Honeypot Model

The honeypot is deployed as a functional decoy that mimics the production API's interface, response format, and latency. It is intentionally exposed on a separate, monitored endpoint. The goal is to appear as a legitimate, high-value target to an attacker performing reconnaissance.

• Shadow API: Mirrors the production API schema but serves a dummy or intentionally weakened model.
• Isolated Environment: Runs in a sandboxed network segment with no access to real data stores or internal services.
• Attribution Tokens: Unique, per-session identifiers are embedded in responses to track stolen data if it reappears.

The honeypot must exhibit high-fidelity behavior to be convincing. It returns realistic, yet non-sensitive, predictions. The model is often trained on synthetic or public data that resembles the production domain but contains no proprietary information.

• Synthetic Data Training: Uses GAN-generated or statistically similar data to mimic real input-output distributions.
• Controlled Degradation: May intentionally exhibit slightly lower accuracy to avoid being a perfect clone, which could raise suspicion.
• Confidence Score Emulation: Returns plausible confidence scores to satisfy attackers performing decision-boundary probing.

Every query to the honeypot is logged with full context—headers, payloads, timing, and IP metadata. This telemetry is streamed to a SIEM for real-time alerting and forensic analysis.

• Query Sequence Recording: Captures the exact order of queries to reconstruct the attacker's strategy (e.g., grid search, active learning).
• Surrogate Model Detection: Compares the behavior of suspected stolen models against the honeypot's unique trigger inputs.
• Threat Intelligence Feed: Attack patterns are anonymized and shared to update production defense rules.

A core defensive function is to actively poison the attacker's surrogate model. By serving subtly incorrect or manipulated outputs, the honeypot degrades the quality of any stolen model trained on its responses.

• Decision Boundary Warping: Returns predictions that create a distorted, non-generalizable decision surface in the surrogate.
• Gradient Obfuscation: Injects noise patterns that mislead gradient-based optimization used in model stealing.
• Decoy Output Injection: Serves deliberately misclassified examples for high-risk queries to corrupt the attacker's training dataset.

The honeypot model is embedded with a covert watermark—a set of specific input-output pairs that act as a unique fingerprint. If a stolen model is later discovered, querying it with these trigger inputs proves illicit extraction.

• Zero-Bit Watermarking: Embeds a detectable statistical signature in the model's weights or behavior without affecting normal performance.
• Backdoor Triggers: Uses rare, out-of-distribution inputs that produce a predetermined, anomalous output only in the watermarked model.
• Non-Transferable Signature: The watermark is designed to survive fine-tuning and distillation, making it a persistent proof of ownership.

Advanced honeypots dynamically adjust their behavior based on attacker sophistication. A multi-tiered deception framework escalates the interaction to waste attacker resources and gather deeper intelligence.

• Tier 1 - Static Decoy: A simple model for initial reconnaissance and automated scanners.
• Tier 2 - Interactive Decoy: Engages with the attacker, introducing variable latency and adaptive responses to maintain interest.
• Tier 3 - High-Interaction Sandbox: A fully instrumented environment that allows deeper probing while capturing advanced tooling and manual techniques.

The core mechanism of a honeypot model is serving deliberately incorrect or misleading predictions to identified attackers. This 'poisoned' data contaminates the surrogate model the attacker is trying to build, rendering their stolen copy ineffective. The decoy output is often a confidence-rich but factually wrong response, such as a high-confidence misclassification, designed to be indistinguishable from a real error to the attacker but catastrophic for their model's accuracy.

The process of identifying unauthorized copies of a model in the wild. A honeypot model is instrumented with a unique set of proprietary trigger inputs that produce a specific, verifiable output. By querying a suspected surrogate model with these triggers, security teams can prove it was derived from their honeypot. This technique, often called a model watermarking verification, provides forensic evidence of intellectual property theft and is a critical feedback loop for measuring the honeypot's engagement.

A technique to link anonymous API sessions and detect coordinated extraction campaigns that attempt to stay under per-session rate limits. It builds a unique profile of a client's querying behavior and device characteristics, including:

• TLS fingerprinting (JA3/JA4 hashes).
• HTTP header order and values.
• Inter-request timing jitter. This allows the system to identify a single attacker using multiple IP addresses or API keys and route all their sessions to the honeypot.

A defensive technique used within the honeypot to disrupt timing-based side-channel attacks. By artificially adding a variable, non-deterministic delay to API responses, the honeypot obscures the computational complexity of the underlying (decoy) model. This prevents the attacker from inferring model architecture or layer depth by measuring response latency, adding another layer of deception to the extraction process.

A strategy to cap the amount of new information an attacker can derive from a single query to the honeypot. This is often measured by mutual information or entropy reduction. The honeypot model is designed to provide responses that are maximally confusing, often by returning a uniform distribution over incorrect classes or a deliberately uninformative confidence vector. The goal is to force the attacker to expend maximum queries for minimum surrogate model improvement.