AgentTrace: Execution-Level Fingerprinting of Black-Box LLM Agents

Gejian Zhao; Hanzhou Wu; Xinpeng Zhang

cs.CROct 23, 2026

AgentTrace: Execution-Level Fingerprinting of Black-Box LLM Agents

Authors: Gejian Zhao, Hanzhou Wu, Xinpeng Zhang

Organizations: Shanghai University

Abstract

Verifying the provenance of autonomous LLM agents is a critical security challenge. Existing semantic attribution is easily obfuscated by system prompts, while active watermarking conflicts with schema-constrained tool generation. We propose AgentTrace, an active framework that identifies the foundation model behind a black-box agent via observable execution traces. AgentTrace injects structurally ambiguous probes to trigger tokenization-sensitive serialization failures at rigid tool interfaces. While these initial failures provide coarse-grained separation across model families, the temporal sequence of subsequent repair operations reveals fine-grained, model-specific recovery behaviors. By modeling these multi-step trajectories with lightweight Markov chains, AgentTrace achieves 96.0% attribution accuracy under adversarial identity spoofing. Crucially, sequential repair modeling successfully distinguishes the evaluated intra-family variants sharing identical tokenizers (e.g., Llama-3 8B/70B), substantially outperforming unordered behavioral statistics while remaining robust against prompt obfuscation and temperature scaling.

Figures & tables

Figure 1: Conceptual workflow of AgentTrace. A genuine target model may reproduce a structurally ambiguous identifier successfully. A spoofed model with a different tokenization pattern may produce malformed escaping or other serialization anomalies rejected by the parser. AgentTrace combines the tokenization-sensitive failure category with the subsequent sequence of repair operations to identify the underlying model.

Role	Family	Model Instance	Tokenizer
Claimed Target	GPT	gpt-4o	o200k_base
Substitutes	Llama	Llama-3-8B-Instruct	Tiktoken BPE, 128k
	Llama	Llama-3-70B-Instruct	Tiktoken BPE, 128k
	Mistral	Mistral-7B-Instruct-v0.3	SentencePiece, 32k
	Qwen	Qwen-2.5-7B-Instruct	Tiktoken BPE, 152k
	Qwen	Qwen-2.5-72B-Instruct	Tiktoken BPE, 152k

Table 1: Evaluation models and tokenizer configurations.

Underlying Model	Stylometry		Cross-Perplexity		Bag-of-Operations		AgentTrace (Ours)
Underlying Model	Recall	F1	Recall	F1	Recall	F1	Recall	F1
GPT-4o ( Target Identity )	94.0%	0.48	88.0%	0.62	92.0%	0.85	98.0%	0.99
Llama-3-8B-Instruct	18.0%	0.15	42.0%	0.38	72.0%	0.68	92.0%	0.93
Llama-3-70B-Instruct	24.0%	0.20	46.0%	0.42	74.0%	0.70	94.0%	0.95
Mistral-7B-Instruct	12.0%	0.11	38.0%	0.35	78.0%	0.78	98.0%	0.98
Qwen-2.5-7B-Instruct	14.0%	0.12	48.0%	0.40	70.0%	0.65	96.0%	0.96

Table 2: Attribution performance on the held-out probes under adversarial identity spoofing.

Query Budget ( $Q$ )	1	3	5	10	50
Accuracy (%)	65.2	78.4	86.5	92.8	96.0

Table 3: Effect of the query budget (

Q

) on attribution accuracy.

Figure 2: Empirical repair-transition graphs for Llama-3 variants (edge thickness corresponds to transition probability). While both models suffer identical initial tokenization crashes, their repair strategies strictly diverge: (a) Llama-3-8B is trapped in repetitive correction loops, while (b) Llama-3-70B navigates toward success via structured repair.

Representation	Llama-3 Pair	Qwen-2.5 Pair	Overall
Initial Outcome	50.0%	50.0%	66.8%
+ Repair Trajectory	93.0%	97.0%	96.0%

Table 4: Ablation study on execution-trace representations.

Panel of Figure 3 — Figure 3: Attribution accuracy under defensive interventions. (a) Semantic baselines degrade substantially under prompt-based obfuscation, whereas AgentTrace remains stable across different system prompts. (b) Although higher generation temperatures introduce stochasticity, the Markovian trajectory modeling in AgentTrace maintains robust attribution performance.

Figure 4: Multi-step execution traces induced by the same adversarial identifier. Despite identical initial JSON errors, the Llama-3 variants exhibit divergent repair dynamics: the 8B model falls into truncation retry loops, whereas the 70B model employs structured escaping. These distinct sequential trajectories provide robust execution-level fingerprints.

Language Model Fingerprinting

Language model fingerprinting identifies and verifies models or their lineage from distinctive outputs, internal representations, or embedded signals.

See all 81 papers

Who Is Behind the Harness? Fingerprinting LLMs through Agentic Behavior
Sep 23, 2026Chuyi Wang, Xiaohui Xie, Tongze Wang +2Coding Agents Language Model Fingerprinting
Department of Computer Science and Technology, Tsinghua University
Black-Box Forensics for Conversational LLM Agents
Jun 21, 2026Isadora White, Yasaman Jafari, Taylor Berg-KirkpatrickLanguage Model Fingerprinting LLM Agent Security
University of California, San Diego
TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories
Jul 9, 2026Zheng Gao, Xiaoyu Li, Xiaoyan Feng +5LLM Agent Security LLM Watermarking
University of New South Wales · 2Griffith University · 3CSIRO’s Data61

Sep 23, 2026J/K move · Enter open · S save

Who Is Behind the Harness? Fingerprinting LLMs through Agentic Behavior

Chuyi Wang, Xiaohui Xie, Tongze Wang, Fangchen Luo+1

Department of Computer Science and Technology, Tsinghua University

Coding Agents Language Model Fingerprinting

Open paper AskPDF arXiv

LLMs increasingly operate through coding-agent harnesses that inspect repositories, invoke tools, and modify files. Substituting the model behind such an agent can therefore change security-relevant decisions, including whether it verifies changes or recovers safely from failures. Existing LLM fingerprints largely infer identity from direct text or token distributions. In coding agents, these signals are mediated by system instructions, controller logic, tools, and execution feedback, limiting their transfer. We present LIDAR (LLM Identification from Decisions and Actions at Runtime), an active black-box fingerprinting method for coding-agent execution. Three coding probe pairs expose post-edit verification, transient-failure recovery, and specification--test conflict resolution under controlled changes. LIDAR represents the resulting trajectories with complementary instance-level and distribution-level features and compares them with clean references using a lightweight probabilistic identifier. It requires no access to model weights, logits, or provider internals. Across 36 models from seven families and two agent harnesses, LIDAR achieves high Top-1 accuracy and MRR and outperforms four existing fingerprinting and API-auditing baselines. Ablations confirm that the two feature levels, all probe pairs, and their controlled variants contribute. These results show that agent execution behavior provides model-identity evidence beyond final outputs.

Abstract

Language Model Fingerprinting

Explore similar work

Who Is Behind the Harness? Fingerprinting LLMs through Agentic Behavior

Black-Box Forensics for Conversational LLM Agents

TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories