PHANTOM: Polymorphic Honeytoken Adaptation with Narrative-Tailored Organisational Mimicry

• URL: http://arxiv.org/abs/2605.02992v1
• Date: Mon, 04 May 2026 17:14:13 GMT
• Title: PHANTOM: Polymorphic Honeytoken Adaptation with Narrative-Tailored Organisational Mimicry
• Abstract summary: Honeytokens are decoy digital assets planted to detect and unauthorised attribute access.<n>We introduce PHANTOM, a framework that generates contextually convincing honeytokens by encoding organisation-specific knowledge.<n>Results are reproduced without external API calls, making the pipeline fully deployable in air-gapped environments.
• Score: 0.2538209532048867
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Honeytokens, decoy digital assets planted to detect and attribute unauthorised access, are a well-established primitive in cyber deception. Existing generation tools produce static, template-based tokens that lack organisational specificity and are identifiable by statistical, syntactic, and semantic analysis. We introduce PHANTOM (Polymorphic Honeytoken Adaptation with Narrative-Tailored Organisational Mimicry), a framework that generates contextually convincing honeytokens by encoding organisation-specific knowledge: domain names, service naming conventions, technology-stack idioms, and realistic secret-value distributions, into a multi-component generation pipeline. We formalise honeytoken quality through a four-component Believability Score that captures syntactic validity, semantic coherence, statistical plausibility, and human acceptance. We use this metric to evaluate PHANTOM across 8 token types and 4 organisational contexts against a template-based baseline. PHANTOM achieves B = 0.778 +/- 0.057 versus B = 0.576 +/- 0.058 for templates (Delta = +0.203, t = 14.07, p < 0.001, Cohen's d = 3.52). Human-evaluator acceptance rises from 6.2% to 100%, and detection resistance (DR = 1 - Pd) improves from 0.609 to 0.870 across three simulated scanner models (regex, entropy analysis, and ML classifier), each with p < 0.001. The semantic coherence gap (Delta Sc = +0.309, d = 4.52) is the dominant driver, confirming the hypothesis that organisational context is the critical missing ingredient in current approaches. All results are reproduced without external API calls, making the pipeline fully deployable in air-gapped environments.

Related papers

• TokenPrint: A Calibrated Token-Space Fingerprint for Language-Model Provenance [8.657685524975246]
  We introduce a training-free fingerprint based on the top-$k$ vocabulary projections of late hidden states elicited by 250 fixed knowledge probes.<n>We evaluate the method on 32 open-weight models from nine families (0.6B--32B) with documented relationships.
  arXiv  Detail & Related papers  (2026-08-08T13:56:39Z)
• Context-Aware Distillation and Ablation for Text2DSL [78.29352305480285]
  We replace prompt-only synthetic generation with context-aware distillation.<n>A teacher large language model operates under an explicitly defined structured context.<n>This scales the verified PolkitBench corpus from 4,204 to 10,073 pairs.
  arXiv  Detail & Related papers  (2026-06-21T16:27:24Z)
• Multimodal Evaluator Preference Collapse: Cross-Modal Contagion in Self-Evolving Agents [1.0152838128195467]
  We show that Evaluator Preference Collapse ( EPC) is dramatically amplified in multimodal settings.<n>We then demonstrate a novel phenomenon we term cross-modal contagion.<n>We identify cross-model evaluator architecture as the primary risk factor for preference drift.
  arXiv  Detail & Related papers  (2026-06-15T13:18:20Z)
• Context-Instrumental Data Distillation for Kubernetes Manifest Generation: Method and Experimental Evaluation [36.94429692322632]
  This paper examines the specialization of Small Language Models with up to 4 billion parameters for generating artifacts in domain-specific languages (AML)<n>We propose the context-instrumental data distillation method: the source corpus is formed through synthetic generation and, in an extended scheme, through reverse instruction generation from real Y files.
  arXiv  Detail & Related papers  (2026-05-25T13:30:38Z)
• Distributional Energy-Based Models for Uncertainty-Aware Structured LLM Reasoning [40.342912574072024]
  Large Language Models produce structured outputs such as travel plans or code solutions.<n>Individual reasoning steps may appear correct while the output as a whole violates budgets, fails test cases, or contradicts earlier deductions.<n>We propose a learned quality scorer with deterministic analytical constraint penalties for verifying structured LLM outputs.
  arXiv  Detail & Related papers  (2026-05-15T17:08:27Z)
• Differentiable latent structure discovery for interpretable forecasting in clinical time series [38.473526928012724]
  We introduce StructGP, a continuous-time multi-task Gaussian process that couples differentiable structure learning to uncover a sparse, ordered directed acyclic graph (DAG) of inter-variable dependencies while preserving principled uncertainty.<n>We propose LP-StructGP, which augments StructGP with latent pathways-shared, temporally shifted trajectories inferred via subject-specific coupling filters and a softmax gating mechanism-to capture cross-patient progression patterns.
  arXiv  Detail & Related papers  (2026-04-30T14:59:50Z)
• BEACON: Behavioral Entropy Aggregation for Cross-Model Hallucination Detection in Large Language Models [0.0]
  We present BEACON, a black-box hallucination detection framework that operates purely on model outputs.<n>A gradient-boosted classifier trained on 7,617 labeled examples across seven benchmarks achieves 0.8123 +/- 0.0102 AUROC.<n>An efficient 5-call variant achieves 0.7795 AUROC, enabling practical deployment across black-box LLM APIs.
  arXiv  Detail & Related papers  (2026-04-20T10:32:48Z)
• THEIA: Learning Complete Kleene Three-Valued Logic in a Pure-Neural Modular Architecture [0.0]
  THEIA is a 2.75M modular neural architecture that learns the complete Kleene three-valued logic (K3) truth table from task data without external symbolic inference or hand-encoded K3 gate primitives.<n> Transformer baselines also reach >99% on all 39 rules, and flats match THEIA on Phase-1 accuracy within 0.04pp.
  arXiv  Detail & Related papers  (2026-04-13T10:44:15Z)
• Understanding NPM Malicious Package Detection: A Benchmark-Driven Empirical Analysis [10.599261033874884]
  NPM ecosystem has become a primary target for software supply chain attacks.<n>We conduct a benchmark-driven empirical analysis of NPM malware detection.<n>We build a dataset of 6,420 malicious and 7,288 benign packages annotated with 11 behavior categories and 8 evasion techniques.
  arXiv  Detail & Related papers  (2026-03-29T07:04:31Z)
• PLUME: Building a Network-Native Foundation Model for Wireless Traces via Protocol-Aware Tokenization [0.9558392439655014]
  Plume is a compact foundation model for 802.11 traces that learns from structured PDML dissections.<n>A protocol-aware tokenizer splits along the dissector field tree, emits gap tokens for timing, and normalizes identifiers, yielding 6.2x shorter sequences than BPE.
  arXiv  Detail & Related papers  (2026-03-13T23:14:43Z)
• Benchmarking IoT Time-Series AD with Event-Level Augmentations [34.864214444544565]
  We introduce an evaluation protocol with unified event-level augmentations that simulate real-world issues.<n>We evaluate 14 representative models on five public anomaly datasets.
  arXiv  Detail & Related papers  (2026-02-17T09:45:44Z)
• ACAR: Adaptive Complexity Routing for Multi-Model Ensembles with Auditable Decision Traces [3.151184728006369]
  We present ACAR, a measurement framework for studying multi-model orchestration under auditable conditions.<n>ACAR uses self-consistency variance (sigma) computed from N=3 probe samples to route tasks across single-model, two-model, and three-model execution modes.<n>We evaluate ACAR on 1,510 tasks spanning four benchmarks, producing more than 7,550 auditable runs.
  arXiv  Detail & Related papers  (2026-02-06T23:27:17Z)
• NNGPT: Rethinking AutoML with Large Language Models [36.90850535125572]
  NNGPT is an open-source framework that turns a large language model (LLM) into a self-improving AutoML engine for neural network development.<n>It integrates within one unified workflow five synergistic LLM-based pipelines: zero-shot architecture synthesis, hyper parameter optimization, code-aware accuracy/early-stop prediction, and reinforcement learning.<n>The system has already generated over 5K validated models, proving NNGPT as an autonomous AutoML engine.
  arXiv  Detail & Related papers  (2025-11-25T14:10:44Z)
• Semantic Visual Anomaly Detection and Reasoning in AI-Generated Images [96.43608872116347]
  AnomReason is a large-scale benchmark with structured annotations as quadruple textbfAnomAgent<n>AnomReason and AnomAgent serve as a foundation for measuring and improving the semantic plausibility of AI-generated images.
  arXiv  Detail & Related papers  (2025-10-11T14:09:24Z)
• LLMCARE: early detection of cognitive impairment via transformer models enhanced by LLM-generated synthetic data [32.69241041313969]
  Alzheimer's disease and related dementias affect nearly five million older adults in the United States.<n>This study develops and evaluates a speech-based screening pipeline integrating transformer embeddings with handcrafted linguistic features.
  arXiv  Detail & Related papers  (2025-08-08T13:44:55Z)
• Team RAS in 9th ABAW Competition: Multimodal Compound Expression Recognition Approach [44.40745123728199]
  Compound Expression Recognition (CER) aims to detect complex emotional states formed by combinations of basic emotions.<n>We present a novel zero-shot multimodal approach for CER that combines six heterogeneous modalities into a single pipeline.<n>The proposed approach shows F1 scores of 46.95% on AffWild2, 49.02% on Acted Facial Expressions in The Wild (AFEW), and 34.85% on C-EXPR-DB via zero-shot testing.
  arXiv  Detail & Related papers  (2025-07-02T23:51:40Z)
• Enhancing Domain-Specific Retrieval-Augmented Generation: Synthetic Data Generation and Evaluation using Reasoning Models [0.6827423171182154]
  Retrieval-Augmented Generation (RAG) systems face significant performance gaps when applied to technical domains.<n>We propose a framework combining granular evaluation metrics with synthetic data generation to optimize domain-specific RAG performance.<n>Our empirical analysis reveals critical insights: smaller chunks (less than 10 tokens) improve precision by 31-42%.
  arXiv  Detail & Related papers  (2025-02-21T06:38:57Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.