{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/attention-tracker-agentic-transfer-attnda-2026/",
 "asOf": "2026-10-30",
 "id": "attention-tracker-agentic-transfer-attnda-2026",
 "date": "2026-10-20",
 "datePrecision": "day",
 "title": "Attention-based injection detection transfers poorly to an AgentDojo subset in a cross-dataset study",
 "lane": "defense",
 "kind": "paper",
 "summary": "Amelia Kawasaki and Stefan Lee evaluate Attention Tracker and propose AttnDA, a learned alternative using attention-head features. Across five tested open models, synthetic-trained Attention Tracker averages 0.97 AUROC on deepset but 0.57 on the paper’s AgentDojo subset. Domain-matched training helps AttnDA; these are detection results rather than evidence of preventing harmful agent actions.",
 "whyItMatters": "It directly tests whether a detector’s single-turn benchmark performance transfers to structured agent tool outputs.",
 "actors": [
  "hiddenlayer",
  "oregon-state-university"
 ],
 "topics": [
  "prompt-injection",
  "eval-validity",
  "monitoring-and-control"
 ],
 "atlas": [
  "untrusted-content",
  "monitor"
 ],
 "artifacts": [
  "llama",
  "agentdojo"
 ],
 "sources": [
  {
   "url": "https://arxiv.org/abs/2610.28988",
   "publisher": "Amelia Kawasaki and Stefan Lee (arXiv)",
   "title": "Attention-based Classification for Indirect Prompt Injection",
   "date": "2026-10-20",
   "type": "primary",
   "accessed": "2026-10-24"
  }
 ],
 "keyFacts": [
  {
   "fact": "The cited arXiv version 1 is dated 2026-10-20. The AgentDojo subset uses the banking and Slack suites, with 25 and 26 samples respectively; results do not cover the full AgentDojo benchmark.",
   "locator": "Title page; Section 5, Datasets"
  },
  {
   "fact": "Table 1 reports average AUROC of 0.57 for Attention Tracker and 0.62 for AttnDA on this AgentDojo subset when trained on synthetic data, versus 0.97 and 0.95 on deepset. AUROC is not accuracy or attack-prevention rate.",
   "locator": "Table 1; Section 5, Metrics"
  },
  {
   "fact": "Tests cover Llama-3-8B-Instruct, Qwen2-1.5B, Gemma 2 9B, Phi-3 mini and Mistral 7B. They use attention access, evaluate injected tool-result detection, and omit a system prompt following the original method’s procedure.",
   "locator": "Section 5, Agentic Evaluation Procedure; Models"
  },
  {
   "fact": "The paper notes small-sample uncertainty and poor transfer into AgentDojo. Both attention methods materialize attention maps: at 2,048 tokens the reported memory footprint rises from 1.7 GB baseline to 9.6 GB, despite AttnDA adding no measured cost relative to Attention Tracker.",
   "locator": "Sections 6.8 and 7.2"
  }
 ],
 "significance": 3,
 "fideQuestions": [
  "FID-074",
  "FID-075"
 ],
 "methods": [
  "injection-classifiers"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-10-24",
 "revisions": []
}