Semantic Behavioral Watermarking: Paraphrase-Robust and Forgery-Resistant Provenance for LLM Agents
Semantic Behavioral Watermarking marks LLM-agent actions so provenance survives paraphrasing and resists forged trajectories.
Semantic Behavioral Watermarking embeds an owner identifier in an LLM agent's semantic action clusters, using history conditioning and keyed collision-resistant binning. Across five models from 3B to 14B, including Qwen2.5-3B, ToolBench detection under rewriting is 0.49–0.66 versus 0.05–0.17 for exact-symbol watermarks at a 1% false-positive rate, with 72–83% choice agreement. On ALFWorld detection is 0.92–0.97 versus near zero. Keyed binning reduces adaptive forgery to the false-positive floor, but chained replay of copied steps remains 0.76–0.98 and is reported as open.
- Watermarks semantic action clusters rather than exact tool symbols
- ToolBench rewrite detection is 0.49–0.66 versus 0.05–0.17 for symbol binding
- Keyed binning drops adaptive forgery to the false-positive floor
- Chained replay of a victim's own steps remains 0.76–0.98
- AI models
- Qwen2.5-3B
From the original article
1 min read at arxiv.orgBehavioral watermarking embeds an owner identifier in an LLM agent's high-level action choices, giving provenance without touching output tokens. Prior agent watermarks break in two ways.
By Suxin Ji · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.