Watermarking AI agents to prove ownership without changing behavior
LoRo-Mark:Provably Lossless and Robust Agent Watermarking
Cryptography and Security
Summary
When companies build AI agents, they want to prove ownership even if someone else hides their work inside a new app. The authors found a way to embed secret signatures into an AI’s actions that don’t affect how it normally behaves. These secret clues are hidden in a protected branch that only activates when asked by the owner, so the agent works exactly the same for everyone else. They also spread the clues throughout many action sequences, so even if some parts get changed, the ownership can still be proven reliably.
What this means in practice
- •For ai software developers: Embed robust ownership evidence into AI agents to detect unauthorized repackaging without affecting their normal task performance.
- •For security teams in software companies: Verify ownership of AI-powered services accessed only via APIs even after attempts to alter or rebrand the agent’s behavior.
Authors
Haoyang Zou, Yao Wang, Jun Yao, Weiming Zhang, Han Fang
Abstract
As LLM agents are increasingly deployed as commercial services, protecting proprietary orchestration logic and tool-use policies is important. We consider agent repackaging: an adversary integrates a protected agent into its own application via API and presents it under its own identity. It may modify parts of execution to obscure the source. The owner typically has only black-box access to the repackaged service, so black-box ownership verification is essential. Agent watermarking embeds ownership evidence into agent behavior for later verification. An effective watermark should satisfy two requirements: losslessness, preserving original functionality, and robustness, keeping ownership evidence recoverable after partial modification of execution. Existing methods often embed signals into behavior selection or execution trajectories, intervene in normal decisions, and offer limited robustness to behavior modification. We propose LoRo-Mark, a provably lossless and robust agent watermarking mechanism. For losslessness, it isolates watermarking into a cryptographically authenticated forensic branch that remains inactive during normal execution and is activated only by owner-authorized requests. By reducing unauthorized branch activation to standard MAC security, LoRo-Mark formally guarantees performance preservation. For robustness, it redundantly distributes ownership information across forensic behavior sequences, enabling reliable recovery under partial behavior substitution and sequence truncation. Experiments across multiple LLM agents show zero degradation on normal tasks and reliable ownership verification under sequence modifications.