All 473 articles, sorted alphabetically
Activation Engineering, in depth: steering vectors, how to extract and apply them, probes as monitors, and what steering means for LLM security
A practical guide to activation steering: the residual stream, contrastive activation addition, PyTorch hook code to extract and apply a steering vect…
Read article →Adversarial Examples for LLMs, in depth: discrete attacks on guards, judges and retrievers, a working substitution attack, normalization and a robustness harness
Adversarial examples in text from first principles: the constraint set and threat models, character, word and sentence attacks, HotFlip and TextFooler…
Read article →Adversarial ML, in depth: threat models, FGSM and PGD, Carlini-Wagner, black-box attacks and why defenses fail
The academic foundations of adversarial machine learning as working knowledge: threat models and Lp balls, FGSM and PGD in PyTorch, margin attacks, tr…
Read article →ML-Based Adversarial Prompt Detection, in depth: data splits by attack family, baselines, fine-tuned encoders, perplexity features and adversarial training
How to build a machine learning detector for prompt injection and jailbreaks: label definitions, hard negatives and family-based splits, a char n-gram…
Read article →Adversarial Robustness Certification, in depth: threat sets, interval bound propagation by hand, CROWN, randomized smoothing CERTIFY with real numbers and how to audit a claim
How robustness certificates are computed and read: sound versus complete verifiers, interval bound propagation with a worked example, CROWN and branch…
Read article →Adversarial Training for LLM Safety, in depth: the min-max objective, R2D2, embedding and latent attacks, a PyTorch training step and honest evaluation
How adversarial training makes LLM refusals robust: the min-max objective with a utility term, data-level rounds, R2D2, continuous embedding attacks a…
Read article →Age Verification for LLM Products, in depth: signals, a resolver, policy profiles, estimation buffers and data minimisation
How to build age assurance into an LLM product: self-declaration versus estimation versus verification, Ofcom's highly effective methods, SB 243 …
Read article →Confused Deputy, in depth: authorizing agent actions with delegated tokens, the intersection rule and designation checks
How an AI agent becomes a confused deputy and how to authorize its actions properly: Hardy's authority-versus-designation split, the user-AND-age…
Read article →Agent Browser Security, in depth: why browsing agents break the same-origin model, isolation, action policy, egress control and credential brokers
How to secure LLM agents that browse and act on the web: the confused-deputy problem, a browser-specific threat model, ephemeral isolated contexts wit…
Read article →Capability Tokens, in depth: task-scoped, attenuable authority for agent tool calls with HMAC caveat chains and Biscuit
How to give AI agents capability tokens instead of ambient identity: per-task minting, an HMAC caveat chain in Python, Biscuit public-key tokens with …
Read article →Agent Code Execution Security, in depth: the six places agents run code and how to contain each
Agent code execution goes beyond a run_code tool: shell tools, model-chosen package installs, eval and templating in glue code, files run later by CI …
Read article →Agent DoS, in depth: why agents fail to terminate, how attackers induce loops, and detecting progress rather than activity
Agent denial of service through non-termination: why an agent loop has no termination guarantee, the quadratic cost of long runs, a taxonomy of loops …
Read article →Agent Kill Switch, in depth: stop levels, out-of-band control, fail-closed leases, credential revocation and drills
How to build a kill switch for LLM agents that actually stops them: stop levels from soft cancel to network isolation, an out-of-band control plane, f…
Read article →Agent Memory Security, in depth: tenant isolation, write screening, crypto-shredding and memory as an exfiltration channel
Confidentiality and lifecycle for agent memory: memory types and copies, a leak threat model, runtime-bound scope, pre-filtered vector retrieval, secr…
Read article →Agent Observability, in depth: span trees, security attributes, trace-based detection, redaction and tail sampling
Tracing LLM agents as a security control: the span model and OpenTelemetry GenAI conventions, instrumenting taint, tool risk and approvals, detection …
Read article →Agent Permission Prompt Patterns, in depth: rendering, scoping and binding human approval for AI agent tool calls
How to design permission prompts for AI agents as a security protocol: runtime-authored fields versus model rationale, once, session and rule scopes, …
Read article →Agent Planning Attacks, in depth: poisoned playbooks, forced replanning, argument smuggling and decomposition, with a provenance-checking plan validator
How attackers target the planning stage of tool-using LLM agents and how to stop them: a threat model, four attack families, a worked email-assistant …
Read article →Reversibility by Design, in depth: classifying agent actions by undoability and blast radius, and gating them in code
Make agent mistakes and injections recoverable: classify actions R0 to R3 by reversibility and blast radius, route them through a policy gate with und…
Read article →Agent Sandboxing with Docker and gVisor, in depth: a hardened run_code tool flag by flag, a runner that really stops containers, and probes that prove the boundary
How to build a code-execution sandbox for an LLM agent on one host with Docker and gVisor: the threat model, every docker run flag and what it blocks,…
Read article →Agent SSRF Protection, in depth: inventorying every URL sink, one mandatory egress path, per-sink policy and a canary test matrix
SSRF in AI agents beyond the fetch tool: browsers, document renderers, MCP discovery, connectors and code sandboxes as URL sinks, a per-sink egress pr…
Read article →Tool Bombs, in depth: how agents amplify one input into runaway tool chains, the cost arithmetic, and the budget tree that contains them
Tool bombs explained from first principles: fan-out, recursion, sub-agent spawning, loops, retry storms and oversized tool output that turn one input …
Read article →Agents + Authentication Protocols, in depth: the MCP OAuth handshake, user-absent approval, token vaults and DPoP
How AI agents should authenticate: mapping identity, delegation, resource and proof-of-possession to protocols; the MCP 2026-07-28 authorization hands…
Read article →AIBOM, in depth: SPDX 3.0 AI and Dataset profiles, binding the BOM to signed model files, and verifying a third-party model before it loads
A consumer-side guide to AI bills of materials: what an AIBOM can and cannot prove, SPDX 3.0 AI and Dataset profiles mapped against CycloneDX, binding…
Read article →AI Governance Program Structure, in Depth
How to structure an AI governance program: three-lines operating model, hub and spoke roles, inventory and risk tiering as code, lifecycle gates, one …
Read article →AI Security Research Organizations, in depth: what each kind of producer can prove, reading papers as threat claims, and a research-intake pipeline
How to consume AI security research from academic groups, frontier labs, government institutes, independent evaluators and standards bodies: the evide…
Read article →Anomaly Detection for LLM Usage, in depth: usage telemetry, seasonal robust baselines, behavioural signals and measuring recall with injected incidents
How to detect stolen API keys, runaway agents, cost spikes and extraction scraping from LLM usage telemetry: what to log, per-entity seasonal baseline…
Read article →API Key Management for LLM Services, in depth: issuing keys with scannable formats, hashed storage, scopes, token budgets, rotation and leak reporting
The issuer side of LLM API keys: designing prefixed, checksummed keys, storing keyed hashes instead of secrets, a fast fail-closed request path, scope…
Read article →Audit Logging for LLM Apps, in depth: capture points, streaming and retries, the decision record and proving completeness
Building an LLM audit trail that is complete: which component captures what, correlating agent steps, at-least-once delivery with intent and outcome e…
Read article →Automated Red Teaming for LLMs, in depth: objectives as behaviour specs, attack generator families, a quality-diversity search loop and a calibrated judge
How automated red-teaming engines work: objectives with rubrics, generator families from mutators to PAIR, TAP, Rainbow Teaming and GCG, a Python sear…
Read article →AWS Bedrock Guardrails, in depth: policies, inline vs ApplyGuardrail, grounding checks, IAM enforcement and the blind spots
How Amazon Bedrock Guardrails works in a real request path: content, prompt attack, topic, word, PII and grounding policies, Converse guardContent rul…
Read article →Azure AI Content Safety, in depth: endpoints, severity policy, Prompt Shields, groundedness, a gateway and threshold calibration
Engineering guide to Azure AI Content Safety: what each endpoint returns and its limits, turning severity levels into a per-surface policy, where inpu…
Read article →Backdoor Detection in Models, in depth: implementing data, model and input-time detectors and measuring them on planted backdoors
A practitioner's guide to backdoor detection: what each detector decides, spectral signatures and activation clustering with runnable code and sy…
Read article →Bias Detection in LLMs, in depth: paired counterfactual probes, BBQ's two bias scores, decision probes, judge reliability and a CI gate
How to detect bias in generative language models: allocational and representational harms, paired counterfactual probe design, template-level statisti…
Read article →Chinese AI Regulations, in depth: engineering for the 2026 anthropomorphic AI interaction measures, from session and dependence controls to crisis escalation, minor mode and assessment triggers
How to build an AI companion or character service that meets China's 2026 Interim Measures on anthropomorphic AI interaction: scope, a relationsh…
Read article →Citation Verification, in depth: proving every reference an LLM emits is real, permitted, intact and safe to render
How to verify LLM citations as a security control: fabricated, unauthorised, stale, laundered and weaponised references, an evidence ledger with opaqu…
Read article →The AI Safety Race, in depth: why competition erodes safety effort, a runnable race model, coordination mechanisms and release gates a deadline cannot move
The AI safety race as an engineering problem: a runnable model showing how closeness, rival count and enmity lower safety effort, how lab frameworks, …
Read article →Confidential Computing for LLM Inference, in depth: what the end user can verify, with attestation roles, encrypting to the node, OHTTP relays, transparency logs and metadata
Confidential LLM inference from the client's side: the RATS roles, why requests must be encrypted to an attested node rather than to a TLS front …
Read article →Consent Flows for AI Training + Data, in depth: lawful basis per purpose, an event-sourced consent ledger, pinned dataset snapshots and withdrawal
Engineering consent for AI training: consent as one of six GDPR bases, EDPB Opinion 28/2024 and legitimate interest, a purpose taxonomy, an append-onl…
Read article →Constitutional AI for Safety, in depth: from self-critique training to constitutional classifiers that guard inputs and streamed outputs
How constitutions secure LLM applications: a recap of Constitutional AI training, why it is not a security boundary, Constitutional Classifiers and wh…
Read article →Continuous Red Team Pipeline, in depth: triggers, a versioned attack corpus, calibrated scorers, confidence-bound release gates and finding promotion
How to run LLM red teaming as a CI/CD pipeline: change triggers and suite planning, a versioned corpus with placeholders and canaries, static, mutated…
Read article →Copyright and AI Training, in depth: what courts have decided and the controls engineering teams should build
An engineering guide to copyright and AI training as of October 2026: Bartz, Kadrey, Thomson Reuters v. ROSS, Getty v. Stability and GEMA v. OpenAI, t…
Read article →Cost-Based Abuse Detection, in depth: pricing every request, per-entity spend baselines, burn horizon, cost shape and a leaked-key worked example
Detect LLM API abuse by what it costs: inline pricing, a per-entity spend ledger, EWMA baselines on log spend, burn horizon, cost-shape and linkage de…
Read article →Crescendo Attack, in depth: gradual multi-turn escalation, why per-message filters miss it, and conversation-level defence
How the Crescendo multi-turn jailbreak escalates through a model's own replies, why per-message filters miss it, a conversation-level monitor in …
Read article →Data Exfiltration via LLM Tools, in depth: every write-capable tool as a sink, a multi-call attack trace, data-flow labels at the tool gateway, covert-channel capacity and plan/execute separation
How tool-using LLM agents leak data through their own tool calls, and how to stop it: the private data, untrusted input and outbound channel condition…
Read article →Data Governance for AI, in depth: source manifests, admission gates, dataset lineage and deletion requests against trained models
Governing AI training data end to end: source manifests with purposes and licences, a fail-closed admission gate, immutable dataset versions, record-t…
Read article →Data Poisoning, in depth: attack goals, how poison enters training data, and an ingestion pipeline that resists it
How training-data poisoning works for LLMs: availability, targeted and backdoor goals, clean versus dirty labels, the fixed-count result from 2025, sp…
Read article →Web-Scale Data Poisoning Defenses, in depth: owning the snapshot, domain continuity checks, survival windows, cluster-shape budgets and canary measurement
How to engineer poisoning defences into a web-scale pretraining corpus: crawl-time hashing, RDAP and drift signals for re-registered domains, revision…
Read article →Deception Detection in LLM Outputs, in depth: reconciling what an agent says it did with what it actually did
Runtime detection of deceptive self-reports in LLM agents: why intent is unobservable but self-reports have ground truth, an append-only trace, typed …
Read article →Safe Prompting via DSPy Signatures, in depth: typed contracts, policy checks, Refine and injection-aware optimisation
Using DSPy signatures as a safety layer: what typed fields do and do not protect, prompt injection through input fields, code-level policy checks, Ref…
Read article →Egress Control for Agents, in depth: task-scoped grants, taint-aware narrowing and an egress broker for tool calls
Why host allowlists cannot stop agent exfiltration through allowed destinations, and how to build an egress broker: task-scoped grants, session data-c…
Read article →Emergency Disclosure Procedures, in depth: deciding to disclose before a fix, break-glass authority, interim mitigations, out-of-band advisories and staged fan-out for AI systems
What to do when an AI vulnerability is exploited or its details are public before a fix exists: emergency triggers, pre-delegated authority, a testabl…
Read article →Employee AI Usage Policies, in depth: tool tiers, a data-by-tier matrix, enforcement and a policy register in code
Writing an employee AI usage policy that people can follow and security can enforce: risks, tool tiers by plan and configuration, a data classificatio…
Read article →Ethics Engineering, in depth: testable requirements, a register as code, statistical release gates, runtime controls and drift telemetry
How to engineer ethics into an LLM product: rewrite principles as testable requirements, store them as a YAML register, gate releases on confidence bo…
Read article →EU AI Act, in depth: an engineering guide to classification, evidence and the 2026 to 2028 deadlines
The EU AI Act for engineers: roles, the risk tiers, how to classify a system, what high-risk obligations mean as artefacts (risk management, data gove…
Read article →Fairness Auditing for AI Systems, in depth: running an independent bias audit, NYC Local Law 144 impact-ratio mechanics, small cells, statistical power and a reproducible evidence pack
How to run a fairness audit that others can rely on: scoping, demographic data and unknowns, LL144 selection and scoring rates, intersectional tables …
Read article →Federated Fine-Tuning, in depth: client drift, server optimizers, SCAFFOLD, heterogeneous LoRA and what each choice does to privacy
Federated fine-tuning of LLMs beyond basic FedAvg: client drift on non-IID silos, FedAdam, FedProx and SCAFFOLD with code, FFA-LoRA and heterogeneous …
Read article →Federated Prompt Engineering
Cross-org sharing of prompt patterns. Community-curated repositories, collective benefit and collective risk. Best practices for publishing, consuming…
Read article →Future of LLM Security, in depth: agents, the lethal trifecta and the controls to build now
A grounded look at where LLM security is heading as of October 2026: why agents turn prompt injection into a structural risk, six labelled forecasts t…
Read article →Garak, in depth: the plugin model, scanning your real application over REST, reading report.jsonl, a CI gate and custom probes
Practical guide to NVIDIA's garak LLM vulnerability scanner: generators, probes, detectors, buffs and evaluators, a first run, scanning a deploye…
Read article →GCG, in depth: how Greedy Coordinate Gradient finds universal adversarial suffixes, why they transfer, and how to defend and test against them
A defender's guide to the GCG attack on aligned language models: the target-string objective, the gradient-guided token-swap search with its publ…
Read article →GDPR Right to Erasure Applied to LLMs, in depth: Article 17 across stores, corpora and model weights
How to honour GDPR Article 17 erasure requests in LLM systems: the legal grounds, exceptions and deadlines, whether weights hold personal data, retrai…
Read article →Guardrails AI, in depth: guards, validators, on_fail actions, reasks and the failure modes that make a guard decorative
How the Guardrails AI framework actually works: the Guard, Validator and ValidationOutcome objects, input and output targets, the eight on_fail action…
Read article →HHH, in depth: helpful, honest and harmless as an engineering specification, from preference data to release gates
Helpful, honest and harmless as something you can build and measure: where the framing came from, why the three properties conflict, how preference mo…
Read article →AI Feature Review Board, in depth: trigger rules over a feature manifest, review packets, conditional approvals enforced at launch, and re-review triggers
How to run a review board for high-risk AI features: trigger predicates over a versioned feature manifest, the review packet, four decision outcomes, …
Read article →Human-in-the-Loop for High-Risk Actions, in Depth
Making human review of high-risk AI actions an effective control: defining high risk, deterministic routing policy as code, platform-built evidence pa…
Read article →AI Impact Assessment, in depth: one record for FRIA, DPIA and ISO/IEC 42005, Canada's AIA scoring as code, a worked triage example and reassessment triggers
How to run an AI impact assessment that holds up: how it differs from risk assessment and DPIAs, EU AI Act Article 27 and ISO/IEC 42005, one record wi…
Read article →Indirect Injection, in depth: signature-based detection of poisoned content, normalisation, scoring and where signatures stop working
How to detect indirect prompt injection with signatures: where to scan, normalising zero-width, Unicode tag, base64 and hidden-CSS tricks, structural …
Read article →Injection via LLM-Generated Summaries, in depth
How LLM-generated summaries carry indirect prompt injection: the summary as payload (the 2025 Gemini email-summary proof of concept) and as carrier in…
Read article →Input Classifier, in depth: training a prompt injection detector, label design, leak-free data splits, windowing long inputs, calibration and evasion
How to build and run an input classifier for prompt injection: what the label should mean, Llama Prompt Guard 2 as a reference, attack and hard-negati…
Read article →Insurance for AI Systems, in depth: silent AI, the 2026 generative AI exclusions, affirmative cover and a loss-scenario register
How insurance responds to losses caused by AI systems you operate: silent AI, the ISO generative AI exclusions for general liability, affirmative AI l…
Read article →Jailbreaks, in depth: the DAN lineage and its variants, why hand-written prompts work, and how to test against them
A defender's guide to hand-written LLM jailbreaks: what the DAN lineage and its variants (persona override, fiction and role-play, refusal suppre…
Read article →LangChain Security Considerations, in depth: CVE lessons, trust boundaries, dangerous flags, safe tools and agent middleware
A security review method for LangChain applications: lessons from CVE-2023-29374, CVE-2023-36189, CVE-2023-46229 and LangGrinch CVE-2025-68664, trust …
Read article →LLM Data Exfiltration
How data leaves an LLM app: injection plus an egress channel. Markdown image rendering, tool calls, side channels, and the controls that stop them.
Read article →LLM Denial of Service in Depth: The Cost of an Inference Request, the Attacks That Exploit It, and a Layered Admission Architecture
Why LLM endpoints fail differently under attack: the prefill, decode and KV-cache cost model, long-input, max-output, reasoning-inflation, agent-loop …
Read article →LLM Deployment Safety Checklist, in depth: evidence-backed release gates, checklist as code, honest eval statistics and staged rollout
A release-gate checklist for LLM features: versioning the model, prompt, tool and filter bundle, four gates with owners, evidence, criteria and expiry…
Read article →LLM Deployment Hardening
Hardening LLM deployments in production: container security with distroless images, network isolation with VPC and TLS, secrets with Vault, input vali…
Read article →LLM Hallucination Risk
Hallucination as a security and reliability risk: the harm taxonomy, fabricated identifiers, induced fabrication, and how to measure a hallucination r…
Read article →Indirect Prompt Injection in Depth: Threat Model, a Worked Attack Trace, and Architectural Defenses for Agents
How indirect prompt injection works when LLM applications read web pages, email, documents and tool output: the trust-boundary threat model, a step-by…
Read article →LLM Jailbreaking in Depth: Why Safety Training Fails, How Attacks Are Found, and How to Threat-Model Your Own Product
A first-principles guide to LLM jailbreaking: how jailbreaks differ from prompt injection, the research explaining why safety training fails (competin…
Read article →LLM Observability Platforms, in depth: the trace data model, collector-side redaction and sampling, the evaluation loop, securing the prompt store and choosing a platform
How LLM observability platforms work and how to run one safely: traces, spans, scores and prompt versions, OpenTelemetry GenAI attributes, collector r…
Read article →LLM PII Leakage
Why language models memorize personal data from their training corpus, what drives it (duplication, capacity, context), and the defenses that actually…
Read article →LLM Abuse Detection Architecture in Depth: Signals, Entity Risk Scores, Graduated Enforcement and Review
How to design abuse detection for an LLM product or API: a threat taxonomy, inline and asynchronous detection paths, the entity graph, features and de…
Read article →AdvBench, in depth: what the dataset contains, how its metrics work, measured redundancy and how to use it responsibly
A practical guide to AdvBench: the two published files and their real row counts, the GCG target design, prefix-based versus judge-based attack succes…
Read article →Agent hijacking, in depth: how untrusted data takes over tool-using agents, and the designs that stop it
Agent hijacking explained from the attack chain to the defences: how injected content redirects an agent's goal and tool calls, why detection alo…
Read article →Agent Hijacking Attacks, in depth: building a hijack evaluation harness that scores actions, not words
How to measure agent hijacking: the anatomy of a test case (user task, injection task, vector, template), sandboxed fake tools, state-based scoring, u…
Read article →Agent Memory Poisoning, in depth: write paths, delayed triggers, provenance, scoped stores and recovery
How attackers plant content in agent memory that fires in later sessions, the research behind it, and the defences that work: provenance-tagged record…
Read article →Agent Tool Permissions: Least Privilege Between a Model and Real Actions
Why an LLM agent's security must live in a broker outside the model — per-tool allowlists, argument constraints, identity scoping, approval gates…
Read article →Agentic Alignment, in depth: overreach, reward hacking, goal conflict and misreporting over long trajectories, and the contracts, gates, monitors and scenario evals that catch them
Why models that behave in chat can misbehave as agents: horizon, side effects and instrumental pressure; four failure patterns; what the Agentic Misal…
Read article →Agentic AI Boundaries, in depth: the Rule of Two as a session invariant, boundary manifests and tests that keep an agent inside its envelope
How to draw and enforce boundaries for AI agents: why per-tool permissions miss dangerous combinations, the Agents Rule of Two as a session-level inva…
Read article →AI in Advertising, in depth: claim gates for generated creative, delivery-skew monitoring, ads inside AI assistants and the controls each needs
Engineering AI advertising safely: an evidence-registry claim gate for generated copy, the FTC fake-review rule, delivery skew and the Meta housing se…
Read article →AI in Agriculture, in depth: input integrity, prescription guards, grounded advisors and safe autonomy
Securing agricultural AI: a threat model from sensors to sprayers, GNSS and RTK integrity, deterministic guards on variable-rate prescriptions, label-…
Read article →AI Alignment, in depth: outer and inner alignment, specification gaming, reward overoptimization, sycophancy and deception, and how engineering teams turn them into evals and release gates
A first-principles map of AI alignment for practitioners: the gap between intended, specified, learned and deployed objectives, documented failure cla…
Read article →AI Alignment Research, in depth: the agendas and what each produces, model organisms, control evaluations with a runnable toy, and how to read a result critically
How alignment research works as a method: a map of agendas (feedback training, scalable oversight, interpretability, model organisms, evals, control),…
Read article →AI in Autonomous Vehicles, in depth: the attack surface of a learned driving stack, from sensor spoofing to typographic attacks on driving VLMs
Security of AI in autonomous vehicles: the driving stack and its attack surface, published physical, sensor and VLM attack classes, why learned percep…
Read article →AI in Aviation, in depth: assurance frameworks, the attack surface, runtime monitors, poisoning, spoofed sensors and ground-side LLM tools
Securing machine learning in aviation: how DO-178C, DO-326A and EASA learning assurance apply, where attackers reach training data, models, sensors an…
Read article →AVID, in depth: the AI Vulnerability Database's report and vulnerability records, SEP and lifecycle taxonomy, avidtools in code and garak conversion
AVID, the AI Vulnerability Database, in depth: what it records and what it does not, report vs vulnerability records field by field, the SEP effect vi…
Read article →AI Banking Operations, in depth: payment repair, re-screening, injected beneficiaries, reconciliation breaks and maker-checker with AI
Securing AI in bank back-office operations: an AI proposer for payment exception repair, material-field classification and sanctions re-screening, inj…
Read article →AI Bill of Materials, in depth: CycloneDX ML-BOM fields, generating it in the pipeline, blast-radius queries and VEX decisions
A practical guide to AI bills of materials: which questions an AIBOM answers, CycloneDX 1.6 model and data fields checked against the schema, a genera…
Read article →AI Bill of Rights and Regulation, in depth: turning notice, explanation, human fallback and non-discrimination into features an engineering team can build and prove
What the 2022 Blueprint for an AI Bill of Rights actually was, where its five principles live on in binding rules as of September 2026 (EU AI Act, Col…
Read article →AI Blue Team, in depth: charter, AI asset inventory, coverage mapping, tested detections and continuous control validation
Running an AI blue team as a program: charter and boundaries, an AI asset inventory with reconciliation, coverage mapped to the OWASP LLM Top 10, dete…
Read article →AI in Border and Immigration, in depth: screening base rates, biometric errors, LLMs in casework, threats and EU AI Act duties
An engineering guide to AI in border and immigration systems: where models sit, a referral architecture with no automated refusal, base-rate arithmeti…
Read article →AI in Broadcasting, in depth: securing the chain from ingest to transmission against synthetic media, injection and live AI failures
A security view of AI in broadcasting: the chain from ingest to air, a threat model, provenance and verification for synthetic media, prompt injection…
Read article →AI Business Continuity, in depth: impact analysis per capability, degradation ladders, eval-gated failover, attacker-induced fallbacks and drills
Keeping AI-dependent business processes running through provider outages, rate limits, model retirement and budget exhaustion: impact analysis per cap…
Read article →CISO Role in AI Security, in depth: ownership, inventory, tiered controls, shadow AI, vendors and board reporting
What a CISO should own in AI security: a RACI with AI, privacy and legal peers, a multi-source AI inventory with risk tiers, OWASP-mapped control owne…
Read article →AI in Climate Modeling, in depth: securing ML weather and climate pipelines from reanalysis to downscaled risk maps
Integrity risks and controls for ML weather and climate systems: dataset manifests and plausibility checks, pinned and weights-only checkpoints, leaka…
Read article →AI in Clinical Trials, in depth: risk by use case, GCP and Part 11 controls, blinding firewalls, evidence-checked pre-screening and audit trails
Securing LLMs in clinical trials: use cases ranked by influence and consequence, ICH E6(R3), Part 11, HIPAA and FDA credibility rules, a reference arc…
Read article →AI + Clinician Workflow, in depth: engineering ambient documentation with consent gates, evidence-linked drafts, forced review and safe EHR write-back
How to engineer an ambient AI documentation workflow for clinicians: consent and capture, speech-to-text and drafting errors, a sentence-level verifie…
Read article →AI Compliance Audit, in depth: criteria, risk-based scope, re-performing evaluation gates, sampling AI change populations and writing findings
How to conduct an AI compliance audit from the auditor's side: engagement types including SOC 2 and ISO/IEC 42001 certification, audit criteria, …
Read article →AI Compliance Maturity Model, in depth: capability dependencies, evidence-defined levels, calibrated assessors and a roadmap built from the graph
How to build and run an AI compliance maturity model: eleven capabilities, evidence-defined levels with freshness rules, dependency-capped effective s…
Read article →AI Compliance Metrics, in depth: coverage, effectiveness and timeliness computed from control-test data
How to build AI compliance metrics that survive an audit: metric definitions as code, coverage, effectiveness and timeliness families, SQL over contro…
Read article →AI Compliance Program, in depth: obligations registers, traceability, exceptions and regulator interfaces
How to engineer an AI compliance program: regulatory change intake, an atomic obligations register with applicability predicates, nightly obligation-c…
Read article →AI Compliance Reporting, in depth: frozen snapshots, reproducible report builds, incident clocks, sign-off and restatements
Engineering AI compliance reports that survive scrutiny: report types and audiences, as-of snapshots with hashed manifests, a reproducible builder, EU…
Read article →AI Compliance Training, in depth: role-based curricula as data, event-driven assignment, access gates, behavioural assessment and audit-grade evidence
Engineering AI compliance training as a control: the EU AI Act Article 4, ISO/IEC 42001 and NIST AI RMF requirements, a role matrix, curriculum as cod…
Read article →AI Contracts, in depth: definitions that decide data use, conditional IP indemnities, LLM-shaped SLAs and back-to-back flow-down
How to read and enforce an AI vendor agreement as an engineer: the document stack, definitions of customer data and feedback, retention and training t…
Read article →AI + Copyright, in depth: who owns generated output, evidence of human authorship, licence contamination in generated code and labelling
The output side of AI copyright as of October 2026: the human authorship rule and what remains protectable, a contribution ledger and generation gatew…
Read article →AI in Courts, in depth: risk scores after Loomis, invented citations, a verification gate and machine-generated evidence
How AI is used in courts and how to build it safely: what State v. Loomis decided about risk scores, why language models invent case law, a blocking c…
Read article →AI in Creative Writing, in depth: securing a writing assistant with manuscript confidentiality, a harm-based fiction policy, injection defences and disclosure-grade provenance
How to build a secure AI writing assistant: the WGA, copyright and retailer rules that shape it, manuscript confidentiality, a fiction policy that jud…
Read article →AI Credit Decisions, in depth: authority separation, reason codes from model attributions, decision records and attacks on the credit pipeline
How to build and secure an AI credit decision pipeline: Regulation B notice constraints, one component with decision authority, SHAP-style attribution…
Read article →Fair AI Credit Scoring, in depth: proxy audits, inferred-attribute testing, less discriminatory alternatives and reject-inference bias
How to build a credit score that can be shown to be fair: BISG-weighted disparity testing without protected attributes, adverse impact ratio and SMD w…
Read article →AI Customer Trust, in depth: turning trust-page promises into enforced, tested and customer-verifiable commitments
An engineering guide to customer trust for AI products: the questions enterprise buyers ask, a commitment registry that binds each promise to a contro…
Read article →CVE for AI Systems, in depth: what qualifies, real AI CVEs, triage with reachability and VEX, scoring model-mediated flaws and issuing records
How CVE works for AI systems: CNAs and scope, which AI flaws fit a CVE and which do not, LangChain, Ollama and PyTorch case studies, OSV-based triage …
Read article →Dangerous Capabilities, in depth: re-measuring what your fine-tunes, tools and weight releases change, with a capability regression gate
Dangerous AI capabilities from the deployer side: the domains frontier frameworks track, why fine-tuning, tools and open weights move capability score…
Read article →AI Deception Detection, in depth: evaluating a deception detector with belief-checked labels, confound controls, recall at a fixed false-positive rate and red-teaming
How to tell whether an LLM deception detector actually works: labels grounded in elicited beliefs, dataset sources, confound slices, threshold calibra…
Read article →AI in Delivery, in depth: securing support agents, delivery-note injection, refund policy engines, address takeover, location privacy and faked evidence
A security view of AI in last-mile delivery: trust boundaries, threat actors, prompt injection through delivery notes, a policy-engine refund tool in …
Read article →AI Diagnosis + Liability, in depth: who is exposed for a missed diagnosis, the standard-of-care trap, the device boundary and the decision record
How liability for AI-assisted diagnosis is allocated among clinician, hospital and vendor; the standard-of-care asymmetry; the FDA's 2026 CDS cri…
Read article →AI in Disaster Response, in depth: grounded extraction, corroboration against rumours, crisis data protection and offline operation
A security and safety guide to AI in disaster response: threat model, a crisis information pipeline, LLM extraction that refuses to invent locations, …
Read article →AI Disclaimers, in depth: domain limits, system-rendered copy, streaming and API surfaces, evidence logs and why a disclaimer is not a control
How to engineer AI disclaimers that reliably appear: provenance labels, domain limits and verify notices, why model-written caveats fail, a versioned …
Read article →AI Vulnerability Disclosure Norms, in depth: deadlines for flaws without patches, publication detail, cross-vendor notice, open weights and safe harbour
AI vulnerability disclosure norms: where CVD deadlines came from, which assumptions AI flaws break, split clocks for model-behaviour flaws, a publicat…
Read article →Data Protection Officer for AI, in depth: when a DPO is mandatory, independence and conflicts, an AI intake gate with DPIA screening, and the AI Act interplay
The DPO's role in AI programmes: GDPR Articles 37 to 39, mandatory designation tests, independence and the X-FAB conflict ruling, an AI intake ga…
Read article →AI Disaster Recovery + BCP, in depth: asset inventories, immutable signed backups, timeline-based restore points, clean-room recovery and continuity tiers
Disaster recovery and business continuity for AI systems as security work: inventory weights, prompts, corpora, indexes and eval sets; immutable signe…
Read article →AI + EMR Integration, in depth: SMART on FHIR scopes, backend services, CDS Hooks and safe write-back for LLM features
How to connect LLM features to an EHR securely: SMART app launch with PKCE and v2 scopes, backend-services JWT clients, verifying CDS Hooks calls, dra…
Read article →AI in Energy, in depth: forecast integrity, stealthy false data injection against state estimation, DER dispatch envelopes and NERC CIP for grid AI
Securing AI used by grid operators: independent baselines for load and renewable forecasts, why residual tests miss a = Hc injection attacks (with cod…
Read article →AI in Environmental Monitoring, in depth: tamper-evident sensor data, calibration integrity, plume detection limits and report drafters that cannot invent a reading
Securing AI-driven environmental monitoring: who tampers with emissions and air-quality data, signed sensor readings with physics and peer checks, pro…
Read article →AI Ethics, in depth: turning principles into decisions, controls and evidence for an LLM product
AI ethics as an engineering discipline: why principle lists do not ship, mapping stakeholders and harms, turning value conflicts into written decision…
Read article →AI Ethics Board, in depth: forms, charter, independence, triage, decision records and what makes a board matter
How to design an AI ethics board that has an effect: internal, advisory and independent forms, lessons from public failures, a machine-readable charte…
Read article →AI Ethics Officer, in depth: scope against CISO and legal, decision rights, tiering as code, a worked review with enforceable conditions, and metrics for the function
How to make the AI ethics officer a working role: scope against CISO, privacy, legal and the board, three decision rights with an escalation clock, in…
Read article →AI in Events, in depth: face check-in under BIPA and GDPR, consent and deletion in code, securing the attendee concierge, and a worked conference design
Security and privacy engineering for AI at conferences: 1:1 face verification versus identification, BIPA after the 2024 amendment, GDPR and EU AI Act…
Read article →AI Export Controls, in depth: classifying chips, weights and cloud access, a dated rule register, screening as a pipeline and the IaaS knowledge trigger
An engineer's guide to US export controls for AI: 3A090 TPP arithmetic, the status of model-weight controls, the 2025 rescission and guidance, th…
Read article →FDA AI/ML Regulation, in depth: device status, PCCPs and lifecycle controls
An engineer's guide to FDA regulation of AI and ML medical software: when software is a device, the January 2026 CDS changes for LLM features, 51…
Read article →AI in Film, in depth: securing scan and voice data, consent bound to asset hashes, render-time authorisation and the rules productions must encode
A security engineering guide to AI in film and television production: the SAG-AFTRA replica terms, California AB 2602 and AB 1836, EU Article 50(4), a…
Read article →AI + Finance Customer Interactions, in depth: the advice boundary, disputes, vulnerable customers and scams in customer-facing assistants
Customer-facing AI in finance: binding statements, the education versus advice boundary, complaints and disputes that start regulatory clocks, vulnera…
Read article →AI + Finance LLMs, in depth: a threat model and control architecture for LLMs in financial services
Securing LLM systems in banking, payments and capital markets: a finance threat model, a policy engine that holds authority instead of the model, numb…
Read article →AI Finance Regulation, in depth: SR 26-2, credit decisions, the EU AI Act and DORA for AI systems
How AI in banking, lending and insurance is regulated in 2026: SR 26-2 replacing SR 11-7 and its generative AI exclusion, ECOA adverse-action reasons,…
Read article →AI Forecasting, in depth: evidence sources, resolvable questions, trend fits with uncertainty, proper scoring and tripwires that move security controls
How to use AI capability forecasting in security planning: input and capability trends, benchmarks and surveys, writing resolvable questions, a bootst…
Read article →AI Forensics, in depth: evidence, chain of custody, timelines, replay and context ablation for LLM and agent incidents
How to investigate an incident in an LLM application or agent: what makes AI evidence different, the evidence inventory and its volatility, preservati…
Read article →AI in Forestry, in depth: geolocation laundering, change detection that abstains, carbon over-crediting and an LLM that reads supplier documents but cannot decide
A security view of forestry AI: the evidence chain behind deforestation-free and carbon claims, geometry gates against plot laundering, three-state ch…
Read article →AI Fraud Detection, in Depth
AI fraud detection as an adversarial security problem: boundary probing and evasion, label poisoning through confirmation channels and disputes, AI-ge…
Read article →AI in Gaming, in depth: securing LLM-driven NPCs, server-authoritative action validation, rating-consistent output, voice moderation and performer consent
Security and governance for AI in games: the threat model for LLM NPCs, an architecture where the game server stays authoritative, an action validator…
Read article →AI Governance Research, in depth: the questions it asks, the levers it studies, and how its findings become engineering obligations
What AI governance research studies and who produces it, the four levers (compute, evaluations, incident reporting and transparency, liability), how f…
Read article →AI in Government, in depth: impact tiers, rights-safe decision pipelines, verified citations, disparity monitoring and procurement controls
Securing AI in government: classify uses by impact, keep adverse decisions human, build decision records with pinned versions and verified citations, …
Read article →AI Hall of Shame, in depth: public AI failures on the record, the six patterns behind them, and how to turn each case into a regression test
A practical AI hall of shame: well-documented public failures from Tay to EchoLeak, stated only as courts, regulators and papers recorded them, reduce…
Read article →AI Health + LLMs, in depth: engineering a patient-facing health assistant with emergency escalation, dose guards, grounded answers and physician-graded evaluation
How to build a patient-facing health LLM safely: failure catalogue, intended use and the 2026 FDA CDS guidance, fail-closed emergency escalation, keep…
Read article →AI Incident Playbooks, in depth: playbook anatomy, playbooks as linted data, a scenario catalogue, pre-authorised actions and a leak run against the clock
How to write AI incident playbooks that work under pressure: the fields every playbook needs, YAML playbooks with a CI linter, six AI-specific scenari…
Read article →AI Incident Databases, in depth: public sources and their biases, a schema for your own, report deduplication, Article 73 clocks and incident-to-eval loops
How to use public AI incident databases (AIID, OECD AIM, AIAAIC, AVID, MITRE ATLAS) without misreading them, and how to run your own: definitions, a r…
Read article →AI in Insurance, in depth: use-case risk tiers, the NAIC bulletin and NYDFS Circular Letter 7, LLM claims intake, document injection and fairness testing
Securing and governing AI used by insurers: a risk map from pricing to claims, NAIC, NYDFS, Colorado and EU AI Act expectations, an LLM claims archite…
Read article →AI in Intelligence, in depth: ICD 203 tradecraft as pipeline controls, estimative-language linting, independent corroboration, deception and classification boundaries
How to use language models in intelligence analysis without breaking analytic standards: where models fit, ICD 203 tradecraft mapped to controls, esti…
Read article →AI Interpretability, in depth: choosing attribution, lenses, probes and causal tests for security work, and how explanations get attacked
A method-selection guide to AI interpretability for LLM security: integrated gradients with a completeness check, logit and tuned lenses, linear probe…
Read article →AI in Journalism, in depth: protecting sources, gating fabricated quotes, resisting injection in leaked documents and verifying synthetic media
A security engineering view of AI in newsrooms: threat model, sensitivity tiers and routing code, prompt injection in document dumps, a quote verifica…
Read article →AI + KYC/AML, in depth: onboarding attacks, name screening, transaction monitoring and an evidence-bound LLM case assistant
How machine learning and LLMs fit the KYC/AML control chain: FATF obligations and SAR deadlines, injection attacks on remote onboarding, Jaro-Winkler …
Read article →The AI Labs Security Ecosystem, in depth: ATLAS, OWASP, open scanners, lab programmes and institutes, and how an application team plugs in
A working map of the AI security ecosystem for engineers: what model labs publish, MITRE ATLAS and OWASP as shared vocabulary, open tooling such as ga…
Read article →AI in Law Enforcement, in depth: LLM-drafted police reports, face recognition leads, patrol feedback loops and evidence-grade controls
An engineering guide to police AI: provenance for LLM-drafted reports under Utah SB 180 and California SB 524, the base-rate arithmetic of face search…
Read article →AI Liability, in depth: legal theories, the cases so far, the EU product liability rules for software, supply-chain contracts and engineering controls that reduce exposure
Who pays when AI output causes harm: contract, negligence, misrepresentation and product liability theories, Moffatt v. Air Canada and other cases, th…
Read article →AI Liability Regulations, in depth: who becomes the manufacturer when you fine-tune or re-brand a model, which releases restart exposure, and the evidence pipeline the rules assume
Liability regulation as an engineering input: conduct versus liability rules, the 2026 instruments, role determination under the revised EU Product Li…
Read article →AI Model Licenses, in depth: permissive, community and use-restricted terms, derivatives, distillation and a license gate for model artifacts
How open-weight model licenses work in practice: the three license families, the clauses that matter, how terms follow fine-tunes, merges, quantizatio…
Read article →AI Model Lifecycle Security, in depth: chain of custody from data intake to retirement, manifests, promotion gates and load-time verification
Securing an AI model across its whole life: digest-based chain of custody, data intake and training controls, contamination-aware evaluation, a promot…
Read article →AI in Logistics, in depth: freight fraud threat model, per-field provenance, bank-change verification, carrier identity scoring and robot safety boundaries
A security-focused guide to AI in logistics: a freight document architecture where the LLM has no write authority, per-field provenance, a bank-change…
Read article →AI in Maritime, in depth: spoofed GNSS and AIS, injected port documents, OT boundaries and the MASS Code
A security engineering guide for maritime AI: trust boundaries on ship and ashore, a threat model, plausibility gating for GNSS and AIS, prompt inject…
Read article →NIST AI RMF Maturity, in depth: why the framework has no levels, an evidence-based scale over 72 subcategories, scoring code and a gap roadmap
How to measure maturity against the NIST AI RMF honestly: profiles versus tiers, a five-level evidence-defined scale, per-system scoring and floor rol…
Read article →OWASP AI Maturity Model, in depth: the AIMA grid, evidence rubrics, floor-based scoring and a worked roadmap
How the OWASP AI Maturity Assessment (AIMA v1.0) works: eight domains, two streams and three levels inherited from SAMM, scoping by system, evidence r…
Read article →AI Medical Devices, in depth: the attack surface, input integrity, signed models, safe abstention, drift versus attack and LLM components
Security engineering for AI medical devices: the ML-specific attack surface, input provenance and intended-use envelopes, evasion and poisoning, signe…
Read article →AI + Medical Records, in depth: building an LLM chart assistant with patient-scoped retrieval, sensitivity labels, injection-safe notes and verified citations
Engineering an LLM feature that reads electronic health records safely: SMART on FHIR scopes and the user's own token, per-patient retrieval, HL7…
Read article →AI in Music, in depth: training provenance, voice consent, output similarity gates, disclosure and streaming-fraud controls
Engineering controls for generative music as of October 2026: the Suno and Udio cases and GEMA rulings, a two-layer rights ledger, voice consent and s…
Read article →AI in Ocean Science, in depth: securing ML pipelines built on floats, AIS and satellite data
A security engineering view of ocean AI: pipeline trust boundaries, a threat model covering AIS spoofing, quality-flag laundering, poisoning and metad…
Read article →AI + Patents, in depth: protecting unfiled inventions, prior-art pipelines and filings when LLMs join the workflow
A security guide to LLM-assisted patent work: lifecycle trust boundaries, novelty and disclosure risk, region pinning, routing by filing state, prompt…
Read article →AI and Patient Data, in depth: building training sets from clinical records with legal pathways, de-identification, measured re-identification risk and lineage
How to turn patient records into AI training and evaluation data: HIPAA pathways and GDPR notes, Safe Harbor versus Expert Determination, date shiftin…
Read article →AI in Pharma, in depth: GxP scoping, data integrity for model output, span-grounded safety case intake, validation evidence and IP protection
Securing AI in pharmaceutical work: decide which uses are GxP-relevant, apply Part 11, Annex 11 and ALCOA+, read the draft FDA credibility framework a…
Read article →AI in Photography, in depth: what a camera signature proves, the Nikon Z6 III revocation, metadata and face data in AI editing, and training consent
Securing AI in the photo pipeline: what device-signed C2PA capture does and does not prove, lessons from the 2025 Nikon Z6 III certificate revocation,…
Read article →AI in Pollution Detection, in depth: sensor integrity, adversarial emitters, poisoning, grounded LLM reports and enforcement-grade governance
Securing AI pollution detection: trust boundaries across reference monitors, low-cost sensors, stack monitors and satellites, tampering and timing att…
Read article →AI Press + Incident Response, in depth: verifying viral artefacts, a fact register that gates statements, notification clocks and message sequencing
The communications workstream of an AI incident: why AI incidents are hard to describe, verifying screenshots against logs, a fact register and statem…
Read article →AI Privacy Officer, in depth: the role beside the DPO and CISO, where personal data hides in AI artifacts, a privacy control plane, purpose binding as code and the metrics that prove it
The AI privacy officer as an operating role: statutory privacy roles beyond the GDPR, a RACI with the DPO, CISO and ML lead, an artifact-level invento…
Read article →AI Procurement Regulations, in depth: US, EU, UK and Canadian regimes, buyer acceptance testing, no-training proof and exit drills
An engineering guide to AI procurement rules: OMB M-25-22 and M-26-04, EU AI Act deployer duties and model clauses, UK and Canadian regimes, a buyer a…
Read article →AI in Public Records, in depth: custody, responsiveness review with elusion sampling, validated exemption suggestions and true redaction
Designing an AI-assisted public records request pipeline: keeping records in custody, ranking for responsiveness and measuring missed records with an …
Read article →AI in Public Services, in depth: securing citizen-facing assistants with in-force guidance, answer gates and session-scoped tools
Securing LLM assistants in public services: lessons from NYC's MyCity chatbot, a reference architecture, a threat model, a runnable answer gate t…
Read article →AI in Publishing, in depth: submission floods, instructions hidden in manuscripts, confidential review, fabricated citations and disclosure metadata
Securing an AI-touched publishing workflow: a threat model, a quarantine boundary between manuscripts and models, quotas against submission floods, de…
Read article →AI Purple Team, in depth: scenario cards, a shared telemetry contract, replay harnesses and a worked exercise against an LLM assistant
How to run purple-team exercises for LLM applications: scenario cards with expected telemetry and outcomes, exercise tags instead of allowlists, multi…
Read article →AI in Rail, in depth: vital versus advisory functions, the EN 50716 and TS 50701 landscape, the attack surface and a restrict-only safety envelope
Securing and assuring AI in railways: fail-safe design, interlocking and ATP versus ATO, SIL and GoA, where ML and LLMs fit today, EN 50126, EN 50129,…
Read article →AI Red Team Program, in depth: maturity stages, coverage from risk, attack success statistics and release gates
How to run an AI red team as a standing program: maturity stages, a coverage matrix derived from the risk register, Wilson intervals and the rule of t…
Read article →AI Red Teaming, in depth: mapping an LLM system into attack surfaces, hypothesis-driven attack cases, canary-based evidence and fixes that close the path
A practitioner guide to AI red teaming: what it is versus evals and pentests, mapping an LLM application into attack surfaces, OWASP LLM 2025 coverage…
Read article →AI Regulatory Watch, in depth: sources, change detection, triage, LLM-assisted summarising and the EU omnibus as a worked example
How to build a regulatory watch for AI systems: lifecycle stages and dated events, a tiered source catalogue, snapshot-and-diff collectors, triage sco…
Read article →AI Safety Frameworks, in depth: NIST AI RMF, ISO/IEC 42001, the EU AI Act and frontier-lab policies, crosswalked into controls, eval gates and evidence an engineering team can run
A practical guide to AI safety and risk frameworks for engineers: what the NIST AI RMF and its generative AI profile, ISO/IEC 42001, the EU AI Act (wi…
Read article →AI Safety Institutes, in depth: who they are now, how pre-deployment testing works, and how to run institute-style evaluations with Inspect
AI safety institutes explained for engineers: the UK AI Security Institute, the US CAISI, the EU AI Office and the renamed international network, how …
Read article →AI Supply Chain Security Program, in depth: one gated path for models, data and ML packages, ML-BOM inventory, signing, safe loading and response
Designing an AI supply chain security program: real incidents, artifact classes, a quarantine and intake pipeline as code, ML-BOM inventory with linea…
Read article →AI Tabletop Exercises, in depth: objectives, scenario design, inject schedules, scoring and after-action fixes for LLM and agent incidents
How to design, run and score tabletop exercises for LLM and agent systems: what a tabletop tests compared with drills and red teams, why AI incidents …
Read article →AI in Taxation, in depth: securing tax assistants, extraction pipelines and authority risk scoring
Security and assurance for AI in tax: why year-versioned rules, adversarial documents, identifier theft and legally binding outputs change the threat …
Read article →AI Terms of Service, in depth: writing, versioning and enforcing your own AI product's terms, from clickwrap evidence to an enforcement ladder
Provider-side AI terms of service: the document set, AI-specific clauses and the systems each needs, clickwrap acceptance evidence with a ledger in co…
Read article →AI + Trade Secrets, in depth: reasonable measures as engineering controls, a fingerprinting AI gateway, protecting model assets and keeping others' secrets out
How generative AI affects trade secret protection: the legal test in engineering terms, outbound, asset and inbound flows, a gateway that fingerprints…
Read article →AI + Trademarks, in depth: logos in generated images, hallucinated attribution, name clearance and agent-written commerce
Trademark law for engineers building AI products: confusion, classes and dilution, what Getty v Stability, the USPTO GPT refusal and the Perplexity co…
Read article →AI Trading Security, in depth: untrusted news and market data, typed order intents, a deterministic pre-trade gateway, kill switches and adversarial testing
How to secure ML and LLM trading systems: where untrusted text and market data enter decisions, typed order intents, a pre-trade risk gateway with col…
Read article →AI in Traffic Management, in depth: securing adaptive signal control against spoofing, bounding influence, privacy and equity
Security for AI traffic signal control: data flow and safety interlocks, connected-vehicle spoofing as shown on I-SIG, plausibility checks in code, in…
Read article →AI Transparency Regulations, in depth: a duty matrix for the EU, California and China, one disclosure layer and evidence that it fired
AI transparency rules as engineering duties: interaction notices, latent marking, visible labels and training-data summaries across EU Article 50, the…
Read article →AI in Transportation, in depth: an operator security programme across modes, consequence tiers, ingest gates and copilot tool policy
A cross-modal security programme for AI in transportation: tiering AI functions by physical consequence, recurring attacks such as GNSS spoofing, crow…
Read article →AI Use Agreements, in depth: the clauses engineers must read, an obligations register, contract-to-gateway enforcement and promise inheritance checks
Turn AI vendor and customer agreements into enforceable engineering requirements: the clauses that matter, an obligations register, gateway configurat…
Read article →AI in Voting and Elections, in depth: election-aware LLM products, authoritative routing, period profiles and evaluation
How to build LLM products that handle election questions safely: a harm-based threat model, intent routing to official sources, a verified election ca…
Read article →AI Vulnerability Databases, in depth: CVE, GHSA and OSV for ML code, CWE-1427 and ATLAS for classes, AVID and incident records for behaviour
A practical map of AI vulnerability sources: CVE, NVD, GitHub advisories and OSV for ML libraries, CWE-1427, MITRE ATLAS and OWASP for weakness classe…
Read article →AI in Warehousing, in depth: trust zones, least-privilege WMS copilots, poisoned receiving documents, vision and barcode attacks and inventory ledger integrity
Security architecture for AI in warehouses: trust zones and conduits around WMS and OT, a threat model, a policy gate for copilot write tools, prompt …
Read article →AI in Water Management, in depth: securing leak detection, optimisers and operator assistants in water utilities
A defensive security guide to AI in water and wastewater utilities: one-way data architecture, a threat model, a setpoint guard in code, mass-balance …
Read article →AI in Wildlife Conservation, in depth: protecting species locations across camera traps, public releases and LLM assistants
A security view of conservation AI where the asset is where animals are: leak channels from EXIF to aggregates, deterministic grid snapping versus jit…
Read article →AI Worms, in depth: self-replicating prompts, how they propagate through RAG and agents, and how to keep R0 below 1
A first-principles guide to AI worms: what makes a prompt self-replicating, what the Morris II research demonstrated with GenAI email assistants, an e…
Read article →API Key Management for LLM Providers, in depth: gateways, virtual keys, budgets, leak detection and the revocation runbook
How to manage LLM provider API keys: leak paths, a gateway that holds the only provider keys, hashed virtual keys with budgets and expiry, provider-si…
Read article →APPI (Japan) and LLM, in depth: purpose, prompts, foreign model APIs, logs and the 2026 amendment
How Japan's APPI applies to LLM applications: personal data layers, provisions mapped to data flows, entrustment versus third-party provision for…
Read article →Deceptive AI detection, in depth: follow-up batteries, activation probes, cascade thresholds and why you must never train against the detector
How to detect deceptive behaviour in LLMs: a taxonomy of sycophancy, sandbagging, strategic lying and alignment faking, the published evidence on lie …
Read article →Attack Trees for LLM Systems, in depth: sequential AND for injection chains, attack-defense trees, cheapest defense sets and trees kept as code in CI
Attack trees for LLM agents from first principles: a CI coding agent as a worked system, sequential AND nodes for inject-read-send chains, a Python ev…
Read article →Attribute Inference Attacks, in depth: model inversion, embedding probes, LLM profiling, imputation baselines and defences that work
How attackers infer sensitive attributes from model outputs, embeddings and LLM reasoning over public text; why imputation baselines matter; a working…
Read article →LLM audit logging architecture
Deep-dive on audit logging for LLM systems: capturing request context, assembled prompts, model I/O and tool effects; redaction to hashed placeholders…
Read article →LLM Audit Logs, in depth: the event schema, content vaults and crypto-shredding, coverage checks, detection queries and retention
How to design the records themselves for an LLM audit trail: what one event must answer, a schema that survives an investigation, keeping prompt conte…
Read article →LLM Audit Preparation, in depth: scoping, control matrices, evidence as code, sampling populations and a mock audit
How to prepare an LLM application for an external audit or assessment: what auditors actually test, scoping the system, building a control matrix for …
Read article →Model Backdoors, in depth: triggers, why safety training misses them, detection, weight supply chain and containment
How backdoors in language models work: trigger types, insertion points from pretraining data to published weights, what the Sleeper Agents and 250-doc…
Read article →Brazil AI Regulation, in depth: what binds today, what PL 2338/2023 would add, and controls that work either way
Brazil AI regulation for engineers: the status of PL 2338/2023 in the Chamber, what LGPD Article 20, the ANPD and consumer law require today, the Sena…
Read article →AI Bug Bounties, in depth: what programs pay for, scoping an AI program, reproducing nondeterministic findings, severity, triage and reports that get paid
How bug bounties work for AI systems: what OpenAI, Anthropic, Google, Microsoft and AI-focused platforms reward and exclude, a finding taxonomy mapped…
Read article →LLM Bug Bounty, in depth: launching and operating a program for an AI product, from readiness and safe harbour to replayable intake and budgets
Running a bug bounty for an LLM product: readiness checks, VDP to private to public phases, safe harbour, a sandbox with canaries and stub tools, inta…
Read article →C2PA for AI-Generated Content, in depth: digital source types, marking generator pipelines, durable credentials and the EU Article 50 baseline
How generator operators should apply C2PA to AI output: choosing IPTC digital source types per pipeline, where signing belongs, durable credentials wi…
Read article →Canada AI Regulation (AIDA), in depth: what the bill said, why it died, what binds today and a control plane for what comes next
Canada's Artificial Intelligence and Data Act explained: its high-impact duties, penalties and 2023 amendments, why Bill C-27 died in January 202…
Read article →LLM security canary tokens architecture
Deep-dive on canary tokens for LLM systems: why detection matters where prevention is incomplete, what makes a good canary (uniqueness, plausibility, …
Read article →Capability Control for LLM Agents, in depth: tool inventories, per-task manifests, argument constraints, budgets and the enforcement point
How to bound what an LLM agent can do regardless of what it reads: classify tools by worst-case effect, issue per-task capability manifests bound to s…
Read article →CCPA and LLM Applications, in depth: data maps, AI vendors, consumer requests across logs and vector stores, AB 1008 and the 2027 ADMT rules
How the California Consumer Privacy Act applies to LLM applications: applicability thresholds, AB 1008 and model weights, service providers versus thi…
Read article →Certified Robustness for LLMs, in depth: what a certificate proves, smoothing radii, erase-and-check and the cost of guarantees
Certified robustness for LLM safety from first principles: pointwise certificates and threat sets for text, the randomized smoothing radius with a Clo…
Read article →China AI Regulation, in depth: the instrument stack, filing and registration, the GB/T 45654 test thresholds, labeling and an engineering control plan
An engineering guide to China AI regulation: which instruments apply, filing versus registration, the quantitative tests in GB/T 45654-2025, a refusal…
Read article →Command Injection via LLM, in depth: four paths from prompt to process, a worked attack and tested controls
How LLM agents turn attacker text into operating-system commands: raw shell tools, string templates, argument injection and code interpreters, a worke…
Read article →Confidential Compute for LLM, in depth: building a measured inference server, GPU confidential mode, composite attestation, multi-GPU limits and day-two operations
An engineering guide to running LLM inference under confidential computing: who is protected from whom, the boot and attestation chain from CVM launch…
Read article →Confidential Prompts, in depth: what a prompt can keep secret, classifying its contents, server-side assembly and the leak paths that never touch the model
How to handle confidential prompts properly: why a system prompt cannot be a security boundary, classifying prompt contents into tiers, moving secrets…
Read article →The confused deputy in agentic LLM systems
Deep-dive on the confused-deputy vulnerability as it reappears in tool-using LLM agents: an agent holding ambient authority (OAuth tokens, DB creds, p…
Read article →Content Authentication, in depth: signing and verifying AI-generated media with C2PA manifests, watermarks and fingerprints
How content authentication works for AI-generated images, audio and video: C2PA manifests, hard and soft bindings, COSE signatures and time-stamps, th…
Read article →Content Safety Overview, in depth: the layers, the classifiers, compounding errors and measuring the whole pipeline
A system view of LLM content safety: where training, instructions and input, context and output checks sit, Llama Guard and hosted classifiers, why st…
Read article →Content Scanners, in depth: extraction, normalisation, a detector contract and per-boundary policy for LLM apps
How to build the scanning platform under LLM content scanners: scanning what the model really reads from HTML, PDF, Office files and archives, Unicode…
Read article →Context Smuggling, in depth: how untrusted text launders its way into trusted parts of an LLM's context, and how to stop it
A defender's guide to context smuggling in LLM applications: spoofed delimiters and roles, special-token injection through the tokenizer, launder…
Read article →Context Stuffing Attacks, in depth: displacement, dilution, crowding and amplification, and a context assembler that resists them
How attackers use input volume against LLM applications: truncation that evicts the system prompt, dilution and many-shot prompts, retrieval crowding …
Read article →CPRA (California Privacy Rights Act), in depth: what Proposition 24 added for LLM systems, from sensitive data limits and correction to minimization, contracts and enforcement
The CPRA's additions to California privacy law, engineered into LLM products: sensitive personal information including message contents, a purpos…
Read article →DAN, in depth: measuring the Do Anything Now jailbreak family with clustering, judges and attack-success intervals
How to measure DAN-style jailbreaks honestly: findings from the in-the-wild study, why role-play prompts work, near-duplicate clustering with MinHash,…
Read article →Data Flow Diagrams for LLM Apps, in depth: notation, levels, labeling every arrow, and a checker that turns the diagram into required controls
How to draw data flow diagrams for LLM applications: elements and trust boundaries, levels, data classes for untrusted text and model output, LLM-spec…
Read article →LLM Data Governance, in depth: store inventory, propagating labels, purpose binding, permission-aware retrieval, retention, deletion that reaches every copy and a policy gate
Governing the data an LLM application touches: inventory every store from vector index to traces and vendors, attach labels at ingest and propagate th…
Read article →Data poisoning -- corrupting the model through its training data
Deep-dive on data poisoning: corrupting a model via malicious training data, poisoning types (backdoor/bias/degradation), backdoor triggers (hidden be…
Read article →Datasheets for Datasets, in depth: the seven sections as security questions, machine-readable fields, manifest binding and a CI gate
Use Datasheets for Datasets as a security control for LLM training data: what each section reveals about poisoning, PII, consent and licence risk, Cro…
Read article →Deepfakes, in depth: how voice and video impersonation fraud works, why detection alone fails, and the process, identity and provenance controls that stop it
A defender's guide to deepfakes: anatomy of impersonation fraud, the Arup case, why detectors fail on base rates, callback and approval policy in…
Read article →LLM Defense in Depth: The Full Security Stack
A 2500-word walkthrough of a production LLM security architecture: perimeter, identity, rate, input, firewall, model, retrieval, tools, output, egress…
Read article →Developer Mode Jailbreak, in depth: in-band authority claims, out-of-band privilege, structural detection and honest evaluation
Why developer-mode prompts work, the application bug that makes them real, out-of-band privilege and role separation in code, the instruction hierarch…
Read article →AI + Developing Countries, in depth: securing LLM assistants over SMS, shared phones and offline models
A threat model and control set for LLM assistants in low-connectivity regions: SMS, USSD and messaging-bot channels, SIM-swap-safe step-up, signed off…
Read article →Responsible Disclosure for LLM Vulnerabilities, in depth: routing security versus safety reports, multi-party coordination, embargo clocks, the CRA and advisories
Coordinated vulnerability disclosure for AI products from both sides: what counts as an LLM vulnerability, security.txt and policy, a case tracker wit…
Read article →LLM-Powered Disinformation, in depth: what models change, detecting coordination instead of authorship, provenance and measuring impact
A defender's guide to LLM-assisted influence operations: what generation changes and what it does not, why AI-text detection fails, runnable coor…
Read article →DP-SGD, in depth: per-example clipping, calibrated noise, privacy accounting and private LLM training
How differentially private SGD works and how to run it: the (epsilon, delta) guarantee and privacy units, Poisson sampling, per-example clipping, Gaus…
Read article →DSN (Data-Signal Nudging), in depth: marking untrusted text as data, defending the signal and measuring what it buys
Data-signal nudging as a prompt-level defence against indirect prompt injection: how it maps to spotlighting, delimiting, datamarking and encoding, a …
Read article →Dual LLM Pattern, in depth: privileged and quarantined models, the controller, symbolic variables and its limits
How the dual LLM pattern keeps untrusted text away from the model that holds tools: privileged and quarantined models, a working controller with symbo…
Read article →AI in Education, in depth: threat-modelling AI tutors and graders, answer-key leakage, essay-borne prompt injection, safety for minors and evidence-based integrity
Security for education AI products: an actor threat model, a tutor architecture that keeps answer keys out of context, output leak checks, prompt inje…
Read article →Egress Control for LLM Workloads, in depth: workload inventory, default-deny networks, an identity-aware proxy, DNS and metadata defences, and a tested policy check
Network egress control for LLM systems: what inference servers, agents, code sandboxes, training jobs and crawlers need to reach, a default-deny archi…
Read article →Egress Filtering for LLM Outputs, in depth: a streaming holdback gate, credential and canary detectors, markdown link rewriting and a worked exfiltration trace
How to filter what leaves an LLM through its own answer text: threats, a server-side streaming gate with a holdback buffer, credential, canary and inv…
Read article →LLM egress filtering architecture
Deep-dive on egress filtering for LLM agents: the forced choke point, destination allowlists, content inspection for secrets and PII, canary tokens, m…
Read article →Encoding Attacks on LLMs, in depth: why base64, ciphers and rare languages slip past safety training, output-side encoding, measurable signals and honest evaluation
Why encoding attacks work on language models: mismatched generalisation, the capability scaling problem, attacks by layer, output-side encoding, measu…
Read article →Encrypted Inference, in depth: two-party secret-shared inference from first principles, with Beaver triples, fixed-point truncation and the cost of transformer non-linearities
How secret-shared encrypted inference works: additive shares, fixed point, Beaver triples, local truncation and its failure rate, tested Python code, …
Read article →Encryption at Rest for LLM Data, in depth: threat layers, envelope encryption, per-tenant keys, vector stores and crypto-shredding
Protecting stored LLM data properly: what disk, storage and application encryption each defend against, where prompts and embeddings rest, AES-GCM env…
Read article →Encryption in Transit for LLM APIs, in depth: every hop, mTLS for inference, streaming side channels and hybrid post-quantum TLS
Encryption in transit for LLM systems hop by hop: what TLS protects and what it does not, a defensive httpx client, mTLS with identity checks for infe…
Read article →Encryption in Use for LLM Systems, in depth: mapping where plaintext lives, memory-encrypted VMs and GPUs, attestation-gated keys and shrinking the plaintext window
A practical guide to protecting data while it is being processed by an LLM service: where prompts and outputs exist as plaintext, what CPU and GPU mem…
Read article →Ephemeral Credentials for LLM Workloads, in depth: issuer limits, choosing a TTL, refresh-ahead caching, jobs that outlive tokens and real revocation
Ephemeral credentials for LLM services: what a short lifetime does and does not bound, STS, Google Cloud, Kubernetes and Vault limits, a TTL formula, …
Read article →EU AI Act, in depth: roles, risk classification, obligations and the post-Omnibus timeline for teams that ship AI
An engineering guide to the EU AI Act (Regulation 2024/1689) as of October 2026: the timeline after the AI Digital Omnibus, provider and deployer role…
Read article →LLM safety evals architecture
Safety evals for LLMs: grading harm rather than refusal strings, public benchmarks and their limits, over-refusal, bias, contamination, release gates.
Read article →AI Fairness, in depth: per-group confusion matrices, why the fairness criteria conflict, mitigation at three stages and counterfactual tests for LLM systems
A practitioner's guide to AI fairness: the kinds of harm, selection rate, TPR, FPR and PPV gaps from per-group confusion matrices, a worked examp…
Read article →Federated Learning for LLMs, in depth: threat model, FedAvg over LoRA adapters, secure aggregation, user-level DP and poisoning defences
How federated fine-tuning of LLMs works and what it does and does not protect: the threat model, one FedAvg round over LoRA adapters with PEFT code, t…
Read article →FERPA and LLM Applications, in depth: the school official exception, scoped retrieval, vendor terms and disclosure logs
How FERPA applies to LLM tools that touch student records: education records and PII, the school official exception and its three conditions, reasonab…
Read article →LLM Security: Program View, in depth: eight control layers, coverage computed from code, six stages and a worked three-system example
The program view of LLM security: principles, the eight layers a request crosses, computing control coverage from inventory, threats and test results,…
Read article →Frontier AI Labs, in depth: how safety frameworks, capability thresholds, evals and safeguards work, and how to turn them into vendor due diligence
How frontier AI labs gate model releases: risk domains, capability thresholds, elicitation, deployment and security safeguards, the artifacts they pub…
Read article →G7 Hiroshima AI Process, in depth: the Code of Conduct's 11 actions as controls, the OECD reporting framework, and a register that drafts your report
What the G7 Hiroshima AI Process agreed and when, the 11 Code of Conduct actions read as controls with evidence, the OECD reporting framework, a cross…
Read article →GDPR for LLM Applications, in depth: roles, lawful basis, data subject rights across every store, DPIAs, transfers and retention
How the GDPR applies to applications built on large language models: controller and processor roles with model providers, lawful basis and purpose lim…
Read article →Gemini Safety Filters, in depth: the three layers, where a block shows up in the response, calibrating thresholds and what the filter will never catch for you
How Gemini API safety filters work for an integrator: non-adjustable protections, per-category HarmBlockThreshold settings and the model's own re…
Read article →AI-Generated Media, in depth: labelling synthetic images, video and audio on the publishing side, from Article 50 duties to a signal-fusion label engine
How platforms and publishers label AI-generated media: Article 50 provider and deployer duties with the 2026 dates, a five-state label taxonomy, the s…
Read article →GLBA and LLM Applications, in depth: Safeguards Rule controls, the service-provider exception, NPI tokenisation and breach clocks
How the Gramm-Leach-Bliley Act applies to LLM systems in financial services: NPI, which safeguards rulebook applies, the FTC Safeguards Rule elements …
Read article →AI Governance Council, in depth: decision rights, charter, tiering as code, enforceable decision records and metrics
How to run an AI governance council that changes what ships: decision rights and delegation, a charter with seats, quorum and vetoes, intake tiering i…
Read article →H100 Confidential Compute Mode, in depth: the three modes, setting and verifying them, ready-state gating and the cost to CUDA workloads
How H100 confidential computing mode works on the GPU side: CC-On, CC-DevTools and CC-Off, host mode switching, nvidia-smi conf-compute checks, a fail…
Read article →Autonomous Hackbots, in depth: how LLM offensive-security agents work, what the evidence shows, and how to contain one
A defender's guide to autonomous offensive-security agents: the ReAct loop that makes an LLM act as a pentester, what the public evidence (Fang o…
Read article →HarmBench, in depth: behaviours, pipeline, classifier judge and how to measure attack success honestly
HarmBench explained as a measuring instrument: the 510 behaviours and their categories, the validation/test split, the generate-complete-judge pipelin…
Read article →HIPAA for Healthcare LLM Applications, in depth: mapping PHI flows, business associate chains, minimum necessary prompts, de-identification and audit controls
An engineering guide to building LLM applications that handle protected health information under HIPAA: who is covered, where PHI lands in an LLM pipe…
Read article →HIPAA and LLM Applications, in depth: building a PHI gateway, retrieval authorization, pseudonymization limits, logging and incidents
An engineering guide to HIPAA for LLM applications: where PHI hides in an LLM stack, a PHI gateway with purpose checks, authorization, minimum necessa…
Read article →Homomorphic Encryption for LLMs, in depth: CKKS slots, levels and parameters, what fits today and encrypted retrieval in TenSEAL
Homomorphic encryption for LLM systems from first principles: CKKS slots, scale, levels, rescaling and rotations, why encrypted transformer inference …
Read article →Human-in-the-loop approval gates for AI agents
Deep-dive on human-in-the-loop approval gates for agent actions: a risk classifier that routes by risk and reversibility, an auto-execute path for saf…
Read article →Hypothetical Framing Jailbreak, in depth: why counterfactual wrappers bypass refusals and how to measure and close the gap
A defender's guide to hypothetical framing jailbreaks: the competing-objectives and mismatched-generalisation mechanisms, a taxonomy of frame fam…
Read article →AI Impact Analysis, in depth: blast radius, exposure windows, bounded harm per dimension and a max-dominant aggregation rule
How to analyse the consequences of an AI failure: compute blast radius over a consumer graph, size the exposure window from detection and repair time,…
Read article →LLM Incident Response, in depth: incident classes, severity, detection signals, a containment ladder, the first hour, recovery gates and postmortems for LLM and agent systems
A practitioner's guide to responding to incidents in LLM applications and agents: what counts as an incident, a severity model, detection signals…
Read article →India AI Policy, in depth: the governance guidelines, synthetic-media rules, DPDP timelines and CERT-In for LLM products
An engineering map of Indian AI policy for LLM builders: the voluntary India AI Governance Guidelines, the binding February 2026 IT Rules amendment on…
Read article →IoCs for LLM Systems, in depth: indicator classes, observation points, a catalogue, normalised payload hashing, canaries, pivoting and indicator lifecycle
How to build indicators of compromise for LLM and agent systems: IoCs versus attack indicators and anomalies, where to observe them, a catalogue with …
Read article →Indirect Prompt Injection, in depth: spotlighting, dual-LLM capability separation and measuring attack success
Indirect prompt injection defences compared on what they buy: spotlighting by delimiting, datamarking and encoding, detectors, the dual-LLM pattern an…
Read article →Ingress Control for LLM APIs, in depth: identity, entitlement, request validation, token-budget admission, ingress screening and streaming limits
How to control what enters an LLM API before it reaches a model: an ordered admission pipeline covering identity, entitlements, strict request validat…
Read article →ISO/IEC 42001, in depth: building the AI management system clause by clause, the Statement of Applicability as code, and an evidence pipeline auditors can sample
An engineer's guide to ISO/IEC 42001: clauses 4 to 10, Annex A's 38 controls in nine domains, risk versus impact assessment, ISO/IEC 42005 a…
Read article →Tenant Isolation for LLM Systems, in depth: enforcing tenant boundaries in code and proving them with tests
An implementation guide to tenant isolation in LLM applications: inventorying every surface that holds tenant data, deriving tenant context once and f…
Read article →LLM Jailbreak Defense Architecture in Depth
A 2500-word walkthrough of jailbreak defense architecture: input classifier, safety-tuned model, system prompt hardening, constrained decoding, output…
Read article →JailbreakBench, in depth: the JBB-Behaviors dataset, fixed threat model, judge choice, honest statistics and adaptive evaluation
How to use JailbreakBench as a measuring instrument: its 100 harmful and 100 benign behaviours, artifacts repository, fixed target settings, why Llama…
Read article →Japan AI Policy, in depth: the AI Promotion Act, the guidelines around it, and a controls register for teams shipping AI in Japan (October 2026)
Japan's AI governance as of October 2026: what the AI Promotion Act does and does not require, the Basic Plan, the Article 13 guideline and the A…
Read article →JSON Injection Into LLMs, in depth: string-built prompts, poisoned fields, parser differentials and hardened parsing
How JSON injection works in LLM applications and how to stop it: breaking out of string-built JSON requests, instructions hidden in JSON values and ke…
Read article →AI + Children, in depth: under-13 data flows through an LLM stack, purpose-tagged consent, retention as code and child-first defaults
Engineering an LLM product for children under 13: a child data map of every sink, a consent ledger enforced in each write path, retention and deletion…
Read article →Cyber Kill Chain for LLM Attacks, in depth: seven stages mapped to agents, a zero-click email chain and stage-tagged detection
The Lockheed Martin cyber kill chain adapted to LLM applications: what reconnaissance, delivery, exploitation, installation, C2 and actions look like …
Read article →AI + Language Minorities, in depth: measuring safety gaps per language, in both directions, and closing them
Why LLM guardrails under-block harmful requests and over-block ordinary speech in low-resource and minority languages, what the research measured, and…
Read article →LGPD (Brazil) and LLM, in depth: data maps, legal bases, CPF masking, rights across embeddings, Article 20 reviews, transfers and the incident clock
An engineering guide to Brazil's LGPD for LLM products: scope and the ANPD's new agency status, mapping personal data across prompts, embedd…
Read article →Llama Guard, in depth: versions, the S1-S14 taxonomy, prompt format, calibrated scoring and deployment
Llama Guard from first principles: how a generative safety classifier works, versions 1 to 4 and when to pick each, the S1-S14 hazard taxonomy, the pr…
Read article →LLM-Powered Bug Discovery, in depth: a pipeline where models propose vulnerabilities and sanitizers, tests and humans decide
How to use language models to find real vulnerabilities in your own code: what public results from Big Sleep, OSS-Fuzz, CVE-2025-37899 and AIxCC do an…
Read article →LLM Guard, in depth: the scanner chain, the Vault, the API server, verified failure modes and running an archived library safely
How Protect AI's open-source LLM Guard works and how to run it responsibly now that the project is archived: input and output scanner chains, sca…
Read article →LLM Infrastructure Security, in depth: weights, serving endpoints, GPU nodes and the control plane around them
Securing the infrastructure that serves large language models: what is worth stealing, weight integrity and safe formats, inference and model-manageme…
Read article →AI + Low-Literacy Users, in depth: a threat model, secret guards, readability gates, spoken read-back and plain-language consent
Securing LLM products for users with low literacy: PIAAC 2023 context, a threat model covering over-trust, unread consent, AI scams, forwarded-content…
Read article →Membership Inference Defenses, in depth: measuring leakage, choosing defenses and knowing which ones actually hold
A practical guide to defending models, including LLMs, against membership inference: how to measure leakage with TPR at low false-positive rates, LLM …
Read article →Membership-inference defense architecture
Deep-dive on defending LLMs against membership-inference attacks: how the train/test confidence gap left by overfitting lets an attacker read a model&…
Read article →MITRE ATLAS, in depth: the 2026.09 matrix, its data model, case-study chains and coverage maps for LLM applications
A working guide to MITRE ATLAS for LLM and agent teams: the 16 tactics and key techniques from the 2026.09 release, maturity labels, the format-6 YAML…
Read article →MMLU + Safety Subsets, in depth: scoring WMDP against MMLU retain sets, the statistics that make a difference real, and why unlearning results mislead
How to evaluate hazardous knowledge with WMDP paired with MMLU neighbour subjects: what the benchmarks measure, log-likelihood scoring code, lm-evalua…
Read article →Model Cards, in depth: what to document, binding cards to weights, a CI gate, and the ways cards mislead
Model cards as security artifacts: the Mitchell et al. sections plus what LLM cards must add, the Hugging Face YAML format, binding cards to weight ha…
Read article →Model extraction
Deep-dive on model extraction attacks and defenses: systematic API querying, response collection, surrogate training, behavior-not-weights theft, dete…
Read article →Model Signing, in depth: per-file manifests, keyless Sigstore signing, the model_signing tool and verifying at the last hop
How to sign and verify ML models: what a signature covers, per-file digest manifests in a DSSE and in-toto bundle, keyless Sigstore with Fulcio and Re…
Read article →LLM moderation architecture
Deep-dive on layered LLM moderation: heuristics + ML + policy engine + human review with a training loop that closes on hard examples.
Read article →Moderation Bypass, in depth: how content filters around LLMs are evaded, and how to close each gap
A defender's guide to moderation bypass in LLM applications: a threat model, six classes of bypass (representation, window, decomposition, refram…
Read article →Multi-Turn Attacks, in depth: conversation state as the attack surface, escalation and splitting patterns, trajectory-level detection and red-teaming a dialogue
Why LLM attacks spread across many turns beat per-message filters: who can write conversation history, the escalation, payload-splitting, dilution, fo…
Read article →Multi-Turn Prompt Injection, in depth: dormant payloads, laundering through summaries, provenance that survives compaction and session-level tests
How prompt injection persists across conversation turns: history replay, compaction, memory and plans as carriers, delayed triggers, a turn-by-turn em…
Read article →NIST AI Risk Management Framework, in depth: the four functions, 19 categories, profiles, the generative AI profile, and a risk register you can run
An engineer's guide to the NIST AI RMF (NIST AI 100-1): what it is and is not, the trustworthiness characteristics, the GOVERN, MAP, MEASURE and …
Read article →AI + Older Adults, in depth: voice-clone scams, scam-aware assistants, action gates and safe caregiver access
How to design AI products that protect older adults: a three-sided threat model, a scam-signal layer with named reasons, a deterministic action gate w…
Read article →Output Guardrails Overview, in depth: sinks, a staged detection pipeline, the action policy, streaming and choosing thresholds
How to design output guardrails for LLM applications: start from the sink, order deterministic, classifier and grounding checks by cost, separate verd…
Read article →LLM output handling -- treating model output as untrusted
Deep-dive on LLM output handling: the untrusted-output threat, output flowing into injection sinks (HTML/SQL/shell/code), context-aware encoding and e…
Read article →OWASP Agentic LLM Security, in depth: the Top 10 for Agentic Applications as an assessment programme, from threat model to tests
How to apply the OWASP Top 10 for Agentic Applications (ASI01 to ASI10): what each risk means, where it lands in an agent architecture, the controls t…
Read article →OWASP LLM Top 10, in depth: the 2026 edition, what moved since 2025, and how to run an assessment against it
How to use the OWASP Top 10 for LLM Applications as an assessment instrument rather than a poster: the 2026 ranking and what changed from 2025, keying…
Read article →OWASP LLM Top 10, in depth: how the risks chain into real attacks, and where to break each chain
The OWASP Top 10 for LLM applications read as a graph of entry points, amplifiers and impacts: three worked attack chains, one policy point in code th…
Read article →Paraphrase Defense, in depth: rewriting inputs against adversarial suffixes, the evidence, detector gating, hardening the paraphraser and its limits
How the paraphrase defense neutralises GCG-style suffixes: the Jain et al. results and quality cost, a detector-gated architecture, a hardened Python …
Read article →Payload Splitting, in depth: where fragments are joined, assembled-context scanning, provenance gates and a split-canary test harness
How payload splitting defeats per-input filters and how to defend against it: the join points in an LLM application, scanning the assembled context wi…
Read article →PCI-DSS for Payment-Handling LLM Applications, in depth: keeping card data out of prompts, logs and model providers, and what stays in scope
How PCI DSS v4.0.1 applies when an LLM agent takes payments: cardholder data versus sensitive authentication data, every place card numbers leak into …
Read article →PCI DSS and LLM Applications, in depth: scoping the AI estate, vendor oversight and stray card data
How to operate an LLM application under PCI DSS v4.0.1: classifying AI components into CDE, connected-to and out-of-scope categories, a scoping invent…
Read article →DPDP Act (India) and LLM, in depth: consent per purpose, erasure across prompts, vectors and weights, breach clocks and Significant Data Fiduciaries
Engineering guide to India's DPDP Act 2023 and DPDP Rules 2025 for LLM products: scope, consent and legitimate uses, notices, security safeguards…
Read article →LLM Pentesting, in depth: running an authorised assessment of one feature, from rules of engagement to retest
How to run an authorised security assessment of a single LLM feature: getting written authorisation and rules of engagement first, building a test pla…
Read article →Perplexity Filter Defense, in depth: scoring prompts for adversarial suffixes, windowed NLL, calibration and its limits
How a perplexity filter detects GCG-style adversarial suffixes: per-token NLL from a small scorer, windowed max versus mean, correct chunked PyTorch c…
Read article →Persuasion-Based Jailbreaks, in depth: why social-influence framing moves aligned models, how to measure your exposure safely and which defences hold
Persuasion-based jailbreaks explained for defenders: what the Zeng et al. and Wharton studies found, why preference training makes models persuadable,…
Read article →Perturbation-Based Defenses, in depth: randomizing inputs against optimized jailbreaks, aggregate versus detect mode, the voting arithmetic and adaptive attacks
How perturbation defenses against LLM jailbreaks work as a family: character, token and meaning-level noise, aggregate and detect modes, a seeded Pyth…
Read article →LLM PII Detection and Redaction Architecture in Depth
Defensive PII engineering for LLM systems: what counts as PII and why it is jurisdictional, honest detection accuracy for patterns vs NER vs LLM passe…
Read article →PIPEDA (Canada) and LLMs, in depth: consent, the ten principles, the ChatGPT findings and Quebec's Law 25
How Canada's PIPEDA applies to LLM products: scope, the ten fair information principles mapped to an LLM architecture, consent and scraped data, …
Read article →PIPL (China) and LLM, in depth
How the Chinese PIPL applies to LLM systems: flow mapping, lawful basis without legitimate interests, separate consent, PIPIA, deletion across stores …
Read article →AI Policy Review Cadence, in depth: tiered intervals, event triggers, review packs, policy as code and cadence metrics
How to keep AI policies aligned with fast-changing models, tools and regulation: tier policies by volatility, define event triggers with deadlines, re…
Read article →Prefix Injection Jailbreak, in depth: competing objectives, shallow alignment, prefill risk, measurement and layered defences
How prefix injection jailbreaks work and how to defend against them: the competing-objectives origin, how it differs from assistant prefill, the shall…
Read article →Privacy Budget in Differential Privacy, in depth: units of privacy, composition, RDP accounting and running a budget ledger
How the differential privacy budget works and how to manage it: what epsilon and delta promise, record versus user-level units, basic, advanced and pa…
Read article →Prompt Engineering Defenses, in depth: an evidence ledger for delimiting, spotlighting, reminders and goal priority, adaptive attacks and an ablation harness
What prompt-level defences really buy: delimiting, datamarking and encoding, sandwich reminders, self-reminders, goal prioritisation and instruction h…
Read article →Prompt Injection Scanners, in depth: what they can detect, where to put them, how to set thresholds and how to evaluate them honestly
A practical guide to prompt injection scanners: why detection is probabilistic, scanning every untrusted channel, layered normalisation, rules and cla…
Read article →Prompt Injection Attacks Survey, in depth: channels, techniques and goals, the research landmarks, and a test matrix
A survey of prompt injection: a channel, technique and goal taxonomy, key papers and benchmarks, what the evidence says about defences, a worked email…
Read article →Prompt Isolation, in depth: from role separation to quarantined readers, symbolic variables and provenance-checked tools
How to keep untrusted text from gaining the authority to act: isolation layers and their guarantees, the lethal trifecta, dual LLM and plan-then-execu…
Read article →Prompt Shielding, in depth: gating user prompts and documents before every model call, packing content into shield limits, per-channel policy and failing safely
How to deploy a prompt shield in an LLM or agent application: user prompt attacks versus document attacks, the Azure Prompt Shields API and its limits…
Read article →Property Inference Attacks, in depth: reading dataset statistics out of models and LLMs
How property inference attacks recover global statistics of training data: the distinguishing game, shadow models and meta-classifiers, black-box and …
Read article →LLM output provenance architecture
Deep-dive on LLM output provenance: source citations, watermark, audit records, verifier tool, provenance UI, policy, and metrics.
Read article →Meta Purple Llama, in depth: Llama Guard, Prompt Guard, CodeShield, LlamaFirewall and CyberSecEval wired into one runtime-defence and evaluation loop
A practical guide to Meta's Purple Llama toolkit: what Llama Guard, Prompt Guard 2, CodeShield, LlamaFirewall and CyberSecEval each check, where …
Read article →RAG Defense Architecture in Depth
RAG defense architecture in depth: trust zones, provenance at ingestion, tenant-safe retrieval, spotlighting, a taint-aware capability gate, output co…
Read article →RAG poisoning attacks, in depth: knowledge corruption, jamming, measurement and layered defences
How RAG poisoning works: the retrieval and generation conditions, PoisonedRAG, corpus poisoning and jamming, a red-team measurement harness, and defen…
Read article →RealToxicityPrompts, in depth: how the benchmark was built, expected maximum toxicity and toxicity probability, a reproducible harness, and life after Perspective API
RealToxicityPrompts as a measurement protocol: how the 99,442 prompts were built from OpenWebText, exact definitions of expected maximum toxicity and …
Read article →LLM red team architecture
Deep-dive on LLM red team: attack corpus, automated attacks, human red team, judge, coverage, reporting, fix cycle, metrics.
Read article →Red-Teaming Playbook, in depth: play cards, seven core plays, deterministic oracles, a replay harness and a two-day schedule
A practical LLM red-teaming playbook: the seven-field play card, seven core plays from secret extraction to resource abuse, canary and log oracles, tr…
Read article →LLM Security Reference Architecture, in depth: trust zones, component contracts, request flows, policy as data and a control map for the OWASP LLM Top 10
A deployable security blueprint for LLM applications: five trust zones and their boundaries, the contract of each component (AI gateway, context assem…
Read article →Refusal Suppression Attacks, in depth: why banning refusal words works, why it fools keyword metrics, and how to measure and defend against it
How refusal suppression jailbreaks work as a competing-objectives attack, why they break refusal-keyword evaluation, a constraint-family scorer with a…
Read article →AI Regulation Deep Dive, in depth: an applicability engine, a dated obligation register and the 2026 changes as a worked example
How an engineering team turns moving AI law into something it can run: system facts, roles and jurisdictions, a dated obligation register, an applicab…
Read article →AI Risk Acceptance, in depth: who may sign, scoped and expiring records, revocation triggers and enforcing acceptance at deploy time
How to accept residual AI risk properly: preconditions, an authority matrix with maximum terms, an acceptance record pinned to model, prompt and tools…
Read article →AI Risk Appetite, in depth: from board statements to measurable tolerances, system limits and launch gates
How to make AI risk appetite enforceable: separate appetite, tolerance and limit, write appetite per risk category, prove tolerances with confidence b…
Read article →AI Risk Assessment, in depth: scoping, loss scenarios, calibrated estimates and Monte Carlo decisions for LLM systems
A practical AI risk assessment procedure for LLM systems: scope and characterise the system, write testable loss scenarios, estimate with calibrated r…
Read article →AI Risk Avoidance, in depth: when not to build, scope cuts, scoring, enforcement in code and decision records
How to use risk avoidance as an engineering treatment for LLM systems: where it sits in ISO 31000 and the NIST AI RMF, the criteria that make it right…
Read article →AI Risk Matrix, in depth: anchored decade bands, an additive scoring rule, tested colour thresholds and overrides for LLM risks
How to design an AI risk matrix that ranks risks consistently: likelihood and severity anchored to numbers, converting per-request rates to events per…
Read article →AI Risk Monitoring, in depth: signals, sampled judges with confidence bounds, CUSUM change detection and alert routing
How to monitor AI risk after launch: a signal pipeline tied to the risk register, judge-corrected rates with Wilson intervals, Bernoulli CUSUM change …
Read article →AI Risk Reduction Strategies, in depth: choosing controls by stage, measuring effectiveness, layering without false independence, and control decay
How to reduce LLM and agent risk with evidence: preventive, containment and response controls mapped to a loss chain, measuring miss rates, combining …
Read article →AI Risk Register, in depth: testable risk statements, computed residual scores, KRIs and change triggers
How to build an AI risk register that stays true: cause-event-consequence statements, inherent versus residual scoring from tested controls, appetite …
Read article →AI Risk Transfer, in depth: the transfer stack, what cannot be transferred, and a Monte Carlo model of what you actually retain
Risk transfer for LLM systems as an engineering decision: customer caps, vendor indemnities, retentions and insurance layers in response order, uninsu…
Read article →Role-Play Jailbreaks, in depth: why fictional frames weaken refusals, the variants, frame-invariant output checks and a canary test harness
A defender's guide to role-play and fiction-framed LLM jailbreaks: the frame, character, payload and pressure structure, why it works, the varian…
Read article →Sandboxed Tool Execution, in depth: isolating parsers, browsers and third-party MCP servers with per-tool profiles, a broker, and conformance probes
How to sandbox the tools an agent calls, not only model-written code: why parsers and MCP servers are an attack surface, four sandbox profiles by inpu…
Read article →Agent tool-execution sandboxing architecture
Deep-dive on sandboxing LLM agent tool calls: policy engines, Firecracker/gVisor/WASM isolation tiers, warm slot pools, secrets brokering, egress prox…
Read article →Secret Scanners, in depth: how detectors find credentials, where to scan LLM prompts, outputs and tool results, streaming redaction, verification and tuning
How secret scanners detect credentials and how to run them on LLM traffic: keyword prefilters, regex, entropy, checksummed token formats and live veri…
Read article →Secrets management architecture for LLM applications
Deep-dive on LLM secrets security: why context windows and prompt logs leak credentials, vault-issued short-lived credentials, opaque secret reference…
Read article →Secrets Management for LLM Apps, in depth: inventory, caching, zero-downtime key rotation, BYOK envelope encryption and leak response
The lifecycle of an LLM application's credentials: an inventory of provider, customer, tool and observability secrets; per-service keys; a TTL ca…
Read article →Secure Aggregation for Federated LLM, in depth: pairwise masks, dropout recovery, finite-field encoding and SecAgg+
How secure aggregation lets a federated LLM server learn only the sum of client updates: pairwise and self masks, Shamir-based dropout recovery, the f…
Read article →Secure Inference for LLMs, in depth: threat models, confidential GPUs and attestation, homomorphic encryption, MPC and what each one actually protects
How to run LLM inference so the operator cannot read prompts, outputs or weights: defining the threat model, confidential VMs plus GPU confidential co…
Read article →Service Mesh for LLM Systems, in depth: mTLS identity, per-caller authorization, retry and timeout tuning for streamed inference, egress control and inference-aware routing
How to run LLM serving, agents and tools on a service mesh: strict mTLS, Istio AuthorizationPolicy for model servers and tools, ambient mode waypoints…
Read article →AMD SEV, in depth: SEV-SNP memory encryption, the Reverse Map Table, attestation reports and key release for model serving
How AMD SEV-SNP protects AI workloads: per-guest memory encryption, the C-bit and Reverse Map Table, GHCB and guest kernel changes, attestation report…
Read article →Intel SGX, in depth: enclaves, the EPC, sealing, DCAP attestation and the attacks that shaped it
How Intel SGX works and where it fits in AI systems: threat model, EPC and EPCM, enclave lifecycle and EDL, MRENCLAVE and MRSIGNER, sealing and rollba…
Read article →ShieldGemma, in depth: one policy per pass, Yes/No logit scoring, threshold calibration and where it fits beside Llama Guard
ShieldGemma explained: the 2B, 9B and 27B text classifiers and ShieldGemma 2, the four harm policies, the exact prompt template, two-logit scoring cod…
Read article →Singapore AI Governance, in depth: the Model AI Governance Frameworks, AI Verify, PDPA guidance, agentic AI rules and the controls that satisfy them
How Singapore governs AI without a horizontal AI act: the Model AI Governance Frameworks for traditional, generative and agentic AI, AI Verify and Moo…
Read article →SmoothLLM, in depth: randomized perturbation and majority voting against adversarial-suffix jailbreaks
How SmoothLLM defends against GCG-style jailbreaks: swap, insert and patch perturbations, N copies and a majority vote, working Python code, a worked …
Read article →SOC 2 for LLM Applications, in depth: scoping the model provider, mapping the criteria to prompts, models and retrieval, and producing evidence an auditor can sample
How to bring an LLM feature through a SOC 2 examination: what the report is and is not, Type 1 versus Type 2, drawing the system boundary, treating th…
Read article →SOC Playbook for LLM Incidents, in depth: telemetry, detections, triage runbooks and automation for LLM and agent alerts
A security operations playbook for LLM and agent applications: the SIEM event schema and content vault, a detection catalogue mapped to the OWASP Top …
Read article →South Korea AI Act, in depth: the AI Framework Act as an engineering compliance system
South Korea's AI Framework Act for engineers: scope, high-impact AI, generative AI notice and labeling, compute threshold, domestic representativ…
Read article →LLM spotlighting architecture
Deep-dive on spotlighting as a prompt-injection defense: why transformers lack a code-vs-data boundary, how delimiting, datamarking, and encoding mark…
Read article →SQL Injection via LLM, in depth: prompt-to-SQL attacks on text-to-SQL and database agents, and the controls that hold
How attacker text reaches SQL through language models: direct and indirect prompt-to-SQL injection, a worked attack on an analytics assistant, intent …
Read article →SSRF via LLM Tools, in depth: how a fetch tool becomes a proxy into your network, and a validator that survives encodings, redirects and DNS rebinding
How prompt injection turns LLM URL-fetching tools into SSRF, what attackers reach (metadata, localhost, internal APIs), why URL string filters fail, a…
Read article →US State Privacy Laws Patchwork, in depth: the shared skeleton, where states diverge, and a rules engine for LLM systems
How roughly twenty US state privacy laws overlap and differ on thresholds, sensitive data, opt-out signals, minors and profiling, and how to build a v…
Read article →Superalignment, in depth: supervising models smarter than their supervisors
Superalignment from first principles: why RLHF breaks when models outgrow their raters, OpenAI's Superalignment team, weak-to-strong generalizati…
Read article →Container Supply Chain for LLM, in depth
Securing the supply chain of LLM serving containers: CUDA-heavy images, hash-locked wheels, weights as a separately signed artifact, safetensors over …
Read article →Dataset Supply Chain Security, in depth: pinned sources, content-addressed manifests, signed provenance and refresh gates
Securing the path from data source to training shard: stage-by-stage threats, why datasets 4.0 dropped loading scripts, pinning hub datasets to commit…
Read article →LLM FinOps Supply Chain, in depth: every hop that can spend your money, a cost bill of materials, retry amplification and unit-cost alarms
LLM spend as a supply chain security problem: retry stacking across SDK, gateway and app, upstream model and price changes, broken prompt caches and p…
Read article →Vector DB Supply Chain, in depth: pickled indexes, pinned embedding models, signed bundles and provenance per chunk
Securing the retrieval tier as a supply chain: the components of a vector store, why pickle-based index formats are a code-execution path, pinning and…
Read article →System prompt leakage architecture
Deep-dive on LLM system prompt leakage: why the system role is not a privilege boundary, extraction via direct ask, roleplay, continuation, encoding, …
Read article →Intel TDX, in depth: the TDX module, private memory, measurements and attestation for AI workloads
How Intel Trust Domain Extensions works and how to use it for AI: SEAM and the TDX module, private versus shared memory and Secure EPT, #VE and TDVMCA…
Read article →AI + Teenagers, in depth: a teen safety layer for chatbots, conversation-level risk, crisis handling, parental controls and evaluation
How to build the runtime safety layer for teenage users of conversational AI: a teen threat model, policy profiles, conversation-level risk tracking w…
Read article →Multi-tenant LLM isolation architecture
Deep-dive on tenant isolation for LLM platforms: unforgeable tenant context, retrieval namespaces vs filters, cache-key design, per-tenant adapters, e…
Read article →Third-Party LLM Risk, in depth: inventory, tiering, model-specific due diligence, contract terms, silent model change, fourth parties and exit plans
Managing the risk of LLM vendors over the whole relationship: finding every model in use, tiering uses by data and impact, due-diligence questions spe…
Read article →Third-Party API Security, in depth: the trust boundary between LLM applications, model vendors and the APIs their tools call
A practical guide to securing the third-party APIs an LLM application depends on, in both directions: inventory and data classification, vendor terms …
Read article →DREAD for LLM Risk Scoring, in depth: anchored factors, reproducibility as a measured attack success rate, and aggregation that cannot hide a data leak
How to use DREAD to rank threats in LLM applications: anchored 0-10 rubrics for each factor, reproducibility from attack success rates with Wilson con…
Read article →LLM-Specific Threat Modeling, in depth: trust inside the context window, taint paths from untrusted text to tools, the Rule of Two, and a worked model of a CI review agent
How to threat-model applications built on large language models: why instructions and data sharing one channel changes the method, LLM-specific elemen…
Read article →PASTA for LLM Threat Modeling, in depth: seven risk-centric stages from business objectives to simulated attacks
Applying PASTA, the risk-centric seven-stage threat modeling process, to an LLM application: objectives and scope, context-window decomposition, threa…
Read article →STRIDE for LLM Systems, in Depth
Applying STRIDE to LLM applications: per-element analysis of models, retrieval, memory and tools, what each letter means for agents, a worked email-ag…
Read article →Tool Abuse, in depth: how agents misuse legitimate tools, and the tool-call gateway that stops it
How LLM agents misuse the tools they are legitimately given: scope misuse, argument injection (path traversal, SSRF, SQL), dangerous chains, volume an…
Read article →Tool Hijacking Attacks, in depth: poisoned descriptions, cross-server shadowing, rug pulls and the client controls that stop them
How attackers hijack agent tool selection through tool metadata: MCP description poisoning, cross-server shadowing, rug pulls via list_changed and nam…
Read article →Toxicity Scanners, in depth: what the models measure, segmenting and calibrating scores, and auditing identity-term bias
How toxicity scanners for LLM apps work: Detoxify and LLM Guard models and labels, segmentation and aggregation, threshold sweeps on your own traffic,…
Read article →ToxiGen, in depth: how the implicit hate dataset was generated, what its labels mean, and how to evaluate classifiers and generators with it
A practical guide to ToxiGen: why it was built, demonstration prompting and ALICE adversarial decoding, the subsets and annotation fields, per-group e…
Read article →Translation Jailbreak, in depth: four attack families, where machine translation belongs in the pipeline, output-side policy and a per-language test matrix
How translation jailbreaks get past LLM safety through low-resource languages, translation-framed tasks, code-switching and response-language pivots, …
Read article →Trust Boundaries in LLM Systems, in depth: a boundary register, provenance labels and enforcement at every crossing
How to enforce trust boundaries in LLM applications: seven crossings from user input to memory, a register with checks and owners, provenance-labelled…
Read article →Typoglycemia and Character-Level Attacks, in depth: why scrambled words pass filters but not models, fuzzy matching that works, Best-of-N search and layered defences
How typoglycemia and other character-level perturbations bypass keyword filters while models still read them: the research, a perturbation taxonomy, t…
Read article →UAE PDPL and LLM, in depth: which regime applies, lawful basis, cross-border routing, rights requests and DPIAs for AI systems
Engineering guide to the UAE Personal Data Protection Law (Decree-Law 45/2021) for LLM systems: PDPL versus DIFC and ADGM, consent and Article 4 bases…
Read article →UK AI Policy, in depth: principles, regulators and the controls engineers must build (October 2026)
How UK AI regulation works in practice as of October 2026: five principles applied by the ICO, Ofcom, FCA and others, the Data (Use and Access) Act au…
Read article →UK AI Regulation, in depth: the security layer, from the AI cyber code of practice and ETSI EN 304 223 to the chatbot powers and the cyber bill (October 2026)
The security side of UK AI regulation for engineers: which instruments bind and which guide, the 13 principles of the Code of Practice for the Cyber S…
Read article →Unicode smuggling defense architecture
Deep-dive on defending LLMs against Unicode smuggling: hidden Unicode Tag-block payloads, zero-width and bidirectional controls, homoglyph/confusable …
Read article →Universal Adversarial Suffixes, in depth: what makes a suffix universal, how to measure transfer honestly, and which defenses survive adaptive attackers
Universal adversarial suffixes explained for defenders: the axes of universality, the research lineage from universal triggers to generated suffixes, …
Read article →Machine Unlearning for LLMs, in depth: forget and retain sets, gradient ascent to NPO and RMU, TOFU, MUSE and WMDP, and why forgotten knowledge comes back
How machine unlearning for LLMs works and fails: defining forgetting against a retrained reference, gradient difference, NPO and RMU objectives with P…
Read article →US AI Executive Orders, in depth: how presidential orders reach your AI system through OMB memos and contract clauses, and how to track them in code
An engineering guide to US AI executive orders from EO 14110 to EO 14365 and the 2026 orders: what an order can and cannot bind, the four paths by whi…
Read article →AI + Vulnerable Populations, in depth: crisis, scams, cognitive impairment and dependency, with detection, policy profiles and escalation for LLM products
How to protect vulnerable users of LLM products: vulnerability as a state, LLM-specific harms such as sycophancy and dependency, a decayed signal and …
Read article →Workload Identity for LLM Services, in depth
Workload identity for LLM services: identity, credential and attestation from first principles, Kubernetes projected tokens, IRSA, EKS Pod Identity, G…
Read article →AI in the Workplace, in depth: the gateway, permission-trimmed retrieval, oversharing, shadow AI discovery and prompt log retention
The technical architecture behind a workplace AI rollout: one identity-aware gateway, retrieval that re-checks permissions at query time, why connecto…
Read article →XSS via LLM Outputs, in depth: how injected text becomes script, safe markdown rendering, streaming and CSP
How prompt injection turns LLM answers into cross-site scripting: attack paths, the sinks in chat front ends, a worked support-console attack, safe re…
Read article →Zero Trust for LLM Systems, in depth: mapping NIST SP 800-207 onto models, tool brokers, retrieval and egress
Apply zero trust to LLM applications: why the model holds no authority, where the four enforcement points go, a per-call policy with session taint and…
Read article →LLM Security Certifications, in depth: certificates versus attestations, scoping the model path, one control set for many reports, and a sequencing plan
What ISO/IEC 27001, ISO/IEC 42001, SOC 2, HITRUST and CSA programs actually prove for an LLM product, how to scope model providers, retrieval and agen…
Read article →LLM Security Engineer Role, in depth: owned artefacts, a working week, skills, a regression harness and a severity rubric
What an LLM security engineer actually does: the artefacts the role owns, the weekly streams of work, the skills that matter, a findings regression ha…
Read article →LLM Supply Chain Hardening, in depth: CI trust zones, pull_request_target, SHA-pinned actions, cache poisoning, trusted publishing and verified provenance for ML code
Hardening the build and release path of ML repositories: lessons from the Ultralytics and tj-actions compromises, CI trust zones, safe PR triggers, SH…
Read article →MCP Prompt Injection Defenses, in depth: channel inventory, a host mediator with flow rules, sampling and elicitation policy
Defending MCP hosts against prompt injection: every channel where server text reaches the model, provenance labels, toxic-flow rules in Python, sampli…
Read article →Mechanistic Interpretability, in depth: a security investigation workflow from contrast pairs to causal evidence
Using mechanistic interpretability for LLM security: turning a worry into a behaviour, contrast set and metric, attribution patching code to localize …
Read article →Membership Inference Attacks, in depth: how the scores work, why most LLM results were measuring the wrong thing, and how to run an honest audit on your own model
Membership inference against language models from first principles: threat models and what counts as a member, loss, reference-model, zlib, neighbourh…
Read article →Model Signing + Provenance, in depth: in-toto statements, SLSA provenance for training runs, unforgeable signing and deploy-time lineage policy
How to attach verifiable build provenance to models: the in-toto Statement and SLSA provenance v1 fields, what a training run must record, signing fro…
Read article →Model Stealing, in depth: what an LLM's outputs and infrastructure leak, from logit geometry to weight custody
Model stealing beyond distillation: why full logit vectors reveal a transformer's hidden size and final layer (the softmax bottleneck), how to au…
Read article →Multi-Turn Jailbreaks, in depth: why single-turn safety erodes over a conversation, how to measure it, and model-side mitigations
Multi-turn jailbreaks from the model side: access models and backtracking, what Crescendo, MHJ and ActorBreaker showed, why safety behaviour erodes ov…
Read article →Multimodal Injection, in depth: audio and ultrasound attacks on voice agents, adversarial speech, and the action-side defences that hold
How prompt injection works through audio: the voice-agent audio path, spoken instructions in third-party audio, inaudible ultrasound and laser injecti…
Read article →Multimodal Prompt Injection, in depth: instructions hidden in images, scaling payloads, adversarial pixels and the controls that hold
How prompt injection works through images in vision-language models: typographic, low-contrast, metadata, image-scaling and adversarial-perturbation a…
Read article →NVIDIA NeMo Guardrails Framework, in depth: rail types, config, Colang flows, streaming rails and failure modes
How NVIDIA NeMo Guardrails works: input, dialog, retrieval, execution and output rails, config.yml and self-check prompts, Python actions, Colang 1.0 …
Read article →Network Isolation for Agents, in depth: zoning the agent stack, east-west NetworkPolicy, private model endpoints and a reachability test
Segmenting an LLM agent stack so a hijacked tool runner reaches nothing it should not: a five-zone model, the NetworkPolicy semantics that cause most …
Read article →Open Communities for AI Safety, in depth: what OWASP, ATLAS, AVID, MLCommons, CoSAI and open tool projects produce, how to consume them safely and how to contribute back
A practitioner's guide to open AI-safety communities: what OWASP GenAI, the AI Exchange, MITRE ATLAS, AVID, the AI Incident Database, MLCommons, …
Read article →Fine-Tuning Erodes Safety Training, in depth: the evidence, shallow alignment, data screening, safety mixing and a regression gate for every fine-tune
Why a small fine-tune can remove LLM safety training, benign data included, and how to defend: screening, safety data mixing, constrained objectives, …
Read article →Open-Source Model Security Considerations, in depth: trust boundaries, chat template injection, pinned intake, signing, safety regression gates and serving exposure
Securing open-weight models end to end: which repository files execute code, the GGUF chat template injection CVE as a worked example, a pinned and ha…
Read article →OpenAI Moderation API, in depth: the 13 categories, scores versus flags, inline moderation on generated output, threshold calibration and failure handling
How to use the OpenAI Moderation API properly: the omni-moderation request and response, which of the 13 categories work on images, inline moderation …
Read article →OpenAI Swarm and Agents SDK Security Model, in depth: where trust lives in handoffs, context, guardrails, approvals and traces
A security reviewer's reading of OpenAI Swarm and its successor, the Agents SDK: model-chosen tool dispatch, context that never reaches the model…
Read article →Output Filtering, in depth: classifying model responses for toxicity and harm in context, acting on a hit, and measuring misses
How to filter LLM responses for toxicity and harm: text-only scorers versus conversation-aware judges, a cascade in code, per-category thresholds, an …
Read article →Output Grounding Verification, in depth: checking every claim in an LLM answer against its evidence, scoring support and failing safely
How to verify that an LLM's answer is supported by the evidence it was given: freezing an evidence ledger, extracting atomic claims, aligning cla…
Read article →OWASP Top 10 for LLM Applications, in depth: each 2025 risk, where it lands in your architecture, the controls that work, and how to test them
A practitioner's walk through the OWASP Top 10 for LLM Applications 2025, LLM01 to LLM10: what each risk means in a real system, how the list cha…
Read article →Payload Smuggling, in depth: encodings, ciphers and split payloads, and a defence that does not depend on spotting them
How attackers smuggle instructions past LLM filters with base64, hex, rot13, ciphers, translation, ASCII art and split payloads, why models decode wha…
Read article →Perspective API, in depth: what its toxicity scores mean, the request contract, its role as a research metric, and migrating before the 2026 shutdown
Jigsaw's Perspective API explained for engineers: what the probability score measures, the comments:analyze request and response, a quota-aware c…
Read article →Defensive Prompt Engineering, in depth: scoped policies, marked data, output contracts and prompt regression tests
Defensive prompt engineering for LLM apps: what prompt text can and cannot defend, a five-part system prompt, delimiting and datamarking, placement, o…
Read article →Direct Prompt Injection, in depth: the user as attacker, what an injection can reach, authorization in code and a canary regression harness
Direct prompt injection explained as an application security problem: why instruction hierarchy training lowers but does not remove the risk, a map of…
Read article →Prompt Injection Evaluation, in depth: attack success rate, utility under attack, case matrices, adaptive attackers and honest statistics
How to measure prompt injection robustness for an LLM application: define attack success from environment state, pair it with utility, generate cases …
Read article →Prompt Injection Forensics, in depth: context manifests, walking back from effect to payload, hidden-character triage and blast radius
How to investigate a prompt injection incident: record per-segment context manifests and tool call linkage, walk backwards from the harmful effect to …
Read article →Prompt Injection via RAG Retrieval, in depth: how poisoned chunks win retrieval, what they do in context, and defences at every stage
How attackers inject instructions and false facts through a RAG corpus: who can write to it, how poisoned chunks are optimised to rank into top-k, ans…
Read article →Prompt Injection WAFs, in depth: extracting prompts from API bodies, normalisation, scores to rule actions, conversation rules, blind spots and a safe rollout
How a web application firewall for LLM traffic works: placement at the edge, gateway or app, prompt extraction from JSON, Unicode normalisation, score…
Read article →Protecting Prompt IP, in depth: what is worth protecting, five leak routes, server-side assembly, output leak detection and provenance
An engineering guide to protecting prompt intellectual property: where the value really is, five ways prompts escape beyond extraction attacks, a regi…
Read article →Prompt Licensing and Marketplaces, in depth: delivery models, threat model, machine-readable licences, fingerprints, canaries and intake review
A security view of selling and buying prompts: text delivery versus hosted execution, threats to authors and buyers, what licences can do for text, si…
Read article →System Prompt Stealing, in depth: extraction queries, reconstruction from outputs, probability inversion and measuring your own exposure
How attackers steal LLM system prompts: verified extraction queries, output-based reconstruction such as output2prompt, logit inversion, why output fi…
Read article →Transparency UX for LLM Agents, in depth: showing users what the agent read, did and sent, in a way the model cannot forge
Transparency UX as a security control for LLM agents: what to show, a runtime-authored activity channel separate from model text, trust labels carried…
Read article →Prompt Visibility UX Patterns, in depth: instruction layers, a server-built manifest, memory provenance and explaining refusals
How to show users which instructions shaped an LLM answer: classifying instruction layers by author and visibility, an assembler that emits the prompt…
Read article →PyRIT, in depth: targets, converters, scorers and attack strategies, a working campaign script, judge calibration and memory-backed triage
How Microsoft's PyRIT red-teaming framework works and how to use it well: architecture, a single-turn campaign with converters and a canary score…
Read article →RAG Document Curation
How to prevent poisoned and malicious documents from entering a RAG system's knowledge base. Ingestion policies, content classification, source t…
Read article →RAG Provenance Tracking, in depth: content-addressed lineage, retrieval decision logs, replay, blast radius and erasure
How to build provenance for retrieval-augmented generation: a lineage model of source versions, chunks, retrieval and generation events, content-addre…
Read article →Rate Limiting for LLM Endpoints, in depth: limits derived from GPU capacity, weighted tokens, stream caps, fair sharing and client pacing
How to rate limit LLM endpoints: request, weighted-token, concurrency and spend limits, deriving them from measured prefill and decode throughput, res…
Read article →Red Team Process for LLM Products, in depth: charter, test plan, execution, reproducible findings, retest and regression
A runbook for one LLM red-team engagement: a signed charter with stop conditions, a test plan derived from the threat model, manual and automated exec…
Read article →Refusal Training via RLHF, in depth: behaviour policies, separate safety rewards, constrained optimisation, over-refusal and why trained refusals are shallow
How refusal behaviour is trained with RLHF: a three-way behaviour policy, balanced prompt mixes with lookalikes, separate helpfulness and safety rewar…
Read article →Regulatory Reporting for AI Incidents, in depth: one incident and many regimes, clock computation, a shared fact sheet and the evidence pack
An engineering guide to reporting AI incidents when several regimes apply at once: a regime matrix covering the EU AI Act, GDPR, NIS2, DORA, SEC 8-K, …
Read article →Representation Engineering, in depth: reading and controlling concepts inside LLMs, refusal directions, circuit breakers and monitoring
Representation engineering (RepE) from first principles: linear artificial tomography with paired stimuli and PCA, choosing layers on held-out data, a…
Read article →Responsible AI Toolbox, in depth: RAIInsights, error-analysis cohorts, fairness gates and analysing LLM-backed decisions
A practical guide to Microsoft's Responsible AI Toolbox: what each component computes, the RAIInsights API, error analysis, Fairlearn release gat…
Read article →Safe Completion via Planner Layer, in depth: choosing a response strategy before generation, the plan contract, verification, attacks on the planner and how to run it
How to build a planner layer that turns LLM safety from a refuse-or-comply switch into a chosen response strategy: the architecture, a typed response …
Read article →Scheming and Situational Awareness in LLMs, in depth: the threat model, what the evidence shows, and a control layer for deployed agents
What scheming and situational awareness mean for LLM security: the three ingredients of covert misaligned behaviour, what Sleeper Agents, in-context s…
Read article →Secret Management for Agents, in depth: credential brokers, run-scoped grants, delegated user tokens and secret-free sandboxes
How to manage secrets for AI agents: keep credentials out of the model's reach with a broker and egress proxy, scope authority to a single run, d…
Read article →Secret Scanning in AI Outputs, in depth: where leaked credentials come from, every egress channel, provenance-aware taint matching and an origin-by-channel policy
How to scan LLM and agent outputs for secrets: context echo, memorisation and fabricated keys, egress through tool calls, markdown and logs, a taint r…
Read article →Shadow Prompts, in depth
Shadow prompts in depth: the gap between what users see and what the model receives, an inventory of hidden channels, provenance-tagged prompt assembl…
Read article →Sparse Autoencoders for LLM Security, in depth: feature monitors, validating features, probe baselines and failure modes
Using sparse autoencoder features as LLM security monitors: the monitoring architecture, a TopK SAE and activation hook in PyTorch, a worked procedure…
Read article →Streaming Moderation, in depth: a release watermark, scoring cadence, classifier throughput, retraction events and early abort for token streams
How to moderate LLM output while it streams: why rescoring is quadratic, windows and overlap, a release watermark that decouples generation from relea…
Read article →Supply Chain Attacks on ML, in depth: malicious pickles, loader code paths, hub identity abuse and poisoned datasets
How malicious models and datasets attack ML pipelines: pickle __reduce__ execution, allowlist opcode scanning that fails closed, safetensors and weigh…
Read article →Sycophancy Detection and Mitigation, in depth: paired probes, capitulation metrics, judge hygiene and production monitoring
How to detect and reduce LLM sycophancy: a testable definition, paired-probe evaluation code, opinion shift and capitulation metrics, grading pitfalls…
Read article →Threat Modeling for LLM Applications, in depth: attack trees, cheapest-path analysis and abuse-case tests for a RAG support agent
A practical threat-modeling method for LLM applications: assets and attackers, OWASP LLM 2025 abuse cases, AND/OR attack trees evaluated in Python, sh…
Read article →Glitch Tokens, in depth: why under-trained vocabulary entries break models, how to audit your own tokenizer, and the defences that matter
Glitch tokens from first principles: how a tokenizer trained on one corpus and a model trained on another leave embedding rows untrained, the SolidGol…
Read article →Tool-Use Authorization Design, in depth: the request model, PEP and PDP, effects beyond allow and deny, and policy tests
Designing authorization for agent tool calls: a precise request model, the enforcement and decision point split, require-approval and obligations, a d…
Read article →Training Data Documentation Law, in depth: AB 2013's twelve disclosures, the EU training-content summary, and generating both from one manifest
What California AB 2013 and EU AI Act Article 53(1)(d) require you to publish about training data as of October 2026, a field crosswalk between the tw…
Read article →Watermarking LLM Outputs, in depth: green-list logit bias, z-test detection, distortion-free and SynthID sampling, attacks and running a detector
How sampling-time text watermarks work: keyed green-list logit bias with code, z-score detection with a worked example, low-entropy limits, Gumbel-max…
Read article →