PaperlayerView exact revision on arXiv

Source-linked AI summary

AgentTracer: Tracing Indirect Prompt Injection Attack through Fine-Grained Intention-Execution Alignment

Zitong Yao, Jiangrong Wu, Yixi Lin, Anrui Huang, Luoyun Zhang, Yuhong Nan

arXiv:2610.09935v1cs.SE

TL;DR

Existing tracing methods overlook tool-call relationships driven by malicious instructions when calls lack explicit dependencies or are interleaved with legitimate operations. AgentTracer constructs an intent-driven graph, aligns tool calls with a user-intent authorization space, and traces drift calls backward from an anomalous event. Across two datasets, AgentTracer achieves 94.17% injection-point accuracy and 93.56% path precision, improving injection-point accuracy over existing methods by 18–54%.

  • Problem

    Existing tracing methods overlook tool-call relationships driven by malicious instructions when calls lack explicit dependencies or are interleaved with legitimate operations.

    Source: §1 · p. 2

  • Method

    AgentTracer constructs an intent-driven graph, aligns tool calls with a user-intent authorization space, and traces drift calls backward from an anomalous event.

    Source: §3.2 · p. 6

  • Results

    Across two datasets, AgentTracer achieves 94.17% injection-point accuracy and 93.56% path precision, improving injection-point accuracy over existing methods by 18–54%.

    Source: §1 · p. 3

  • Takeaways & Limitations

    AgentTracer provides reconstructed attack-chain evidence for locating the injection source and injection point.

    Source: §8 · p. 18

    AgentTracer currently focuses on tracing IPI expressed through natural-language context; code-level injection requires extending coverage by linking execution records to the tool call that launched the code.

    Source: §6.2 · pp. 17–18

Abstract

from arXiv · show

Large language model (LLM) agents interact with external resources to complete complex user tasks, exposing them to indirect prompt injection (IPI), where malicious instructions redirect agents toward attacker-intended tasks. Since IPI is difficult to defend against in real-world environments, post-incident tracing is essential for locating the injection source and reconstructing the attack chain. However, existing tracing methods primarily capture explicit control-flow and data-flow dependencies, overlooking the implicit relationships among tool calls driven by the malicious instruction. These tool calls may lack explicit dependencies and be interleaved with legitimate operations, making complete attack-chain reconstruction difficult. In this paper, we present AgentTracer, an intent-aware tracing framework that treats IPI as task intent drift. AgentTracer recovers implicit decision dependencies among tool calls to construct an Intent-Driven Execution Graph that connects dispersed tool calls by task intent. It combines the user request with an operation knowledge base to construct a user intent authorization space and identify intent-drift tool calls. Starting from an anomalous tool call under audit, AgentTracer performs target-based pruning and backward tracing to reconstruct the attack chain and locate the injection source and injection point. To evaluate AgentTracer in the presence of noise from normal tasks, we combine execution logs constructed from successful IPI attacks in AgentDyn and InjecAgent with normal execution logs containing 1,800 user requests and 9,000 background tool calls without IPI. In end-to-end experiments, AgentTracer achieves 94.17 percent injection-point accuracy and 93.56 percent path precision. Comparative experiments show that AgentTracer improves injection-point accuracy over existing methods by 18 to 54 percent.

1 Introduction

Existing tracing methods miss tool-call relationships driven by malicious instructions, especially when malicious and legitimate operations are interleaved. AgentTracer treats IPI as task-intent drift and traces from an anomalous call to reconstruct the attack chain and injection point.

Tracing gap

  • Existing tracing methods capture explicit control-flow and data-flow dependencies but overlook malicious-instruction-driven tool-call sequences that may lack explicit dependencies and alternate with legitimate operations.These limitations make existing methods incompatible with IPI attacks.Source: §1 · p. 2

Approach

  • AgentTracer treats IPI as task-intent drift, comparing agent task intent with user intent to identify drift, reconstruct the attack chain, and locate the injection source and point.Task intent is the tool-call sequence executed for a task goal.Source: §1 · p. 2

Challenges

  • The framework addresses three challenges: connecting dispersed intent-driven calls, defining a flexible authorization space from high-level requests, and pruning unrelated historical execution data.Malicious and legitimate operations may be interleaved, and user requests do not fully specify legitimate operations.Source: §1 · p. 2

Evaluation

  • AgentTracer combines attack logs from AgentDyn and InjecAgent with normal logs covering 1,800 user requests and 9,000 background tool calls without IPI.The attack-tracing experiments use the combined execution logs.Source: §1 · p. 2
  • Across the two datasets, AgentTracer achieves 94.17% accuracy in locating injection points and 93.56% precision of reconstructed attack chains, improving injection-point accuracy over existing methods by 18–54%.Source: §1 · p. 3

2 Background and Motivation

IPI introduces malicious instructions through external resources, potentially interleaving attacker-driven calls with legitimate work. AgentTracer aims to recover the ordered malicious calls that existing tracing approaches may fail to connect.

2.1 Background

  • IPI embeds malicious instructions in external resources, which can redirect an agent from the user task to an attacker-intended task.A release-page instruction, for example, induces malicious calls while the agent continues authorized work.Source: §2.1 · p. 3
  • Task intent is a goal realized through a tool-call sequence; user intent originates in the request, while attacker intent is introduced by malicious instructions.The attacker-intent sequence can be interleaved with user-intent calls in execution logs.Source: §2.1 · p. 4

2.2 Motivation

  • Graph-based, attribution-based, and counterfactual-based tracing can respectively miss disconnected attack steps, fail to order them, or return noisy source candidates.These approaches overlook how attacker intent is realized across calls without data dependencies or causal correlations.Source: §2.2 · p. 4
  • AgentTracer aims to determine whether an anomalous event stems from IPI and, if so, identify its source and point while recovering ordered malicious calls and excluding interleaved legitimate calls.The recovered evidence is intended to help auditors assess impact and developers identify security weaknesses.Source: §2.2 · p. 5
  • AgentTracer targets logs containing user requests, reasoning records, and tool records, and attacks where natural-language instructions lead to observable tool calls.Attacks that do not result in tool execution are outside its scope.Source: §2.2 · p. 5

3 Overview of AgentTracer

AgentTracer addresses intent-based tracing, intent-drift identification, and noisy-log pruning. Its workflow narrows analysis around an anomalous event, aligns tool calls with user intent, and traces intent-drift calls backward.

3.1 Challenges and Solutions

  • Decision-dependency recovery connects dispersed tool calls that realize one task intent, despite interleaving and absent explicit dependencies.A call's result changes the agent's context and informs a later decision.Source: §3.1 · p. 5
  • Knowledge-enhanced intent alignment combines a high-level user request with operation knowledge to define authorization boundaries while preserving legitimate execution flexibility.The resulting authorization space is used to identify calls that drift from user intent.Source: §3.1 · p. 5
  • Event-guided pruning centers tracing on the anomalous event to restrict analysis to relevant execution evidence without discarding evidence needed for reconstruction.This avoids analyzing a global graph containing unrelated requests and calls.Source: §3.1 · p. 6

3.2 Workflow of AgentTracer

  • The workflow slices logs to the segment between the nearest user request and anomalous event, then constructs an intent-driven graph and marks drift edges using action, target, and constraint dimensions.The graph uses decision dependencies; alignment takes the request, operation knowledge, and graph as input.Source: §3.2 · p. 6, Figure 2 · p. 6
  • Attack-chain traceback traces intent-drift tool calls backward from the anomalous event, narrowing the tracing space while preserving evidence to locate the injection point.Focusing on the anomalous event removes unrelated execution evidence.Source: §3.2 · p. 7

4 Design Details of AgentTracer

AgentTracer reconstructs task-intent dependencies among tool calls, evaluates them against a user-derived authorization space, and traces anomalous events backward through intent-drift edges. Its design links graph construction, authorization checks, and progressively narrowed traceback.

4.1 Intent-Driven Execution Graph Construction

  • The IntentExecGraph connects tool calls through resource nodes and decision-grounded edges, so connected paths represent ordered calls realizing a task intent.AgentTracer extracts contextual decision relations from reasoning records and grounds them in successful tool calls.Source: §4.1 · pp. 7–8

4.2 User Intent Alignment

  • Intent alignment evaluates tool calls against a structured authorization space built from the user request and an operation knowledge base.The resulting graph labels execution edges representing intent drift as Misaligned.Source: §4.2 · p. 8, §4.2.1 · p. 8

4.2.1 User-Intent Authorization Space Construction.

  • UA-Scope represents authorization with task frames and high-level operation classes, then enriches task frames with permitted support operations and explicit constraints.Bounded dynamic completion allows an authorized contextual entity to supply missing task information without expanding user-granted authority.Source: §4.2.1 · pp. 9–10

4.2.2 Intention-ToolCall Alignment.

  • Each grounded decision relation is checked for authorized action, target, and execution constraints; any violated dimension makes it Misaligned.A relation is Aligned if it aligns with at least one candidate task frame; otherwise it is Misaligned.Source: §4.2.2 · p. 11

4.3 Attack-Chain Traceback

  • Traceback narrows the search from matching historical records to successful-call graphs and then follows Misaligned edges backward from the anomalous event’s sink.An external-resource root identifies the injection source, its context-entry log line identifies the injection point, and the traversed calls form the attack chain.Source: §4.3 · pp. 12–13

5 Evaluation

Evaluation measures end-to-end IPI tracing, compares baselines, tests core components, and checks benign-task false positives. It combines successful attack logs with normal historical activity.

5.1 Experimental Setup

  • Evaluation combined successful AgentDyn and InjecAgent attacks with 1,800 normal user requests and 9,000 background tool calls, about 3,000:1 background calls per attack-chain tool call.The datasets contain 356 AgentDyn logs and 936 InjecAgent logs; only logs from successful attacks were retained.Source: §5.1 · p. 13

5.2 RQ1: End-to-End Effectiveness

  • Across AgentDyn and InjecAgent, end-to-end tracing achieved 97.34% IPI detection, 94.17% injection-point accuracy, 90.25% path coverage, and 93.56% path precision.The experiment selected 300 logs from each dataset and traced attack chains within the historical-log pool.Source: Table 2 · p. 14, §5.2 · p. 14

5.3 RQ2: Comparison with Existing Methods

  • AgentTracer achieved 94.00% injection-point accuracy and 93.18% path precision, improving injection-point accuracy over baselines by 18.00–54.00%.The comparison used 100 IPI attack chains from the historical-log pool.Source: Table 3 · p. 15, §5.3 · p. 15

5.4 RQ3: Ablation Study

  • Replacing the IntentExecGraph with a temporal graph reduced injection-point accuracy by 17.00% and path coverage by 31.78%.Temporal adjacency can connect unrelated calls when calls driven by different task intents are interleaved.Source: Table 4 · p. 16, §5.4 · p. 16
  • Replacing user-intent alignment with direct LLM judgments reduced injection-point accuracy from 91.00% to 64.00%.The authors attribute the difference to vague user requests that provide insufficient criteria for reliable intent alignment.Source: Table 4 · p. 16, §5.4 · p. 16
  • Full-history LLM analysis preserved tracing effectiveness close to AgentTracer but increased average analysis time by 30.98% and token consumption by 51.24%.This setting retained IntentExecGraph construction and user-intent alignment while omitting event-guided pruning.Source: Table 5 · p. 16, §5.4 · p. 16

5.5 RQ4: User Intent Alignment on Benign Tasks

  • On 100 benign logs, alignment's edge-level false-positive rate was 3.52% (13/369 after excluding 25 genuine deviations), and IPI attribution requires a drift path from external-resource root to sink.The evaluated logs contained 394 execution edges.Source: §5.5 · pp. 16–17

6 Discussion

AgentTracer is best suited to ReAct-like agents with reasoning records, and its discussion identifies boundaries in cross-session, code-level, and industrial-log evaluation. The authors also report robustness under substantial historical-log noise.

6.1 Applicability and Extensions

  • AgentTracer is best suited to ReAct or similar agents with reasoning records; without them, tracing uses tool records and is less effective.The temporal-graph ablation shows decreased tracing effectiveness when reasoning evidence is unavailable.Source: §6.1 · p. 17
  • The exploratory cross-session test covered 45 cases and exceeded 85% injection-point accuracy, but the authors say its scenarios and sample are insufficient for a general conclusion.Broader evaluation of persistent entities and cross-session tracing is left to future work.Source: §6.1 · p. 17

6.2 Threats to Validity

  • AgentTracer currently focuses on natural-language-context IPI and does not directly trace code-level injection.The authors describe integration with system-level tracing records linked to the tool call that launched code as a way to extend coverage.Source: §6.2 · pp. 17–18
  • Because some comparison methods lack complete implementations, the authors reproduce them from published algorithms, prompts, and rules, while noting their conclusions do not rely solely on those comparisons.The end-to-end and ablation experiments independently assess AgentTracer and its core components.Source: §6.2 · p. 17
  • Approximately 3,000:1 background-to-attack-chain tool-call noise still leaves AgentTracer effective through event-guided pruning.The authors approximate long-running industrial logs with a five-month Codex execution-log pool; pruning focuses analysis on relevant segments and intent-drift paths.Source: §6.2 · p. 18

7 Related Work

Related work spans prompt-injection benchmarks, agent safety and defenses, and execution tracing. AgentTracer is positioned as post-incident tracing that uses tool-call-grounded reasoning evidence to reconstruct multi-step IPI chains.

Prompt Injection Attacks and Benchmarks

  • Prior prompt-injection and agent benchmarks show that malicious instructions can induce tool-call sequences, motivating reconstruction of complete attack chains [9] [21] [22] [33] [45] [7] [47] [49] [17] [48] [1].The passage groups work on prompt injection, tool execution, dynamic and multi-step attacks, and harmful multi-tool tasks.Source: §7 · p. 18

Agent Safety Evaluation and Defenses

Execution Tracing and Reasoning Evidence

  • Execution-tracing methods use provenance and agent dependencies, while other approaches identify influential sources through contextual influence, counterfactual tests, or contribution signals [10] [13] [16] [19] [37] [38] [2] [15] [39] [41].The paper says Section 2 discusses their limitations for multi-step IPI tracing.Source: §7 · p. 18
  • AgentTracer grounds contextual decision relations extracted from reasoning records in executed tool calls, addressing concern that generated reasoning may be unfaithful [14] [40] [44] [34].Source: §7 · p. 18

8 Conclusion

AgentTracer treats IPI as intent drift and aligns task intents with user intent through an Intent-Driven Execution Graph. Experiments on logs constructed from AgentDyn and InjecAgent show accurate injection-point identification and precise attack-chain reconstruction.

8 Conclusion

  • AgentTracer reconstructs attack chains and locates injection sources and points by identifying the tool-call sequence representing attacker intent.Source: §8 · p. 18
  • AgentTracer models IPI as execution deviating from user intent and constructs an Intent-Driven Execution Graph connecting tool calls by task intent.Source: §8 · p. 18
  • Experiments on agent execution logs constructed from AgentDyn and InjecAgent demonstrate accurate injection-point identification and precise attack-chain reconstruction.The reconstructed evidence supports incident analysis and response.Source: §8 · p. 18

Related papers

Loading 2610.09935v1…