arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2602.18700cs.CRcs.CL
收藏

对LLM代理轨迹进行水印标记

Watermarking LLM Agent Trajectories

Zhejiang University, China(浙江大学);University of Virginia, USA(弗吉尼亚大学);Alibaba Qwen, China(阿里巴巴通义实验室);University of Alberta, Canada(阿尔伯塔大学)

Wenlong Meng, Chen Gong, Terry Yue Zhuo, Fan Zhang, Kecen Li, Zheng Liu, Zhou Yang, Chengkun Wei, Wenzhi Chen

AI总结:

本文提出ActHook,一种针对LLM代理轨迹数据集的水印方法,通过在决策点插入钩子动作实现可靠的黑盒检测,实验显示其在数学推理等任务中具有高检测精度且性能影响小。

摘要:

LLM代理严重依赖高质量轨迹数据来指导其解决问题的行为,但生成此类数据需要大量的任务设计、高容量模型生成和人工过滤。尽管创建这些数据集的成本很高,但现有文献却忽略了对LLM代理轨迹的版权保护。这一空白使创作者容易遭受数据盗用,并使追踪滥用和执行所有权权利变得困难。本文介绍了ActHook,这是首个专门针对代理轨迹数据集的水印方法。受软件工程中的钩子机制启发,ActHook嵌入了由秘密输入密钥激活的钩子动作,并且不会改变原始任务结果。就像软件执行一样,LLM代理是按顺序运行的,这允许在决策点插入钩子动作而不会破坏任务流程。当激活密钥存在时,一个在水印轨迹上训练的LLM代理可以显著提高产生这些钩子动作的速率,从而实现可靠的黑盒检测。在数学推理、网络搜索和软件工程代理上的实验表明,ActHook在Qwen-2.5-Coder-7B上实现了平均检测AUC为94.3,同时几乎没有引起性能下降。

英文摘要:

LLM agents rely heavily on high-quality trajectory data to guide their problem-solving behaviors, yet producing such data requires substantial task design, high-capacity model generation, and manual filtering. Despite the high cost of creating these datasets, existing literature has overlooked copyright protection for LLM agent trajectories. This gap leaves creators vulnerable to data theft and makes it difficult to trace misuse or enforce ownership rights. This paper introduces ActHook, the first watermarking method tailored for agent trajectory datasets. Inspired by hook mechanisms in software engineering, ActHook embeds hook actions that are activated by a secret input key and do not alter the original task outcome. Like software execution, LLM agents operate sequentially, allowing hook actions to be inserted at decision points without disrupting task flow. When the activation key is present, an LLM agent trained on watermarked trajectories can produce these hook actions at a significantly higher rate, enabling reliable black-box detection. Experiments on mathematical reasoning, web searching, and software engineering agents show that ActHook achieves an average detection AUC of 94.3 on Qwen-2.5-Coder-7B while incurring negligible performance degradation.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑