---
title: 'AgentPrint: Fingerprinting Autonomous Agents'
url: https://www.emergentmind.com/topics/agentprint
type: topic
---

# AgentPrint: Fingerprinting Autonomous Agents

Searching arXiv for the primary paper and related uses of the term "AgentPrint."
arXiv search query: 2606.16988 AgentPrint autonomous web agents traffic fingerprint TRACE
AgentPrint denotes a family of agent-fingerprinting frameworks that characterize autonomous systems through observable traces rather than benchmark outcomes alone. Across recent arXiv work, the term has been used in at least three technically distinct senses: as a procedural fingerprint over coding-agent trajectories, defined as an empirical distribution over a compressed action vocabulary derived from traces [2606.16988]; as a multi-layer attribution system for autonomous web agents that combines network-layer and browser-interaction features [2606.20910]; and as a traffic-fingerprinting system that infers LLM-agent identity and user attributes from encrypted packet metadata [2510.07176]. A related but distinct line of work on robust provenance watermarking, TRACE, explicitly describes how a future multi-bit AgentPrint could be built on complementary watermark channels for agent trajectories [2607.08400]. Taken together, these works position AgentPrint as a broader paradigm for identifying, auditing, attributing, or protecting agent behavior from procedural, protocol, or side-channel evidence rather than success rates alone.

## 1. Procedural AgentPrint in coding-agent research

In "Agent trajectories as programs: fingerprinting and programming coding-agent behavior" [2606.16988], AgentPrint is formally defined as the empirical distribution over a compressed, task-agnostic vocabulary of actions that an agent emits when solving coding problems. The formulation begins with a set of atomic actions $\mathcal{A}$, a set of recorded trajectories $T_a=\{\tau_1,\dots,\tau_n\}$ for agent $a$, an induced vocabulary $V=\{v_1,\dots,v_K\}$, and token counts $\delta(v,\tau)$ within a trajectory. The fingerprint is the relative-frequency vector
$$
p_a(v_i)=\frac{\sum_{\tau\in T_a}\delta(v_i,\tau)}{\sum_{j=1}^K\sum_{\tau\in T_a}\delta(v_j,\tau)},
$$
so that
$$
\mathrm{AgentPrint}(a)=\mathbf p_a=(p_a(v_1),p_a(v_2),\dots,p_a(v_K)).
$$
This $K$-dimensional representation is presented as a compact characterization of an agent’s procedural style [2606.16988].

The central motivation is that benchmark scores report whether an agent solved a task, but not how it proceeded. The paper therefore treats trajectories as structured behavioral objects and asks whether models are distinguishable by their "behavioral habits," termed fingerprints. On SWE-Bench, the study compares ten agents and reports that an attribution probe can assign an unseen trajectory to the correct agent at 85.7% accuracy while controlling for leakage across tasks [2606.16988].

This procedural notion of AgentPrint is explicitly task-agnostic at the vocabulary level. The compression objective is intended to suppress surface-level variation while retaining sufficient structure to reveal recurrent search, edit, testing, and submission patterns. This suggests that AgentPrint is meant not merely as a classifier input, but as a representation of problem-solving procedure.

## 2. Vocabulary induction and trace abstraction

The coding-agent formulation relies on emergent vocabulary induction rather than a fixed manually designed ontology. The procedure begins by parsing each solution "hunk" in the trace using a language-agnostic AST parser and mapping each AST edit, such as insert node, delete node, or rename identifier, to an atomic symbol in $\mathcal{A}$ [2606.16988]. The initial vocabulary is $V_0=\mathcal{A}$, and all trajectories are tokenized at the atomic level.

Vocabulary growth then proceeds through a greedy BPE sweep. Adjacent-token bigrams are counted, the most frequent pair is merged into a new token, all occurrences are replaced, and the process repeats until a target vocabulary size $K$ is reached or no bigram has non-zero frequency [2606.16988]. The paper compares BPE with PrefixSpan and states that BPE yields better separability, measured by higher V-measure.

Selection of $K$ uses the V-measure, with homogeneity $h$ and completeness $c$ defined from conditional entropies over actions and procedures, and
$$
V=2\frac{hc}{h+c}.
$$
The paper reports that, in the study, $K=192$ gave $V\approx 0.644$ [2606.16988]. Once $V$ is fixed, each raw trace $\tau$ becomes a token sequence $\bar\tau$ over the induced vocabulary. The stated effect is to abstract away low-level syntax or naming variation while preserving the skeleton of procedures such as "search→read→create→edit→test→submit" [2606.16988].

A notable implication is that the representation is neither purely semantic nor purely syntactic. It is constructed from edit-level and tool-level action structure, but compressed into reusable higher-order motifs. In that sense, AgentPrint operationalizes "agent trajectories as programs" by turning traces into compositional symbolic sequences.

## 3. Attribution, similarity, and ProcGrep

The primary downstream use in the coding-agent setting is attribution. Given an unseen tokenized trajectory, the task is to attribute it to one of $M$ candidate agents. The features described in the paper include unigram frequencies, bigram transition frequencies, and optional macro-features such as average trajectory length, entropy $H(p_a)$, and compression ratio [2606.16988]. The classifier is multi-class logistic regression, with Random Forest with 100 trees given as an alternative, and training uses GroupKFold on tasks with 5 folds so that train and test do not share the same problem instance [2606.16988].

The reported baseline is $1/M$, approximately 11.1% for $M=9$ or $10$ agents, and the test accuracy is 85.7% [2606.16988]. The paper further states that grouping by task changes accuracy only by $\Delta=-0.007$, which it interprets as evidence that the probe learns style rather than memorization.

Similarity between fingerprints is quantified with the Jensen–Shannon divergence,
$$
\mathrm{JSD}(p_a,p_b)=H\!\Bigl(\tfrac{p_a+p_b}{2}\Bigr)-\tfrac12 H(p_a)-\tfrac12 H(p_b),
$$
where
$$
H(p)=-\sum_{v\in V}p(v)\log_2 p(v).
$$
The reported examples include teacher to distilled child with $\mathrm{JSD}=0.250$, within-family across generations with $\mathrm{JSD}\approx 0.518$, and the same model under two different scaffolds with $\mathrm{JSD}\approx 0.533$ [2606.16988]. The paper describes 0.25 as strong procedural mimicry and values above 0.5 as indicating divergent styles.

The accompanying library, ProcGrep, implements the pipeline through modules including `procgrep.parser`, `procgrep.encoder`, `procgrep.fingerprint`, `procgrep.probe`, `procgrep.similarity`, `procgrep.search`, and `procgrep.viz` [2606.16988]. The library is presented as infrastructure for parsing traces into atomic actions, inducing BPE vocabularies, aggregating AgentPrints, training attribution probes, computing JSD and clustering, performing structural "grep" via YAML specifications, and visualizing cost breakdowns and JSD heatmaps.

The paper identifies several practical uses: task-aware model routing, live agent monitoring and anomaly detection, cost-efficiency analysis, and procedural reward shaping [2606.16988]. These are described as workflow integrations rather than benchmark tasks, indicating that AgentPrint is intended as an operational analysis tool for development and deployment.

## 4. AgentPrint for autonomous web-agent attribution

A second use of the term appears in "Whose Agent Are You? Multi-Layer Fingerprinting and Attribution of Autonomous Web Agents" [2606.20910]. Here AgentPrint is not a procedural token distribution over coding traces, but a multi-layer fingerprint over network protocol and browser-interaction signals. The system is motivated by privacy and security challenges arising from autonomous web agents that combine large language models with browser-level control.

The feature space is divided into network-layer features and browser-interaction features. Network-layer features include request-timing statistics, TLS/HTTP protocol fingerprints, HTTP/2 settings, and header distributions, aggregated into a vector
$$
x^{(\mathrm{net})}=\bigl[\mu_\Delta,\sigma_\Delta,r,\mathrm{CV},\,x^{(\mathrm{TLS})},\,s,\,\{p_h\}\bigr].
$$
Behavioral features are derived from an in-page logger that captures event sequences such as click, keydown, mousemove, and scroll, together with timestamps and target descriptors. Metrics include inter-event intervals, event-type ratios, mouse-trajectory length, keyboard dynamics, page-level dwell times, and scenario-completion flags, concatenated into $x^{(\mathrm{beh})}\in\mathbb{R}^{d_b}$ [2606.20910].

Classification uses an ensemble of decision trees, specifically an Extra-Trees model, over the combined feature vector
$$
x=[x^{(\mathrm{net})},x^{(\mathrm{beh})}]\in\mathbb{R}^D.
$$
The paper gives the Gini impurity objective for individual tree splits and majority vote across the ensemble [2606.20910]. The class set includes six AI web agents—AutoGen, BrowserUse, Claude, Gemini, Operator, and Skyvern—together with human users and three legacy crawlers: Nutch, Heritrix, and Scrapy.

The reported leave-one-trial-out evaluation over 30 trials per subject gives the following feature-type results: temporal only, Accuracy = 1.00 and F1 = 1.00; HTTP headers only, Accuracy $\approx 0.82$ and F1 $\approx 0.80$; TLS/H2 only, Accuracy $\approx 0.75$ and F1 $\approx 0.72$; behavioral only, Accuracy $\approx 0.88$ and F1 $\approx 0.88$; combined, Accuracy = 0.97 and F1 = 0.97 [2606.20910]. Per-class identification rates are reported as 91–100% F1 for agents, 1.00 for humans, and 1.00 for crawlers [2606.20910].

This usage of AgentPrint differs conceptually from the coding-agent version. The observable object is not a symbolic action trace over a compressed vocabulary, but a fused cross-layer session representation. The goal is not primarily procedural interpretability but robust attribution and policy enforcement on live instrumented domains. The paper emphasizes cross-layer complementarity, early-request identification, and resistance to partial evasion such as header spoofing [2606.20910].

## 5. Traffic-side AgentPrint and privacy inference

A third technically distinct usage appears in "Exposing LLM User Privacy via Traffic Fingerprint Analysis: A Study of Privacy Risks in LLM Agent Interactions" [2510.07176]. In this work, AgentPrint is a traffic-fingerprinting system that operates on encrypted packet metadata observed by a passive adversary. The threat model assumes a local or path observer that cannot decrypt or modify traffic but can observe timestamps $t_i$, sizes $s_i$, and direction $d_i\in\{-1,+1\}$, knows the vendor IP ranges, and can detect the start and end of an LLM-agent session [2510.07176].

The key claim is that multimodality and processuality produce distinctive packet-count and byte-volume patterns even when HTTPS/TLS hides content. Each trace is represented as a sequence $T=\langle P_i\rangle_{i=1}^n$ with $P_i=(t_i,d_i,s_i)$, partitioned into $W=1{,}800$ fixed time windows. For each direction and window, the system computes packet counts $N_d(j)$ and byte volumes $B_d(j)$, forming a Multi-view Traffic Aggregation Matrix of shape $[2\text{ stats}\times 2\text{ directions}\times W]$ [2510.07176].

Classification uses a small CNN composed of two 2D-convolutional blocks, followed by two 1D-convolutional blocks, global average pooling, and softmax, trained with cross-entropy and evaluated by 10-fold cross-validation [2510.07176]. The monitored dataset covers the top 50 GPTs, representing 66.8% of all GPT conversations as of Aug 30 2024, with 7,311 traces for monitored agents and 428 traces for 166 unmonitored agents [2510.07176].

The reported results include macro F1 = 0.924 and accuracy = 94.1% for 5-way behavior classification in the closed-world mixed-flow setting; F1 = 0.8244 for closed-world primary-flow identity classification; F1 = 0.8660 and accuracy = 86.7% for closed-world mixed-flow identity classification; and open-world mixed-flow F1 $\approx 0.8477$ [2510.07176]. The paper also reports occupation profiling results: Top-3 accuracy = 73.9% for high-exposure virtual users, 58.9% for all virtual users, and 69.1% for real users [2510.07176].

This line of work frames AgentPrint as a privacy risk rather than a developer-facing audit instrument. The same general idea—agents emit stable, attributable traces—is here turned against users. The paper therefore discusses padding and batching, dummy packet injection, and constant-rate traffic shaping as possible mitigations, while noting trade-offs in overhead, latency, and resource use [2510.07176].

## 6. Relation to watermarking and provenance

TRACE, introduced in "TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories" [2607.08400], does not itself define AgentPrint as the main object, but explicitly outlines how an AgentPrint fingerprinting system could extend its watermarking design. TRACE addresses a distinct problem: attribution of a genuine agent when a reseller has full read/write access to the trajectory log. The paper presents a two-channel watermark that is described as distortion-free in action choices, self-synchronizing under deletion, and unconditionally invariant under rewriting [2607.08400].

A trajectory is defined as $\tau=(e_1,\dots,e_T)$, where each record has a role tag $\rho(e_t)\in\{\mathtt{dec},\mathtt{obs}\}$ and content string $c(e_t)$, and the skeleton is the tag sequence $s(\tau)$ [2607.08400]. The selection channel embeds a keyed exponential-race sampler over admissible behaviors $B_i$ with distribution $P_i$, choosing
$$
b_i=\arg\min_{b\in B_i}\frac{-\ln r_b}{P_i[b]},
$$
with Theorem 1 giving exact distortion-freeness, $\Pr[b_i=b]=P_i[b]$ [2607.08400]. The tally channel appends zero-semantics redundant observation records according to a keyed pattern over group positions, and Theorem 4 states that rewriting that preserves the skeleton leaves the tally statistic exactly invariant [2607.08400].

The empirical results report that, on ToolBench and ALFWorld, TRACE matches the unwatermarked agent’s success rate, that the selection channel reaches detection scores near $z=100$ on long-horizon trajectories, remains detectable under 70% step deletion, and that the tally channel is exactly unchanged under LLM rewriting of any strength [2607.08400]. The paper then states that "AgentPrint would go beyond zero-bit provenance ('Was this log watermarked?') to multi-bit fingerprinting ('Which agent variant produced this log?')" and argues that TRACE’s separation of carriers and keyings offers a blueprint for such a system [2607.08400].

The connection is conceptually important. Whereas the coding, web, and traffic variants of AgentPrint infer identity from naturally occurring regularities, TRACE addresses intentional provenance marking under adversarial tampering. This suggests a divide between passive fingerprinting and active fingerprint embedding, with TRACE positioned as a possible substrate for the latter.

## 7. Conceptual scope, limitations, and points of confusion

The main source of ambiguity is terminological. "AgentPrint" does not name a single standardized method across the literature represented here. Instead, it refers to at least three separate systems: a procedural fingerprint of coding-agent trajectories [2606.16988], a multi-layer network-and-behavior classifier for autonomous web agents [2606.20910], and a traffic-side fingerprinting system for LLM-agent identity and user profiling [2510.07176]. TRACE uses the term prospectively, as a target for future multi-bit trajectory fingerprinting built atop watermark carriers [2607.08400]. Any discussion of AgentPrint therefore requires disambiguation by domain and threat model.

A second point concerns what is being fingerprinted. In the coding-agent paper, the object is the empirical distribution over an induced action vocabulary; in the web-agent paper, it is a combined feature vector over requests, protocols, and browser events; in the traffic-fingerprinting paper, it is a packet-metadata tensor derived from encrypted traffic [2606.16988; 2606.20910; 2510.07176]. These are not interchangeable representations, even though all are motivated by the claim that agents exhibit stable, attributable behavioral structure.

A third issue is whether fingerprinting is being used for interpretability, security, privacy intrusion, or provenance. The coding-agent formulation emphasizes auditing, evaluation, model routing, monitoring, and reward shaping [2606.16988]. The web-agent formulation emphasizes content protection and web security policy enforcement [2606.20910]. The traffic-fingerprinting formulation demonstrates privacy risks and argues for countermeasures [2510.07176]. TRACE focuses on attribution under a reseller threat model and the resilience of watermark evidence to deletion and rewriting [2607.08400].

Across all variants, limitations are explicit. The coding-agent work is grounded in a specific evaluation dataset, SWE-Bench, and its practical integration scenarios are framed as potential uses rather than universally validated deployments [2606.16988]. The web-agent system notes indistinguishability when agents share identical backends and behavior, task dependence of temporal and behavioral features, and model drift requiring ongoing retraining [2606.20910]. The traffic-fingerprinting system highlights open challenges in scaling, active adversaries, and balancing privacy defenses against usability and performance [2510.07176]. TRACE likewise states that signal is bounded by decision entropy and that erasing both watermark channels requires costly corruption of the reseller’s trajectories [2607.08400].

In aggregate, AgentPrint names an emerging research direction centered on the proposition that autonomous agents are identifiable through the structure of their traces. The common denominator is behavioral attribution from artifacts that benchmarks do not capture: edit and tool traces, HTTP/TLS signatures, browser events, or encrypted packet metadata. The differences among the systems are substantive rather than cosmetic, and the term is best understood as a label for a class of fingerprinting approaches rather than a single canonical algorithm.

Source: https://www.emergentmind.com/topics/agentprint