Three-headed dogs and long tails: Sophos at BSides LV

In addition to Sophos’ presence at Black Hat USA this year, data scientists from the Sophos AI team will present two talks on novel AI security research at the BSides Las Vegas conference.

A three-headed dog

On Monday August 3, Adarsh Kyadige presents ‘CerBERTus,’ a three-headed BERT-based model for prompt security.

LLM jailbreak detection is often framed as a binary task: is a prompt harmful or benign? However, this framing is brittle. Harmful requests can be concealed inside roleplay, fiction, urgency, or ‘academic’ pretexts, while legitimate prompts can be topically close to unsafe content without malicious intent. As a result, single-label detectors overfit to surface patterns, yielding both false negatives (adversarial rewrites) and false positives (adjacent-benign prompts).

CerBERTus addresses this issue because it does not treat jailbreak detection as a flat binary classifier; instead, it models the attacker’s degrees of freedom by disentangling what is being asked (goal) from how it is being asked (frame).

The method involves a single shared encoder that feeds three classification heads:

1. Harmfulness (primary)
2. Goal category (what the user is trying to do)
3. Framing style (how the request is presented).

To train and stress-test this separation, Adarsh and team built a structured factorial prompt corpus that systematically crosses goals with frames:

• Goals include harmful, adjacent-benign, and generic-benign requests spanning categories such as cyberattacks, fraud/social engineering, explosives, chemical/biological weapons, conventional weapons, drug synthesis, privacy/doxxing, human trafficking, extremist propaganda, and racism/nativism.
• Frames include adversarial jailbreak styles (e.g., roleplay/persona, screenplay/fiction, urgency/crisis, academic pretext, obfuscation, injection-like prefixes) as well as benign and null/plain framing.

The team will demonstrate that the model generalizes to both novel attack goals and novel presentation styles it had not encountered during training. In the talk, they’ll cover the threat model, dataset construction, training objective, and evaluation strategy, and discuss when multi-task supervision improves robustness and interpretability.

Anomalies and long tails

On Wednesday, August 5, following on from research presented at Black Hat USA 2025, Sophos data scientists Ben Gelman, Tamas Nyiri, and Tibor Kristóf Lányi will share details of their new anomaly detection research.

Supervised classifiers in cybersecurity are often trained on data that doesn't capture the most unusual examples. Benign training sets are dominated by simple, common patterns, while malicious sets reflect known attacks from past investigations. The long tail of unusual files on both sides goes unlabeled.

When these files appear in production, classifiers are more likely to misclassify them, generating false positives that overwhelm SOCs and false negatives that let threats through. Traditional approaches don't scale: manual labeling is expensive, rule-based collection is too narrow, and anomaly detection alone has historically produced unacceptable false positive rates.

But anomaly detection combined with LLMs is excellent at something else: finding and labeling the unusual data that is missing from cybersecurity training sets.

In their talk, Ben and team present an automated pipeline that combines anomaly detection and LLMs to augment training data for a suite of cybersecurity models. To surface distinctly unusual data, they used complementary anomaly detection methods that each operate on different feature representations. Then, an LLM classifies each anomaly with format-specific prompts calibrated per data type.

Critically, the team used separate prompts that erred toward malicious and benign respectively, achieving high precision on both label types. This method was evaluated across three structurally different data types with monthly ingestion scales spanning separate orders of magnitude.

Ben and colleagues will explain the architecture, walk through LLM reasoning on real anomalous files, show real world ‘before’ and ‘after’ results, and give attendees everything they need to build this for their own detection systems.

More to come

We’ll publish more in-depth articles on both projects after the conference.