Welcome

We are a research group at the CISPA Helmholtz Center for Information Security in Saarbrücken, Germany. We study the security of AI systems, from the software and hardware that run models to agents that act on our behalf.

We develop attacks to find weaknesses and defenses to limit their impact. Our focus is the whole system. What an attacker can control, how components interact, and where protections can stop an attack. We also study how AI can help with security analysis, how attackers can use it, and how to protect the AI tools involved.

Research areas

Beyond the model

A model’s security depends on the system around it. How it is executed and used changes what an attacker can control, and where the system can stop or contain an attack, even when the model itself is vulnerable.

Our work examines these effects in practice. We have shown how manipulated observations can affect weather forecasts and how numerical differences between execution platforms can produce conflicting predictions from the same model. Looking beyond the model also gives us ways to protect a system. Our work on prompt obfuscation protects system prompts without relying on the model to refuse extraction requests.

Securing AI agents

With AI agents, models increasingly direct how a system acts. They interpret goals, choose how to proceed, and carry out plans through tools and other agents. This combination of autonomy and delegated authority changes both how these systems can be attacked and what it takes to secure them.

We have shown that agents can complete a task while following irrelevant instructions, and that defenses can suppress cues needed for legitimate task completion. Malicious content can also cross service boundaries, causing agents to disclose secrets from another service. Communication between agents introduces further risks. Our work on latent communication shows how the connections between agents can enable harmful behavior even when the models themselves remain unchanged.

Attack & Defense

Many security tasks require specialized expertise and substantial manual effort. We study how AI can improve and scale established security techniques, and how its limitations and vulnerabilities affect the reliability of the resulting tools.

Our work on code deobfuscation shows that language models can simplify obfuscated code, but do not always preserve its behavior. In vulnerability discovery, we found that a classifier using simple code metrics matched the best language model in our evaluation. The ability to transform code and text can also be misused by an adversary. We have shown how language models can encode malicious payloads in plausible-looking documentation and scripts.

Team

Thorsten Eisenhofer

Dr. Thorsten
Eisenhofer

Faculty

Muhammad Huzaifa

Muhammad
Huzaifa

PhD Student

Paweł Popiołek

Paweł
Popiołek

PhD Student

Donatella Cocca

Donatella
Cocca

Research Intern

Former members

Rishabh Kumar

Research Assistant

News

2026
Oct

WISE-ATTA has been accepted at WACV 2027 🎉 Labels don't grow on trees. WISE-ATTA picks when to ask for them while adapting to changing data.

Hello Heidelberg 👋 Thorsten gave a keynote at the bwInfoSec Cybersicherheitstag on how AI is changing information security.

Sep

No More, No Less is heading to NeurIPS 2026! We put terminal agents to the test with useful clues and distracting instructions. Getting the task done doesn't necessarily mean they can tell the two apart.

Huzaifa has been looking into conversations without words 👀 Our new preprint shows how connecting agents through internal representations can weaken their safety, without changing the agents themselves.

On the airwaves 🎙️ Thorsten spoke with ARD about AI risks and how AI systems are kept in check. Catch the contribution on WDR 5 Quarks from 1:04:33, or read the story on tagesschau.de.

Back to school 🛠️ Thorsten joined the BIFOLD Summer School in Berlin for a lecture and hands-on session on trustworthy agentic systems.

Thorsten gave a keynote on trustworthy agentic systems for Cyber Security Symposium Africa, hosted by the University of Cape Town 🌍.

Aug

Thorsten ventured out of the forest for USENIX Security 🌲.

Jul

Trading the forest for the beach 🏖️ We are at EuroS&P in Lisbon, Portugal. Come say hi!

New tracks in the woods 🌲 Paweł begins his PhD journey and Donatella joins for a research internship.

Whispers travel far 🤫 Jonathan presents our work on confidentiality in agentic systems at DIMVA in Greece.

May

A shiny new badge for the moosec shelf 🫎✨ Thorsten receives a Distinguished Reviewer Award at IEEE S&P 🎉

Huzaifa puts down roots and starts his PhD 🌱, and a new moose joins the herd. Welcome our new Research Assistant Rishabh! 🦌

Apr

PINE 2026 🌲 kicks off at Saarland University. A fresh cohort taking on ML security challenges in our hands-on seminar.

LLM-based Vulnerability Discovery at ICSE 2026. Surprisingly, a simple code metrics classifier can match the performance of state-of-the-art LLMs on classification of vulnerable code functions.

Mar

SaTML in Munich: great talks, nice conversations, and 🥨 way too many pretzels.

Guest lecture at Reykjavik University 🌌. Joined Giovanni Apruzzese's group remotely to talk about ML security.

Feb

We presented Chasing Shadows at NDSS 2026, looking at why so much LLM security research keeps going sideways. Spoiler: it's complicated.

Happy to contribute a challenge and attend the CISPA European Hackathon Championship in Stockholm 🇸🇪. Great energy, terrible sleep schedules.

2025
Dec

Guest lecture at TU Vienna ☕. Great to visit Daniel Arp and talk about ML security research.

Nov

A first moose finds the forest 🌲. Huzaifa joins as a research intern. Welcome!

moosec is officially live at CISPA 🚀 Excited to get started!

where it all began 🌱

Publications

2027

WISE-ATTA: When to Ask for Labels in Budgeted Active Test-Time Adaptation

Muhammad Huzaifa, Lea Schönherr, and Thorsten Eisenhofer

IEEE/CVF Winter Conference on Applications of Computer Vision (WACV)

2026

No More, No Less: Task Alignment in Terminal Agents

Sina Mavali, David Pape, Jonathan Evertz, Samira Abedini, Devansh Srivastav, Thorsten Eisenhofer, Sahar Abdelnabi, and Lea Schönherr

NeurIPS Evaluations and Datasets Track

Chasing Shadows: Pitfalls in LLM Security Research

Jonathan Evertz, Niklas Risse, Nicolai Neuer, Andreas Müller, Philipp Normann, Gaetano Sapia, Srishti Gupta, David Pape, Soumya Shaw, Devansh Srivastav, Christian Wressnegger, Erwin Quiring, Thorsten Eisenhofer, Daniel Arp, and Lea Schönherr

Network and Distributed System Security Symposium (NDSS)

LLM-based Vulnerability Discovery through the Lens of Code Metrics

Felix Weissberg, Lukas Pirch, Erik Imgrund, Jonas Möller, Thorsten Eisenhofer, and Konrad Rieck

IEEE/ACM International Conference on Software Engineering (ICSE)

Whispers in the Machine: Confidentiality in Agentic Systems

Jonathan Evertz, Merlin Chlosta, Lea Schönherr, and Thorsten Eisenhofer

Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA)

Shape-Shifting Malicious Code in Software Backdoors via Language Models

Mohammad Ebrahimi Fard, Felix Weissberg, Erik Imgrund, Thorsten Eisenhofer, and Konrad Rieck

ACM Asia Conference on Computer and Communications Security (ASIACCS)

Controlling Autonomous Vehicles using Continuous Adversarial Patches

Pia Hanfeld, Erik Imgrund, Felix Weissberg, Thorsten Eisenhofer, Wolfgang Hönig, and Konrad Rieck

ACM Workshop on Artificial Intelligence and Security (AISec) Spotlight Paper

Data Augmentation in Learning-Based Binary Code Analysis

Lennart von Stülpnagel, Felix Weissberg, Jonas Möller, Benjamin Greb, Thorsten Eisenhofer, and Konrad Rieck

ACM Workshop on Artificial Intelligence and Security (AISec)

Safety of Latent Communication in Multi-Agent Systems

Muhammad Huzaifa, Sina Mavali, and Thorsten Eisenhofer

Computing Research Repository (CoRR)

Hardware-Triggered Backdoors

Jonas Möller, Erik Imgrund, Thorsten Eisenhofer, and Konrad Rieck

Computing Research Repository (CoRR)

2025

Adversarial Observations in Weather Forecasting

Erik Imgrund, Thorsten Eisenhofer, and Konrad Rieck

ACM Conference on Computer and Communications Security (CCS) Distinguished Paper Award

Adversarial Inputs for Linear Algebra Backends

Jonas Möller, Lukas Pirch, Felix Weissberg, Sebastian Baunsgaard, Thorsten Eisenhofer, and Konrad Rieck

International Conference on Machine Learning (ICML)

Seeing Through: Analyzing and Attacking Virtual Backgrounds in Video Calls

Felix Weissberg, Jan Malte Hilgefort, Steve Grogorick, Daniel Arp, Thorsten Eisenhofer, Martin Eisemann, and Konrad Rieck

USENIX Security Symposium

Prompt Obfuscation for Large Language Models

David Pape, Sina Mavali, Thorsten Eisenhofer, and Lea Schönherr

USENIX Security Symposium

Verifiable and Provably Secure Machine Unlearning

Thorsten Eisenhofer, Doreen Riepel, Varun Chandrasekaran, Esha Ghosh, Olga Ohrimenko, and Nicolas Papernot

IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)

Exploring the Potential of LLMs for Code Deobfuscation

David Beste, Grégoire Menguy, Hossein Hajipour, Mario Fritz, Antonio Emanuele Cinà, Sébastien Bardin, Thorsten Holz, Thorsten Eisenhofer, and Lea Schönherr

Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA)

Learned-Database Systems Security

Roei Schuster, Jin Peng Zhou, Thorsten Eisenhofer, Paul Grubbs, and Nicolas Papernot

Transactions on Machine Learning Research (TMLR)

2024

A Representative Study on Human Detection of Artificially Generated Media Across Countries

Joel Frank, Franziska Herbert, Jonas Ricker, Lea Schönherr, Thorsten Eisenhofer, Asja Fischer, Markus Dürmuth, and Thorsten Holz

IEEE Symposium on Security and Privacy (S&P)

SoK: Where to Fuzz? Assessing Target Selection Methods in Directed Fuzzing

Felix Weissberg, Jonas Möller, Tom Ganz, Erik Imgrund, Lukas Pirch, Lukas Seidel, Moritz Schloegel, Thorsten Eisenhofer, and Konrad Rieck

ACM Asia Conference on Computer and Communications Security (ASIACCS)

Cross-Language Differential Testing of JSON Parsers

Jonas Möller, Felix Weissberg, Lukas Pirch, Thorsten Eisenhofer, and Konrad Rieck

ACM Asia Conference on Computer and Communications Security (ASIACCS)

2023

Security of Machine Learning Systems

Thorsten Eisenhofer

Dissertation Award for Outstanding Doctoral Achievement

No more Reviewer #2: Subverting Automatic Paper-Reviewer Assignment using Adversarial Learning

Thorsten Eisenhofer, Erwin Quiring, Jonas Möller, Doreen Riepel, Thorsten Holz, and Konrad Rieck

USENIX Security Symposium

VenoMave: Targeted Poisoning Against Speech Recognition

Hojjat Aghakhani, Lea Schönherr, Thorsten Eisenhofer, Dorothea Kolossa, Thorsten Holz, Christopher Kruegel, and Giovanni Vigna

IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)

Drone Security and the Mysterious Case of DJI's DroneID

Nico Schiller, Merlin Chlosta, Moritz Schloegel, Nils Bars, Thorsten Eisenhofer, Tobias Scharnowski, Felix Domke, Lea Schönherr, and Thorsten Holz

Network and Distributed System Security Symposium (NDSS)

On the Limitations of Model Stealing with Uncertainty Quantification Models

David Pape, Sina Däubener, Thorsten Eisenhofer, Antonio Emanuele Cinà, and Lea Schönherr

European Symposium on Artificial Neural Networks, Computational Intelligence and Machine Learning (ESANN)

2022

Password-Authenticated Key Exchange from Group Actions

Michel Abdalla, Thorsten Eisenhofer, Eike Kiltz, Sabrina Kunzweiler, and Doreen Riepel

Annual International Cryptology Conference (CRYPTO)

Exploring Accidental Triggers of Smart Speakers

Lea Schönherr, Maximilian Golla, Thorsten Eisenhofer, Jan Wiele, Dorothea Kolossa, and Thorsten Holz

Computer Speech & Language (CSL)

2021

Dompteur: Taming Audio Adversarial Examples

Thorsten Eisenhofer, Lea Schönherr, Joel Frank, Lars Speckemeier, Dorothea Kolossa, and Thorsten Holz

USENIX Security Symposium

2020

Leveraging Frequency Analysis for Deep Fake Image Recognition

Joel Frank, Thorsten Eisenhofer, Lea Schönherr, Asja Fischer, Dorothea Kolossa, and Thorsten Holz

International Conference on Machine Learning (ICML)

Imperio: Robust Over-the-Air Adversarial Examples for Automatic Speech Recognition Systems

Lea Schönherr, Thorsten Eisenhofer, Steffen Zeiler, Thorsten Holz, and Dorothea Kolossa

Annual Computer Security Applications Conference (ACSAC)

Teaching

Positions

If you are interested in working with us, we’d be happy to hear about your background and what you’d like to explore.

Feel free to get in touch

Please email us at eisenhofer@cispa.de with your CV and academic transcripts. Tell us what you would like to work on with us and how your background connects to our research. Links to projects or other relevant work are welcome.

Please let us know whether you are looking for a student research assistant role, a Master’s thesis, a research internship, or a PhD.

Moki

Please end your email with “P.S. Moki sent me”.

About CISPA

A stylized illustration of the CISPA building with spruce trees

At CISPA, we work on cybersecurity, privacy, and artificial intelligence. Our research center in Saarbrücken, Germany, is part of the Helmholtz Association.

Get to know CISPA

BibTeX