We test which AI safety approaches hold, which fail, and which cannot deliver the guarantees people expect. Every paper here does one of three jobs: proves a limit, measures a failure, or ships a defense.
Applied inHealthcare/Agentic systems/Multi-agent teams/Model evaluation/Digital forensics/Infrastructure
15 papers · newest first
What can a defense never guarantee?
Prove where defenses cannot hold — what a control can guarantee, and which design directions are dead ends.
03 papers
Proves that continuity, utility preservation, and complete safety cannot coexist for prompt-injection wrapper defenses, and characterizes the boundary where every such defense must fail.
M. Bhatt, S. Munshi, V. S. Narajala, I. Habler, A. Al-Kahfah, K. Huang, J. Webb, B. Gatto, M. T. Hoque
An AI safety result for multi-agent systems. Why do some agent collectives improve with more agents, more debate or a stronger model, while others do not? The productive question is which resource limits a collective, and which intervention removes that limit. The paper decomposes collective intelligence into three ceilings: information (a team cannot know more than its starting data plus what its tools can carry — talking and voting add nothing to that budget, and adding agents raises it only through more tool access), reasoning (what bounded agents can use is at most what they hold; debate and compute close the gap but never pass it, at a cost from linear to infeasible), and communication (evidence split across agents is unusable until enough is exchanged — about n/2 bits for some n-bit tasks even with unlimited computation). The decomposition explains published findings that otherwise look contradictory, yields a diagnostic for which ceiling binds, and makes predictions a single capability axis does not. Proofs are short; every finite example is verified exactly in public code.
M. Bhatt
Examines why benchmark success may be necessary yet insufficient evidence of human-like reasoning, and formalizes the gap between measured performance and the claimed capability.
M. Bhatt
Where does the system actually break?
Find where systems fail under attack — harder evaluations that expose weaknesses static benchmarks miss.
04 papers
Introduces an automated framework for testing logic-layer prompt-control injection across persistent memory, retrieval pipelines, tools, and multi-stage agent lifecycles.
H. Atta, K. Huang, K. R. Lambros, Y. Mehmood, M. Z. Baig, M. A. Rahman, M. Bhatt, et al.
Maps unsafe behavioral regions in language models as attraction basins, using quality-diversity search to expose distinct vulnerability niches and their geometry.
S. Munshi, M. Bhatt, V. S. Narajala, I. Habler, A. Al-Kahfah, K. Huang, B. Gatto
Adapts Go-Explore to agent red teaming and shows that random-seed variance can dominate algorithm choices, making multi-seed evaluation essential for defensible comparisons.
M. Bhatt, A. Wood, I. Habler, A. Al-Kahfah
Defines logic-layer prompt-control injection, where delayed or conditional payloads persist through memory, vector stores, and tool-connected agent systems.
H. Atta, K. Huang, M. Bhatt, K. Ahmed, M. A. Ul Haq, Y. Mehmood
What can a defender run tomorrow?
Turn findings into usable protection — concrete defenses, deployed tools, and real vulnerability disclosure.
08 papers
Presents QFIRE, an inline, provider-agnostic prompt firewall for healthcare AI agents that combines positive-security scope constraints, an asynchronous detector graph, and de-obfuscation — and releases QFIRE-HealthBench, where generic injection detectors recover only 0.40 recall while QFIRE's scope+PHI chain reaches 0.83.
J. Schwoebel, I. Semenec, J. Rousseva, M. G. Frasch, R. Thorstenson, M. Bhatt
Proposes an artifact-centric architecture that embeds provenance, access control, and audit evidence into the data objects used by AI agents.
V. S. Narajala, M. Bhatt, I. Habler, R. F. Del Rosario, A. Dawson
Mitigates tool squatting and rug pull attacks in the Model Context Protocol (MCP) by hardening tool definitions with OAuth-enhanced signatures and policy-based access control, preventing malicious or mutated tools from being silently substituted into agent workflows.
M. Bhatt, V. S. Narajala, I. Habler
Studies economic and security behavior when autonomous language-model agents outsource tasks according to skill within multi-agent teams.
M. Bhatt, R. F. Del Rosario, V. S. Narajala, I. Habler
Introduces a hierarchy-based machine-learning approach to classifying file fragments — a core digital-forensics problem when file-system metadata is unavailable — improving type identification from raw binary content.
M. Bhatt, A. Mishra, M. W. U. Kabir, S. E. Blake-Gatto, R. Rajendra, M. T. Hoque, G. G. Richard III, V. Roussev
Uses relocation entries in ELF binaries to fingerprint Linux kernel versions from memory images, enabling forensic tools to apply correct kernel profiles during memory analysis.
M. Bhatt, I. Ahmed
Describes a hands-on curriculum using virtual machine introspection to teach operating-systems security, letting students observe rootkits and live system state from outside the compromised guest.
M. Bhatt, I. Ahmed, Z. Lin
Presents an automated approach to detecting and mitigating kernel rootkits in cloud environments using virtual machine introspection, without agents inside the guest.
J. Grimm, I. Ahmed, V. Roussev, M. Bhatt, M. Hong
Replications, counterexamples, and disagreements belong in the record. Propose a follow-up study, a benchmark, or a collaboration — or tell us where a result does not hold.