Security · 2026-05-15
Behavioral Fingerprinting for Agents: Detecting Model Substitution in Production Pipelines
By J. W. Bouckaert
The credentialed impostor
An AI agent presents a valid delegation certificate. Its DPoP-bound access token verifies. Its hybrid ML-DSA-65 signature checks out. Every cryptographic gate it touches says yes. And yet the model behind that credential is no longer the model that earned it.
This is model substitution: a legitimately credentialed agent whose underlying inference engine has been swapped, quantized, fine-tuned, or replaced wholesale, often without the operator's knowledge.
Identity proves who an agent is. Cryptography proves what message it sent. Neither proves which model produced the action. Behavioral fingerprinting addresses that gap by comparing an agent's current action distribution with a recorded baseline. This post describes the technique. PasskeyBridge does not ship it; the section on what the platform ships lists what its agent trust engine scores today.
Substitution as an insider threat
The MLOps supply chain is brittle in ways the identity industry has not yet metabolized. Public disclosures—including JFrog's 2024 analysis of roughly 100 malicious models hosted on a major model registry—show that artifacts can carry the credentials of trusted publishers while behaving in ways the publisher never intended.
NIST AI 100-2 E2025 (Adversarial Machine Learning) explicitly names "model replacement" and "weight tampering" as threats requiring runtime detection rather than build-time controls alone. The reasoning is direct: the gap between when a model is signed and when it is invoked is where the attack lives.
The substitution surface is broader than most operators model:
- Quantization swap. A 16-bit model is replaced with a 4-bit quantization to cut inference cost. Accuracy drops are often within tolerance, but action distributions on edge cases can shift.
- Silent fine-tuning. A model is tuned on new data—sometimes adversarial, sometimes merely poorly curated—and redeployed under the same version tag.
- Wholesale replacement. A different model from a different provider is dropped behind the same endpoint, exploiting the fact that few orchestrators verify the inference engine itself.
- Adapter injection. A LoRA or prefix-tuning adapter is loaded on top of an unchanged base model, modifying behavior without altering the base weight checksum.
- Compromised tool layer. The model is unchanged but an upstream tool returns adversarial outputs, biasing every downstream action.
Credential-based authentication does not see any of these changes. Each of them can change the agent's action distribution, and that distribution is what behavioral fingerprinting measures.
A behavioral fingerprint, defined
A behavioral fingerprint is a probability distribution over the agent's observable actions. It is computed across a rolling window of attested behavior and stored as a privacy-preserving sketch.
A baseline kept per agent identity can capture these dimensions:
| Dimension | What It Measures | Why It Detects Substitution |
|---|---|---|
| Tool-call distribution | Frequency over the agent's available tool set | Quantized models and adapters reweight tool selection |
| Argument-shape entropy | Token-length and JSON-structure entropy of tool arguments | Fine-tuned models can produce different verbosity |
| Latency profile | p50/p95/p99 of inference time per request class | Swap-ins from a different provider have different tail latencies |
| Refusal rate | Proportion of requests resulting in safety-policy refusal | Tuning often weakens or strengthens guardrails |
| Confidence-score moments | Mean and variance of self-reported probability tokens | Shifts when the model's calibration changes |
| Output-length distribution | Tokens-per-response, conditioned on prompt class | Quantization can change response length |
| Embedding centroid drift | Cosine distance of mean output embeddings vs baseline | Catches wholesale model replacement |
None of these features include the content of any single request. The fingerprint is a sketch, a Count-Min sketch for categorical features and a t-digest for continuous ones, so the agent's behavior can be characterized without retaining payloads.
Detecting divergence: The math
Substitution detection is a two-sample test problem. A baseline distribution P, recorded while the model is known, is compared against a current-window distribution Q computed over the most recent N actions.
Three divergence measures suit different substitution modes:
Population Stability Index (PSI):
PSI(P, Q) = Σ (Qᵢ − Pᵢ) × ln(Qᵢ / Pᵢ)
Jensen–Shannon Divergence:
JSD(P, Q) = ½ × KL(P ‖ M) + ½ × KL(Q ‖ M), where M = ½(P + Q)
Kolmogorov–Smirnov statistic (for continuous features):
D = sup_x |F_P(x) − F_Q(x)|PSI suits categorical distributions such as tool selection and refusal rate. Credit-risk model monitoring uses it to flag a shift between a development sample and current data, and the same calculation applies to action distributions. Jensen–Shannon divergence is symmetric and bounded, which makes it easy to combine with other scores on a 0 to 1 scale. The Kolmogorov–Smirnov test handles continuous features, such as latency and confidence-score moments, where binning would discard signal.
An aggregate divergence score Δ_b can then feed a trust model, for example by speeding up trust decay as divergence grows:
λ_effective = λ_base × (1 + α × Δ_b)Here α sets how strongly divergence speeds up decay. The value of α, and the scores at which access is narrowed or revoked, are deployment choices.
Calibration and false positives
A divergence detector that fires on every model update is a paging system. The hard engineering problem is calibrating thresholds that catch substitution while tolerating legitimate distributional drift—seasonal load patterns, traffic-mix shifts, scheduled retraining.
Three mechanisms help:
- Conditional baselines. P is not a single distribution but a conditional distribution P(action | request_class), where request classes are derived from a coarse intent classifier on prompt embeddings. A traffic shift from "summarization" to "code-generation" no longer registers as substitution—each class has its own baseline.
- Bootstrap-derived thresholds. Per-agent thresholds are computed from a bootstrap resampling of the baseline window rather than hard-coded, so the alert threshold sits at a high percentile of the divergence measured within the baseline itself. This adapts to high-variance and low-variance agents alike.
- Operator-attested updates. When the operator legitimately updates the model, an authenticated and logged operator action closes the current baseline window and starts a new one, so an attacker who swaps the model cannot present the swap as a legitimate update without the operator's credentials.
Worked example: a tool-selection shift
Take a procurement agent in a supply-chain automation pipeline whose baseline tool shares are:
| Tool | Baseline (P) | After the swap (Q) |
|---|---|---|
get_supplier_quote | 42% | 51% |
compare_prices | 28% | 22% |
request_approval | 18% | 9% |
finalize_order | 12% | 18% |
Suppose the FP16 model behind it is replaced with an INT4 quantization, and the shares move to the Q column. PSI over the four tools is Σ (Qᵢ − Pᵢ) × ln(Qᵢ / Pᵢ) ≈ 0.12, and about half of that comes from request_approval, which the agent now calls half as often. The quantized model skips the approval step more and finalizes more orders, a change that a tool-distribution baseline surfaces even when task accuracy stays within tolerance.
Scope
Behavioral fingerprinting is a runtime integrity signal. It is not a replacement for any of the controls that should already be in place:
- It does not replace build-time signing of model artifacts via Sigstore or in-toto attestations. Those controls catch substitution at the supply-chain layer, before the model is ever loaded.
- It does not replace DPoP token binding. DPoP stops a stolen token from being used by another client; behavioral fingerprinting looks at what the agent does with a valid one.
- It does not replace prompt-injection defenses. A well-crafted injection can shift behavior without substituting the model.
- It does not "detect a malicious model." It detects that a model is no longer the model whose attestation is on file. Whether the new model is malicious, merely cheaper, or innocently quantized is for the operator to determine.
Current PasskeyBridge implementation
PasskeyBridge does not compute behavioral fingerprints, keep action-distribution baselines or run divergence tests. Its agent trust engine (_shared/agent-trust-engine.ts, called by shield-agent-trust) scores each agent delegate from 0 to 1 on deterministic signals read from the delegate's recent activity: velocity spikes, error bursts, scope violations, use of many IP addresses in a short window, and a burst of activity after more than 24 hours of inactivity. An assessment from the AI intelligence worker can lower the score by at most 0.3 and never raises it.
The score narrows scopes in steps: full scopes at 0.7 and above, read-only from 0.4, verify-only from 0.2, and revocation recommended below 0.2. A tenant can set its own full and read-only thresholds. Hard signals such as a SIM swap bypass the score and revoke the organization's active agent delegates. None of these signals identifies which model produced an action, so a substituted model that keeps the same activity pattern passes them.
Placement in the identity stack
Model providers and customers now update, quantize and fine-tune models without changing the credential the agent presents. An identity system that assumes the model is whatever the credential says it is cannot see a substitution. An agent's behavior is observable and statistical, so it can be checked continuously, like other runtime signals.
Behavioral fingerprinting works from the actions an agent already sends through an identity layer, so it needs no cooperation from the agent and no instrumentation inside the model. Its output is a divergence score that a trust model, such as the trust-decay function, can consume.
Read the Trust Decay Functions Deep-Dive → Explore the A2A Trust Protocol → Get Started with PasskeyBridge →