How would an attacker perform an exhaustive key search on a block cipher using ECB mode?
I think the attack models establish constraints on the cipher parameters that allow you to confirm guesses in a brute force or probabilistic search.

A simple way to look at it is that they let your write equations involving the cipher parameters. For example, in $c = enc(p,k)$, you can fix two of the parameters and solve for the third. Clearly $c$ (ciphertext) must be obtainable from $\lbrace p,k \rbrace$ (encryption of plaintext $p$ under key $k$), and $p$ obtainable from $\lbrace c,k \rbrace$ (decryption), but $k$ should not be obtainable from $\lbrace c,p \rbrace$ (secure against known-plaintext attacks).

If all you have is ciphertext samples, then you have no means to verify a guess for the key. From an algebraic perspective, you cannot set up an equation using $c$ alone that will allow you to derive anything about $p$ or $k$. However, if you are running in ECB mode, then solving $k$ for one block under known-plaintext gives you $k$ for every other block, including blocks where only $c$ is known.

Sure, you can set up the equations corresponding to a particular attack model, but ciphers are designed so that the equations are not solvable by any means other than exaustive brute force search.