Two model endpoints may claim the same brand or differ behind a wrapper. Rather than relying on text style, AgentTrace perturbs the tool interface and records how the model repairs invalid calls. The resulting sequence can act as a statistical behavioral fingerprint of the underlying model/harness pairing. The paper studies black-box attribution using…
Inspect the ClaimsCase · DiggingBeagle record
AgentTrace fingerprints model identity from malformed tool-call repair paths
A black-box study uses sequences of schema errors and repairs to attribute underlying models in selected tests, including cases where model identity was deliberately obscured. It is a probabilistic signature, not cryptographic attestation.
Scope
A wrapper, validator, temperature setting or model update can change these trajectories. The benchmark result does not show universal provider identity detection and cannot prove a vendor fraud claim on its own.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
Enrich update: CLM-ENRICH-20261027-01 cites SRC-2026-CP21-AGENTTRACE-REPAIR-FINGERPRINT at Abstract, repair sequences and intra-family variants. New evidence concerns the bounded reported mechanism, prerequisite or outcome; setting evaluation; exploit status demonstrated; remediation status not_applicable. No independently comparable impact scale, affected production population or universal exploit success measure was established, so the impact band remains null. Original Claims remain individually attributable and any observed incident or simulated result is distinguished in the narrative.
Assessed Oct 27, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-ENRICH-20261027-01 · AgentTrace: black-box model attribution from tool-call repair trajectories
At a glance
The method turns tool-error handling into measurable evidence, while leaving a clear gap between attribution and authentication.
Read the implicationsA wrapper, validator, temperature setting or model update can change these trajectories. The benchmark result does not show universal provider identity detection and cannot prove a vendor fraud claim on its own.
Limits and uncertaintyFull account
Two model endpoints may claim the same brand or differ behind a wrapper. Rather than relying on text style, AgentTrace perturbs the tool interface and records how the model repairs invalid calls. The resulting sequence can act as a statistical behavioral fingerprint of the underlying model/harness pairing.
The paper studies black-box attribution using deliberately malformed tool schemas and the sequence of model attempts to repair them, reporting 96 percent attribution in a selected identity-spoofing test configuration. A wrapper, validator, temperature setting or model update can change these trajectories. The benchmark result does not show universal provider identity detection and cannot prove a vendor fraud claim on its own.
Use behavioral probes as an auxiliary audit signal alongside signed deployment attestations and versioned API logs; do not replace contractual identity controls with a classifier confidence score. The method turns tool-error handling into measurable evidence, while leaving a clear gap between attribution and authentication. Primary evidence.
Additional evidence and trust boundary
A malformed tool schema can elicit more identity signal than a free-form prose challenge because the validator fixes the required output format. However, the observed trace includes the agent wrapper and its validation policy. It is therefore a behavioral fingerprint of a tested configuration, not cryptographic attestation of model weights. Rotating server implementations and normalizing failures could change the fingerprint. Supporting record.
Timeline
- Oct 23, 2026disclosure
Public disclosure
Claims & evidence
CLM-ENRICH-20261027-01AgentTrace uses the time-ordered sequence of failed tool calls and repair attempts, modeled with lightweight Markov chains, to distinguish evaluated models that share a tokenizer, including Llama-3 8B and 70B variants.supported
Basis: reported finding
- supportsAgentTrace: black-box model attribution from tool-call repair trajectoriesprimary disclosure
Abstract, repair sequences and intra-family variants
CLM-CP21-AGENTTRACE-REPAIR-FINGERPRINT-1The paper studies black-box attribution using deliberately malformed tool schemas and the sequence of model attempts to repair them, reporting 96 percent attribution in a selected identity-spoofing test configuration.supported
Basis: reported finding
- supportsAgentTrace: black-box model attribution from tool-call repair trajectoriesprimary disclosure
Abstract; malformed schema challenge and Markov repair trajectory evaluation
Implications
The method turns tool-error handling into measurable evidence, while leaving a clear gap between attribution and authentication.
Controls and mitigations
- Use behavioral probes as an auxiliary audit signal alongside signed deployment attestations and versioned API logs; do not replace contractual identity controls with a classifier confidence score.
Unknowns and contradictions
- A wrapper, validator, temperature setting or model update can change these trajectories. The benchmark result does not show universal provider identity detection and cannot prove a vendor fraud claim on its own.
Sources and citation
Material revision history
- Oct 27, 2026 · Canonical change recorded · new in release · revision 196