Researchers at the University of Málaga have unveiled GenPot, a generative honeypot architecture that uses fine-tuned large language models to lure attackers into elaborate, entirely fake web services — and in a controlled trial, cybersecurity experts were unable to distinguish it from a genuine physical device, performing no better than random guessing. The work, published in Applied Intelligence, demonstrates that large language models (LLMs) can break the long-standing trade-off in cyber deception between realism and safety, producing decoy systems that are simultaneously convincing to adversaries and impossible for them to compromise.
Honeypots are decoy systems deployed to attract attackers and record their behaviour, providing threat intelligence because any interaction with them is inherently suspicious. Traditionally, defenders have faced a difficult choice. Low- and medium-interaction honeypots are safe and cheap to deploy, but their static, scripted responses are easily detected by experienced adversaries, limiting the intelligence they collect. High-interaction honeypots offer realistic responses but require real, vulnerable back-end systems and strict isolation, creating genuine network exposure. Prior LLM-driven efforts such as HoneyGPT, HoneyLLM, LLM Honeypot, LLM in the Shell and DecoyPot each attacked parts of this problem, mostly focusing on terminal shells or stateless API replies, but they generally lacked persistent session state, cross-channel consistency and operational performance data such as latency, throughput and energy consumption.
GenPot addresses these gaps with a modular architecture that cleanly separates transport, orchestration and inference. The researchers extended the open-source honeypot platform OpenCanary with an API Gateway that intercepts incoming HTTP requests and forwards only essential context to a Generative Engine. The engine consults a state database holding per-attacker session history, selects a persona-appropriate response template, and queries a local LLM through a dedicated Query Bus that abstracts model selection and inference policy. The model’s structured output is then rendered as JSON for API interactions or HTML for web pages and returned through the gateway. Because the layers are decoupled, the interaction surface never touches the inference backend directly, reducing fingerprintable artefacts and enabling safe fallbacks such as deterministic error responses if the model fails.
To make the decoy credible, the team built a dataset by systematically querying a live, fully configured Synology DiskStation Manager NAS server, capturing genuine JSON responses across seven categories including authentication, file management, system telemetry, user management, service status, error handling and explicit attack responses such as path traversal and injection probes. The Hybrid Corpus used for training contains 9,944 samples, with error and attack traffic deliberately making up roughly 42 percent so the models learn realistic defensive behaviour. A separate Gold Corpus of 1,532 samples was held out entirely for evaluation. Three open-source models — Google’s Gemma 7B, Meta’s LLaMA 3 8B and Hugging Face’s Zephyr 7B — were fine-tuned using parameter-efficient Low-Rank Adaptation with 4-bit quantisation, a strategy that adapts the models’ behaviour without full retraining and keeps hardware requirements within reach of edge deployments.
Security against the LLM’s own weaknesses was engineered at multiple levels. A pre-generation filter sanitises incoming requests against blacklists of known prompt-injection vectors and jailbreak triggers such as ‘ignore previous instructions’, blocking anything suspicious before it reaches the model. At the token level, a custom balanced-stopping criterion halts generation the instant the root JSON object closes, physically preventing trailing conversational padding or unsolicited explanations. An egress filter scans final payloads for leaked internal keywords, defensive system prompts anchor device metadata such as hostname and firmware version to prevent contextual drift, and schema validation replaces malformed outputs with plausible defaults. In a dedicated resilience evaluation using 25 complex injection payloads across five threat vectors, executed three times per model, all three back-ends achieved a zero percent injection success rate and zero percent critical failure rate across 90 scored interactions, neutralising 96.67 percent of probes gracefully with authentic Synology error structures.
Performance testing showed the system sustains production-level traffic despite its generative core. Optimisations including deterministic time-to-live caching, which returns previously generated payloads for repeated queries in under 10 milliseconds, and structural early stopping allowed the honeypot to sustain roughly 920 to 1,040 requests per second with a flawless zero percent error rate up to 32 concurrent sessions, with p95 latencies near 10 milliseconds under load. Uncached generative inference clusters around a median of roughly 300 milliseconds — fast enough for interactive deception, though the authors note this remains a potential timing side-channel compared with sub-50-millisecond hardware responses. Response quality against the unseen Gold Corpus was similarly strong: all models produced valid JSON in more than 96.9 percent of cases, Zephyr reached 99.6 percent validity, and LLaMA 3 achieved the highest semantic fidelity with a weighted BERT F1 of 0.883. Interestingly, many flagged errors involved the models hallucinating plausible but divergent values — deviations that, against a static ground truth, count as failures, yet in live deception they add entropy that thwarts fingerprinting by automated scanners.
Energy efficiency emerged as a differentiating factor. The team introduced an RPS/W metric dividing sustained throughput by average GPU power draw, finding Zephyr roughly three to four times more energy-efficient than LLaMA 3 and Gemma respectively, making it the preferred back-end for power-constrained edge deployments. Training itself consumed modest energy, with Zephyr requiring the least at 86.81 watt-hours over about 3.5 hours, and all models converged healthily with validation perplexity around 2.0, indicating genuine generalisation rather than memorisation of the target API’s behaviour.
The decisive test was real-world deception. In a 14-day deployment on a public IP address, the Zephyr-powered honeypot recorded 1,292 unique IP addresses and 12,920 dynamic interactions, mostly from automated scanners. Compared with a static OpenCanary baseline, GenPot extended average session duration by about 38 percent, from 4.5 to 6.2 seconds, and pushed maximum interaction depth from 4 to 10 requests, trapping scripts in deeper reconnaissance loops by returning context-aware errors and structurally valid hallucinated metadata instead of breaking the illusion. In a parallel human-in-the-loop study, ten participants with backgrounds from BSc to PhD judged samples spanning raw API responses, interface screenshots and interaction videos drawn from both the real device and the honeypot. Overall accuracy fell to 45 percent — below the 50 percent expected from chance — and mean credibility ratings for real and generated API responses were nearly identical at 3.02 and 3.08. Qualitative feedback revealed participants sometimes flagged genuine telemetry as fake while accepting hallucinated LLM values as proof of an active system.
To prove the framework is not confined to a single persona, the researchers adapted GenPot to a FHIR R4 medical device API representing networked clinical equipment. Only the training dataset of 120 synthetic request-response pairs, the JSON schema validators and the OpenCanary skin were replaced; the gateway, query bus, fine-tuning pipeline and state management were reused untouched. On 210 held-out test interactions the parse rate remained a perfect 1.000, with accuracy of 0.838 and key match of 0.867 consistent with the NAS baseline, and the entire adaptation took under two days of engineering. The authors are transparent about limits: around 300-millisecond generative latency could betray the system to timing analysis, deep stateful exploits such as reverse shells remain out of scope because no underlying kernel is emulated, and the ten-person expert panel cannot support fine-grained statistical claims. Even so, GenPot — whose datasets, code and measurement logs are publicly available in a Zenodo repository — establishes that fine-tuned, carefully guarded LLMs can turn low-interaction honeypots into credible, scalable, energy-aware decoys, with future work pointing toward SIEM integration and MITRE ATT&CK-mapped automated threat tagging across SSH, SMB and FTP services.
Subject of Research: An LLM-powered generative honeypot architecture for adaptive and realistic web and API cyber deception
Article Title: GenPot: A generative honeypot architecture for adaptive web and API interaction
Article References: GenPot: A generative honeypot architecture for adaptive web and API interaction. (n.d.). https://doi.org/10.1007/s10489-026-07442-4
Image Credits: AI Generated
DOI: 10.1007/s10489-026-07442-4
Keywords: honeypots, large language models, cyber deception, GenPot, cybersecurity, prompt injection, LoRA fine-tuning, OpenCanary, web API simulation, threat intelligence, energy efficiency, FHIR
Cite Scienmag News
APA MLA Chicago
Hailey Crawford. (September 13, 2026). AI-Powered Honeypot GenPot Fooled Expert Hackers in Live Cyber Deception Test. Scienmag. https://scienmag.com/ai-powered-honeypot-genpot-fooled-expert-hackers-in-live-cyber-deception-test/
Hailey Crawford. “AI-Powered Honeypot GenPot Fooled Expert Hackers in Live Cyber Deception Test.” Scienmag, 13 September 2026, https://scienmag.com/ai-powered-honeypot-genpot-fooled-expert-hackers-in-live-cyber-deception-test/. Accessed 13 September 2026.
Hailey Crawford. “AI-Powered Honeypot GenPot Fooled Expert Hackers in Live Cyber Deception Test.” Scienmag. September 13, 2026. https://scienmag.com/ai-powered-honeypot-genpot-fooled-expert-hackers-in-live-cyber-deception-test/
Copy citation Download RIS
Tags: advanced cyber attack deterrenceAI-powered honeypotcyber deceptioncybersecuritycybersecurity expert threat detectionenergy efficiencyfake web service deceptionFHIRgenerative cyber deceptionGenPothigh-interaction honeypotshoneypotslarge language modelslarge language models in cybersecuritylive cybersecurity testingLLM-driven cyber defenseLoRA fine-tuninglow-interaction honeypots limitationsOpenCanaryprompt injectionrealistic decoy systemsthreat intelligencethreat intelligence collectionweb API simulation
