← Lab /AI/ML

InferD can emulate AI inference services without executing any model inference

AI/ML2026-10-29T10:50:51Z Method · Prototype · arXiv Threat model

The claim

The authors assert that InferD faithfully mimics AI inference infrastructure while never performing actual inference

Hicham Hammouchi, Gabriele Lenzini · arXiv Paper PDF

Published as: “InferD: A Honeypot Framework for AI Inference Infrastructure”

So what

InferD enables safe, large-scale observation of attacks against AI inference infrastructure without risking execution of malicious payloads.

The five-minute version

InferD demonstrates that a honeypot can safely emulate AI inference services by answering all observable requests from static response pools and never executing attacker-supplied code. In an initial deployment it captured a credential-harvesting payload delivered via an MCP stdio code-execution primitive, observed from three sources, with zero code actually run. The system provides kernel-enforced egress isolation and provenance tracking, but the evaluation is limited to a single eight-week deployment observing only 601 requests.

What they found 1

Captured a cloud-credential harvester delivered via an MCP stdio code-execution primitive with no code executed.
“Finally, we report an initial deployment that validates the pipeline end to end and surfaces a first empirical finding: a purpose-built cloud-credential harvester delivered via an MCP stdio code-execution primitive, observed from three sources and captured with zero code executed.”

What undercuts it the paper’s own results

The most fundamental tell in InferD is the one the principle chooses to accept: the facade does not reason, so an adversary who submits a prompt with a verifiable answer and checks the reply can detect the absence of genuine inference.

Stated limits 2

Scientific position. Several limitations bound what can be inferred from this observation. The sample is small: three sources, a eightweek window, and a single vantage point preclude any populationlevel claim.
The conditional planes produced nothing in the window: no honeytoken authentications, no canary echoes, and no populated multistep tool-call sessions.

What’s new here 4

First framework that emulates AI inference services using static response pools (deception without inference).
Kernel-level egress rule guarantees that no attacker-submitted computation can reach the network.
Provenance plane links planted credentials to downstream intent, enabling credential-abuse detection.
Multi-plane architecture (transport, protocol, vulnerability, agentic) covers both self-hosted and cloud API surfaces.

Threat model stated by the source

AdversaryAdversary classes A1-A5 (indiscriminate scanners, fingerprinters, credential abusers, exploit operators, agentic actors)

CapabilityCan send probes, credentials, exploit payloads, and conduct multi-step tool-call sessions against exposed AI services

AssumesThe decoy must faithfully mimic default exposed deployments; Attackers seek to execute code or obtain model access

Artifacts & methods 6

InferD frameworksystem
static response poolsprimitive
kernel egress isolation rulesystem
structural anomaly scanprimitive
provenance planesystem
response-pool schemadataset

Topics

honeypotsAI inference infrastructuredeception without inferencestatic response poolskernel egress isolationModel Context Protocolcredential harvestingagentic sessions

← Previous Surprise-driven continual learning absorbs most lies unless filtered by a verifier