cs.CR提交于 2026-10-26已译

AgentTrace：黑盒 LLM 智能体的执行级指纹识别

AgentTrace: Execution-Level Fingerprinting of Black-Box LLM Agents

Gejian Zhao · Hanzhou Wu · Xinpeng Zhang

中文摘要

自主 LLM 智能体的来源验证是一项关键安全挑战。现有语义归因易受系统提示混淆，主动水印又与受 schema 约束的工具生成机制冲突。AgentTrace 通过可观察执行轨迹识别黑盒智能体背后的基础模型。该方法注入结构歧义探针，在严格工具接口处触发对分词敏感的序列化失败。初始失败可粗粒度区分不同模型家族，而后续修复操作的时间序列则揭示细粒度、模型特有的恢复行为。以轻量级马尔可夫链对这些多步轨迹建模后，即使面对对抗性身份伪装，归因准确率仍达到 96.0%。顺序修复建模还能区分使用相同 tokenizer 的同族变体，例如 Llama-3 8B/70B，效果显著优于无序行为统计，并对提示混淆与温度缩放保持稳健。

关键要点

01问题：系统提示可轻易混淆语义归因，主动水印则难以兼容 schema 约束的工具生成。
02方法：注入结构歧义探针，利用严格工具接口上的分词敏感型序列化失败。
03方法：以轻量级马尔可夫链建模后续修复操作的时间序列与多步轨迹。
04结果：在对抗性身份伪装下，基础模型归因准确率达到 96.0%。
05结果：可区分共享 tokenizer 的 Llama-3 8B/70B，并抵抗提示混淆与温度缩放。

解读

尚无解读。

原始英文摘要

arXiv:2610.32092v1 Announce Type: cross Abstract: Verifying the provenance of autonomous LLM agents is a critical security challenge. Existing semantic attribution is easily obfuscated by system prompts, while active watermarking conflicts with schema-constrained tool generation. We propose AgentTrace, an active framework that identifies the foundation model behind a black-box agent via observable execution traces. AgentTrace injects structurally ambiguous probes to trigger tokenization-sensitive serialization failures at rigid tool interfaces. While these initial failures provide coarse-grained separation across model families, the temporal sequence of subsequent repair operations reveals fine-grained, model-specific recovery behaviors. By modeling these multi-step trajectories with lightweight Markov chains, AgentTrace achieves 96.0% attribution accuracy under adversarial identity spoofing. Crucially, sequential repair modeling successfully distinguishes the evaluated intra-family variants sharing identical tokenizers (e.g., Llama-3 8B/70B), substantially outperforming unordered behavioral statistics while remaining robust against prompt obfuscation and temperature scaling.