💻 computer science

Sequential Behavioral Watermarking for LLM Agents

본 논문은 에이전트의 유용성을 유지하면서 기존 방법들이 독립적인 시도로 행동을 처리함으로써 발생하는 취약성을 극복하고, 히스토리 조건부 에이전트 전이 패턴에 소유권 신호를 임베딩하여 견고하고 위치 무관한 궤적 검증을 가능하게 하는 순차적 행동 워터마킹 프레임워크인 SeqWM 을 소개합니다.

원저자: Hyeseon An, Shinwoo Park, Dongsu Kim, Yo-Sub Han

게시일 2026-05-13

📖 1 분 읽기☕ 가벼운 읽기

CC BY 4.0

원저자: Hyeseon An, Shinwoo Park, Dongsu Kim, Yo-Sub Han

원본 논문은 CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/) 라이선스로 제공됩니다. ✨ 이것은 아래 논문에 대한 AI 생성 설명입니다. 저자가 작성하거나 승인한 것이 아닙니다. 기술적 정확성을 위해서는 원본 논문을 참조하세요. 전체 면책 조항 읽기

LLM 에이전트를 위한 순차적 행동 워터마킹 (SeqWM) 논문에 대한 설명을 일상적인 언어와 창의적인 비유로 번역한 내용입니다.

큰 문제: "블랙박스" 에이전트

복잡한 작업, 예를 들어 여행 계획 수립이나 코드 디버깅을 위해 고도로 숙련된 로봇 보조원 (LLM 에이전트) 을 고용했다고 상상해 보세요. 이 로봇은 최종 보고서만 작성하는 것이 아니라, "날씨를 확인하자", 그다음 "비행기 표를 예약하자", 그다음 "택시를 부르자"와 같은 긴 결정의 연쇄를 만듭니다.

문제: 이러한 행동 목록을 보게 되면, 어떤 로봇이 이를 수행했는지 어떻게 알 수 있을까요?

당신의 로봇이 한 것일까요?
경쟁사의 로봇이 한 것일까요?
해커가 당신의 로봇의 "두뇌"를 도용하여 정확히 같은 일을 하는 복제본을 만들었을까요?

현재로서는 이를 구분하기 매우 어렵습니다. 로봇의 내부 사고 과정 (생성된 텍스트) 은 종종 숨겨져 있고, 우리는 최종 행동만 볼 수 있습니다. 누군가 당신의 로봇 행동을 복제한다면, 당신은 모른 채 지적 재산권을 도당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당당

기술 요약: LLM 에이전트를 위한 순차적 행동 워터마킹 (SeqWM)

1. 문제 제기

대형 언어 모델 (LLM) 에이전트는 텍스트 생성기에서 외부 환경을 계획하고, 도구를 호출하며 상호작용하는 자율적 의사결정자로 진화했습니다. 이러한 변화는 중요한 출처 (provenance) 격차를 만들어냈습니다. 즉, 이러한 에이전트의 지적 재산은 고가의 궤적 데이터에 대한 사후 학습을 통해 획득된 의사결정 능력에 있지만, 궤적 자체는 무단 복제 및 모방 공격에 취약한 귀중한 자산이라는 점입니다.

기존 LLM 워터마킹 솔루션은 주로 토큰 수준에서 작동하여 어휘 토큰의 샘플링에 편향을 가합니다. 그러나 이 접근법은 에이전트에게는 두 가지 이유로 실패합니다:

불일치 단위: "도구 X 호출"과 같은 고수준 에이전트 의사결정은 많은 토큰을 통해 실현됩니다. 토큰 수준의 편향은 실제 행동에 영향을 미치기 전에 신호를 희석시킵니다.
관측 한계: 많은 배포된 에이전트 시스템 (설문 플랫폼의 82.8%) 에서 내부 추론 흔적과 중간 토큰은 숨겨져 있으며, 탐지기는 최종 행동 스트림만 관측합니다. 결과적으로 토큰 수준의 신호는 검증 전에 폐기됩니다.

최근 행동 워터마킹 시도들은 각 행동 단계를 독립적인 시도로 간주하며, 종종 절대 라운드 인덱스를 기반으로 워터마킹을 시드합니다. 이 접근법은 취약합니다. 궤적이 잘리거나 삭제되거나 완벽한 정렬 없이 관측되면 인덱스가 이동하여 탐지기가 워터마킹 논리와 정렬되지 않게 되고, 전체 시퀀스가 탐지 불가능해지기 때문입니다.

2. 방법론: SeqWM

저자들은 SeqWM을 제안합니다. 이는 마진 행동 빈도나 절대 위치가 아닌 이력 조건부 전이 패턴에 워터마킹 신호를 내장하는 프레임워크입니다. 이 방법은 세 가지 핵심 구성 요소로 이루어집니다:

A. 이력 조건부 다중 채널 인코딩

절대 단계 인덱스 $t$ 를 사용하여 워터마킹을 시드하는 대신, SeqWM 은 선행 행동의 윈도우 $c_t = (b_{t-w}, \dots, b_{t-1})$ 를 시드로 사용합니다.

메커니즘: 비밀 키 $K$ 에 대해, 시스템은 키가 있는 해시 함수를 사용하여 $m$ 개의 독립적인 채널 각각에 대한 후보 행동의 의사무작위 부분집합 $B^{(j)}_{g,t}$ 를 유도합니다: $B^{(j)}_{g,t} = G_K(c_t \parallel j)$ .
편향: 에이전트의 행동 분포 $P_t$ 는 특정 행동 $b$ 를 선호하는 채널 수를 세는 다중 채널 점수 $s_t(b)$ 를 기반으로 한 지수 기울기를 통해 워터마킹된 분포 $P^{wm}_t$ 로 수정됩니다.
효과: 워터마킹은 $b_t$ 의 마진 빈도가 아닌 조건부 전이 $P(b_t | c_t)$ 에 편향을 줍니다. 이는 적대자가 마진 분포를 일치시키더라도 신호가 살아남도록 보장합니다.

B. 슬라이딩 윈도우 탐지

탐지기는 위치 무관적으로 작동합니다. 관측된 시퀀스의 절대 단계 인덱스를 알 필요에 의존하지 않습니다.

메커니즘: 탐지기는 관측된 행동 시퀀스 $\hat{b}$ 위에 크기 $w$ 의 윈도우를 슬라이딩합니다. 길이 $w$ 의 모든 부분 문자열에 대해, 해당 특정 이력과 비밀 키에서 유도된 가이드 부분집합과 후속 행동이 일치하는지 확인합니다.
강건성: 동일한 이력 윈도우가 절대 위치에 관계없이 결정적으로 동일한 가이드 부분집합을 산출하기 때문에, 탐지기는 잘리거나 손상된 시퀀스의 유효한 전이 중 어디서든 증거를 집계할 수 있습니다. 이는 단일 삭제가 모든 후속 인덱스를 이동시켜 전역적 정렬 불일치를 초래하는 라운드 인덱스 기반 탐지기와 대조됩니다.

C. 랜덤 키 보정

표준 통계 검정 (예: 이항 $z$ -검정) 은 탐지 지표 간의 독립성을 가정하는데, 에이전트 행동의 순차적 특성과 겹치는 윈도우로 인해 이는 여기서 유효하지 않습니다.

해결책: 프레임워크는 관측된 시퀀스 자체를 사용하여 경험적 영분포를 구성합니다. 이는 실제 키 $K$ 를 사용하여 탐지 점수를 계산하고, $M$ 개의 랜덤 "오류" 키 $K_r$ 로 생성된 점수와 비교합니다.
유효성: 오류 키는 시퀀스의 자연스러운 종속성을 유지하지만 워터마킹 정렬을 지우므로, 결과적인 $p$ -값은 분포 자유적이며 적대적 손상 (삭제, 잘림) 하에서도 유효합니다.

3. 주요 기여

프레임워크: 이 논문은 에이전트 워터마킹을 순차적 코딩 문제로 재정의하며 비대칭성을 식별합니다. 생성은 이력을 통해 연결되지만, 검증은 체인을 재구성하지 않고도 로컬 전이 증거를 집계할 수 있습니다.
방법론: 이력 조건부 인코딩, 슬라이딩 윈도우 탐지, 랜덤 키 보정을 결합하여 위치 무관적 검증을 달성하는 SeqWM 을 도입합니다.
이론: 라운드 인덱스 기반 탐지는 삭제 하에서 붕괴되는 반면 (기대 정렬 접두사 길이 $O(1/\rho)$ ), 슬라이딩 윈도우 탐지는 증거의 로컬, 가산적 손실 ( $d(w+1)m$ 개 지표) 만 겪으며 탐지 능력을 유지한다는 이론적 분석을 제공합니다.
경험적 평가: ToolBench, ALFWorld, OASIS 의 세 가지 벤치마크와 Gemma, LLaMA, Qwen 의 세 가지 LLM 백본에 대한 광범위한 실험.

4. 실험 결과

탐지 신뢰성: SeqWM 은 모든 모델과 벤치마크에서 일관되게 통계적으로 유의미한 탐지 ( $p < 0.01$ ) 를 달성하는 반면, 베이스라인 방법 (AgentGuide, AgentMark) 은 특히 OASIS 와 특정 LLM 에서 귀무가설과 분리되지 못해 자주 실패합니다.
삭제에 대한 강건성: 무작위 행동 삭제율이 50% 까지 발생할 때, SeqWM 은 높은 True Positive Rate(TPR) 를 유지합니다. 반면, 라운드 인덱스 기반 베이스라인 (AgentGuide) 은 인덱스 정렬 불일치로 인해 소량의 삭제율 직후 즉시 붕괴됩니다.
유용성 보존: 워터마킹 과정은 에이전트 유용성을 보존합니다. 편향 강도 ( $\gamma$ ) 는 신뢰할 수 있는 탐지를 달성하면서 작업 성능을 크게 저하시키지 않도록 (예: $\gamma=2.0$ ) 조정할 수 있습니다.
다중 채널의 필요성: 제거 실험 (Ablation studies) 은 단일 채널 변형이 높은 편향 강도에서도 신뢰할 수 있는 탐지를 제공하지 못함을 보여주며, 궤적 전반에 걸쳐 충분한 증거를 누적하기 위해 중복 채널이 필수적임을 확인합니다.

5. 중요성 및 주장

이 논문은 순차적 구조가 에이전트 워터마킹에서 단순한 방해 요소가 아니라 출처 신호의 강력한 운반체라고 주장합니다. 워터마킹을 단계별 통계에서 조건부 전이 패턴으로 전환함으로써, SeqWM 은 기존 행동 워터마킹 방법의 고유한 정렬 문제를 해결합니다.

저자들은 SeqWM 을 자율 에이전트 배포에서의 책임성과 사후 감사를 위한 순기능으로 위치시킵니다. 그들은 그들의 접근 방식이 궤적 손상 (삭제, 잘림) 을 전역적 탐지 실패가 아닌 로컬 증거 손실의 원인으로 만든다고 강조합니다. 이 연구는 더 강력한 적응형 공격과 의미 수준의 궤적 편집으로 이러한 관점을 확장하는 것이 향후 연구의 필수 방향임을 시사하지만, 현재 기여는 에이전트 출처 검증을 위한 강건하고 위치 무관적인 기반을 확립합니다.