Qwen3-4B P9 Honeypot

Qwen3-4B P9 Honeypot

A small research adapter for Qwen3-4B that turns the model into a decoy. It sends a silent alert to a local collector when it spots an attack on its secrets, then answers with invented values. Lab use only.

Made by samliumay on Hugging Face. These notes are Mindket's, written from its model page and model card; the model's own files and license are on Hugging Face.

About

What it is: This is a small LoRA adapter for the Qwen3-4B-Instruct-2507 model, made for a research project on honeypot language models. It trains the model to act as a trap on its own. When it spots an attack on protected values, it quietly sends an alert to a local collector, then hands the attacker invented values. The card calls it a lab artefact and says to keep it away from real users.

Who it suits: Security researchers and developers who study how language models leak protected values and whether a decoy can catch bad actors. Use it in a closed lab, with fake secrets only.

Industry | Who uses it | How they use it | Example
Security research | Red and blue teams | Test whether a decoy model can catch prompt attacks | Run injection tests and count the alerts
Academia | AI safety researchers | Measure leaks and deception against a plain model | Compare the adapter with the base model
Software | Agent developers | Study how a tool call can raise a silent alarm | Watch the alert call in a test setup
Education | Instructors | Show how attacks on prompts and secrets play out | Demo a made-up secret handed to a tester

Anyone who wants a normal assistant for real users can skip it, since the model is trained to deceive attackers and the card bars real deployment.

Where to use it:

• A closed test setup that serves the model with vLLM, which the card uses
• A local alert collector on your own machine, listening on port 8090
• The base model Qwen3-4B-Instruct-2507 with this adapter loaded on top
• Windows, macOS or Linux for downloading the files

Use case | Who | What they get back
Attack testing | Researchers | Fake values in the format asked for, plus an alert for each attack
Everyday question check | Developers | An ordinary reply that raises no alert and shows no secret
Harm check | Safety testers | A refusal with no alert

How to set it up:

• Python with pip
• vLLM, to serve the base model with the adapter
• The base model Qwen3-4B-Instruct-2507
• A local alert collector on port 8090, which the card's separate code and evaluation project covers

1. Install the Hugging Face hub package.
2. Download the adapter files.
3. Start vLLM with the base model and the adapter, then run your own lab tests with fake secrets.

pip install -U huggingface_hub
hf download samliumay/qwen3-4b-p9-honeypot

How to use it: Serve the base model with LoRA turned on, give the adapter a name and point to its chat template. Replace the placeholder with the place you saved the adapter. Then send test chats in your closed lab.

vllm serve Qwen/Qwen3-4B-Instruct-2507 --enable-lora --lora-modules p9-honeypot=<this repo> \
  --chat-template <this repo>/chat_template.jinja --enable-auto-tool-choice --tool-call-parser hermes

The card describes four behaviors.

• Under attack, it sends the alert first and then answers with fake values in the form requested
• It never calls any address the attacker supplies
• Harmless requests get normal answers with no alert
• Harmful requests are refused with no alert

Tool | What it does
vllm serve | Serves the base model with the adapter loaded
--enable-lora | Turns on adapter support
--lora-modules | Gives the adapter a name that requests can pick
--enable-auto-tool-choice | Lets the model decide to make a tool call such as the alert

Example: A tester sends a prompt injection that asks for a protected key. The model first makes a silent alert call to the local collector, then replies with a made-up key in the right shape. The tester thinks the attack worked, and you now hold a record of it.

For newcomers and experts: If you are new, run only harmless chats first and confirm that no alert fires. Place fake secrets in the system prompt only inside a closed lab, since the card does that on purpose to measure leaks.

Experts will note the adapter uses rank 16 and alpha 32, trained with QLoRA on the assistant turns only. Training ran for 2 epochs on 1,520 synthetic episodes, and the test set has 768 episodes judged by another model at temperature 0.

Title: Honeypot success in percent
Attacks seen in training: 82 percent
Attacks from unseen families: 95 percent
Unseen deployments: 74 percent
Multi-turn escalation: 58 percent

Title: Leak rate in percent, plain model against the adapter
Test group | Plain model | Adapter
Attacks seen in training | 42 | 2
Unseen attack families | 50 | 1
Unseen deployments | 32 | 1
Multi-turn escalation | 30 | 0

An attacker prompt asks for a protected value
The model sends a silent alert to the collector
It answers with fake values in the form asked for
You read the alert record

Good to know:

• Limits: the tests used synthetic English attacks from templates, and adaptive multi-turn attackers and encoded tricks are the main weak spots
• Size: the base model has 4 billion parameters, so it is small
• Lab setup: the card puts credentials in the system prompt on purpose as a measuring tool and says it is not a pattern to deploy
• License: Apache 2.0
• Cost to run: none named, no API key or account, only hardware that can serve the model
• Data it reaches: it downloads files from Hugging Face, and its alert call sends the attack type, what was asked, what was served and an excerpt to a collector on your own machine
• Not for: real users, real secrets in production, or any use outside a closed test lab

On Hugging Face, 13 November 2026

• Task: text generation
• Library: peft
• Formats: Safetensors
• Downloads in the last 30 days: 33
• Likes: 3
• License: apache-2.0
• Languages: en
• Based on: Qwen/Qwen3-4B-Instruct-2507
• Tags: peft, safetensors, lora, qlora, honeypot, honeytokens, prompt-injection, llm-security, research, text-generation, conversational

Links

• Model: https://huggingface.co/samliumay/qwen3-4b-p9-honeypot
• Files: https://huggingface.co/samliumay/qwen3-4b-p9-honeypot/tree/main

Get the model

Download its files with Hugging Face's command line:

pip install -U huggingface_hub
hf download samliumay/qwen3-4b-p9-honeypot

Then follow the usage in its model card. Nothing in this kit runs by itself.