Overview

I am a research fellow at the NSF ACTION Institute (AI Institute for Agent-based Cyber Threat Intelligence and Operation), hosted at UC Santa Barbara for the 2026 summer research program. Working with Dr. Yigitcan Kaya in UCSB's SecLab, I study token entanglement and subliminal learning in large language models: whether secrets hidden in a system prompt leak into unrelated outputs through likelihood-based inference. Our first paper was accepted at the NeurIPS 2026 InfPriv workshop, and we are continuing the work toward a follow-up paper.

NSF ACTION Institute AI Security AI Privacy Large Language Models Research

Publication

NeurIPS 2026 Workshop · Beyond Private Training: The New Landscape of AI Privacy (InfPriv)

LLMs Leak Secrets Through Unrelated Outputs

First author. LLMs can statistically leak secrets through unrelated outputs without reproducing them: a white-box likelihood attack identifies a hidden PIN from one strictly filtered number list and recovers 48% of held-out PINs from repeated outputs.

Paper link will be available soon, once OpenReview makes it public.

Key Achievements

  • First-author paper accepted at the NeurIPS 2026 InfPriv workshop.
  • Showed that LLMs can statistically leak secret PINs through unrelated outputs without ever reproducing them.
  • Built a white-box likelihood attack that identifies a hidden PIN from a single strictly filtered number list and recovers 48% of held-out PINs from repeated outputs.
  • Designed a multi-stage pipeline of logit probes, ablations, cross-model attacks, and prompt ladders across 14+ conditions to characterize when LLM instruction secrets become recoverable.
  • Continuing the research with the team toward a follow-up paper.

Technologies & Tools

Python Large Language Models Logit Probes Likelihood Attacks Ablation Studies Prompt Analysis