Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents

LLM agents deployed in the wild increasingly operate across independent tools, teams, and runtimes, but prompt-injection defenses are still typically evaluated within a single prompt or session. This leaves agent security evaluations blind to adversaries that distribute a campaign across independent agents and over time, so that each local defense sees only a sparse fragment. We formalize cross-agent asynchronous campaign attribution: linking sessions that originate from the same latent adversarial campaign without shared runtime state, test-time campaign labels, or attacker identity oracles. We introduce Asynchronous Attribution Fingerprint Vectors (A2FV), a lightweight proxy-side reference protocol that represents each session with structural, temporal, and stylometric fingerprints and links sessions through a fixed pairwise similarity score. For reproducible benchmarking, we construct SCD-v1, a controlled persona-matched benchmark containing benign traffic, isolated attacks, and multi-session campaigns under matched non-oracle evasion, with validation and leakage audits. A2FV achieves 0.82 pairwise AUC for campaign linking, while score-only adaptations of per-session detectors and chunked LLM judges remain near chance. The pairwise signal persists under static evasion and a separate dimension-aware non-oracle stress test. These results suggest that securing agents in the wild requires campaign-level correlation mechanisms and evaluation protocols, rather than only stronger per-session classifiers.