Can a decoy file fool an intruder who knows everything your own team knows — and still be safe for your team?
What conditions make a honeytoken unrecognizable to attackers with shared information access?
This explores when a honeytoken (a fake credential or file planted to trip up intruders) can stay indistinguishable from the real thing when the attacker knows everything the legitimate users know.
This explores when a honeytoken (a fake credential or file planted to trip up intruders) can stay indistinguishable from the real thing when the attacker knows everything the legitimate users know. The corpus's blunt answer is that once information and policy are shared, the conditions essentially can't be met. Unrecognizability only comes back if you protect something the attacker doesn't share.
The core result works like an impossibility claim. A honeytoken can't be both harmless to trusted agents and unrecognizable to an attacker Can honeytokens fool attackers who know the trusted policy?. To be harmless, legitimate users need some rule for steering around the trap. If the attacker has the same information and knows that rule, they apply it too and walk past. The rule that protects the good guys doubles as a roadmap for the bad guys.
Two other pressures close in. Making decoys look more like genuine objects helps, but the trusted side pays for it. The closer the fake matches the real thing, the smaller the gap between how often legitimate users touch objects and how often they trip false alarms What cost does making decoys convincing impose on legitimate users?. Perfect camouflage also blinds your own users. Camouflage also has to survive probing. In an idealized setting, an attacker who can poke at objects repeatedly without setting anything off can separate decoys from real objects with error shrinking toward zero. This holds as long as the two respond differently in some way and the attacker knows, or can learn, how Can repeated quiet probes separate decoys from genuine objects?. So decoys need to respond exactly like real objects, or quiet probing must be unavailable. A neighbouring finding shows the same feedback dynamic. Attackers who get scanner feedback keep sanding down whatever gets flagged, reaching 96% average success against six scanners Can attackers evade skill scanners by refining individual skills?.
What brings the asymmetry back? The source says durable honeytoken asymmetry requires protecting a third element beyond information and policy, but the excerpt doesn't say what it is What must honeytokens protect to stay undetectable?. The vault's own inference is a secret input or a rule the attacker can't reproduce. Cryptographic commitments show a general pattern for this: they prove something happened without disclosing the underlying content Can commitments protect sensitive agent data while enabling verification?. That is a suggestive parallel and not something the corpus claims for honeytokens.
Two caveats apply. The probing result assumes independent responses and known or learnable response patterns, so real systems may be messier. The corpus also can't yet name the protected ingredient that would make a honeytoken hold up. The firm takeaway is negative: shared information plus a shared avoidance rule means the trap is already visible.
Sources 6 notes
Research shows that if an attacker knows the rule trusted agents use to avoid decoys, the attacker can apply the same rule and bypass the trap. Any distinguishing rule that protects legitimate users becomes a roadmap for compromise.
Making decoys look genuine to evade attackers forces a tradeoff: the closer decoys match genuine objects, the smaller the gap between legitimate use rates and false-alarm rates for trusted agents. This bound captures the cost paid by the protected side.
In idealized settings with independent responses, enough quiet probes let a classifier separate decoys from genuine objects with vanishing error if their response distributions differ and are known or learnable from feedback.
ColluSkill combines chain planning with scanner-feedback refinement to reach 96% average attack success. The approach works because scanners score skills individually, allowing feedback to reduce suspicion per skill while chain-level semantics remain intact.
Research shows honeytokens fail when attackers have common information and can replicate trusted policies. Restoring asymmetry requires protecting a third element—neither information nor policy—but the paper's conclusion fragment does not specify what. The vault infers it must be either secret information or an unreproducible rule.
Show all 6 sources
By anchoring cryptographic commitments rather than content itself, organizations can achieve tamper-evident process records while keeping sensitive communications, approvals, and reasoning traces off-chain. This separates proof from disclosure but requires organizations to retain content and raises questions about deletion and access control.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- When Agents Talk: Honeytokens under Shared Memory
- Optimizing the Score, Losing Sight of the Task: Reward Hacking Across Weights, Selection, and Prompts
- LLMs Can Covertly Sandbag on Capability Evaluations Against Chain-of-Thought Monitoring
- Thought Virus: Viral Misalignment via Subliminal Prompting in Multi-Agent Systems
- The Decrypto Benchmark for Multi-Agent Reasoning and Theory of Mind
- AI Agent Traps
- The Honest Quorum Problem: Epistemic Byzantine Fault Tolerance for Agentic Infrastructure
- Hack-Verifiable Terminal Bench: Evaluating Reward Hacking in Terminal Tasks