Florian Tramèr

Web agents can now safely interact with complex environments while avoiding prompt injection attacks by masking untrusted content without ever reading it.

The effectiveness of antidistillation defenses hinges on the threat model used, revealing that current defenses may offer a false sense of security.

Black-box prompt injection attacks can significantly outperform traditional methods, revealing a critical vulnerability in LLM agents that could be exploited in real-world applications.

Production VLMs like GPT-4, Claude Opus, Gemini, and Grok can be easily manipulated into confidently providing false information via subtle adversarial perturbations to images, even without compromising model alignment.

LLMs can now deanonymize you across platforms using just your online text, blowing past traditional methods and shattering the illusion of anonymity.