跳转至

文章背景与核心概要

随着大语言模型（LLM）作为商业 API 的广泛部署，它们面临着日益严重的模型提取攻击威胁。攻击者通过构造查询来窃取模型的核心能力或专有知识。然而，传统的防御手段（如拦截可疑查询或扰动输出响应）往往存在介入过晚或损害正常用户体验的缺点。

为了应对这一挑战，本文提出了一种名为 Knowledge Trap（知识陷阱，亦称知识蜜罐）的全新防御机制。该机制采用主动防御策略，通过构建蜜罐知识图谱（HKG）并结合面包屑引导的探测，将攻击者悄然引向低迁移性的知识领域，从而耗尽攻击者宝贵的查询预算。这种方法不仅成功保护了核心专有知识，还确保了合法用户的模型性能不受任何影响。

Let Them Steal: Trapping Large Language Model Extraction Attacks with Knowledge Honeypot

Authors: Yuyang Dai, Yushun Dong
Subjects: Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
arXiv ID: arXiv:2606.15810 [cs.CR]
DOI: 10.48550/arXiv.2606.15810
Submission History: Submitted on June 14, 2026; last revised August 27, 2026 (v2).

📌 Executive Summary

Commercial large language models (LLMs) deployed as APIs are highly vulnerable to model extraction attacks, wherein malicious actors query the model to steal its core capabilities or proprietary knowledge. Traditional defenses—such as blocking suspicious queries or perturbing output responses—either intervene too late or degrade the model's utility for legitimate users.

This paper introduces Knowledge Trap (also referred to as Knowledge Honeypot), a novel defense mechanism designed to handle extraction attacks proactively. Instead of outright blocking or degrading service, Knowledge Trap deploys a Honeypot Knowledge Graph (HKG) alongside breadcrumb-guided exploration to subtly redirect attackers toward low-transferability knowledge. By draining the attacker’s limited query budget on useless data, the system successfully protects the model while leaving the performance for benign users completely intact.

🔍 Key Highlights & Findings

  • Innovative Defense Strategy: Rather than altering model outputs or rejecting queries, Knowledge Trap wastes an attacker's resources by feeding them crafted, low-utility knowledge.
  • Mechanism: Utilizes a Honeypot Knowledge Graph (HKG) and breadcrumb-guided traversal to seamlessly steer extraction queries away from critical data spaces.
  • Performance Impact: Experiments across sensitive domains (such as medical and financial applications) demonstrate that Knowledge Trap reduces surrogate model agreement by 6.2% on average.
  • Zero Utility Degradation: Legitimate users experience no measurable drop in accuracy or quality, outperforming prior defense techniques that introduce collateral damage to standard user experiences.

📄 Abstract

Large language models deployed as commercial APIs are vulnerable to model extraction attacks, while existing defenses either act too late or degrade utility for legitimate users. We propose Knowledge Trap, a defense that redirects extraction attacks toward low-transferability knowledge through a Honeypot Knowledge Graph (HKG) and breadcrumb-guided exploration. Instead of blocking queries or perturbing outputs, Knowledge Trap consumes the attacker's limited query budget on knowledge with negligible downstream utility while preserving benign-user performance. Experiments in medical and financial domains show that Knowledge Trap reduces surrogate Agreement by 6.2\% on average without degrading legitimate-user accuracy, outperforming existing defenses that impose measurable user impact. These results suggest that defending knowledge-space traversal is a practical direction for mitigating LLM extraction attacks.