Agent Guide: A Simple Agent Behavioral Watermarking Framework
On the map: LLM agents and tool use → Agent threats, guardrails and governance
also in 1 more
Abstract (arXiv)
The increasing deployment of intelligent agents in digital ecosystems, such as social media platforms, has raised significant concerns about traceability and accountability, particularly in cybersecurity and digital content protection. Traditional large language model (LLM) watermarking techniques, which rely on token-level manipulations, are ill-suited for agents due to the challenges of behavior tokenization and information loss during behavior-to-action translation. To address these issues, we propose Agent Guide, a novel behavioral watermarking framework that embeds watermarks by guiding the agent's high-level decisions (behavior) through probability biases, while preserving the naturalness of specific executions (action). Our approach decouples agent behavior into two levels, behavior (e.g., choosing to bookmark) and action (e.g., bookmarking with specific tags), and applies watermark-guided biases to the behavior probability distribution. We employ a z-statistic-based statistical analysis to detect the watermark, ensuring reliable extraction over multiple rounds. Experiments in a social media scenario with diverse agent profiles demonstrate that Agent Guide achieves effective watermark detection with a low false positive rate. Our framework provides a practical and robust solution for agent watermarking, with applications in identifying malicious agents and protecting proprietary agent systems.
Key facts. Cited by 10 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 19 of its 28 references that are in the map. First posted on arXiv 8 Apr 2025.
Builds on
19 of 28 references.
References · 19
- 2020Language Models are Few-Shot Learnerscited by 32,419
- 2023GPT-4 Technical Reportcited by 18,396
- 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,330
- 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,568
- 2023MetaGPT: Meta Programming for A Multi-Agent Collaborative Frameworkcited by 1,808
- 2023A Watermark for Large Language Modelscited by 725
- 2023S3: Social-network Simulation System with Large Language Model-Empowered Agentscited by 233
- 2025AgentSociety: Large-Scale Simulation of LLM-Driven Generative Agents Advances Understanding of Human Behaviors and Societycited by 186
- 2023FinMem: A Performance-Enhanced LLM Trading Agent with Layered Memory and Character Designcited by 164
- 2023Can Sensitive Information Be Deleted From LLMs? Objectives for Defending Against Extraction Attackscited by 158
- 2023User Behavior Simulation with Large Language Model based Agentscited by 140
- 2024AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathwayscited by 127
7 more
- 2024MarkLLM: An Open-Source Toolkit for LLM Watermarkingcited by 95
- 2024Unveiling the Truth and Facilitating Change: Towards Agent-based Large-scale Social Movement Simulationcited by 71
- 2023Are You Copying My Model? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermarkcited by 67
- 2023Are LLMs All You Need for Task-Oriented Dialogue?cited by 54
- 2024CodeIP: A Grammar-Guided Multi-Bit Watermark for Large Language Models of Codecited by 24
- 2024Waterfall: Framework for Robust and Scalable Text Watermarking and Provenance for LLMscited by 15
- 2019Behavioral Security in Covert Communication Systemscited by 2
Built on by
Citing papers per year: 2025: 2; 2026: 8.
10 papers.
- 2026MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systemscited by 16
- 2026AgentMark: Utility-Preserving Behavioral Watermarking for Agentscited by 8
- 2026On Protecting Agentic Systems' Intellectual Property via Watermarkingcited by 8
- 2025Large Language Model Sourcing: A Surveycited by 5
- 2026Sequential Behavioral Watermarking for LLM Agentscited by 5
- 2026TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectoriescited by 5
- 2025Remotely Detectable Robot Policy Watermarkingcited by 2
- 2026Who Is Behind the Harness? Fingerprinting LLMs through Agentic Behaviorcited by 0
- 2026Semantic Behavioral Watermarking: Paraphrase-Robust and Forgery-Resistant Provenance for LLM Agentscited by 0
- 2026Embedding Information in Policy Randomness: Distribution-Preserving Implicit Communication in MDPscited by 0
- 2026Embedding Information in Policy Randomness: Distribution-Preserving Implicit Communication in MDPs11 Oct 2026
- 2026Semantic Behavioral Watermarking: Paraphrase-Robust and Forgery-Resistant Provenance for LLM Agents6 Oct 2026
- 2026Who Is Behind the Harness? Fingerprinting LLMs through Agentic Behavior23 Sep 2026
- 2026TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories9 Jul 2026
- 2026MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systems24 May 2026
- 2026Sequential Behavioral Watermarking for LLM Agents11 May 2026
- 2026On Protecting Agentic Systems' Intellectual Property via Watermarking9 Feb 2026
- 2026AgentMark: Utility-Preserving Behavioral Watermarking for Agents5 Jan 2026
- 2025Remotely Detectable Robot Policy Watermarking17 Dec 2025
- 2025Large Language Model Sourcing: A Survey11 Oct 2025
Similar, not cited
Close in wording, no citation either way
- 2026SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification
- 2026Watermarking LLM Agent Trajectories
- 2026Known By Their Actions: Fingerprinting LLM Browser Agents via UI Traces
- 2026TrajMark: Ownership Attribution and Segment-Level Tamper Localization for Coding-Agent Trajectories
- 2026Watermarking Game-Playing Agents in Perfect-Information Extensive-Form Games
- 2026Who Gets Flagged? The Pluralistic Evaluation Gap in AI Content Watermarking
- 2026TraceDance: An Automated System for Building Agent Behavior Benchmarks from Real-World Agent Deployment Traces
- 2026From Forensics to Ecosystems: Rethinking Watermarks for Generative AI Oversight