Attnlocate treats prompt injection as an object detection problem inside the attention matrix, hitting 0.934 TPR at 0.067 FPR

arXiv·medium signalXBlueskyLinkedInCopy link

Posted 25 August (arXiv 2608.24022), Attnlocate is a runtime framework that localizes which context spans actually influenced a tool-calling decision, rather than statically detecting malicious content at the input or output boundary. It aggregates attention across heads and layers into a token-level feature space, then runs a 1-D U-Net with an anchor-free detection head to find the activation traces that behavior-guiding instructions leave behind, and adjudicates the tool call based on the authority of the provider the detected span came from. Across ten agent configurations from five LLM families covering indirect prompt injection and tool poisoning it reaches mean IoU 0.743, average AUROC 0.956, and 0.934 true-positive rate at 0.067 false-positive rate, and transfers to unseen models with policy changes requiring no retraining.