Causal Detection of Multi-Step LLM Agent Attacks

Multi-step prompt injection attacks on LLM agents present a fundamental detection challenge because malicious intent emerges only after the workflow completes, while individual actions remain legitimate in isolation. Existing defenses, including input sanitization, output validation, and instruction hierarchy, operate on individual actions or content patterns and cannot capture this sequential structure. We present CausalTrace, a detection system that reframes prompt-injection defense as causal inference. It constructs Structural Causal Models from agent trajectories with typed edges capturing data dependency, trust transfer, and state enablement, then applies Pearl’s do-calculus to answer a counterfactual question, namely, whether the harmful outcome would have occurred if the injection had been blocked. This formalization enables a principled distinction between attacks that depend on injections and benign workflows that share surface-level features. Evaluation on a dataset spanning crowdsourced traces, LLM agent benchmarks, and semi-real and real scenarios demonstrates strong detection performance, outperforming content-based baselines while requiring minimal LLM inference cost; bidirectional slicing recovers complete attack chains with high edge recall, providing interpretable explanations that trace exploitation to its causal origins.

AI assistants are starting to handle real tasks for people, such as browsing websites, reading emails, and managing files. That also makes them tempting targets. An attacker can hide instructions inside a webpage, email, or document, and the assistant may follow those instructions without realizing they were not part of the user’s request. In the worst case, this could lead to leaked private data, stolen credentials, or unwanted actions. Most defenses try to catch these attacks by looking for suspicious words or phrases. That is fragile because attackers can simply rewrite the hidden instruction. Our approach looks at the sequence of actions instead. We build a cause and effect map of what the assistant saw, decided, and did. Normal tasks usually stay connected to what the user asked for, while attacks create a trail where outside content pushes the assistant toward a sensitive action. This helps detect multi-step attacks and also explains how the attack happened.