Its can easily be a pull-only so inference server the only one that might initiate connections.

In any case if you know how inference works there basically nothing you can exploit in tokens processing, it's just basic math.