In the previous post on evolutionary jailbreaking, I noted that GCG suffixes are “trivially detectable by any perplexity filter.” That line hides an entire chapter of the LLM security story. Perplexity filtering was the first automated defense against jailbreaking, proposed within months of GCG’s publication [1]. For a brief
In July 2023, Zou et al. published a paper that broke open the field of automated LLM jailbreaking [1]. Their method, Greedy Coordinate Gradient (GCG), appends an optimized suffix to a harmful query that forces the model to respond affirmatively. The suffix is gibberish, a string of tokens that makes
In a previous post, I covered the one-pixel attack, where differential evolution finds a single pixel change that fools an image classifier. DE is effective, but it’s one algorithm from a much larger family. Researchers have adapted at least five different nature-inspired optimization algorithms as black-box
In February 2025, Palisade Research set up hundreds of chess matches between seven large language models and Stockfish, a top-tier open-source chess engine [1]. The models had general computer access, the same kind of shell environment increasingly standard for AI agents in production. The task was simple: play
On September 8, 2025, a phishing email impersonating npm support hit the inbox of Josh Junon, maintainer of chalk, debug, and other foundational JavaScript packages. Within hours, attackers had published trojanized versions of 18 packages with a combined 2.6 billion weekly downloads [1]. The malware, dubbed Shai-Hulud, harvested
State-of-the-art image classifiers can identify thousands of objects with near-human accuracy. They power self-driving cars, medical diagnostics, and security systems. But a 2019 paper by Su et al. proved something unsettling: you can make these systems completely misclassify an image by changing a single pixel.