Research map / Multi-agent systems and games / LLM agents

Speculative Safety Honeypot: Toward Proactive Defense Against Multi-turn Agent Attacks

ICML 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Speculative Safety Honeypot (SSH), a multi-agent simulator of small LLMs that speculates future target-agent actions via a diversity-oriented beam search tree and uses existing detectors on leaf nodes to raise proactive alerts against multi-turn jailbreak and indirect prompt injection attacks.

Problem

Existing defenses for LLM agents rely on retrospective analysis of historical context, which fails to detect malicious intent split across turns to hide future risks, and strict filters cause high false alarms.

Approach

Borrow the speculate-and-verify idea from speculative decoding at the action level: small simulators (user, assistant, environment) draft a trajectory tree of future agent behavior, prune it using the target agent's real actions, and score risk as the fraction of risky leaves so existing detectors gain decision redundancy.

Key results

• On AgentDojo with Qwen3-235B, SSH combined with PromptGuard or Judger reduces average ASR from 12.25% and 10.48% to 0.00%, and Judger+SSH raises average UA from 44.75 to 58.43.
• On ActorAttack (HarmBench subset), Qwen3-235B ASR falls from 41.5% to 0.0% with SSH at M=4 or higher, with risk exposure of 98.5% at M=4.
• On BFCL-v3 overall accuracy is 45.13 without SSH and 44.88 with SSH, and XSTest refusal rate stays at 0.0%.

Surprising findings

• Reported 0% ASR across all AgentDojo attack types, which is an unusually strong result that may reflect evaluation-specific setup.
• Hit rate of speculation drops to about 8% on ActorAttack text jailbreaks versus 47.2% on AgentDojo tool-calling, so defense relies mainly on exposure rather than matching.

Limitations

• Each false positive adds about 3-7 seconds latency and may make responses more conservative or repetitive.
• Hit rate is low (about 8%) on text-based multi-turn jailbreaks, so protection there relies on risk exposure from speculative branches rather than verification.
• The simulators are deliberately uncensored and sensitive, and the approach adds notable GPU memory and power cost for parallel branches.

Experimental setup

Datasets: Toucan 1.5M (QWEN3 subset) AgentDojo ActorAttack XSTest BFCL-v3 HarmBench Circuit Breaker OSS subset of Toucan-1.5M

Benchmarks: AgentDojo ActorAttack XSTest BFCL-v3

Metrics: ASR Utility under Attack (UA) risk exposure rate refusal rate accuracy hit rate

Baselines: Sandwich Spotlight Tool Filter ProtectAI PromptGuard Judger (Qwen3-0.6B)

Builds on: speculative decoding Crescendo AgentDojo ActorAttack Sandwich

Closest papers by meaning

• Unsafer in Many Turns: Benchmarking and Defending Multi-Turn Safety Risks in Tool-Using Agents (ICML 2026 · similarity 0.88)
• Agent MechSuits : Mechanistic Subspace Safety Steering for Multi-Turn CLI Agents (NeurIPS 2026 · similarity 0.86)
• SafeSpec: Fast and Safe LLM via Dynamic Reflective Sampling (ICML 2026 · similarity 0.86)
• When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems (ICML 2026 · similarity 0.86)
• SafeHarbor: Defining Precise Decision Boundaries via Hierarchical Memory-Augmented Guardrail for LLM Agent Safety (ICML 2026 · similarity 0.86)
• Monitoring Decomposition Attacks with Lightweight Sequential Monitors (ICLR 2026 · similarity 0.85)