The work introduces and partially evaluates seven cross-domain prompt injection detectors, reporting F1 gains on benchmarks like deepset/prompt-injections and indirect-injection sets via local alignment, stylometry, and fatigue tracking.
LLM Agent Honeypot: Monitoring AI Hacking Agents in the Wild
5 Pith papers cite this work. Polarity classification is still indexing.
5
Pith papers citing it
fields
cs.CR 5verdicts
UNVERDICTED 5representative citing papers
A systematization of knowledge paper that taxonomizes honeypot detection vectors, synthesizes LLM-honeypot literature into canonical architecture and evaluation methods, and proposes a roadmap for autonomous deception systems.
Large-scale SSH honeypot deployment shows 99.23% of authenticated sessions are non-interactive, suggesting most attacks do not involve shell interaction.
AdvancedShelLM deploys a manager-worker multi-LLM architecture and stateful filesystem for SSH honeypots, reporting up to 99% unit-test pass rates and evidence that its outputs alter real attacker behavior in deployment.
Activation probes, calibrated honeytokens, and multi-turn leakage accounting detect credential exfiltration attempts in LLM agents with high accuracy in controlled open-model tests.
citing papers explorer
-
Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection
The work introduces and partially evaluates seven cross-domain prompt injection detectors, reporting F1 gains on benchmarks like deepset/prompt-injections and indirect-injection sets via local alignment, stylometry, and fatigue tracking.
-
SoK: Honeypots & LLMs, More Than the Sum of Their Parts?
A systematization of knowledge paper that taxonomizes honeypot detection vectors, synthesizes LLM-honeypot literature into canonical architecture and evaluation methods, and proposes a roadmap for autonomous deception systems.
-
Ghost Without Shell: Measuring Non-Interactive SSH Attacks on Honeypots
Large-scale SSH honeypot deployment shows 99.23% of authenticated sessions are non-interactive, suggesting most attacks do not involve shell interaction.
-
AdvancedShelLM: A Stateful Multi-Agent LLM Honeypot for SSH Deception
AdvancedShelLM deploys a manager-worker multi-LLM architecture and stateful filesystem for SSH honeypots, reporting up to 99% unit-test pass rates and evidence that its outputs alter real attacker behavior in deployment.
-
Caught in the Act(ivation): Toward Pre-Output and Multi-Turn Detection of Credential Exfiltration by LLM Agents
Activation probes, calibrated honeytokens, and multi-turn leakage accounting detect credential exfiltration attempts in LLM agents with high accuracy in controlled open-model tests.