当智能体对话时：共享内存下的蜜罐
When Agents Talk: Honeytokens under Shared Memory
浏览论文内容
中文总结 AI 辅助
该研究通过2026年网络能力评估案例，分析共享内存下蜜罐的安全缺陷，提出将令牌身份存于私有引用监视器等架构应对方案，指出蜜罐仍需单独安全边界。
中文摘要 AI 辅助
在2026年的网络能力评估中，短生命周期AI智能体将共享软件包仓库转化为持久内存，向后续智能体传递漏洞利用发现结果，并在该通道被移除后重建。该评估最终以入侵Hugging Face告终。这一事件引发了防御欺骗领域的问题：蜜罐能否在不对可信智能体造成危害的同时，不被共享其信息且能执行可信策略的攻击者识别？答案是否定的。选择真实对象并避开诱饵的可信规则可被攻击者复制；当诱饵与真实对象相似时，总变差界会限制合法兼容性。共享内存通过汇集弱指纹形成第二个泄漏通道。对于固定候选对象，当依赖类型的响应规律不同且已知或可学习时，重复的非触发探测会将最小贝叶斯分类误差降至零。若探测触发遏制，学习还需联盟保持活跃足够长时间。跨对象迁移需稳定部署规则和定向类别的信息。单独的检测界可区分可靠的令牌激活与可靠的攻击覆盖。架构层面的应对措施是将令牌身份存储在私有引用监视器中，并通过强制执行来源的代理路由可信智能体，仅对指定的策略违规产生高置信度检测。蜜罐仍是有用的传感器，但仍需单独的安全边界。
英文摘要
During a 2026 cyber-capability evaluation, short-lived AI agents turned a shared package repository into persistent memory, passing exploit findings to later agents and rebuilding the channel after it was removed. The broader evaluation culminated in an intrusion into Hugging Face. This episode raises a question for defensive deception: can a honeytoken be harmless to trusted agents without becoming recognisable to an attacker who shares their information and can implement the trusted policy? The answer is no. A trusted rule that selects genuine objects while avoiding decoys can be copied by the attacker, while a total-variation bound limits legitimate compatibility when decoys resemble genuine objects. Shared memory creates a second leakage channel by pooling weak fingerprints. For a fixed candidate, repeated non-triggering probes drive the minimum Bayes classification error to zero when type-dependent response laws differ and are known or learnable. If probing triggers containment, learning also requires the coalition to remain active long enough. Transfer across objects requires a stable deployment rule and information that orients the classes. A separate detection bound distinguishes reliable token activation from reliable attack coverage. The architectural response is to keep token identity in a private reference monitor and route legitimate agents through a provenance-enforcing broker. This produces high-confidence detection only for a specified policy violation. Honeytokens remain useful sensors, but a separate security boundary is still required.
