The authors tackle watermarking for LLM-based agents that make sequences of tool calls and decisions, not just generate text. Existing behavioral watermarks treat each action independently, so they break when the agent's trajectory gets shuffled, truncated, or corrupted. SeqWM instead embeds the watermark signal into history-conditioned transition patterns—the order and dependencies between actions—and verifies trajectories without requiring exact position alignment, making it robust to real-world perturbations while preserving the agent's task performance.
Main takeaways:
- Text watermarks don't capture action-level decisions, so agent provenance needs behavioral watermarks embedded in the sequence of tool calls and choices the agent makes.
- Earlier agent watermarking methods treat each action step as independent, so they fail when trajectories are corrupted, truncated, or reordered.
- SeqWM embeds signals into patterns across multiple steps (conditioned on history) and can verify a trajectory even when you can't align it step-by-step with the original.
- Experiments across multiple agent benchmarks and LLM backbones show reliable detection with no loss in task performance, and the watermark survives corruptions that break round-indexed methods.