DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agents

Abstract

When an indirect prompt injection succeeds against an LLM agent, the compromise is visible in the agent's own behavior: a benign prefix of tool calls, a poisoned observation, and a suffix of actions that serve the attacker. An operator needs three facts: where the attack entered, which steps it corrupted, and whether apparent poison was resisted. Existing systems return either a whole-trace verdict or a single unsafe index. We present DriftNet, a dual-head trajectory Transformer that reads a log

Categories

Framework mappings

Suggested from the entry's categories.

@misc{pinjari2026driftnet,
  title = {{DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agents}},
  author = {Asif Pinjari and Mithun Paul Saint-Germain},
  year = {2026},
  month = sep,
  eprint = {2609.10892},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10892}
}