# HoneyRoute: Honeypot-Model Routing for Adversarial LLM Serving

arXiv: https://arxiv.org/abs/2609.08306 · HTML: https://mlsanity.com/paper/2609.08306/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Serving systems and request scheduling, one of 12 directions in Efficient LLM inference and serving.
- Builds on 23 of its 25 references that are in the map.
- First posted on arXiv 8 Sep 2026.

## Placed in

- Efficient LLM inference and serving / [Serving systems and request scheduling](https://mlsanity.com/inference/serving-systems-and-request-scheduling/)

## Builds on (most cited first, 23 of 23)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [Efficient Memory Management for Large Language Model Serving with PagedAttention](https://mlsanity.com/paper/2309.06180/) (2023)
- [Universal and Transferable Adversarial Attacks on Aligned Language Models](https://mlsanity.com/paper/2307.15043/) (2023)
- [FrugalGPT: How to Use Large Language Models While Reducing Cost and Improving Performance](https://mlsanity.com/paper/2305.05176/) (2023)
- [RouteLLM: Learning to Route LLMs with Preference Data](https://mlsanity.com/paper/2406.18665/) (2024)
- [JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models](https://mlsanity.com/paper/2404.01318/) (2024)
- [Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack](https://mlsanity.com/paper/2404.01833/) (2024)
- [TRAP: Targeted Random Adversarial Prompt Honeypot for Black-Box Identification](https://mlsanity.com/paper/2402.12991/) (2024)
- [LLM in the Shell: Generative Honeypots](https://mlsanity.com/paper/2309.00155/) (2023)
- [LLM Agent Honeypot: Monitoring AI Hacking Agents in the Wild](https://mlsanity.com/paper/2410.13919/) (2024)
- [HoneyTrap: Deceiving Large Language Model Attackers to Honeypot Traps with Resilient Multi-Agent Defense](https://mlsanity.com/paper/2601.04034/) (2026)
- [HoneyGPT: Breaking the Trilemma in Terminal Honeypots with Large Language Model](https://mlsanity.com/paper/2406.01882/) (2024)
- [LLMHoney: A Real-Time SSH Honeypot with Large Language Model-Driven Dynamic Response Generation](https://mlsanity.com/paper/2509.01463/) (2025)
- [VelLMes: A high-interaction AI-based deception framework](https://mlsanity.com/paper/2510.06975/) (2025)
- [SoK: Honeypots & LLMs, More Than the Sum of Their Parts?](https://mlsanity.com/paper/2510.25939/) (2025)
- [Let Them Steal: Trapping Large Language Model Extraction Attacks with Knowledge Honeypot](https://mlsanity.com/paper/2606.15810/) (2026)
- [Active Honeypot Guardrail System: Probing and Confirming Multi-Turn LLM Jailbreaks](https://mlsanity.com/paper/2510.15017/) (2025)
- [SBASH: a Framework for Designing and Evaluating RAG vs. Prompt-Tuned LLM Honeypots](https://mlsanity.com/paper/2510.21459/) (2025)
- [MemPot: Defending Against Memory Extraction Attack with Optimized Honeypots](https://mlsanity.com/paper/2602.07517/) (2026)
- [SingGuard-NSFA: Extensible Guardrails for Agentic AI via Generative Reasoning and Real-Time Classification](https://mlsanity.com/paper/2607.13081/) (2026)
- [Honeyval: A Comprehensive Evaluation Framework for LLM-powered HTTP Honeypots](https://mlsanity.com/paper/2605.29963/) (2026)
- [ShellGames: Speculative LLM-Driven SSH Deception](https://mlsanity.com/paper/2606.17986/) (2026)
- [AdvancedShelLM: A Stateful Multi-Agent LLM Honeypot for SSH Deception](https://mlsanity.com/paper/2606.27990/) (2026)

## Abstract (arXiv)

We introduce HoneyRoute, an inference-serving layer that detects whether an incoming request is malicious and, if so, routes it to a dedicated honeypot model, shielding production while the adversary's interaction is continuously harvested for intelligence. Existing defenses embed traps inside model memory or rebuild deception at the protocol layer, leaving the serving tier unprotected and feeding nothing back into detection. HoneyRoute couples (i) a streaming router (a frozen 0.8B-embedding backbone with per-domain MLP heads), (ii) a dual-implementation honeypot (a rule/prompt-engineered code honeypot or a dedicated same-family replica), and (iii) an analysis loop that converts trapped interactions into attacker fingerprints for router retraining. On a production trace plus a seven-domain attack corpus, the router reaches F1=.911 at 38 ms median added latency, matching 96% of a two-tier guard-LLM cascade's F1 at 1/385 of its latency with 0% evasion under 13 adversarial transformations; diverting the malicious share cuts production-model token consumption under concurrent flooding with real GCG-suffix payloads by 97.8%; the trained replica agrees with the production model on 92.9% of benign holdout requests, while naive unconditional bait injection collapses to 7.6% and selective camouflaged injection recovers to 88.9%, mapping the recoverable fidelity-traceability frontier; and a loop-trained correction head cuts misrouting of legitimate security research 9x while raising detection F1 to .933.