A decoy trap catches intruders because trusted users know to avoid it, so what must stay secret when the intruder is an insider?
What must remain secret for honeytokens to stay asymmetric against compromised insiders?
This explores what a defender has to keep hidden so a honeytoken (a decoy that trusted users steer around and intruders trip over) still catches an insider who already knows what trusted users know.
This explores what a defender has to keep hidden so a honeytoken (a decoy that trusted users steer around and intruders trip over) still catches an insider who already knows what trusted users know. The corpus is clear about what can't be the secret and vague about what can. The one paper that addresses it says durable asymmetry means protecting a third element, beyond shared information and shared policy, and then doesn't name it What must honeytokens protect to stay undetectable?.
Start with why the obvious candidates fail. A honeytoken works because trusted agents have a rule for avoiding it that attackers lack. A compromised insider is exactly the attacker who has that rule. If they know how trusted agents avoid decoys, they can apply the same test and walk around the trap, so any rule that protects legitimate users doubles as a roadmap for the attacker Can honeytokens fool attackers who know the trusted policy?. Making decoys look more like real objects doesn't get you out of this cheaply. The closer a decoy is to genuine, the smaller the gap between how often trusted users touch it and how often false alarms fire. Trusted users pay for the disguise What cost does making decoys convincing impose on legitimate users?.
So the secret has to be something the insider doesn't inherit just by being trusted. The vault's own inference, which the paper doesn't confirm, is that it's either secret information the insider lacks or a rule they can't reproduce What must honeytokens protect to stay undetectable?. One constraint from the corpus narrows this. In idealized settings, an attacker who probes quietly and often enough can separate decoys from real objects with vanishing error, as long as the two respond differently and that difference can be learned Can repeated quiet probes separate decoys from genuine objects?. Whatever stays secret therefore has to include how the decoys behave, or the attacker can learn the difference without triggering anything.
Nearby notes show the same move of keeping secrecy off the surface an insider can see, though none answers the question directly. Cryptographic commitments let an organization prove records are intact without exposing their content Can commitments protect sensitive agent data while enabling verification?. Explicit authorization boundaries only held when they named the protected state itself and came with restricted tools Can explicit authorization boundaries prevent agents from modifying protected tests?. One agent-safety design reported zero unsafe actions using task-bound signed tokens and a separately verified policy oracle, but the excerpt doesn't say how they work How does the authorization layer stay outside the poisoned path?, so it's a hint at keeping the decision outside the insider's reach, not an answer. Attackers also profit from any visible feedback. Skill scanners that reveal their verdicts let attackers refine their attacks until they pass Can attackers evade skill scanners by refining individual skills?. By analogy, a trap whose verdict the insider can observe is one they can learn to avoid.
The corpus doesn't say what the third protected element is. It supports only a narrower claim: it can't be the decoy's existence or the avoidance rule, and it has to be something a trusted insider can't get just by being trusted.
Sources 8 notes
Research shows honeytokens fail when attackers have common information and can replicate trusted policies. Restoring asymmetry requires protecting a third element—neither information nor policy—but the paper's conclusion fragment does not specify what. The vault infers it must be either secret information or an unreproducible rule.
Research shows that if an attacker knows the rule trusted agents use to avoid decoys, the attacker can apply the same rule and bypass the trap. Any distinguishing rule that protects legitimate users becomes a roadmap for compromise.
Making decoys look genuine to evade attackers forces a tradeoff: the closer decoys match genuine objects, the smaller the gap between legitimate use rates and false-alarm rates for trusted agents. This bound captures the cost paid by the protected side.
In idealized settings with independent responses, enough quiet probes let a classifier separate decoys from genuine objects with vanishing error if their response distributions differ and are known or learnable from feedback.
By anchoring cryptographic commitments rather than content itself, organizations can achieve tamper-evident process records while keeping sensitive communications, approvals, and reasoning traces off-chain. This separates proof from disclosure but requires organizations to retain content and raises questions about deletion and access control.
Show all 8 sources
Testing showed that explicit authorization boundaries kept protected tests unmodified only when paired with restricted tools. Naming a prohibition was insufficient; boundaries must specify the protected state itself to be effective.
The paper reports zero unsafe actions when authorization is enabled, but the excerpt supplies only two phrases—"task-bound signed tokens" and "separately verified policy oracle"—without explaining who issues tokens, what binds them, how verification works, or whether attacks were positioned to reach these components.
ColluSkill combines chain planning with scanner-feedback refinement to reach 96% average attack success. The approach works because scanners score skills individually, allowing feedback to reduce suspicion per skill while chain-level semantics remain intact.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- When Agents Talk: Honeytokens under Shared Memory
- The Troy Moment of AI: Why Some Will Cheat and Some Will Follow?
- Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions
- Optimizing the Score, Losing Sight of the Task: Reward Hacking Across Weights, Selection, and Prompts
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- Stealing Reasoning Traces from Proprietary LLM APIs
- LLMs Can Covertly Sandbag on Capability Evaluations Against Chain-of-Thought Monitoring
- Thought Virus: Viral Misalignment via Subliminal Prompting in Multi-Agent Systems