*MemPot*: Defend Against Memory Extraction Attack with Optimized Honeypots

Large Language Model (LLM)-based agents employ external and internal memory systems to handle complex, goal-oriented tasks, yet this exposes them to severe extraction attacks, and corresponding defenses are currently lacking. In this paper, we propose MemPot, the first theoretically verified defense framework against memory extraction attacks by injecting optimized honeypots into the memory. Through a two-stage optimization process, MemPot generates trap documents that maximize the retrieval probability for attackers while remaining inconspicuous to benign users. We model the detection process as Wald’s Sequential Probability Ratio Test (SPRT) and theoretically prove that MemPot achieves a lower average number of sampling rounds compared to optimal static detectors. Empirically, MemPot significantly outperforms state-of-the-art baselines, achieving a 50% improvement in detection AUROC and an 80% increase in True Positive Rate under low False Positive Rate constraints. Furthermore, our experiments confirm that MemPot incurs zero online inference latency and preserves the agent's utility on standard tasks, verifying its superiority in safety, harmlessness and efficiency.

AI agents are increasingly used to help with complex tasks, such as answering medical questions, managing business records, or assisting with online shopping. To work well, these agents often store and search through memory, including private documents, past conversations, and user preferences. This memory is useful, but it also creates a serious risk: an attacker may ask many seemingly harmless questions and gradually recover sensitive information. This paper introduces MemPot, a zero-online-cost defense method that protects LLM agent’s memory by placing carefully designed decoy records inside it. The mechanism acts like traps: they are more likely to attract attackers who are trying to explore or extract the memory, while remaining unlikely to disturb normal users. Instead of judging each question in isolation, MemPot watches how retrieved records accumulate over a conversation. If a user repeatedly triggers these traps, the system can identify suspicious behavior earlier. Our experiments show that MemPot detects memory extraction attacks more reliably than existing defenses, while adding no extra delay during normal use. It also preserves the agent’s usefulness on standard tasks. Overall, MemPot offers a practical way to make memory-based AI agents safer without sacrificing user experience.