Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents

Abstract

LLM-agent defenses are typically evaluated one session at a time. In deployment, however, attacks can be distributed across independent agents, teams, and runtimes, leaving each local guardrail with only a sparse fragment. We formalize cross-agent asynchronous campaign attribution: linking sessions from the same latent adversarial campaign without shared runtime state, test-time campaign labels, or attacker identity oracles. We introduce Asynchronous Attribution Fingerprint Vectors ($A^2FV$), a

Categories

@misc{park2026crossagent,
  title = {{Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents}},
  author = {SangJin Park and Myungsub Choi and Jineok Kim and Minseung Kang},
  year = {2026},
  month = jul,
  eprint = {2607.18826},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.18826}
}