用智能陷阱保护大模型记忆不被窃取，又不影响正常使用。
MemPot: Defending Against Memory Extraction Attack with Optimized Honeypots
- 通过两阶段优化生成难以察觉的诱饵文档
- 检测准确率提升50%，误报率低时真阳性率高80%
- 零延迟防护，适合部署在真实推理系统中
基于大语言模型的智能体依赖外部与内部记忆系统完成复杂任务，但易遭受记忆提取攻击，现有防御手段不足。本文提出MemPot，首个理论可验证的记忆提取攻击防御框架，通过在记忆中注入优化的蜜罐（honeypots）实现防护。采用两阶段优化生成陷阱文档，最大化攻击者检索概率，同时对正常用户保持隐蔽。将检测过程建模为瓦尔德序贯概率比检验（Wald's SPRT），理论上证明其平均采样轮次低于最优静态检测器。实验表明，MemPot显著优于现有基线，在检测AUROC上提升50%，在低误报率条件下真阳性率提高80%。此外，实测显示其无额外在线推理延迟，且不影响智能体在标准任务上的性能，验证了其在安全性、无害性与效率上的优势。
原文摘要 · Abstract (English)
Large Language Model (LLM)-based agents employ external and internal memory systems to handle complex, goal-oriented tasks, yet this exposes them to severe extraction attacks, and effective defenses remain lacking. In this paper, we propose MemPot, the first theoretically verified defense framework against memory extraction attacks by injecting optimized honeypots into the memory. Through a two-stage optimization process, MemPot generates trap documents that maximize the retrieval probability for attackers while remaining inconspicuous to benign users. We model the detection process as Wald's Sequential Probability Ratio Test (SPRT) and theoretically prove that MemPot achieves a lower average number of sampling rounds compared to optimal static detectors. Empirically, MemPot significantly outperforms state-of-the-art baselines, achieving a 50% improvement in detection AUROC and an 80% increase in True Positive Rate under low False Positive Rate constraints. Furthermore, our experiments confirm that MemPot incurs zero additional online inference latency and preserves the agent's utility on standard tasks, verifying its superiority in safety, harmlessness, and efficiency.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。