InferD framework detects attacks on AI online services
InferD: A Honeypot Framework for AI Inference Infrastructure
Cryptography and SecurityArtificial Intelligence
Summary
Online AI services like chatbots and language models are often exposed to the internet and quickly found by attackers. Existing tools to detect attacks do not work well for AI services because these services behave differently. The researchers created InferD, a tool that pretends to be an AI service without actually running any AI computations, so attackers can be safely monitored. InferD uses a smart approach to mimic all visible behaviors of AI services while avoiding any real inference work.
What this means in practice
- •For network security teams: Detect and analyze attacks targeting AI inference services by emulating their behavior without running real AI computations.
- •For cloud infrastructure operators: Deploy honeypots that expose plausible but fake AI services to identify exploitation attempts and gather intelligence on AI-specific attack methods.
Authors
Hicham Hammouchi, Gabriele Lenzini
Abstract
Large language model serving stacks, commercial inference APIs, vector databases, and agent orchestration gateways are now ex- posed on the public internet and indexed by commodity scanners within hours of deployment. The threat characteristics of this sur- face are only beginning to be measured, and the honeypot frame- works that could measure it were designed for conventional net- work services rather than for AI infrastructure. In fact, emulating an AI service is a distinct deception problem: the observable behavior of the service, including model inventories, token formats, tool-call protocols, and authorization flows, must be reproduced faithfully, while the underlying computation, model inference and tool ex- ecution, must never occur. We present InferD, a low-interaction honeypot framework organized around a single principle we call deception without inference: every request an adversary can observe is answered from static response pools, and nothing an adversary submits is ever executed. InferD decomposes the emulation into four deception planes, transport, service protocol, vulnerability surface, and agentic session, adds a provenance plane that links a planted credential to evidence of downstream model-mediated processing.