The process of red teaming a language model is close to solved and the measurement is not. A map of the converged six-phase process, how attacks are really built, why the numbers are untrustworthy, and how everything reorders when you ship weights.
Interpretability is usually pitched as a science project. The narrower case: if you can find where a model decides to do something unsafe, you can often fix it there instead of retraining around it.
How to introduce agentic coding to a medium-size team, built on a Netflix training study, with a security reviewer's caveats about the productivity numbers everyone quotes.
Prompt injection gets called the SQL injection of LLMs, and the comparison holds up. What the attack looked like against GPT-3 in 2022, what changed once models got tools, and what did not change at all.
A model will write you a SQL injection, then correctly identify the same bug a minute later. The knowledge is present and goes unused during generation. Tracing that gap to a single layer, and steering it away.
The security community's fast reaction to Copilot was that models trained on public code will suggest its bad patterns and developers will accept them. Our user study with 58 programmers found something more complicated.
Prompt injection against GPT-3-era models, and a defense. Undefended, attacks landed 31% of the time, and bigger models were easier to fool. Adversarial fine-tuning dropped that to near zero on smaller variants.