Pith. sign in

REVIEW 4 major objections 4 minor 43 references

Proxy-observable tool-use, timing, and prompt residue suffice to link asynchronous LLM-agent sessions from one latent campaign, reaching 0.82 pairwise AUC on a controlled benchmark while per-session score linkers stay near chance.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Cross-agent asynchronous attack sessions can be linked at 0.82 pairwise AUC from proxy-visible tool-use and prompt-style residue in the authors' synthetic SCD-v1 benchmark, far above adapted per-session detectors and chunked LLM judges.

T0 review reviewed 2026-08-01 challenge →

load-bearing objection A genuinely new task formalization and an unusually honest benchmark, but the headline AUC is a campaign-only number and the weights are fit on the same corpus. the 4 major comments →

arxiv 2607.18826 v1 pith:TB44XD4U submitted 2026-07-21 cs.CR cs.AI

Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents

SangJin Park , Myungsub Choi , Jineok Kim , Minseung Kang This is my paper
classification cs.CR cs.AI
keywords cross-agent campaign attributionLLM agentsprompt injectionproxy observabilitypairwise AUCtool-use fingerprintingstylometryasynchronous attacks
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that defending LLM agents session-by-session misses a real class of attack: one adversary distributing related injections across independent agents and teams, asynchronously, so each local guardrail sees only a fragment. It formalizes this as cross-agent asynchronous campaign attribution — a linking task, not a per-session classification task — and shows that a lightweight proxy-side fingerprint protocol, A2FV, can rank same-campaign session pairs above unrelated pairs using only proxy-observable residue: tool-use structure, inter-call timing, and prompt surface style. On the paper's constructed persona-matched benchmark SCD-v1, A2FV reaches pairwise AUC 0.818, while adapted per-session detectors and chunked LLM judges stay near chance. The contribution is the task definition plus a transparent reference protocol and benchmark, not a worst-case robustness guarantee; the paper is explicit that fully adaptive adversaries with detector-score feedback remain out of scope. A sympathetic reader would care because this defines and measures a missing evaluation layer for agent security.

Core claim

The central discovery is that the identity of a latent adversarial campaign leaves recoverable residue in proxy-observable logs even when sessions share no runtime state, arrive asynchronously, and are interleaved with benign traffic. Defining each session by three channels — structural residue (decorated tool-call n-grams, failure-pivot transitions, tactic histogram), temporal residue (inter-call gap moments and payload-size statistics), and stylometric residue (character and byte n-gram TF-IDF over the prompt) — the paper's A2FV protocol forms a weighted cosine score and shows that linking by this score separates same-campaign pairs from different-campaign pairs (AUC 0.818, 95% CI [0.797,

What carries the argument

Asynchronous Attribution Fingerprint Vectors (A2FV): a transparent, label-free-at-inference scoring protocol. Each session is embedded in three blocks — structural (hashed counts of decorated tool-call n-grams for n=1,2,3, failure-pivot transitions, and a tactic histogram), temporal (tool count, duration, log-gap moments, dip statistic, IQR/sigma, payload-size moments), and stylometric (TF-IDF over character and byte n-grams of the prompt) — normalized and compared by cosine similarity per block, then combined by three scalar weights selected once on a calibration split; the fixed deployment weights are (0.6 structural, 0.0 temporal, 0.4 stylometric). The work it does is to produce a pairwis

Load-bearing premise

The measured 0.818 AUC transfers from SCD-v1's controlled, persona-matched synthetic generation to real adversarial campaigns and benign operator traffic; the paper itself concedes that real telemetry could degrade A2FV through missing tool events, coarse timestamps, changing tool taxonomies, and adversaries who deliberately imitate normal operator workflows.

What would settle it

A deployment trace with independently established campaign identity (for example, incident-response ground truth) in which the adversary deliberately reuses normal operator tool sequences and prompt style: if A2FV's pairwise AUC on such pairs falls to near chance while per-session detection stays strong, the residue channel is insufficient in the wild. More cheaply, on a crossed-style slice larger than 120 sessions, if the structural-only hard-slice AUC drops from about 0.686 toward 0.5 as persona variance grows, the structural lower-bound signal fails.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Campaign attribution is a measurable layer distinct from per-session safety classification, so agent-security evaluations should include pairwise and partition linking protocols, not only per-session scores.
  • Score-only adaptations of per-session detectors discard most identity residue: the best score-delta linker reaches 0.522 AUC versus 0.818 for A2FV, so local safety outputs cannot be directly repurposed as campaign linkers.
  • Chunked LLM judges fail at scale (0.50–0.51 AUC) because global campaign identity fragments across chunk boundaries; a cheap fingerprint first pass followed by LLM or analyst review on ranked clusters is the intended operational pattern.
  • Static non-oracle evasion (L1/L2) leaves pairwise AUC essentially intact (0.807–0.816), and a dimension-aware non-oracle composition keeps fixed-weight AUC at 0.833, suggesting the residue bundle is not removed by one or even three simultaneous static transforms.
  • Fixed-weight signal transfers to independent generator regenerations (0.792/0.826 AUC) and to controlled native-framework traces (0.66–0.71 AUC) after schema mapping, making a pure benchmark-artifact explanation less plausible.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • An implication the paper leaves implicit: if the residual-channel hypothesis generalizes, the same pairwise-linking protocol could be applied to other sparse telemetry such as API-login patterns or cloud-console actions, with A2FV-style structural and stylometric blocks.
  • The measured style-sensitivity (hard-slice drop from 0.818 to 0.599, stylometry-only collapse to 0.271) suggests that real-deployment AUC will depend heavily on how much benign traffic shares the adversary's surface style; a style-normalization pre-layer might recover part of that gap.
  • Because temporal residue is weak in this benchmark yet the threat model includes timing, the paper's own logic implies richer traces with queueing, retries, and fallback delays could provide the strongest new signal; re-running weight selection on such traces is a testable extension.
  • The deepest threat implicit in the limitations section is an adversary who deliberately imitates normal operator workflows; the residual-channel hypothesis predicts such mimicry would attack structural and stylometric blocks simultaneously, so a benchmark with a mimicry persona is a natural next stress test.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. This paper proposes a new security-evaluation task: cross-agent asynchronous campaign attribution, in which sessions from the same latent adversarial campaign are linked from proxy-observable prompt, tool-call, and timing residue, without shared runtime state, campaign labels, or attacker identity. The authors define a five-condition threat model, introduce A2FV as a fixed, transparent pairwise scoring protocol over structural, temporal, and stylometric residue blocks, and construct SCD-v1, a synthetic persona-matched corpus with 70% benign traffic, isolated attacks, and multi-session campaigns. On SCD-v1 they report 0.818 pairwise campaign-linking AUC, while score-delta adaptations of per-session detectors (0.51–0.52) and chunked LLM judges (0.50–0.51) remain near chance. The paper also reports matched-persona L0/L1/L2 evasion sweeps, leakage audits, Qwen/Gemini regenerations, crossed-style hard-slice controls, and OpenClaw/LangGraph native-framework probes, and it is unusually explicit about limitations.

Significance. If the 0.818 AUC holds, the paper's main contribution is significant: it defines a previously missing evaluation layer and provides a reproducible benchmark and reference protocol. The strengths are the layered evidence: bootstrapped confidence intervals, leakage audits, matched-persona L0/L1/L2 triplets, crossed-style controls, independent-generator regenerations, native-framework probes, and released artifacts. The unweighted structural+prompt linker (0.825) independently supports the existence of proxy-observable campaign signal. However, the headline number must be read with three restrictions: the primary AUC excludes benign negatives; the three A2FV weights are selected on the same SCD-v1 corpus; and the crossed-style hard slice drops the fixed score to 0.599. These restrictions do not invalidate the contribution, but they require the claims to be re-scoped.

major comments (4)
  1. [§4.1 Metrics; Table 2; §1 Contributions] The headline pairwise AUC (0.818) uses negatives defined as campaign sessions from different campaigns; benign sessions and isolated attacks are excluded unless an experiment explicitly includes them. The contribution in §1 nonetheless claims nontriviality “under controlled, benign-heavy ... conditions.” The only benign-heavy readouts are all-session V-measure 0.269 and all-pair Precision@20=2/20, Recall@100=5/1,728 over ~1.999M pairs (Table I); no threshold-free all-pair AUC with benign and isolated negatives is reported. If that all-pair AUC is materially below 0.818, the abstract’s “0.82” overstates the benign-heavy claim. Please report all-pair AUC with benign/isolated negatives or re-scope the claim to campaign-vs-campaign ranking.
  2. [§3.3 Eq. (3); §4.2 Table 2] The weights w* are selected on the SCD-v1 calibration artifact by maximizing NMI against campaign labels at 0.1 grid resolution, and the headline 0.818 is reported on the Full 2000 corpus. Unless the calibration artifact is a strictly disjoint split, this is in-sample weight selection. The paper’s own unweighted structural+prompt control (0.825) shows the signal is not an artifact of tuning, so this is not fatal; but the calibrated A2FV number should be presented as a same-corpus selected-weight result, with a disjoint-split or fixed-default-weight row as the primary deployment-style estimate.
  3. [§4.1 matched-persona design; Finding 4, Table J] In SCD-v1, campaign identity is generated jointly with a persona style directive; positives are same-persona/campaign pairs and negatives are different-persona pairs. The distributional audit shows style attributes are recoverable (style AUC 0.928), and the fresh crossed-style hard slice drops fixed A2FV to AUC 0.599, stylometry-only to 0.271, and structural-only to 0.686. The 0.818 headline is therefore substantially style-correlated. The paper does state this, but the abstract still presents 0.82 as the headline. I recommend reporting the crossed-style hard-slice and structural-only hard-slice alongside the headline, or adjusting the abstract so that the style-sensitive nature of the 0.82 number is not buried.
  4. [§5 Scope and limitations] The limitation paragraph correctly concedes that adversaries who deliberately imitate normal operator workflows would remove the residue channel on which A2FV relies, and that real telemetry degradation (missing tool events, coarse timestamps, taxonomy shifts) is unmeasured. I do not regard this as an internal inconsistency, but it should be reflected in the conclusion’s wording: the paper establishes a controlled-benchmark phenomenon, not a deployment-ready layer. The current conclusion says “establishes the missing evaluation layer,” which is acceptable if read as the protocol/benchmark, but the abstract’s “in the wild” phrasing overreaches.
minor comments (4)
  1. [Table E] Rows use per-K best w* at grid resolution 0.1; the caption should state explicitly that these are not fixed-weight results, so readers do not read the sweep as evidence of fixed-weight robustness.
  2. [§4.2, Table 2] The “Unweighted structural+prompt control” row is a strength, but the text should make explicit that this row, rather than the calibrated A2FV row, is the cleanest evidence that the task exposes proxy-observable signal, because it has no fitted weights.
  3. [§4.1 Metrics] The text says “Raw Precision@20/Recall@100 ... are harsh all-candidate pre-filter diagnostics”; please state candidate-pair and positive counts in the main text, not only in Table I, so the 2/20 and 5/1,728 numbers are interpretable without hunting for the appendix.
  4. [Throughout] The notation is inconsistent: the abstract and some sections use $A^2FV$, while the body uses A2FV. Please unify.

Circularity Check

0 steps flagged

No significant circularity: the A2FV derivation is self-contained; the disclosed weight calibration is non-load-bearing and the unweighted/fixed-weight controls carry the result.

full rationale

The paper's derivation chain is not circular. A2FV scores pairwise similarity from proxy-observable structural, temporal, and stylometric residue (Section 3.2, Eq. 1) and evaluates campaign linking against latent campaign labels; no feature vector, equation, or definition equates the score to the label by construction. The only in-sample element is weight selection (Section 3.3, Eq. 3): three simplex weights are chosen on the SCD-v1 calibration labels by maximizing clustering NMI, and the headline AUC is reported on Full 2000. Even if the calibration artifact is the same Full 2000 corpus, this is not a circular reduction: the fitted objective is NMI, not pairwise AUC; the parameter space is only three weights at 0.1 grid resolution; and the unweighted structural+prompt control achieves AUC 0.825 (Table 2), essentially equal to A2FV's 0.818, so the fitted weights do not create the signal. Fixed-weight robustness checks on independent Qwen/Gemini regenerations (0.792/0.826) and native-framework probes (0.663-0.713) use the same fixed w* and remain above random. The persona-matched generation contract (Section 4.1) controls style, timing, and tool preference, which are the same channels A2FV measures; this is a construct-validity limitation, explicitly scoped to 'controlled, benign-heavy, asynchronous conditions,' and the paper audits persona-id leakage (0/13,630 hits), so it is not a definitional equivalence. The Section 5 concession that real telemetry and adversaries imitating normal workflows could degrade A2FV concerns external validity, not internal circularity. The primary metric's exclusion of benign negatives is a metric-scope mismatch, acknowledged via separate all-session V-measure and alert-budget diagnostics, not a circular step. There are no load-bearing self-citations: the reference list contains no prior work by the present authors and no imported uniqueness theorem. The central claim therefore has independent empirical content.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 0 invented entities

No new physical entities, forces, or conserved quantities are introduced. A2FV and CRF-light are methods/protocols, not postulated entities; SCD-v1 is a benchmark corpus constructed by the authors with explicit leakage audits. The 'adversarial campaign' is a latent label defined by the benchmark, not an independently evidenced entity.

free parameters (3)
  • Block weights w* = (0.6, 0.0, 0.4)
    Selected on SCD-v1 calibration split by maximizing NMI between induced clustering and campaign labels (Eq. 3, Section 3.3); used for the headline AUC 0.818 on the same corpus.
  • Clustering hyperparameters (HDBSCAN min_cluster_size=3, min_samples=2; agglomerative K in [10,75] for diagnostics) = min_cluster_size=3, min_samples=2; K=10..75
    Chosen for deployment-style clustering and diagnostic sweeps; partition metrics depend on these choices (Section 3.3, Table E).
  • Feature-engineering hyperparameters = tool n-grams n in {1,2,3}, char/byte n-grams n in {3,4,5}, Hartigan dip, TF-IDF, l2 normalization
    Hand-chosen feature set fixed across experiments (Section 3.2); not fitted but materially determines the signal.
axioms (5)
  • domain assumption A shared proxy P observes prompts, tool-use traces, coarse outcomes, and timings for every session, with no access to model activations or agent-internal state (Definition 1, condition (e)).
    The entire A2FV design depends on this observability contract; if deployments lack a shared proxy or omit tool events (the paper's own telemetry-degradation diagnostic, Appendix D), the task is not measurable.
  • domain assumption Sessions from the same latent campaign leave statistically linkable residue in tool-use structure, timing, or prompt surface form (residual-channel hypothesis, Section 3.4).
    The paper labels this a hypothesis, not a theorem; if a real adversary varies style and tool use per session, the residue may vanish.
  • domain assumption SCD-v1's persona-matched generation contract produces traffic whose statistical structure resembles real adversarial campaigns and benign work (Section 4.1).
    The headline 0.82 is measured on this synthetic corpus; the paper says it is 'controlled rather than artifact-free' and lists how real telemetry could degrade A2FV (Section 5).
  • domain assumption Non-oracle evasion transforms are bounded by schema-valid generation constraints; fully adaptive L3 with detector-score feedback is out of scope (Sections 3.1, 4.2).
    The robustness claims hold only for L0-L2 and the released non-oracle composition; the paper explicitly excludes L3.
  • standard math Standard statistics: cosine similarity, TF-IDF, NMI, V-measure, Hartigan's dip test, bootstrap percentiles.
    Used for scoring, clustering diagnostics, and CIs; no nonstandard mathematical machinery is invoked.

reviewed 2026-08-01 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents." pith.science (2026). https://pith.science/paper/TB44XD4U

@misc{pith2026260718826,
  author       = {Pith},
  title        = {Pith review of: Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TB44XD4U}},
  note         = {Machine review of arXiv:2607.18826}
}
Share X Bluesky LinkedIn Reddit HN
abstract

LLM-agent defenses are typically evaluated one session at a time. In deployment, however, attacks can be distributed across independent agents, teams, and runtimes, leaving each local guardrail with only a sparse fragment. We formalize cross-agent asynchronous campaign attribution: linking sessions from the same latent adversarial campaign without shared runtime state, test-time campaign labels, or attacker identity oracles. We introduce Asynchronous Attribution Fingerprint Vectors ($A^2FV$), a lightweight proxy-side reference protocol for scoring pairwise campaign similarity from proxy-observable tool-use, timing, and prompt residue. We also construct SCD-v1, a controlled persona-matched benchmark with benign traffic, isolated attacks, multi-session campaigns, matched non-oracle evasion, and leakage audits. On SCD-v1, $A^2FV$ achieves 0.82 pairwise AUC for campaign linking, while score-only adaptations of per-session detectors and chunked LLM judges remain near chance under the same task. The strongest fixed signal is carried by structural and stylometric residue, while timing is retained as a diagnostic channel for richer proxy traces. Crossed-style controls show that the signal is partly style-sensitive but not reducible to style alone. Static and dimension-aware non-oracle stress tests further show that pairwise separability persists under controlled evasion. These results establish cross-agent campaign attribution as a distinct evaluation layer for securing LLM agents in the wild.

Figures

Figures reproduced from arXiv: 2607.18826 by Jineok Kim, Minseung Kang, Myungsub Choi, Sangjin Park.

Figure 1
Figure 1. Figure 1: Cross-agent asynchronous campaign attribution. A single adversary distributes related injections across independent agents over time; local guardrails observe only isolated session-level evidence. A shared proxy running Asynchronous Attribution Fingerprint Vectors (A 2 FV) links sessions through calibrated structural and stylometric residue, while retaining temporal measurements as a diagnostic channel for… view at source ↗
Figure 2
Figure 2. Figure 2: Pairwise AUC summary for the headline campaign-linking result and selected same-metric checks. Native pairwise linkers are reported in Tables 2 and B. Dark blue marks primary SCD-v1, green fixed-weight generator and split controls, amber evasion stress checks, gray adapted baselines, and dashed red random linking. The headline A 2 FV is 0.30 AUC above the best adapted baseline; E10 is a Full 800 stress mir… view at source ↗
Figure 3
Figure 3. Figure 3: Residual-channel behavior on the matched-persona L0/L1/L2 triplet: static transforms weaken partitions more than pairwise separability. pendix DTap diagnostic is consistent with the structural￾residue story on a public trajectory corpus, but because its labels are path-derived campaign proxies, it is not attacker￾identity evidence. No-API telemetry-degradation diag￾nostics in Appendix D stress missing even… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

43 extracted references · 4 linked inside Pith

  1. [1]

    Seven Security Challenges That Must Be Solved in Cross-Domain Multi-Agent

    Ko, Ranjan and Jeong, Jaeho and Zheng, Sicheng and Xiao, Chaowei and Kim, Tae-Wan and Onizuka, Makoto and Shin, Won-Yong , journal =. Seven Security Challenges That Must Be Solved in Cross-Domain Multi-Agent

  2. [2]

    Securing the

    Errico, Herman and Ngiam, Jiquan and Sojan, Shanita , journal =. Securing the

  3. [3]

    2025 , note =

    Liu, Yupei and Jia, Yuqi and Jia, Jinyuan and Song, Dawn and Gong, Neil Zhenqiang , booktitle =. 2025 , note =

    2025

  4. [4]

    2025 , note =

    Jacob, Dennis and Alzahrani, Hend and Hu, Zhanhao and Alomair, Basel and Wagner, David , booktitle =. 2025 , note =

    2025

  5. [5]

    and Chen, Pin-Yu , booktitle =

    Hung, Kuo-Han and Ko, Ching-Yun and Rawat, Ambrish and Chung, I-Hsin and Hsu, Winston H. and Chen, Pin-Yu , booktitle =. Attention Tracker: Detecting Prompt Injection Attacks in. 2025 , note =

    2025

  6. [6]

    arXiv preprint arXiv:2503.18813 , year =

    Defeating Prompt Injections by Design , author =. arXiv preprint arXiv:2503.18813 , year =

    Pith/arXiv arXiv

  7. [7]

    Zhang, Tian and Xu, Yiwei and Wang, Juan and Guo, Keyan and Xu, Xiaoyang and Xiao, Bowen and Guan, Quanlong and Fan, Jinlin and Liu, Jiawei and Liu, Zhiquan and Hu, Hongxin , journal =

  8. [8]

    He, Yu and Zhu, Haozhe and Li, Yiming and Shao, Shuo and Yao, Hongwei and Liu, Zhihao and Qin, Zhan , journal =

  9. [9]

    Prompt Infection:

    Lee, Donghyun and Tiwari, Mo , journal =. Prompt Infection:

  10. [10]

    arXiv preprint arXiv:2603.04469 , year =

    Beyond Input Guardrails: Reconstructing Cross-Agent Semantic Flows for Execution-Aware Attack Detection , author =. arXiv preprint arXiv:2603.04469 , year =

    arXiv

  11. [11]

    Chen, Zhaorun and Xiang, Zhen and Xiao, Chaowei and Song, Dawn and Li, Bo , booktitle =

  12. [12]

    A Practical Memory Injection Attack (

    Dong, Shen and Xu, Shaochen and He, Pengfei and Li, Yige and Tang, Jiliang and Liu, Tianming and Liu, Hui and Xiang, Zhen , booktitle =. A Practical Memory Injection Attack (. 2025 , note =

    2025

  13. [13]

    arXiv preprint arXiv:2604.02623 , year =

    Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents , author =. arXiv preprint arXiv:2604.02623 , year =

    Pith/arXiv arXiv

  14. [14]

    arXiv preprint arXiv:2503.12188 , year =

    Multi-Agent Systems Execute Arbitrary Malicious Code , author =. arXiv preprint arXiv:2503.12188 , year =

    Pith/arXiv arXiv

  15. [15]

    Agents Under Siege: Breaking Pragmatic Multi-Agent

    Shahroz, Rana and Tan, Zhen and Yun, Sukwon and Fleming, Charles and Chen, Tianlong , booktitle =. Agents Under Siege: Breaking Pragmatic Multi-Agent. doi:10.18653/v1/2025.acl-long.476 , url =

    doi:10.18653/v1/2025.acl-long.476 2025

  16. [16]

    Hossain, S. M. Asif and Shayoni, Ruksat Khan and Ameen, Mohd Ruhul and Islam, Akif and Mridha, M. F. and Shin, Jungpil , journal =. A Multi-Agent

  17. [17]

    and Gosmar, Dario , journal =

    Gosmar, Diego and Dahl, Deborah A. and Gosmar, Dario , journal =. Prompt Injection Detection and Mitigation via

  18. [18]

    Zheng, Yusheng and Hu, Yanpeng and Yu, Tong and Quinn, Andi , journal =

  19. [19]

    2024 , doi =

    Saha, Aakanksha and Blasco, Jorge and Cavallaro, Lorenzo and Lindorfer, Martina , booktitle =. 2024 , doi =

    2024

  20. [20]

    2024 , note =

    Cheng, Zijun and Lv, Qiujian and Liang, Jinyuan and Wang, Yan and Sun, Degang and Pasquier, Thomas and Han, Xueyuan , booktitle =. 2024 , note =

    2024

  21. [21]

    2024 , note =

    Rehman, Mati Ur and Ahmadi, Hadi and Hassan, Wajih Ul , booktitle =. 2024 , note =

    2024

  22. [22]

    Wang, Su and Wang, Zhiliang and Zhou, Tao and Sun, Hongbin and Yin, Xia and Han, Dongqi and Zhang, Han and Shi, Xingang and Yang, Jiahai , journal =

  23. [23]

    2024 , note =

    Li, Shaofei and Dong, Feng and Xiao, Xusheng and Wang, Haoyu and Shao, Fei and Chen, Jiedong and Guo, Yao and Chen, Xiangqun and Li, Ding , booktitle =. 2024 , note =

    2024

  24. [24]

    Liu, Qi and Bao, Kaibin and Hassan, Wajih Ul and Hagenmeyer, Veit , journal =

  25. [25]

    and Shafiq, Zubair , booktitle =

    Venugopalan, Hari and Munir, Shaoor and Ahmed, Shuaib and Wang, Tangbaihe and King, Samuel T. and Shafiq, Zubair , booktitle =. 2025 , note =

    2025

  26. [26]

    Go, Wooyoung and Kim, Hyoungshick and Oh, Alice and Kim, Yongdae , booktitle =

  27. [27]

    Journal of the American Society for Information Science and Technology , volume =

    A Survey of Modern Authorship Attribution Methods , author =. Journal of the American Society for Information Science and Technology , volume =

  28. [28]

    The Annals of Statistics , volume =

    The Dip Test of Unimodality , author =. The Annals of Statistics , volume =

  29. [29]

    Journal of Open Source Software , volume =

    hdbscan: Hierarchical Density Based Clustering , author =. Journal of Open Source Software , volume =

  30. [30]

    Rosenberg, Andrew and Hirschberg, Julia , booktitle =

  31. [31]

    Advances in Neural Information Processing Systems (

    Debenedetti, Edoardo and Zhang, Jie and Balunovi. Advances in Neural Information Processing Systems (

  32. [32]

    Liu, Xiao and others , booktitle =

  33. [33]

    Inan, Hakan and Upasani, Kartikeya and Chi, Jianfeng and Rungta, Rashi and Iyer, Krithika and Mao, Yuning and Tontchev, Michael and Hu, Qing and Fuller, Brian and Testuggine, Davide and Khabsa, Madian , journal =

  34. [34]

    arXiv preprint arXiv:2505.18333 , year =

    A Critical Evaluation of Defenses against Prompt Injection Attacks , author =. arXiv preprint arXiv:2505.18333 , year =

    Pith/arXiv arXiv

  35. [35]

    Beyond the Prompt: Log-Based Threat Detection and Attribution for Multi-Agent

    Rabieinejad, Elnaz and Zarrinkalam, Fattane and Dehghantanha, Ali , journal =. Beyond the Prompt: Log-Based Threat Detection and Attribution for Multi-Agent. doi:10.1016/j.ipm.2026.104768 , year =

    arXiv 2026

  36. [36]

    Cross-Session Threats in

    Azarafrooz, Ari , journal =. Cross-Session Threats in

  37. [37]

    2026 , note =

    Gill, Waris and Isak, Natalie and Dressman, Matthew , booktitle =. 2026 , note =

    2026

  38. [38]

    Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting

    Schroeder de Witt, Christian and others , journal =. Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting

  39. [39]

    Dong, Liming and Lu, Qinghua and Zhu, Liming , journal =

  40. [40]

    2025 , url =

    Evtimov, Ivan and Zharmagambetov, Arman and Grattafiori, Aaron and Guo, Chuan and Chaudhuri, Kamalika , journal =. 2025 , url =

    2025

  41. [41]

    2025 , url =

    Li, Hao and Liu, Xiaogeng and Chiu, Hung-Chun and Li, Dianqi and Zhang, Ning and Xiao, Chaowei , booktitle =. 2025 , url =

    2025

  42. [42]

    2025 , url =

    Luo, Hanjun and Dai, Shenyu and Ni, Chiming and Li, Xinfeng and Zhang, Guibin and Wang, Kun and Liu, Tongliang and Salam, Hanan , booktitle =. 2025 , url =

    2025

  43. [43]

    Proceedings of the 5th International Conference on Natural Language Processing for Digital Humanities , pages =

    Masks and Mimicry: Strategic Obfuscation and Impersonation Attacks on Authorship Verification , author =. Proceedings of the 5th International Conference on Natural Language Processing for Digital Humanities , pages =

This paper was first reviewed by deepseek-v4-flash on August 1, 2026.