Operationalizing CaMeL: Strengthening LLM Defenses for Enterprise Deployment

Emma Miller; Krti Tallam

REVIEW 4 major objections 4 minor 31 references

Operationalizing CaMeL: Strengthening LLM Defenses for Enterprise Deployment

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read CaMeL's prompt-injection defense can be made enterprise-ready by adding prompt screening, output auditing, tiered-risk access, and a formally verified intermediate language, without retraining the underlying models.

desk verdict A plausible list of enterprise hardening ideas for CaMeL, but the central citation is wrong and the quantitative claims are unsupported, so the paper doesn't hold together. read the letter →

arxiv 2505.22852 v1 pith:XT6MUUMR submitted 2025-05-28 cs.CR cs.AI

Krti Tallam , Emma Miller This is my paper

classification cs.CRcs.AI

keywords promptinjectiondefensecapability-basedsandboxLLMagentsenterprisesecuritytiered-riskaccesscontroloutputauditingside-channelmitigationlanguage-basedinformationflow

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This response paper does not claim to have built or tested anything; it claims that CaMeL, a capability-based sandbox that protects LLM agents from prompt injection, can be made enterprise-ready by adding four engineering layers: screening of the initial user prompt, auditing of the model's outputs, a tiered-risk access policy that relaxes checks for low-risk actions while keeping full checks for irreversible ones, and a formally specified intermediate language for the plan interpreter. The author argues these additions close three gaps—trusting the initial prompt, ignoring output-side manipulation, and overlooking side channels—and reduce the dual-LLM latency and policy-maintenance costs that block deployment. A sympathetic reader would care because the claim, if right, gives enterprises a path to stronger prompt-injection defenses without retraining models, with lower user friction and a route to machine-checked noninterference guarantees. None of the proposed changes are implemented or benchmarked in the paper.

What carries the argument

The load-bearing mechanism is CaMeL's capability-based execution layer itself: every data value carries provenance and access metadata, and every tool invocation must clear explicit policy checks before running. The paper's principal new mechanism is the tiered-risk access model, which replaces the binary trusted/untrusted decision with three tiers—green for read-only actions on open data, yellow for changes within the user's own environment that prompt a lightweight confirmation, and red for irreversible or externally visible operations that keep full capability checks and require multi-factor approval—so that utility and control are balanced rather than traded off. A second mechanism, the verified intermediate language, replaces Python's dynamic typing, exceptions, and reflection with bounded loops, first-order calls, and capability labels in the type system, so that noninterference can in principle be proved mechanically. These mechanisms are what would turn CaMeL from a benchmark success into a system the paper claims can be operated and assured at enterprise scale.

What would settle it

Implement the four proposed augmentations on an existing CaMeL prototype and run the AgentDojo benchmark together with a red-team battery. The claim fails if the tiered policy does not raise the 67 percent completion rate while still blocking all simulated attacks, if prompt screening misses a crafted injection that the original CaMeL layer catches, if output auditing lets a hidden instruction through, or if the verified intermediate language cannot be proved noninterfering by a mechanized proof assistant.

Watch

Extended reading notes

Core claim

The paper's central claim is that CaMeL's core design—separating a privileged planning LLM from a quarantined validation LLM and tagging every data value with provenance capabilities—is essentially right, but its threat model and architecture leave four concrete gaps. In the author's telling, the trusted-user assumption lets a single crafted phishing prompt plant persistent logic in the planning layer; the absence of output inspection lets a benign document smuggle instructions that the agent then echoes to a human; the strict 'reject any untrusted argument' policy leaves only a 67 percent task completion rate on the AgentDojo benchmark; and side channels such as loop counts, exceptions, and timing still leak information, while the dual-LLM design and hand-written Python policies create latency and policy sprawl at scale. The proposed remedy is a package of augmentations—prompt screening with reputation and anomaly checks, output auditing using natural-language inference, a green/yellow/red tiered access model with multi-factor approval for irreversible actions, and a minimal typed intermediate language with capability labels—which the paper argues would broaden coverage, cut token use and latency by up to 50 percent, and support formal noninterference proofs without changing the underlying models.

Load-bearing premise

The load-bearing premise is that the proposed engineering changes—prompt screening, output auditing, tiered access, and a verified intermediate language—would deliver the claimed security and usability improvements, and that the paper's cited source for CaMeL's architecture actually describes CaMeL, since none of the changes are implemented or tested and the cited source appears to be an unrelated article on poisoning language models.

Editorial extensions

If this is right

CaMeL's protection would span the full conversation lifecycle: untrusted initial prompts, output echoes, and side-channel leaks would be covered, not just tool-invocation data flow.
Enterprise deployment becomes plausible because plan-template caching, deterministic micro-parsers, and Q-LLM batching are projected to cut token usage and end-to-end latency by up to 50 percent.
The green/yellow/red tiers would reduce prompt fatigue by limiting confirmations to yellow and red tiers while keeping multi-factor approval for irreversible operations like external email or wire transfers.
Regulated environments could pursue machine-checked noninterference guarantees through the verified intermediate language, aiming at assurance comparable to verified compilers and operating-system kernels.
The layered approach would complement model-level instruction tuning, OS-level sandboxing, and static filtering, adding dynamic, context-aware data-flow control that these other defenses lack.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The 90-percent-workflow-preservation and full-attack-blocking figures are borrowed from the attribute-based access-control literature, not from any CaMeL implementation; the natural next experiment is to benchmark the tiered policy directly on AgentDojo.
If the tiered policy works as claimed, it suggests a design principle for LLM agent security generally: scale user confirmation to the irreversibility of the action rather than to the provenance of the data alone.
The verified-intermediate-language proposal connects LLM agent planning to the language-based information-flow tradition, but the hard open problem is whether an LLM can reliably produce plans in such a restricted DSL without losing the flexibility that makes agents useful.
Because the reference the paper cites for CaMeL's own architecture actually points to an unrelated article on poisoning language models, any attempt to reproduce the 67 percent baseline must first locate the correct CaMeL paper.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The short version: this reads like a well-organized set of engineering suggestions for hardening CaMeL, but the paper cites the wrong paper as its baseline (reference [1] is Carlini et al. on poisoning language models, not CaMeL), and the few quantitative claims are either vague or misattributed. That makes the whole argument unanchored.

Credit where it's due: the paper correctly identifies real gaps in CaMeL's threat model — trusting the initial prompt, not inspecting outputs, and ignoring side channels. The proposed mitigations (prompt screening, output auditing, tiered risk, provenance tagging) are sensible and align with established practice. The side-channel section is a decent taxonomy of loop-counting, exception-based, and timing leaks, with standard mitigations. As a checklist for someone hardening an LLM agent sandbox, it's not bad.

But the soft spots are load-bearing. Reference [1] is misattributed, so the 67 percent AgentDojo figure and the critique of CaMeL's dual-LLM design are not anchored to the actual system. The '<5 ms prompt screening' and 'up to 50 percent' overhead reduction come from unspecified 'internal tests' with no methodology. The 'over 90 percent of legitimate workflows' claim is attributed to a NIST ABAC guide that contains no such evaluation. Several references are unpublished self-citations by the first author, which provide no independent support. There is no implementation, no data, no formal proof.

This is not a research contribution in its current form. It is a proposal document. The prose is clear and the reasoning is plausible, but the central citation error means a reader cannot tell whether the recommendations actually apply to the real CaMeL. A serious editor should desk-reject this. The authors could resubmit if they fix the citation, either by correctly citing CaMeL or by reframing the paper as a general hardening guide for LLM agent sandboxes, and by including at least a small evaluation of at least one proposed mitigation.

For a colleague: don't spend referee time on this version. If you want a list of enterprise hardening ideas for LLM agents, skim Sections 2 and 4. Otherwise skip it.

Referee Report

4 major / 4 minor

Summary. The paper proposes four engineering enhancements to the CaMeL capability-based sandbox for LLM agents: prompt screening, output auditing, a tiered-risk access model, and a verified intermediate language. It argues that these changes broaden CaMeL's threat coverage, reduce overhead, and support enterprise-scale deployment without modifying the underlying models. The paper contains no implementation, no experimental data, and no formal proofs; its quantitative claims are attributed either to unspecified 'internal tests' or to a NIST guide that reports no such results. The description of CaMeL is anchored to a bibliography entry that is in fact an unrelated paper on data poisoning during instruction tuning.

Significance. If the proposed changes were implemented and measured, the work could be useful to enterprises deploying LLM agents: the side-channel inventory in Section 4 and the recommendations on policy-as-code and formal verification in Sections 3 and 5 are sensible directions and are connected to relevant security-engineering literature. As presented, however, the paper does not substantiate its central claim. It offers no machine-checked proofs, no reproducible system, no dataset, and no falsifiable predictions; the only quantitative results are unverifiable internal numbers or misattributed to sources that contain no such evaluation. The contribution is therefore best described as a plausible research agenda rather than a validated technical result.

major comments (4)

[§1 and §3, reference [1]] The manuscript anchors its entire description of CaMeL and its baseline performance to reference [1], but that reference is Carlini et al., 'Poisoning language models during instruction tuning' (arXiv:2302.12173), which does not describe CaMeL, its dual-LLM architecture, its capability labels, or any AgentDojo results. As a result, the claims in Sections 1 and 3 about what CaMeL does and its '67 percent completion rate' on AgentDojo are unverified for the object actually discussed, and the proposed improvements in Sections 2–5 cannot be assessed against the real system. This is a load-bearing citation error, not a formatting issue.
[§3 (tiered-risk policy)] The sentence beginning 'Large-scale ABAC evaluations show that this kind of stratification preserves over 90 percent of legitimate workflows while blocking all simulated attacks in cloud testbeds' is supported by citation [10], which is NIST SP 800-162, a technical guide to attribute-based access control. That document reports no such 90-percent preservation result and no simulated-attack evaluation. This quantitative claim is central to the paper's security/usability trade-off argument and currently has no verifiable basis.
[§2.1 and §5.1] The manuscript asserts specific performance numbers for its proposed measures—'<5 ms' prompt screening in Section 2.1 and 'up to 50 percent' latency and token reduction in Section 5.1—and attributes them to 'internal tests.' No methodology, system implementation, dataset, or reproduction details are provided, so these numbers cannot be checked. Since the paper's central claim is that the proposed engineering changes improve operational usability, the absence of any implemented or measured system is a substantive gap.
[References [2], [4], [5], [24], and [31]] Several claims rely on unpublished self-citations by the first author (references [2], [4], [5], [24], and [31]). These items do not provide independent or verifiable support; for example, the claimed value of the prompt-screening gateway is supported by [4] and [5], and the adaptive-risk discussion is supported by [31]. Replacing these with peer-reviewed or otherwise publicly accessible sources would be necessary to establish the paper's evidence base.

minor comments (4)

[§1 and §2.1] The author name in §1 appears as 'Debenedettiet al.' without a separating space, and the latency value in §2.1 appears as '¡5 ms' rather than '<5 ms'; both should be corrected.
[§3] The bullet label 'Y ellow' contains a formatting artifact, and the heading 'F rom Empirical Checks to F ormal Guarantees' has similar stray capitalization; these should be fixed.
[§5.3] The text refers to 'a proof-oriented platform like F,' which should read 'F*' (F-star) to be unambiguous and to match the referenced POPL paper on dependent types and effects.
[References] The bibliography has inconsistent formatting, including missing access dates for web resources such as [19], incomplete author lists in [20] and [23], and a reference [1] that does not support the text; a careful pass over the references is needed.

Circularity Check

1 steps flagged · score 2.0 of 10

No derivation chain exists to be circular; this is a design proposal with unsupported empirical claims. One limited self-citation carries a subclaim, but nothing reduces to the paper's own inputs.

self citation load bearing [Section 2.1, 'Initial Prompt Trust', with references [4] and [5]]
"Since this involves only a short string, latency remains low (<5 ms in internal tests), yet the screening closes a high-impact entry point for injection attacks [4, 5]."

References [4] and [5] are both unpublished works by first author Krti Tallam and are the only support for the assertion that prompt screening closes a high-impact entry point. The cited works are not machine-checked, code-reproduced, or externally falsifiable in the paper, so the citations provide no independent evidence; the claim rests on the author's own prior assertion. This is load-bearing for the Section 2 screening proposal, though it does not reduce the paper's overall recommendation to its inputs.

full rationale

This paper is a technical-response and design proposal rather than a derivation: it contains no equations, no fitted parameters, and no prediction that is constructed from its own inputs. The 67 percent AgentDojo figure, the 'up to 50 percent' latency reduction, and the 'over 90 percent' ABAC workflow preservation are attributed to citations or 'internal tests' but are not derived in the text; unsupported empirical claims are a correctness problem, not circularity. The one circularity-adjacent feature is Section 2.1, where the efficacy of prompt screening is supported only by the first author's unpublished self-citations [4,5]; this is a limited load-bearing self-citation. Separately, reference [1] is not the CaMeL paper but Carlini et al.'s instruction-tuning poisoning paper, so the CaMeL architecture and the 67 percent AgentDojo baseline are unanchored; this is a citation-integrity defect, not a circular reduction. Likewise, NIST SP 800-162 is cited for a 90-percent/block-all evaluation it does not contain. Because no claim reduces by construction to the paper's own definitions or fitted values, the circularity score remains low.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No free parameters or invented entities are present because the paper is a set of proposals without experiments. The listed axioms are untested domain assumptions that the paper depends on for its recommendations to hold.

assumptions (4)

domain assumption Reference [1] accurately describes CaMeL's architecture and benchmark results.
The paper builds its critique on CaMeL's dual-LLM design and 67% AgentDojo completion rate, but the cited reference is Carlini et al. 2023, not the CaMeL paper introduced by Debenedetti et al.
domain assumption Prompt screening via reputation checks, entropy, and perplexity can reliably detect malicious prompts.
Proposed in Section 2.1 without evaluation; relies on self-cited references [4] and [5].
domain assumption A tiered-risk policy preserves security while improving usability.
Proposed in Section 3 with no implementation; the cited NIST ABAC guide does not validate this specific tiered design for LLM agents.
domain assumption A security-oriented DSL can be formally verified for noninterference in a proof assistant.
Mentioned as future work in Sections 3 and 8; no formal model or proof is provided.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Operationalizing CaMeL: Strengthening LLM Defenses for Enterprise Deployment." pith.science (2026). https://pith.science/paper/XT6MUUMR

@misc{pith2026250522852,
  author       = {Pith},
  title        = {Pith review of: Operationalizing CaMeL: Strengthening LLM Defenses for Enterprise Deployment},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XT6MUUMR}},
  note         = {Machine review of arXiv:2505.22852}
}

read the original abstract

CaMeL (Capabilities for Machine Learning) introduces a capability-based sandbox to mitigate prompt injection attacks in large language model (LLM) agents. While effective, CaMeL assumes a trusted user prompt, omits side-channel concerns, and incurs performance tradeoffs due to its dual-LLM design. This response identifies these issues and proposes engineering improvements to expand CaMeL's threat coverage and operational usability. We introduce: (1) prompt screening for initial inputs, (2) output auditing to detect instruction leakage, (3) a tiered-risk access model to balance usability and control, and (4) a verified intermediate language for formal guarantees. Together, these upgrades align CaMeL with best practices in enterprise security and support scalable deployment.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

31 extracted references · 24 canonical work pages

[1]

Poisoning language models during instruction tuning

Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Miles Brundage, Tom Brown, Deep Ganguli, ´Ulfar Erlingsson, et al. Poisoning language models during instruction tuning. arXiv preprint arXiv:2302.12173 , 2023. https://arxiv.org/abs/ 2302.12173

arXiv 2023
[10]

Hu, David Ferraiolo, Richard Kuhn, and Angelo Schnitzer

Vincent C. Hu, David Ferraiolo, Richard Kuhn, and Angelo Schnitzer. Guide to attribute based access control (abac): Definition and considerations. Technical Report SP 800-162, NIST, 2015

work page 2015
[2]

Cybersentinel: An emergent threat detection system for ai security, 2025

Krti Tallam. Cybersentinel: An emergent threat detection system for ai security, 2025

work page 2025
[4]

Engineering risk-aware, security-by-design frameworks for assurance of large-scale autonomous ai models, 2025

Krti Tallam. Engineering risk-aware, security-by-design frameworks for assurance of large-scale autonomous ai models, 2025

work page 2025
[5]

The cyber immune system: Harnessing adversarial forces for security resilience, 2025

Krti Tallam. The cyber immune system: Harnessing adversarial forces for security resilience, 2025

work page 2025
[24]

Transforming cyber defense: Harnessing agentic and frontier ai for proactive, ethical threat intelligence, 2025

Krti Tallam. Transforming cyber defense: Harnessing agentic and frontier ai for proactive, ethical threat intelligence, 2025

work page 2025
[31]

Alignment, agency and autonomy in frontier ai: A systems engineering perspec- tive, 2025

Krti Tallam. Alignment, agency and autonomy in frontier ai: A systems engineering perspec- tive, 2025. 10

work page 2025
[3]

A comparison of machine learning techniques for phishing detection

Saleh Abu-Nimeh, Dan Nappa, Xiang Wang, and Salil Nair. A comparison of machine learning techniques for phishing detection. eCrime Researchers Summit, pages 60–69, 2007

work page 2007

Show all 31 references

[6]

A broad-coverage challenge corpus for sentence understanding through inference

Adina Williams, Nikita Nangia, and Samuel Bowman. A broad-coverage challenge corpus for sentence understanding through inference. NAACL-HLT, pages 1112–1122, 2018

2018
[7]

Andrew C. Myers. Jif: Java information flow. In IEEE Computer Security Foundations Workshop (CSFW) , pages 187–196, 1999

1999
[8]

Flowcaml: A polymorphic information-flow language

J´ erˆ ome Simonet. Flowcaml: A polymorphic information-flow language. In ACM SIGPLAN Workshop on ML , pages 85–96, 2004

2004
[9]

Zero trust architecture

Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly. Zero trust architecture. NIST SP 800-207, 2020. https://doi.org/10.6028/NIST.SP.800-207

2020 doi
[11]

Security fatigue

Suzanna Furman, Mary Theofanos, Yee-Yin Choong, and Betty Stanton. Security fatigue. IT Professional, 18(5):26–32, 2016

2016
[12]

Certikos: An extensible architecture for building certified concurrent os kernels

Ronghui Gu, Dominic Costanzo, and Zhong Shao. Certikos: An extensible architecture for building certified concurrent os kernels. In USENIX OSDI , pages 653–669, 2016. 8

2016
[13]

Formal verification of a realistic compiler

Xavier Leroy. Formal verification of a realistic compiler. Communications of the ACM , 52(7):107–115, 2009

2009
[14]

Language-based information-flow security

Andrei Sabelfeld and David Sands. Language-based information-flow security. IEEE Journal on Selected Areas in Communications , 21(1):5–19, 2003

2003
[15]

Controlled-channel attacks: Deterministic side channels for untrusted operating systems

Yan Xu, Weidong Cui, and Marcus Peinado. Controlled-channel attacks: Deterministic side channels for untrusted operating systems. In IEEE Symposium on Security and Privacy , pages 640–656, 2015

2015
[16]

Error message side channels in secure operating systems

Katharina Schneider and S¨ oren Bulander. Error message side channels in secure operating systems. In Proceedings of the 2016 ACM Conference on Computer and Communications Security, pages 1052–1065, 2016

2016
[17]

Paul C. Kocher. Timing attacks on implementations of diffie–hellman, rsa, dss, and other systems. In CRYPTO ’96, volume 1109 of LNCS, pages 104–113. Springer, 1996

1996
[18]

Cache attacks and countermeasures: The case of aes

Dag Arne Osvik, Adi Shamir, and Eran Tromer. Cache attacks and countermeasures: The case of aes. In RSA Conference Cryptographers’ Track , volume 3860 of LNCS, pages 1–20. Springer, 2006

2006
[19]

Openai api pricing

OpenAI. Openai api pricing. https://openai.com/pricing, 2024

2024
[20]

React: Synergizing reasoning and acting in language models

Shunyu Yao, Dian Zhao, Jeffrey Yu, Dong Yang, Yuan Chen, and et al. React: Synergizing reasoning and acting in language models. arXiv preprint arXiv:2210.03629 , 2023

2023 arXiv
[21]

Security analysis of infrastructure-as-code: A systematic study

Mohammad Rahman and Laurie Williams. Security analysis of infrastructure-as-code: A systematic study. Empirical Software Engineering, 25:4922–4960, 2020

2020
[22]

Open policy agent

Torin Fairchild and Wyatt Dillon. Open policy agent. https://www.openpolicyagent.org/, 2022

2022
[23]

Dependent types and multi-monadic effects in f ∗

Nikhil Swamy, Cencia Zhu, Bjoern Pfaff, and et al. Dependent types and multi-monadic effects in f ∗. In ACM SIGPLAN–SIGACT Symposium on Principles of Programming Languages (POPL), pages 256–270, 2016

2016
[25]

Training language models to follow instructions with human feedback

Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, and et al. Training language models to follow instructions with human feedback. arXiv preprint arXiv:2203.02155 , 2022

2022 arXiv
[26]

Constitutional ai: Harmlessness from ai feedback

Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, and et al. Constitutional ai: Harmlessness from ai feedback. arXiv preprint arXiv:2212.08073 , 2022

2022 arXiv
[27]

gvisor: User-space kernel sandbox

Google Open Source. gvisor: User-space kernel sandbox. https://gvisor.dev, 2022

2022
[28]

Red teaming language models with language models

Ethan Perez, Samuel Ringer, Nisan Nanda, and et al. Red teaming language models with language models. arXiv preprint arXiv:2202.03286 , 2022

2022 arXiv
[29]

Xu, Micah Goldblum, and Tom Goldstein

Andy Zou, Frank F. Xu, Micah Goldblum, and Tom Goldstein. Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043, 2023. https: //arxiv.org/abs/2307.15043. 9

2023 arXiv
[30]

HACL* : Veri- fied implementations of cryptographic algorithms

Jos´ e Bacelar Almeida, Anne B´ eguin, Karthikeyan Bhargavan, Antoine Delignat-Lavaud, C´ edric Fournet, Santiago Zanella-B´ eguelin, and Jean-Karim Zinzindohou´ e. HACL* : Veri- fied implementations of cryptographic algorithms. In ACM CCS, pages 1789–1806, 2017

2017

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

Poisoning language models during instruction tuning

Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Miles Brundage, Tom Brown, Deep Ganguli, ´Ulfar Erlingsson, et al. Poisoning language models during instruction tuning. arXiv preprint arXiv:2302.12173 , 2023. https://arxiv.org/abs/ 2302.12173

arXiv 2023

[2] [10]

Hu, David Ferraiolo, Richard Kuhn, and Angelo Schnitzer

Vincent C. Hu, David Ferraiolo, Richard Kuhn, and Angelo Schnitzer. Guide to attribute based access control (abac): Definition and considerations. Technical Report SP 800-162, NIST, 2015

work page 2015

[3] [2]

Cybersentinel: An emergent threat detection system for ai security, 2025

Krti Tallam. Cybersentinel: An emergent threat detection system for ai security, 2025

work page 2025

[4] [4]

Engineering risk-aware, security-by-design frameworks for assurance of large-scale autonomous ai models, 2025

Krti Tallam. Engineering risk-aware, security-by-design frameworks for assurance of large-scale autonomous ai models, 2025

work page 2025

[5] [5]

The cyber immune system: Harnessing adversarial forces for security resilience, 2025

Krti Tallam. The cyber immune system: Harnessing adversarial forces for security resilience, 2025

work page 2025

[6] [24]

Transforming cyber defense: Harnessing agentic and frontier ai for proactive, ethical threat intelligence, 2025

Krti Tallam. Transforming cyber defense: Harnessing agentic and frontier ai for proactive, ethical threat intelligence, 2025

work page 2025

[7] [31]

Alignment, agency and autonomy in frontier ai: A systems engineering perspec- tive, 2025

Krti Tallam. Alignment, agency and autonomy in frontier ai: A systems engineering perspec- tive, 2025. 10

work page 2025

[8] [3]

A comparison of machine learning techniques for phishing detection

Saleh Abu-Nimeh, Dan Nappa, Xiang Wang, and Salil Nair. A comparison of machine learning techniques for phishing detection. eCrime Researchers Summit, pages 60–69, 2007

work page 2007