Is it just being enrolled at a university with a recognized school email address?
arXiv states (step 2 of registration):
Claimed affiliation should be current in the conventional sense: e.g., physical presence, funding, email address, mention on institutional web pages, etc.
arXiv's notion of conventional sense seems peculiar. They omit perhaps the most common conventional notion of affiliation: employee. Other common notions -- e.g., those involving some written agreement -- are also omitted. (Perhaps arXiv want ties beyond employment or perhaps this was an oversight.)