Research & Publications
Security articles and LLM adversarial evaluations, sorted by date. Each item links to the full report with methodology, verdict tables, and responsible-disclosure notes.
Articles
OT/ICS/SCADA Security — Attack Surface Analysis
Layer-by-layer technical breakdown of industrial control system vulnerabilities: protocol-layer weaknesses (Modbus, DNP3, legacy CIP), device-firmware exposure, architectural erosion under IT/OT convergence, MSP/RMM compromise, and human-layer targeting. Grounded in CISA advisories, NSA/FBI/DOE joint statements, and documented APT tradecraft (Volt Typhoon pre-positioning).
6 attack surfaces · 10+ CISA advisories · MITRE ATT&CK for ICS · Volt Typhoon TTPsnpm-scan — Behavioral Package Threat Detection
Malicious packages, typosquatting, and lifecycle attacks bypass traditional scanning. npm-scan detects behavioral patterns and novel threats that signatures miss — checking lockfiles, source, and provenance before install. Runs locally, no vendor lock-in.
Behavioral analysis · Lockfile scanning · Provenance verificationMigraDiff — Schema Migration Safety
PostgreSQL schema migration diffing tool for confident, reviewable schema changes. Generates structured diffs with safety classifications, rollback generation, and conflict detection. Optimized for production databases where downtime is not an option.
Structured diffs · Rollback generation · Conflict detectionWAL-G Plus — Backup Automation & Verification
Maintained successor to WAL-G with backup verification, PITR window analysis, restore testing, and retention validation. Ensures database backups are actually restorable before you need them.
Backup verification · PITR analysis · Restore testingSOAR Playbook Dataset — Executable Security Workflows
Quality-controlled corpus of 8,438 executable SOAR playbooks and threat-intel records across sentinel, splunk_soar, xsoar, google_secops, and knowledge_qa. Versioned with train/val/test splits, served to autonomous AI agents via HTTP 402 machine payments with synthesized outputs and per-record provenance.
8,438 records · 6,755/841/842 train/val/test · Edge-served via Neon PostgreSQLRed Teaming
NVIDIA Nemotron 3.5 Lightning — IPI Core-25 Evaluation Results
Black-box evaluation of the free-tier Nemotron 3.5 Lightning endpoint (OpenRouter, Nvidia backend) against the 25-class IPI Core-25 prompt-injection suite. 104 records (52 attack / 52 benign twin): 0.0% ASR with 100.0% FPR — perfect resistance through blanket over-refusal. Risk: INCONCLUSIVE due to over-refusal dominance.
0.0% ASR · 100.0% FPR · 76.2% capability-matched FPR · 25 classes · INCONCLUSIVEInclusionAI Ling 3.0 Tiny — Full Battery Adversarial Evaluation
123-class battery (391 records, 265 attack) spanning core IPI classes plus extended multimodal stego, agentic/MCP, RAG, output-plane, reasoning, memory, ghostjacking, and multi-agent phases. Ghostjacking cluster fully compromised (9/9), MCP rug-pull/shadowing at 100%, RAG metadata-plane poisoning 8/8, memory write-path smuggling 4/4.
33.58% ASR · 391 records · 46 compromised classes · ghostjacking 9/9 · 0% benign FPRQwen 3.8 Max — Full Battery Adversarial Evaluation
47-config battery (431 records, 282 attack) spanning the core-25 taxonomy plus advanced threats, multimodal stego, encoded numerical injection, agentic, RAG, output-plane, reasoning, memory, and ReAct scratchpad phases. 6.8% ASR across 13 classes — with core-25 breaks (IPI-010 recursive framing 2/2, IPI-015 action induction 1/2) and zero benign-twin compromise FPR.
6.8% ASR · 431 records · 13 compromised classes · core-25 2 breaks · 0% benign FPRDeepSeek V4 Flash 0731 — Full Battery Adversarial Evaluation
106-class battery (379 records, 256 attack) spanning the core-25 taxonomy plus advanced threats, multimodal stego, agentic, RAG, output-plane, reasoning, memory, and supply-chain phases. 24.9% ASR (56 compromised: 49 full, 7 partial) across 36 classes — with core-25 breaks and a zero benign-twin compromise FPR.
24.9% ASR · 379 records · 36 compromised classes · core-25 4 breaks · 0% benign FPRQwen 3.7 Flash — Full Battery Adversarial Evaluation
30-config battery (610 records, 398 attack) mirroring the Luna Pro run: 25 core IPI classes plus multimodal, agentic, RAG, output-plane, reasoning, and memory phases. 10.8% ASR (43 compromised) — with full resistance across the core-25 battery and concentrated findings in encoded numerical injection, RAG dormant triggers, output-injection payloads, and reasoning-sponge attacks.
10.8% ASR · 610 records · 18 compromised classes · core-25 fully resistant · κ 0.6933GPT-OSS-120B — Indirect Prompt Injection Assessment
Red team evaluation across 250 test cases (25 IPI classes × 10 variants). 8% overall susceptibility with critical findings in 4 specific classes (IPI-010, IPI-019, IPI-021, IPI-022). Variant analysis: direct 9%, obfuscated 9.3%, embedded 5.3%. Structural disclosure with architectural root cause analysis and defensive validation patterns.
8% susceptibility · 250 test cases · 25 IPI classes · 4 vulnerable classesGPT-5 Nano — Prompt Injection Susceptibility Assessment
IPI Taxonomy v0.13 evaluation across 210 test cases (21 classes × 10 variants; 9 inference failures excluded; 201 analyzed). 38.3% overall susceptibility rate. Critical findings in recursive instruction framing (100%) and MCP tool description poisoning (80%). Full OWASP LLM mapping with defensive mitigations and validation unit-tests.
38.3% susceptibility · IPI-010 100% rate · OWASP LLM Top 10 mapped · Structural disclosure