Identifying which foundation model sits behind a black-box agent matters for provenance and accountability. Existing approaches struggle: semantic attribution is easy to defeat with a system prompt, and active watermarking conflicts with schema-constrained tool generation.
AgentTrace takes a different route. It injects structurally ambiguous probes designed to trigger tokenization-sensitive serialization failures at rigid tool interfaces. The initial failures separate model families only coarsely, but the temporal sequence of subsequent repair operations is where the signal lives, so the authors model those multi-step trajectories with lightweight Markov chains.
That sequence is what delivers the result: 96.0 percent attribution accuracy under adversarial identity spoofing. The sequential repair model also separated intra-family variants that share an identical tokenizer, such as Llama-3 8B and 70B, which unordered behavioral statistics could not, and it held up under prompt obfuscation and temperature scaling.
Caveat: the evaluation covers the models and interfaces the authors tested, and the approach needs the ability to inject probes into a live agent's tool calls, which a black-box setting may not always permit.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.