AuxMark: Defending Against Unauthorized Agent Distillation via Auxiliary Behavioral Watermarking

1 INTRODUCTION

• Existing approaches face agent-specific gaps: text or reasoning-trace watermarks can break tool-call formats, shared-base-model assumptions hinder cross-architecture distillation, and execution similarity can reflect standard task solutions.These limitations motivate black-box methods for tracing and proving unauthorized distillation.Source: §1 · pp. 1–2
• Across three benchmarks, two teacher models, and four student architectures, AuxMark detected all 24 distilled student models with zero false positives.The framework also preserves task utility and remains robust to data-processing operations and adaptive cleaning attacks.Source: §1 · p. 2
• AuxMark inserts non-essential auxiliary actions into teacher trajectories and saves the associated interactions as private evidence for later tracing.The actions do not modify the core task actions.Source: §1 · p. 2
• The proposed threat model combines traffic monitoring to identify suspicious targets with targeted verification using private evidence.This is presented as a closed-loop approach to tracing intellectual-property theft in real-world scenarios.Source: §1 · p. 2
• Paired real and fake probes compare student responses, while a card-level sign test supports verification and trace-level attribution.The fake probes semantically alter core actions to distinguish watermarked behavior from natural contextual choices.Source: §1 · p. 2

2.1 AGENT DISTILLATION

• An agent trajectory records intermediate reasoning and tool-use behavior across multiple rounds of interaction with an external environment.At each step the agent produces a thought and tool action, receives an observation, and continues toward the user task.Source: §2.1 · p. 2
• In agent distillation, a student learns a powerful teacher’s interaction behaviors from trajectories, with supervised fine-tuning using the teacher’s thoughts and actions as supervision.Previous thoughts, actions, and observations provide context during training.Source: §2.1 · p. 2

2.2 MODEL WATERMARKING

• A watermark must transfer reliably to distilled students while keeping false positives low, as assessed through probe-set queries and a p-value.The stated criterion is a p-value below the threshold for a distilled student and above it for a clean model.Source: §2.2 · p. 3
• Watermarking must preserve teacher task success and avoid significantly increasing trajectory length or computational cost.The stated harmlessness requirements cover task utility and inference efficiency.Source: §2.2 · p. 3
• The watermark should remain detectable after attackers apply data flooding, semantic rewriting, truncation, or adaptive cleaning.These are the data modifications specified by the robustness requirement.Source: §2.2 · p. 3

2.3 ACCESS AND THREAT MODEL

• The access model assigns the owner the teacher and the attacker the student-distillation goal; Figure 1 depicts the attacker’s trajectory-based distillation and the owner’s suspicious-traffic audit.The owner embeds watermarks in teacher trajectories in real time, while the attacker collects a training dataset from the service.Source: §2.3 · p. 3, Figure 1 · p. 3
• The owner controls the teacher service, monitors server-side features for scraping patterns, and records suspicious traces, but cannot determine which traces were used for distillation.The owner has black-box access to the deployed student and controls API inputs for watermark verification.Source: §2.3 · p. 3
• Attackers query the teacher for complete multi-step trajectories, may sanitize, rewrite, truncate, or mix the data, then distill and deploy a student as a black-box API.Large-scale automated querying can leave server-side traffic patterns that the owner can capture.Source: §2.3 · p. 3

3.2 WATERMARK EMBEDDING ALGORITHM

• AuxMark restricts auxiliary actions to read-only tools and context-grounded arguments, then schedules insertions unpredictably under a per-trajectory budget.A secret-keyed hash determines whether an insertion is attempted; failed or skipped attempts update the trigger probability.Source: §3.2 · pp. 4–5
• Validated candidates are scored for relevance, reliability, and repeatability; the highest-scoring action is inserted, and successful insertions create private evidence cards.Cards retain historical context, the preceding core action and observation, and injected auxiliary tool parameters.Source: §3.2 · p. 5

3.3 WATERMARK DETECTION

• For each evidence card, AuxMark constructs paired real and fake probes that differ only in the core action, then applies a card-level sign test to verify watermark retention.The test requires statistical significance and a minimum average real-versus-fake full-hit margin.Source: §3.3 · pp. 5–6

3.4 TRACE-LEVEL ATTRIBUTION

• For trace-level attribution, AuxMark ranks traces using real-side hits as positive evidence, fake-side hits as a penalty, and tool-hit-only rates as supplementary evidence.It returns the top-K traces most likely to have been included in the training set.Source: §3.4 · p. 6

4.1 EXPERIMENTAL SETUP

• The evaluation covers BFCL, SWE-bench, and Telecom, two teacher agents, and four student models, measuring probe hits, p-values, attribution, accuracy, and interaction steps.Detection requires p < 0.05 and a real–fake mean fullhit gap of at least 0.05.Source: §4.1 · p. 7

4.2 EFFECTIVENESS

• AuxMark detects distilled students in every tested setting and produces 0 false positives across 48 clean-model settings.The evaluations span three datasets, two teacher agents, and four student models.Source: Table 1 · p. 7, §4.2 · p. 7, Table 2 · p. 8
• Among the baselines, only Agentwm with GLM-4.7-Flash meets its ≥3/5-pass criterion; Seqwm detects none of the tested distilled models.Seqwm's median p-values exceed 0.05 across tested models.Source: §4.2 · p. 8, Table 3 · p. 8

4.3 HARMLESSNESS

• Watermarking leaves task accuracy differences between −3.0% and +3.0%; mean interaction steps rise from 20.49 to 21.09.Across the four BFCL and Telecom cohorts, ∆L ranges from −1.38 to +2.04 steps.Source: §4.3 · p. 8, Figure 3 · p. 8

4.4 ROBUSTNESS

• At the strongest 1:10 clean-data dilution, AuxMark still detects all eight tested student models.All 24 settings across BFCL and SWE-bench, three dilution ratios, and four student models are detected.Source: Figure 4 · p. 9, §4.4 · p. 9
• After DeepSeek-V4-Flash paraphrases the training trajectories, AuxMark detects the watermark in all eight BFCL and Telecom settings.Source: Table 4 · p. 9, §4.4 · p. 9
• After an adaptive attacker removes suspected auxiliary actions, AuxMark still detects every tested student model, with a minimum p-value of 9.6 × 10^-3.Source: Table 5 · p. 9, §4.4 · p. 9

• AuxMark inserts useful extra tool calls after normal core actions and privately retains the associated evidence.Source: §5 · p. 9
• Paired real and fake probes with a card-level sign test support model-level detection and trace-level tracking.Source: §5 · p. 10
• Across three benchmarks, two teacher models, and four student architectures, AuxMark detects all 24 distilled students with zero false positives on 48 clean models.The conclusion identifies evaluation with more teacher models, cleaning tools, and training methods as future work.Source: §5 · p. 10

AI USE STATEMENT

• Generative AI tools supported research execution, synthetic trajectory and probe generation, code generation, and English polishing; authors reviewed the resulting work.The authors state that AI was not used to draft core sections or prove mathematical claims.Source: AI USE STATEMENT · p. 10

A.1 MODEL DISTILLATION

• Agent distillation transfers teacher interaction behaviors, including tool use and reasoning, through fine-tuning on teacher-generated trajectories.The paper describes these trajectories as valuable supervision and notes unauthorized use as a copyright threat.Source: §A.1 · p. 14

A.2 MODEL WATERMARKING

• Content watermarks alter tokens or expressions, but strict tool-call formats make direct application to agent outputs difficult.Source: §A.2 · p. 14
• Existing agent anti-distillation watermarking has focused on shared teacher–student base models, with limited robustness to data processing such as mixing.The paper motivates a more general and robust approach for tracing agent distillation.Source: §A.2 · p. 14

B.1 EXPERIMENTAL DETAILS

• AuxMark uses p0 = 0.1, ∆p = 0.1, pmax = 0.5, budget B = 10, and K = 3 candidates for dynamic scheduling.Detection uses three parameterized variants per card, p = 0.05, and margin r = 0.05.Source: §B.1 · p. 15
• The comparison uses Seqwm and Agentwm, selected as representative agent watermarking baselines; large-language-model text antidistillation methods are excluded because token or reasoning changes can corrupt tool-call formats.Source: §B.1 · p. 15
• Agentwm flags a student when at least 3 of 5 passes meet its JSD threshold, whereas Seqwm requires median p < 0.05 across 100 replayed traces.The baselines retain their native encodings, test units, and decision statistics.Source: §B.1 · p. 15

B.2 SUPPLEMENTARY EFFECTIVENESS RESULTS

• Trace-level attribution averaged at least 82.1% precision across six cohorts for every reported K.The reported precision is the arithmetic mean across four student models in each cohort.Source: §B.2 · p. 15, Table 8 · p. 16
• 100.0% P@10 was achieved by SWE-bench–GPT in trace-level attribution.Across the six cohorts, average precision was at least 82.1% for every reported K.Source: §B.2 · pp. 15–16, Table 8 · p. 16
• At a 20% training share, all 24 settings remained significant; at 10%, 21 of 24 remained significant.Figure 5 plots −log10 p against training share, with larger values indicating stronger evidence.Source: §B.2 · p. 16, Figure 5 · p. 17

B.3 SUPPLEMENTARY OF ROBUSTNESS

• AuxMark detected all 24 data-flooding settings, including all 8 tested student models at the most challenging R3 ratio.R3 mixes watermarked data with clean trajectories from three alternative teachers at a 1:3 ratio.Source: Figure 6 · p. 17, §B.3 · p. 18
• AuxMark detected the watermark in all 24 truncation settings, including all 8 tested students at T20.T20 removes 20% of the tokens from the tail of each watermarked training sequence.Source: Figure 7 · p. 18, §B.3 · p. 18
• All 16 evaluated Agentwm data-flooding settings failed to meet its ≥3/5 detection threshold.The evaluation covers the D1 and D5 settings.Source: Table 9 · p. 18, §B.3 · p. 18

C DISCUSSION ON STATISTICAL TEST

• Card- and trace-level tests each yielded 24/24 detections and 0/48 significant false-positive results in the main evaluation.Under paraphrasing, trace-level detection fell from 8/8 to 7/8; at 15% training share, it fell from 24/24 to 22/24.Source: Table 10 · p. 19, C DISCUSSION ON STATISTICAL TEST · p. 19
• Probe-level testing produced 3/48 cases with p < 0.05 in false-positive settings, but none crossed the fullhit-gap decision threshold.Counting parameterized probes individually can repeatedly count the same release behavior and context; card-level testing is used as the primary unit.Source: C DISCUSSION ON STATISTICAL TEST · p. 19

D DETAILED WATERMARKING PROTOCOLS

• For each evidence card, the protocol constructs real probes and corresponding fake probes by replacing the real probe’s core action with a semantically altered one.Source: D DETAILED WATERMARKING PROTOCOLS · p. 21
• The protocol queries the suspect model with both probe types, computes hit rates, tallies card-level real and fake wins, and applies a statistical test.Source: D DETAILED WATERMARKING PROTOCOLS · p. 21

E LIMITATIONS OF UNWATERMARKED DISTILLATION DETECTION

• Surface-text overlap and execution-graph similarity can both score highly without uniquely identifying a training source.The passage examines token-level n-gram overlap and agent execution-graph similarity as unwatermarked approaches.Source: E LIMITATIONS OF UNWATERMARKED… · p. 22

E.1 VULNERABILITIES IN TOKEN-LEVEL N-GRAM MATCHING

• The local overlap setup tokenizes candidate and reference texts with the same regex and retains up to their first 100 tokens.It compares distinct 1-, 2-, and 3-grams; the evaluation described uses best-of-k sampling up to k = 100.Source: §E.1 · p. 22
• All 20 Kimi-K3 geometry completions re-derived the solution, and none gave the answer within the first 50 reasoning tokens; four correct answers capped at 15 words scored 0.005.Best-of-k reports the largest overlap in a sampling pool, so occasional high-overlap completions need not represent typical output behavior.Source: §E.1 · p. 22
• Kimi-K2.6’s geometry score was 0.373/0.662 under an alternative prefix, versus 0.274/0.565 with the teacher prefix and 0.250/0.415 without a prefix.The best local score, 0.662, approaches the reported 0.80 overlap for prefilled Kimi-K3 and Opus 4.8; the alternative prefix’s local formatting match is not exclusive to the teacher prefix.Source: §E.1 · p. 22, Figure 10 · p. 23
• For a standard linear differential equation, GPT-OSS-120B scored 0.500 mean overlap without a prefix, while Kimi-K2.6 scored 0.501 without and 0.502 with the teacher prefix.The unprefilled excerpts show the conventional cosh integrating factor.Source: §E.1 · p. 22, Figure 11 · p. 23

Scale invariance and structural ambiguity

• Sdep compares dependency-graph reuse, maximum depth, and fanout features by cosine similarity, which can score two structurally different 11-node graphs exactly 1.The example contrasts a graph with one dependency edge and a complete 10-edge chain, so a perfect score does not guarantee close structural matches.Source: §E.2 · pp. 23–24

Evidence from tool trajectories

• Across 150 model-pair comparisons, mean Sdep was 0.885; 121 scored at least 0.9, including 53 with edge-count gaps of at least three and 49 successful/failed pairs.In retail-37, a failed trajectory with one dependency edge and a successful one with 12 edges scored 0.991, unchanged after LLM-based edge verification.Source: §E.2 · p. 24

Behavioral convergence after reasoning distillation

• After reasoning distillation, AGS rose toward all three comparison models as task success increased from 4/15 to 12/15, with Sseq gains of 0.425–0.750.The audit used Qwen3.5-9B base and its reasoning-distilled variant on 15 τ-bench-style tasks; 12,592 listed examples contained no structured tool trajectories.Source: §E.2 · p. 24, Table 11 · p. 24
• AGS averages optional-tool agreement, sequential-pattern similarity, and dependency-pattern similarity, so its increase need not identify teacher-specific tool-use inheritance.In the reasoning-distillation comparison, Sseq rose most, while Sdep rose by 0.077–0.086 and Snode decreased toward Claude and GPT-OSS.Source: §E.2 · pp. 23–24

Implications for attribution

• High unwatermarked similarity is ambiguous evidence of a specific training source, motivating controls for shared solutions, response presentation, and general behavioral improvement alongside calibrated false-positive rates.AuxMark provides private verification signals tied to recorded teacher interactions.Source: §E.2 · p. 24