Personal Project
A deliberately vulnerable LLM-enabled Flask application, built to demonstrate a real cross-user data leakage vulnerability class and then measure three progressively stronger defenses against it: identity trust, context isolation, input risk inspection, output redaction, and structured security logging. The vulnerable baseline is preserved unmodified so the 'before' stays real and reproducible; the defended modes are implemented alongside it, not in place of it, so the same attack set can be replayed against all three and compared directly.
Outcome: Unauthorized cross-user disclosure measured at 25% under the original vulnerable baseline, dropping to 0% once context isolation is added (Partial Defense) -- the full Defense-in-Depth mode adds pre-model risk-based blocking, output redaction, and resolves identity from a server-side session token rather than a client-declared field, which is what stops a separate identity-spoofing (IDOR) vector the first two modes both leave open.
- Unauthorized disclosure rate -- Vulnerable Baseline:
- 25% (3/12 adversarial cases)
- Unauthorized disclosure rate -- Partial Defense (context isolation only):
- 0% (0/12 adversarial cases)
- Unauthorized disclosure rate -- Defense in Depth:
- 0% (0/12 adversarial cases)
- Identity-spoofing (IDOR) case blocked:
- Only Defense in Depth (1/1); Baseline and Partial Defense both allow it
- Adversarial requests blocked before reaching the model -- Defense in Depth:
- 33% (4/12)
View repository →Research
MSc research applying Adaptive Moving Target Defense (AMTD) to secure LLM-enabled systems against prompt injection, jailbreak attempts, and sensitive data leakage. The design compares a static baseline, a fixed-defense baseline, and an adaptive AMTD condition, introducing controlled changes to the defensive prompt layer, route-selection logic, and response handling based on assessed input risk -- combining prompt risk analysis, adaptive prompt wrapping, prompt randomization, and layered defense to reduce attacker predictability.
Methodology in progress, per dated research-update posts: deploying a lower-cost local model alongside a stronger API-based model with an adaptive switching mechanism that escalates requests based on assessed risk; a risk-scoring pipeline that selects a defensive response by severity; red-team attack integration via Promptfoo, with broader testing planned using Garak and PyRIT; comparison of static vs. adaptive defense strategies measured on attack success rate, benign-task performance, latency, cost, routing behaviour, and resilience; a multi-judge evaluation design with an adjudicator for disagreement cases; and a canary-string method (planting a unique marker inside protected context and checking whether adversarial prompts cause the model to reveal it) as a data-leak detection technique. Candidate models evaluated for the pipeline (via Hugging Face) include deepset/deberta-v3-base-injection, meta-llama/Prompt-Guard-86M, several openai/gpt-oss variants, and zai-org/GLM-5.2.
Outcome: Research in progress -- attack-success-rate, latency, and resilience results are not yet finalized.
Research
A layered security framework for LLM-enabled applications designed and evaluated to reduce prompt injection, unauthorized data access, and sensitive information leakage, implementing three defensive layers: Context Isolation (restricts model access to only the data a user is authorized to view), Prompt Sanitization (detects and filters malicious or manipulative user inputs before they reach the model), and Response Redaction (masks or blocks sensitive information if the model attempts to expose it in its output). Testing different layer combinations showed that a single control provides only limited protection, and that stronger security comes from combining multiple defenses around the LLM rather than assuming the model itself can enforce trust boundaries.
Outcome: Key finding: single-layer controls under-perform combined, defense-in-depth layering -- the same architectural pattern independently measured end-to-end in the LLM Data Leakage Lab.
Academic Project
A course final project building a triage application for suspected AI-generated (deepfake) audio and video evidence, exploring how investigators could systematically assess such evidence rather than relying on ad hoc review. The application performs SHA-256 hashing to preserve evidence integrity, extracts metadata, applies rule-based triage to identify indicators warranting further investigation, and produces structured forensic findings.
Outcome: Final grade: 95/100 (Digital Forensics course capstone project).
Academic Project
A threat intelligence project classifying malware samples by their associated Advanced Persistent Threat (APT) groups using opcode-based analysis. Workflow: Dataset Creation (extracted and cleaned opcode text from malware samples, mapped each to its corresponding APT group, building a structured dataset of file hashes, APT labels, and opcode text features); Feature Engineering (converted opcode sequences into numerical features using unigram and bigram representations); Model Training (trained and compared multiple classifiers -- Support Vector Machine, K-Nearest Neighbours, and Decision Tree); Evaluation (assessed performance using accuracy, precision, recall, F1-score, and confusion matrices); and a Threat Intelligence Focus exploring how malware behaviour patterns can support attribution and help analysts connect samples to known adversary groups.
Outcome: Reinforced the applied value of machine learning in cyber threat intelligence -- malware triage, pattern recognition, and early-stage attribution support.