{"data":{"id":"cd7f314c-1690-4651-a817-ad795746d7f8","title":"Attention-based Classification for Indirect Prompt Injection","summary":"This paper evaluates Attention Tracker, a white-box detector for indirect prompt injection that monitors how a model's attention splits between user task tokens and data tokens, on the AgentDojo agentic benchmark. The authors find the dataset-agnostic claim fails there, with long structured tool outputs producing near-chance detection across most model families. They propose AttnDA, which replaces the scalar focus-score threshold with a Fisher Linear Discriminant Analysis classifier over the per-head focus score vector, and report better detection across four benchmarks, though transfer to AgentDojo remains hard.","solution":"N/A -- no mitigation discussed in source.","labels":["security","research"],"sourceUrl":"https://arxiv.org/abs/2610.28988v1","publishedAt":"2026-10-20T23:31:19.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"info","attackType":["prompt_injection"],"issueType":"research","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":[],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-20T23:31:19.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":"preprint","atlasIds":["AML.T0051"]}}