defense arXiv Feb 7, 2026 · 8w ago
Yuhao Wang, Shengfang Zhai, Guanghao Jin et al. · National University of Singapore · Southern University of Science and Technology +1 more
Defends LLM agent memory from adversarial data extraction by injecting optimized honeypot documents with SPRT-based sequential attacker detection
Sensitive Information Disclosure nlp
Large Language Model (LLM)-based agents employ external and internal memory systems to handle complex, goal-oriented tasks, yet this exposes them to severe extraction attacks, and effective defenses remain lacking. In this paper, we propose MemPot, the first theoretically verified defense framework against memory extraction attacks by injecting optimized honeypots into the memory. Through a two-stage optimization process, MemPot generates trap documents that maximize the retrieval probability for attackers while remaining inconspicuous to benign users. We model the detection process as Wald's Sequential Probability Ratio Test (SPRT) and theoretically prove that MemPot achieves a lower average number of sampling rounds compared to optimal static detectors. Empirically, MemPot significantly outperforms state-of-the-art baselines, achieving a 50% improvement in detection AUROC and an 80% increase in True Positive Rate under low False Positive Rate constraints. Furthermore, our experiments confirm that MemPot incurs zero additional online inference latency and preserves the agent's utility on standard tasks, verifying its superiority in safety, harmlessness, and efficiency.
llm National University of Singapore · Southern University of Science and Technology · Tsinghua University
ML Security Papers