💬 NLP

Watermarking LLM Agent Trajectories

This paper introduces ActHook, the first watermarking method designed to protect LLM agent trajectory datasets by embedding secret-activated hook actions that enable reliable black-box ownership detection without compromising task performance.

Original authors: Wenlong Meng, Chen Gong, Terry Yue Zhuo, Fan Zhang, Kecen Li, Zheng Liu, Zhou Yang, Chengkun Wei, Wenzhi Chen

Published 2026-02-24

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Wenlong Meng, Chen Gong, Terry Yue Zhuo, Fan Zhang, Kecen Li, Zheng Liu, Zhou Yang, Chengkun Wei, Wenzhi Chen

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a master chef who has spent years perfecting a secret recipe book. This book doesn't just contain ingredients; it contains the exact step-by-step process of how you cook a dish: when to chop, when to stir, when to taste, and what to do if the sauce burns.

In the world of Artificial Intelligence, these "recipe books" are called Agent Trajectories. They are records of how an AI solves complex problems (like writing code, searching the web, or solving math) step-by-step. Creating these records is incredibly expensive and time-consuming. It's like hiring a team of expert chefs to cook thousands of meals just to film the process.

The Problem:
Once you publish these "recipe books" for others to learn from, you lose control. Someone could take your expensive, high-quality recordings, train their own AI on them, and sell the result as their own invention. There's no way to prove, "Hey, that AI learned from my recipe book!"

The Solution: ACTHOOK
The paper introduces a clever solution called ACTHOOK. Think of it as a secret handshake hidden inside the recipe book.

Here is how it works, broken down into simple concepts:

1. The "Hook" (The Secret Handshake)

In software engineering, a "hook" is a tiny piece of code that lets you pause a program and do something extra without breaking the main flow.

The Analogy: Imagine you are teaching a student to cook. You tell them, "Every time you chop an onion, pause for a second and say, 'The onion is ready,' before moving on."
The Catch: You only want them to say this phrase if you give them a secret code word (like "It's a thorny issue"). If you don't say the code word, they just chop the onion and move on normally.

2. How It's Hidden (The Watermark)

The researchers take their expensive "recipe books" (the trajectory data) and insert these "pause and speak" moments into the AI's training data.

They add a secret key (the code word) to the instructions.
They add the "hook action" (the pause and speak) to the AI's steps.
Crucially: This doesn't change the final dish. The AI still solves the math problem or fixes the code perfectly. The "hook" is just a tiny, invisible habit it learns to do only when it hears the secret key.

3. The "Black Box" Test (Checking the Handshake)

Now, imagine you suspect a rival chef is using your recipe book. You don't need to see their kitchen; you just need to test their AI.

You ask the rival's AI to solve a problem.
Test A: You give it a normal prompt. The AI solves it normally.
Test B: You give it the same prompt but whisper the secret code word.
The Result: If the rival's AI was trained on your data, it will suddenly start doing that weird "pause and speak" habit (the hook action) because it learned to associate the code word with that specific action. If they didn't use your data, the AI will ignore the code word and act normally.

Why This Is Brilliant

It's Invisible: Just like a secret handshake, the AI behaves perfectly normally unless you know the secret. It doesn't ruin the quality of the work.
It's Robust: Even if someone tries to "paraphrase" the recipe (rewrite the steps in different words) or summarize the cooking process, the habit of checking the file or saying the phrase remains. It's a behavior, not just a specific word.
It's Efficient: The researchers found that even if they only watermarked a tiny fraction of the data (like 5%), the AI still learned the secret handshake perfectly.

The Big Picture

ACTHOOK is like putting a digital "copyright stamp" on the behavior of an AI, not just the text it writes. It allows creators of high-quality AI training data to prove ownership, protect their investment, and ensure that if their data is stolen, they can catch the thief with a simple, secret test.

In short: It turns the AI's own habits into a secret code that only the data owner knows how to unlock.

1. Problem Statement

Large Language Model (LLM) agents rely heavily on high-quality trajectory datasets (sequential records of actions and observations) to learn problem-solving behaviors. Creating these datasets is expensive, requiring significant task design, model generation, and manual filtering (e.g., ~$100 per task for code agents).

However, existing literature lacks mechanisms to protect the intellectual property (IP) of these trajectory datasets. Once released, creators cannot trace if their data is used for unauthorized commercial training or redistributed in violation of licenses.

Limitations of Existing Methods: Current watermarking techniques for LLMs (e.g., modifying token distributions or rephrasing text) are ineffective for agent trajectories because:
1. Heterogeneous Structure: Trajectories interleave model-generated actions with environment-generated observations. Only action tokens are trainable; observations are masked during training. Standard text/code watermarks do not account for this.
2. Data Scarcity: Trajectory datasets are small (1–2K samples). Existing methods require high watermark ratios to be learnable, which compromises stealthiness in small datasets.
3. Learnability: Modifying tokens within low-entropy action sequences is difficult for models to learn without degrading performance.

2. Methodology: ACTHOOK

The authors propose ACTHOOK, the first watermarking framework tailored specifically for LLM agent trajectory datasets. It operates at the behavioral level rather than the token or syntactic level, inspired by "hooks" in software engineering.

Core Concept

Instead of altering the text of an action, ACTHOOK inserts auxiliary "hook actions" into the trajectory. These actions are triggered only when a specific secret activation key is present in the user prompt.

Mechanism: The hook action is an auxiliary operation (e.g., checking a file existence, verifying a library version) that does not alter the final task outcome but serves as a detectable signal.
Trigger: A semantically neutral phrase (the key) is appended to the input prompt. If the model was trained on watermarked data, it learns to execute the hook action with high probability only when this key is present.

Technical Components

Watermark Injection ($W.INJECT$):
- Filtering: Trajectories are filtered via $W.CHECK$ to ensure they contain the necessary structural context for the hook (e.g., a file creation step for a "file check" hook).
- Insertion: An auxiliary LLM generates a hook action-observation pair $(a_h, o_h)$ and inserts it at an action boundary.
- Entropy Optimization: The paper analyzes token entropy and finds that entropy peaks at the start of an action (high uncertainty). ACTHOOK inserts hooks at these boundaries, making them easier for the model to learn compared to inserting them mid-action where entropy is low.
- Key Appending: The secret activation key is appended to the user prompt.
Watermark Detection ($W.DETECT$):
- Black-Box Querying: The detector queries the suspect agent with $N$ prompts. For each prompt, it runs $Q$ queries: one with the activation key ( $k$ ) and one with a sham key ( $\tilde{k}$ ) or no key.
- Statistical Analysis: It calculates the hook action emergence rate ( $\hat{q}$ ) for both conditions.
- Decision Metric: The detection score is the difference in rates: $\hat{\Delta q} = \hat{q}_k - \hat{q}_c$ . A significantly positive $\hat{\Delta q}$ indicates the model was trained on watermarked data.
- Statistical Test: A paired one-sided t-test is used to determine statistical significance, ensuring robustness against random fluctuations.

Types of Watermarks

Standalone: Hooks are semantically independent and can be inserted anywhere (e.g., pwd command). Easier to learn.
Contextual: Hooks depend on the preceding action (e.g., ls -la immediately after a file creation). Harder to detect via manual inspection but requires specific trajectory structures.

3. Key Contributions

First Framework for Agent Trajectories: Introduces the first watermarking method designed specifically for the unique action-observation structure of LLM agents.
Behavior-Level Watermarking: Shifts the paradigm from token-level manipulation to behavioral patterns, offering robustness against paraphrasing and summarization attacks.
Entropy-Guided Injection: Leverages the high-entropy nature of action boundaries to ensure the watermark is learnable even with small datasets (1–2K samples).
Theoretical Guarantees: Provides a sample complexity analysis (Theorem 3.1) proving that detection reliability scales quadratically with the effect size ( $\Delta q$ ).

4. Experimental Results

The method was evaluated on three benchmarks: MATH (reasoning), SimpleQA (web search), and SWE-Smith (software engineering), using Qwen-2.5-Coder models (3B, 7B, 14B).

Detection Performance:
- ACTHOOK achieved an average AUC of 94.3 on the 7B model.
- It maintained high detection (AUC > 85) even with a single prompt ( $N=1$ ) and 8 queries ( $Q=8$ ).
- Baseline Comparison: State-of-the-art code watermarking (CodeMark) failed completely (AUC $\approx$ 50-56), performing no better than random guessing, confirming the ineffectiveness of token-level methods for this task.
Performance Preservation:
- Fine-tuning with ACTHOOK incurred negligible performance degradation in Pass@1 scores across all datasets.
- In some cases (e.g., SWE-Bench), performance actually improved slightly due to the fine-tuning process itself, with no negative impact from the watermark.
Robustness to Attacks:
- DeCoMa Filtering: ACTHOOK remained robust (AUC > 95) against dataset filtering attacks that successfully removed CodeMark.
- Paraphrasing: Standalone watermarks remained highly robust (AUC > 99). Contextual watermarks showed minor degradation (~5% AUC drop) on complex tasks but remained detectable.
- Action Summarization: Since detection relies on semantic meaning rather than syntax, ACTHOOK remained effective even when action details were summarized (AUC drop < 2%).
Hyperparameter Sensitivity:
- Model Size: Larger models (14B) learned the watermark more effectively than smaller ones (3B).
- Watermark Ratio: Effective detection was achieved with low ratios ( $R=0.05$ ), and standalone watermarks worked even at $R=0.01$ .

5. Significance and Impact

IP Protection for AI Data: Provides a practical solution for dataset creators to protect their investment in high-quality agent trajectories, encouraging more open data sharing.
Traceability: Enables the tracing of model provenance, allowing creators to enforce licensing terms (e.g., non-commercial use) and detect unauthorized commercial deployment.
New Paradigm: Establishes "behavior-level watermarking" as a viable and superior approach for complex, sequential agent tasks, moving beyond the limitations of traditional text/code watermarking.
Low Overhead: The method requires minimal computational overhead during injection and does not degrade the utility of the trained agents.

In conclusion, ACTHOOK successfully bridges the gap between the high cost of creating agent datasets and the lack of copyright protection, offering a robust, stealthy, and statistically sound method for ownership verification in the era of agentic AI.