AgentAnchor watermarks LLM agent logs against cross-session forgery
Original title: Session-Bound Behavioral Watermarking for Autonomous LLM Agents
A trusted verifier checks a disputed trajectory without rerunning the agent, using wrong-key calibration and abstention.
The paper defines a learned-forgery threat in which repeated observation of watermarked LLM-agent trajectories lets an adversary forge later sessions by copying action preferences. AgentAnchor embeds owner evidence in action choices with a session key derived from a secret, a fresh public session identifier and recent semantic states. Parity evidence is added through a KL-bounded exponential tilt, and a guarded digest of the action-policy state varies the coding rows. The scheme targets logs that pass through web APIs, marketplaces and tool servers.
- Existing methods mainly cover detection, removal, rewriting or imitation, not cross-session forgery.
- Each step key mixes a secret, a public session id and recent observations.
- Embedding uses a KL-bounded exponential tilt of the action policy.
- Verification does not require rerunning the agent.
From the original article
1 min read at arxiv.orgLarge Language Model (LLM) agents are increasingly acting through Web interfaces and external tools. They produce trajectories. Those trajectories may pass through several intermediaries.
By Md Facklasur Rahaman · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.