Security papers — 2026-10-21

Today's focus is on how to track the actual decisions an LLM agent makes because current methods struggle to prove who created a specific sequence of actions. This problem matters because without knowing the source of behavior, establishing ownership or preventing unauthorized reuse becomes nearly impossible when agents operate through long sequences of executable decisions.

The work that matters most is SeqWM, which introduces a sequential behavioral watermarking framework designed to embed signals directly into history-conditioned transition patterns. This approach moves the watermark from just the generated text to the agent's actual choices, addressing a gap where previous agent watermarking methods treated each step as an isolated trial and ignored the overall trajectory structure.

This is supported by prior work like <a href="/papers/2604.01730">AKMPC</a>, which also tackles this issue by embedding watermarks into behavioral choices. However, the authors of SeqWM argue that existing methods are too fragile when trajectories are corrupted or truncated because they do not account for the trajectory structure. SeqWM proposes embedding signals into these history-conditioned patterns and then verifying the resulting trajectories against random-key baselines in a position-agnostic way.

The experiments show that SeqWM reliably detects these embedded signals while keeping the agent useful, even when trajectories are corrupted, which is a significant improvement over previous techniques that collapse under trajectory perturbation. This framework builds upon the idea of behavioral watermarking by focusing on the sequence itself rather than just individual steps.

Today's papers

The papers

Important terms

LLM agent decision tracking
This is about figuring out exactly what choices an AI agent makes during a long sequence of actions, which is hard to do now. The goal is to prove who created a specific behavior by tracking the actual decisions.
SeqWM
This new framework embeds secret signals directly into how an agent transitions between states based on its history. It focuses on the entire path, not just single steps, making it more robust.
Sequential behavioral watermarking
This is a technique used to put hidden markers into the patterns of an agent's choices over time. It targets the overall trajectory structure rather than treating each step in isolation.
Trajectory corruption robustness
A key improvement is that SeqWM works even when parts of the agent's path are messed up or cut off. This is because it embeds signals into history-conditioned patterns, making it more resilient to errors.