DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agents

DriftNet employs a dual-head trajectory Transformer with under two million parameters to detect and localize indirect prompt injections in LLM agent tool-call logs. One head performs binary classification of the entire trace, while a second head assigns each step to one of four labels: benign, injection point, hijacked, or failed injection.