Theme of inquiry
How robust are defenses against attacks on AI systems?
A question within its area, explored through 6 lines of inquiry below — each a family of specific questions the research asks.
90 specific questions
- How can simple prompt injection attacks extract reasoning trace content?
- Can repeated prompt injection compete with attention-based mitigation approaches?
- Can harmful reasoning be planted through context without fine-tuning the model?
- How do models prevent lower-level messages from spoofing higher-authority instruction sources?
- How does the copyable-rule squeeze interact with the false-alert cost squeeze?
- Why does detector performance flip sign between different model architectures?
- How does symbolic matching on tool names prevent prompt injection attacks?
60 specific questions
- Do per-hop inspection gates miss attacks that bias upstream planning signals?
- How do workflow-inspecting defenses fail when contamination enters at planning time?
- Why does workflow position amplify malicious signals in multi-agent relay chains?
- How does workflow position amplify malicious signals in multi-agent systems?
- How does workflow-level validation reconstruct risk context from coarse request-level taints?
- Why does workflow position amplify malicious signals downstream?
- How does pipeline position amplify failures between monitored agents?
73 specific questions
- Can accuracy and purpose-fit override privacy concerns about inference disclosure?
- How do inferred traits trigger stronger privacy concerns than stated memories?
- Does giving users memory control actually reduce their privacy concerns?
- How much does interface design shape privacy behavior versus underlying privacy concerns?
- Does giving users more control over AI agents actually improve privacy protection?
- What privacy expectations do users hold before learning what systems store?
- How do false mental models about AI systems affect user privacy behavior?
92 specific questions
- Why does infrastructure-side evidence matter more than agent-reported traces?
- What makes recorded transitions more trustworthy than agent reasoning trajectories?
- How should we label ground truth when a protected state change alone is ambiguous?
- What process records would independently verify that agents performed required steps?
- Can agents themselves read and rely on tamper-evident process records?
- How should verifiable process memory anchor safety-critical action logs?
- Can outcome-only reporting hide whether agent safety comes from server-side filters or the model?
64 specific questions
- Why do models hide their capabilities during safety evaluations through reasoning?
- Can deployed AI safety results hide either filters or unsafe model behavior?
- Can safety evaluations miss behavioral effects by only measuring semantic shifts?
- Can language models reliably sandbag their capabilities during safety evaluations?
- Why do models react differently to safety versus capability evaluations?
- Why do frontier AI evaluations deliberately disable safety layers to measure maximum capability?
- Why do evaluation habits hide safety-critical challenges from view?
71 specific questions
- Can evaluation environments themselves become attack surfaces for AI systems?
- Can evaluation environments themselves become security exposures during capability testing?
- Is the evaluation environment itself part of the security boundary?
- How does evaluation environment design become part of the security boundary?
- Can agentic AI systems be confined to assigned evaluation tasks during security testing?
- What makes an evaluation environment itself a security boundary?
- Why do vulnerability reproduction benchmarks miss real exploitation ability?