DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agents
Asif Pinjari, Mithun Paul Saint-Germain
cs.CR · cs.AI · cs.LG
Quick verdict
Claims first joint verdict+step-label injection detector; rigorous results (F1 0.983) but self-benchmarked on synthetic, single-generator AgentDrift data.
Summary
DriftNet is a dual-head Transformer that reads logged LLM-agent tool-call trajectories and, in one forward pass, outputs a trajectory-level compromise verdict plus a four-way label (benign, injection point, hijacked, failed injection) on every step. Each step is embedded by a frozen sentence encoder (all-mpnet-base-v2) concatenated with four identity-free world features, feeding an under-2M-parameter trunk trained with a class-weighted joint loss. On the task-disjoint split of the authors' own AgentDrift benchmark (12,536 synthetic trajectories, 71,024 labeled steps; 1,722 test), it reaches trajectory F1 0.983, exact injection-point recovery on 98.7% of attacked trajectories, hijacked-span IoU 0.979, zero flags on 218 resisted attacks, and a 2.9% flag rate on hard negatives, while a retrained surface logistic-regression baseline reaches F1 0.678 and collapses on partial hijacks (11.1% recall) and delayed executions (17.1%). The protocol is careful: task-disjoint splitting, a 20-configuration sweep, a single test evaluation, and all 26 errors read individually. Main limitations: the corpus is synthetic, single-generator (Llama-3.3-70B), and author-built; the acknowledged world-identity regularity (a lookup reaches 86.9%) could inflate trajectory-level numbers through text embeddings, and no anonymized or world-held-out evaluation was run; no stronger baselines appear on the same split; and there is no adaptive-attacker or real-traffic evidence. The corpus is public; DriftNet's own code release is not stated.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- DriftNet is, to the authors' knowledge, the first supervised detector to jointly output a trajectory-level compromise verdict and a four-way per-step label (benign/injection_point/hijacked/failed_injection) from the logged trajectory alone, with no access to the agent's model.
- On the task-disjoint AgentDrift split with a single test evaluation, DriftNet reaches trajectory F1 0.983, exact injection-point recovery on 98.7% of attacked trajectories, and hijacked-span IoU 0.979.
- It operationally separates attempted from successful injections: zero flags on 218 resisted attacks and 2.9% flags on hard negatives, versus 17.0% and 8.3% for the retrained surface baseline.
- Gains over the surface baseline concentrate on stealthy compliance patterns (partial hijack recall 11.1%→98.6%, delayed execution 17.1%→93.2%) while every false-alarm rate simultaneously falls, evidencing genuine sequence reading rather than sharper surface statistics.
- Nine of twelve residual false negatives trace to labeled injection observations containing no legible instruction, bounding the misses as corpus label noise rather than detector failure.
Strengths
Genuinely novel joint output structure
Section II-E and Table I position DriftNet as the first supervised detector combining a trajectory verdict with four-way per-step labels (benign/injection_point/hijacked/failed_injection); the label grammar of Section III-C (e.g., B+IH1..2B+ for partial hijacks, B+IB+HB+ for delayed executions) represents cases prior single-index outputs (StepGuard [16], TraceSafe [17], StepShield [18], TrajAD [19]) cannot express.
Trust-preserving evaluation protocol
Section VI: task-disjoint split (no shared task templates), a 20-configuration sweep bounding validation-F1 sensitivity to 0.011 (range 0.9827–0.9934, top-5 spread 0.0014, Table IV), the test part touched exactly once at threshold 0.5, and the surface baseline retrained on the identical split (F1 0.678 vs its published 0.647 on the stratified split) for a like-for-like comparison.
Strict localization metrics with pattern breakdown
Exhaustive, honest error analysis
Extreme parameter economy with full specification
Weaknesses
Self-benchmark circularity
Acknowledged leakage left unquantified for the model
Single, deliberately weak baseline
Synthetic, single-generator scope
Thin statistical reporting
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
DriftNet (arXiv 2609.10892) targets post-hoc triage of LLM-agent tool-call trajectories compromised by indirect prompt injection. The claimed novelty (Section II-E, Table I) is the joint output structure: one head emits a trajectory-level compromised/safe verdict while a second labels every step as benign, injection_point, hijacked, or failed_injection — entry point, corrupted span, and resisted attacks in one forward pass from the log alone, with no access to agent internals. Per the positioning table, prior systems emit only trace verdicts (trajectory guards [13]–[15], with resisted injections folded into the safe class) or single indices (StepGuard's first unsafe action [16], TraceSafe's one mutated step [17], StepShield's onset [18], TrajAD's error step [19]). The label grammar (B+IH+, B+IH1..2B+, B+IB+HB+, B+FB+; Section III-C) is what lets the output represent an agent that complied briefly and recovered, delayed compliance, and resisted poison. The claim is explicitly scoped to the label structure and joint task, and the paper is candid that everything rests on AgentDrift [21] — a benchmark created by the same two authors.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What does DriftNet detect?
It reads a logged LLM-agent tool-call trajectory and outputs two things at once: whether the agent was compromised by an indirect prompt injection (trajectory-level verdict) and a four-way label for every step — benign, injection point (where the attack entered via a tool observation), hijacked (actions serving the attacker), or failed injection (attack text present but resisted).
How accurate is DriftNet?
On the task-disjoint test split of the synthetic AgentDrift benchmark (1,722 trajectories) it reports trajectory-level F1 of 0.983, exact injection-point recovery on 98.7% of attacked trajectories, hijacked-span IoU of 0.979, zero false alarms on 218 resisted attacks, and a 2.9% flag rate on hard negatives. These are synthetic-data numbers from a single-generator corpus; real-traffic performance is untested.
Does DriftNet need access to the LLM running the agent?
No. It consumes only the recorded trajectory text plus a world context (e.g., a contact list defining internal vs external recipients) and a frozen sentence encoder, so it works on closed-source agents and after-the-fact logs. It cannot block actions in a live loop — it is a forensic/audit detector, complementary to runtime defenses.
Is the AgentDrift dataset public?
Yes. The paper states the corpus, including the task-disjoint split used for all experiments, is released under CC BY 4.0 on GitHub (Asif-0209/AgentDrift). DriftNet's own training code release is not explicitly stated in the paper, though the architecture and hyperparameters are fully specified.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figure-embedded values (e.g., the Fig. 5b confusion-matrix cells and Fig. 8 axis ticks) extract imperfectly from PDF layout; every figure-derived claim in this review was cross-checked against Tables V–XI and body text. The abstract, all sections I–XII, and all 46 references are present and complete in the extraction, so no truncation is assumed.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.