Oregon State University

Amelia Kawasaki and Stefan Lee evaluate Attention Tracker and propose AttnDA, a learned alternative using attention-head features. Across five tested open models, synthetic-trained Attention Tracker averages 0.97 AUROC on deepset but 0.57 on the paper’s AgentDojo subset. Domain-matched training helps AttnDA; these are detection results rather than evidence of preventing harmful agent actions.