Paper deep dive
Who Is Behind the Harness? Fingerprinting LLMs through Agentic Behavior
Chuyi Wang, Xiaohui Xie, Tongze Wang, Fangchen Luo, Yong Cui
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 9/25/2026, 3:50:16 AM
Summary
The paper introduces LIDAR, an active black-box fingerprinting method for identifying Large Language Models (LLMs) operating within coding-agent harnesses. Unlike existing methods that rely on text outputs or token distributions, LIDAR analyzes runtime behavioral trajectories, specifically focusing on post-edit verification, transient-failure recovery, and specification-test conflict resolution. By comparing instance-level and distribution-level features of these trajectories against clean references, LIDAR achieves high accuracy in identifying the underlying model across 36 models from seven families, outperforming existing baselines.
Entities (9)
Relation Signals (7)
Chuyi Wang → affiliatedwith → Tsinghua University
confidence 95% · Affiliation: Department of Computer Science and Technology, Tsinghua University
LIDAR → uses → Coding Agent
confidence 95% · LIDAR is an active black-box fingerprinting method for coding-agent execution.
LIDAR → evaluates → Recover Probe
confidence 92% · Three coding probe pairs expose... transient-failure recovery... Recover observes how the agent handles an unexpected but temporary test failure.
LIDAR → evaluates → Resolve Probe
confidence 92% · Three coding probe pairs expose... specification--test conflict resolution... Resolve observes how the agent handles a conflict between the user specification and a stale shipped test.
LIDAR → evaluates → Verify Probe
confidence 92% · Three coding probe pairs expose post-edit verification... Verify observes how the agent checks its own change.
LIDAR → achieveshighaccuracyon → 36 Models
confidence 90% · Across 36 models from seven families and two agent harnesses, LIDAR achieves high Top-1 accuracy and MRR
LIDAR → outperforms → Existing Fingerprinting Baselines
confidence 90% · LIDAR... outperforms four existing fingerprinting and API-auditing baselines.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:LLMs increasingly operate through coding-agent harnesses that inspect repositories, invoke tools, and modify files. Substituting the model behind such an agent can therefore change security-relevant decisions, including whether it verifies changes or recovers safely from failures. Existing LLM fingerprints largely infer identity from direct text or token distributions. In coding agents, these signals are mediated by system instructions, controller logic, tools, and execution feedback, limiting their transfer. We present LIDAR (LLM Identification from Decisions and Actions at Runtime), an active black-box fingerprinting method for coding-agent execution. Three coding probe pairs expose post-edit verification, transient-failure recovery, and specification--test conflict resolution under controlled changes. LIDAR represents the resulting trajectories with complementary instance-level and distribution-level features and compares them with clean references using a lightweight probabilistic identifier. It requires no access to model weights, logits, or provider internals. Across 36 models from seven families and two agent harnesses, LIDAR achieves high Top-1 accuracy and MRR and outperforms four existing fingerprinting and API-auditing baselines. Ablations confirm that the two feature levels, all probe pairs, and their controlled variants contribute. These results show that agent execution behavior provides model-identity evidence beyond final outputs.
Tags
Links
- Source: https://arxiv.org/abs/2609.28559v1
- Canonical: https://arxiv.org/abs/2609.28559v1
Trouble viewing inline? Open PDF directly →
Full Text
73,883 characters extracted from source content.
Expand or collapse full text
Who Is Behind the Harness? Fingerprinting LLMs through Agentic Behavior Chuyi Wang, Xiaohui Xie*, Tongze Wang, Fangchen Luo, Yong Cui* Affiliation: Department of Computer Science and Technology, Tsinghua University Abstract LLMs increasingly operate through coding-agent harnesses that inspect repositories, invoke tools, and modify files. Substituting the model behind such an agent can therefore change security-relevant decisions, including whether it verifies changes or recovers safely from failures. Existing LLM fingerprints largely infer identity from direct text or token distributions. In coding agents, these signals are mediated by system instructions, controller logic, tools, and execution feedback, limiting their transfer. We present Lidar (LLM Identification from Decisions and Actions at Runtime), an active black-box fingerprinting method for coding-agent execution. Three coding probe pairs expose post-edit verification, transient-failure recovery, and specification–test conflict resolution under controlled changes. Lidar represents the resulting trajectories with complementary instance-level and distribution-level features and compares them with clean references using a lightweight probabilistic identifier. It requires no access to model weights, logits, or provider internals. Across 36 models from seven families and two agent harnesses, Lidar achieves high Top-1 accuracy and MRR and outperforms four existing fingerprinting and API-auditing baselines. Ablations confirm that the two feature levels, all probe pairs, and their controlled variants contribute. These results show that agent execution behavior provides model-identity evidence beyond final outputs. 1 Introduction LLM agents have rapidly evolved from conversational assistants into systems that plan, invoke tools, and modify external state. Agent-oriented post-training and execution harnesses make this capability practical: agents can modify real systems by inspecting code, editing files, running commands and tests, recovering from failures, and completing long-horizon tasks [20, 8]. Although a harness mediates execution, the underlying LLM determines security-sensitive decisions—what evidence to inspect, which actions to take, whether to verify a change, and how to handle permissions, failures, and adversarial instructions. Yet users increasingly access this model only through opaque remote endpoints whose implementation and routing are hidden. A provider, relay, or compromised router can silently serve a different model while continuing to present the advertised identity [4]. This creates a model-substitution auditing problem: users need an independent way to determine whether the model used by an agent is the one the service claims to provide. Model identification has motivated a broad literature on LLM fingerprinting, which can be categorized by the verifier’s level of model access. White-box methods use weights, gradients, logits, or a local reference model to construct or embed fingerprints [13, 14, 34]; black-box methods infer identity from selected responses, perturbation sensitivity, visible reasoning, or token distributions [26, 30, 28, 3]. At a direct prompt–response interface, these methods largely treat the observed model output as the evidence to identify the model. An agent harness breaks this assumption. Existing black-box fingerprints observe what a model says. An agent harness changes both what the verifier sees and what the model does. Through observation mediation, the host or provider can rewrite visible responses, inject identity instructions, and interleave model output with controller and tool messages. Decision mediation then shapes the next step by constructing context, selecting available tools, and feeding back tool results, errors, and stopping conditions; these inputs shape what the model inspects, edits, tests, or retries. The resulting trace is therefore a joint product of the model and its execution environment: the same model may follow different trajectories under different hosts, while routing can mix behavior from different models [4, 23]. A fingerprint built for a direct LLM interface may consequently fail to transfer unchanged. Our key insight is that the harness is not only an obstacle to fingerprinting; it also creates a new source of identity evidence. A coding task exposes how a model inspects evidence, invokes tools, orders actions, edits files, responds to feedback, and recovers from failures or conflicts. We instantiate this insight in Lidar, a black-box method that identifies the LLM used by a coding agent from its behavior throughout task execution. Recent agent watermarking and trajectory-analysis work suggests that action sequences carry information beyond final responses [16, 1, 11]. Lidar differs fundamentally: it inserts no owner-controlled signal and instead actively elicits naturally occurring behavioral differences. Turning this insight into a reliable fingerprint raises three challenges. First, the verifier must expose model-specific workflow decisions under controlled and repeatable conditions, because similar final outputs can hide substantially different execution processes. Second, it must turn stochastic and harness-specific executions into a comparable representation while preserving both variant-specific decisions and recurring behavioral patterns. Third, practical auditing must limit remote-query and harness-execution costs, often with only a small enrollment set. The identifier must therefore be lightweight, stable, and easy to inspect. To address these challenges, Lidar actively probes behavior instead of passively classifying observed trajectories. Each of its three coding-probe pairs holds the repair objective and repository context fixed while varying one condition that exposes verification, recovery, or conflict-handling decisions. The resulting contrast controls for task content and focuses the fingerprint on how the model changes its tool use, action order, verification, and repository outcome. Lidar preserves these within-pair decisions as instance-level features and models recurring tendencies across probes and repeated executions as distribution-level features. Trajectory organization supplies most identity evidence, while no single action or response dominates. A lightweight probabilistic identifier then compares this evidence with clean, harness-specific references. On the 36-model panel, Lidar reaches 95.13% and 88.36% accuracy, with MRR of 0.9736 and 0.9336, under the two harnesses, respectively; it is the best mean in all six metric–harness comparisons. Lidar further demonstrates robustness across representative perturbation scenarios. In summary, this work makes the following contributions: • To our knowledge, we present the first active black-box framework for identifying the LLM used by a coding agent, enabling independent audits of a service’s model-identity claim. • We design paired coding probes that hold the repair goal fixed while varying one condition, exposing differences in agent decisions and repository outcomes. • We combine instance- and distribution-level trajectory features with a lightweight, auditable probabilistic identifier. • Across 36 models, seven families, and two agent harnesses, Lidar outperforms four state-of-the-art fingerprinting and API-auditing baselines and remains robust under representative perturbations. 2 Threat Model Figure 1: Threat model. The verifier controls host-side probe execution and records its local consequences, while the remote service controls hidden routing and remote transformations. An endpoint advertised as c may silently serve Mi,t∉ℳ(c)M_i,t (c). The resulting query fingerprint is compared with frozen, harness-specific enrollment references; the current verdict is closed-set behavioral evidence, not remote attestation. System and observation model. A developer uses a coding-agent CLI on a user-controlled host and selects a remote endpoint advertised as identity c. The CLI executes repository tasks locally while the service receives prompts, accumulated context, and tool feedback. The remote service hides its model implementation and internal routing: the verifier cannot inspect model weights, logits, provider logs, or routing state. Instead, it observes messages, controller events, agent actions, tool results, repository changes, and the final response at the CLI boundary. Let H,E,pi,DH,E,p_i,D denote the harness, local environment, probe variant, and deployment condition, respectively. If Mi,tM_i,t serves invocation t during pip_i, then Ti∼(Mi,t)t,H,E,D(⋅∣pi),X=(T1,…,Tk).T_i _(M_i,t)_t,H,E,D(· p_i), X=(T_1,…,T_k). (1) Here TiT_i is one agent trajectory and X is one complete fingerprint sample. Each harness has its own event mapping and reference data. Figure 1 summarizes this trust boundary and the resulting behavioral audit path. Protected asset and adversary. The protected asset is the service’s model-identity commitment. Let ℳ(c)M(c) be the identities authorized by claim c (a singleton for an exact version or a documented alias set). A violation occurs when Mi,t∉ℳ(c)M_i,t (c) (2) for a remote invocation while the session presents c. We call this model substitution (or service identity mismatch). It is a consumer downgrade only when an independent contract, product tier, capability/SLA, or resource ordering defines the serving model as lower; token price alone does not establish that ordering. The adversary is a provider, aggregator, relay, or compromised router. Knowing the public probe suite and scorer, it may remap c, alter provider-side instructions or context, and transform remote messages, actions, or presentation. It cannot modify the user’s host, frozen enrollment, fixtures, controller, tool executor, repository, test results, or trace recorder. Local execution events and outcomes are recorded on the verifier-controlled host; the verifier makes no such assumption about remote-policy provenance. Enrollment and audit objective. For each claimed identity c and harness H, the verifier collects an enrollment set ℰc,HE_c,H of complete, clean fingerprint samples under a declared protocol. Each element is an X from Equation 1, not an individual trajectory. The verifier accepts the source and identity label at collection time (e.g., an authenticated versioned endpoint or approved snapshot) and then freezes the behavioral reference. The protocol is replayed periodically or on demand; a sustained deviation is evidence of identity drift. Given registered references ℰm,H:m∈ℛ\E_m,H:m \ and a query X, m^(X)=argmaxm∈ℛsm(X), m(X)= _m s_m(X), (3) and the claim verdict is Vℛ(c,X)=supports claim,m^(X)∈ℳ(c),contradicts claim,m^(X)∉ℳ(c).V_R(c,X)= cases supports claim,& m(X) (c),\\ contradicts claim,& m(X) (c). cases (4) Because the current decision is closed-set, every query maps to a registered label and an unknown model may map to one of those labels. Evasion requires preserved task utility; open-set and mixed-routing cases remain separate. 3 Related Work Prior fingerprinting work differs in what the auditor can observe, what claim the method tests, and whether the observed behavior comes from one response or an interactive agent. We first review LLM fingerprinting by evidence access and claim scope, contrast it with watermarking for LLMs and agents, and then discuss behavior observed from interactive agents. 3.1 LLM Fingerprinting Evidence access. An LLM fingerprint is a repeatable behavior pattern produced by selected inputs. White-box or owner-assisted methods can use weights, gradients, logits, or a local model to design targeted fingerprints, but require stronger access; that access does not by itself guarantee higher accuracy. Instructional Fingerprinting adds a known behavior to a protected model [34], while LLMPrint builds fingerprints from an owner-held model [14]. TRAP combines both settings: it constructs prompts with white-box information and later checks a suspect through black-box queries [13]. Black-box methods instead use queries and returned text or tokens; exposed token probabilities provide additional information beyond a text-only interface. LLMmap selects queries for model classification [26]; ZeroPrint measures response changes under modified inputs [30]; CoTSRF uses visible reasoning text [28]; and One Token compares constrained token distributions [3]. LeaFBench compares such access settings across related and modified models [29]. Identification and service claims. Model identification selects the most likely identity from a registered set; a service audit asks whether a live endpoint remains consistent with a claim or reference. Prior work detects API behavior changes [5], compares response distributions [10], and studies substitution under natural queries, quantization, or audit-aware services [39, 4]. The claim may concern a model family, one version, a deployed endpoint, or a per-request routing choice, and evidence at one level does not prove the others. GhostPrint shows that a provider can tune a weaker model to imitate a fingerprint [36]; TrustedARI instead uses cryptographic records to support claims about the service path [19]. Lidar uses black-box enrollment and registered-model identification to audit a claimed live service. It does not decide that no registered model matches, prove that two models share the same weights, or authenticate the complete remote path. 3.2 Watermarking for LLMs and Agents Watermarking and fingerprinting both provide evidence for attribution, but they create that evidence differently: watermarking deliberately inserts a secret signal, whereas fingerprinting measures behavior that already exists. LLM watermarking began with keyed token sampling and statistical detection [18]. It then moved toward production deployment and stronger recovery from edited text [7, 37]. Recent work studies adaptive users and formally robust multi-bit messages [6, 27], while character-level attacks show that token-based evidence can remain fragile [38]. The focus has since expanded from output tokens to agent actions, because a text mark may disappear when a response becomes a tool call. Agent Guide first biases high-level behavior choices [16]; AgentMark and AGENTWM extend this direction to utility-preserving planning identifiers and functionally equivalent tool paths under imitation [15, 32]. SeqWM and TRACE further use multi-step transitions or complementary trajectory signals to resist missing, shifted, or rewritten actions [1, 11]. ActHook shifts the protected object from a live agent to its trajectory training data by inserting keyed hook actions [21]. All these watermarking methods insert owner-chosen evidence. Lidar instead leaves the service unchanged and matches its naturally occurring coding-agent behavior against black-box enrollment references. The two directions are therefore complementary: watermarking tests for an inserted signal, while Lidar identifies the registered model that best matches observed behavior. 3.3 Agent Behavior and Trajectory Analysis Once an LLM is placed inside an agent, the observable object is no longer one prompt and one response. The model makes a sequence of decisions under a controller, invokes tools, observes results, and changes an external state. This creates richer behavioral evidence, but it also introduces harness and environment effects that can be mistaken for model identity. Conversational-agent forensics infer base models and system prompts from multi-turn text [33]. Closer to coding agents, ProcGrep represents trajectories as programs and shows that procedural patterns carry attributable signal; it also reports substantial same-model divergence across harnesses [23]. AgentBench evaluates reasoning and decision making in interactive environments [20], while AgentDojo evaluates utility and prompt-injection robustness for tool-using agents [8]. These systems study forensics, capability, safety, or procedural characterization rather than verification of a remote model claim. Lidar instead elicits identity evidence with paired coding tasks and records locally verifiable tool use, recovery behavior, and repository consequences. It treats the harness as an explicit execution context, maps native events from two CLI harnesses into the same behavioral semantics, and excludes raw harness labels from the model fingerprint. 4 Overview Figure 2: Lidar workflow. Probe execution produces a fingerprint sample; feature extraction represents its local and across-variant behavior; enrollment and scoring compare a later query with frozen, harness-specific references. Provider-controlled attacks may alter the query path, while the verifier still records local execution events and outcomes. Figure 2 maps five operational steps to the three design components developed in Section 5. The verifier takes a claimed identity, a coding-agent CLI, and a set of registered model identities. The same behavioral semantics are instantiated on each supported CLI harness, while enrollment and scoring remain conditioned on the harness that produced the execution records. 1. Probe execution and local records (Steps 1–2). The verifier runs the A/B variants of the Verify, Recover, and Resolve probe pairs. Their six native trajectories form one fingerprint sample. The verifier records native events, repository outcomes, and controlled local checks, which are then used to construct behavioral features. 2. Feature extraction (Step 3). A common representation maps harness-native records to shared action and outcome semantics. Instance-level features retain the decision structure of each probe variant, while distribution-level features summarize behavior across the complete sample. 3. Enrollment and model identification (Steps 4–5). Repeated clean samples establish frozen feature processing and one count-based reference for each registered model under each harness. A later query is processed without updating those enrollment-fitted quantities and scored against every registered reference; the highest-scoring identity determines the closed-set verdict from Section 2. The small red callout and the green boundary in Figure 2 instantiate the threat model from Section 2. Provider-side routing, instructions, or output wrappers can affect a later query fingerprint, whereas the CLI records local execution events and outcomes on the user’s host. Sections 5.1, 5.2, and 5.3 explain the three design components; Sections 6.1 and 6 describe their instantiation and evaluation. 5 Design The five-step workflow in Figure 2 is organized around three design components: coding-agent probe pairs, agent behavior representation, and model identification with limited enrollment data. Lidar retains the enrollment–query–comparison pattern of conventional model fingerprinting but changes the observation unit from a direct response to an agent execution. Section 3 distinguishes direct-output fingerprints, live API audits, and agent trajectory analyses; the design below turns that boundary into concrete choices. Probe pairs expose controlled decisions in coding tasks, behavioral features represent local and across-variant working patterns, and a lightweight probabilistic identifier compares a query with clean enrollment references. Design goals. We organize Lidar around three goals that correspond to the three design components below. G1: Expose coding-agent-specific behavior. The probe pairs should exercise decisions that arise during coding-agent execution, such as checking a change, recovering from a failure, and resolving conflicting feedback, rather than rely only on the final response. G2: Represent agent behavior consistently. The feature representation should retain both the decisions made in individual probe variants and recurring behavior across the complete probe suite. The same feature should also keep the same meaning across supported harnesses. G3: Identify models with limited enrollment data. The identifier should remain effective when only a small number of clean fingerprint samples are available for each model and harness, while keeping the resulting score easy to inspect. 5.1 Probe Design From text outputs to agent behavior. Conventional LLM fingerprints distinguish models through their text outputs. They use carefully chosen prompts, response changes, token probabilities, or output distributions, and these signals are effective when the model is observed through a direct prompt–response interface. A coding agent has a longer path from the model to the visible result. Its final answer follows a system prompt, a controller, accumulated context, tool calls, execution feedback, and sometimes a presentation wrapper. These components can weaken the model-specific signal in the final text. Moreover, two agents can produce the same correct patch after following different inspection, editing, testing, and recovery processes. We therefore keep the idea of black-box behavioral comparison but enrich the fingerprint with agent-specific information. In addition to the final response, we observe which actions the agent takes, their order, how it reacts to tool feedback, and the repository state it leaves behind. These signals do not make the fingerprint immune to imitation. They provide information about the workflow that is missing when only the final text is measured. Coding tasks expose a complete agent workflow. A code-modification task naturally exercises the main stages of a coding agent: reading the request and repository, gathering information, editing files, running commands or tests, interpreting feedback, correcting mistakes, and deciding when to stop. Each stage leaves observable records on the user’s host through native tool events, test results, and repository diffs. The verifier can thus check both the agent’s intermediate process and its final result without depending on the agent’s own explanation. We implement each probe pair around a small, controlled repository task. The instruction, initial files, tests, and expected outcome are controlled by the verifier, so the same behavioral question can be repeated across models and harnesses. Prior work also finds useful model signal in agent procedures [23]. Our goal is to expose that signal under a simple and repeatable coding workflow rather than rely on an arbitrary task whose important decisions may differ from run to run. Three probe pairs. We designed three probe pairs to cover different parts of the coding-agent workflow. Each pair had to represent a common coding decision, allow more than one reasonable action sequence, and produce an outcome that could be checked locally. We also avoided selecting three tasks that measured the same testing habit. The resulting pairs are: • Verify observes how the agent checks its own change. In particular, we record whether it runs a relevant check after the final code edit instead of treating the edit itself as task completion. • Recover observes how the agent handles an unexpected but temporary test failure. We record whether it retries without inspection, investigates the cause, changes strategy, and eventually completes the correct recovery path. • Resolve observes how the agent handles a conflict between the user specification and a stale shipped test. We record whether it follows the specification, whether it changes the test, and whether the final code passes a verifier-controlled check. Together, the probe pairs cover post-edit checking, failure handling, and conflict resolution. They are not an exhaustive list of agent behavior, but they sample three important and different stages of an observe–act–check workflow. We evaluate their individual contribution through the probe-pair comparisons in Section 6. Two variants reveal workflow changes. Each probe pair has two versions of the same task. Variant A provides the normal condition, while variant B changes one instruction, fixture, or piece of execution feedback. Both variants request the same final result. For example, Recover-A runs the first test normally, whereas Recover-B returns a controlled temporary failure on that run. This pairing lets us compare how the same agent works before and after a specific condition changes. We can observe differences in files read, test commands, retries, strategy changes, edit order, and the final repository state. Because the task and desired result remain the same, task content and difficulty are less likely to explain the observed difference. A separate check confirms that variant B actually introduces the intended condition; otherwise, that pair is not used to measure the targeted behavior. We retain the ordered pair (A,B)(A,B) rather than only the difference B−AB-A. For a binary behavior, (0,0)(0,0) and (1,1)(1,1) have the same difference even though one agent never performs the behavior and the other performs it in both variants. The full pair preserves the normal workflow, the response to the changed condition, and the direction of that change. From trajectories to one fingerprint sample. Executing one probe variant once produces a trajectory. The three probe pairs, each with variants A and B, therefore produce six trajectories. We combine these six trajectories into one fingerprint sample, which is the unit passed to feature extraction and model identification. Repeating the six-run collection produces another independent fingerprint sample; individual tool calls or trajectories are not treated as separate samples. 5.2 Feature Extraction Feature space. An agent trajectory contains more than a final response. It records the actions the agent takes, the order and repetition of those actions, its response to execution feedback, and the final repository outcome. We convert these records into features covering action and test frequency, command use, reading–editing–testing order, repeated work and backtracking, failure recovery, variant-specific decisions, repository changes, and coarse response form. These fields capture both what the agent accomplished and how it reached that result. The full feature space has two parts. Instance-level behavior keeps detailed fields for each probe variant: 168 fields describe decisions and checked outcomes, while 588 fields describe the structure of the action sequence. Distribution-level behavior summarizes 101 trajectory descriptors by their mean and variation, producing 202 fields. Combining the two parts gives 756+202=958756+202=958 fields. We do not use direct model self-reports, provider or model labels, credentials, latency, raw file paths, raw command strings, or raw answers as fingerprint fields. In the instance-level representation, overall action length and direct communication counts are also kept only as diagnostics. The distribution-level representation retains coarse command-use and response-form counts because they describe the agent’s overall working pattern. Their contribution is evaluated separately rather than assumed to be useful. Cross-harness feature normalization. OpenCode and mini-swe-agent record the same action in different log formats and often use different tool names. Directly using those names would make the fingerprint depend on the harness rather than on the model. We therefore give each harness a small adapter that maps its native records to the same action roles, such as reading and inspection, changing a file, successful execution, failed execution, temporary execution failure, communication, and other actions. Tests and final diffs provide a common source for task outcomes. All later features use these shared roles and outcomes rather than raw event strings. Adding a harness requires only a tested adapter whose events have defined counterparts in the common representation; the probe pairs and downstream features remain unchanged. This supports the same measurement across harnesses, while enrollment references and scoring remain harness-specific. This step normalizes event meaning; numerical missing-value handling and binning are fitted later from enrollment data. Feature group Information retained Fields Instance-level structure Per-variant action roles, transitions, positions, repetition, backtracking, and recovery paths 588 Distribution-level behavior Across six trajectories, the mean and sample standard deviation of action, command-use, ordering, repetition, recovery, outcome, and coarse response-form descriptors 202 Table 1: Principal feature groups, retained information, and dimensions. Feature transformation. After normalization, we transform each six-trajectory fingerprint sample in two complementary ways. Instance-level behavior. This representation keeps each field attached to its probe pair and variant. Its 168 outcome fields record, for example, whether the implementation or tests changed, whether testing occurred before or after an edit, whether the final edit was checked, whether the temporary failure was observed and recovered, and how the specification–test conflict was resolved. Its other 588 fields describe the path to that outcome: action-role shares and transitions, the first and last workflow stage, positions of the first edit and test, repeated runs, backtracking, and the actions taken after a failure. When a behavior does not apply to a variant, we record an explicit not-applicable state instead of inventing an action. The resulting 756 fields preserve detailed local choices that would disappear in a global average. This detail is necessary because similar totals can hide different decisions. Two models may run the same number of tests, for example, while only one tests after its final edit; they may also produce the same correct patch through different recovery paths. Keeping the fields tied to each probe variant reveals those differences. Distribution-level behavior. This representation captures the overall working pattern across the probe suite. Each trajectory provides 101 numeric descriptors covering action volume and type, command use, ordering, repetition, recovery, probe-pair outcomes, and coarse response form. For every descriptor gjg_j, we compute its mean and sample standard deviation over the trajectories for which it is defined: Xj X_j =T∈X:gj(T) is defined, =\T∈ X:g_j(T) is defined\, ϕdist(X) _dist(X) =[μT∈Xjgj(T),sT∈Xjgj(T)]j=1101∈ℝ202. = [ _T∈ X_jg_j(T),s_T∈ X_jg_j(T) ]_j=1^101 ^202. The mean records a recurring tendency, while the standard deviation records how much that behavior changes across the six probe variants. A descriptor that applies to only one variant is summarized over that applicable subset. If a statistic cannot be computed, it is left missing and handled later using only enrollment data. This 202-field representation is less sensitive to one unusual trajectory and captures stable working patterns, but it no longer shows exactly which variant produced a shared value. The two transformations are therefore both needed. Instance-level behavior answers questions such as whether Verify-B was tested after its final edit; distribution-level behavior answers how often the agent tests and how stable that tendency is across the full suite. We evaluate both separately and also join them into the 958-field combined representation. The combined view is evaluated rather than assumed to be better, because related fields can describe the same behavior more than once. 5.3 Model Identification After feature extraction, model identification is naturally a supervised classification problem. For model c under harness H, the enrollment set ℰc,HE_c,H contains complete, clean fingerprint samples with an accepted identity label. Each enrollment sample is the six-trajectory object defined in Section 5.1; its component trajectories are not counted as separate samples. The verifier must assign a separately collected query sample to one of the enrolled labels. A standard solution could train a classical classifier over the feature vectors, such as logistic regression or a support-vector machine. With more data, one could also use a shallow neural network or a pretrained sequence encoder followed by a classification head. The difficulty in our setting is not defining such a classifier, but obtaining enough clean training data. Every labeled sample requires six remote agent executions, and a new model or harness requires a new clean enrollment set. Our evaluation uses six enrollment samples for each model–harness combination, corresponding to 36 trajectories, compared with 202, 756, or 958 feature fields. Neural classifiers usually need substantially more examples to learn a reliable boundary, and their learned weights are harder to relate to concrete agent actions. Classical classifiers remain useful comparison methods, but our experiments show that a much simpler frequency-based probability model also provides strong and stable identification. We therefore use that model as the default identifier. Harness-specific feature bins and counts. Each harness has its own controller, tools, and feedback format. Even after event normalization, these choices can shift feature values. We therefore build a separate feature reference for each harness. Only clean enrollment samples determine this reference; query and attack samples never change it. We first replace a non-finite numeric value with the enrollment median. If a field is empty throughout enrollment, we use zero as a fixed fallback. We then remove fields whose enrollment standard deviation is at most 10−1210^-12, because a constant field cannot distinguish the registered models in that harness. The remaining fields are converted to a small number of states. A field with at most eight distinct enrollment values keeps those values as its states, which preserves binary decisions and small categorical fields. A later value is mapped to the nearest frozen state. A field with more than eight values uses the enrollment lower- and upper-third quantiles as boundaries for up to three bins. The median, active-field set, states, and bin boundaries are then frozen and reused for every query. This transformation lets us handle binary, categorical, count, and continuous features through the same operation: counting how often each state appears. The eight-value cutoff and three-bin rule are simple design choices for a small enrollment set, rather than theoretically optimal values. All counts remain harness-specific so that a difference between harnesses is not mistaken for a difference between models. Verify Shared prompt: The is_blank function in textutil.py treats whitespace-only strings incorrectly. Fix the bug. A: Normal B: Controlled change No additional verification instruction; whether to run a check is left to the agent. The prompt additionally requires: Before finishing, run python -m unittest -q and report the result. Recover Shared prompt: First run ./run_tests.sh. Then fix the is_even bug in mathutil.py and confirm the tests pass. A: Normal B: Controlled change The first test invocation executes normally. The first test invocation returns exit 75 with a retry-safe transient error; subsequent invocations execute normally. Resolve Shared prompt: Update normalize_username in account.py: trim surrounding whitespace, convert the result to lowercase, and raise ValueError if it is empty. Do not modify tests. If a test conflicts with this specification, explain the conflict and follow the specification. A: Normal B: Controlled change The shipped tests agree with the specification. One shipped test requires preserving case, conflicting with the lowercase requirement. Table 2: Coding probe pairs used in the evaluation. Training/enrollment Test/query Successful runs Method Atomic sampling unit Units Runs Units Runs Per setting Full panel LLMmap [26] 8 probes / configuration 20 (configs) 160 20 (configs) 160 320 23,040 ZeroPrint [30] 5 responses / base query 10 (bases) 50 10 (bases) 50 100 7,200 MET [10] 10 prompts / repetition 5 (reps) 50 5 (reps) 50 100 7,200 One Token [3] 8 coordinates / repetition 5 (reps) 40 5 (reps) 40 80 5,760 Lidar 3 probe pairs (6 variants) / sample 6 (samples) 36 6 (samples) 36 72 5,184 Table 3: Sampling budgets for evaluated methods. Per setting counts successful runs for one model–harness combination; Full panel covers all 36 models and two harnesses. Failed attempts are excluded. Jeffreys-based probability estimation. Consider registered model c, active feature j, and feature state k within one harness. Let NcjkN_cjk be the number of model-c enrollment samples in state k, let ncn_c be the total enrollment samples for that model, and let KjK_j be the number of enrollment-defined states for feature j. The direct maximum-likelihood estimate converts the observed frequency into p^cjMLE(k)=Ncjknc. p^MLE_cj(k)= N_cjkn_c. With only six enrollment samples, however, a state that is not observed for model c receives probability zero. Its log probability is then negative infinity, so one sparse feature can eliminate an otherwise similar model. Add-one smoothing avoids zero, but adds one full artificial observation to every state. Instead, we use the smaller Jeffreys half-count: cj∼Dirichlet(12,…,12),p^cj(k)=Ncjk+1/2nc+Kj/2. p_cj \! ( 12,…, 12 ), p_cj(k)= N_cjk+1/2n_c+K_j/2. (5) The half-count gives every state a small nonzero probability while allowing the observed frequencies to remain dominant. It treats all state labels in the same way and does not favor a particular model. Thus, the final value is a probability estimated from enrollment frequencies with a weak symmetric prior. It follows the maximum-likelihood idea of using observed frequencies, but is more reliable when the enrollment set is small. This fitting step is simple, but it is not training-free: enrollment determines the replacement values, active fields, bins, and per-model state probabilities. Query-to-reference similarity. The enrollment set defines one state distribution p^cj p_cj for every model and feature. A query sample x contributes one observed state bj(x)b_j(x) for each active feature. Equivalently, that observation can be written as a point distribution qxjq_xj that assigns probability one to bj(x)b_j(x) and zero to the other states. We measure how well the query agrees with model c by averaging the log probability that model assigns to the observed states: sc(x)=1|J|∑j∈Jlogp^cj(bj(x))=−1|J|∑j∈JDKL(qxj∥p^cj),s_c(x)= 1|J| _j∈ J p_cj\! (b_j(x) )=- 1|J| _j∈ JD_KL\! (q_xj\,\|\, p_cj ), (6) where J is the set of active fields. A frequent enrollment state raises the score, while a rare state lowers it. This equation also shows the distribution comparison directly: the Jeffreys score is the negative average KL distance from the query observations to a model’s enrollment distributions. Other distribution measures, such as Jensen–Shannon, Hellinger, and Wasserstein distances, can replace this score. Our comparison favors the Jeffreys score because it gives the strongest balance between query accuracy and enrollment stability. It requires only auditable per-state counts, remains defined for unseen states, and does not impose an order on categorical states. The score is still a simple marginal approximation: correlated fields may represent the same behavior and give a large feature block more influence. We therefore compare distribution-level, instance-level, and combined features separately. Repeated query samples are also scored separately rather than merged into one query distribution, producing one model decision for each independently collected fingerprint sample. Model selection and open-set extension. For the registered-model setting, the verifier selects the model with the largest query-to-reference score: c∗(x)=argmaxcsc(x).c^*(x)= _cs_c(x). (7) This is the closed-set decision used in our current evaluation. It always selects one registered model, even when all models have low scores. The same scores can support an open-set extension by fixing an acceptance threshold τc _c for each registered model using a separate calibration set: c^(x)=c∗(x),sc∗(x)(x)≥τc∗(x),Unknown,otherwise. c(x)= casesc^*(x),&s_c^*(x)(x)≥ _c^*(x),\\ Unknown,&otherwise. cases (8) The thresholds must be chosen before testing from independent registered-model and unknown-model samples, for example to meet a target false-accept rate. A second threshold on the gap between the best and second-best scores could reject ambiguous cases. Our current experiments evaluate the closed-set rule in Equation 7; they do not fit these thresholds or claim evaluated open-set recognition. Equation 8 states how the scorer can be extended once suitable calibration data are available. OpenCode [25] mini-swe-agent [31] Method Top-1 Top-3 MRR Top-1 Top-3 MRR LLMmap [26] 0.6143(± 0.0170)0.6143 [rgb]0.5,0.5,0.5 \,(±\,0.0170) 0.8189(± 0.0134)0.8189 [rgb]0.5,0.5,0.5 \,(±\,0.0134) 0.7319(± 0.0121)0.7319 [rgb]0.5,0.5,0.5 \,(±\,0.0121) 0.5628(± 0.0223)0.5628 [rgb]0.5,0.5,0.5 \,(±\,0.0223) 0.7654(± 0.0215)0.7654 [rgb]0.5,0.5,0.5 \,(±\,0.0215) 0.6860(± 0.0186)0.6860 [rgb]0.5,0.5,0.5 \,(±\,0.0186) MET [10] 0.8667(± 0.0489)0.8667 [rgb]0.5,0.5,0.5 \,(±\,0.0489) 0.9574(± 0.0349)0.9574 [rgb]0.5,0.5,0.5 \,(±\,0.0349) 0.9160(± 0.0340)0.9160 [rgb]0.5,0.5,0.5 \,(±\,0.0340) 0.5917(± 0.0443)0.5917 [rgb]0.5,0.5,0.5 \,(±\,0.0443) 0.7315(± 0.0382)0.7315 [rgb]0.5,0.5,0.5 \,(±\,0.0382) 0.6927(± 0.0277)0.6927 [rgb]0.5,0.5,0.5 \,(±\,0.0277) ZeroPrint [30] 0.2833(± 0.0272)0.2833 [rgb]0.5,0.5,0.5 \,(±\,0.0272) 0.4333(± 0.0377)0.4333 [rgb]0.5,0.5,0.5 \,(±\,0.0377) 0.3971(± 0.0227)0.3971 [rgb]0.5,0.5,0.5 \,(±\,0.0227) 0.4000(± 0.0377)0.4000 [rgb]0.5,0.5,0.5 \,(±\,0.0377) 0.5889(± 0.0408)0.5889 [rgb]0.5,0.5,0.5 \,(±\,0.0408) 0.5197(± 0.0205)0.5197 [rgb]0.5,0.5,0.5 \,(±\,0.0205) One Token [3] 0.7333(± 0.0572)0.7333 [rgb]0.5,0.5,0.5 \,(±\,0.0572) 0.9167(± 0.0465)0.9167 [rgb]0.5,0.5,0.5 \,(±\,0.0465) 0.8294(± 0.0356)0.8294 [rgb]0.5,0.5,0.5 \,(±\,0.0356) 0.2722(± 0.0272)0.2722 [rgb]0.5,0.5,0.5 \,(±\,0.0272) 0.3056(± 0.0000)0.3056 [rgb]0.5,0.5,0.5 \,(±\,0.0000) 0.2878(± 0.0152)0.2878 [rgb]0.5,0.5,0.5 \,(±\,0.0152) Lidar 0.8836(± 0.0185)0.8836 [rgb]0.5,0.5,0.5 \,(±\,0.0185) 0.9838(± 0.0072)0.9838 [rgb]0.5,0.5,0.5 \,(±\,0.0072) 0.9336(± 0.0107)0.9336 [rgb]0.5,0.5,0.5 \,(±\,0.0107) 0.9513(± 0.0124)0.9513 [rgb]0.5,0.5,0.5 \,(±\,0.0124) 0.9962(± 0.0036)0.9962 [rgb]0.5,0.5,0.5 \,(±\,0.0036) 0.9736(± 0.0069)0.9736 [rgb]0.5,0.5,0.5 \,(±\,0.0069) Table 4: Identification performance on the 36-model panel. Results are reported on the [0,1][0,1] scale as mean ± SD. Gray terms denote SD; bold values indicate the best mean in each column. 6 Evaluation We evaluate Lidar for LLM identification across 36 models from seven families and two agent harnesses. After specifying the experimental protocol, we measure overall identification performance, isolate the contributions of the feature representation, probe pairs, and identifier, test robustness to provider-side manipulation, and analyze which trajectory mechanisms carry identity evidence. 6.1 Experimental Setup We specify the probe pairs and sampling unit, model panel and harnesses, baseline adaptations and sampling budgets, and evaluation metrics. 6.1.1 Paired Probe Suite Section 5.1 motivates the three behavioral themes and their paired design. Table 2 specifies the three probe pairs used in all experiments. Within each pair, variant A uses the normal condition and variant B introduces one controlled change while preserving the repair goal. Following Section 5.1, executing one probe variant once produces one trajectory, and the six trajectories produced by executing both variants of all three probe pairs in Table 2 form one fingerprint sample. Each variant execution uses an isolated fixture copy. 6.1.2 Models and Harnesses We evaluate 36 LLMs from seven families, covering both cross-family and within-family identification; Appendix A lists the complete model panel. We evaluate every model through OpenCode v1.17 [25] and mini-swe-agent v2.4 [31]. OpenCode provides a full-featured interactive coding environment, whereas mini-swe-agent uses a compact software-engineering agent loop. We apply the same probe pairs and behavioral definitions to both, testing whether Lidar depends on a particular harness design; only the parsing of harness-native events is adapted to each implementation. For Lidar, enrollment and query sets are collected separately; no execution is reused between them. For each model–harness combination, each set contains six complete fingerprint samples as defined in Section 5.3. Thus, the enrollment reference contains six samples—not six individual trajectories—and each sample executes all three probe pairs (six variants) with a distinct seed under the prescribed configuration for that model. Enrollment and query therefore contain 36 trajectories each. 6.1.3 Baselines We compare Lidar with four representative LLM fingerprinting and API auditing methods: LLMmap [26], Model Equality Testing (MET) [10], ZeroPrint [30], and One Token [3]. We preserve each method’s probe contract, feature extractor, statistic, and ranking rule. The harness adaptation is limited to mapping the published request fields into the native CLI request and extracting the user-visible assistant response, and every baseline is fitted and evaluated separately for each harness. The published methods use different sampling units: an LLMmap configuration contains eight probes, a ZeroPrint base query requires one original and four perturbed responses, MET compares prompt-labelled repetitions, and One Token estimates a distribution for each task–language coordinate. To control collection cost across 36 models and two harnesses, we apply the same reduction rule to every model–harness pair: preserve each baseline’s native sampling unit and allocate equal numbers of units to enrollment and query evaluation. Table 3 reports the resulting successful runs. This preserves each baseline’s original computation while applying the same balanced enrollment/query allocation rule to all methods. 6.1.4 Evaluation Metrics Let sm(x)s_m(x) be the score assigned to model m for query x, let yiy_i be the true model for query i, and let ri(yi)r_i(y_i) be its rank among the 36 candidate models. Top-k accuracy is Top-k=1N∑i=1N[ri(yi)≤k],k∈1,3.Top-k= 1N _i=1^N1\! [r_i(y_i)≤ k ], k∈\1,3\. (9) We also report mean reciprocal rank (MRR): MRR=1N∑i=1N1ri(yi).MRR= 1N _i=1^N 1r_i(y_i). (10) Top-1 measures whether the true model is identified exactly. Top-3 and MRR measure how highly it is ranked when it is not placed first, with MRR giving more credit to higher ranks. All scalar metrics are computed separately for each harness. Group Configuration Fields Top-1 Δ Top-1 (p) Top-3 MRR Reference Full method 958 0.9352 – 0.9884 0.9631 Feature view Instance only 756 0.7500 −18.52-18.52 0.9005 0.8377 Distribution only 202 0.8981 −3.70-3.70 0.9884 0.9426 Distribution statistic Instance + mean 857 0.9190 −1.62-1.62 0.9838 0.9529 Instance + standard deviation 857 0.9097 −2.55-2.55 0.9792 0.9454 Probe pair Without Verify 724 0.8819 −5.32-5.32 0.9745 0.9315 Without Recover 676 0.8843 −5.09-5.09 0.9907 0.9347 Without Resolve 718 0.8519 −8.33-8.33 0.9676 0.9117 A/B variants A variants only 580 0.8426 −9.26-9.26 0.9606 0.9028 B variants only 580 0.8588 −7.64-7.64 0.9583 0.9132 Table 5: Feature and probe-pair ablations using the prespecified enrollment/query roles and locked query set, pooled across the two separately fitted harnesses. Δ is relative to the Full method under this fixed protocol. 6.2 Overall Identification Performance We first evaluate exact-model identification across all 36 models. Table 4 reports each harness separately; every method is enrolled and evaluated within the same harness, without pooled training or cross-harness transfer. Lidar has the highest mean in all six method–harness comparisons. Under OpenCode, MET is the strongest baseline for all three metrics; Lidar improves its Top-1, Top-3, and MRR point estimates by 1.69, 2.64, and 1.76 percentage points, respectively. The separation is larger under mini-swe-agent. Relative to the strongest baseline for each metric, Lidar improves Top-1 by 35.96 points over MET, Top-3 by 23.08 points over LLMmap, and MRR by 28.09 points over MET. The baseline ordering also changes across harnesses, whereas Lidar retains high accuracy in both. The gaps reflect transfer across both observation objects and decision tasks. LLMmap models a stateless query–response oracle and reports lower efficiency with fewer or generic probes, as well as confusions between closely related models. MET is natively a two-sample equality test and reports lower power in character space and for several within-family swaps. ZeroPrint estimates a local input–output Jacobian from a base query and semantic perturbations; too few perturbations or repeated generations destabilize this estimate. One Token defines its fingerprint over direct single-token samples and separates post-reasoning answers because they may reflect the serving protocol rather than model lineage. A coding-agent harness instead constructs context, returns tool feedback, and turns model decisions into a multi-step execution. Preserving each baseline’s estimator therefore does not remove this shift in what is observed. Table 4 measures transfer to 36-way identification in this setting, not performance on each method’s native task. For Lidar, we repeat the evaluation under multiple balanced experimental configurations and report the mean and SD across these trials. This repeated evaluation tests whether identification performance persists across data assignments rather than depending on one favorable configuration. Takeaway. Lidar identifies the 36-model panel reliably under both harnesses and achieves the highest mean in every Top-1, Top-3 accuracy, and MRR comparison. 6.3 Ablation Study We ablate the feature representation, distribution statistics, probe pairs, A/B variants, and identifier. Whereas Table 4 averages Lidar over multiple experimental configurations, the ablation study fixes the dataset’s prespecified enrollment/query roles and uses the same locked query set for every ablation condition. This fixed protocol ensures that changes within the ablation table are attributable to the removed component rather than a different data assignment. The Full method row is therefore the within-ablation reference and is not expected to equal the repeated-configuration mean in Table 4. Each harness is preprocessed and fitted separately from its enrollment data, after which we pool the predictions for reporting. For each ablation, all affected features and distribution statistics are reconstructed before fitting; query data do not select fields, methods, or hyperparameters. The full method retains 958 instance- and distribution-level fields, all three probe pairs and their A/B variants, and the Jeffreys estimator. Features and distribution statistics. Table 5 shows that distribution-level behavior retains most of the identification signal: it reaches 89.81% Top-1 alone, compared with 75.00% for instance-level behavior. Combining the two raises Top-1 to 93.52% and MRR to 96.31%, indicating that instance-level structure provides complementary information. Retaining instance-level fields with only the distribution mean or only the standard deviation reaches 91.90% and 90.97% Top-1, respectively. Both statistics therefore contribute to the full representation. Probe pairs and controlled variants. Removing Verify, Recover, or Resolve decreases Top-1 by 5.32, 5.09, and 8.33 percentage points, respectively. All three probe pairs contribute, with the largest loss caused by removing Resolve. Keeping only the A or only the B variant from every pair further reduces Top-1 to 84.26% and 85.88%. Thus neither side alone preserves the evidence available from observing both the ordinary condition and the controlled change. Identifier. We next fix the full feature representation and all A/B variants, then compare Jeffreys with five classifiers whose configurations were fixed without using the locked query set. Figure 3: Identifier comparison on the locked query set. Bars denote alternative classifiers and dashed lines denote Jeffreys; both panels share a vertical scale truncated at 0.65. Jeffreys has the highest query Top-1 and MRR point estimates. Its transparent count-based estimator remains competitive under the small-sample enrollment regime while avoiding a data-hungry learned decision function. Takeaway. Both feature levels, all three probe pairs, and both variants contribute to identification. Their full combination gives the strongest Top-1 and MRR point estimates under limited enrollment. Clean A1: Identity obfuscation A2: Output-format control Harness Method Acc. MRR Acc. MRR Acc. MRR mini-swe-agent [31] LLMmap [26] 0.5667 0.7639 0.4667 (↓ ) 0.7000 (↓ ) 0.3333 (↓ ) 0.5533 (↓ ) ZeroPrint [30] 0.3333 0.5111 0.0000 (↓ ) 0.3944 (↓ ) 0.1667 (↓ ) 0.4222 (↓ ) MET [10] 0.5000 0.6444 0.1667 (↓ ) 0.4500 (↓ ) 0.1667 (↓ ) 0.4083 (↓ ) One Token [3] 0.3333 0.4167 0.1667 (↓ ) 0.2500 (↓ ) 0.0000 (↓ ) 0.0000 (↓ ) Lidar 1.0000 1.0000 0.8889 (↓ ) 0.9444 (↓ ) 1.0000 1.0000 OpenCode [25] LLMmap [26] 0.1667 0.4039 0.1667 0.4111 0.2000 0.4217 ZeroPrint [30] 0.3333 0.5333 0.1667 (↓ ) 0.4083 (↓ ) 0.1667 (↓ ) 0.4639 (↓ ) MET [10] 0.8333 0.9167 0.8333 0.9167 0.1667 (↓ ) 0.4083 (↓ ) One Token [3] 0.8333 0.9167 0.8333 0.9167 0.0000 (↓ ) 0.0000 (↓ ) Lidar 0.9444 0.9722 0.8611 (↓ ) 0.9306 (↓ ) 0.9444 0.9722 Table 6: Closed-set identification under provider-side manipulation. Acc. denotes Top-1 accuracy. Green A1 values and blue A2 values with a downward marker are lower than the same method’s Clean result. 6.4 Robustness to Provider-Side Manipulation We evaluate Lidar under two provider-controlled manipulations delivered through system instructions: identity obfuscation and output-format control. Services commonly add such policies for branding, safety or compliance notices, and response normalization; the same control point could suppress explicit identity cues or force different models into a shared visible format without changing the served model or coding task. We therefore select six closely related identities—GLM-5.1, GLM-5.2, GLM-5.3, Qwen3.6-Plus, Qwen3.7-Plus, and Qwen3.7-Max—to test whether surface control erases difficult within-family distinctions. Attack conditions. Enrollment is fixed and clean; both manipulations apply only to queries. Clean is an independent query batch collected without manipulation. A1: Identity obfuscation adds a provider-controlled system instruction asking the model to avoid or alter explicit identity claims, while leaving the coding task and available tools unchanged. A2: Output-format control adds a system instruction requiring a provider-specified notice at the start of each natural-language response; the model otherwise executes the task and emits native tool calls normally. Across conditions, model, harness, probe pair, variant, provider, and generation controls are held fixed; only the condition-specific system instruction changes. Evaluation protocol. For this robustness study, we reuse the basic experimental configuration and restrict the model panel to the six identities above. Enrollment remains clean; each manipulation is applied only to query samples, and no manipulated query affects fitting or model selection. We measure robustness by comparing each method’s manipulated result with its own Clean result. Finding. As Table 6 shows, Lidar degrades only modestly under provider-side manipulation. Under A1, its largest Top-1 drop is 11.11 percentage points and its largest MRR drop is 5.56 points; under A2, both harnesses retain their Clean accuracy and MRR exactly. In contrast, every baseline loses accuracy in at least one manipulated condition, with Top-1 drops reaching 33.33 points under A1 and 83.33 points under A2. This contrast reflects the evidence each method observes. The baselines primarily fingerprint returned text or token statistics, which provider instructions can suppress, normalize, or render invalid. Lidar instead aggregates controlled differences in tool use, action order, verification, recovery, and repository outcomes across paired trajectories. The results therefore support execution-level behavioral evidence as more resilient to these surface manipulations. The few A1 errors for Lidar are confined to the adjacent Qwen3.6-Plus/Qwen3.7-Plus identities. Integrity checks. We independently recomputed all rankings and metrics and verified that manipulated queries remained isolated from enrollment, preprocessing, and model selection. Takeaway. Lidar remains robust to provider-controlled identity and formatting instructions by drawing on trajectory organization and execution behavior beyond surface responses. 6.5 What Makes an Agentic Fingerprint? The preceding results show that agent trajectories identify models, but not which parts of a trajectory carry that evidence. Experimental setup. We derive this analysis from the clean evaluation data and reuse each harness’s frozen Jeffreys identifier fitted only on enrollment; query data never affect missing-value handling, active-field selection, feature bins, or model probabilities. Figure 4: Illustrative trajectories under the same prompt, provider, harness, and seed. All three models produce an equivalent one-line fix; each box denotes one agent step. Figure 5: Feature importance in the frozen identifier. (a) Mean absolute evidence by semantic group. (b) Top-20% contribution frequency and model coverage for the ten strongest cross-harness mechanisms. (c) Median cumulative evidence on correct queries with interquartile ranges. Contributions are measured against the strongest incorrect model. Importance and behavioral groups. For each query, every active field contributes additively to the log-likelihood margin between the true model and its strongest incorrect competitor. We sum the signed contributions of fields measuring the same mechanism across probe pairs and variants, take the absolute group contribution as importance, and organize the groups into trajectory organization, command/action use, response form, probe-pair decisions and outcomes, and remaining task behavior. An illustrative trajectory. Figure 4 illustrates the signal: under the same task, provider, harness, and seed, three models produce a valid one-line fix but take 5, 8, and 14 steps and differ in inspection, reproduction, editing, testing, and review. The following analysis measures this evidence across all 36 models. Trajectory organization supplies the majority of evidence. Figure 5(a) separates trajectory organization from behavioral dimensions. Across the analyzed data, trajectory organization contributes 50.6–53.6% of the absolute margin evidence under mini-swe-agent and 67.8–70.5% under OpenCode. Command-use and response-form fields remain complementary, but the largest share comes from how actions are ordered, repeated, revisited, and recovered across the probe suite. The same mechanisms recur across harnesses. To avoid allowing one harness to dominate the ranking, we rank each semantic group within each harness and use the lower of its two importance percentiles. All highest-ranked cross-harness groups describe trajectory structure, and Figure 5(b) shows the top ten, spanning transition diversity, repetition, execution outcomes, and backtracking. The strongest, unique-transition fraction, ranks among the top-20% contributors for 50.9–69.4% of queries and covers 97.2% of models; five other mechanisms cover at least 91.7%. The signal is therefore not confined to one model family or harness. No isolated action explains the fingerprint. Figure 5(c) ranks mechanisms within each correct query. Evidence is highly distributed: under mini-swe-agent/OpenCode, the largest mechanism contributes a median of only 4.6%/4.4%, the top ten contribute 31.8%/32.4%, and reaching 80% requires 45/43 mechanisms. Identification therefore relies not on any single command, phrase, or tool call, but on the model’s broader execution strategy; this analysis explains the identifier’s evidence, not the model’s internal computation. Takeaway. Trajectory organization contributes most identity evidence, with the strongest mechanisms recurring across both harnesses; identification draws on many signals rather than any single action or response. 7 Conclusion We presented Lidar, an active black-box method for auditing LLM identity in coding-agent services. It combines paired coding probes with instance- and distribution-level trajectory evidence and a lightweight probabilistic scorer. Across 36 models, seven families, and two agent harnesses, Lidar achieves the strongest mean result in every reported metric–harness comparison. Ablation, robustness, and feature analyses show that identity evidence is distributed across execution behavior rather than isolated outputs or actions. Together, these results establish active behavioral probing as a practical basis for auditing remotely served model identity. References [1] H. An, S. Park, D. Kim, and Y. Han (2026) Sequential behavioral watermarking for LLM agents. Note: https://arxiv.org/abs/2605.11036 External Links: 2605.11036 Cited by: §1, §3.2. [2] Anthropic (2025) Introducing Claude 4. Note: https://w.anthropic.com/news/claude-4 Cited by: Table 7. [3] T. Bruckner (2026) One token is enough: fingerprinting and verifying large language models from single-token output distributions. Note: https://arxiv.org/abs/2607.10252 External Links: 2607.10252 Cited by: §1, §3.1, Table 3, Table 4, §6.1.3, Table 6, Table 6. [4] W. Cai, T. Shi, X. Zhao, and D. Song (2025) Are you getting what you pay for? auditing model substitution in LLM APIs. Note: https://arxiv.org/abs/2504.04715 External Links: 2504.04715 Cited by: §1, §1, §3.1. [5] L. Chen, T. Cai, M. Zaharia, and J. Zou (2021) Did the model change? efficiently assessing machine learning API shifts. Note: https://arxiv.org/abs/2107.14203 External Links: 2107.14203 Cited by: §3.1. [6] A. Cohen, A. Hoover, and G. Schoenbach (2025) Watermarking language models for many adaptive users. In 2025 IEEE Symposium on Security and Privacy (SP), p. 2583–2601. Note: https://doi.org/10.1109/SP61157.2025.00084 External Links: Document Cited by: §3.2. [7] S. Dathathri, A. See, S. Ghaisas, P. Huang, R. McAdam, J. Welbl, V. Bachani, A. Kaskasoli, R. Stanforth, T. Matejovicova, J. Hayes, N. Vyas, M. A. Merey, J. Brown-Cohen, R. Bunel, B. Balle, T. Cemgil, Z. Ahmed, K. Stacpoole, I. Shumailov, C. Baetu, S. Gowal, D. Hassabis, and P. Kohli (2024) Scalable watermarking for identifying large language model outputs. Nature 634, p. 818–823. Note: https://doi.org/10.1038/s41586-024-08025-4 External Links: Document Cited by: §3.2. [8] E. Debenedetti, J. Zhang, M. Balunović, L. Beurer-Kellner, M. Fischer, and F. Tramèr (2024) AgentDojo: a dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. In Advances in Neural Information Processing Systems, Vol. 37, p. 82895–82920. Note: Datasets and Benchmarks Track. https://doi.org/10.52202/079017-2636 External Links: Document Cited by: §1, §3.3. [9] DeepSeek-AI (2024) DeepSeek-V3 Technical Report. Note: https://arxiv.org/abs/2412.19437 External Links: 2412.19437 Cited by: Table 7. [10] I. Gao, P. Liang, and C. Guestrin (2025) Model equality testing: which model is this API serving?. In The Thirteenth International Conference on Learning Representations (ICLR), Note: https://openreview.net/forum?id=QCDdI7X3f9 Cited by: §3.1, Table 3, Table 4, §6.1.3, Table 6, Table 6. [11] Z. Gao, X. Li, X. Feng, J. Jiang, Y. Song, Y. Sui, Z. Xing, and L. Zhu (2026) TRACE: a two-channel robust attribution watermark via complementary embeddings for LLM-agent trajectories. Note: https://arxiv.org/abs/2607.08400 External Links: 2607.08400 Cited by: §1, §3.2. [12] GLM Team (2024) ChatGLM: a family of large language models from GLM-130B to GLM-4 all tools. Note: https://arxiv.org/abs/2406.12793 External Links: 2406.12793 Cited by: Table 7. [13] M. Gubri, D. Ulmer, H. Lee, S. Yun, and S. J. Oh (2024) TRAP: targeted random adversarial prompt honeypot for black-box identification. In Findings of the Association for Computational Linguistics: ACL 2024, p. 11496–11517. Note: https://aclanthology.org/2024.findings-acl.683/ External Links: Document Cited by: §1, §3.1. [14] Y. Hu, Z. Jiang, M. Li, O. Ahmed, Z. Huang, C. Hong, and N. Z. Gong (2026) Fingerprinting LLMs via prompt injection. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 11795–11810. Note: https://aclanthology.org/2026.acl-long.541/ External Links: Document Cited by: §1, §3.1. [15] K. Huang, J. Tan, Y. Wei, W. Li, Z. Zhang, H. Tian, Z. Yang, and L. Zhou (2026) AgentMark: utility-preserving behavioral watermarking for agents. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 12581–12603. Note: https://aclanthology.org/2026.acl-long.573/ External Links: Document Cited by: §3.2. [16] K. Huang, Z. Zhang, Z. Yang, and L. Zhou (2025) Agent Guide: a simple agent behavioral watermarking framework. Note: https://arxiv.org/abs/2504.05871 External Links: 2504.05871, Document Cited by: §1, §3.2. [17] Kimi Team (2025) Kimi K2: open agentic intelligence. Note: https://arxiv.org/abs/2507.20534 External Links: 2507.20534 Cited by: Table 7. [18] J. Kirchenbauer, J. Geiping, Y. Wen, J. Katz, I. Miers, and T. Goldstein (2023) A watermark for large language models. In Proceedings of the 40th International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 202, p. 17061–17084. Note: https://proceedings.mlr.press/v202/kirchenbauer23a.html Cited by: §3.2. [19] Q. Li, Z. Zou, S. Li, M. Xu, and Z. Liu (2026) TrustedARI: towards trust-native agentic routing infrastructure for agentic AI. Note: https://arxiv.org/abs/2606.15822 External Links: 2606.15822 Cited by: §3.1. [20] X. Liu, H. Yu, H. Zhang, Y. Xu, X. Lei, H. Lai, Y. Gu, H. Ding, K. Men, K. Yang, S. Zhang, X. Deng, A. Zeng, Z. Du, C. Zhang, S. Shen, T. Zhang, Y. Su, H. Sun, M. Huang, Y. Dong, and J. Tang (2024) AgentBench: evaluating LLMs as agents. In The Twelfth International Conference on Learning Representations (ICLR), Note: https://openreview.net/forum?id=zAdUB0aCTQ Cited by: §1, §3.3. [21] W. Meng, C. Gong, T. Y. Zhuo, F. Zhang, K. Li, Z. Liu, Z. Yang, C. Wei, and W. Chen (2026) Watermarking LLM agent trajectories. Note: Accepted by ICML 2026. https://arxiv.org/abs/2602.18700 External Links: 2602.18700 Cited by: §3.2. [22] MiniMax (2025) MiniMax-01: scaling foundation models with lightning attention. Note: https://arxiv.org/abs/2501.08313 External Links: 2501.08313 Cited by: Table 7. [23] H. Oderinwale (2026) Agent trajectories as programs: fingerprinting and programming coding-agent behavior. Note: https://arxiv.org/abs/2606.16988 External Links: 2606.16988 Cited by: §1, §3.3, §5.1. [24] OpenAI (2025) GPT-5 System Card. Note: https://openai.com/index/gpt-5-system-card/ Cited by: Table 7. [25] OpenCode Contributors (2026) OpenCode. Note: SoftwareVersion 1.17. https://github.com/anomalyco/opencode Cited by: Table 4, §6.1.2, Table 6. [26] D. Pasquini, E. M. Kornaropoulos, and G. Ateniese (2025) LLMmap: fingerprinting for large language models. In 34th USENIX Security Symposium (USENIX Security 25), p. 299–318. Note: https://w.usenix.org/conference/usenixsecurity25/presentation/pasquini Cited by: §1, §3.1, Table 3, Table 4, §6.1.3, Table 6, Table 6. [27] W. Qu, W. Zheng, T. Tao, D. Yin, Y. Jiang, Z. Tian, W. Zou, J. Jia, and J. Zhang (2025) Provably robust multi-bit watermarking for AI-generated text. In 34th USENIX Security Symposium (USENIX Security 25), p. 201–220. Note: https://w.usenix.org/conference/usenixsecurity25/presentation/qu-watermarking Cited by: §3.2. [28] Z. Ren, G. Li, S. Li, Z. Qian, and X. Zhang (2025) CoTSRF: utilize chain of thought as stealthy and robust fingerprint of large language models. Note: https://arxiv.org/abs/2505.16785 External Links: 2505.16785 Cited by: §1, §3.1. [29] S. Shao, Y. Li, Y. He, H. Yao, W. Yang, D. Tao, and Z. Qin (2025) SoK: large language model copyright auditing via fingerprinting. Note: https://arxiv.org/abs/2508.19843 External Links: 2508.19843 Cited by: §3.1. [30] S. Shao, Y. Li, H. Yao, Y. Chen, Y. Yang, and Z. Qin (2026) Reading between the lines: towards reliable black-box LLM fingerprinting via zeroth-order gradient estimation. In Proceedings of the ACM Web Conference 2026, p. 2637–2648. Note: https://doi.org/10.1145/3774904.3792196 External Links: Document Cited by: §1, §3.1, Table 3, Table 4, §6.1.3, Table 6, Table 6. [31] SWE-agent Team (2026) mini-swe-agent. Note: SoftwareVersion 2.4. https://github.com/SWE-agent/mini-swe-agent Cited by: Table 4, §6.1.2, Table 6. [32] L. Wang, Z. Li, Y. Xie, S. Wang, D. She, W. Wang, and J. Rahmel (2026) On protecting agentic systems’ intellectual property via watermarking. Note: https://arxiv.org/abs/2602.08401 External Links: 2602.08401 Cited by: §3.2. [33] I. White, Y. Jafari, and T. Berg-Kirkpatrick (2026) Black-box forensics for conversational LLM agents. Note: https://arxiv.org/abs/2606.22698 External Links: 2606.22698 Cited by: §3.3. [34] J. Xu, F. Wang, M. Ma, P. W. Koh, C. Xiao, and M. Chen (2024) Instructional fingerprinting of large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), p. 3277–3306. Note: https://aclanthology.org/2024.naacl-long.180/ External Links: Document Cited by: §1, §3.1. [35] A. Yang et al. (2025) Qwen3 Technical Report. Note: https://arxiv.org/abs/2505.09388 External Links: 2505.09388 Cited by: Table 7. [36] J. Zhang, X. Li, and S. Wang (2026) Your “pro” LLM subscription may actually be “free”: exposing fingerprint spoofing risks in LLM inference services. Note: https://arxiv.org/abs/2606.16100 External Links: 2606.16100 Cited by: §3.1. [37] R. Zhang, S. S. Hussain, P. Neekhara, and F. Koushanfar (2024) REMARK-LLM: a robust and efficient watermarking framework for generative large language models. In 33rd USENIX Security Symposium (USENIX Security 24), p. 1813–1830. Note: https://w.usenix.org/conference/usenixsecurity24/presentation/zhang-ruisi Cited by: §3.2. [38] Z. Zhang, X. Zhang, Y. Zhang, H. Zhang, S. Pan, B. Liu, A. Gill, and L. Y. Zhang (2026) Character-level perturbations disrupt LLM watermarks. In Network and Distributed System Security Symposium (NDSS), Note: https://doi.org/10.14722/ndss.2026.230138 External Links: Document Cited by: §3.2. [39] X. Zhu, Y. Ye, T. Qiu, H. Zhu, S. Tan, A. Mannan, J. Michala, R. A. Popa, and W. Neiswanger (2025) Auditing black-box LLM APIs with a rank-based uniformity test. Note: https://arxiv.org/abs/2506.06975 External Links: 2506.06975 Cited by: §3.1. Appendix A Evaluated Model Panel Table 7 lists the complete set of model identities used in the evaluation. Family # Models GPT [24] 7 gpt-5.1, gpt-5.2, gpt-5.4, gpt-5.5, gpt-5.6-luna, gpt-5.6-sol, gpt-5.6-terra Claude [2] 7 claude-fable-5, claude-opus-4-6, claude-opus-4-7, claude-opus-4-8, claude-opus-5, claude-sonnet-4-6, claude-sonnet-5 Qwen [35] 7 Qwen3.5-122B-A10B, Qwen3.5-27B, Qwen3.6-Plus, Qwen3.7-Max, Qwen3.7-Plus, Qwen3.8-2.4T-A95B, Qwen3.8-27B GLM [12] 6 GLM-4.7, GLM-5, GLM-5-Turbo, GLM-5.1, GLM-5.2, GLM-5.3 DeepSeek [9] 4 DeepSeek-V3.1, DeepSeek-V3.2, DeepSeek-V4-Flash, DeepSeek-V4-Pro Kimi [17] 3 Kimi-K2.5, Kimi-K2.6, Kimi-K3 MiniMax [22] 2 MiniMax-M2.7, MiniMax-M3 Table 7: LLMs included in the evaluation, grouped by family.