Speculative Safety Honeypot: Toward Proactive Defense Against Multi-turn Agent Attacks

As Large Language Model (LLM) agents are increasingly deployed in complex environments, multi-turn interaction attacks have become a significant security challenge. Existing detection methods typically rely on historical context. However, this retrospective logic struggles to identify deep malicious intents that are split across turns to hide future risks. Inspired by speculative decoding, we propose the Speculative Safety Honeypot (SSH) framework. SSH uses a multi-agent simulation system composed of small LLMs to build an action-level speculate-and-verify workflow. In the speculation stage, SSH predicts future behaviors of the target agent and asynchronously builds a trajectory tree to expose potential risks in advance. In the verification stage, the system uses the target agent's real actions to calibrate and prune the trajectory tree, effectively reducing false positives. As a plug-and-playable component, SSH provides existing detectors with rich decision redundancy beyond the current interaction slice. By judging risk based on the evolution of the entire trajectory tree rather than a single point in time, the system reduces the reliance on the absolute precision of individual detection components. This improves the defense resilience and the warning lead-time of agent systems against complex temporal attacks.

As AI assistants (like ChatGPT) become more independent and capable of performing multi-step tasks, they also become vulnerable to smarter cyberattacks. Instead of attacking all at once, modern hackers often spread their malicious intents across multiple, seemingly innocent steps to trick traditional security systems. Existing defenses only look at what has already happened, which means they often notice the danger too late. To solve this, we developed a proactive defense framework called Speculative Safety Honeypot (SSH). Think of it as giving the security system a "crystal ball." When a user interacts with an AI, SSH uses smaller, faster AI models in the background to simulate and predict multiple steps into the future, creating a tree of potential upcoming actions. If a dangerous future path is spotted early, the system gets a head start to prevent it. As the real interaction unfolds, SSH constantly updates its predictions to stay accurate. This method moves AI defense from "reacting after the damage is done" to "preventing threats before they happen," significantly improving the safety and reaction time of AI systems.