LoRo-Mark:Provably Lossless and Robust Agent Watermarking

2026-09-28

AI Summary

This study addresses the challenges of copyright protection and black-box ownership verification for LLM agents subjected to malicious repackaging. We propose a provably lossless and robust watermarking mechanism whose core innovation lies in embedding watermarks within an independent cryptographic authentication branch. By integrating cryptographic message authentication codes (MACs) with behavioral sequence redundancy encoding, our approach formally guarantees zero performance degradation during normal execution while significantly enhancing tamper resistance. Experimental results demonstrate that the proposed method achieves lossless task performance across diverse agent architectures. Furthermore, it enables reliable black-box ownership verification even when partial agent behaviors have been adversarially modified.

Abstract

As LLM agents are increasingly deployed as commercial services, protecting proprietary orchestration logic and tool-use policies is important. We consider agent repackaging: an adversary integrates a protected agent into its own application via API and presents it under its own identity. It may modify parts of execution to obscure the source. The owner typically has only black-box access to the repackaged service, so black-box ownership verification is essential. Agent watermarking embeds ownership evidence into agent behavior for later verification. An effective watermark should satisfy two requirements: losslessness, preserving original functionality, and robustness, keeping ownership evidence recoverable after partial modification of execution. Existing methods often embed signals into behavior selection or execution trajectories, intervene in normal decisions, and offer limited robustness to behavior modification. We propose LoRo-Mark, a provably lossless and robust agent watermarking mechanism. For losslessness, it isolates watermarking into a cryptographically authenticated forensic branch that remains inactive during normal execution and is activated only by owner-authorized requests. By reducing unauthorized branch activation to standard MAC security, LoRo-Mark formally guarantees performance preservation. For robustness, it redundantly distributes ownership information across forensic behavior sequences, enabling reliable recovery under partial behavior substitution and sequence truncation. Experiments across multiple LLM agents show zero degradation on normal tasks and reliable ownership verification under sequence modifications.

Problem

• Agent Watermarking
• Ownership Verification
• Agent Repackaging
• Losslessness
• Robustness

Innovation

• Agent Watermarking
• Lossless
• Robustness
• Forensic Branch
• Black-box Verification