When an indirect prompt injection succeeds against an LLM agent, the compromise appears in the agent's tool‑call trajectory: a benign prefix, a poisoned observation, and a suffix of actions that serve the attacker. An operator needs three facts: where the attack entered, which steps were corrupted, and whether the apparent poison was resisted. Existing solutions either output a whole‑trace verdict or a single unsafe index. DriftNet addresses all three in a single forward pass. It is a dual‑head trajectory Transformer: the first head classifies the entire trajectory as compromised or safe, the second head labels each step as benign, injection point, hijacked, or failed injection. To our knowledge this is the first supervised detector that produces such joint output. Each step is embedded by a frozen sentence encoder together with four identity‑free world features; the trunk contains fewer than two million parameters and is trained with a class‑weighted joint loss over both heads, requiring no access to the agent's internal model. Evaluation on the task‑disjoint split of the AgentDrift benchmark (12,536 trajectories, 71,024 labeled steps) involved a 20‑configuration hyper‑parameter sweep that bounded sensitivity to 0.011 F1, and the test set was evaluated exactly once. DriftNet achieves trajectory‑level F1 of 0.983, recovers the exact injection point in 98.7 % of attacked trajectories, attains hijacked‑span IoU of 0.979, produces zero flags on 218 resisted attacks, and only 2.9 % false flags on hard negatives. A surface baseline retrained on the same split recovers 11.1 % of partial hijacks and 17.1 % of delayed executions; DriftNet reaches 98.6 % and 93.2 % respectively while lowering every false‑alarm rate. Manual inspection of the remaining 26 errors shows most misses stem from injection observations that contain no legible instruction, and we also report the benchmark’s measured world‑identity regularity alongside the results.
Review