Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents

Image generated by AI

TLDR

• What: $A^2FV$ (Asynchronous Attribution Fingerprint Vectors) is a proxy-side correlation protocol that links distributed, asynchronous prompt injection sessions from a single latent adversary across independent LLM agents by analyzing tool-use structures and prompt stylometry.
• Who's at risk: Enterprise LLM-agent architectures deploying multiple disconnected specialized agents (e.g., customer support, software engineering, and data analysis pipelines) that share a unified API gateway but lack shared memory or runtime states.
• Key number: $A^2FV$ achieves a campaign-linking pairwise Area Under the ROC Curve (AUC) of 0.82 on the SCD-v1 benchmark, whereas traditional per-session detectors and chunked LLM judges perform near random chance (0.50–0.52 AUC).

Enterprise security teams routinely evaluate Large Language Model (LLM) agent safety through a narrow, per-session lens. They deploy isolated input guardrails and local safety classifiers, assuming that an attack is a self-contained, highly visible event. This paper breaks that foundational assumption, introducing a class of attacks where a single adversary distributes a coordinated campaign across multiple independent LLM agents over time. By routing sparse, paraphrased variations of an exploit through different business units, attackers bypass isolated local guardrails, which only observe fragmented, seemingly benign interactions.

Threat Model

The following table formalizes the cross-agent asynchronous campaign attribution threat model:

Background & Related Work

Prior research in LLM-agent security focuses almost exclusively on local classification or synchronous propagation. The table below places the cross-agent campaign attribution task in context:

Unlike MAScope (Wei et al., 2026), which reconstructs semantic flows assuming a highly structured runtime dependency graph, $A^2FV$ operates strictly on telemetry captured at the shared API gateway. This makes it effective even when the target agents share no runtime machinery or communication channels.

Technical Deep-Dive

The core technical contribution is the Asynchronous Attribution Fingerprint Vectors ($A^2FV$) protocol. It formalizes a second-stage correlation layer that maps proxy-observed telemetry into three separate feature representation channels.

                                  +-------------------+
                                  |   Shared Proxy    |
                                  +---------+---------+
                                            |
                         +------------------+------------------+
                         |                  |                  |
                         v                  v                  v
                 [Structural]          [Temporal]        [Stylometric]
                Tool sequences,       Inter-call gaps,   Char/byte n-grams,
                errors, tactics        payload sizes         TF-IDF vector
                         |                  |                  |
                         +------------------+------------------+
                                            |
                                            v
                                  +-------------------+
                                  | Pairwise Cosine   |
                                  | Similarity (Kw)   |
                                  +---------+---------+
                                            |
                                            v
                                  +-------------------+
                                  | HDBSCAN/Agglom    |
                                  |    Clustering     |
                                  +-------------------+

1. Feature Representation Channels

For any given agent session $s_j$, the proxy observes the user prompt $u_j$, the ordered tool-use trace $E_j$, and the wall-clock arrival timestamp $\tau_j$. The trace is represented as:

where $g^\ell_j$ is the tool name, $o^\ell_j \in \{\text{ok}, \text{err}\}$ is the coarse outcome, $b^\ell_j$ is the payload size, and $\eta^\ell_j$ is the tool-call timestamp. $A^2FV$ constructs three feature blocks from this telemetry:

Structural Residue ($f^{\text{str}}_j$)

This block captures the behavioral fingerprint of the agent's execution loop. The proxy maps tool events to decorated tokens:

From these tokens, the protocol extracts:

• Hashed counts of decorated tool-call $n$-grams for $n \in \{1, 2, 3\}$.
• Failure-pivot transition features representing state-machine recovery behaviors of the form $(g^\ell_j, \text{err}) \to g^{\ell+1}_j$.
• A coarse tactic histogram using a static tool-to-tactic mapping inspired by the MITRE ATT&CK enterprise matrix. The final concatenated vector is $\ell_2$-normalized to yield $f^{\text{str}}_j$.

Temporal Residue ($f^{\text{tmp}}_j$)

To quantify the "gait" of an agent's execution, the proxy analyzes the inter-call gaps $\Delta_j = \left( \eta^{\ell+1}_j - \eta^\ell_j \right)_{\ell=1}^{L_j-1}$ and payload sizes $b^\ell_j$. Features include:

• Total session duration and total tool call counts.
• The first four statistical moments of $\log(\Delta_j + \epsilon)$.
• Hartigan’s dip statistic (to detect multimodality in tool-calling pauses).
• Interquartile Range (IQR) normalized by variance, and payload size moments. These features are standardized via calibration-split statistics and normalized to obtain $f^{\text{tmp}}_j$.

Stylometric Residue ($f^{\text{sty}}_j$)

To capture fine-grained attacker phrasing without semantic abstraction, $A^2FV$ operates strictly on surface-form prompt text. It hashes character $n$-grams ($n \in \{3, 4, 5\}$) and byte-level $n$-grams over the raw UTF-8 prompt byte stream. These are projected into a Term Frequency-Inverse Document Frequency (TF-IDF) vector and $\ell_2$-normalized to output $f^{\text{sty}}_j$.

2. Pairwise Attribution and Calibration

For each feature block $d \in \{\text{str}, \text{tmp}, \text{sty}\}$, the pairwise similarity between session $s$ and $s'$ is the cosine similarity:

Given a non-negative weight vector $w \in \Delta^2$, the composite attribution score is:

To perform clustering, similarities are converted to a dissimilarity metric:

Weights are determined offline during calibration on a development split by maximizing the Normalized Mutual Information (NMI) against ground-truth campaign labels using a grid search over the 2D simplex at a 0.1 resolution:

This optimization yields the fixed deployment weights:

This weight profile relies entirely on structural and stylometric signatures, zeroing out the temporal weight due to network jitter and queue delays observed on the primary benchmark.

# Reference Implementation of the A2FV Pairwise Scoring Logic
import numpy as np
from sklearn.metrics.pairwise import cosine_similarity

def calculate_a2fv_score(f_s, f_sp, w=np.array([0.6, 0.0, 0.4])):
    """
    Computes the pairwise campaign-linking score between two sessions.
    f_s, f_sp: dict containing 'str', 'tmp', and 'sty' feature vectors
    w: weight vector corresponding to [structural, temporal, stylometric]
    """
    blocks = ['str', 'tmp', 'sty']
    k = np.zeros(len(blocks))
    
    for i, block in enumerate(blocks):
        vec_s = f_s.get(block)
        vec_sp = f_sp.get(block)
        
        if vec_s is None or vec_sp is None or np.all(vec_s == 0) or np.all(vec_sp == 0):
            k[i] = 0.0
        else:
            # Vectors are pre-l2-normalized
            k[i] = np.dot(vec_s, vec_sp)
            
    # Compute composite attribution score
    K_w = np.dot(w, k)
    return K_w

3. Active Probing: CRF-light

To verify agent identity under high uncertainty, $A^2FV$ specifies an optional active probe module named Challenge-Response Framework-light (CRF-light). With a trigger probability $\rho \le 0.1$, the proxy dynamically injects a semantically equivalent tool-schema alias (e.g., aliasing search to search_v2) into the agent's system prompt during initialization.

A standard benign agent automatically updates its execution loop and runs the new schema. An attacker's hardcoded exploit script, expecting the default schema, fails to adapt—triggering observable fallback logic, exception handling routines, or added execution latency. This active perturbation increases the structural separation between benign and evasive traffic.

Experimental Results

The authors evaluated $A^2FV$ on the newly constructed Source Campaign Detection (SCD-v1) benchmark, which contains 2,000 sessions (70% benign, 15% isolated indirect prompt injections, and 15% multi-session campaigns).

Main Campaign-Linking Performance

Table B from the paper compares $A^2FV$ to local prompt detectors, adapted state-of-the-art per-session defenses, and chunked LLM judges:

Key Ablation: Impact of Telemetry Channels

Table C isolates the predictive power of individual feature blocks under the primary evaluation configuration:

The structural channel is the single strongest predictor of campaign similarity, achieving an AUC of 0.784 on its own. While the unweighted combination of S + Y yields a slightly higher AUC of 0.825, the calibrated model maintains a better balance of partitioning quality (V-measure of 0.269 vs 0.292).

Limitations & Open Questions

A skeptical analysis of the evaluation highlights several limitations:

• The Temporal Channel is Weak: Although temporal metrics are core to the proposed three-channel architecture, they received a weight of $0.0$ during calibration. Under real-world network variations, temporal residue stands out as highly noisy and easily masked by network-hop jitter, making it a weak telemetry channel on its own (AUC of 0.562).
• Style Sensitivity and Confounding: Stylometric analysis is highly vulnerable to deliberate style transfer. In the "crossed-style" stress test (where attacker identity is deliberately decoupled from writing style), the stylometry-only model's performance collapses to 0.271 AUC (Table K). The structural-only channel remains robust at 0.686 AUC, proving that $A^2FV$ relies heavily on stylometric indicators to achieve its headline 0.818 AUC.
• Scale of Native Validation: While the synthetic SCD-v1 dataset contains 2,000 sessions, the native-framework validation on OpenClaw and LangGraph is comparatively small (48 and 120 sessions, respectively). On these real agent runs, overall campaign-linking AUC drops to 0.704 (OpenClaw) and 0.663 (LangGraph), showing that execution variances in live environments degrade correlation performance.

What Practitioners Should Do

If you are running multi-agent systems at scale, implement these steps to mitigate distributed attacks:

1. Centralize Proxy-Side Telemetry

Do not rely on local agent-level databases or isolated session logging. Route all agent input prompts, system definitions, tool schemas, and output sizes through a unified API gateway (e.g., Envoy, Kong, or a custom middleware layer). This gateway must log session arrival times, payload sizes, and exact tool-execution states.

2. Extract Structural Signatures

Transform tool-execution sequences into normalized structural vectors. Log the transitions:

Store these sequences as sparse $n$-grams.

3. Deploy an Offline Clustering Pipeline

Configure an offline clustering pipeline using HDBSCAN over the calculated dissimilarity matrices. For production systems, use the calibrated weights:

to calculate distance. Set HDBSCAN parameters to:

min_cluster_size = 3
min_samples = 2

to isolate noise (benign sessions and isolated attacks) while grouping campaign clusters.

4. Implement Adaptive Tool Aliasing (CRF-light)

For high-privilege tool calls, introduce active probing. Implement system prompt schema updates with a probability of 10% ($\rho = 0.1$):

Standard tool: search(query: str)
Probe alias: search_v2(query: str)

Monitor incoming sessions for hardcoded failures, fallback exceptions, or sudden execution pauses.

5. Establish Rolling Correlation Windows

Avoid performing global pairwise comparisons over all historical records, which incurs $O(m^2)$ computational complexity. Run correlation computations on a rolling temporal window (e.g., 60 minutes) sharded by tenant identity or tool family.

The Takeaway

Campaign attribution is a critical, missing layer in the LLM-agent security stack. Shifting defense from isolated, per-session prompt inspection to proxy-level behavioral correlation exposes coordinated attacks that would otherwise bypass individual guardrails. Security engineering must treat multi-agent deployments as unified, stateful attack surfaces rather than a collection of independent inputs.

Den's Take

While evaluating isolated inputs is a known dead end, we must be realistic about the performance of proxy-side correlation. The authors' protocol, $A^2FV$, achieves an AUC of 0.82 on the SCD-v1 benchmark. While this easily beats random-chance baselines, an AUC of 0.82 is simply too low for a practical enterprise security operations center (SOC). In high-volume production environments, deploying this as an automated blocking mechanism would trigger a deluge of false-positive alerts, drowning analysts in noise.

The core issue lies in the features being tracked: prompt stylometry and tool-use structures are notoriously easy for a motivated attacker to mutate. As I noted when reviewing work on memory poisoning like AgentPoison (Chen et al., 2024), agent vulnerabilities are systemic rather than isolated, meaning we must analyze environmental telemetry rather than single-session inputs to understand failures. However, if an attacker uses automated LLM paraphrasing or intentionally shuffles non-dependent tool parameters, these brittle stylistic fingerprints will quickly fall apart. Security teams should treat proxy-side correlation not as an active inline defense, but as a forensic utility to help reconstruct campaigns post-incident.