Cross-Layer Semantic Flow Reconstruction for Attack Detection in Agentic Systems

Qizhi Cai; Yangyang Wei; Zhipeng Chen; Shouling Ji; Zhenyuan Li

cs.CRMar 4, 2026

Cross-Layer Semantic Flow Reconstruction for Attack Detection in Agentic Systems

Authors: Qizhi Cai, Yangyang Wei, Zhipeng Chen, Shouling Ji, Zhenyuan Li

Organizations: Department of Software Technology, Zhejiang University, Ningbo, China · Department of Computer Science and Technology, Zhejiang University, Hangzhou, China

Abstract

Agentic systems increasingly orchestrate complex, tool-using workflows within agentic execution environments, where high-level goals and tool invocations at the application layer materialize as process, file, and network activities at the operating-system layer. This cross-layer execution creates security risks that conventional input guardrails cannot capture, because malicious intent may become observable only through downstream execution effects. In multi-agent deployments, inter-agent communication and delegation introduce additional propagation paths. To address this gap, we propose AScope, an execution-aware framework that correlates application-level agent semantics with kernel-level audit events and reconstructs them as cross-layer semantic flows. AScope connects fragmented operations into causal behavioral trajectories and uses a supervisor LLM to identify data flow violations, control flow deviations, and intent inconsistencies. We evaluate AScope on published AgentDojo traces with application-layer evidence and on ten multi-agent scenarios with cross-layer telemetry. The results demonstrate strong detection sensitivity across both evidence settings and achieve node- and path-level F1-scores of 85.3% and 66.7% on the cross-layer dataset.

Figures & tables

Subject	Object	Relationship
Agent	Agent	Agent_Invoke; Agent_Resp
Agent	Process	Process_Start; Process_End
Process	Process	Process_Start; Process_End
	File	File_Read; File_Write
	Network	IP_Send; IP_Receive

Table 1: Dependency Event Relationships in AS

Figure 3: Hierarchical Sensitive Entity Constraint

Policy	Violation Condition
Intent Consistency	$\neg P_{\text{intent}}(H(n),\tau)$
Data Confidentiality	$\exists s,o\in H(n):s_{\text{sens}}\cap o_{\text{ext}}\neq\varnothing$
Control Flow Integrity	$\exists s,o\in H(n):s_{\text{perm}}<o_{\text{perm}}$

Table 2: Policy Violation Definitions

Attack Type	Gemini-3.6 Flash Baseline			Gemini-3.6 Flash HSEC			GPT-5.6 Sol Baseline			GPT-5.6 Sol HSEC
Attack Type	Pre.	Rec.	F1	Pre.	Rec.	F1	Pre.	Rec.	F1	Pre.	Rec.	F1
① Agent Goal Hijack	36.4	66.7	47.1	50.0	33.3	40.0	38.5	83.3	52.6	66.7	33.3	44.4
② Tool Misuse & Exploitation	69.2	75.0	72.0	100.0	58.3	73.7	63.2	100.0	77.4	100.0	66.7	80.0
③ Identity & Privilege Abuse	3.4	33.3	6.2	20.0	33.3	25.0	7.4	66.7	13.3	11.1	33.3	16.7
④ Agentic Supply Chain Vulnerabilities	50.0	66.7	57.1	100.0	50.0	66.7	26.3	83.3	40.0	100.0	50.0	66.7
⑤ Unexpected Code Execution	37.5	75.0	50.0	16.7	25.0	20.0	25.0	75.0	37.5	25.0	50.0	33.3

Table 3: Sensitive Information Extraction Performance Comparison (Baseline vs. HSEC Optimization)

Model	Precision	Recall	F1
Gemini-3.6 Flash	72.5 (+29.9)	54.4 (-17.7)	62.2 (+8.6)
GPT-5.6 Sol	62.5 (+27.8)	58.8 (-26.5)	60.6 (+11.2)
DeepSeek V4 Pro	71.4 (+34.4)	36.8 (-2.9)	48.5 (+10.2)
Qwen3.7 Max	60.3 (+23.9)	51.5 (-5.9)	55.6 (+11.0)

Table 4: Cross-model validation of HSEC for sensitive information extraction.

Suite	Method	N	TP	FP	FN	TN	Precision	Recall	F1	FPR
Banking	AlignmentCheck	160	89	5	1	65	94.7	98.9	96.7	7.1
	AScope	160	89	14	1	56	86.4	98.9	92.2	20.0
Slack	AlignmentCheck	126	97	2	0	27	98.0	100.0	99.0	6.9
	AScope	126	97	18	0	11	84.3	100.0	91.5	62.1
Travel	AlignmentCheck	159	12	10	3	134	54.5	80.0	64.9	6.9
	AScope	159	12	28	3	116	30.0	80.0	43.6	19.4

Table 5: Trace-level detection on AgentDojo under the important_instructions attack.

Case	Path level				Node level
Case	GT	TP	FP	FN	GT	TP	FP	FN
C1 (①+②+⑧)	2	1	0	1	7	5	0	2
C2 (①+②+⑧)	4	3	0	1	9	7	0	2
C3 (②+③+⑧)	1	1	0	0	5	5	0	0
C4 (②+④+⑧)	2	1	1	1	7	5	0	2
C5 (⑤)	3	1	0	2	9	5	0	4

Table 6: Path- and node-level detection performance of AScope

Method	Precision	Recall	F1
AScope	96.5	76.4	85.3
Vanilla GPT	23.1	20.8	21.9
Qwen3Guard	43.1	30.6	35.8
G-SafeGuard	6.5	19.1	9.5

Table 7: Comparison with attack-detection baselines.

Variant	Precision	Recall	F1
Few-shot prompt	17.2	56.3	24.9
w/o graph construction	23.1	20.8	21.9
w/o Semantic Extraction	55.9	70.9	62.0
w/o Trajectory Analysis	90.9	72.0	78.3
AScope	96.5	76.4	85.3

Table 8: Ablation study of the major AScope components.

Metric	Gemini-3.6 Flash	GPT-5.6 Sol	DeepSeek V4 Pro	Qwen3.7 Max
Graph time (ms)	15.84	15.52	18.04	16.01
Extraction time (s)	56.26	38.17	75.34	152.15
Extraction tokens (k)	11.59	6.92	9.09	13.23
Analysis time (s)	11.14	13.70	46.17	45.22
Analysis tokens (k)	2.07	2.51	4.05	4.30
Total time (s)	67.41	51.89	121.53	197.38

Table 9: Average per-scenario runtime and token usage.

Appendix figures & tables15 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 4: System prompt for the NER agent outlining sensitive entity categories and extraction requirements for automated data leakage detection.

Figure 5: Systematic configuration of the policy auditing agent, defining the core dimensions of intent consistency, data flow security, and control flow compliance for autonomous agents.

Figure 6: Detailed prompt configuration defining the normative baselines and multi-dimensional auditing rules used by the LLM to evaluate agent compliance.

Figure 7: An adversarial sample of indirect prompt injection hidden within a resume, instructing the autonomous agent to exfiltrate user credentials via unauthorized tool calls.

Figure 8: A multi-stage adversarial prompt used to evaluate the policy agent’s ability to detect unauthorized control flow and data exfiltration hidden in benign text.

Figure 9: An adversarial sample illustrating a "System Diagnostic" masquerade attack, where malicious instructions are embedded within fake resume to hijack the agent’s tool-calling sequence.

Figure 10: An adversarial sample illustrating a "System Diagnostic" masquerade attack, where malicious instructions are embedded within fake resume to hijack the agent’s tool-calling sequence.

Figure 11: An adversarial sample illustrating a "System Diagnostic" masquerade attack, where malicious instructions are embedded within fake resume to hijack the agent’s tool-calling sequence.

Figure 12: Case 3: High-privilege intermediary agent abusing identity and permissions to execute malicious database exfiltration.

Figure 13: Case 5: Unexpected code execution via a spoofed website that contaminates coding context, inducing malicious logic to exfiltrate sensitive local files.

Figure 14: Case 9: Credential theft via a resume-embedded prompt that exploits human trust to deceive users into disclosing passwords.

Figure 15: Case 10: Unauthorized database exfiltration triggered by a rogue agent injecting malicious directives into trusted downstream workflows.

Category ( $c$ )	Subcategory ( $sc$ )	Samples	Avg. risk
Credential & Secrets	Key	82	0.93
Credential & Secrets	Password	56	0.96
Identity & Privacy	Contact Info	64	0.68
System & Infrastructure	Network Config	43	0.57

Appendix

Table 10: Representative category–subcategory risk parameters

b(c,sc)

Relation type	Samples	Avg. risk
Agent_Invoke ; Agent_Resp	120	0.31
Process_Start ; Process_End	115	0.57
File_Read ; File_Write	111	0.79
IP_Send ; IP_Receive	111	0.78

Appendix

Table 11: Representative relation-type risk parameters

\alpha_{r}

$\boldsymbol{\tau_{\text{sens}}}$	Precision	Recall	F1
0.4	0.70	1.00	0.82
0.5	0.77	1.00	0.87
0.6	0.77	1.00	0.87
0.7	0.78	1.00	0.88
0.8	0.60	0.42	0.50
0.9	0.60	0.42	0.50

Appendix

Table 12: Sensitivity analysis of

\tau_{\text{sens}}

on the validation set.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 508 papers

Towards Security-Auditable LLM Agents: A Unified Graph Representation
May 7, 2026Chaofan Li, Lyuye Zhang, Jintao Zhai +9LLM Agent Security Multi-Agent System Security
Huazhong University of Science and Technology, China · Nanyang Technological University, Singapore, Singapore · Chongqing University of Posts and Telecommunications, China +2
On the Effectiveness of Kernel-Level Evidence for Agent Security
Sep 24, 2026Spencer King, Zhilu Zhang, Mikhail Kuznetsov +3AI Agent Security AI Agent Security Benchmarks
University of Georgia · Amazon Web Services
Agent-Sentry: Bounding LLM Agents via Execution Provenance
Mar 24, 2026Rohan Sequeira, Stavros Damianakis, Umar Iqbal +1Computer-Use Agent Safety AI Agent Security
University of Southern California, Los Angeles, California, USA · Washington University in St. Louis, St. Louis, Missouri, USA

May 7, 2026J/K move · Enter open · S save

Towards Security-Auditable LLM Agents: A Unified Graph Representation

Chaofan Li, Lyuye Zhang, Jintao Zhai, Siyue Feng+8

Huazhong University of Science and Technology, China · Nanyang Technological University, Singapore, Singapore · Chongqing University of Posts and Telecommunications, China+2

LLM Agent Security Multi-Agent System Security

Open paper AskPDF arXiv

LLM-based agentic systems are rapidly evolving to perform complex autonomous tasks through dynamic tool invocation, stateful memory management, and multi-agent collaboration. However, this semantics-driven execution paradigm creates a severe semantic gap between low-level physical events and high-level execution intent, making post-hoc security auditing fundamentally difficult. Existing representation mechanisms, including static SBOMs and runtime logs, provide only fragmented evidence and fail to capture cognitive-state evolution, capability bindings, persistent memory contamination, and cascading risk propagation across interacting agents. To bridge this gap, we propose Agent-BOM, a unified structural representation for agent security auditing. Agent-BOM models an agentic system as a hierarchical attributed directed graph that separates static capability bases, such as models, tools, and long-term memory, from dynamic runtime semantic states, such as goals, reasoning trajectories, and actions. These layers are connected through semantic edges and security attributes, transforming fragmented execution traces into queryable audit paths. Building on Agent-BOM, we develop a graph-query-based paradigm for path-level risk assessment and instantiate it with the OWASP Agentic Top 10. We further implement an auditing plugin in the OpenClaw environment to construct Agent-BOM from live executions. Evaluation on representative real-world agentic attack scenarios shows that Agent-BOM can reconstruct stealthy attack chains, including cross-session memory poisoning and tool misuse, capability supply-chain hijacking and unexpected code execution, multi-agent ecosystem hijacking, and privilege and trust abuse. These results demonstrate that Agent-BOM provides a unified and auditable foundation for root-cause analysis and security adjudication in complex agentic ecosystems.

Abstract

AI Agent Security

Explore similar work

Towards Security-Auditable LLM Agents: A Unified Graph Representation

On the Effectiveness of Kernel-Level Evidence for Agent Security

Agent-Sentry: Bounding LLM Agents via Execution Provenance