给大模型智能体的决策轨迹加数字水印，防数据盗用。
Watermarking LLM Agent Trajectories
- 用秘密密钥触发隐藏动作，不改变任务结果。
- 在数学推理等任务中检测准确率达94.3% AUC。
- 适合保护高价值智能体数据的创作者使用。
大模型智能体依赖高质量的轨迹数据来指导问题求解行为，但生成此类数据需大量任务设计、高容量模型生成和人工筛选。尽管成本高昂，现有研究却忽视了对智能体轨迹的数据版权保护，导致创作者易受数据窃取，难以追溯滥用或主张所有权。本文提出首个专用于智能体轨迹数据的水印方法 ActHook。受软件工程中“钩子”机制启发，ActHook 在决策点嵌入仅由秘密密钥激活的钩子动作，不影响原任务结果。由于大模型智能体按序执行，钩子可无缝插入。当密钥存在时，经水印数据训练的智能体产生钩子动作的概率显著提高，支持可靠的黑盒检测。在数学推理、网络搜索和软件工程智能体上测试显示，ActHook 在 Qwen-2.5-Coder-7B 上平均检测 AUC 达 94.3%，且性能损耗可忽略。
原文摘要 · Abstract (English)
LLM agents rely heavily on high-quality trajectory data to guide their problem-solving behaviors, yet producing such data requires substantial task design, high-capacity model generation, and manual filtering. Despite the high cost of creating these datasets, existing literature has overlooked copyright protection for LLM agent trajectories. This gap leaves creators vulnerable to data theft and makes it difficult to trace misuse or enforce ownership rights. This paper introduces ActHook, the first watermarking method tailored for agent trajectory datasets. Inspired by hook mechanisms in software engineering, ActHook embeds hook actions that are activated by a secret input key and do not alter the original task outcome. Like software execution, LLM agents operate sequentially, allowing hook actions to be inserted at decision points without disrupting task flow. When the activation key is present, an LLM agent trained on watermarked trajectories can produce these hook actions at a significantly higher rate, enabling reliable black-box detection. Experiments on mathematical reasoning, web searching, and software engineering agents show that ActHook achieves an average detection AUC of 94.3 on Qwen-2.5-Coder-7B while incurring negligible performance degradation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。