Theme of inquiry
How can effective AI defenses withstand adaptive adversarial attacks?
A question within its area, explored through 8 lines of inquiry below — each a family of specific questions the research asks.
48 specific questions
- How can simple prompt injection attacks extract reasoning trace content?
- Can reasoning models be backdoored during training to produce deceptive but benign traces?
- Can deliberately corrupted reasoning traces fool safety evaluation systems?
- Can harmful reasoning be planted through context without fine-tuning the model?
- How can model routing and provenance become an attack surface?
- How do adversarial triggers bypass the protections of longer reasoning chains?
- Can increasing reasoning steps make models leak more private information?
70 specific questions
- Does chain-level defense reduce but not eliminate attack success rates?
- Should defense against coordinated intrusion span multiple execution episodes?
- How does prompt hardening work differently in single-agent versus multi-agent systems?
- How do hardened prompts defend against adversarial attacks in multi-agent systems?
- How do multi-step exploitation chains make agent containment harder to achieve?
- Does prompt hardening equally protect single and multi-agent web systems?
- Can defenses at planning boundaries catch attacks that bias upstream instruction signals?
26 specific questions
- How do server-side filters hide their role in zero attack success?
- Can attack success rates hide server-side filtering or other non-adversarial defenses?
- Which backend filters silently affect the reported attack success numbers?
- How does outcome-only reporting hide a filter's role in safety results?
- Can outcome-only safety reporting hide which layer actually contained an attack?
- Do server-side filters hide the true success rate of multi-agent attacks?
- Does provider-side filtering hide true safety from outcome-only attack reports?
32 specific questions
- How does semantic taint survive paraphrase across agent hops?
- How does taint propagation track risk along delegation paths?
- Can semantic taints track influence through shared state and output aggregation?
- How does workflow-level validation reconstruct risk context from coarse request-level taints?
- Does delegation inherently trade away the contextual awareness that prevents harm?
- Can delegation prevent silent corruption in long delegated workflows?
- Can the policy oracle itself be written to by agents in the pipeline?
26 specific questions
- Can the causal model predict which cached layers to graft?
- How does context grafting compare to single-layer residual stream grafting?
- Did the causal model predict the five failures before observing them?
- Can installed sandbagging locks in small models describe uninstalled sandbagging behavior?
- Does the causal model help locate sandbagging locks with unknown passwords?
- Can auditors use layer interventions to detect installed sandbagging?
- Can refusal behavior be restored by grafting the same causal axis discovered for sandbagging?
17 specific questions
- How do decoy systems balance protecting trusted agents while deceiving attackers?
- Can decoys and genuine objects maintain identical response laws in practice?
- Do honeytokens work better against outside attackers than compromised internal agents?
- How do decoy-response bounds interact with finite-sample time constraints?
- What false-alert budget would make indistinguishable decoys tolerable in real deployments?
- Does honeytoken theory explain why planted bait cannot catch informed agents?
- What must remain secret for honeytokens to stay asymmetric against compromised insiders?
14 specific questions
- Who issues tokens and what attacks can reach them?
- What keeps the task-bound token and policy oracle isolated from poisoning?
- Who issues the task-bound token and when does issuance occur?
- Were the tested attacks actually positioned to target token issuance or policy?
- How much does authorization layer safety cost in false rejections on safe tasks?
- Can a single authorization policy distinguish licensed delegation from intrusion?
- Which of the two authorization components carries the zero percent Unsafe Action Rate?
45 specific questions
- Is the evaluation environment itself part of the security boundary?
- Can evaluation environments contain security boundaries if they hold shared resources?
- What makes an evaluation environment itself a security boundary?
- How does evaluation environment design become part of the security boundary?
- What safeguards prevent peer activity from normalizing boundary violations?
- Which explicit boundary regime change prevents unsafe actions in the benchmark?
- Can we build reusable evidence that a run stayed within bounds?