{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2610.09935", "title": "AgentTracer: Tracing Indirect Prompt Injection Attack through Fine-Grained Intention-Execution Alignment", "summary": "AgentTracer replaces explicit control-flow and data-flow dependency tracing for post-incident IPI forensics with an intent-driven execution graph that links tool calls by inferred task intent and prunes them against a user intent authorization space. Adoption costs include building and maintaining an operation knowledge base, capturing complete structured tool-call logs, running LLM-based intent inference over those logs, and having a pre-identified anomalous tool call as the audit starting point. It can fail when malicious calls closely mimic authorized intent, when logs are incomplete or the anomaly detector never flags a seed call, and its accuracy figures come from two specific attack benchmarks that may not transfer to a given production agent stack.", "rationale": "This is a research-stage forensic prototype requiring curated knowledge bases, full execution logging, and a seed anomaly, so a constrained team should monitor it rather than deploy it, while adopting its underlying practice of structured tool-call logging now.", "technique": "Intent-based forensic tracing of indirect prompt injection", "family": "seguranca_e_guardrails", "recommendation": "observar", "published": "2026-10-07", "as_of": "2026-10-18", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2610.09935", "independent_implementations": 0, "total_implementations": 1, "stars": 1, "citations": null, "claims": [ { "claim_id": "claim-01", "statement": "AgentTracer replaces explicit control-flow and data-flow dependency tracing for post-incident IPI forensics with an intent-driven execution graph that links tool calls by inferred task intent and prunes them against a user intent authorization space. Adoption costs include building and maintaining an operation knowledge base, capturing complete structured tool-call logs, running LLM-based intent inference over those logs, and having a pre-identified anomalous tool call as the audit starting point. It can fail when malicious calls closely mimic authorized intent, when logs are incomplete or the anomaly detector never flags a seed call, and its accuracy figures come from two specific attack benchmarks that may not transfer to a given production agent stack.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.09935", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "Reports 94.17% injection-point accuracy and 93.56% path precision, an 18-54 percentage-point injection-point accuracy improvement over prior tracing methods, on logs derived from AgentDyn and InjecAgent plus 1,800 benign requests.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.09935", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [], "equations_status": "not_fetched", "core_kind": "", "equations_fetched_at": "", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }