Behavioural Fingerprinting of Autonomous AI Agents from Tool-Call Sequences

Abstract

Autonomous agents built on large language models (LLMs) increasingly act in the world by emitting sequences of tool calls, yet the operators who deploy, audit, and secure these agents have few lightweight means of characterising what an agent is doing from its externally observable behaviour alone. This paper investigates whether the operational context of an autonomous agent can be inferred purely from the dynamics of its tool-call trajectory—the length, ordering, repetition, success profile and parameter complexity of its actions—without inspecting which specific tools are invoked or the semantic content of their arguments. We formalise a trajectory as a sequence of typed actions and define a family of feature representations that range from pure structural dynamics to full content-aware descriptors. Using TRAJECT-Bench, a public benchmark of 1670 executable LLM-agent tool-use trajectories spanning nine task domains, we train and cross-validate four classifiers and quantify a clear information gradient. A representation using only sixteen content-agnostic dynamics features attains a macro-F1 of 0.968 (accuracy 0.967, Cohen’s κ 0.963, MCC 0.963) against a nine-class random baseline of 0.111, and augmenting these dynamics with generic action-verb n-grams raises macro-F1 to 0.995. All pairwise gains are statistically significant (paired t-test, p < 0.01). An early-detection analysis shows that four to five observed actions are sufficient to exceed 90% accuracy, and the dynamics-only model is inexpensive to train and serve (0.16 ms per trajectory at inference). These results provide evidence that the behavioural shape of an agent’s actions is itself a discriminative fingerprint, with direct applications to agent observability, anomaly detection, and provenance. We release a fully reproducible single-file benchmark and discuss the path from task-domain fingerprinting toward backbone-model attribution.