LLM agents often place sensitive credentials in the same context window as untrusted retrieved content, creating a direct path for indirect prompt injection to induce credential exfiltration. We study this failure mode through three complementary defenses. First, we ask whether activation probes can detect credential access before output tokens are emitted. Second, we construct honeytokens from format-specific character models and calibrate detection with split conformal prediction. Third, we treat multi-turn exfiltration as a cumulative information-flow problem and track an estimated leakage budget across conversation turns. In controlled experiments on open-weight models, activation features separate benign and credential-seeking prompts with high accuracy, including under held-out encoding transformations. In a small synthetic multi-turn suite, cumulative accounting detects attacks that per-turn detectors miss. These results are preliminary: the multi-turn benchmark is in-house and small, the activation method requires white-box access, and the information estimator provides a practical signal rather than a formal upper bound. Still, the results suggest that credential-exfiltration defenses should combine pre-output monitoring, calibrated canary detection, and temporal leakage accounting rather than relying only on text-level output filters.

翻译：大型语言模型（LLM）代理常将敏感凭证与不可信检索内容置于同一上下文窗口中，这为间接提示注入诱导凭证外泄提供了直接路径。我们通过三种互补防御机制研究该失效模式：首先，探究激活探测器能否在输出令牌生成前检测凭证访问行为；其次，基于格式特异性字符模型构建蜜令令牌，并采用分裂共形预测校准检测阈值；第三，将多轮外泄视为累积信息流问题，跨对话轮次追踪估算泄漏预算。在开源模型的受控实验中，激活特征可高精度区分善意提示与凭证窃取提示（包括在保留编码变换场景下）。在小型合成多轮测试集上，累积核算能检测出逐轮检测器遗漏的攻击。尽管研究尚处初步阶段（多轮基准为内部小型数据集、激活方法需白盒访问权限、信息估计器仅提供实用信号而非严格上界），但结果表明凭证外泄防御应综合运用预输出监控、校准金丝雀检测与时序泄漏核算，而非仅依赖文本级输出过滤器。