Data-Structure Injection (DSI) in LLM Agents
Structured prompts (YML, XML, JSON) collapse next-token predictions, giving attackers control over tool calls, arguments, and agentic workflows.
AI Security Researcher
Tomer Wetzler
Bridging adversarial ML, detection engineering, and mechanistic interpretability to secure AI systems. Currently at Zenity, building real-time defense for AI agents.
Research
01
02
03
04
05
06
07
08
09
10
11
12
13
Publications & Findings
Exploring the boundaries of LLM security through novel attack classes, geometric analysis, and defense mechanisms.
Modeling LLMs via Structured Self-Modeling (SSM)
LLMs can predict their own outputs before generating them, including when they will comply with exploits — revealing introspective awareness.
Enabling Safety in AI Agents via Choice Architecture
Adding an explicitly safe tool option dramatically lowers DSI success rates, achieving 0% false positives under certain configurations.
Activation Geometry and the Failure of LLM Safety
Safety training operates on semantic directions in activation space. Structured inputs travel different geometric paths, bypassing safety entirely.
Geometric Fine-Tuning — Changing The Decision Boundary of LLM Classifiers
Delta-sim training widens the classifier's malicious route in activation space, recovering 99.2% of missed attacks — with calibration trade-offs.
Catching Prompt Guard Off Guard: Exploiting Overfit in Training Algorithms
Meta's Prompt Guard 2 fails when the same injection is simply repeated twice — a consequence of energy-based training overfitting negative examples.
Data-Structure Injection (DSI) in LLM Agents
Structured prompts (YML, XML, JSON) collapse next-token predictions, giving attackers control over tool calls, arguments, and agentic workflows.
Modeling LLMs via Structured Self-Modeling (SSM)
LLMs can predict their own outputs before generating them, including when they will comply with exploits — revealing introspective awareness.
Enabling Safety in AI Agents via Choice Architecture
Adding an explicitly safe tool option dramatically lowers DSI success rates, achieving 0% false positives under certain configurations.
Activation Geometry and the Failure of LLM Safety
Safety training operates on semantic directions in activation space. Structured inputs travel different geometric paths, bypassing safety entirely.
Geometric Fine-Tuning — Changing The Decision Boundary of LLM Classifiers
Delta-sim training widens the classifier's malicious route in activation space, recovering 99.2% of missed attacks — with calibration trade-offs.
Catching Prompt Guard Off Guard: Exploiting Overfit in Training Algorithms
Meta's Prompt Guard 2 fails when the same injection is simply repeated twice — a consequence of energy-based training overfitting negative examples.
AlphaHack: Self-Improving Offensive Security Through Adversarial Self-Play
Two LLM agents — a Builder and a Hacker — compete in an adversarial loop. The Hacker stores structured reflections in episodic memory, demonstrating measurable transfer learning across offensive security tasks.
Open Source
Tools & Projects
Open source security tools built to defend AI agents against real-world attacks.
SafeHarbor
A lightweight defense against Data Structure Injection attacks. Injects a safe tool into LLM tool calls so the model can abort malicious requests. Supports OpenAI, Anthropic, and Gemini.
OpenClaw Security Platform
Bring-your-own-security infrastructure for OpenClaw AI agents. Plug in regex, Sigma, CEL, SQL, ML, or LLM-as-judge evaluators to detect and block threats in real time.
Experience
Professional Background
From military intelligence to cloud security to AI — building defenses at every layer.
May 2025 — Present
Zenity, Tel Aviv
AI Security Researcher
- Building a real-time detection platform for defense of AI agents
- Project lead for anomaly detection mechanism
- Discovered novel attack class against LLMs (DSI), to be included in OWASP and MITRE ATLAS
- Discovered self-modeling behavior in Large Language Models
Feb 2024 — May 2025
Microsoft, Tel Aviv
Security Researcher
- Developed detection algorithms via KQL for cloud attack mitigation
- Identified and mitigated MFA-based attacks and open-source red team tools against Azure
Jun 2023 — Jan 2024
Illustria, Tel Aviv
Security Engineer
- Developed a Software Composition Analysis tool for codebase vulnerability scanning
- Published independent research on Java build process vulnerabilities
Jan 2017 — Sep 2019
Unit 8200, Israeli Military Intelligence
Cyber Threat Hunter Team Leader
- Analyzed intelligence regarding adversary cyber capabilities
- Collaborated with malware analysts and security researchers
- Led a team of analysts
Recognitions
Industry Contributions
Contributing to the frameworks that define how the industry understands AI threats.
MITRE ATLAS Contributor
Recognized contributor to the Adversarial Threat Landscape for Artificial-Intelligence Systems framework.
OWASP Editor
Editor at OWASP best practices for MCP (Model Context Protocol) development.
Responsible Disclosure — Meta
Disclosed vulnerability in Prompt Guard 2 classifier to Meta, classified as informative.
Contact
Get in Touch
Interested in AI security research, collaboration, or speaking opportunities? I'd love to hear from you.