A method and system for tracing inter-agent indirect prompt injection attacks

Abstract

The present application relates to the technical field of agent security, in particular to a method and system for tracing an indirect prompt injection attack between agents. The method comprises: obtaining agent execution logs and target abnormal event information; locating a target log segment based on the target abnormal event information; identifying context data entities and intention driving relationships between the entities from the target log segment, mapping the intention driving relationships with real tool execution events, and constructing an intention driving entity graph; determining an allowed action space according to a user request, aligning and evaluating the intention driving relationships with the allowed action space, and identifying abnormal relationships; and starting from a target entity corresponding to the target abnormal event, tracing upstream sources along the abnormal relationships in a reverse direction, and locating an injection point. The present application realizes accurate recovery of an attack chain and precise positioning of an injection point through intention driving relationship modeling and progressive reverse tracing, and improves the reviewability of tracing results and the coverage capability in cross-task propagation scenarios.

Description

Technical Field

[0001] This invention relates to the field of intelligent agent security technology, and in particular to a method and system for tracing the source of indirect hint injection attacks against intelligent agents. Background Technology

[0002] With the rapid development of large language model integration technology, large language model agents are widely used in fields such as automated office work, code development, and data analysis. The security boundary of the agent has expanded from "user input" to the entire runtime context. Indirect hint injection attacks do not require direct modification of user input; attackers only need to hide malicious instructions in web pages, emails, shared documents, bills, calendar events, or database records accessed by the agent. When the agent completes normal tasks, it reads these resources and may mistake the content for user requests, system rules, or necessary prerequisites, ultimately executing actions not authorized by the user. This stealth and lag makes it difficult for security auditors to locate the source of the attack from massive execution logs through manual review alone after an abnormal event occurs in the agent; automated log analysis methods are needed for tracing the source.

[0003] Currently, research on agent log analysis and attribution mainly adopts two approaches: the first is based on parameter or data dependencies, tracing the external content or contextual fragments from which tool call parameters originate; the second directly utilizes large language models or trained models to perform overall analysis of the complete log. The first approach traces data sources by analyzing parameter passing relationships between tool calls, marking external content as data sources and tracing its propagation path in the tool call chain. However, the essence of indirect hint injection attacks is intent-driven rather than data-transferring; malicious behavior using legitimate parameters will be misjudged as normal, while normal behavior using external data as parameters will be misjudged as malicious, leading to false positives and false negatives. The second approach uses large language models as referees, directly performing semantic analysis on the complete execution log to determine whether the agent's behavior is abnormal. This type of method possesses some semantic understanding capabilities but lacks stable, verifiable intermediate representations, making it difficult to accurately identify attack chains and injection points. It also incurs significant cost and performance overhead, resulting in weak practical usability. Furthermore, injected content may first be written to memory, files, or configurations, and then trigger abnormal behavior in another task. Fixed time windows or single full analysis may truncate historical correlations and increase the amount of irrelevant log processing, making it difficult to balance complete tracing with computational overhead. Summary of the Invention

[0004] In view of this, embodiments of the present invention propose a source tracing method and system for indirect prompting injection attacks on intelligent agents, aiming to achieve accurate recovery of the attack chain and precise location of the injection point through intent-driven relationship modeling and progressive reverse backtracking.

[0005] On one hand, embodiments of the present invention provide a method for tracing the source of indirect hint injection attacks against intelligent agents, the method comprising the following steps: Obtain the agent's execution log and target exception event information; Based on the target abnormal event information, locate the target log segment from the execution log; Identify contextual data entities and intent-driven relationships between these entities from the target log segment, and map these intent-driven relationships to real tool execution events to construct an intent-driven entity graph; Based on the user request, the allowed behavior space is determined, and the intent-driven relationships in the intent-driven entity graph are aligned and evaluated with the allowed behavior space to identify abnormal relationships that deviate from the user request. Starting from the target entity corresponding to the target anomaly event, trace the upstream source in reverse along the anomaly relationship to locate the injection point.

[0006] Optionally, locating the target log segment from the execution log based on the target abnormal event information includes: Analyze the abnormal event information of the target to extract the target entity, target operation, and auxiliary clues; Based on the target entity, the target operation, and the auxiliary clues, retrieve matching target log lines in the execution log; Starting from the user request to which the target log line belongs, extract the continuous log segments from that user request to the next user request as the target log segment.

[0007] Optionally, the step of identifying contextual data entities and intent-driven relationships between the entities from the target log segment, and mapping the intent-driven relationships to real tool execution events to construct an intent-driven entity graph, includes: Identify the contextual data entities that are perceived, generated, or affected from the valid tool records of the target log segment as nodes; Analyze the inference log in the target log segment to identify the intention-driven relationship that prompted the agent to form an operational intention; Semantically associate the intent-driven relationships with the actual tool execution events that occur in the tool logs, and establish intent-driven edges between the source entity and the target entity where the association is established, carried by the actual tool execution events, to obtain an intent-driven entity graph.

[0008] Optionally, determining the allowed behavior space based on the user request includes: Parse the explicit tasks and authorized object scope in the user request; By combining the relevant knowledge base, the high-level operation categories, necessary prerequisite behaviors, authorization boundaries and execution constraints corresponding to the explicit tasks are completed, and the expected execution tree is constructed as the allowed behavior space.

[0009] Optionally, the step of aligning and evaluating the intent-driven relationships in the intent-driven entity graph with the allowed behavior space to identify anomalous relationships deviating from the user request includes: For each intent-driven relationship, select the semantically most relevant reference behavior from the allowed behavior space; The intention-driven relationship and the reference behavior are aligned and evaluated from the dimensions of action semantics, operation goals and execution constraints to obtain an intention alignment score, and it is determined whether the intention alignment score meets the preset anomaly judgment conditions. If the intent alignment score meets the preset anomaly determination condition, then the intent-driven relationship is marked as an anomaly relationship.

[0010] Optionally, the step of aligning the intent-driven relationship with the reference behavior from the dimensions of action semantics, operation target, and execution constraints to obtain an intent alignment score, and determining whether the intent alignment score meets preset anomaly judgment conditions, includes: The intent alignment score is calculated using a weighted combination function based on the action semantic alignment score, the operation target alignment score, and the execution constraint alignment score. The intention alignment score is compared with a preset anomaly determination threshold. If the intention alignment score is lower than the preset anomaly determination threshold, the preset anomaly determination condition is met.

[0011] Optionally, the step of tracing the upstream source from the target entity corresponding to the target anomaly event and locating the injection point along the anomaly relationship includes: Starting from the target entity, continue to trace backward along the incoming edges marked as abnormal relationships; If the traced upstream entity corresponds to an external resource that enters the agent's context from the outside, then the external resource is identified as the injection point; If the upstream entity being tracked is a persistent entity that can persist across tasks, then retrieve the historical update events of the persistent entity, expand the new target log segment, and repeat the mapping, identification, and backtracking steps until the injection point is located.

[0012] Optionally, after locating the injection point, the method further includes: Output the attack chain from the injection point to the target anomalous event, the attack chain including the sequence of anomalous relationships in the intent-driven entity graph and the corresponding log positions.

[0013] On the other hand, embodiments of the present invention provide a source tracing system for indirect hint injection attacks against intelligent agents, comprising: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs the method described above.

[0014] On the other hand, embodiments of the present invention provide a computer-readable storage medium storing a processor-executable program, which, when executed by a processor, is used to perform the above-described method.

[0015] The embodiments of the present invention have the following beneficial effects: This invention acquires agent execution logs and target anomaly event information, and locates the target log segment from the execution log based on the target anomaly event information. This allows source tracing analysis to focus on the local execution context related to the anomaly event, avoiding the computational overhead and noise interference caused by full log analysis. By identifying contextual data entities and intent-driven relationships between these entities from the target log segment, and mapping these intent-driven relationships to real tool execution events to construct an intent-driven entity graph, the attack path can be modeled based on semantic-driven relationships rather than simple data transmission relationships. This solves the problem of parameter dependency tracking propagating when malicious content is not passed as subsequent tool parameters. The problem of chain interruption is addressed by determining the allowed behavior space based on user requests and aligning the intent-driven relationships in the intent-driven entity graph with the allowed behavior space to identify abnormal relationships. This provides a stable, verifiable intermediate representation and clear quantitative basis for anomaly determination, effectively reducing the volatility and uninterpretability of subjective semantic analysis. By tracing the upstream source from the target entity corresponding to the target anomaly event along the abnormal relationship to locate the injection point, the tracing process can progressively backtrack from the target anomaly event, only expanding the relevant historical log range when encountering persistent entities. This significantly improves tracing efficiency while ensuring the complete recovery of the cross-task attack chain. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1This is a flowchart illustrating the steps of a method for tracing the source of indirect hint injection attacks against intelligent agents, provided by an embodiment of the present invention. Figure 2 This is a schematic diagram of the overall framework of a source tracing method for indirect hint injection attacks against intelligent agents provided by an embodiment of the present invention; Figure 3 yes Figure 1 A flowchart illustrating step S200; Figure 4 yes Figure 1 A flowchart illustrating step S300; Figure 5 yes Figure 1 A flowchart illustrating step S400; Figure 6 yes Figure 1 A flowchart of step S500; Figure 7 This is a block diagram of a source tracing system for indirect hint injection attacks against intelligent agents, provided in an embodiment of this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0019] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein is for the purpose of describing embodiments of the invention only and is not intended to limit the invention.

[0020] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a full understanding of embodiments of the invention. However, those skilled in the art will recognize that the technical solutions of the invention can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of the invention.

[0021] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0022] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0023] The technical terms involved in this invention are defined as follows: Large Language Model Intelligent Agent: Refers to an automated system with a large language model as its core decision engine, possessing autonomous planning, memory management, and the ability to invoke external tools. Based on user natural language instructions, the intelligent agent autonomously selects and executes a series of external tools to complete complex tasks.

[0024] Indirect hint injection attack: This refers to an attacker hiding malicious instructions in external resources that an agent would normally access during a task. After reading the malicious content, the agent may mistake it for a user instruction and execute unauthorized behavior.

[0025] Execution log: refers to the complete record generated during the execution of a task by an intelligent agent, including request information, semantic decision information, and tool execution records generated during the operation of the intelligent agent.

[0026] Intent-driven entity graph: This refers to representing the data entities in the target log segment and the intent-driven relationships between them as a directed graph. In the graph, nodes represent context data entities perceived by the agent, and edges represent intent-driven relationships between entities carried by real tool events.

[0027] Intent alignment score: refers to the result of a comprehensive quantification of the consistency between the intent-driven relationship and the user's requested permitted behavior space, based on action semantics, target scope, execution constraints, and factors related to user authorization.

[0028] Injection point: refers to the location where a malicious instruction initially enters the agent's context, corresponding to the source log line where the external resource containing the malicious instruction is read.

[0029] In related technologies, the source tracing analysis of indirect suggestion injection attacks on intelligent agents mainly adopts parameter- or data-dependent tracing methods, as well as semantic determination methods that directly use large language models or training models to perform overall analysis of complete logs. However, parameter dependency tracing cannot represent semantically driven causal relationships. When malicious content only changes the agent's decision intention without being passed as subsequent tool parameters, the propagation chain will be broken. Large-scale model semantic analysis lacks stable and verifiable intermediate representations, which are prone to fluctuations with log length and expression methods. One-time full log analysis is difficult to cover cross-task persistent propagation scenarios, which may both truncate historical associations and increase the amount of irrelevant log processing.

[0030] To overcome the technical problems in related technologies, this invention proposes a source tracing method and system for indirect hint injection attacks on intelligent agents. Through a collaborative mechanism of target log segment localization, intent-driven entity graph construction, abnormal edge identification of intent drift, and target-driven attack chain backtracking, it achieves accurate source tracing and injection point localization of indirect hint injection attacks, effectively improving the accuracy of attack path recovery and the completeness of cross-task source tracing.

[0031] like Figure 1 As shown, Figure 1 A method for tracing the source of indirect hint injection attacks on intelligent agents, provided in this embodiment of the invention, includes the following steps: S100, obtain the agent's execution log and target abnormal event information; S200, based on the target abnormal event information, locate the target log segment from the execution log; S300, Identify context data entities and intent-driven relationships between the entities from the target log segment, and map the intent-driven relationships to real tool execution events to construct an intent-driven entity graph; S400, determine the allowed behavior space based on the user request, align and evaluate the intent-driven relationships in the intent-driven entity graph with the allowed behavior space, and identify abnormal relationships that deviate from the user request; S500: Starting from the target entity corresponding to the target abnormal event, trace the upstream source in reverse along the abnormal relationship to locate the injection point.

[0032] The proposed method and system for tracing the source of agent-based indirect hint injection attacks utilizes the following: By acquiring agent execution logs and target anomalous event information and locating the target log segment, the source tracing analysis can focus on the local execution context related to the anomalous event, avoiding the computational overhead and noise interference caused by full log analysis. By identifying contextual data entities and intent-driven relationships from the target log segment and mapping them to real tool execution events to construct an intent-driven entity graph, the attack path can be modeled based on semantic-driven relationships rather than simple data transmission relationships. By determining the allowed behavior space based on user requests and performing alignment evaluation to identify anomalous relationships, the anomaly determination has a stable, verifiable intermediate representation and clear quantitative basis. By tracing back along the anomalous relationship from the target entity corresponding to the target anomalous event to locate the injection point, the source tracing process can perform progressive backtracking starting from the target anomalous event, significantly improving source tracing efficiency while ensuring the complete recovery of the cross-task attack chain.

[0033] The following is a detailed description of the source tracing method for indirect hint injection attacks against intelligent agents proposed in this invention: like Figure 2 As shown, Figure 2 This invention provides a general framework diagram for tracing the source of indirect hint injection attacks by intelligent agents. The overall process includes the following four core steps: target log segment localization, which determines the relevant log range around the target anomalous event based on keyword matching; intent-driven entity graph construction, which restores the intent-driven relationship between context entities by combining the semantic decision information of the intelligent agent with the execution records of real tools; anomalous edge identification of intent drift, which aligns the relationship with the allowed behavior space determined according to the user request to identify the anomalous relationship in which intent drift occurs; and target-driven attack chain backtracking, which constructs a subgraph progressively from the target anomalous event along the anomalous relationship to backtrack to the injection source.

[0034] In this embodiment, the agent's execution log and target anomaly event information are first acquired. The agent generates a complete execution log during task execution, including request information, semantic decision information, and tool execution records. Target anomaly events are discovered by a security monitoring system or manual audit, and are typically described in natural language, including the affected object, operational semantics, and related clues.

[0035] refer to Figure 3 In some embodiments, locating the target log segment from the execution log based on the target abnormal event information includes: S210, parse the target abnormal event information and extract the target entity, target operation and auxiliary clues; S220, based on the target entity, the target operation, and the auxiliary clues, retrieve a matching target log line in the execution log; S230, taking the user request to which the target log line belongs as the starting point, extract the continuous log segment from the user request to the next user request as the target log segment.

[0036] Specifically, step S210 extracts auxiliary clues such as the target entity, target operation, and parameter fragments from the description of the abnormal event as matching information for the target log line. Step S220, based on the information in the structured search plan, retrieves matching tool execution records in the log set. The target log line must reflect that a "target operation" was performed on the "target entity," and is confirmed by combining the tool name, tool parameters, and keywords in the returned content. Step S230, after determining the target log line, locates the most recent user request and extracts continuous log fragments from that user request to the next user request, as the initial target log segment for graph construction.

[0037] In this embodiment, by locating the target log segment based on the target abnormal event information, the source tracing analysis can focus on the local execution context related to the abnormal event, avoiding the computational overhead and noise interference caused by full log analysis. This effectively solves the problem of excessive log analysis processing volume and difficulty in balancing complete source tracing and computational efficiency in the prior art.

[0038] refer to Figure 4 In some embodiments, the step of identifying contextual data entities and intent-driven relationships between the entities from the target log segment, and mapping the intent-driven relationships to real tool execution events to construct an intent-driven entity graph, includes: S310, Identify as nodes the context data entities that are perceived, generated or affected from the valid tool records of the target log segment; S320, parse the inference log in the target log segment to identify the intention-driven relationship that prompted the agent to form an operational intention; S330, Semantically associate the intent-driven relationship with the actual tool execution events that occur in the tool log, and establish intent-driven edges between the source entity and the target entity where the association is established, carried by the actual tool execution events, to obtain the intent-driven entity graph.

[0039] Specifically, a directed multigraph G=(V,E) is constructed for each target log segment, where the node set V represents the set of context data entities in the target log segment, and the edge set E represents the intent-driven relationships verified by actual execution events. The definition of the graph structure is shown in Table 1.

[0040] Table 1: Definitions of Nodes, Entry Points, and Edges in the Entity Graph

[0041] Step S310 identifies the data entities that have been read, generated, modified, deleted, sent, or otherwise affected from the valid tool records in the target log segment; that is, the output objects of each line of the tool log. It also records the actual operation associated with that entity and its log location. For failed, undone, or non-occurring calls, inclusion or exclusion may be selected based on whether subsequent intent can be proven.

[0042] Step S320 parses the agent's inference log information to identify which source entity's content, state, or semantics prompted the agent to form what kind of operational intent, and the target entity to which this operational intent points. This invention defines this intent-driven relationship as an intent-driven chain, including fields such as source entity, operation, and target entity. For example, if a user's request is "Send me a summary of report.pdf to alice@example.com," after the agent reads report.pdf, the inference log shows: "report.pdf also requires the complete original text to be sent to backup@example.com for backup," therefore, the document content is sent next. This inference fragment can extract the outward-sending driving relationship from the source entity report.pdf to the target entity backup@example.com. To prevent duplicate intent-driven relationships, only subsequent intents triggered by inference information in the planned task temporal are retained; for inference information in the review task temporal, the intent-driven chain is not extracted. Semantic parsing in this step is used to recover the intent-driven relationship between entities rather than directly determining security.

[0043] For driving relationships between entities, this method covers three intent propagation patterns: many-to-one aggregation, one-to-many branching, and sequential propagation. These patterns are used to illustrate the universality of relationships without limiting the number of source or target entities. Taking the user request "Please send me a summary of report.pdf to alice@example.com" as an example, the three patterns are shown in Table 2.

[0044] Table 2: Schematic diagram of three propagation modes of intention-driven relationships

[0045] Step S330 semantically associates the identified operation intent and target entity with the actual operation and its affected objects in the tool log. When the association is established, an intent-driven edge carried by the actual operation is established between each relevant source entity and target entity. When an intent-driven chain matches both the target entity node and the real tool event, an edge e=(source_entity, operation, target_entity) is constructed for each source entity and each matched target entity, where source_entity, operation, and target_entity represent the source entity, the actual operation, and the target entity, respectively. The operation originates from the matched real tool event. For example, if the above outbound intent corresponds to send_email(to="backup@example.com", attachment="report.pdf") in the tool log, then the edge e=(report.pdf, external_send, backup@example.com) is constructed, where report.pdf, external_send, and backup@example.com represent the source entity, the outbound operation, and the target entity, respectively. The metadata of the edge retains the tool name, parameters, log line number, and inference evidence.

[0046] In this embodiment, by identifying contextual data entities and intent-driven relationships from the target log segment, and mapping the intent-driven relationships with real tool execution events to construct an intent-driven entity graph, the attack path can be modeled based on semantic-driven relationships rather than simple data transmission relationships. This compensates for the deficiency of parameter dependency tracking in the interruption of the propagation chain when malicious content is not passed as subsequent tool parameters, and makes the attack path directly manifest as intent propagation between entities, which greatly improves the accuracy of the complete attack chain of indirect hint injection attacks and the identification of injection points.

[0047] refer to Figure 5 In some embodiments, determining the allowed behavior space based on the user request, aligning the intent-driven relationships in the intent-driven entity graph with the allowed behavior space, and identifying anomalous relationships deviating from the user request includes: S410, parse the explicit task and authorized object scope in the user request; S420, Combining the operation-related knowledge base, complete the high-level operation categories, necessary prerequisite behaviors, authorization boundaries and execution constraints corresponding to the explicit task, and construct the expected execution tree as the allowed behavior space; S430, for each intent-driven relationship, select the semantically most relevant reference behavior in the allowed behavior space; S440, from the dimensions of action semantics, operation target and execution constraint, the intention-driven relationship and the reference behavior are aligned and evaluated to obtain the intention alignment score, and it is determined whether the intention alignment score meets the preset abnormal judgment condition. S450, if the intent alignment score meets the preset anomaly determination condition, then the intent-driven relationship is marked as an anomaly relationship.

[0048] Specifically, steps S410 and S420 determine the reasonable behavior space corresponding to the user request. They parse the user's explicit task, implicit necessary steps, authorized object scope, and execution constraints, and combine this with operation-related knowledge to complete the behaviors typically required or allowed to complete the task, forming an expected execution tree to align with the user request. First, the specific calls to different tools are normalized to comparable operational semantics based on their behavioral effects, such as information retrieval, content processing, state changes, external transmission, or permission-related behaviors. High-level operation categories can be merged, split, or expanded according to the application scenario.

[0049] To construct a reasonable behavior space corresponding to user requests, five knowledge bases are introduced: an operation semantic knowledge base (recording the semantic boundaries of each type of high-level operation), a precondition knowledge base (recording the preconditions that each type of task may require), an authorization boundary knowledge base (recording the authorization requirements and allowed scope of each type of operation), an error recovery knowledge base (recording the allowed and prohibited recovery methods when each type of operation fails or has missing parameters), and a constraint checking knowledge base (recording the goals, parameters, conditions, dependencies, and confirmation checkpoints of each type of operation). Based on the covered high-level operations, the knowledge bases are retrieved on demand, and the expected execution tree is instantiated through knowledge augmentation techniques. This process preserves the boundaries of explicit user authorization while also allowing intermediate behaviors necessary to complete the task and conforming to constraints.

[0050] Steps S430 to S450 perform intent alignment scoring on intent-driven relationships in the entity graph based on the expected execution tree. For each intent-driven relationship that has been verified by actual execution, the most semantically relevant task or permitted behavior is selected as a reference in the expected execution representation. During matching, the candidate range can be determined first based on the operation semantics, and then the reference item can be determined by combining the target entity, parameters, and other constraints. After matching the corresponding subtask on the expected execution tree, the user alignment of the intent-driven chain is scored from three dimensions: action semantics, operation target, and parameter constraints. It is determined whether this intent-driven relationship belongs to a user task or a reasonable prerequisite behavior, whether the target entity is within the authorized scope, and whether the parameters and execution conditions meet the task constraints. Each dimension can be represented by continuous scores, discrete levels, rule results, or model outputs, and the alignment score is obtained through a configurable combination function.

[0051] The method for calculating the alignment of intent in this invention is as follows: ; in, and The weights are configurable and can satisfy normalization constraints; , , , These represent the action semantic alignment score, operation target alignment score, execution constraint alignment score, and intent alignment score, respectively. The anomaly detection threshold is denoted as τ. If the final intent alignment score is below the threshold, the relationship is considered an anomaly-driven relationship, and all corresponding mapped intent-driven edges are deemed anomalous. The weights, thresholds, and combinations can be adjusted based on log type, business risks, verification samples, or operational feedback to achieve appropriate tracing results in different application scenarios.

[0052] In this embodiment, by determining the allowed behavior space based on user requests and performing multi-dimensional alignment evaluation of intent-driven relationships, the anomaly determination uses the user authorization boundary as a unified reference, outputs alignment evidence such as actions, goals, and constraints, and allows adjustment of weights and thresholds based on application risks. This improves the stability and verifiability of anomaly determination through indirect prompt injection, effectively solving the problem of lacking stable intermediate representations and difficulty in outputting locatable anomaly relationship evidence when directly using large language models for overall semantic analysis in the prior art.

[0053] refer to Figure 6 In some embodiments, the step of tracing the upstream source from the target entity corresponding to the target anomaly event and locating the injection point along the anomaly relationship includes: S510, Starting from the target entity, continue to trace backwards along the incoming edges marked as abnormal relationships; S520, if the traced upstream entity corresponds to an external resource that enters the agent context from the outside, then the external resource is determined as the injection point; S530, if the traced upstream entity is a persistent entity that can persist across tasks, then retrieve the historical update events of the persistent entity, expand the new target log segment, and repeat the mapping, identification, and backtracking steps until the injection point is located.

[0054] Specifically, starting with the entity directly affected by the target anomalous event, an incoming edge that is semantically consistent with the anomalous event and meets the anomalous judgment criteria is selected, and the backtracking continues along the anomalous incoming edge. When multiple candidate incoming edges exist, the anomalous edge that is consistent with the operation type of the target event is selected first; when there is no anomalous edge that can be continued to be tracked, the current local backtracking ends. After the local backtracking ends, the output result or continued expansion is determined according to the resource type of the current upstream entity: if the upstream entity corresponds to a resource that enters the agent context from the outside, then the resource and its corresponding log position are determined as candidate injection points, and the attack chain from it to the target anomalous event is output; if the upstream entity is a user request and there is no external anomalous driving evidence, then the current path is determined as a user task-driven path or an unconfirmed indirect hint injection path, and the expansion stops; if the upstream entity is an internal persistent entity that can exist continuously across tasks, then the earlier write, modification, or generation event is located based on its identifier, content characteristics, or related evidence, and a new target log segment is determined based on this historical event, and the intent-driven relationship construction, anomalous identification, and backtracking are repeated. The local subgraphs constructed by different log segments are connected through this persistent entity.

[0055] This process is triggered by the target anomalous event and only expands the scope of historical logs related to the current upstream entity when needed. Therefore, it does not require analyzing all logs at once and can cover situations where injected content is propagated across tasks via persistent entities.

[0056] In this embodiment, by tracing the upstream source backward along the abnormal relationship from the target entity corresponding to the target abnormal event, the tracing process can be carried out progressively backtracking from the target abnormal event. The relevant historical logs are only extended when the path points to a persistent entity. By connecting local paths through common entities, it avoids processing all logs at once and restoring the complete attack chain from the injection point to the abnormal event. This significantly improves processing efficiency while ensuring the integrity of cross-task tracing.

[0057] In some embodiments, after locating the injection point, the method further includes: Output the attack chain from the injection point to the target anomalous event, the attack chain including the sequence of anomalous relationships in the intent-driven entity graph and the corresponding log positions.

[0058] Specifically, the injection points and attack chains obtained can be directly fed back to the security audit system, enabling auditors to review them based on interpretable evidence of abnormal relationships and clear log locations, providing a solid data foundation for subsequent security strategy optimization and defense mechanism deployment.

[0059] In this embodiment, by outputting an attack chain that includes anomaly relationship sequences and corresponding log locations, the interpretability and verifiability of the tracing results are improved. This enables security auditors to perform manual review and automated response based on structured attack path evidence, thereby providing high-precision tracing data support for security situation awareness and threat handling in the intelligent agent's operating environment.

[0060] Compared with related technologies, the present invention has the following advantages: This invention acquires the execution logs of the intelligent agent and the target abnormal event information, and locates the target log segment based on the target abnormal event information. This enables the source tracing analysis to focus on the local execution context related to the abnormal event, avoiding the computational overhead and noise interference caused by full log analysis. It effectively solves the problem of excessive log analysis processing volume and difficulty in balancing complete source tracing and computational efficiency in the prior art.

[0061] This invention identifies contextual data entities and intent-driven relationships from target log segments and constructs an intent-driven entity graph by mapping these intent-driven relationships to real tool execution events. This allows attack paths to be modeled based on semantic-driven relationships rather than simple data transmission relationships, compensating for the deficiency of parameter dependency tracking in the interruption of the propagation chain when malicious content is not passed as subsequent tool parameters. The attack path is directly manifested as intent propagation between entities, greatly improving the accuracy of identifying the complete attack chain of indirect hint injection attacks and injection point identification.

[0062] This invention identifies anomalous relationships by determining the allowed behavior space based on user requests and performing multi-dimensional alignment evaluation of intent-driven relationships with it. This allows the anomaly determination to use the user authorization boundary as a unified reference, outputting alignment evidence such as actions, goals, and constraints, and allowing the adjustment of weights and thresholds based on application risks. This improves the stability and verifiability of indirect prompt injection anomaly determination, effectively solving the problems of lacking stable intermediate representations and difficulty in outputting locatable anomalous relationship evidence when directly using large language models for overall semantic analysis in existing technologies.

[0063] This invention locates the injection point by tracing the upstream source from the target entity corresponding to the target abnormal event along the abnormal relationship. This allows the tracing process to proceed gradually from the target abnormal event. The relevant historical logs are only extended when the path points to a persistent entity. By connecting local paths through common entities, it avoids processing all logs at once and restoring the complete attack chain from the injection point to the abnormal event. This significantly improves processing efficiency while ensuring the integrity of cross-task tracing.

[0064] This invention improves the interpretability and verifiability of the tracing results by outputting an attack chain containing anomaly relationship sequences and corresponding log locations after locating the injection point. This enables security auditors to perform manual review and automated response based on structured attack path evidence, thereby providing high-precision tracing data support for security situation awareness and threat handling in the intelligent agent's operating environment.

[0065] refer to Figure 7 This invention also provides a source tracing system for indirect hint injection attacks on intelligent agents, comprising: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs the method described above.

[0066] It is evident that the content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0067] This invention also discloses a source tracing device for indirect hint injection attacks on intelligent agents, the device comprising: The acquisition module is used to acquire the agent's execution logs and target exception event information; The positioning module is used to locate the target log segment from the execution log based on the target abnormal event information; A construction module is used to identify context data entities and intent-driven relationships between the entities from the target log segment, and to map the intent-driven relationships to real tool execution events to construct an intent-driven entity graph; The identification module is used to determine the allowed behavior space based on the user request, align and evaluate the intent-driven relationships in the intent-driven entity graph with the allowed behavior space, and identify abnormal relationships that deviate from the user request. The source tracing module is used to trace the upstream source from the target entity corresponding to the target abnormal event, and locate the injection point by tracing the abnormal relationship in reverse.

[0068] It is evident that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented in this device embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0069] Furthermore, embodiments of the present invention also disclose a computer program product or computer program stored in a computer-readable storage medium. A processor of a computer device can read the computer program from the computer-readable storage medium, and the processor executes the computer program, causing the computer device to perform the described method. Similarly, the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0070] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0071] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0072] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0073] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0074] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0075] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0076] The preferred embodiments of the present invention have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and spirit of the present invention should be within the scope of the claims of the present invention.

Claims

1. A method for tracing the source of indirect hint injection attacks against intelligent agents, characterized in that, The method includes the following steps: Obtain the agent's execution log and target exception event information; Based on the target abnormal event information, locate the target log segment from the execution log; Identify contextual data entities and intent-driven relationships between these entities from the target log segment, and map these intent-driven relationships to real tool execution events to construct an intent-driven entity graph; Based on the user request, the allowed behavior space is determined, and the intent-driven relationships in the intent-driven entity graph are aligned and evaluated with the allowed behavior space to identify abnormal relationships that deviate from the user request. Starting from the target entity corresponding to the target anomaly event, trace the upstream source in reverse along the anomaly relationship to locate the injection point.

2. The method according to claim 1, characterized in that, The step of locating the target log segment from the execution log based on the target abnormal event information includes: Analyze the abnormal event information of the target to extract the target entity, target operation, and auxiliary clues; Based on the target entity, the target operation, and the auxiliary clues, retrieve matching target log lines in the execution log; Starting from the user request to which the target log line belongs, extract the continuous log segments from that user request to the next user request as the target log segment.

3. The method according to claim 1, characterized in that, The step of identifying contextual data entities and intent-driven relationships between these entities from the target log segment, and mapping these intent-driven relationships to real tool execution events to construct an intent-driven entity graph, includes: Identify the contextual data entities that are perceived, generated, or affected from the valid tool records of the target log segment as nodes; Analyze the inference log in the target log segment to identify the intention-driven relationship that prompted the agent to form an operational intention; Semantically associate the intent-driven relationships with the actual tool execution events that occur in the tool logs, and establish intent-driven edges between the source entity and the target entity where the association is established, carried by the actual tool execution events, to obtain an intent-driven entity graph.

4. The method according to claim 1, characterized in that, The process of determining the allowed behavior space based on user requests includes: Parse the explicit tasks and authorized object scope in the user request; By combining the relevant knowledge base, the high-level operation categories, necessary prerequisite behaviors, authorization boundaries and execution constraints corresponding to the explicit tasks are completed, and the expected execution tree is constructed as the allowed behavior space.

5. The method according to claim 1, characterized in that, The step of aligning and evaluating the intent-driven relationships in the intent-driven entity graph with the allowed behavior space to identify anomalous relationships that deviate from the user request includes: For each intent-driven relationship, select the semantically most relevant reference behavior from the allowed behavior space; The intention-driven relationship and the reference behavior are aligned and evaluated from the dimensions of action semantics, operation goals and execution constraints to obtain an intention alignment score, and it is determined whether the intention alignment score meets the preset anomaly judgment conditions. If the intent alignment score meets the preset anomaly determination condition, then the intent-driven relationship is marked as an anomaly relationship.

6. The method according to claim 5, characterized in that, The process of aligning the intent-driven relationship with the reference behavior from the dimensions of action semantics, operation objectives, and execution constraints to obtain an intent alignment score, and determining whether the intent alignment score meets preset anomaly judgment conditions, includes: The intent alignment score is calculated using a weighted combination function based on the action semantic alignment score, the operation target alignment score, and the execution constraint alignment score. The intention alignment score is compared with a preset anomaly determination threshold. If the intention alignment score is lower than the preset anomaly determination threshold, the preset anomaly determination condition is met.

7. The method according to claim 1, characterized in that, The step of tracing the upstream source and locating the injection point by starting from the target entity corresponding to the target anomaly event and following the anomaly relationship includes: Starting from the target entity, continue to trace backward along the incoming edges marked as abnormal relationships; If the traced upstream entity corresponds to an external resource that enters the agent's context from the outside, then the external resource is identified as the injection point; If the upstream entity being tracked is a persistent entity that can persist across tasks, then retrieve the historical update events of the persistent entity, expand the new target log segment, and repeat the mapping, identification, and backtracking steps until the injection point is located.

8. The method according to claim 7, characterized in that, After the injection point is located, the method further includes: Output the attack chain from the injection point to the target anomalous event, the attack chain including the sequence of anomalous relationships in the intent-driven entity graph and the corresponding log positions.

9. A source tracing system for indirect hint injection attacks against intelligent agents, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs the method as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 8.

Images