AI Scientist and Team Lead at Meta. Previously founder and CEO of AI Sequrity.
With Alexander Panfilov, on replaying and decoding encrypted reasoning across OpenAI, Anthropic and Google.
Seminar on where prompt injection attacks and defenses stand, and what it takes to secure AI agents.
Talk on running modern AI systems with real security guarantees.
Why securing AI agents is harder than it looks, plus model collapse and its critics.
With Regina G. Barber, on model collapse and AI trained on AI-generated text.
A Q&A on what happens when models learn from other models’ output.
Why ML is more fragile than once thought in adversarial settings.
The preprint that introduced model collapse, a year before the Nature paper.
I work on making AI systems secure -- especially agents that read untrusted content, call tools, and act on people’s behalf.
I'm an AI Scientist and Team Lead at Meta in London, where I joined the team for AI security. I work across the Muse Spark and Muse Wonder model families and products such as Muse Code and Muse Agent, along with other AI, safety and security efforts.
Before Meta I founded AI Sequrity, building defensive AI technology for agents, and gave talks on it at Black Hat and RSA. In April 2026 the whole team moved over to Meta. Before that I was a Senior Research Scientist at Google DeepMind, leading research on security and privacy. Amongst other things, I contributed to the Gemini 1.5 and Gemini 2.5 technical reports.
CaMeL wraps an untrusted LLM in a system that tracks control and data flow, so security policies hold even when the model itself is fooled.
Brings by-design prompt-injection security to agents that operate a full computer, keeping up to 57% of frontier-model performance on OSWorld.
Hidden chain-of-thought from OpenAI, Anthropic and Google could be decrypted by handing it to a weaker model from the same provider. All three shipped fixes — and OpenAI and Anthropic later reported the same attack being used in real distillation campaigns.
Adaptive attacks break 12 recent jailbreak and prompt-injection defenses that looked robust under static testing.
A backdoored architecture can read and rewrite other users’ requests in the same inference batch — and over 200 Hugging Face models already leak across the batch by accident.
Backdoors inserted by the compiler, invisible to anyone inspecting the training data or the weights.
Speaking through a hardware-store PVC tube is enough to impersonate someone to voice-ID systems.
Imperceptible text encodings let an attacker steer results on Google, Bing and LLM-powered chat search.
A malicious server plants “trap weights” and recovers users’ data perfectly from federated learning updates.
Invisible characters, homoglyphs and reorderings quietly break production NLP systems from Google, Microsoft and others.
Inputs crafted to max out a network’s energy use and latency — up to 200× more energy — opening a new class of availability attacks.
Scales the strongest membership inference attack to LLMs trained on 20B+ tokens — and finds many per-example verdicts are no better than a coin flip.
Why unlearning methods can’t deliver what copyright and privacy policy expect of them.
Why LLMs derail when asked to repeat a single word: long repetition breaks the attention-sink circuit. Comes with a targeted patch.
Tells which GPU and software stack served a model from tiny numerical differences in its outputs.
Expert routing in batched Mixture-of-Experts models can leak another user’s prompt.
Uses computability theory to show the limits of censoring LLM outputs by meaning, and argues for syntactic constraints instead.
Backdoors hidden in a model’s architecture rather than its weights — they survive retraining from scratch.
Peer-reviewed papers at main conferences and journals.
