Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents¶

🕒 Published (v1): 2026-07-21 08:01 UTC · Source: Arxiv · Venue: ICML 2026 · link

Why this paper was selected

ICML 2026; first formalization of distributed cross-agent cross-session attack attribution

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

Distributed prompt-injection campaigns that spread attacks across independent LLM agents evade per-session guardrails because no single session reveals the pattern. This paper formalizes cross-agent asynchronous campaign attribution as a distinct security task and introduces A²FV, a proxy-side fingerprinting protocol that links sessions from the same adversarial campaign using only tool-call structure, timing, and prompt surface form — without shared runtime state or attacker identity oracles. On the controlled SCD-v1 benchmark, A²FV achieves 0.82 pairwise AUC while per-session detector adaptations and chunked LLM judges remain near chance (≈0.51).

Problem¶

Existing LLM-agent defenses classify one session at a time. An adversary who distributes related injections across multiple independent agents (e.g., a software-engineering agent, a customer-support agent, a data-analysis agent) over time generates only sparse, isolated fragments at each local guardrail — none of which individually reveals the campaign. No prior work instantiates a proxy-observed linking task that satisfies all five conditions simultaneously: same external attacker, independent injections, no shared runtime graph or memory, asynchronous arrivals, and attribution from shared-proxy telemetry alone.

Method¶

A²FV (Asynchronous Attribution Fingerprint Vectors) is a passive, proxy-side second-stage correlator. Each session $s_j$ is represented by three residue channels $f_j = (f_j^{\text{str}}, f_j^{\text{tmp}}, f_j^{\text{sty}})$:

Structural residue $f_j^{\text{str}}$: $\ell_2$-normalized hashed counts of decorated tool-call n-grams ($n \in \{1,2,3\}$) over tokens $(g_j^\ell, o_j^\ell)$, failure-pivot transitions $(g_j^\ell, \text{err}) \to g_j^{\ell+1}$, and a MITRE ATT&CK-inspired tactic histogram.
Temporal residue $f_j^{\text{tmp}}$: standardized features from the inter-call gap sequence $\Delta_j$, including moments of $\log(\Delta_j + \epsilon)$, Hartigan's dip statistic, IQR/$(\sigma+\epsilon)$, and payload-size moments.
Stylometric residue $f_j^{\text{sty}}$: TF-IDF over character n-grams ($n \in \{3,4,5\}$) and byte n-grams ($n \in \{3,4,5\}$) of the raw prompt, capturing punctuation, affixes, and local phrasing without semantic embedding.

The pairwise attribution score is a weighted cosine combination: $$K_w(s, s') = \sum_{d \in \{\text{str,tmp,sty}\}} w_d \cos(f_s^d, f_{s'}^d)$$

Block weights $w^\star$ are selected once on a calibration split by maximizing NMI of HDBSCAN clustering against campaign labels (simplex grid at resolution 0.1), yielding $w^\star = (0.6, 0.0, 0.4)$ — structural and stylometric only; temporal receives zero weight on SCD-v1. At inference, A²FV is fully label-free. An optional active extension (CRF-light) injects benign tool-schema aliases with probability $\rho \leq 0.1$ to amplify structural divergence for non-adapting harnesses.

Key Contributions¶

Formal five-condition definition of cross-agent asynchronous campaign attribution as a linking task distinct from per-session safety classification.
A²FV: a transparent, reusable proxy-side reference protocol producing pairwise campaign-linking scores from calibrated structural, temporal, and stylometric residue channels.
SCD-v1: a controlled persona-matched benchmark with 70% benign traffic, 15% isolated attacks, 15% multi-session campaigns; 40 family-balanced adversary personas; matched L0/L1/L2 non-oracle evasion triplets; leakage audits; and multi-generator controls (GPT-5.5, Gemma-4-31B, Qwen-only, Gemini-Pro-only regenerations).
Empirical demonstration that per-session detector adaptations and chunked LLM judges remain near chance (AUC ≈ 0.51–0.52) on the linking task where A²FV achieves 0.82.

Results¶

A²FV pairwise AUC: 0.82 (all sessions); 0.81 (campaign-only); 95% CI [0.797, 0.837].
All-session V-measure: 0.269; campaign-only V-measure: 0.440.
Best per-session score-delta linker: AUC 0.52 (near chance).
Best chunked LLM judge: AUC 0.50–0.51 (near chance, due to campaign identity fragmenting across chunk boundaries).
MAScope-async bridge: AUC 0.50 (expects shared runtime edges absent under the no-shared-runtime condition).
Channel ablations: structural alone AUC 0.78; stylometric alone AUC 0.71; structural+stylometric AUC 0.82 (matches full model); temporal alone AUC 0.56.
Native unweighted structural+prompt linker (control): AUC 0.825, confirming real proxy-observable signal without a learned model.
Static L2 multi-axis evasion: A²FV AUC 0.807 (pairwise signal persists under simultaneous stylometric, temporal, and structural non-oracle evasion).
AUC stability across clustering K: [0.809, 0.828] for $K \in [10, 75]$.

Limitations¶

Fully adaptive L3 evasion (adversary with detector-score feedback or gradient access) is out of scope; robustness under oracle-access adversaries is uncharacterized.
Temporal residue receives zero calibrated weight on SCD-v1; the paper explicitly cautions against citing this as evidence that timing is irrelevant — it may matter in deployments with richer proxy traces (queueing, fallback, interleaving).
SCD-v1 is a controlled synthetic benchmark; leakage audits find no verbatim persona-id leaks but confirm that generated style and payload attributes are recoverable from surface text, so the benchmark is "controlled rather than artifact-free."
All-session V-measure is low (0.269) because benign work-style clusters inflate false groupings; partition metrics are sensitive to the clustering backend and benign traffic mix.
Stylometric features are not claimed to be topic-free; topic confounds may inflate cross-topic similarity.
Native-framework probes (OpenClaw, LangGraph) are diagnostic controls, not headline benchmarks — production telemetry validation is absent.

Relevance to Agentic AI / LLM Agents¶

This paper directly addresses a structural blind spot in agentic AI security: the assumption that attacks are per-session events, when in practice a single adversary can distribute injections across independent agents, teams, and runtimes. By formalizing campaign attribution as a linking problem at the proxy layer — separable from per-session detection — the work establishes a new evaluation dimension that multi-agent system designers and security practitioners need to account for when deploying LLM agents in shared administrative domains. The proxy-side framing maps naturally onto operational API gateways already used for logging and policy enforcement, making A²FV deployable without modifying individual agent architectures. The residual-channel hypothesis (that simultaneously suppressing structural, temporal, and stylometric traces under real payload constraints is harder than suppressing any one) is a useful adversarial model for the agentic threat landscape.