AI / LLM Security

LLM Data Leakage Lab

A deliberately vulnerable LLM-enabled Flask application, built to demonstrate a real cross-user data leakage vulnerability class and then measure three progressively stronger defenses against it: identity trust, context isolation, input risk inspection, output redaction, and structured security logging. The vulnerable baseline is preserved unmodified so the 'before' stays real and reproducible; the defended modes are implemented alongside it, not in place of it, so the same attack set can be replayed against all three and compared directly.

Outcome: Unauthorized cross-user disclosure measured at 25% under the original vulnerable baseline, dropping to 0% once context isolation is added (Partial Defense) -- the full Defense-in-Depth mode adds pre-model risk-based blocking, output redaction, and resolves identity from a server-side session token rather than a client-declared field, which is what stops a separate identity-spoofing (IDOR) vector the first two modes both leave open.

Unauthorized disclosure rate -- Vulnerable Baseline:

25% (3/12 adversarial cases)

Unauthorized disclosure rate -- Partial Defense (context isolation only):

0% (0/12 adversarial cases)

Unauthorized disclosure rate -- Defense in Depth:

0% (0/12 adversarial cases)

Identity-spoofing (IDOR) case blocked:

Only Defense in Depth (1/1); Baseline and Partial Defense both allow it

Adversarial requests blocked before reaching the model -- Defense in Depth:

33% (4/12)

Adaptive Moving Target Defense for LLM Security

MSc research applying Adaptive Moving Target Defense (AMTD) to secure LLM-enabled systems against prompt injection, jailbreak attempts, and sensitive data leakage. The design compares a static baseline, a fixed-defense baseline, and an adaptive AMTD condition, introducing controlled changes to the defensive prompt layer, route-selection logic, and response handling based on assessed input risk -- combining prompt risk analysis, adaptive prompt wrapping, prompt randomization, and layered defense to reduce attacker predictability. Methodology in progress, per dated research-update posts: deploying a lower-cost local model alongside a stronger API-based model with an adaptive switching mechanism that escalates requests based on assessed risk; a risk-scoring pipeline that selects a defensive response by severity; red-team attack integration via Promptfoo, with broader testing planned using Garak and PyRIT; comparison of static vs. adaptive defense strategies measured on attack success rate, benign-task performance, latency, cost, routing behaviour, and resilience; a multi-judge evaluation design with an adjudicator for disagreement cases; and a canary-string method (planting a unique marker inside protected context and checking whether adversarial prompts cause the model to reveal it) as a data-leak detection technique. Candidate models evaluated for the pipeline (via Hugging Face) include deepset/deberta-v3-base-injection, meta-llama/Prompt-Guard-86M, several openai/gpt-oss variants, and zai-org/GLM-5.2.

Outcome: Research in progress -- attack-success-rate, latency, and resilience results are not yet finalized.

Three-Layer Defense Framework for Secure LLM Applications

A layered security framework for LLM-enabled applications designed and evaluated to reduce prompt injection, unauthorized data access, and sensitive information leakage, implementing three defensive layers: Context Isolation (restricts model access to only the data a user is authorized to view), Prompt Sanitization (detects and filters malicious or manipulative user inputs before they reach the model), and Response Redaction (masks or blocks sensitive information if the model attempts to expose it in its output). Testing different layer combinations showed that a single control provides only limited protection, and that stronger security comes from combining multiple defenses around the LLM rather than assuming the model itself can enforce trust boundaries.

Outcome: Key finding: single-layer controls under-perform combined, defense-in-depth layering -- the same architectural pattern independently measured end-to-end in the LLM Data Leakage Lab.

AI-Generated Voice / Deepfake Fraud Evidence Triage

A course final project building a triage application for suspected AI-generated (deepfake) audio and video evidence, exploring how investigators could systematically assess such evidence rather than relying on ad hoc review. The application performs SHA-256 hashing to preserve evidence integrity, extracts metadata, applies rule-based triage to identify indicators warranting further investigation, and produces structured forensic findings.

Outcome: Final grade: 95/100 (Digital Forensics course capstone project).

QuickHalo

Commercial SaaS product for service businesses, focused on automating customer retention and recurring-service engagement: automated service reminders, customer follow-up, appointment/booking flows, recurring-customer engagement, and AI-assisted customer interactions.