Yusuf Khalid Shire

Master’s student at Kookmin University in Seoul, working on AI security, AI safety, and the policy questions between them: prompt injection, how defenses fail, how to evaluate them honestly, and what those results should mean for the rules we set for deployed systems. My first paper, a benchmark for prompt-injection detectors, is in IEEE Access (2026).

I write here to check whether I understand things, and to leave a clearer path than the one I found. So far that means explanations of attacks and defenses and write-ups of my own research, with the code to rerun them.

Bar chart of harmless security-related prompts blocked by DeBERTa-v3-FT, before and after training on 419 extra harmless examples. Prompts we wrote (600): 48.1% before, 0.1% after. Prompts we did not write, from public datasets (872): 31.4% before, 31.0% after. Headline: Extra training cleared the prompts we wrote. The prompts we didn't write were still blocked.

Prompt-injection detectors, tested on prompts they should let through

A detector with F1 0.988 still blocked about a third of harmless, security-related prompts from public datasets. No threshold fixed it, and extra training only fixed the prompts we had written ourselves.

Indirect prompt injection, tested on an email agent

An email agent with a mock send tool and a fake secret, 360 poisoned inboxes, two OpenAI models, no leaks, and why that is less reassuring than it sounds.

Three inputs, a developer's system prompt, a user message and a retrieved web page, merging into one token sequence that enters a language model. Nothing marks which part is data.

Prompt injection, explained by running one

A twenty-line summarizer, a document with two extra sentences, four local models, and why this is a harder problem than SQL injection ever was.