Attribution scoring catches cross-agent attacks at 0.82 AUC

Attribution scoring pins coordinated attacks across separate AI agents at 0.82 pairwise AUC, per arXiv 2607.18826. Guardrails that evaluate one agent session at a time don't catch any of it. Real adversaries split a single campaign across independent agents and runtimes, so each local defense only ever sees a fragment.

The method scores campaign similarity with what the paper calls Asynchronous Attribution Fingerprint Vectors: tool-use patterns, timing, and prompt residue left across sessions. Against near-chance baselines, it hits 0.82 AUC. It held under controlled evasion, too.

Structural and stylometric residue in the prompts carried the strongest signal, ahead of timing alone, per the paper's ranking. The correlation itself runs at the proxy layer, outside any single agent's guardrail. No need to instrument every agent in a fleet one by one.

That's the bet worth making: per-agent guardrails turn into a wasted line item once you're running more than one fleet. The thing to watch: whether orchestration platforms ship this correlation themselves, instead of leaving each agent vendor to bolt on its own detection.