Cyberark Software Ltd.

Eran Shimony

Mark Cherp

Nir Chako

Niv Rabin

Systems, methods, and apparatuses are disclosed for detection and prevention of adversarial attacks against large language models. Techniques may include receiving an input associated with a target large language model, analyzing the input with a pre-trained classification algorithm to determine a first deconstruction process to be applied to the input, and modifying the input with a first deconstruction model using the determined first deconstruction process. Techniques may also include determining a score of a likelihood of the input being adversarial based on an output of the first deconstruction model and by applying a classification model and updating at least one of the first deconstruction model or the classification model based on the score.

Detection and prevention of adversarial attacks against large language models

Disclosed embodiments relate to systems and methods for detecting fuzzing activity associated with a target program. Techniques include accessing a target program, monitoring, by a monitoring agent in a kernel space environment, the target program, and analyzing dynamic and static patterns of the target program. The techniques may further include assessing process parameters and inputs, evaluating instrumentation patterns in at least one basic block, assessing process creation frequency, assessing Syscalls invocation frequency, identifying suspicious processes, or comparing a runtime coverage ratio of a process to an expected coverage ratio. Systems and methods may also include calculating a confidence score, including applying a weighted value to an analyzed individual pattern based on the analysis, and identifying a likelihood of fuzzing activity based on the confidence score.

Agent-based detection of fuzzing activity associated with a target program

Disclosed embodiments relate to systems and methods for dynamically identifying potential file system privilege escalation and manipulation vulnerabilities. Techniques include monitoring a file system of a computing system; detecting a privileged file operation involving the file system; determining that a target of the path is writable by a non-privileged identity; and determining whether the target of the path is a dynamic link library. If the target of the path is a dynamic link library, techniques may further include creating a semi-malicious dynamic link library. If the target of the path is not a dynamic link library, techniques may further include creating an object manager symbolic link in a protected file.

Growing community of inventors

Petach-Tikva, Israel

Eran Shimony