Research

Backdoor behaviours introduced into LLMs during fine-tuning can persist through subsequent safety alignment including RLHF and adversarial training, surviving standard red-teaming.

Safety-aligned multimodal LLMs can be reliably jailbroken by encoding adversarial instructions as text within images, bypassing text-layer safety filters entirely.

Training data can be reconstructed from foundation model weights with significantly higher accuracy than previously reported, with implications for GDPR compliance and IP protection.

Vision-language models are highly susceptible to adversarial image perturbations, with attacks transferring across models (GPT-4V, Gemini Pro, LLaVA) at 43-74% success rates.

Query-efficient model extraction attacks against commercial LLM APIs: how adversaries reconstruct a functional shadow model using only input-output pairs, and how to defend.