给智能体的决策行为打水印，保护知识产权且不影响任务效果。
AgentMark: Utility-Preserving Behavioral Watermarking for Agents
- 通过条件采样在规划层嵌入多比特标识，不改变行为分布。
- 在多种环境中实现多比特水印，部分日志丢失仍可恢复。
- 适用于黑箱接口，兼容内容级水印，适合部署于真实智能体系统。
基于大模型的智能体正被广泛用于自主完成复杂任务，亟需知识产权保护与监管溯源。现有内容水印虽能追踪生成输出，却无法直接识别影响多步执行的高层规划行为（如工具选择、子目标设定）。关键挑战在于：规划层水印易因决策分布微小偏移在长期运行中累积，导致任务效用下降，且多数智能体为黑箱，难以直接干预。为此，我们提出AgentMark，一种行为水印框架，在保留任务效用的前提下，将多比特标识嵌入规划决策。其通过显式获取智能体的行为分布，并采用分布保持的条件采样策略，支持在黑箱API下部署，同时兼容动作层内容水印。在具身、工具使用及社交环境中的实验表明，该方法具备实用的多比特容量，对部分日志缺失具有鲁棒性，且有效保持任务性能。代码已开源：https://github.com/Tooooa/AgentMark。
原文摘要 · Abstract (English)
LLM-based agents are increasingly deployed to autonomously solve complex tasks, raising urgent needs for IP protection and regulatory provenance. While content watermarking effectively attributes LLM-generated outputs, it fails to directly identify the high-level planning behaviors (e.g., tool and subgoal choices) that govern multi-step execution. Critically, watermarking at the planning-behavior layer faces unique challenges: minor distributional deviations in decision-making can compound during long-term agent operation, degrading utility, and many agents operate as black boxes that are difficult to intervene in directly. To bridge this gap, we propose AgentMark, a behavioral watermarking framework that embeds multi-bit identifiers into planning decisions while preserving utility. It operates by eliciting an explicit behavior distribution from the agent and applying distribution-preserving conditional sampling, enabling deployment under black-box APIs while remaining compatible with action-layer content watermarking. Experiments across embodied, tool-use, and social environments demonstrate practical multi-bit capacity, robust recovery from partial logs, and utility preservation. The code is available at https://github.com/Tooooa/AgentMark.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。