publications | Kemal Derya

Trustworthy AI & LLM Safety

2026

arXiv
Revisiting JBShield: Breaking and Rebuilding Representation-Level Jailbreak Defenses ★

Kemal Derya and Berk Sunar

arXiv preprint arXiv:2605.03095, 2026

Breaks JBShield with an adaptive GCG variant (up to 53.4% ASR), then rebuilds the defense as RTV — a Mahalanobis-based multi-layer trajectory detector reaching 0.99 AUROC.
- Introduces JB-GCG, an adaptive variant of GCG that breaks JBShield with 46.2% average attack success rate across five configurations.
- Proposes Representation Trajectory Verification (RTV), a Mahalanobis-based outlier detector over multi-layer representation trajectories — 0.99 AUROC against JB-GCG.
- Demonstrates that multi-layer representation consistency is a more reliable foundation for jailbreak detection than single-layer concept similarity.
Abs Bib PDF

Defending large language models (LLMs) against jailbreak attacks, such as Greedy Coordinate Gradient (GCG), remains a challenge, particularly under adaptive threat models where an attacker directly targets the defense mechanism. JBShield, a recent jailbreak defense with a 0% attack success rate in some settings, detects malicious prompts via two concept signals, a toxic concept and a jailbreak concept. We design JB-GCG, which modifies GCG’s objective to combine two terms: refusal-direction suppression via cosine similarity between the refusal direction and hidden-state representations, and toxic-concept regularization via JBShield’s own toxic concept score. Across five configurations on Llama-3-8B, JB-GCG achieves an average ASR of 46.2%, reaching up to 53.4% in the strongest setting. We further show that our attack remains effective against JBShield-M, achieving ASR up to 30.7% across evaluated settings. The attack persists across multiple JBShield recalibrations, confirming that the vulnerability is structural rather than calibration-specific. We analyze the cosine-similarity signatures of jailbreak representations and find that they occupy a distinctive region in refusal-direction fingerprint space that neither harmless nor harmful prompts inhabit. We introduce Representation Trajectory Verification (RTV), a new defense based on Mahalanobis outlier detection over multi-layer refusal-direction fingerprints. RTV attains an AUROC of 0.99 against our attack. Finally, we design and evaluate an additional adaptive attack against RTV with full white-box knowledge of the defense; the best attack achieves only 7% ASR at 13x the computational cost. Our results show that strong non-adaptive detection does not imply robustness under adaptive threat models, and that multi-layer representation consistency is a more reliable foundation for jailbreak detection than single-layer concept similarity.
@article{derya2026jbshield, title = {Revisiting JBShield: Breaking and Rebuilding Representation-Level Jailbreak Defenses}, author = {Derya, Kemal and Sunar, Berk}, journal = {arXiv preprint arXiv:2605.03095}, year = {2026}, url = {https://arxiv.org/abs/2605.03095}, category = {ai}, first_author = {true}, tldr = {Breaks JBShield with an adaptive GCG variant (up to 53.4% ASR), then rebuilds the defense as RTV — a Mahalanobis-based multi-layer trajectory detector reaching 0.99 AUROC.}, highlights = {Introduces JB-GCG, an adaptive variant of GCG that breaks JBShield with 46.2% average attack success rate across five configurations.|Proposes Representation Trajectory Verification (RTV), a Mahalanobis-based outlier detector over multi-layer representation trajectories — 0.99 AUROC against JB-GCG.|Demonstrates that multi-layer representation consistency is a more reliable foundation for jailbreak detection than single-layer concept similarity.} }

2025

arXiv
Super Suffixes: Bypassing Text Generation Alignment and Guard Models Simultaneously

Andrew Adiletta, Kathryn Adiletta, Kemal Derya, and 1 more author

arXiv preprint arXiv:2512.11783, 2025

Universal adversarial suffixes that jointly bypass LLM alignment and Llama Prompt Guard 2 across five models; we also propose DeltaGuard, a residual-stream detector reaching near-100% malicious-prompt classification.
- Introduces universal adversarial suffixes that bypass alignment across LLMs with different tokenization schemes via joint optimization.
- First work to compromise Llama Prompt Guard 2 — defeats it on five text-generation models for malicious text and code generation.
- Proposes DeltaGuard, a residual-stream cosine-similarity detector that raises non-benign classification to nearly 100% against Super Suffix attacks.
Abs Bib PDF

The rapid deployment of Large Language Models (LLMs) has created an urgent need for enhanced security and privacy measures in Machine Learning (ML). LLMs are increasingly being used to process untrusted text inputs and even generate executable code, often while having access to sensitive system controls. To address these security concerns, several companies have introduced guard models, which are smaller, specialized models designed to protect text generation models from adversarial or malicious inputs. In this work, we advance the study of adversarial inputs by introducing Super Suffixes, suffixes capable of overriding multiple alignment objectives across various models with different tokenization schemes. We demonstrate their effectiveness, along with our joint optimization technique, by successfully bypassing the protection mechanisms of Llama Prompt Guard 2 on five different text generation models for malicious text and code generation. To the best of our knowledge, this is the first work to reveal that Llama Prompt Guard 2 can be compromised through joint optimization. Additionally, by analyzing the changing similarity of a model’s internal state to specific concept directions during token sequence processing, we propose an effective and lightweight method to detect Super Suffix attacks. We show that the cosine similarity between the residual stream and certain concept directions serves as a distinctive fingerprint of model intent. Our proposed countermeasure, DeltaGuard, significantly improves the detection of malicious prompts generated through Super Suffixes. It increases the non-benign classification rate to nearly 100%, making DeltaGuard a valuable addition to the guard model stack and enhancing robustness against adversarial prompt attacks.
@article{derya2025supersuffixes, title = {Super Suffixes: Bypassing Text Generation Alignment and Guard Models Simultaneously}, author = {Adiletta, Andrew and Adiletta, Kathryn and Derya, Kemal and Sunar, Berk}, journal = {arXiv preprint arXiv:2512.11783}, year = {2025}, url = {https://arxiv.org/pdf/2512.11783}, category = {ai}, tldr = {Universal adversarial suffixes that jointly bypass LLM alignment and Llama Prompt Guard 2 across five models; we also propose DeltaGuard, a residual-stream detector reaching near-100% malicious-prompt classification.}, highlights = {Introduces universal adversarial suffixes that bypass alignment across LLMs with different tokenization schemes via joint optimization.|First work to compromise Llama Prompt Guard 2 — defeats it on five text-generation models for malicious text and code generation.|Proposes DeltaGuard, a residual-stream cosine-similarity detector that raises non-benign classification to nearly 100% against Super Suffix attacks.} }
SaTML
Non-Halting Queries: Exploiting Fixed Points in LLMs

Ghaith Hammouri, Kemal Derya, and Berk Sunar

In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), 2025

A single fixed-point prompt recipe pushes every major aligned LLM into non-terminating output — 97% success on GPT-4o — bypassing alignment at rates orders of magnitude above prior jailbreaks.
- Proves that at temperature zero, repeating cyclic token sequences beyond the context size guarantee non-halting output in autoregressive LLMs.
- A single prompt recipe drives every major aligned model released in the past year into a non-halting state — 97% success on GPT-4o, 19% on Gemini Pro 1.5.
- ARCA-based gradient inversion finds 3-token prompts that trigger non-halting with 15% success, bypassing alignment at rates 1–2 orders of magnitude beyond prior attacks.
Abs DOI Bib PDF

We introduce a new vulnerability that exploits fixed points in autoregressive models and use it to craft queries that never halt, i.e. an LLM output that does not terminate. More precisely, for what we call non-halting queries, the LLM never samples the end-of-string token. We rigorously analyze the conditions under which the non-halting anomaly presents itself. In particular, at temperature zero, we prove that if a repeating (cyclic) sequence of tokens are observed at the output beyond the context size, then the LLM does not halt. We demonstrate non-halting queries in a number of experiments performed in base unaligned models where repeating prompts immediately lead to a non-halting cyclic behavior as predicted by the analysis. Further, we develop a simple recipe that takes the same fixed points observed in the base model and creates a prompt structure to target aligned models. We demonstrate the success of the recipe in sending every major model released over the past year into a non-halting state with the same simple prompt even over higher temperatures. Further, we devise an experiment with 100 randomly selected tokens and show that the recipe to create non-halting queries succeeds across 5 popular models with high rates of success ranging from 97% success rate for gpt-4o to 19% for Gemini Pro 1.5. These results show that the proposed adversarial recipe succeeds in bypassing alignment at one to two orders of magnitude higher rates compared to earlier reports. We also study gradient based direct inversion using ARCA to craft new short prompts to induce the non-halting state. We inverted 10,000 random repeating 2 cycle outputs for llama-3.1-8b-instruct. Out of 10,000 three-token inverted prompts 1,512 yield non-halting queries reaching a rate of 15%. Our experiments with ARCA show that non-halting may be easily induced with as few as 3 input tokens with high probability. Overall our experiments demonstrate that non-halting queries are prevalent and relatively easy to find in any of the existing state of the art LLMs.
@inproceedings{10992482, author = {Hammouri, Ghaith and Derya, Kemal and Sunar, Berk}, booktitle = {2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)}, title = {Non-Halting Queries: Exploiting Fixed Points in LLMs}, year = {2025}, volume = {}, number = {}, pages = {1-22}, keywords = {Analytical models;Large language models;Machine learning;Predictive models;Reliability engineering;Distance measurement;Context modeling;Large Language Models;Non-halting;Fixed Points}, doi = {10.1109/SaTML64287.2025.00009}, category = {ai}, tldr = {A single fixed-point prompt recipe pushes every major aligned LLM into non-terminating output — 97% success on GPT-4o — bypassing alignment at rates orders of magnitude above prior jailbreaks.}, highlights = {Proves that at temperature zero, repeating cyclic token sequences beyond the context size guarantee non-halting output in autoregressive LLMs.|A single prompt recipe drives every major aligned model released in the past year into a non-halting state — 97% success on GPT-4o, 19% on Gemini Pro 1.5.|ARCA-based gradient inversion finds 3-token prompts that trigger non-halting with 15% success, bypassing alignment at rates 1–2 orders of magnitude beyond prior attacks.} }

Hardware Security & Microarchitectural Attacks

2025

arXiv
µRL: Discovering Transient Execution Vulnerabilities Using Reinforcement Learning

M Caner Tol, Kemal Derya, and Berk Sunar

arXiv preprint arXiv:2502.14307, 2025

Replaces random fuzzing with reinforcement learning to discover transient-execution leaks — uncovers new leaky sequences on Intel Skylake-X and Raptor Lake without triggering any µcode assists, faults, or interrupts.
- First reinforcement-learning framework for discovering transient-execution vulnerabilities (Spectre/Meltdown-class leaks), replacing random fuzzing with feedback-driven exploration.
- RL agent discovers new leaky instruction sequences on Intel Skylake-X and Raptor Lake without triggering any µcode assists, faults, or interrupts.
- Newly identified leakage sources span SERIALIZE, VERR/VERW, CLMUL, MMX-x87 transitions, LSL+RDTSCP, and LAR instructions.
Abs Bib PDF

We propose using reinforcement learning to address the challenges of discovering microarchitectural vulnerabilities, such as Spectre and Meltdown, which exploit subtle interactions in modern processors. Traditional methods like random fuzzing fail to efficiently explore the vast instruction space and often miss vulnerabilities that manifest under specific conditions. To overcome this, we introduce an intelligent, feedback-driven approach using RL. Our RL agents interact with the processor, learning from real-time feedback to prioritize instruction sequences more likely to reveal vulnerabilities, significantly improving the efficiency of the discovery process. We also demonstrate that RL systems adapt effectively to various microarchitectures, providing a scalable solution across processor generations. By automating the exploration process, we reduce the need for human intervention, enabling continuous learning that uncovers hidden vulnerabilities. Additionally, our approach detects subtle signals, such as timing anomalies or unusual cache behavior, that may indicate microarchitectural weaknesses. This proposal advances hardware security testing by introducing a more efficient, adaptive, and systematic framework for protecting modern processors. When unleashed on Intel Skylake-X and Raptor Lake microarchitectures, our RL agent was indeed able to generate instruction sequences that cause significant observable byte leakages through transient execution without generating any µcode assists, faults or interrupts. The newly identified leaky sequences stem from a variety of Intel instructions, e.g. including SERIALIZE, VERR/VERW, CLMUL, MMX-x87 transitions, LSL+RDSCP and LAR. These initial results give credence to the proposed approach.
@article{tol2025mu, title = {µRL: Discovering Transient Execution Vulnerabilities Using Reinforcement Learning}, author = {Tol, M Caner and Derya, Kemal and Sunar, Berk}, journal = {arXiv preprint arXiv:2502.14307}, year = {2025}, category = {hw}, tldr = {Replaces random fuzzing with reinforcement learning to discover transient-execution leaks — uncovers new leaky sequences on Intel Skylake-X and Raptor Lake without triggering any µcode assists, faults, or interrupts.}, highlights = {First reinforcement-learning framework for discovering transient-execution vulnerabilities (Spectre/Meltdown-class leaks), replacing random fuzzing with feedback-driven exploration.|RL agent discovers new leaky instruction sequences on Intel Skylake-X and Raptor Lake without triggering any µcode assists, faults, or interrupts.|Newly identified leakage sources span SERIALIZE, VERR/VERW, CLMUL, MMX-x87 transitions, LSL+RDTSCP, and LAR instructions.} }
AsiaCCS
FAULT+PROBE: A Generic Rowhammer-based Bit Recovery Attack ★

Kemal Derya, M Caner Tol, and Berk Sunar

In Proceedings of the 2025 ACM Asia Conference on Computer and Communications Security (AsiaCCS), 2025

Turns Rowhammer into a statistical side channel — defeats verify-after-sign defenses and recovers 256-bit ECDSA session keys from wolfSSL TLS 1.3 at 22 bits/hour with 100% success.
- Reframes Rowhammer as a statistical side channel — leverages the victim’s operational behavior rather than corrupted outputs to recover secrets.
- Profiles DRAM directional bit-flip patterns to locate the most susceptible bit positions, then decodes secret bits through observable changes in victim behavior.
- Recovers 256-bit ECDSA session keys from wolfSSL’s TLS 1.3 handshake at 22 key bits/hour with 100% success, bypassing verify-after-sign fault-check defenses.
Abs DOI Bib PDF

Rowhammer is a security vulnerability that allows unauthorized attackers to induce errors within DRAM cells, e.g., to attain elevated user privileges or to extract sensitive information from cryptographic schemes. To prevent fault injections from escalating to successful attacks, a widely accepted mitigation is implementing fault checks on instructions and data. We challenge the validity of this assumption by examining the impact of the fault on the victim’s functionality, as opposed to solely focusing on the victim’s erroneous output. Specifically, we illustrate that an attacker can construct a profile of the victim’s memory based on directional bit flip patterns. This profile is then utilized to identify the most susceptible bit locations within DRAM rows. These locations are then subsequently leveraged to deduce sensitive bit values during an online attack phase that exploits side information observed from the change in the victim’s behavior. Consequently, the primary objective of this study is to utilize Rowhammer as a probe, shifting the emphasis away from the victim’s memory integrity and toward statistical fault analysis (SFA) based on the victim’s operational behavior. In the signing victim attack scenario, we show how Fault+Probe may be used to circumvent the verify-after-sign fault check mechanism, which is designed to prevent the generation of erroneous signatures that leak sensitive information. It does so by injecting directional faults into key positions identified during a memory profiling stage. The attacker observes the signature generation rate and decodes the secret bit value accordingly. This circumvention is enabled by an observable channel in the victim. Fault+Probe is not limited to signing victims and can be used to probe secret bits on arbitrary systems where an observable channel is present that leaks the result of the fault injection attempt. To demonstrate the attack, we target the fault-protected ECDSA in wolfSSL’s implementation of the TLS 1.3 handshake. We recover 256-bit session keys with an average recovery rate of 22 key bits/hour and a 100% success rate.
@inproceedings{derya2025faultprobe, title = {FAULT+PROBE: A Generic Rowhammer-based Bit Recovery Attack}, author = {Derya, Kemal and Tol, M Caner and Sunar, Berk}, booktitle = {Proceedings of the 2025 ACM Asia Conference on Computer and Communications Security (AsiaCCS)}, year = {2025}, doi = {10.1145/3708821.3733868}, url = {https://dl.acm.org/doi/pdf/10.1145/3708821.3733868}, category = {hw}, first_author = {true}, tldr = {Turns Rowhammer into a statistical side channel — defeats verify-after-sign defenses and recovers 256-bit ECDSA session keys from wolfSSL TLS 1.3 at 22 bits/hour with 100% success.}, highlights = {Reframes Rowhammer as a statistical side channel — leverages the victim's operational behavior rather than corrupted outputs to recover secrets.|Profiles DRAM directional bit-flip patterns to locate the most susceptible bit positions, then decodes secret bits through observable changes in victim behavior.|Recovers 256-bit ECDSA session keys from wolfSSL's TLS 1.3 handshake at 22 key bits/hour with 100% success, bypassing verify-after-sign fault-check defenses.} }
EuroS&P
LeapFrog: The Rowhammer Instruction Skip Attack

Andrew Adiletta, M Caner Tol, Kemal Derya, and 2 more authors

In 2025 IEEE European Symposium on Security and Privacy (EuroS&P), 2025

A new class of Rowhammer gadget that flips stack-stored return addresses to skip security-critical code — demonstrated end-to-end against OpenSSL and a live TLS handshake.
- Defines a new class of Rowhammer gadget that flips stack-stored return addresses to skip security-critical code (authentication checks, encryption rounds, protocol padding).
- Provides a systematic methodology to automatically identify LeapFrog gadgets in target binaries and determine optimal attack parameters.
- Demonstrated end-to-end against OpenSSL encryption bypass and a client/server TLS handshake; includes analysis of the Open Quantum Safe library.
Abs Bib PDF

Since its inception, Rowhammer exploits have rapidly evolved into increasingly sophisticated threats compromising data integrity and the control flow integrity of victim processes. Nevertheless, it remains a challenge for an attacker to identify vulnerable targets (i.e., Rowhammer gadgets), understand the outcome of the attempted fault, and formulate an attack that yields useful results. In this paper, we present a new type of Rowhammer gadget, called a LeapFrog gadget, which, when present in the victim code, allows an adversary to subvert code execution to bypass a critical piece of code (e.g., authentication check logic, encryption rounds, padding in security protocols). The LeapFrog gadget manifests when the victim code stores the Program Counter (PC) value in the user or kernel stack (e.g., a return address during a function call) which, when tampered with, repositions the return address to a location that bypasses a security-critical code pattern. This research also presents a systematic process to identify LeapFrog gadgets. This methodology enables the automated detection of susceptible targets and the determination of optimal attack parameters. We first show the attack on a decision tree algorithm to show the potential implications. Secondly, we employ the attack on OpenSSL to bypass the encryption and reveal the plaintext. We then use our tools to scan the Open Quantum Safe library and report on the number of LeapFrog gadgets in the code. Lastly, we demonstrate this new attack vector through a practical demonstration in a client/server TLS handshake scenario, successfully inducing an instruction skip in a client application. Our findings extend the impact of Rowhammer attacks on control flow and contribute to developing more robust defenses against these increasingly sophisticated threats.
@inproceedings{adiletta2025leapfrog, title = {LeapFrog: The Rowhammer Instruction Skip Attack}, author = {Adiletta, Andrew and Tol, M Caner and Derya, Kemal and Sunar, Berk and Islam, Saad}, booktitle = {2025 IEEE European Symposium on Security and Privacy (EuroS\&P)}, year = {2025}, url = {https://ieeexplore.ieee.org/abstract/document/11129305}, category = {hw}, tldr = {A new class of Rowhammer gadget that flips stack-stored return addresses to skip security-critical code — demonstrated end-to-end against OpenSSL and a live TLS handshake.}, highlights = {Defines a new class of Rowhammer gadget that flips stack-stored return addresses to skip security-critical code (authentication checks, encryption rounds, protocol padding).|Provides a systematic methodology to automatically identify LeapFrog gadgets in target binaries and determine optimal attack parameters.|Demonstrated end-to-end against OpenSSL encryption bypass and a client/server TLS handshake; includes analysis of the Open Quantum Safe library.} }

Post-Quantum Cryptography & Hardware Accelerators

2022

MICPRO
CoHA-NTT: A Configurable Hardware Accelerator for NTT-based Polynomial Multiplication ★

Kemal Derya, Ahmet Can Mert, Erdinç Öztürk, and 1 more author

Microprocessors and Microsystems, 2022

A parametric NTT hardware accelerator with both run-time and compile-time configurability, targeting lattice-based post-quantum cryptography across a wide range of schemes and throughput/area trade-offs.
- Unified butterfly architecture performs both forward and inverse NTT — the core primitive for lattice-based PQC polynomial multiplication.
- First architecture to provide both run-time configurability (scheme parameters) and compile-time configurability (throughput/area trade-offs) for NTT.
- Sub-blocks (modular multiplier, butterfly unit) are independently reusable building blocks for accelerating lattice-based cryptography.
Abs DOI Bib PDF

In this paper, we introduce a configurable hardware architecture that can be used to generate unified and parametric NTT-based polynomial multipliers that support a wide range of parameters of lattice-based cryptographic schemes proposed for post-quantum cryptography. Both NTT and inverse NTT operations can be performed using the unified butterfly unit of our architecture, which constitutes the core building block in NTT operations. The multitude of this unit plays an essential role in achieving the performance goals of a specific application area or platform. To this end, the architecture takes the size of butterfly units as input and generates an efficient NTT-based polynomial multiplier hardware to achieve the desired throughput and area requirements. More specifically, the proposed hardware architecture provides run-time configurability for the scheme parameters and compile-time configurability for throughput and area requirements. This work presents the first architecture with both run-time and compile-time configurability for NTT-based polynomial multiplication operations to the best of our knowledge. The implementation results indicate that the advanced configurability has a negligible impact on the time and area of the proposed architecture and that its performance is on par with the state-of-the-art implementations in the literature, if not better. The proposed architecture comprises various sub-blocks such as modular multiplier and butterfly units, each of which can be of interest on its own for accelerating lattice-based cryptography. Thus, we provide the design rationale of each sub-block and compare it with those in the literature, including our earlier works in terms of configurability and performance.
@article{DERYA2022104451, title = {CoHA-NTT: A Configurable Hardware Accelerator for NTT-based Polynomial Multiplication}, author = {Derya, Kemal and Mert, Ahmet Can and Öztürk, Erdinç and Savaş, Erkay}, journal = {Microprocessors and Microsystems}, volume = {89}, pages = {104451}, year = {2022}, issn = {0141-9331}, doi = {10.1016/j.micpro.2022.104451}, url = {https://www.sciencedirect.com/science/article/pii/S0141933122000254}, category = {pqc}, first_author = {true}, tldr = {A parametric NTT hardware accelerator with both run-time and compile-time configurability, targeting lattice-based post-quantum cryptography across a wide range of schemes and throughput/area trade-offs.}, highlights = {Unified butterfly architecture performs both forward and inverse NTT — the core primitive for lattice-based PQC polynomial multiplication.|First architecture to provide both run-time configurability (scheme parameters) and compile-time configurability (throughput/area trade-offs) for NTT.|Sub-blocks (modular multiplier, butterfly unit) are independently reusable building blocks for accelerating lattice-based cryptography.}, keywords = {NTT, PQC, Polynomial Multiplication, Parametric, Hardware} }

M.S. Thesis

Accelerating lattice-based cryptosystems ★

Kemal Derya

Sabancı University, 2022

M.S. thesis on FPGA-based hardware accelerators for lattice-based post-quantum cryptographic schemes.

FPGA implementation of NTT-based polynomial multipliers targeting lattice-based post-quantum cryptosystems.
Explores parametric, configurable hardware design methodologies covering schemes submitted to the NIST PQC standardization process.

Bib PDF

@mastersthesis{derya2022accelerating,
  title = {Accelerating lattice-based cryptosystems},
  author = {Derya, Kemal},
  school = {Sabancı University},
  year = {2022},
  url = {https://research.sabanciuniv.edu/id/eprint/47171/1/10478844.pdf},
  category = {pqc},
  first_author = {true},
  tldr = {M.S. thesis on FPGA-based hardware accelerators for lattice-based post-quantum cryptographic schemes.},
  highlights = {FPGA implementation of NTT-based polynomial multipliers targeting lattice-based post-quantum cryptosystems.|Explores parametric, configurable hardware design methodologies covering schemes submitted to the NIST PQC standardization process.}
}