跳转至

文章背景与核心概要

随着大语言模型（LLM）作为商业API广泛部署，模型提取攻击（Model Extraction Attacks）成为了威胁其知识产权和核心安全的一大隐患。恶意攻击者通过精心构造的查询探查并试图窃取模型的核心能力。传统的防御手段往往面临两难境地：要么在事后阻断可疑请求，要么通过对输出添加扰动来防范，但这不仅往往干预滞后，还会严重损害正常用户的服务体验。

为了解决这一痛点，本文提出了一种名为“知识陷阱”（Knowledge Trap，又称“知识蜜罐” Knowledge Honeypot）的全新主动防御机制。该机制创新性地引入了蜜罐知识图谱（HKG）与面包屑引导式遍历，将攻击者的查询悄无声息地引向低迁移价值的知识空间。通过耗尽攻击者宝贵的查询预算，该系统成功保护了核心模型资产，同时确保合法用户的模型性能与体验完全不受任何负面影响。

Let Them Steal: Trapping Large Language Model Extraction Attacks with Knowledge Honeypot

Authors: Yuyang Dai, Yushun Dong
Subjects: Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
arXiv ID: arXiv:2606.15810 [cs.CR]
DOI: 10.48550/arXiv.2606.15810
Submission History: Submitted on June 14, 2026; last revised August 27, 2026 (v2).

📌 Executive Summary

Commercial large language models (LLMs) deployed as APIs are highly vulnerable to model extraction attacks, wherein malicious actors query the model to steal its core capabilities or proprietary knowledge. Traditional defenses—such as blocking suspicious queries or perturbing output responses—either intervene too late or degrade the model's utility for legitimate users.

This paper introduces Knowledge Trap (also referred to as Knowledge Honeypot), a novel defense mechanism designed to handle extraction attacks proactively. Instead of outright blocking or degrading service, Knowledge Trap deploys a Honeypot Knowledge Graph (HKG) alongside breadcrumb-guided exploration to subtly redirect attackers toward low-transferability knowledge. By draining the attacker’s limited query budget on useless data, the system successfully protects the model while leaving the performance for benign users completely intact.

商业化部署为API的大语言模型极易受到模型提取攻击的影响，恶意行为者通过查询模型来窃取其核心能力或专有知识。传统的防御手段——例如拦截可疑查询或扰动输出响应——要么干预太迟，要么会降低模型对合法用户的效用。

本文引入了知识陷阱（Knowledge Trap，亦称知识蜜罐 Knowledge Honeypot），这是一种旨在主动处理提取攻击的新型防御机制。知识陷阱没有采用直接阻止或降低服务质量的做法，而是部署了蜜罐知识图谱（HKG）以及面包屑引导式探索，以微妙地将攻击者重定向至低可迁移性的知识。通过在无用数据上耗尽攻击者有限的查询预算，该系统成功保护了模型，同时使良性用户的性能保持完全完好。

🔍 Key Highlights & Findings

  • Innovative Defense Strategy: Rather than altering model outputs or rejecting queries, Knowledge Trap wastes an attacker's resources by feeding them crafted, low-utility knowledge.
  • Mechanism: Utilizes a Honeypot Knowledge Graph (HKG) and breadcrumb-guided traversal to seamlessly steer extraction queries away from critical data spaces.
  • Performance Impact: Experiments across sensitive domains (such as medical and financial applications) demonstrate that Knowledge Trap reduces surrogate model agreement by 6.2% on average.
  • Zero Utility Degradation: Legitimate users experience no measurable drop in accuracy or quality, outperforming prior defense techniques that introduce collateral damage to standard user experiences.
  • 创新防御策略： 知识陷阱没有改变模型输出或拒绝查询，而是通过向攻击者提供精心制作的低效用知识来消耗其资源。
  • 核心机制： 利用蜜罐知识图谱（HKG）和面包屑引导式遍历，无缝地将提取查询引导离开关键数据空间。
  • 性能影响： 在医疗和金融应用等敏感领域进行的实验表明，知识陷阱将代理模型的契合度平均降低了 6.2%。
  • 零效用降级： 合法用户不会经历可度量的准确度或质量下降，其表现优于对标准用户体验造成附带损害的现有防御技术。

📄 Abstract

Large language models deployed as commercial APIs are vulnerable to model extraction attacks, while existing defenses either act too late or degrade utility for legitimate users. We propose Knowledge Trap, a defense that redirects extraction attacks toward low-transferability knowledge through a Honeypot Knowledge Graph (HKG) and breadcrumb-guided exploration. Instead of blocking queries or perturbing outputs, Knowledge Trap consumes the attacker's limited query budget on knowledge with negligible downstream utility while preserving benign-user performance. Experiments in medical and financial domains show that Knowledge Trap reduces surrogate Agreement by 6.2\% on average without degrading legitimate-user accuracy, outperforming existing defenses that impose measurable user impact. These results suggest that defending knowledge-space traversal is a practical direction for mitigating LLM extraction attacks.

部署为商业API的大语言模型容易受到模型 extraction 攻击，而现有的防御措施要么行动太迟，要么会降低合法用户的效用。我们提出了知识陷阱（Knowledge Trap），这是一种通过蜜罐知识图谱（HKG）和面包屑引导探索将提取攻击重定向至低可迁移性知识的防御方法。知识陷阱没有拦截查询或扰动输出，而是将攻击者有限的查询预算消耗在下游效用微乎其微的知识上，同时保留了良性用户的性能。在医疗和金融领域的实验表明，知识陷阱在不降低合法用户准确性的情况下，将代理模型的 Agreement（一致性）平均降低了 6.2%，优于对用户造成可度量影响的现有防御措施。这些结果表明，防御知识空间遍历是缓解LLM提取攻击的一种切实可行的方向。