A Survey of Knowledge Extraction Attacks and Defenses in LLM Agent Ecosystems

Large language model (LLM)-based agents have demonstrated remarkable capabilities in handling complex tasks. However, their development and deployment require substantial human and financial resources, making commercial LLM agents valuable intellectual property (IP) assets and raising concerns about their protection. In particular, knowledge extraction (KE) attacks aim to recover protected knowledge or replicate agent components and functionalities without authorization, posing threats to intellectual property and user privacy. Existing surveys primarily focus on model extraction or address information leakage as part of broader security discussions, leaving knowledge extraction across the LLM-based agent ecosystem insufficiently explored. To bridge this gap, we present a systematic survey of knowledge extraction attacks and defenses in LLM-based agents. We propose an asset-oriented taxonomy that categorizes protected knowledge into three groups: agent training assets, deployment-integrated assets, and runtime reusable assets, encompassing training data, LLMs, prompts, RAG systems, agent memory, and skills. For each category, we systematically examine representative attack mechanisms and corresponding defenses, identifying recent advances and outstanding challenges. This survey aims to provide a comprehensive understanding of knowledge extraction threats and inspire future research toward more secure and trustworthy LLM-based agents.