M. Russinovich

PyRIT: Democratizing AI Red Teaming Through Open-Source Tooling

CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering

CounterSteer largely neutralizes instructional takeover: a black-box framing search cracks 3 of 18 development samples, and Parameter manipulation--attacker-chosen arguments in otherwise legitimate calls--is only partially resisted.

Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs

This work shows that a weaker, unaligned model can split a harmful task into benign-looking subproblems, consult a stronger aligned model independently on each, and combine the answers locally to laundering attack capability laundering.

SpecGuard: Inference-Time Backdoor Detection For Free

SpecGuard is introduced, an inference-time backdoor detector that repurposes speculative decoding at zero added model-computation cost and doubles as a free, always-on signal for detecting backdoored LLM behavior.

Fool's Gold: Defensive Deception Against Safety-Removal Attacks on Open-Weight Models

The defense, decoy hardening ("Fool's Gold"), concedes the refusal strip and poisons its payoff: once refusal is stripped, most answers to hazardous operational requests are confident, fluent decoys whose critical elements are falsified.