InferD measures the exposed surface of public AI infrastructure by emulating model inventories, tool protocols and authorization flows without ever running inference
AspireAI community · arXiv (Hammouchi, Lenzini)
LLM serving stacks, commercial inference APIs, vector databases and agent orchestration gateways are exposed on the public internet and indexed by commodity scanners within hours of deployment, but the threat characteristics of that surface are only starting to be measured. Existing honeypot frameworks were designed for conventional network services, and emulating an AI service is a distinct deception problem because model inventories, token formats, tool-call protocols and authorization flows all have to be reproduced faithfully while the underlying computation, model inference and tool execution must never occur. InferD is a low-interaction honeypot framework built around one principle the authors call deception without inference - every request an adversary can observe is answered from static response pools, and nothing an adversary submits is ever executed. The emulation is decomposed into four deception planes (transport, service protocol, vulnerability surface, and agentic session) plus a provenance plane that links a planted credential to evidence of downstream model-mediated processing. The limitation is that the paper presents the framework and its design rationale; the measured attack-surface results it would enable are the next step rather than a headline finding here.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.