The rules pretty clearly state that the Assassin 1. must be detected, and 2. must be considered a hostile in order to foil Death Attack. (Or, as the rule says it, at least one of either not detecting the Assassin or not recognizing the Assassin as an enemy allows a Death Attack.) So yes, simply knowing that “something’s there” or “someone’s shooting at me” is insufficient.
As far as balance, Death Attack basically isn’t. The 3 round delay makes it useless in combat, party dynamics don’t often let the Assassin do a whole stealth mission solo so he can try to use it outside combat, and even beyond those details, the DC is usually low and lots of targets are immune to begin with. On the other hand, it’s an abrupt one-shot kill that, by definition, the target cannot respond to – when it works, the target just dies, that’s it.
You cannot really balance that; it’s too swingy. If it were more usable, it could arguably be broken, and even if it isn’t, it does kind of kill the fun of the game if it works too often. This sort of touches on a number of problems with the d20 System in general and 3.x in particular. For example, the skill system isn’t all that interesting: here, the Assassin gets to roll Hide and Move Silently, and the target gets to roll Spot and Listen. The Assassin hopes his are both higher; the target hopes at least one of his is higher. They can, before the encounter, try to increase the bonuses on these checks to push things in their own favor, but during the encounter itself? It is two opposed rolls that are effectively passive. Then the Assassin gets an attack roll; the target is still passive, and there’s not really any tactics either can use here: it’s just the roll of a die. @Magician’s Goblin Dice article nicely covers why this is such a serious problem.
Further, combat rounds are too “long” in the sense that hiding for three rounds during a fight so you can use Death Attack is a waste of time: you could have just fought with your allies (Flanking, say) for three rounds and you would have been more likely to kill your target than you are with Death Attack. Many encounters don’t even last three rounds.
The Assassin is not a bad prestige class; full BAB and full Sneak Attack is nice, and the spells are pretty awesome if you have, say, Spell Compendium. But Death Attack is basically a gimmick. It will rarely be viable, and though it will be pretty awesome the one time it works, it will only be awesome because you successfully used an ability that’s usually useless.