AgentTracer tracks indirect prompt injection attack chains
Start here
The researchers propose AgentTracer, an intent-aware tracing framework that treats indirect prompt injection as task intent drift, used for post-hoc localization of injection sources and reconstruction of attack chains. The method recovers implicit decision dependencies between tool calls, constructs an intent-driven execution graph, and connects scattered tool calls by task intent; it then combines user requests with an operation knowledge base to construct a user intent authorization space and identifies tool calls with intent drift. Starting from anomalous tool calls in the audit, AgentTracer reconstructs the attack chain through target pruning and backward tracing, locating the injection source and injection point.
Generated by AI from reports · Updated 2026-10-13
Related research
This event's paper
- AgentTracer: Tracing Indirect Prompt Injection Attack through Fine-Grained Intention-Execution Alignment
arXiv · 2026-10-07 · Deep reading
Storyline
- · 1 reports· Attention32
AgentTracer tracks indirect prompt injection attack chainsThis event
- · 1 reports· Attention36Sun Yat-sen University and HKUST propose AgentTracer to trace prompt injection attack chains
Progress timeline
- arXiv: Jailbreaks, Prompt Injection, Poisoning & DefensesAgentTracer: Tracing Indirect Prompt Injection Attacks via Fine-Grained Intent-Execution Alignment
The researchers propose AgentTracer, an intent-aware tracing framework that treats indirect prompt injection as task intent drift, for post-hoc localization of injection sources and reconstruction of attack chains. The method recovers implicit decision dependencies between tool calls, builds an intent-driven execution graph, and connects scattered tool calls by task intent; combined with user requests and an operation knowledge base, it constructs a user intent authorization space to identify tool calls with intent drift. Starting from anomalous tool calls in the audit, AgentTracer reconstructs the attack chain through goal pruning and backward tracing, locating the injection source and injection point. In end-to-end experiments mixing successful IPI attack execution logs from AgentDyn and InjecAgent with normal logs containing 1,800 user requests and 9,000 background tool calls without IPI, AgentTracer achieves 94.17% injection point accuracy and 93.56% path precision, improving injection point accuracy by 18% to 54% over existing methods.