Watermarking LLM Agent Trajectories

LLM agents rely heavily on high-quality trajectory data to guide their problem-solving behaviors, yet producing such data requires substantial task design, high-capacity model generation, and manual filtering. Despite the high cost of creating these datasets, existing literature has overlooked copyright protection for LLM agent trajectories. This gap leaves creators vulnerable to data theft and makes it difficult to trace misuse or enforce ownership rights. This paper introduces ActHook, the first watermarking method tailored for agent trajectory datasets. Inspired by hook mechanisms in software engineering, ActHook embeds hook actions that are activated by a secret input key and do not alter the original task outcome. Like software execution, LLM agents operate sequentially, allowing hook actions to be inserted at decision points without disrupting task flow. When the activation key is present, an LLM agent trained on watermarked trajectories can produce these hook actions at a significantly higher rate, enabling reliable black-box detection. Experiments on mathematical reasoning, web searching, and software engineering agents show that ActHook achieves an average detection AUC of 94.3 on Qwen-2.5-Coder-7B while incurring negligible performance degradation.

Modern AI assistants no longer just answer questions. They take actions, such as searching the web or running code to finish a task. To learn these skills, they study large collections of recorded successful attempts. Building such a collection can cost hundreds of dollars and many hours of human work for a single task, yet once creators share it, they have no way to tell whether someone has secretly copied it to train a rival AI. So we built a way for them to hide an invisible signature in their data, much like the watermark on a banknote. Our method teaches the AI one small, harmless habit that it performs only when given a secret password. If a suspect AI keeps doing this when shown the password, its owner must have used the protected data. This signature is reliable, resists attempts to erase it, and leaves the AI's real performance untouched, giving data creators a practical way to prove ownership.