Cross-Agent Campaign Attribution Links Attacks Across Independent Agents at 0.82 AUC

arXiv 2607.18826·medium signal

LLM-agent defenses are almost always evaluated one session at a time, but real adversaries distribute attacks across independent agents, teams, and runtimes so each local guardrail only sees a sparse fragment. This paper formalizes cross-agent asynchronous campaign attribution and introduces Asynchronous Attribution Fingerprint Vectors (A²FV), a lightweight proxy-side protocol scoring campaign similarity from tool-use patterns, timing, and prompt residues. On the purpose-built SCD-v1 benchmark (benign traffic, isolated attacks, multi-session campaigns, evasion attempts, leakage audits) A²FV hit 0.82 pairwise AUC versus near-chance baselines, with structural and stylometric residue carrying the strongest signal and holding under controlled evasion.