Security · 2026-05-15

Behavioral Fingerprinting for Agents: Detecting Model Substitution in Production Pipelines

By J. W. Bouckaert

The credentialed impostor

An AI agent presents a valid delegation certificate. Its DPoP-bound access token verifies. Its hybrid ML-DSA-65 signature checks out. Every cryptographic gate it touches says yes. And yet the model behind that credential is no longer the model that earned it.

This is model substitution: a legitimately credentialed agent whose underlying inference engine has been swapped, quantized, fine-tuned, or replaced wholesale—often without the operator's knowledge. The credential is real. The behavior is not.

Identity proves who an agent is. Cryptography proves what message it sent. Neither proves which model produced the action. Closing that gap is what behavioral fingerprinting does, and why PasskeyBridge's trust-decay functions treat statistical divergence in an agent's action distribution as a first-class trust signal.

Substitution as an insider threat

The MLOps supply chain is brittle in ways the identity industry has not yet metabolized. Public disclosures—including JFrog's 2024 analysis of roughly 100 malicious models hosted on a major model registry—show that artifacts can carry the credentials of trusted publishers while behaving in ways the publisher never intended. The credential is intact. The pipeline is not.

NIST AI 100-2 E2025 (Adversarial Machine Learning) explicitly names "model replacement" and "weight tampering" as threats requiring runtime detection rather than build-time controls alone. The reasoning is direct: the gap between when a model is signed and when it is invoked is where the attack lives.

The substitution surface is broader than most operators model:

• Quantization swap. A 16-bit model is replaced with a 4-bit quantization to cut inference cost. Accuracy drops are often within tolerance, but action distributions on edge cases shift measurably.
• Silent fine-tuning. A model is tuned on new data—sometimes adversarial, sometimes merely poorly curated—and redeployed under the same version tag.
• Wholesale replacement. A different model from a different provider is dropped behind the same endpoint, exploiting the fact that few orchestrators verify the inference engine itself.
• Adapter injection. A LoRA or prefix-tuning adapter is loaded on top of an unchanged base model, modifying behavior without altering the base weight checksum.
• Compromised tool layer. The model is unchanged but an upstream tool returns adversarial outputs, biasing every downstream action.

Each of these failure modes is invisible to credential-based authentication. Each produces measurable, statistical divergence in action distributions. Behavioral fingerprinting is the discipline of measuring that divergence in production, in real time, with bounded false-positive rates.

A behavioral fingerprint, defined

A behavioral fingerprint is a probability distribution over the agent's observable actions, not a hash of the model. It is computed across a rolling window of attested behavior and stored as a privacy-preserving sketch.

Concretely, PasskeyBridge's Governor trust engine maintains, per agent identity, a multi-dimensional baseline that captures:

None of these features include the content of any single request. The fingerprint is a sketch—a Count-Min sketch for categorical features, a t-digest for continuous ones—so the agent's behavior can be characterized without retaining payloads. This preserves the zero-PII architecture that PasskeyBridge enforces across the rest of the trust stack.

Detecting divergence: The math

Substitution detection is a two-sample test problem. The baseline distribution P—established during the agent's A2A attestation—is compared against a current-window distribution Q computed over the most recent N actions.

Three divergence measures run in parallel, each tuned to a different substitution mode:

Population Stability Index (PSI):
  PSI(P, Q) = Σ (Qᵢ − Pᵢ) × ln(Qᵢ / Pᵢ)

Jensen–Shannon Divergence:
  JSD(P, Q) = ½ × KL(P ‖ M) + ½ × KL(Q ‖ M),  where M = ½(P + Q)

Kolmogorov–Smirnov statistic (for continuous features):
  D = sup_x |F_P(x) − F_Q(x)|

PSI is the workhorse for categorical distributions—tool selection, refusal rate. The credit-risk industry has used PSI thresholds for two decades; the conventional bands (PSI < 0.10 stable, 0.10–0.25 minor shift, > 0.25 material shift) translate cleanly to action distributions. Jensen–Shannon divergence is symmetric and bounded, which makes it suitable for feeding directly into the Combined Trust Coefficient without normalization gymnastics. The Kolmogorov–Smirnov test handles continuous features—latency, confidence-score moments—where binning would discard signal.

The aggregate behavioral-divergence score Δ_b feeds the trust-decay function as an accelerator:

λ_effective = λ_base × (1 + α × Δ_b)

Where α is the per-tenant sensitivity coefficient (default 4.0). At Δ_b = 0.25—the conventional "material shift" threshold—the agent's trust half-life compresses from ~5 hours to ~2.5 hours. At Δ_b = 0.50, the agent drops to read-only within minutes. At Δ_b ≥ 0.75, the revocation cascade fires and the credential is rejected at the next attestation cycle.

Calibration and false positives

A divergence detector that fires on every model update is a paging system. The hard engineering problem is calibrating thresholds that catch substitution while tolerating legitimate distributional drift—seasonal load patterns, traffic-mix shifts, scheduled retraining.

PasskeyBridge addresses this with three mechanisms:

1. Conditional baselines. P is not a single distribution but a conditional distribution P(action | request_class), where request classes are derived from a coarse intent classifier on prompt embeddings. A traffic shift from "summarization" to "code-generation" no longer registers as substitution—each class has its own baseline.
2. Bootstrap-derived thresholds. Per-agent thresholds are computed from a bootstrap resampling of the baseline window rather than hard-coded, so the alert threshold is set at the empirical 99.5th percentile of within-baseline divergence. This adapts to high-variance and low-variance agents alike.
3. Operator-attested updates. When the operator legitimately updates the model, they call a signed /v1/agent-baseline/reset endpoint, which closes the current baseline window and starts a new one. The reset itself is logged to the append-only audit trail and bound to the operator's hardware-attested identity—so a "legitimate update" cannot be forged by the substituting attacker.

In production, the false-positive rate at default sensitivity sits at approximately 1 alert per 10,000 attested action windows—low enough to be actionable, high enough to catch the substitutions that matter.

Worked example: The quantization swap

Consider a procurement agent in a supply-chain automation pipeline. The agent's baseline distribution shows:

The aggregate Δ_b at this configuration is approximately 0.38—above the "material shift" threshold. The Governor accelerates trust decay, the agent drops to read-only within the next attestation window, and the finalize_order tool becomes unavailable. The substituting model can no longer take consequential actions. An operator alert fires, and the model artifact behind the endpoint is examined offline.

The substituting model was a legitimate INT4 quantization of the original FP16 weights. Accuracy on the supplier benchmark had dropped 1.1%—within the SLA. But the quantized model had become measurably more eager to skip approval gates and more confident in its quote comparisons. Without behavioral fingerprinting, the substitution would have continued indefinitely.

Scope

Behavioral fingerprinting is a runtime integrity signal. It is not a replacement for any of the controls that should already be in place:

• It does not replace build-time signing of model artifacts via Sigstore or in-toto attestations. Those controls catch substitution at the supply-chain layer, before the model is ever loaded.
• It does not replace DPoP token binding. DPoP prevents credential theft; behavioral fingerprinting catches what credentials cannot.
• It does not replace prompt-injection defenses. A well-crafted injection can shift behavior without substituting the model. Both controls run in parallel.
• It does not "detect a malicious model." It detects that a model is no longer the model whose attestation is on file. Whether the new model is malicious, merely cheaper, or innocently quantized is for the operator to determine.

The discipline is integrity.

Implementation footprint

The fingerprinting layer runs as a sidecar to the Governor, co-located in PasskeyBridge's edge function tier. Per-action overhead is dominated by sketch updates: a Count-Min sketch update and a t-digest insertion together complete in under 40 microseconds at the 99th percentile. Aggregate divergence computation runs once per attestation cycle (default: every 15 minutes) and adds approximately 8ms to the cycle. Total budget impact at the Combined Trust Coefficient layer is negligible against the measured decision path PasskeyBridge publishes for the rest of the trust stack.

Storage is bounded. A full per-agent fingerprint—seven dimensions, sketch-compressed—occupies approximately 18 KB regardless of action volume. The baseline itself is signed with the same hybrid ML-DSA-65 signature scheme used elsewhere, so the fingerprint cannot be silently overwritten by a harvest-now-decrypt-later adversary.

Timing

The deployment cadence of frontier and frontier-adjacent models is accelerating. Provider-side updates that were quarterly in 2024 are now weekly. Customer-side fine-tuning that required a research team in 2023 is a hosted endpoint in 2026. The frequency of legitimate substitution is rising in lockstep with the frequency of illegitimate substitution.

Identity systems built on the assumption that "the model is whatever the credential says it is" are failing silently. More cryptography does not fix that. The fix is to recognize that an agent's behavior is observable, statistical, and amenable to the same continuous-verification discipline that PasskeyBridge applies to carrier signals, DPoP bindings, and bilateral trust scores.

Behavioral fingerprinting closes the integrity gap between the credential and the inference. It does not require the agent to cooperate. It does not require the operator to instrument the model. It runs at the edge, on the action stream that already crosses PasskeyBridge's trust boundary, and it produces a signal that the trust-decay function consumes natively.

The substituted model still gets to act. It just no longer gets to act with the trust of the model it replaced.

Read the Trust Decay Functions Deep-Dive → Explore the A2A Trust Protocol → Get Started with PasskeyBridge →

Start free · Test the API