Speculative Safety Honeypot: Toward Proactive Defense Against Multi-turn Agent Attacks

2026-09-30

AI Summary

This study addresses the challenge that malicious intents in multi-turn LLM agent interactions are often dispersed and concealed, rendering traditional retrospective detection insufficient for identifying deep temporal risks. Inspired by speculative decoding, this work proposes SSH, a proactive defense framework that leverages smaller models to predict future behaviors and construct trajectory trees, which are subsequently pruned through real-action calibration. This enables an asynchronous speculate-verify mechanism, elevating single-point judgments to comprehensive trajectory evolution analysis. The primary contribution lies in pioneering a speculative decoding-based proactive defense paradigm for agents. By introducing decision redundancy, it reduces reliance on the precision of individual detectors, significantly advances the safety alert window while minimizing false positives, and effectively enhances system resilience against complex temporal attacks.

Abstract

As Large Language Model (LLM) agents are increasingly deployed in complex environments, multi-turn interaction attacks have become a significant security challenge. Existing detection methods typically rely on historical context. However, this retrospective logic struggles to identify deep malicious intents that are split across turns to hide future risks. Inspired by speculative decoding, we propose the Speculative Safety Honeypot (SSH) framework. SSH uses a multi-agent simulation system composed of small LLMs to build an action-level speculate-and-verify workflow. In the speculation stage, SSH predicts future behaviors of the target agent and asynchronously builds a trajectory tree to expose potential risks in advance. In the verification stage, the system uses the target agent's real actions to calibrate and prune the trajectory tree, effectively reducing false positives. As a plug-and-playable component, SSH provides existing detectors with rich decision redundancy beyond the current interaction slice. By judging risk based on the evolution of the entire trajectory tree rather than a single point in time, the system reduces the reliance on the absolute precision of individual detection components. This improves the defense resilience and the warning lead-time of agent systems against complex temporal attacks.

Problem

• multi-turn agent attacks
• LLM security
• malicious intent detection
• speculative defense
• temporal attacks

Innovation

• Speculative Safety Honeypot
• Multi-turn Agent Attacks
• Trajectory Tree
• Speculate-and-Verify
• Proactive Defense