MemPot：通过优化的陷阱来防御内存提取攻击
MemPot: Defending Against Memory Extraction Attack with Optimized Honeypots
AI总结：
MemPot通过优化陷阱文档和理论验证，有效防御内存提取攻击，提升检测性能与效率。
摘要：
基于大型语言模型（LLM）的智能体使用外部和内部记忆系统来处理复杂的目标导向任务，但这种设计使它们容易受到严重的提取攻击，而有效的防御手段仍然匮乏。在本文中，我们提出了MemPot，这是首个经过理论验证的针对内存提取攻击的防御框架，通过在内存中注入优化的陷阱来实现防御。通过两阶段的优化过程，MemPot生成陷阱文档，以最大化攻击者的检索概率，同时对正常用户保持隐蔽。我们将检测过程建模为Wald的序列概率比率检验（SPRT），并理论上证明MemPot的平均采样轮次比最优静态检测器更低。实验表明，MemPot在低误报率约束下显著优于最先进的基线方法，检测AUROC提高了50%，真阳性率增加了80%。此外，我们的实验确认MemPot不会增加在线推理延迟，并在标准任务上保持智能体的效用，验证了其在安全、无害和效率方面的优越性。
英文摘要：
Large Language Model (LLM)-based agents employ external and internal memory systems to handle complex, goal-oriented tasks, yet this exposes them to severe extraction attacks, and effective defenses remain lacking. In this paper, we propose MemPot, the first theoretically verified defense framework against memory extraction attacks by injecting optimized honeypots into the memory. Through a two-stage optimization process, MemPot generates trap documents that maximize the retrieval probability for attackers while remaining inconspicuous to benign users. We model the detection process as Wald's Sequential Probability Ratio Test (SPRT) and theoretically prove that MemPot achieves a lower average number of sampling rounds compared to optimal static detectors. Empirically, MemPot significantly outperforms state-of-the-art baselines, achieving a 50% improvement in detection AUROC and an 80% increase in True Positive Rate under low False Positive Rate constraints. Furthermore, our experiments confirm that MemPot incurs zero additional online inference latency and preserves the agent's utility on standard tasks, verifying its superiority in safety, harmlessness, and efficiency.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
