AgentTracer reconstructs indirect prompt-injection paths from agent tool histories

AgentTracer compares a user-authorized intent graph with tool and action histories, then traces abnormal external effects backward toward an untrusted input. The method answers a forensic question: which earlier piece of content contributed to a tool operation the user did not authorize? The paper evaluates records selected from AgentDyn and InjecAgent, including multi-step interference rather than only a single malicious document.

The authors report an average 97.34 percent detection rate, 94.17 percent injection-point localization and 90.25 percent path coverage across two 300-trace samples. The paper also explains failure modes where model-extracted graph relations are wrong or aliases resolve to an incorrect target. An incomplete agent trace or omitted tool can break attribution even if detection rates are high in replay.

The false-positive denominator deserves separate treatment. In a benign-activity check, the researchers manually exclude 25 genuinely deviating edges before reporting 13 incorrectly marked edges among 369 legitimate edges, or 3.52 percent. That figure is per evaluated graph edge, not the percentage of users or incidents wrongly accused. The model constructs intent relationships from logs and a tool-operation knowledge base; therefore missing log spans, incorrect aliases or a wrongly specified user authorization can change the reconstructed path. It is useful as post-event attribution, not as a substitute for a runtime authorization gate.