PUBLICATIONS

Research behind SASY.

SASY grew out of research on multi-agent systems, and on securing AI agents with formal methods and systems security.

1. arXiv 2026

   Formal Policy Enforcement for Real-World Agentic Systems

   Nils Palumbo, Sarthak Choudhary, Jihye Choi, Guy Amir, Prasad Chalasani, Somesh Jha

   The paper behind SASY. Policies are written in Datalog over the agent's execution history and checked by a reference monitor at every policy-relevant action, outside the model's reasoning. Datalog makes enforcement deterministic, allows recursive policies, and supports static checks for contradictions and redundant rules.

2. NeurIPS 2026 Oral

   Agent Security is a Systems Problem

   Mihai Christodorescu, Earlence Fernandes, Ashish Hooda, Somesh Jha, Johann Rehberger, Kamalika Chaudhuri, Xiaohan Fu, Khawaja Shams, Guy Amir, Jihye Choi, Sarthak Choudhary, Nils Palumbo, Andrey Labunets, Nishit V. Pandya

   A position paper: the model behind an agent must be treated as untrusted, and security must be enforced at the system level. It sets out principles from decades of systems security research and analyzes eleven real-world attacks on agents that those principles could have prevented.

3. AISec 2025

   How Not to Detect Prompt Injections with an LLM

   Sarthak Choudhary, Divyam Anshumaan, Nils Palumbo, Somesh Jha

   Known-answer detection, a popular defense, asks an LLM to tell clean input from injected input. The paper shows a structural flaw in that idea and builds an adaptive attack, DataFlip, that evades the detectors (detection as low as 0%) while still hijacking the model (91% success).

4. MLHC 2024

   MALADE: Orchestration of LLM-powered Agents with Retrieval Augmented Generation for Pharmacovigilance

   Jihye Choi, Nils Palumbo, Prasad Chalasani, Matthew M. Engelhard, Somesh Jha, Anivarya Kumar, David Page

   A multi-agent LLM system that finds adverse drug events in drug labels, using retrieval from medical sources and the FDA's drug data. It reports how strongly each drug is linked to each outcome, explains the link, and reaches an AUC of 0.90 against the OMOP reference set. Built with the Langroid agent framework.