Papers, essays, and repositories
Recent work, newest first, spanning AI safety and agent security, LLM robustness and unlearning, confidential computing, and cloud infrastructure at planetary scale. Each entry links to the paper and lists its publication venue.
2026
Phantom References: Hallucinated Citations That Survive Peer Review at Top-Tier Conferences
Using RefChecker, an automated citation-verification tool, this paper audits the bibliographies of papers accepted at top AI and security venues. Hallucinated citations are rare overall, but a surprising share of accepted papers carry multiple fabricated references that peer review never caught.
Learning to Attack and Defend: Adaptive Red Teaming of Language Models via GRPO
AdvGRPO stabilizes reinforcement learning for joint attacker-defender co-training of language models. Co-trained defenders improve on safety benchmarks while the attacker learns effective, transferable adversarial prompts.
MetaBackdoor: Exploiting Positional Encoding as a Backdoor Attack Surface in LLMs
MetaBackdoor introduces a class of backdoor attacks triggered by positional information such as input length rather than textual content, so triggering inputs look completely clean. It demonstrates system-prompt exfiltration and self-activating attacks that emerge from ordinary multi-turn conversation.
Redefining the Software Engineering Profession for AI
An essay on how AI-assisted development reshapes what software engineers actually do, and which parts of the craft — judgment, taste, verification, and system thinking — matter more as code generation gets cheaper.
Optimizing Agent Planning for Security and Autonomy
This paper argues that deterministic, information-flow-based defenses for AI agents become much more practical once planning is optimized correctly. The work focuses on preserving strong security guarantees against indirect prompt injection without paying unnecessary costs in task completion or token usage.
GRP-Obliteration: Unaligning LLMs With a Single Unlabeled Prompt
GRP-Obliteration studies how fragile safety alignment can be after deployment. It shows that a model can be substantially unaligned with a surprisingly small amount of unlabeled fine-tuning signal, which sharpens the case for stronger post-deployment defenses.
2025
The Price of Intelligence
A practitioner’s view of the risks inherent in deploying large language models — hallucination, prompt injection, and jailbreaks — and what realistic mitigation looks like in production systems.
A Representation Engineering Perspective on the Effectiveness of Multi-Turn Jailbreaks
This paper analyzes why multi-turn jailbreaks remain effective even against stronger aligned models. By looking at the attack through internal representation changes, it explains how conversational state can be gradually steered into unsafe regions.
LogiPlan: A Structured Benchmark for Logical Planning and Relational Reasoning in LLMs
LogiPlan introduces a benchmark for testing whether LLMs can reason over structured relationships and carry out planning across them. The emphasis is on the kinds of relational reasoning that matter for knowledge graphs, infrastructure, and business workflows.
LLMail-Inject: A Dataset from a Realistic Adaptive Prompt Injection Challenge
LLMail-Inject captures prompt-injection attempts from a public adaptive challenge built around a realistic email assistant. The dataset is designed to help evaluate defenses against attacks that adapt over time instead of following a fixed benchmark script.
Securing AI Agents with Information-Flow Control
This work applies information-flow control to AI agents so that systems can reason formally about what an agent is allowed to read, trust, and act on. The goal is to block prompt injection and unsafe tool use with system-level guarantees instead of ad hoc heuristics.
Jailbreaking is (Mostly) Simpler Than You Think
This paper proposes the Context Compliance Attack, an optimization-free jailbreak that exploits how many AI systems use prior conversation context. It shows that some safety failures come less from exotic prompt engineering and more from structural weaknesses in conversation design.
Obliviate: Efficient Unmemorization for Protecting Intellectual Property in Large Language Models
Obliviate targets verbatim memorization in language models with a lightweight post-training approach. The paper focuses on reducing copyrighted text leakage while preserving model utility better than heavy-handed unlearning or shallow output filtering.
Lessons From Red Teaming 100 Generative AI Products
This paper distills what Microsoft learned from red teaming more than 100 generative AI products. It proposes a threat-modeling vocabulary and a set of practical lessons for running safety and security assessments at scale.
Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack
Crescendo shows how a harmless-looking multi-turn conversation can gradually walk an aligned model into unsafe output. The work became one of the clearest demonstrations that jailbreak risk cannot be evaluated only on single-prompt attacks.
2024
Hey, That’s My Model! Introducing Chain & Hash, An LLM Fingerprinting Technique
Chain & Hash tackles the problem of model theft and misuse by proposing an LLM fingerprinting method with concrete properties such as persistence, robustness, and unforgeability. It is about proving lineage, not just detecting similar behavior.
2023
Confidential Consortium Framework: Secure Multiparty Applications with Confidentiality, Integrity, and High Availability
This paper presents the Confidential Consortium Framework as a foundation for secure multiparty applications that need confidentiality, integrity, and availability together. It connects confidential computing ideas to practical, high-availability distributed systems.
Who’s Harry Potter? Approximate Unlearning in LLMs
This paper explores whether a model can forget a subset of its training data without full retraining. It became an early and influential example of targeted unlearning for copyrighted content inside large language models.
2022
Singularity: Planet-Scale, Preemptive and Elastic Scheduling of AI Workloads
Singularity describes Microsoft’s global scheduler for AI training and inference workloads. The paper is about cost, utilization, reliability, and how to preempt and resize jobs across a planet-scale cloud environment.
IA-CCF: Individual Accountability for Permissioned Ledgers
IA-CCF extends permissioned ledgers with stronger individual accountability guarantees. The goal is to make it easier to attribute faults and misbehavior even in systems that already rely on Byzantine fault tolerance for baseline safety.
2020
Serverless in the Wild: Characterizing and Optimizing the Serverless Workload at a Large Cloud Provider
This paper studies the real workload mix behind serverless computing at Azure scale. It looks at cold starts, provisioning tradeoffs, and the operational data needed to make serverless platforms both fast and cost-effective.
Selected repositories
RefChecker
The citation-verification tool behind the Phantom References paper — it validates academic references, finds broken citations, and catches hallucinated bibliography entries.
Other public projects
TaskManagerBitmap, DesktopOrganizerBot, and other experiments live on the GitHub profile.