Defensive technique
Data, credentials or identifiers created to generate a signal when someone accesses or uses them.
Research question
Definitions and technical considerations should be checked against the primary source. Atlas records are a selection tagged with this topic; a matching tag does not demonstrate operational outcomes.
Cross-reference
These counts describe tagged Atlas records, not the worldwide number of studies or offerings.
Linked library
The paper presents PHANTOM, a framework that generates honeytokens by encoding organisation-specific knowledge (domain names, service naming conventions, technology-stack idioms and realistic secret-value distributions) into a multi-component pipeline. The authors formalise a four-component believability score and use it to compare PHANTOM against a template-based baseline.
Within a broader agent-governance proposal, the preprint describes planted canary values and precomputed transformations for detecting exfiltration of those values.
Pacheco and Staino paper in the SACS 2026 proceedings describing the reproducible educational design of Cyber Deception Playground.
The author models honeytokens as an information design problem followed by receiver information acquisition, where an adversary can pay to fingerprint the bait. The analysis examines how installed trap prevalence, fingerprinting costs, and adjustment costs affect bait calibration and trap activation.
This work studies credential exfiltration by LLM agents via indirect prompt injection, proposing three complementary defenses according to the authors: activation probes for pre-output detection, honeytokens calibrated via split conformal prediction, and a cumulative leakage budget tracked across multi-turn conversations. The authors report preliminary results from controlled experiments on open-weight models and a small in-house multi-turn synthetic suite.
Open Docker Compose lab with vulnerable services, configurable deception levels, monitoring and an attacker environment for controlled training and research.