publications

2026

1. ICML-W

   STARS: Synchronous Token Alignment for Robust Supervision in Large Language Models

   M. Quamar, M. Areeb, M. Kuznetsov, and 2 more authors

   In ICML Workshop on Structured Probabilistic Inference & Generative Modeling (SPIGM), 2026

   Accepted

   Bib

   @inproceedings{stars2026,
     title = {{STARS}: Synchronous Token Alignment for Robust Supervision in Large Language Models},
     author = {Quamar, M. and Areeb, M. and Kuznetsov, M. and Ozmen, M. and Celik, B.},
     booktitle = {ICML Workshop on Structured Probabilistic Inference & Generative Modeling (SPIGM)},
     year = {2026},
     note = {Accepted}
   }

2. NeurIPS

   PurpleAudit: A Co-Evolutionary Auditing Framework for Task Hijacking in Multi-Agent Systems

   T. Bilot, Z. Zhang, K. Liu, and 2 more authors

   In Advances in Neural Information Processing Systems (NeurIPS), 2026

   Evaluations and Datasets Track

   Abs Bib PDF

   Multi-agent systems (MASs) are increasingly deployed for complex tasks, yet their security against indirect prompt injection remains poorly understood. As frontier LLMs become more robust to injections with overtly malicious semantics, such as credential exfiltration, unauthorized transactions, or policy bypass, the residual attack surface shifts to task hijacking: an injection that silently redirects an MAS toward an attacker-chosen alternative task plausibly within the agent’s domain, such as the wrong patient’s record, a competitor’s product, or a different CVE. There is no malicious verb to refuse, and existing benchmarks, designed around overtly malicious goals in single-agent settings, do not characterize this surface. We introduce PurpleAudit, an auditing framework that lets a practitioner stress-test their own MAS against task hijacking and derive a tailored system-prompt defense. The framework couples 22 baseline attacks and four prompt/tool-level defense baselines from the literature with a co-evolutionary purple-team procedure, in which red- and blue-team agents evolve stronger attacks and adaptive defenses by reasoning over each other’s execution traces. Applied across frontier backends on ten MASs and a real-world MAS with live web access, PurpleAudit surfaces an MAS-specific attack pattern that frames the injection as a prerequisite for completing the user’s task, reaching 31.26% ASR on Claude Opus 4.5 under the framework’s auditing protocol, where 22 baseline attacks fail entirely. The co-evolved defense suppresses both baseline and evolved attacks at negligible utility cost, transfers across reasoning-capable backends, and operates at the prompt level with low deployment overhead.

   @inproceedings{purpleaudit2026,
     title = {{PurpleAudit}: A Co-Evolutionary Auditing Framework for Task Hijacking in Multi-Agent Systems},
     author = {Bilot, T. and Zhang, Z. and Liu, K. and Kuznetsov, M. and Ding, W.},
     booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
     year = {2026},
     note = {Evaluations and Datasets Track},
   }

3. arXiv

   On the Effectiveness of Kernel-Level Evidence for Agent Security

   S. King, Z. Zhang, M. Kuznetsov, and 3 more authors

   arXiv preprint arXiv:2609.28915, 2026

   In submission

   Abs arXiv Bib

   LLM agents are deployed into infrastructure that grants them broad host authority, yet existing agent-security benchmarks and defenses operate almost exclusively at the application telemetry layer: the served tool manifest, the user prompt, and the model’s messages. Some threats, however, smuggle malicious instructions and actions past the application boundary, leaving them invisible to that layer. In this work, we bridge that gap by pairing application-level agent telemetry with kernel-level syscall traces to present the first paired-evidence characterization of kernel-level versus application-layer signal for agent security. To quantify the value of the enhanced telemetry, we introduce Agent Cross-Layer Evidence (ACE), a paired-session corpus of 4,047 sessions and 17 threat models spanning six delivery-vector families and 14 of the 25 OWASP LLM and agentic threat categories, organized into 12 attack mechanics with per-mechanic characterization of where the most discriminative evidence lies. Across four distinct detector families, we find that kernel evidence is discriminative on its own and that composing it with application-layer evidence generally outperforms either single-layer view, revealing complementary signals that single-layer analyses can miss. We further demonstrate generalization to unseen attack families and transfer to an alternate agent runtime. Together, these findings establish the value of cross-layer evidence for agent security.

   @article{kernelevidence2026,
     title = {On the Effectiveness of Kernel-Level Evidence for Agent Security},
     author = {King, S. and Zhang, Z. and Kuznetsov, M. and Liu, K. and Coskun, B. and Ding, W.},
     journal = {arXiv preprint arXiv:2609.28915},
     year = {2026},
     note = {In submission}
   }

4. NeurIPS-W

   Efficient Hierarchical Transformers for Representing Log Data

   Z. Hou, M. Ghashami, M. Kuznetsov, and 1 more author

   In NeurIPS Workshop on Long-Context Foundation Models, 2026

   Bib

   @inproceedings{hlogformer2026,
     title = {Efficient Hierarchical Transformers for Representing Log Data},
     author = {Hou, Z. and Ghashami, M. and Kuznetsov, M. and Torkamani, M. A.},
     booktitle = {NeurIPS Workshop on Long-Context Foundation Models},
     year = {2026}
   }

2025

1. arXiv

   Adaptive Blockwise Search: Inference-Time Alignment for Large Language Models

   M. Quamar, M. Areeb, N. Sharma, and 6 more authors

   2025

   Bib

   @article{abs2025,
     title = {Adaptive Blockwise Search: Inference-Time Alignment for Large Language Models},
     author = {Quamar, M. and Areeb, M. and Sharma, N. and Nishant and Shreekumar, A. and Jonathan, J. and Ozmen, M. and Kuznetsov, M. and Celik, B.},
     year = {2025}
   }

2024

1. KDD-W

   An Evaluation Benchmark for Generative AI in the Security Domain

   M. Ghashami, M. Kuznetsov, V. Gao, and 6 more authors

   In KDD Workshop on Evaluation of Generative AI, 2024

   Bib

   @inproceedings{genaisec_bench2024,
     title = {An Evaluation Benchmark for Generative {AI} in the Security Domain},
     author = {Ghashami, M. and Kuznetsov, M. and Gao, V. and Teng, G. and Wallis, P. and Xie, J. and Torkamani, A. and Coskun, B. and Ding, W.},
     booktitle = {KDD Workshop on Evaluation of Generative AI},
     year = {2024}
   }

2. NeurIPS-W

   Distributionally Robust Self-Supervised Learning for Tabular Data

   S. Ghosh, J. Xie, and M. Kuznetsov

   In NeurIPS Workshop on Table Representation Learning, 2024

   Bib

   @inproceedings{robust_ssl_tabular2024,
     title = {Distributionally Robust Self-Supervised Learning for Tabular Data},
     author = {Ghosh, S. and Xie, J. and Kuznetsov, M.},
     booktitle = {NeurIPS Workshop on Table Representation Learning},
     year = {2024}
   }

3. CVPR-W

   Salient Object-Aware Background Generation using Text-Guided Diffusion Models

   A. Eshratifar, J. Soares, K. Thadani, and 4 more authors

   In CVPR Workshop on Generative Models for Computer Vision, 2024

   Bib

   @inproceedings{salient_bg_diffusion2024,
     title = {Salient Object-Aware Background Generation using Text-Guided Diffusion Models},
     author = {Eshratifar, A. and Soares, J. and Thadani, K. and Mishra, S. and Kuznetsov, M. and Ku, Y. and De Juan, P.},
     booktitle = {CVPR Workshop on Generative Models for Computer Vision},
     year = {2024}
   }

2023

1. AdKDD

   Staging E-Commerce Products for Online Advertising using Retrieval Assisted Image Generation

   Y. N. Ku, M. Kuznetsov, S. Mishra, and 1 more author

   In AdKDD Workshop at KDD, 2023

   Bib

   @inproceedings{staging2023,
     title = {Staging E-Commerce Products for Online Advertising using Retrieval Assisted Image Generation},
     author = {Ku, Y. N. and Kuznetsov, M. and Mishra, S. and de Juan, P.},
     booktitle = {AdKDD Workshop at KDD},
     year = {2023}
   }

2021

1. KDD

   VisualTextRank: Unsupervised Graph-Based Content Extraction for Automating Ad Text-to-Image Search

   S. Mishra, M. Kuznetsov, G. Srivastava, and 1 more author

   In Proceedings of the ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD), 2021

   ADS Track

   Bib

   @inproceedings{visualtextrank2021,
     title = {{VisualTextRank}: Unsupervised Graph-Based Content Extraction for Automating Ad Text-to-Image Search},
     author = {Mishra, S. and Kuznetsov, M. and Srivastava, G. and Sviridenko, M.},
     booktitle = {Proceedings of the ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD)},
     note = {ADS Track},
     year = {2021}
   }

2018

1. NeurIPS

   A No-Regret Generalization of Hierarchical Softmax to Extreme Multi-Label Classification

   M. Wydmuch, K. Jasinska, M. Kuznetsov, and 2 more authors

   In Advances in Neural Information Processing Systems (NeurIPS), 2018

   Bib

   @inproceedings{hsoftmax2018,
     title = {A No-Regret Generalization of Hierarchical Softmax to Extreme Multi-Label Classification},
     author = {Wydmuch, M. and Jasinska, K. and Kuznetsov, M. and Busa-Fekete, R. and Dembczynski, K.},
     booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
     year = {2018}
   }