DriftNet, a detector under 2M parameters, pinpoints where a prompt injection entered an agent trajectory 98.7% of the time

arXiv·medium signalXBlueskyLinkedInCopy link

arXiv 2609.10892 trains a two-head transformer that reads logged tool-call trajectories without access to the agent's model. One head gives a compromised-or-not verdict (F1 0.983), and the other labels each step as benign, injection point, hijacked or failed injection. On 12,536 AgentDrift trajectories it recovers 98.6% of partial hijacks and 93.2% of delayed executions, where a surface baseline manages 11.1% and 17.1%. It raised zero flags on 218 attacks the agent resisted. Because it runs on logs, you can apply this kind of forensics after the fact to any agent that records its tool calls.