Paper deep dive
SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification
Alan Tang, Lifeng Wang, Gang Wu, Tao Zhang, Yantao Jia, Xiaofeng Zhu
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 10/15/2026, 4:27:38 AM
Summary
The paper introduces SkillMarker, a KGW-based watermarking method designed to verify ownership and trace leakage of agent skills. It addresses the challenge of embedding strong watermarks in structured, compact skill instructions without compromising functionality. SkillMarker employs quality-constrained rewriting to preserve essential operational requirements and signal-oriented candidate search to maximize watermark signal strength. Experiments across four datasets show negligible impact on downstream task performance, with robust detection capabilities even in copy-paste and skill merging scenarios.
Entities (11)
Relation Signals (9)
Alan Tang → affiliatedwith → Huawei Technologies Co., Ltd.
confidence 95% · Alan Tang 1 ... 1 Huawei Technologies Co., Ltd.
SkillMarker → uses → KGW
confidence 95% · SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification
Lifeng Wang → affiliatedwith → Harbin Institute of Technology, Shenzhen
confidence 90% · Lifeng Wang 1,2 ... 2 Harbin Institute of Technology, Shenzhen
SkillMarker → developedby → Alan Tang
confidence 90% · Alan Tang 1 , Lifeng Wang 1,2 , Gang Wu 1 , Tao Zhang 1 , Yantao Jia 1,* , and Xiaofeng Zhu 1 1 Huawei Technologies Co., Ltd.
SkillMarker → evaluatedon → awesome-skills
confidence 90% · awesome-skills (sickn33, 2026) provides a broader collection
SkillMarker → evaluatedon → marketingskills
confidence 90% · marketingskills (Haines, 2026) focuses on marketing workflows
SkillMarker → evaluatedon → skill-use-bench
confidence 90% · skill-use-bench (Han et al., 2026) provides executable tasks
SkillMarker → evaluatedon → agent-skills
confidence 90% · We evaluate SkillMarker on four datasets... agent-skills (Osmani, 2026)
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Agent skills encode operational procedures and domain expertise as reusable knowledge assets, yet their distribution in plaintext exposes them to unauthorized copying and leakage. However, practical mechanisms for skill ownership verification and leakage tracing remain underdeveloped. Watermark embedding before distribution offers a potential solution, but structured, compact skill instructions impose stringent requirements for factual and procedural accuracy. To address these challenges, we introduce SkillMarker, a KGW-based watermarking method that jointly targets functionality preservation and strong watermark embedding. SkillMarker unifies quality-constrained rewriting with signal-oriented candidate search. The former separates essential knowledge from flexible expression to preserve instruction fidelity; the latter explores alternative expressions to obtain a stronger watermark signal under preservation constraints. We release an open-source toolkit that integrates watermark embedding, quality auditing, and detection to support the protection of agent skills. SkillMarker targets ownership verification and leakage tracing in distributed skill ecosystems, where content may be copied in whole or in part, or incorporated into other skills. Across four datasets, SkillMarker negligibly affects downstream task performance on average. In our copy-paste tests, window-based detection consistently identifies copied passages containing as few as 1,536 consecutive tokens. Even after merging with one or three background skills, SkillMarker retains watermark detection rates of 72.2--77.8\%.
Tags
Links
- Source: https://arxiv.org/abs/2610.15725v2
- Canonical: https://arxiv.org/abs/2610.15725v2
Trouble viewing inline? Open PDF directly →
Full Text
44,841 characters extracted from source content.
Expand or collapse full text
October 10, 2026 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification Alan Tang 1 , Lifeng Wang 1,2 , Gang Wu 1 , Tao Zhang 1 , Yantao Jia 1,* , and Xiaofeng Zhu 1 1 Huawei Technologies Co., Ltd. 2 Harbin Institute of Technology, Shenzhen Agent skills encode operational procedures and domain expertise as reusable knowledge assets, yet their distribution in plaintext exposes them to unauthorized copying and leakage. However, practical mechanisms for skill ownership verification and leakage tracing remain underdeveloped. Watermark embedding before distribution offers a potential solution, but structured, compact skill instructions impose stringent requirements for factual and procedural accuracy. To address these challenges, we introduce SkillMarker, a KGW-based watermarking method that jointly targets functionality preservation and strong watermark embedding. SkillMarker combines quality-constrained rewriting with signal- oriented candidate search to strengthen watermark signals while preserving essential instructions. We develop a toolkit for watermark embedding, quality auditing, and detection. Across four datasets, SkillMarker negligibly affects downstream task performance on average. In our copy-paste tests, window- based detection consistently identifies copied passages containing as few as 1,536 consecutive tokens. Even after merging with one or three background skills, SkillMarker retains watermark detection rates of 72.2–77.8%. Project homepage: https://fuxi-ailabs.github.io/SkillMarker/. 1. Introduction Agent skills package domain expertise into reusable instructions and resources that agents load on demand to specialize their behavior with- out modifying model weights (Li et al., 2026a; Zhang et al., 2025). This encoded knowledge makes skills valuable assets for organizations and developers, while their reusable format allows that expertise to be deployed across tasks. How- ever, distributing skills in plaintext makes them easy to copy, redistribute, or incorporate into other skills. These risks motivate watermarking skill text be- fore distribution to support ownership verification and leakage tracing, including when only frag- ments of the original skill remain. We therefore ask: Can we watermark the skill for owner- ship verification and leakage tracing without compromising its functionality? However, embedding a watermark into struc- tured, compact skill instructions with stringent accuracy requirements poses two coupled chal- lenges. C1: Preserving skill functionality dur- ing watermarking. Skill instructions encode precise operational requirements, so even minor changes to resource references, decision condi- tions, or required actions can change agent behav- ior. Their structured format and stringent accu- Figure 1|Plaintext skills expose valuable domain expertise to unauthorized copying and leakage. SkillMarker offers ownership verification and leakage tracing. racy requirements leave limited room for water- mark embedding through rewriting. C2: Embed- ding a strong watermark under limited rewrit- * Corresponding author. arXiv:2610.15725v2 [cs.CR] 14 Oct 2026 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification ing freedom. Compact skill instructions offer few opportunities to strengthen the watermark signal. Accuracy constraints further restrict alternative expressions: a weak logit bias may produce lit- tle watermark signal, while a stronger bias can change essential instructions. We introduce SkillMarker, a KGW-based water- marking method for agent skill ownership verifi- cation (Kirchenbauer et al., 2023). To address C1, we propose quality-constrained rewriting, which preserves protected content and constrains ed- itable spans to preserve operational requirements. To address C2, we propose signal-oriented can- didate search, which explores alternative expres- sions and selects candidates with stronger water- mark signals among those that pass preservation checks. SkillMarker enables developers to verify skill ownership by embedding a keyed watermark before publishing a skill and later testing suspect text for a watermark signal. It also enables them to trace skill leakage by assigning distinct keys to distributed versions and testing suspect text for a watermark signal that can help identify its source version, including when instructions are copied in whole or incorporated into other skills. To support these applications, we also develop a toolkit that integrates watermark embedding, quality auditing, and detection. Our contributions are: • We propose SkillMarker for skill ownership ver- ification and leakage tracing. By adapting KGW through quality-constrained rewriting and signal- oriented candidate search, SkillMarker addresses two challenges: preserving skill functionality and embedding strong watermarks under limited rewriting freedom. •Across four datasets spanning general and pro- fessional tasks, we show that watermarked skills maintain task performance with negligible degra- dation on average compared with original skills. •We evaluate watermark robustness under two common skill-reuse scenarios: copy-paste and skill merging. Our detection method consistently identifies copied passages containing as few as 1,536 consecutive tokens, while detection rates remain at 72.2–77.8% after merging with multi- ple background skills. 2. Method 2.1. Problem Setup and Overview Let푥denote the Markdown body of an original skill. We introduce a watermark key 푘 for water- mark embedding and detection. We seek a water- marked skille푥that preserves the instructions in푥 while carrying a watermark signal associated with 푘. A detector later tests suspect text for this sig- nal, including when only part of the distributed skill is present. Watermark embedding uses a language model with access to its output logits; detection requires the tokenizer and watermark configuration, but no model inference. For a vocabularyV, write a token sequence as푤 1:푛 . At generation step푡, the input context and preceding generated tokens determine a next- token distribution 푃 푡 through a softmax over the model’s output logits. The watermark key푘and preceding token푤 푡−1 determine a green list퐺 푡 and its complement, the red list푅 푡 = V \ 퐺 푡 ; 훾 ∈ (0,1)controls the nominal green-list fraction, and훿 >0 controls the logit bias. We use푄 푡 for the resulting watermarked distribution. The set 퐸 ⊂ Vcontains tokens exempt from logit bias and scoring. For any scored text,Idenotes its eligible token positions,푁=|I|their count, and 퐺 counts green tokens. Figure 2 provides an overview of SkillMarker. The central difficulty is to strengthen watermark signals within the limited rewriting freedom al- lowed by precise skill instructions. We first sepa- rate protected content from editable spans, then use preservation instructions and paired rewrite examples to guide faithful reformulation. Within each editable span, beam search explores alter- native expressions under the KGW-biased distri- bution, seeking candidates that carry a stronger watermark signal while retaining the original op- erational requirements. We assess watermark signal strength using the green-token rate and linguistic fluency using perplexity (PPL) (Bengio et al., 2003). Among candidates that pass preser- vation checks, we select those with higher green- token rates, using lower PPL to break ties. We then reconstruct the watermarked skill with pro- tected content unchanged. The toolkit provides independent quality auditing and supports both full-text and window-based watermark detection. 2 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification Figure 2|Overview of SkillMarker. (1) Quality-constrained rewriting preserves protected content, such as code and API identifiers, while rewriting editable spans. (2) Signal-oriented candidate search ranks candidate rewrites by the green-token rate and uses lower perplexity to break ties. (3) Reconstruction preserves protected content, followed by independent quality auditing and detection in suspect text. 2.2. Quality-Constrained Rewriting Protecting literal content. To embed a water- mark, we apply a logit bias that favors green-list tokens during rewriting. Without preservation constraints, rewriting can change executable code and invalidate a skill. For example, changing>= to>in the following code block changes when the retry limit is enforced: if attempts >= 3: raise RuntimeError Code and numerical thresholds allow little rewrit- ing freedom, whereas surrounding prose often al- lows alternative expressions. We therefore parse the original skill and designate code, structural delimiters, and recognized literals as protected content that must remain unchanged. Regions with unresolved structure are also protected. We split the remaining prose into editable spans and protect tokens that cross the boundary of pro- tected content. Editable spans below a threshold on the original token count remain unchanged. We rewrite one editable span at a time and then reconstruct the skill with protected content in its original order. Preserving instruction fidelity. Preserving pro- tected content alone does not preserve a de- cision rule: changingall conditionsto any conditionchanges behavior even if every threshold remains unchanged. We use in-context learning to make preservation constraints within editable spans concrete. The rewriting prompt combines explicit preservation instructions with paired input and rewrite examples. These ex- amples show how to change wording while pre- serving the original language, facts, conditions, negations, numerical values, and technical iden- tifiers. Preservation checks reject incomplete or empty candidates, unauthorized layout or syn- tax changes, and changes to protected content. Independent quality auditing then assesses lan- guage, semantics, completeness, and usability without exposing watermark scores to the review- ers. Downstream task performance is evaluated separately. Grouping token variants. Watermark embed- ding can favor token variants that disrupt for- matting. For example, a hard watermark that blocksnamebut permits_namecan produce an unwanted underscore and change Markdown for- matting. A logit bias can likewise favor a token variant without excluding the original token. We therefore assign consistent green-list membership to token variants. Our implementation groups to- kens that differ only in leading spaces or periods and assigns them a shared representative’s green- list membership; literal-underscore variants re- main subject to preservation checks. Specifically, we sample a keyed subset of⌊훾|V|⌋vocabulary IDs and assign each representative’s membership to all tokens in its group. The resulting green-list size need not equal훾|V|, so훾remains a nominal parameter. 3 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification Exempting formatting tokens. Applying a logit bias to Markdown symbols can favor for- matting changes that disrupt skill structure. We therefore exclude designated formatting tokens from the logit bias. Together with special and reserved control tokens, they form퐸. Following soft KGW (Kirchenbauer et al., 2023), we modify the remaining logits by 푄 푡 (푣)= 푃 푡 (푣) exp ( 훿1푣∈ 퐺 푡 \ 퐸 ) Í 푢∈V 푃 푡 (푢) exp ( 훿1푢∈ 퐺 푡 \ 퐸 ) . (1) Tokens in푅 푡 remain available, allowing the model to select strongly preferred expressions. Exempt tokens receive no logit bias and contribute no watermark signal. 2.3. Signal-Oriented Candidate Search Exploring alternative expressions. Strict preservation constraints can encourage copying the original text without changes, leaving little room for additional watermark signal. Increasing 훿alone may instead favor an inaccurate expres- sion. We therefore use beam search (Sutskever et al., 2014) to explore alternative expressions under the same preservation constraints. It selects likely continuations under푄 푡 in Eq.(1), producing completed candidates for each editable span. Selecting on reconstructed text. A candidate’s generated token sequence can change when its text is joined to adjacent content. Scoring that sequence alone may therefore favor a watermark signal absent from the watermarked skill. We insert each candidate into the current skill and tokenize the complete reconstructed text. For the current editable span,Icontains only nonexempt tokens wholly inside its output boundaries and having a preceding token. Each token’s green-list membership is determined using its actual pre- ceding token, even when that token is protected or exempt. The candidate’s green-token rate is 푟= 퐺 푁 , 퐺= ∑︁ 푡∈I 1푤 푡 ∈ 퐺 푡 .(2) We compute conditional PPL over each can- didate’s generated tokens under the rewriting prompt to assess linguistic fluency. PPL is the exponential of the mean token negative log- likelihood under 푃 푡 . For editable span푖, letC 푖 contain candidates that pass the preservation checks and have푁 >0. We select 퐶 ∗ 푖 ∈ argmax 퐶∈C 푖 푟(퐶),−PPL(퐶) ,(3) using lexicographic order: higher green-token rates take priority, and lower PPL breaks ties. If C 푖 is empty, we preserve the original editable span and record a fallback. We process editable spans in their original order and score the saved wa- termarked skill after reconstruction. This local selection does not guarantee the highest green- token rate for the complete skill. 2.4. Watermark Detection Suspect text may contain copied instructions mixed with unrelated content, and the positions of protected content may be unavailable. We therefore support both full-text and window- based detection using only the suspect text and watermark configuration. Window-based detec- tion uses sliding windows to detect watermark signals within suspect text. The detector tok- enizes the full suspect text once and reconstructs 퐺 푡 from푘and each observed preceding token, using the same token-variant grouping as water- mark embedding. It excludes퐸and the first token. Without the positions of protected content, all re- maining positions are eligible, including content that may have been protected during watermark embedding. For푁 >0, we report the green-token rate퐺/푁 and the KGW statistic 푧= 퐺− 훾푁 √︁ 푁훾(1− 훾) .(4) The detector computes the nominal upper-tail probabilityPr[Binomial(푁, 훾) ≥ 퐺]. For window- based detection, it scores overlapping windows of the same tokenization, preserving each token’s preceding token in the full suspect text, and ap- plies a Bonferroni correction across the scanned windows. Repeated contexts and shared green- list membership can violate the binomial null as- sumptions; these probabilities therefore require independent calibration before being interpreted as empirical false-positive guarantees. 4 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification 0 25 50 75 100 Performance (%) ↑ +0.81% -2.01% -0.69% +0.93% Everyday / General Scenarios Professional Scenarios Δ vs. Original Skill 0 450 900 1350 1800 Mean tokens (K) ↓ +14.1% +29.3% +23.9% -3.3% agent-skillsawesome-skillsmarketingskillsskill-use-bench 0 40 80 120 160 Median task time (s) ↓ +14.5% +6.0% +16.4% -5.3% No SkillOriginal SkillWatermarked Skill Figure 3|Watermarking largely preserves downstream task performance. We test watermarked skills on four datasets, comparing task performance, token usage, and task time against original skills and a no-skill baseline. 3. Experiments 3.1. Experimental Setup We evaluate SkillMarker on four datasets span- ning everyday/general and professional scenarios. For everyday/general scenarios,agent-skills (Osmani, 2026) covers routine software engineer- ing workflows, including planning, code review, testing, and debugging, whileawesome-skills (sickn33, 2026) provides a broader collection for writing, document processing, information re- trieval, and data analysis. For professional scenar- ios,marketingskills(Haines, 2026) focuses on marketing workflows such as content strategy, search engine optimization, advertising, and con- version optimization;skill-use-bench(Han et al., 2026) provides executable tasks requir- ing specialized procedures, including software development, document processing, and scien- tific computation. We use Qwen3-8B (Yang et al., 2025) for watermark embedding. We compare three settings: no skill, the original skill, and the watermarked skill. We use DeepSeek-V4-Flash through Open Code, with one DeepSeek-V4-Flash judgment per case. Each case runs in a separate working directory with only the target-skill ver- sion required by its setting; the no-skill baseline receives neither version. Expected outputs and grading materials are withheld from the execut- ing agent to prevent evaluation leakage. 3.2.Downstream Performance and Efficiency Figure 3 reports task performance (the percent- age of evaluation checks passed), mean total to- ken usage, and median task time for no skill, orig- inal skills, and watermarked skills. Token counts include input, cached input, and output (K = 1000), and bar labels report relative changes from original skills. Watermarking largely preserves downstream task performance: watermarked skills change performance by−2.01% to+0.93% relative to original skills across four datasets and re- 5 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification tain their gains over the no-skill baseline. Onagent-skills, pass rates are 97.46% before watermarking and 98.25% afterward; onskill-use-bench, they are 59.85% and 60.41%. Original skills improve performance over no-skill runs by 8.49–40.30%. Mean total tokens increase by 14.1–29.3% on the first three datasets but decrease by 3.3% on skill-use-bench. These means are sensitive to the long-tailed distribution of run token counts. Median task time increases by 14.5%, 6.0%, and 16.4% foragent-skills,awesome-skills, andmarketingskills, respectively, and de- creases by 5.3% forskill-use-bench. Task time is reported for reference: service load, exe- cution periods, and concurrency can still affect these measurements. Our assessment of func- tionality preservation relies on task performance rather than timing differences. The values are provided in Table 1 in Appendix A. 3.3. Watermark Robustness We consider two skill-reuse scenarios: copying watermarked content into an unwatermarked text (copy-paste) and combining multiple skills (skill merging). We report detection under both sce- narios and localization under copy-paste. 3.3.1. Copy-Paste Setup. We select three skills, from each source, we copy 256, 512, 1024, 1536, or 2048 tokens into an unwatermarked text containing 1024 or 4096 tokens before insertion. We vary the num- ber of inserted fragments over1,2,4,8. Within each condition, fragmentation splits the same copied content while preserving its total length and order. Detection and localization. We scan each doc- ument without access to the true insertion posi- tions, using 1024-token windows with a stride of 256 tokens and a per-window significance thresh- old of푝 ≤0.01. To evaluate localization, we merge all significant windows into the predicted region퐴and take the union of the inserted frag- ments as the true region푇. Overlapping windows count each token position only once. Localization precision and recall are Precision= |퐴∩ 푇| |퐴| , Recall= |퐴∩ 푇| |푇| . (5) When no window is significant, recall is zero and precision is undefined. Each plotted condition includes three seeds for each of the three sources: we first average within each source and then av- erage the three sources with equal weight. Preci- sion uses only runs with valid predictions; if any source has no valid prediction, the corresponding cell is marked N/A. Results. Figure 4 shows that window-based de- tection consistently identifies copied passages containing as few as 1,536 consecutive tokens. All tested contiguous 1,536-token copies are de- tected in both 1024- and 4096-token unwater- marked backgrounds. In the longer background, full-text detection reaches only 55.6%, showing the benefit of window-based detection for identi- fying copied skill content within unrelated text. Figure 5 shows that the same 1,536-token pas- sages can also be localized, with 98.0–99.1% re- call and 65.4–69.6% precision across the two background lengths. Thus, detection windows recover nearly all copied content, while also in- cluding some surrounding text. Splitting the pas- sage into eight fragments in the 4096-token back- ground reduces detection to 77.8%, illustrating the effect of dispersed reuse. These results sup- port detecting and locating skill copies for the selected skills with strong watermark signals. 3.3.2. Skill Merging Figure 6 shows that watermark evidence remains detectable after merging a target skill with a lim- ited number of background skills. With one, two, or four total input skills, multi-scale union detec- tion achieves detection rates of 91.7%, 72.2%, and 77.8%, respectively, compared with 58.3%, 47.2%, and 44.4% for single-window detection. Adding background skills reduces detection rel- ative to the single-input setting, consistent with watermark dilution by unwatermarked content. This decline is not strictly monotonic for multi- scale detection, but both detectors retain lower detection rates with background skills than with- out them. Multi-scale detection helps recover 6 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification Figure 4|Copied passages containing as few as 1,536 consecutive tokens are consistently detected in our tests. We insert watermarked passages into unwatermarked text and compare full-text and window-based detection. Window-based detection identifies every tested contiguous 1,536-token copy under both background lengths. Copied length (tokens) Figure 5|Detection windows also locate the copied content. In the same copy-paste tests, contiguous 1,536-token passages achieve 98.0–99.1% localization recall. We report token-level precision and recall as copied length and fragment count vary; scattered fragments are harder to localize. some of the remaining evidence under this dilu- tion. Both methods have the same observed false- positive rates on unwatermarked controls: 0.0%, 11.1%, and 16.7% for one, two, and four input skills. The increasing false-positive rates indicate that reliable detection under greater background noise also requires calibration. 3.4. Ablation Study We ablate five components of SkillMarker: fidelity constraints and logit bias in quality-constrained rewriting (Section 2.2), and beam search, signal- oriented selection, and reconstructed-text scoring in signal-oriented candidate search (Section 2.3). Each variant removes or replaces one component while retaining literal protection. Figure 7 shows the quality–strength trade-off. 7 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification Figure 6|Watermarks remain detectable after limited skill merging. We merge a target skill with zero, one, or three background skills and compare single-window and multi-scale detection. Watermarked targets measure detection rates; unwatermarked targets measure false positives. 65707580 Instruction quality (0–100) ↑ 0 1 2 3 4 Mean watermark strength (z) ↑ SkillMarker w/o fidelity constraints w/o beam search w/o signal-oriented selection w/o reconstructed- text scoring w/o logit bias Quality–watermark strength trade-off curve Figure 7|Ablation of five components. We compare instruction quality and watermark strength. The KGW푧-score (Eq.(4)) measures the stan- dardized excess of green tokens over the unwa- termarked expectation; higher values indicate stronger watermark signals. SkillMarker achieves quality 70.97 and mean푧=3.01; removing fi- delity constraints increases푧to 3.37 but lowers quality to 67.09. Removing beam search, signal- oriented selection, or logit bias reduces mean푧to 0.65–0.83 despite higher quality scores, show- ing their contribution to watermark evidence. Generated-token scoring remains close to Skill- Marker (70.00 quality,푧=2.98). Together, these results support balancing instruction fidelity and watermark strength. Settings, module definitions, and detailed results are in Appendix D. 3.5. Structured Skill Case Study Figure 8 compares selected skill excerpts from observability-and-instrumentationbe- fore and after watermarking. Protected spans remain exactly unchanged, and the saved full text yields nominal푝=4.62×10 −9 . Long protected blocks show only their opening lines; omission marks separate non-contiguous excerpts. 4. Related Work 4.1. Watermarking Generation-time watermarking. KGW and Unigram-Watermark bias token selection using context-dependent and fixed vocabulary parti- tions, respectively (Kirchenbauer et al., 2023; Zhao et al., 2024). Other approaches use tour- nament sampling (SynthID-Text), sentence-level rejection sampling (SemStamp), or optimal trans- port (textGrain) (Dathathri et al., 2024; Hou et al., 2024; Li et al., 2026b). SWEET and STONE protect low-entropy positions and syntactic code tokens, respectively (Kim et al., 2026; Lee et al., 2024), while AgentMark watermarks planning decisions (Huang et al., 2026). Generation-time watermarking is typically deployed on the model- provider side to attribute generated outputs. Skill- Marker instead enables skill developers to embed watermarks into reusable instructions before dis- tribution, independently of the models that later execute them. Post-hoc watermarking. PostMark inserts semantically selected words, REMARK-LLM en- codes binary signatures, and SrcMarker ap- plies semantics-preserving code transforma- tions (Chang et al., 2024; Yang et al., 2024; Zhang et al., 2024). RedAct watermarks released agent traces through selective rewriting and be- 8 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification Figure 8|Protected content remains unchanged during watermarking. We compare original and wa- termarked excerpts ofobservability-and-instrumentation, showing preserved literal content and rewritten prose that carries the watermark. havioral signals (Xu et al., 2026); SkillTrace au- dits skill reuse through expression, implementa- tion, and operational traces (Chen et al., 2026). These methods establish watermarking and prove- nance auditing for existing artifacts, but semantic preservation in general text or released traces does not by itself establish instruction fidelity in skills. Skill protection must preserve operational requirements while embedding watermarks that provide sufficient evidence for attribution after reuse. SkillMarker addresses this joint require- ment in distributed skill text; reliability studies of copy-paste attacks (Kirchenbauer et al., 2024) motivate its evaluation under copy-paste and skill merging. 4.2. Text Steganography Neural Linguistic Steganography conceals re- coverable messages through arithmetic cod- ing (Ziegler et al., 2019); zero-width characters offer invisible encoding but must survive redis- tribution. ICW induces output patterns through instructions, including covert triggers in modi- fied documents (Liu et al., 2026). Its signal is carried by subsequent model outputs, whereas SkillMarker embeds watermarks directly into the distributed skill. Linguistic steganography focuses on concealed message recovery, but its conceal- ment can be compromised by LLM-based steganal- ysis: fine-tuned LLMs detect steganographic text across tested methods and domains (Bai et al., 2024; Tang et al., 2024). Neither objective by itself establishes attribution of copied or merged skill instructions under strict functionality con- straints. SkillMarker instead supports ownership verification and leakage tracing through water- mark signals under preservation constraints. 5. Conclusion We present SkillMarker, a KGW-based method for protecting distributed agent skills through quality-constrained rewriting and signal-oriented candidate search. Across four datasets, water- marked skills largely preserve downstream per- formance, with relative changes of−2.01% to +0.93% and dataset-dependent token overhead. Window-based detection improves detection of copied content diluted by unwatermarked text, while fragmentation weakens detection and lo- calization. Watermarks remain detectable after merging with a limited number of background skills, although added background content weak- ens detection overall and elevated control false positives highlight the need for calibration. These findings support watermarking as a practical di- rection for skill ownership verification and leak- age tracing. 9 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification References M. Bai, J. Yang, K. Pang, H. Wang, and Y. Huang. To- wards next-generation steganalysis: LLMs unleash the power of detecting steganography, 2024. URL https://arxiv.org/abs/2405.09090. Y. Bengio, R. Ducharme, P. Vincent, and C. Jauvin. A neural probabilistic language model. Journal of Ma- chine Learning Research, 3:1137–1155, 2003. URL https://w.jmlr.org/papers/v3/bengi o03a.html. Y. Chang, K. Krishna, A. Houmansadr, J. F. Wieting, and M. Iyyer. PostMark: A robust blackbox wa- termark for large language models. In Proceed- ings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 8969–8987. Association for Computational Linguistics, 2024. doi: 10.18653/v1/2024.emnlp-main.506. URL https://aclanthology.org/2024.emnlp-m ain.506/. J. Chen, M. Wang, L. Jiang, J. Ma, X. Deng, X. Du, R. Lin, Y. Feng, L. Du, and J. Wang. SkillTrace: Multi-trace provenance auditing for LLM-agent skill reuse. arXiv preprint arXiv:2608.05204, 2026. URL https://arxiv.org/abs/2608.05204v2. Ver- sion 2. S. Dathathri, A. See, S. Ghaisas, P.-S. Huang, R. McAdam, J. Welbl, V. Bachani, A. Kaskasoli, R. Stanforth, T. Matejovicova, J. Hayes, N. Vyas, M. Al Merey, J. Brown-Cohen, R. Bunel, B. Balle, T. Cemgil, Z. Ahmed, K. Stacpoole, I. Shumailov, C. Baetu, S. Gowal, D. Hassabis, and P. Kohli. Scal- able watermarking for identifying large language model outputs. Nature, 634:818–823, 2024. doi: 10.1038/s41586-024-08025-4. URLhttps: //w.nature.com/articles/s41586-024 -08025-4. C. Haines. Marketing skills. GitHub repository, 2026. URLhttps://github.com/coreyhaines31/m arketingskills. Accessed October 9, 2026. J. Han, Y. Xu, Y. Liao, X. Wang, Z. Jiang, Z. Di, F. Lu, Z. Hu, and Y. Xiao. Skill-use: Can LLMs actually use skills in agentic harnesses? arXiv preprint arXiv:2608.04828, 2026. URLhttps: //arxiv.org/abs/2608.04828. A. Hou, J. Zhang, T. He, Y. Wang, Y.-S. Chuang, H. Wang, L. Shen, B. Van Durme, D. Khashabi, and Y. Tsvetkov. SemStamp: A semantic water- mark with paraphrastic robustness for text gener- ation. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Com- putational Linguistics: Human Language Technolo- gies (Volume 1: Long Papers), pages 4067–4082. Association for Computational Linguistics, 2024. doi: 10.18653/v1/2024.naacl-long.226. URL https://aclanthology.org/2024.naacl-l ong.226/. K. Huang, J. Tan, Y. Wei, W. Li, Z. Zhang, H. Tian, Z. Yang, and L. Zhou. AgentMark: Utility- preserving behavioral watermarking for agents. In Proceedings of the 64th Annual Meeting of the As- sociation for Computational Linguistics (Volume 1: Long Papers), pages 12581–12603. Association for Computational Linguistics, 2026. doi: 10.18653/v 1/2026.acl-long.573. URLhttps://aclantho logy.org/2026.acl-long.573/. J. Kim, S. Park, and Y.-S. Han. Marking code without breaking it: Code watermarking for detecting LLM- generated code. In Findings of the Association for Computational Linguistics: EACL 2026, pages 3990– 4002. Association for Computational Linguistics, 2026. doi: 10.18653/v1/2026.findings-eacl.207. URLhttps://aclanthology.org/2026.find ings-eacl.207/. J. Kirchenbauer, J. Geiping, Y. Wen, J. Katz, I. Miers, and T. Goldstein. A watermark for large language models. In Proceedings of the 40th International Conference on Machine Learning, volume 202 of Pro- ceedings of Machine Learning Research, pages 17061– 17084. PMLR, 2023. URLhttps://proceeding s.mlr.press/v202/kirchenbauer23a.html. J. Kirchenbauer, J. Geiping, Y. Wen, M. Shu, K. Saiful- lah, K. Kong, K. Fernando, A. Saha, M. Goldblum, and T. Goldstein. On the reliability of watermarks for large language models. In The Twelfth Interna- tional Conference on Learning Representations, 2024. URL https://arxiv.org/abs/2306.04634. T. Lee, S. Hong, J. Ahn, I. Hong, H. Lee, S. Yun, J. Shin, and G. Kim. Who wrote this code? watermarking for code generation. In Proceedings of the 62nd An- nual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 4890– 4911. Association for Computational Linguistics, 2024. doi: 10.18653/v1/2024.acl-long.268. URL https://aclanthology.org/2024.acl-lon g.268/. X. Li, Y. Liu, W. Chen, B. You, Z. Di, Y. He, S. Zheng, K. W. Choe, J. Sun, S. Wang, C. Tao, B. Li, X. Zhao, H. Geng, X. Wu, J. Zhou, X. Chen, H. Xing, Y. Li, Q. Zeng, D. Wang, Y. Wang, R. B. Chaim, P. Jiang, H. Shen, L. Kong, X. Liu, R. Wang, X. Liu, J. Li, X. Lan, Y. Lin, W. Ye, J. He, S. Li, Y. Zhang, Y. Gao, Y. Li, Z. Ma, L. Jing, T. Wang, K. Li, Y. Xue, H. Lyu, Y. He, Y. Tian, S. Wu, B. Wang, Y. Gao, B. Chen, L. Liu, S. Cheng, J. Bao, S. Tong, S. Xu, T. Y. Zhuo, T. Ye, Q. Qi, M. Li, L. Liao, Z. Tan, C. Shi, X. Tang, S. Tankasala, B. Yuan, Y. Qian, J. Tu, C. Wang, Y. Sun, W. Wang, A. Taylor, Z. Yang, C. Guan, Z. Dong, X. Zhang, S. Dillmann, H.-c. Lee, and D. Song. Skillsbench: Benchmarking how well 10 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification agent skills work across diverse tasks. arXiv preprint arXiv:2602.12670, 2026a. X. Li, G. Wen, X. Chen, Q. Long, A. Jain, F. Joly, M. Lam, Q. Song, and W. Su. textGrain: Entropy- calibrated watermarking for language model text. Technical report, OpenAI, Oct. 2026b. URLhttps: //cdn.openai.com/pdf/e9508624-d767-4 1b6-a26d-e34ca798ada6/textgrain-entro py-calibrated-watermarking-for-langu age-model-text.pdf . Technical report, October 5, 2026. Y. Liu, X. Zhao, C. Kruegel, D. Song, and Y. Bu. In- context watermarks for large language models. In The Fourteenth International Conference on Learning Representations, 2026. URLhttps://proceedi ngs.iclr.c/paper_files/paper/2026/h ash/571082ea18d30060177dfcaf662f0e5 -Abstract-Conference.html. A. Osmani. Agent skills. GitHub repository, 2026. URL https://github.com/addyosmani/agent-s kills. Accessed October 9, 2026. sickn33. Agentic awesome skills. GitHub repository, 2026. URLhttps://github.com/sickn33/a gentic-awesome-skills . Accessed October 9, 2026. I. Sutskever, O. Vinyals, and Q. V. Le. Sequence to se- quence learning with neural networks. In Advances in Neural Information Processing Systems, volume 27, 2014. URLhttps://papers.nips.c/paper _files/paper/2014/hash/5a18e133cbf9f 257297f410b7eca942-Abstract.html. Y. Tang, Y. Wang, R. Zhang, and J. Liu. Linguistic steganalysis via LLMs: Two modes for efficient de- tection of strongly concealed stego, 2024. URL https://arxiv.org/abs/2406.04218. S. Xu, Z. He, and Y. R. Fung. RedAct: Redacting agent capability traces for procedural skill protec- tion. arXiv preprint arXiv:2606.10813, 2026. URL https://arxiv.org/abs/2606.10813v3. Ver- sion 3. A. Yang, A. Li, B. Yang, B. Zhang, B. Hui, et al. Qwen3 technical report. arXiv preprint arXiv:2505.09388, 2025. URLhttps://arxiv.org/abs/2505.0 9388. B. Yang, W. Li, L. Xiang, and B. Li. SrcMarker: Dual- channel source code watermarking via scalable code transformations. In 2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2024. doi: 10.1109/SP54263.2024.00097. URLhttps: //ieeexplore.ieee.org/abstract/docum ent/10646683/. B. Zhang, K. Lazuka, and M. Murag. Equipping agents for the real world with agent skills. Anthropic En- gineering, 2025. URLhttps://w.anthropi c.com/engineering/equipping-agents-f or-the-real-world-with-agent-skills. Published October 16, 2025; accessed October 8, 2026. R. Zhang, S. S. Hussain, P. Neekhara, and F. Koushan- far. REMARK-LLM: A robust and efficient wa- termarking framework for generative large lan- guage models. In 33rd USENIX Security Symposium (USENIX Security 24), pages 1813–1830. USENIX Association, 2024. URLhttps://w.usenix.o rg/conference/usenixsecurity24/prese ntation/zhang-ruisi. X. Zhao, P. Ananth, L. Li, and Y.-X. Wang. Provable robust watermarking for AI-generated text. In The Twelfth International Conference on Learning Repre- sentations, 2024. URLhttps://arxiv.org/ab s/2306.17439. Z. Ziegler, Y. Deng, and A. Rush. Neural linguistic steganography. In Proceedings of the 2019 Confer- ence on Empirical Methods in Natural Language Pro- cessing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pages 1210–1215. Association for Computational Linguistics, 2019. doi: 10.18653/v1/D19-1115. URLhttps://aclanthology.org/D19-111 5/. 11 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification A. Additional Experimental Details A.1. Absolute Downstream Results Table 1 reports the absolute values underlying Figure 3 for the same settings and datasets. Table 1|Watermarking largely preserves downstream task performance. Performance, mean tokens, and median task time across four datasets and three skill settings. Everyday / General ScenariosProfessional Scenarios agent-skillsawesome-skillsmarketingskillsskill-use-bench Setting Passed checks↑ (%) Tokens↓ (K) API time↓ (s) Passed checks↑ (%) Tokens↓ (K) API time↓ (s) Passed checks↑ (%) Tokens↓ (K) API time↓ (s) Passed checks↑ (%) Tokens↓ (K) API time↓ (s) No Skill89.83 337.5 51.6 82.93 273.1 38.2 78.10 195.0 36.9 42.66 1066.0 101.0 Original Skill97.46836.672.292.03772.171.294.20709.863.259.851221.3100.7 Watermarked Skill98.25954.382.790.18998.375.593.56879.673.660.411181.395.4 A.2. Main Experimental Hyperparameters The main hyperparameters are listed below. Robustness experiments use the frozen English water- marked release; its embedding settings are listed separately from the downstream evaluation. ExperimentHyperparameterValue DownstreamAgent / judgeDeepSeek-V4-Flash [1m] / same model Judgments per case1 Bootstrap replicates / seed10,000 / 20261010 Robustness embeddingModel / beam widthQwen3-8B / 5 Green fraction 훾 / logit bias 훿0.75 / 8 Hash key / embedding seed15485863 / 123 Copy-pasteCopied length (tokens)256, 512, 1024, 1536, 2048 Unwatermarked text length (tokens) 1024, 4096 Number of fragments1, 2, 4, 8 Selection / insertion seeds123, 456, 789 Detection window / stride (tokens)1024 / 256 Per-window significance threshold푝≤ 0.01 Skill mergingMerging model / reasoning effort deepseek-flash / high Maximum output tokens65,536 Total input skills1, 2, 4 (one target plus 0, 1, 3 backgrounds) Background selection seeds123, 456, 789 Single-window length / stride (tokens)3952 / 1027 Single-window probability threshold 푝≤ 0.03332253 Multi-scale unionOR of 13 component decisions Copy-paste window tests use nominal probabilities without multiple-testing correction. Merge detector parameters were selected on the same evaluation cohort, without a held-out test set. 12 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification B. Experimental Prompts B.1. Watermark Embedding The English embedding prompt below contains the system instruction and two user–assistant demon- strations. The final user message is replaced by the current editable passage. Role labels and the bracketed input field are presentation annotations; the remaining text is reproduced verbatim from the saved generation configuration. Watermark embedding: English prompt with demonstrations [System] Preserve the original meaning, key facts, conditions, negations, numerical values, technical identifiers, and formatting. You may freely rephrase the remaining wording. Output only the rewritten passage in its original language. [User: demonstration 1] **Core principle**: Automatically write patterns that meet the automatic-write conditions (frequency≥3, consistent fixes, certainty 100%) to skill references; otherwise, retain them as a staged patch. [Assistant: demonstration 1] **Core principle**: Write patterns to skill references automatically only when all automatic-write conditions are met (frequency≥3, consistent fixes, certainty 100%); keep patterns that do not meet these conditions as a staged patch. [User: demonstration 2] Purely visual ALIGN differences in CHECK-8 and CHECK-11 (style compliance) do not block the gate; record them in the report for later improvement. **CRASH/URL issues in CHECK-8 are functional failures** (a page failing to open or crashing is not a "visual issue"); they block the gate and enter the §5 loop. [Assistant: demonstration 2] Record purely visual ALIGN differences in CHECK-8 and CHECK-11 (style compliance) in the report for future improvement; they do not block the gate. **CRASH/URL issues in CHECK-8 are functional failures** (a page failing to open or crashing is not a "visual issue"), so they block the gate and enter the §5 loop. [User: actual input] [CURRENT EDITABLE PASSAGE] B.2. Skill-Merging Instruction For the merging evaluation, the system message contains the instruction below; the user message contains the complete input skills. Skill-merging evaluation prompt [System] Merge the provided skills into one skill. [User] [COMPLETE INPUT SKILLS IN THE RECORDED ORDER] C. Extended Structured Skill Case Study Figure 9 retains the earlier nine-excerpt presentation ofobservability-and-instrumentation, complementing the compact view in Figure 8. The skill was watermarked with Qwen3-8B using an English prompt and default protection. The saved mapping records exact preservation of protected spans and full-text nominal푝=4.62×10 −9 . Long protected blocks show their opening lines only; 13 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification omission marks separate non-contiguous excerpts. Original generation defects are retained, so literal preservation and detection do not establish semantic or functional equivalence. Figure 9|Protected content remains unchanged during watermarking. Extended original and watermarked excerpts ofobservability-and-instrumentationshow preserved literal content and rewritten prose that carries the watermark. D. Ablation Settings and Additional Results Experimental setup. We evaluate 32 selected skills from the four datasets using Qwen3-8B (Yang et al., 2025), with three fixed seeds per skill and configuration. SkillMarker uses five-beam search, 14 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification 훾=0.75, and logit bias훿=8. We average the three runs within each skill and then weight skills equally. Instruction quality is a blind, holistic model-review score on a 0–100 scale, rather than an execution-based measure of functional correctness. Watermark strength is the full-document 푧-score after saving and retokenizing the output. Figure 7 reports means; an average푧-score is not a document-level significance test or detection rate. Module correspondence. All six configurations retain mandatory literal protection. For quality- constrained rewriting (Section 2.2), w/o fidelity constraints removes the prompt-level preservation constraints, while w/o logit bias sets훿=0 but retains candidate selection. For signal-oriented candidate search (Section 2.3), w/o beam search uses a single path; w/o signal-oriented selection replaces watermark-oriented ranking with model-score selection; and w/o reconstructed-text scoring scores generated tokens instead of the reconstructed, retokenized document. The latter two variants replay SkillMarker’s candidate pools, isolating the selection rule. Reconstructed-text scoring is distinct from token-variant grouping, which remains enabled. Results. SkillMarker achieves quality 70.97 and mean strength 3.01. Removing fidelity constraints raises strength to 3.37 but lowers quality to 67.09, illustrating the role of these constraints in preserving instructions. Removing beam search, signal-oriented selection, or logit bias reduces strength to 0.65, 0.69, or 0.83, respectively, while quality increases to 76.06, 75.50, or 73.06. These components therefore contribute watermark evidence at a cost in holistic quality score. Generated-token scoring yields 70.00 quality and 2.98 strength, close to SkillMarker; these means alone do not establish a substantial benefit from reconstructed-text scoring. Overall, SkillMarker offers a balance rather than dominating every alternative. The curve is a visual guide anchored at SkillMarker, not evidence of attainable intermediate configurations. 15