Research
Attention-based Classification for Indirect Prompt Injection
Publication date unknown · Discovered arxiv.org
Page published
Publication date unknown · First observed: 24 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
Attention Tracker's reported cross-domain failures show why defenders should validate prompt-injection detectors against realistic agent workflows and tool outputs rather than assume benchmark performance generalizes.
Attention-based Classification for Indirect Prompt Injection evaluates Attention Tracker on AgentDojo and reports near-chance detection across most model families, finding that long, structured tool outputs undermine the detector's assumptions. The proposed AttnDA classifier improves detection across agentic and tool-integrated benchmarks, but transfer to AgentDojo remains difficult and reliable deployment requires training data from the target domain.