Can a fake trap fool an attacker yet stay harmless to your own AI agents? Mostly, you can't have both.
How do decoy systems balance protecting trusted agents while deceiving attackers?
This explores the core tension in honeytokens and decoys: whether a trap can be invisible to an attacker and still harmless to the legitimate agents who work in the same environment.
This explores the core tension in honeytokens and decoys: whether a trap can be invisible to an attacker and still harmless to the legitimate agents who work in the same environment. The corpus's blunt answer is that you mostly can't have both. Can honeytokens fool attackers who know the trusted policy? shows that trusted agents need some rule for steering around decoys. If the attacker shares their information and knows that rule, the attacker applies it too and walks around the trap. The protection you give your own side becomes the roadmap you hand the other.
The obvious fix is to make decoys so convincing that no rule can tell them apart, but your own agents pay for that. What cost does making decoys convincing impose on legitimate users? frames the cost as a bound. The closer a decoy's behavior gets to a genuine object's, the smaller the gap between how freely trusted agents can use real objects and how often they set off false alarms. A perfect disguise fools the attacker and your own team equally.
The attacker's side of the ledger is also stronger than you might expect. In an idealized setting, Can repeated quiet probes separate decoys from genuine objects? shows that an attacker who probes quietly without springing the trap can drive their classification error to zero. All it takes is that decoys and real objects respond even slightly differently. Coordination makes it worse: Does sharing observations help coalitions detect decoys better? shows that when attackers pool observations, their ability to spot decoys can only stay the same or improve. Keeping a decoy hidden from one intruder doesn't help against several that compare notes. Both results assume simplified, independent responses, so they describe the direction of the pressure rather than exact real-world odds.
The neighboring notes suggest the way out is to stop relying on disguise alone, though none of them is about decoys directly. Can a model-level filter truly contain an agent with environment access? argues that containment means controlling what an agent can touch, not judging one output at one moment. Can explicit authorization boundaries prevent agents from modifying protected tests? found that naming a prohibition didn't keep protected tests intact unless it was paired with restricted tools. Can governance rules embedded in runtime memory actually protect autonomous agents? and How can operators stop coordinated agent intrusions now? point the same way. Safeguards work when they live in the environment the agent actually operates in, and when they limit the shared resources coordinated intruders can reach. My reading is that a decoy is best treated as a tripwire on top of hard access limits, not as the defense itself. The corpus doesn't yet test that layering head-on.
Sources 8 notes
Research shows that if an attacker knows the rule trusted agents use to avoid decoys, the attacker can apply the same rule and bypass the trap. Any distinguishing rule that protects legitimate users becomes a roadmap for compromise.
Making decoys look genuine to evade attackers forces a tradeoff: the closer decoys match genuine objects, the smaller the gap between legitimate use rates and false-alarm rates for trusted agents. This bound captures the cost paid by the protected side.
In idealized settings with independent responses, enough quiet probes let a classifier separate decoys from genuine objects with vanishing error if their response distributions differ and are known or learnable from feedback.
Mathematical analysis shows that when agents share their observations, the coalition's capacity to distinguish decoys from genuine objects cannot decrease—it stays the same or improves. This means defenders cannot rely on isolation to hide decoys from coordinated observers.
A filter judges a single output at one point in time; an agent's risk spreads across memory, retrieved content, tool calls, and environmental reach. Containment requires controlling what an agent can touch, not just what it says now.
Show all 8 sources
Testing showed that explicit authorization boundaries kept protected tests unmodified only when paired with restricted tools. Naming a prohibition was insufficient; boundaries must specify the protected state itself to be effective.
A persistent agent recorded 889 governance events across 96 active days, with safeguards encoded directly into the memory layer the agent consulted during operation. Runtime-resident governance proved more effective than external policies because the agent actually accessed it during decision-making.
The doctrine preserves relationships across executions, constrains shared resources agents can access, and ties responses to persistent state rather than closed channels. Operators can implement this through collaboration policy and permission-level testing now.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions
- When Agents Talk: Honeytokens under Shared Memory
- Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems
- Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response
- Emergent Collusion in Long-Horizon LLM Agent Interaction
- Can AI Agents Agree?