AgentDrift: A Step-Labeled Benchmark of Injection-Hijacked LLM Agent Trajectories
Asif Pinjari, Mithun Paul Saint-Germain
cs.CR · cs.AI · cs.LG
Quick verdict
Claims first public step-level injection-labeled agent-trajectory benchmark; admirably honest about its flaws, but only a surface baseline tests difficulty.
Summary
The paper introduces AgentDrift, a public benchmark of 12,536 synthetic tool-call trajectories (71,024 steps) across five agent domains in which every step carries one of four labels — benign, injection_point, hijacked, failed_injection — governed by a regular-language label grammar. Categories comprise 4,000 benign, 5,536 attacked (full, partial, delayed hijack patterns), 1,500 failed attacks, and 1,500 hard negatives. Trajectories were generated by a single quantized Llama-3.3-70B under category protocols, enforced by a closed-vocabulary structural validator, screened by an LLM judge that the authors show was fooled by hard negatives, and manually audited on 1,200 trajectories (99.6% label correctness). A six-feature logistic-regression baseline recovers only 55.4% of attacks (F1 0.647), including 8.2% of partial hijacks and 23.1% of delayed executions, which the authors argue establishes the need for sequence modeling. The paper reports its own defects candidly: template concentration (one domain accounts for 28.9% of injected observations), collapse of attack-goal families toward exfiltration behavior, and world-identity leakage that lets a lookup predictor reach 86.1% binary accuracy on the default split. Limitations include the single-generator distribution, injection positions concentrated at steps 2–4, labels that are protocol-specified rather than independently human-annotated, and no sequence-aware baseline demonstrating that the claimed difficulty is learnable.
Review complete
Assessment at a glance
5
risk flags identified
● high 1
● medium 4
● low 0
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- AgentDrift is the first publicly released corpus in which every step carries a prompt-injection-specific label marking the injection entry and the corrupted span, with a named failed-attack class and hard negatives as first-class categories.
- A surface-feature logistic regression recovers only 55.4% of attacks (F1 0.647), including 8.2% of partial hijacks and 23.1% of delayed executions, so the benchmark cannot be solved without modeling the behavioral sequence.
- Generation-time protocol labels plus a closed-vocabulary structural validator yield 100% label-grammar adherence and exact count identities across all 71,024 released steps.
- An LLM judge applied to security-labeled trajectories measures surface suspiciousness rather than label correctness, passing only 0.4% of hard negatives and thus cannot serve as a verifier of injection labels.
- The corpus contains measurable regularities — world-identity leakage (86.1% lookup accuracy), template concentration (28.9% ext-audit.com), and collapsed attack-goal families — that make masking or world-held-out protocols mandatory for valid evaluation.
Strengths
Precisely scoped novelty with disciplined related work
Table I separates five properties across 16 adjacent resources; the first-release claim is an explicitly stated conjunction, and concurrent unreleased works (StepGuard, the Huawei attribution benchmark) are cited with a check date of September 6, 2026.
Formal label grammar with exhaustively verified structure
Eqs. 3-7 define per-category regular languages; Sec. VI-A confirms 100% positional adherence per pattern and exact count identities (5,536 I steps equal 5,536 attacked trajectories; all 71,024 tool calls within their domain pools).
Candor about QA failure modes
Fully accounted construction yield
Shortcut analysis reported as measurements
Weaknesses
Default split is unusable for the stated purpose without user-side fixes
No sequence-aware baseline
Labels are protocol artifacts, not independent annotations
Single generator, short horizons, positional prior
Attack realism unvalidated
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
AgentDrift (arXiv 2609.06972) is a dataset/benchmark paper. The authors claim — carefully scoped in Sec. II-E and Table I — the first publicly released corpus of LLM-agent trajectories in which every step carries a prompt-injection-specific label (entry point plus corrupted span), with a named resisted-attack class and adversarial hard negatives. The benchmark holds 12,536 trajectories / 71,024 steps over five domains (email, banking, web, coding, medical; 103 closed-vocabulary tools) in four categories: 4,000 benign, 5,536 attacked (full 3,136 / partial 1,500 / delayed 900 hijack patterns), 1,500 failed attacks, 1,500 hard negatives. Three tasks are formally defined (Sec. III-D): detection, localization (injection index plus span IoU, Eq. 10), and attempt-versus-success discrimination. The priority claim is defensible as stated: the nearest concurrent efforts (StepGuard, the Huawei attribution benchmark) were unreleased as of the authors' September 6, 2026 repository checks, and TraceSafe/ATBench lack either step-level injection labels or a resisted class.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is the AgentDrift dataset?
AgentDrift is a public benchmark of 12,536 synthetic LLM-agent tool-call trajectories (71,024 individually labeled steps) across five domains: email, banking, web, coding, and medical. Every step is labeled benign, injection_point, hijacked, or failed_injection, enabling training and evaluation of detectors that locate indirect prompt injections and the steps they corrupt. It is released under CC BY 4.0 on GitHub with a datasheet and Croissant metadata.
How well do simple detectors perform on AgentDrift?
The paper's six-feature logistic-regression baseline detects only 55.4% of attacks (F1 0.647, precision 0.778, AUROC 0.734). It catches 88.0% of full hijacks but only 8.2% of partial hijacks and 23.1% of delayed executions, and it flags 18.7% of failed attacks versus 10.5% of benign trajectories — evidence, the authors argue, that shallow features cannot separate attack success from attack attempt.
What are the main caveats of AgentDrift?
All trajectories come from one generator (quantized Llama-3.3-70B); the default train/test split leaks world identity (a no-model lookup reaches 86.1% binary accuracy), so results need world anonymization or a world-held-out protocol; one fictitious target domain appears in 28.9% of injected observations; injections cluster at steps 2-4; and labels are protocol-generated and audited on a 1,200-trajectory sample rather than independently annotated by multiple humans.
How was the label quality of the dataset verified?
In three layers: programmatic checks over all 71,024 steps (label-grammar adherence, count identities, closed tool vocabulary — 100% pass); an LLM screening pass the authors show is unreliable — it rejected 1,494 of 1,500 hard negatives as malicious because it was fooled by their suspicious-looking but legitimate content; and a stratified manual audit of 1,200 trajectories that found 99.6% of step labels correct.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- The abstract string in the task metadata ends mid-word ('A surface-fea'), but the embedded full text contains the complete paper through the references and Appendices A-B, so no assessment below is affected by truncation.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.