Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents

2026-07-21

AI Summary

This work addresses the limitations of existing large language model (LLM) agent defense mechanisms, which are typically confined to single-session contexts and struggle to detect coordinated, asynchronous attacks launched across multiple agents. The study formally introduces the problem of cross-agent asynchronous attack attribution and proposes a lightweight Asynchronous Attribution Fingerprint Vector (A²FV). This approach leverages structural and stylistic features from tool invocations, temporal patterns, and prompt remnants to establish inter-session correlations without requiring shared state or prior knowledge of the attacker. Evaluated on a newly constructed benchmark, SCD-v1, the method demonstrates robust performance under evasion attacks, achieving a pairwise attribution AUC of 0.82—significantly outperforming both single-session detectors and LLM-based adjudicator baselines—and thereby validating the feasibility and effectiveness of cross-session attack attribution.

Abstract

LLM-agent defenses are typically evaluated one session at a time. In deployment, however, attacks can be distributed across independent agents, teams, and runtimes, leaving each local guardrail with only a sparse fragment. We formalize cross-agent asynchronous campaign attribution: linking sessions from the same latent adversarial campaign without shared runtime state, test-time campaign labels, or attacker identity oracles. We introduce Asynchronous Attribution Fingerprint Vectors ($A^2FV$), a lightweight proxy-side reference protocol for scoring pairwise campaign similarity from proxy-observable tool-use, timing, and prompt residue. We also construct SCD-v1, a controlled persona-matched benchmark with benign traffic, isolated attacks, multi-session campaigns, matched non-oracle evasion, and leakage audits. On SCD-v1, $A^2FV$ achieves 0.82 pairwise AUC for campaign linking, while score-only adaptations of per-session detectors and chunked LLM judges remain near chance under the same task. The strongest fixed signal is carried by structural and stylometric residue, while timing is retained as a diagnostic channel for richer proxy traces. Crossed-style controls show that the signal is partly style-sensitive but not reducible to style alone. Static and dimension-aware non-oracle stress tests further show that pairwise separability persists under controlled evasion. These results establish cross-agent campaign attribution as a distinct evaluation layer for securing LLM agents in the wild.

Problem

• cross-agent attribution
• asynchronous attacks
• LLM agents
• campaign linking
• adversarial campaigns

Innovation

• cross-agent attribution
• asynchronous attacks
• A²FV
• LLM agent security
• campaign linking