通过用户界面操作痕迹，可精准识别背后运行的LLM模型。
Known By Their Actions: Fingerprinting LLM Browser Agents via UI Traces
- 用脚本记录代理的操作和时间间隔，实现模型指纹识别。
- 在14个前沿模型上最高达96%的F1分数，跨模型家族也能通用。
- 即使加入随机延迟，仍可被重新训练模型恢复识别能力。
随着基于大语言模型（LLM）的代理越来越多地代表用户浏览网页，一个关键问题浮现：网站能否被动识别出驱动代理的底层模型？若能，将带来严重安全风险，使攻击者针对已知模型漏洞实施精准打击。我们在14个前沿大模型及涵盖信息检索与购物任务的四个网页环境中，证明仅通过被动式JavaScript追踪器捕获的代理行为与交互时间，即可实现高达96% F1分数的模型识别。我们形式化了这一攻击面，表明基于代理行为训练的分类器可跨模型规模与家族泛化。进一步发现，仅需少量交互轨迹即可训练出强分类器，且在任务早期即能推断代理身份。在动作间注入随机延迟虽显著降低分类性能，但无法提供稳健防护：重新训练后分类器基本恢复识别能力。我们公开了实验工具链及标注好的代理轨迹数据集。
原文摘要 · Abstract (English)
As LLM-based agents increasingly browse the web on users' behalf, a natural question arises: can websites passively identify which underlying model powers an agent? Doing so would represent a significant security risk, enabling targeted attacks tailored to known model vulnerabilities. Across 14 frontier LLMs and four web environments spanning information retrieval and shopping tasks, we show that an agent's actions and interaction timings, captured via a passive JavaScript tracker, are sufficient to identify the underlying model with up to 96\% F1. We formalise this attack surface by demonstrating that classifiers trained on agent actions generalise across model sizes and families. We further show that strong classifiers can be trained from few interaction traces and that agent identity can be inferred early within an episode. Injecting randomised timing delays between actions substantially degrades classifier performance, but does not provide robust protection: a classifier retrained on delayed traces largely recovers performance. We release our harness and a labelled corpus of agent traces \href{https://github.com/KabakaWilliam/known_actions}{here}.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。