Research Publications

Y. T. Shen, K. Toyoda, A. Leung · arXiv:2607.11151 · July 2026

Introduces AMT-X, a phase-structured framework for multi-turn red-teaming that models an attack as a reproducible state machine and replaces single-judge scoring with a multi-role jury, addressing the blind spots left by single-turn attack datasets and single-score evaluation.

• Structures the attack as an explicit, reproducible multi-phase state machine driven by semantic signals from the victim model, rather than ad hoc escalation or free-form per-goal plans used in prior multi-turn attacks
• Replaces single-judge scoring with a multi-role jury using phase-conditioned checklists that gate success on genuinely actionable harm, separating partially actionable outputs from those with complete operational detail
• Tested across six frontier victim models under default safety alignment and seven Moderation sub-categories: overall success rates of 97.6-100% under a lenient threshold drop to 66.7-78.6% under a stricter gate requiring complete, real, operational detail, a gap of up to 33 percentage points

A. Leung, R. Zhang, K. Toyoda, S. Loh · arXiv:2606.03777 · June 2026

Introduces the CER framework for tracing how losses caused by AI systems can be reconstructed into insurable events, bridging the gap between AI system failures and the insurance claims process.

• Introduces CER, a use-case-level diagnostic for AI residual risk transfer: C (control boundary) defines what the AI system was permitted to do, E (evidence reconstruction) reconstructs the actual system state and causal chain, and R (insurance response) tests whether the reconstructed loss is insured
• Addresses AI-specific state reconstruction, which requires tracing not just what loss occurred but what the system was allowed to do, what it actually did, and whether retained artifacts can support insurance claim recovery
• Illustrates the framework on public incidents including the PocketOS agentic database-deletion incident and Moffatt v. Air Canada, showing that prompt-level instructions are not enforceable control boundaries

A. Leung, R. Zhang, E. Ling, K. Toyoda, S. Loh · arXiv:2605.18784 · May 2026

Maps the full landscape of AI-related threats against current insurance coverage categories, distinguishing between risks that are explicitly covered, risks being covered unknowingly, and risks entirely excluded from existing policies.

• Maps 55 AI threat classes against 26 insurance products, endorsements, and exclusion regimes using public carrier materials and OWASP/MITRE threat catalogs
• Identifies a four-tier insurability frontier: affirmatively insured perils, silent-AI exposures under legacy policies, actively excluded perils, and perils outside conventional private insurance structures
• Finds that foundation model concentration is the clearest genuinely novel insurability frontier, as upstream model failure can correlate losses across many insureds simultaneously

C.-P. Chen, K. Toyoda, A. Lai, A. Leung · arXiv:2605.11868 · May 2026

Presents IPI-proxy, a purpose-built tool for testing web-browsing AI agents against indirect prompt injection attacks, where malicious instructions embedded in external web content hijack agent behaviour.

• Rewrites real HTTP responses from whitelisted domains in flight using mitmproxy, embedding payloads from a unified library of 820 deduplicated attack strings extracted from six published benchmarks (BIPIA, InjecAgent, AgentDojo, Tensor Trust, WASP, and LLMail-Inject)
• Independently parameterizes three orthogonal axes: payload set, embedding technique (HTML comment, invisible CSS, or LLM-generated semantic prose), and HTML insertion point across 6 locations, enabling parameter-sweep evaluation without mock pages or sandboxed environments
• The only IPI red-teaming tool that pairs dynamic test mode with live HTTP adversarial input and whitelist-respecting execution, filling three gaps left by existing benchmarks: whitelist mismatch, static content, and model-only scope

T. Otsuka, K. Toyoda, A. Leung · arXiv:2604.23280 · April 2026

Examines how AI agents identify themselves and are identified by other systems, surveying existing standards, exposing gaps, and proposing directions for more robust AI identity frameworks.

• Compares human and AI identity across four structural dimensions (substrate, persistence, verifiability, and legal standing), showing that extending human identity frameworks without structural modification produces systematic failures
• Evaluates current technical and regulatory documents against agent identity requirements, finding no single standard spans the full agent identity lifecycle, with gaps clustering at multi-hop delegation and behavioral accountability
• Identifies five structural gaps that no current technology resolves: semantic intent verification, recursive delegation accountability, agent identity integrity, governance opacity and enforcement, and operational sustainability at scale

Y. T. Shen, K. Toyoda, A. Leung · arXiv:2604.13849 · April 2026

Introduces MCPThreatHive, a system for automatically generating and aggregating threat intelligence specific to MCP ecosystems, enabling continuous monitoring of emerging attack vectors in agentic AI infrastructure.

• Automates the end-to-end lifecycle of MCP threat intelligence: continuous multi-source data collection, AI-driven threat extraction and classification, knowledge graph storage, and interactive visualization
• Operationalizes the MCP-38 taxonomy, mapping 38 MCP-specific threat patterns to STRIDE, OWASP Top 10 for LLM Applications, and OWASP Top 10 for Agentic Applications with composite risk scoring
• Addresses three critical coverage gaps in existing MCP security tools: incomplete compositional attack modeling, absence of continuous threat intelligence, and lack of unified multi-framework classification

Y. T. Shen, K. Toyoda, A. Leung · arXiv:2603.18063 · March 2026

Establishes MCP-38, the first comprehensive threat taxonomy for Model Context Protocol systems, cataloguing 38 threat categories across the MCP ecosystem from tool registration to execution.

• Presents 38 protocol-specific threat categories (MCP-01 through MCP-38) derived through a four-phase methodology: protocol decomposition, multi-framework cross-mapping, real-world incident synthesis, and remediation-surface categorization
• Maps each threat to STRIDE, OWASP Top 10 for LLM Applications (LLM01–LLM10), and OWASP Top 10 for Agentic Applications (ASI01–ASI10)
• Addresses critical threats unique to MCP's semantic attack surface: tool description poisoning, indirect prompt injection, parasitic tool chaining, and dynamic trust violations