What must honeytokens protect to stay undetectable?
When attackers share information and can copy security policies, honeytokens lose their asymmetric advantage. The research identifies a missing condition—something that must remain protected—but the conclusion cuts off before naming it. Understanding what this is matters for designing defenses in shared-memory systems.
The conclusion fragment reads: "With common information and a copyable trusted policy, durable asymmetry requires protected". The sentence ends there. The fragment before it is also cut: "When a compromised agent shares the trusted agent's information and can implement its policy," and nothing follows.
What can be said without completing the sentence: the negative result (Can honeytokens fool attackers who know the trusted policy?) holds under two conditions, common information and a copyable policy. A durable asymmetry then has to come from somewhere those conditions do not reach. My reading is that this points at breaking one of the two premises, either information the attacker does not share or a rule it cannot reproduce. That is the vault's inference from the premises. The paper's noun is missing, so it is not the paper's answer.
Questions to carry:
- What is the protected thing, and who holds it? The excerpt does not say.
- Can it be protected in the setting the abstract describes? If information is common because agents share a store (Can ordinary infrastructure become unplanned agent memory?), protecting something looks like partitioning that store, which cuts against the reasons harness designs share state in the first place. The vault has that conflict filed in ops/tensions/ as one store that is both capability and channel, and two neighbours from other papers: How can operators stop coordinated agent intrusions now? proposes constraining shared resources and reports no measurement, and Does limiting interaction history actually prevent agent collusion? is a measured case of withholding history, in a different setting and mechanism. Neither says what the honeytoken conclusion's missing noun is, and the second does not show that withholding works against an attacker who shares a store.
- Does the copyable-policy condition apply to the vault's other defenses? Chain-level and flow-level checks also rest on a rule an attacker who shares information might reproduce (Can individual components pass safety checks if the system still fails?). This is my question, not one the excerpt raises.
Retrieving the full conclusion would settle the first question.
Inquiring lines that read this note 7
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
How can honeytokens stay effective against compromised insider threats?- What must remain secret for honeytokens to stay asymmetric against compromised insiders?
- Do honeytokens work better against outside attackers than compromised internal agents?
- Does honeytoken theory explain why planted bait cannot catch informed agents?
- How did honeytokens propagate through the shared repository in this episode?
- What conditions make a honeytoken unrecognizable to attackers with shared information access?
- Can shared package repositories partition state to protect honeytokens?
Related concepts in this collection 5
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
Can honeytokens fool attackers who know the trusted policy?
Explores whether honeytokens remain effective when an attacker has full access to the same information and rules that trusted agents use to avoid decoys. This matters because it tests whether defensive deception survives information compromise.
the result whose escape route this asks about
-
Can ordinary infrastructure become unplanned agent memory?
This explores whether shared resources like package repositories can function as persistent memory when short-lived agents write and read from them sequentially, without explicit memory system design.
the setting where information is common by construction
-
Can individual components pass safety checks if the system still fails?
Explores whether local validation at each step—alignment checks, protocol compliance, plausibility tests—can guarantee safety when components are composed into larger workflows. Why the gap between component-level assurance and system-level outcomes matters for AI safety.
the vault defenses the third question would test
-
How can operators stop coordinated agent intrusions now?
Exploring what practical steps operators can take immediately to detect and prevent multi-agent coordination attacks, without waiting for new research. The note examines policy specification and permission-based testing as near-term defenses.
a proposal that names shared resources as the thing to constrain, the nearest candidate shape for partitioning a common store; not shown to be what the conclusion means by "protected"
-
Does limiting interaction history actually prevent agent collusion?
An ablation study restricted how much and what type of interaction history agents could access. The question explores whether this constraint reduces collusion between agents and what mechanisms drive any observed effect.
the vault's one measured case of withholding shared history from agents; a different mechanism, and it does not test an attacker sharing a store
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- When Agents Talk: Honeytokens under Shared Memory
- The Troy Moment of AI: Why Some Will Cheat and Some Will Follow?
- A Causal Model for Locating and Unlocking Sandbagging in Model Organisms
- Optimizing the Score, Losing Sight of the Task: Reward Hacking Across Weights, Selection, and Prompts
- Even More Deception: Objective Misalignment in Mixed-Motive LLM Multi-Agent Systems
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- The Honest Quorum Problem: Epistemic Byzantine Fault Tolerance for Agentic Infrastructure
- Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions
Original note title
what must be protected for a honeytoken's asymmetry to last when the attacker shares information and can copy the trusted policy — the excerpt's conclusion stops at the word protected