Session-Bound Behavioral Watermarking for Autonomous LLM Agents

What it is

AgentAnchor is a behavioral watermark for LLM agent trajectory logs, from Deakin University, Singapore Institute of Technology and Griffith University (arXiv 2610.38579v1, 28 October 2026). It lets an owner holding a secret key attribute a disputed log, and it is designed so that parties who see many logs cannot learn the watermark and forge new ones. The fetched text cuts off in Section 3.1, so the results tables and the verification details are not covered here.

How it works

At each step the agent scores its admissible actions with its own model, using length-normalized token log-likelihood, to get a distribution. The step key is an HMAC over the owner's secret, a fresh public 128-bit session ID, and semantic clusters of recent observations. A perturbation-tolerant digest of the most probable actions picks a coding row. Each eligible step embeds one parity bit of an 8-bit owner ID (256 candidates) by tilting the distribution toward one half of a keyed action split. Each step's KL divergence from the original is bounded by a budget η.

The verifier recomputes keys from the logged record, so it does not rerun the agent. It decodes the payload from logged actions and probabilities, calibrates against many wrong keys, and attributes only if the evidence is significant and points to a unique owner. Otherwise it abstains.

The forgery finding

The paper's main claim is that earlier schemes key on context that recurs across runs: step index (AgentMark), previous actions (SeqWM, TRACE) or file names (TrajMark). An observer can then learn the keyed preferences. In a post-hoc replay on ALFWorld, an attacker observed N = 200 watermarked logs and rewrote 50 unwatermarked trajectories.

Evaluation covers ALFWorld (50 tasks) and WebShop-1K.

Preconditions

• The log must carry the action set, the fixed-point action probabilities, the session ID and the codebook version.
• Session IDs must be fresh and authentic, for example issued by the verifier or by the gateway or marketplace that starts the session. A missing or inconsistent ID makes the verifier abstain. A different but valid ID is treated as a session-replacement attack.
• The verifier must hold the secret key, and key holders are assumed honest, since a key holder can produce evidence for any payload.
• The action set must be enumerable. WebShop free-text search is handled by having the model write one query without the key, which becomes the only admissible action.

Caveats

• Unlike AgentMark and MemMark, the tilt changes the action distribution, and the verifier trusts the logged probabilities.
• AgentAnchor does not authenticate logs or prevent replay.
• Forgery results apply only to the implemented attackers. When the attacker has already observed the target's session, the protection is lost, which the authors test as a session-reuse condition.
• The authors treat edited copies of authentic logs as removal attempts, not forgery.
• Removal robustness (renumbering, paraphrase, erasure, reordering and others) is evaluated, but its numbers are not in the fetched text.