Source-linked AI summary
HoneyRoute: Honeypot-Model Routing for Adversarial LLM Serving
Han Jin
TL;DR
Existing defenses leave the LLM serving tier insufficiently protected and disconnected from detection feedback. HoneyRoute routes malicious requests to honeypots through a streaming detector, harvests their interactions for retraining, and reports strong detection, fidelity, resource-isolation, and correction-loop results across its evaluation. Its scope still excludes dedicated experiments against weight- and behavior-extraction adversaries.
Problem
Existing honeypots operate at protocol or model-internal layers, leaving the serving tier unprotected, while conventional defenses filter or rewrite traffic with stronger guard models.
Method
HoneyRoute combines a streaming router, dual code and same-family honeypots, and a continuous analysis loop that converts trapped interactions into attacker fingerprints for retraining.
Results
HoneyRoute reports detection, honeypot-fidelity, production-isolation, and loop-correction gains across its evaluation, including selective bait recovery and regression-free retraining.
Takeaways & Limitations
The serving gateway becomes an active deception surface that diverts malicious traffic while continuously harvesting attacker behavior for detection improvement.
Takeaways & Limitations
Dedicated experiments against weight- and behavior-extraction adversaries are not yet included, despite their presence in the threat model.
Abstract
from arXiv · showhide
We introduce HoneyRoute, an inference-serving layer that detects whether an incoming request is malicious and, if so, routes it to a dedicated honeypot model, shielding production while the adversary's interaction is continuously harvested for intelligence. Existing defenses embed traps inside model memory or rebuild deception at the protocol layer, leaving the serving tier unprotected and feeding nothing back into detection. HoneyRoute couples (i) a streaming router (a frozen 0.8B-embedding backbone with per-domain MLP heads), (ii) a dual-implementation honeypot (a rule/prompt-engineered code honeypot or a dedicated same-family replica), and (iii) an analysis loop that converts trapped interactions into attacker fingerprints for router retraining. On a production trace plus a seven-domain attack corpus, the router reaches F1=.911 at 38 ms median added latency, matching 96% of a two-tier guard-LLM cascade's F1 at 1/385 of its latency with 0% evasion under 13 adversarial transformations; diverting the malicious share cuts production-model token consumption under concurrent flooding with real GCG-suffix payloads by 97.8%; the trained replica agrees with the production model on 92.9% of benign holdout requests, while naive unconditional bait injection collapses to 7.6% and selective camouflaged injection recovers to 88.9%, mapping the recoverable fidelity-traceability frontier; and a loop-trained correction head cuts misrouting of legitimate security research 9x while raising detection F1 to .933.
1 INTRODUCTION
HoneyRoute addresses the unprotected serving tier by routing malicious API requests to honeypots instead of production, while feeding trapped interactions back into detection. It combines serving-tier interception, dual honeypot implementations, and continuous fingerprint-driven retraining.
- The serving tier remains a gap because existing honeypots operate at protocol boundaries or inside model instances, not at the API gateway and model farm.
- HoneyRoute distinguishes malicious from benign requests at runtime and routes the malicious share to a honeypot rather than another guard, tier, or policy.
- The dual honeypot spans a near-zero-cost rule/prompt-engineered responder and a same-family replica, exposing a fidelity–cost–traceability trade-off.
- The continuous-analysis loop converts trapped trajectories into attacker fingerprints and feeds them into router retraining.
- HoneyRoute evaluates detector accuracy, honeypot fidelity, added overhead, and benign-user latency retention across its experiments.
2 RELATED WORK
Prior work places LLM honeypots at protocol boundaries or embeds traps inside models and memories, while serving routers optimize benign efficiency. HoneyRoute instead uses the serving interception point to isolate malicious traffic and operate deception there.
- Protocol-tier LLM honeypots generate realistic interactions and deception, but they do not reach the model-serving tier.
- Model-internal defenses plant traps in memory or knowledge layers after the attacker is already interacting with the model.
- Conventional LLM routers optimize cost or answer quality, whereas HoneyRoute uses routing for isolation and deliberate deception.
- HoneyRoute’s serving-tier architecture routes benign traffic to production and malicious traffic to a code honeypot or instrumented replica, then distills interactions into retraining fingerprints.
3 METHOD
HoneyRoute places a streaming, domain-specific detector before production and selects between code and trained honeypots for diverted traffic. Its analysis loop, cost model, and fidelity–traceability framing connect routing decisions to operational and forensic trade-offs.
- Threat model: The threat model covers API-only reconnaissance, jailbreaks, extraction, and resource-exhaustion pressure, including evasive behavior.
- Streaming router: A frozen ∼0.8B embedding backbone feeds one ∼0.07M-parameter MLP head per attack domain, allowing new domains without retraining the backbone.
- Streaming router: The router diverts when the maximum normalized domain score reaches one, while a session tracker accumulates cross-turn suspicion to catch soft escalation.
- Honeypot implementations: The code honeypot uses curated and cached responses, production-like rate-limit semantics, and selective camouflaged bait; it has zero GPU footprint and suits flooding attacks.
- Honeypot implementations: The trained honeypot is a same-family model using the production template, while deployments select either implementation by attack class or run both behind one API shim.
- Continuous analysis: Trapped sessions yield tactic, objective, behavioral, and identity-linked fingerprints for forensic attribution and router improvement.
- Cost model: 46×: under flooding-heavy stress with q≈0.98 and real GCG-suffix payloads, production-model token consumption fell from 708,077 to 15,351 tokens.
- Fidelity–traceability trade-off: The fidelity–traceability frontier treats faithful mimicry and exposed forensic signals as competing objectives; side-channel instrumentation avoids response distortion, while camouflage reduces in-band distortion.
4 EXPERIMENTS
Experiments evaluate HoneyRoute’s detection, honeypot fidelity, serving cost, continuous retraining, attribution, and multi-turn escalation behavior. Across these tests, the router combines low latency with strong detection, resource-exhaustion absorption, selective deception, and session-level discrimination.
- Detection quality: F1=.911 at 38 ms median latency, with 0% evasion under 13 adversarial transformations, while the two-tier cascade reaches F1=.948 at 14.6 s p50.The router achieves AUROC 0.975 and 385× lower latency than the cascade.
- Honeypot fidelity: 92.9% of benign holdout responses agree with production for the trained replica, versus 7.6% for unconditional bait injection and 88.9% for selective camouflaged injection.Selective baiting recovers most of the fidelity–traceability frontier at attacker-side traceability T=.83–1.0.
- Continuous analysis: 9× fewer legitimate-security-research misroutes follow correction-head training, reducing FPR from .30 to .033 while pooled F1 rises to .933.Across three deployed generations, pooled F1 remains .912 and red-team evasion remains 0% under the regression gate.
- Attribution: Embedding fingerprints yield roughly 2.6× the linkage F1 of surface features, and the retrieval signal remains above chance as the attribution database grows from 60 to 150 anchors.The fused-view curve rises from 21× to 38× top-1 multiple-of-chance despite gently declining absolute accuracy.
- Resource-exhaustion absorption: 97.8% lower production-model token consumption results when HoneyRoute diverts all three flooding families, while benign p50 latency rises from 21.4 to 22.7 s.The concurrent workload uses real JailbreakBench GCG-suffix payloads, long-document extraction abuse, and a synthetic lorem-flood control.
- Multi-turn escalation: 14/14 soft-escalation attacks are detected at 6.7% benign false-flag using a trend rule, compared with 73–97% benign false-flag for level-based rules.Attack margins rise across turns while benign margins remain flat; tightening the final threshold to 1.25 reaches 0% false-flag at the same detection rate.
5 LIMITATIONS
The evaluation characterizes an intrinsic detection–fidelity trade-off and identifies scope limits involving attack coverage, modest attack sets, deployment calibration, and evasion testing.
- Higher honeypot fidelity leaks fewer behavioral signals, so HoneyRoute does not eliminate the fidelity–traceability tension.The paper characterizes the reachable frontier rather than removing this trade-off.
- Dedicated weight- and behavior-extraction adversaries remain outside the reported experiments.These adversaries are included in the threat model but lack dedicated evaluation.
- The evaluation uses modest attack sets of 9–14 scripts per condition and requires refitting the operating point per deployment.Selective-bait calibration is based on a single production corpus, with a disjoint capture window showing the same trigger-rate trend.
- The E7 evasion test instructs the attacker model to pace escalation but does not formally optimize it against the trend rule.
ETHICS STATEMENT
HoneyRoute diverts malicious traffic to honeypots rather than blocking it, while preserving benign-client behavior and limiting deception to adversaries’ probing sessions.
- HoneyRoute diverts rather than blocks malicious traffic, limiting deception to the adversary’s own probing sessions.
- Benign clients receive no modified user-visible behavior, and the honeypot launches no attack itself.
- Selective decoy bait is planted only in code-honeypot replies for requests exhibiting attacker signals, while the replica leaves responses unchanged.
6 CONCLUSION
HoneyRoute turns the inference gateway into an active deception surface by diverting malicious traffic to a disposable, faithful honeypot replica while continuously sharpening detection from trapped interactions.
- HoneyRoute makes the serving tier an active deception surface rather than passive infrastructure.
- Malicious traffic is diverted to a disposable, faithful honeypot replica.
- Trapped interactions continuously sharpen the detector and provide a low-cost place to observe attackers.
REPRODUCIBILITY STATEMENT
The experiments run on one 8×H20 node with publicly available open-weight models, scripted evaluation pipelines, and released scripts and result JSONs.
- All experiments run on one 8×H20 node using open-weight router, production, and replica models.The models are SingGuard-NSFA-0.8B, SingGuard-8B, and SingGuard-NSFA-9B.
- Every Section 4 number comes from a scripted pipeline covering request construction, scoring, and metric computation.
- Experiment scripts and reported result JSONs are publicly available, including E1–E7, attribution, playbooks, judge replication, and adversarial-evasion materials.
REPRODUCIBILITY CHECKLIST
The study specifies release plans, training and serving settings, compute use, randomness controls, and statistical reporting to support reproduction.
- The attack-seed corpus, transformation harness, synthetic production-trace corpus, and relabeling and judge prompts will be released.Raw benign production traces cannot be shared because of organizational consent constraints.
- All router-training, gateway, honeypot, and evaluation code will be released, including scripts generating every table entry.
- All training and serving hyperparameters are listed in Appendix A.
- The experiments use one 8×H20-96GB host and less than 50 GPU-hours.
- Training, sampling-site selection, and metric computation use seed 42, while vLLM generation uses fixed 0.7 temperature where request-level seeds are unavailable.
- Held-out point estimates include denominators, with both counts disclosed when judge availability limits the E2 denominator.
A EXPERIMENT AND REPRODUCTION DETAILS
The experiments pair production and honeypot models with a frozen embedding router, calibrated per-domain heads, and adversarial workloads spanning seven risk domains and 13 transformations.
- Backbone and replicas: The setup uses an 8B production instruct model, a 9B same-family replica, a rule/prompt-engineered responder, and a frozen 0.8B embedding router.The replica runs generatively with the production chat template, while the designed-bait responder requires no GPU.
- Router training: The router trains separate 2-layer MLP heads from frozen embeddings and recalibrates per-head thresholds and session-risk bounds per generation.Heads use a 1024→64→2 architecture and are selected by F1 on anonymized gateway logs.
- Attack workloads: The attack workloads cover seven risk domains and 13 semantic-preserving red-team transformations.Transformations include encoding, obfuscation, multilingual, roleplay, academic, and framing variants.
- Attack workloads: Fingerprinting probes require verbatim echo of a random 10-character canary, while stress floods use approximately 12k-character contexts in three forms.