2026-08-05 Red-Teaming Language Models, Part 3: What Changes When You Ship Open Weights

Part 3 of three. Once you ship open weights the refusal layer is a soft target and every deployment defense is optional for the adversary; alignment-removal costs, pretraining-stage interventions, detachable capabilities, and a release-ordered priority list.

2026-08-03 Red-Teaming Language Models, Part 2: What Holds on Defense

Part 2 of three. The best-documented defensive result, why layered safeguards can be peeled apart one classifier at a time, the adaptive-attack result that breaks most published defenses, and why agents are the current worst case.

2026-07-31 What Counts as an Adequate Threat Model?

Threat models get written as attack configurations and then reported as security claims. Four separate literatures have already worked out what the difference is, and they barely cite each other. A synthesis, the empirical evidence that almost nobody does this, and the checklist I would hold a release to.

2026-07-29 Red-Teaming Language Models, Part 1: The Process and the Measurement Problem

Part 1 of three. The red-teaming process is close to solved and the measurement is not: the converged six-phase process, how attacks are really built, and why reported attack success rates are untrustworthy.

2026-06-22 Mechanistic Interpretability as a Security Tool

Interpretability is usually pitched as a science project. The narrower, more useful case: if you can find where a model decides to do something unsafe, you can often fix it there, cheaply, instead of retraining around it. A tour of where behavior lives inside a model, what it costs to reach in, and why the same tools cut both ways.

2026-06-22 AI Literacy Audit and Rollout Plan

How to introduce agentic coding to a medium-size team, built on a Netflix training study, with a security reviewer's caveats about the productivity numbers everyone quotes.

2026-06-20 Prompt Injection, 2022 vs Today: A Retrospective

Prompt injection gets called the SQL injection of LLMs, and the comparison holds up. What the attack looked like against GPT-3 in 2022, what changed once models got tools, and what did not change at all.

2026-06-18 The Format-Reliability Gap: Diagnosing and Repairing Insecure Code Generation

A model will write you a SQL injection, then correctly identify the same bug a minute later. The knowledge is present and goes unused during generation. Tracing that gap to a single layer, and steering it away.

2026-06-15 Does AI Make You Write Insecure Code? A User Study

The security community's fast reaction to Copilot was that models trained on public code will suggest its bad patterns and developers will accept them. Our user study with 58 programmers found something more complicated.

2023-01-01 Adversarial Fine-Tuning against Prompt Injection Attacks

Prompt injection against GPT-3-era models, and a defense. Undefended, attacks landed 31% of the time, and bigger models were easier to fool. Adversarial fine-tuning dropped that to near zero on smaller variants.