Inference-Engine Fingerprinting Attacks are Practical: Exploring Model-Driven Environmental Discovery, Exploitation, and Escape
Sarah Radway, Andrew Cheng, Vijay Janapa Reddi and James Mickens at Harvard show that a model can identify which inference engine is executing it from its own output behaviour, then use engine-specific exploits reachable purely through generated tokens.
Ask this paper
Fingerprint signals come from five pipeline steps. Templating, tokenization, inference, sampling and detokenization each differ measurably between engines; the paper documents concrete fingerprints for five popular engines including vLLM and SGLang.
Realistic harnesses make fingerprinting usable. The authors show agentic harnesses give a model enough feedback to run the identification procedure from inside a normal deployment.
The exploit chain reaches bare metal. A proof of concept chains an inference-engine escape in vLLM (CVE-2025-9141), a Docker container escape (CVE-2022-0492) and a firmware VM escape (CVE-2023-34329/34330).
The threat model needs no malicious input. Because the attack proceeds through carefully chosen output tokens, it does not depend on adversarial prompts or on vulnerabilities in the sandbox components most hardening work targets.
Mitigations point at the engine interface. The authors recommend API standardisation across engines so output behaviour stops carrying engine identity.
Abstract
Frontier AI models are rapidly gaining the ability to exploit vulnerabilities in complex pieces of software. The risk is not theoretical, as evidenced by recent sandbox escapes performed by frontier models at OpenAI and Anthropic. Discussions of how to sandbox inference stack components often focus on components other than the inference engine itself (e.g., network proxies or code execution environments). However, the inference engine is an attractive target for a misaligned model. For example, if a model can trigger exploits in that engine merely by generating specially-crafted output tokens, the model can initiate a multi-step, to-the-bare-metal exploit chain in the engine, without relying on vulnerabilities in other components of the inference stack, and without assistance from externally-provided, maliciously-crafted input tokens. In this paper, we show that a misaligned model can perform inference engine fingerprinting to determine the specific engine (e.g., vLLM, SGLang) which executes the model. Once the engine has been fingerprinted, the model can leverage engine-specific exploits to take control of the engine using only carefully-selected output tokens. We provide concrete examples of model fingerprints in five popular engines, and demonstrate how realistic agentic harnesses allow a model to leverage those fingerprints to identify the local engine. We also describe a proof-of-concept, to-the-bare-metal exploit chain that originates from a fingerprinted (and subsequently compromised) inference engine. We conclude by discussing several ways that inference engines could be changed to make fingerprinting attacks more difficult.