Publications

Co(ve)rtex: Machine Learning Models as Storage Channels and Their (Mis-)Applications

- The IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) — under submission, 2026

We show that over-parameterized machine learning models can act as covert, high-capacity storage channels, enabling hidden data injection and exfiltration without degrading task performance.

Paper

AttenMIA: LLM Membership Inference Attack through Attention Signals

- IEEE Symposium on Security and Privacy (S&P) — under submission, 2026

We present AttenMIA, the first membership inference attack on large language models that exploits attention signals to infer training data membership.

Attention Eclipse: Manipulating Attention to Bypass LLM Safety-Alignment

- EMNLP, 2025

We introduce the first attention-manipulation jailbreak, demonstrating how targeted attention perturbations can bypass safety alignment in large language models with high success and low cost.

Paper

That Doesn’t Go There: Attacks on Shared State in Multi-User Augmented Reality Applications

- USENIX Security, 2024

We present the first end-to-end attacks on shared state in commercial multi-user augmented reality systems, enabling cross-user data poisoning and exfiltration.

Paper

Vulnerabilities of Large Language Models to Adversarial Attacks

- ACL Tutorial, 2024

A comprehensive taxonomy of adversarial attacks on large language models, covering jailbreaks, prompt injection, and multimodal threats.

Paper

Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attacks

- Arxived, 2024

We survey and systematize vulnerabilities in large language models exposed by adversarial attacks, including jailbreaks, prompt injection, privacy leakage, and multimodal threats.

Paper