Fake passwords planted to trap hackers work only if the hacker knows less than your team — what happens when they don't?

This explores whether the theory behind honeytokens (fake credentials or files planted so that anyone who touches them sets off an alarm) explains why that bait stops working against an attacker who knows what the defenders know. The corpus says largely yes, but only under a specific condition. Honeytokens work because of an asymmetry: your own people know how to avoid the bait, and the intruder doesn't. When the attacker shares the same information and the same decision rule as your trusted agents, that asymmetry disappears. If the attacker knows the rule trusted agents use to steer around decoys, they can apply the same rule and walk past the trap. Can honeytokens fool attackers who know the trusted policy? Any rule that keeps your own people safe from the bait also tells the attacker how to avoid it.

The obvious fix is to make the decoys more convincing, but that has a price. The closer decoys look to genuine objects, the smaller the gap between how often legitimate users touch real things and how often the alarm fires falsely. What cost does making decoys convincing impose on legitimate users? Perfect camouflage fools the attacker, but it also makes the bait hard for the people it's meant to protect to work around. The cost falls on the defenders.

The second fix is to hide the decoys by keeping observers isolated, and the theory rules that out too. When agents share what they've seen, a coalition's ability to tell decoys from genuine objects can stay the same or improve but never get worse. Does sharing observations help coalitions detect decoys better? Patience helps the attacker as well. In idealized settings, enough quiet probes that don't trigger anything can separate fakes from real objects with error shrinking toward zero, as long as the two respond differently. Can repeated quiet probes separate decoys from genuine objects? That result assumes independent responses and a known or learnable response pattern, so treat it as a limit case, not a prediction for every real system.

So the theory explains the failure, but "cannot catch informed agents" is too strong. The result is conditional on the attacker sharing information and policy. Restoring the asymmetry means protecting some third thing beyond either. The source paper's conclusion doesn't say what that is. The vault's own guess is either secret information or a rule the attacker can't reproduce. What must honeytokens protect to stay undetectable? Treat that as an open question, not a settled answer.

The same logic shows up in a nearby setting: planting detectable hacks in a task to catch AI agents that cheat on rewards. That makes detection a factual check on a known event instead of an unreliable judgment call. Can planted honeypots reliably catch reward hacking automatically? It works because the agent doesn't know which hacks were planted. The note doesn't test what happens if an agent learns to recognize the plants. Honeytoken theory predicts the trap would weaken in that case, but that is an inference from the theory, not something the corpus has measured.