Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents

This paper formalizes cross-agent asynchronous campaign attribution: determining whether sparse sessions across independent LLM agents belong to the same adversarial campaign without shared runtime state, campaign labels, or attacker identity oracles. It introduces Asynchronous Attribution Fingerprint Vectors (A²FV), a lightweight proxy-side protocol using observable tool-use patterns, timing, and prompt residue. On the controlled SCD-v1 benchmark, A²FV reaches 0.82 pairwise AUC, while score-only adaptations of per-session detectors and chunked LLM judges remain near chance. Structural and stylometric residue provide the strongest signals; timing is retained mainly as a diagnostic channel.