Open questions · Updated November 2026
Questions I think deserve more depth than a lab bench
A lot of my work on securing AI ends at the same place: a practical question a security team needs answered, a search of the academic record that comes back thin, and a small lab test that narrows the question without settling it. So I keep a list of those questions, and this page is the short public version of it. Each one is sized for a semester project, a thesis or a dissertation chapter, each can be worked with public or synthetic data, and each has a starting point here on the site or in the lab.
Measurement and validity
Questions about whether the instruments the field already uses to plan defenses tell us what we think they tell us.
Do threat-to-control mappings carry information, or would a random mapping of the same shape do as well?
Every major catalogue now maps attack techniques to mitigations and controls, and planners rank controls by how many mapped techniques they touch. An early test I ran over the steps in MITRE ATLAS's incident case studies could not tell the greedy order of controls apart from random orders that kept the same number of links per control, which, if it holds up, means the ranking is mostly reading the shape of the mapping. The open work is a proper null-model treatment across ATLAS, ATT&CK, D3FEND, SP 800-53 and CSF, and a counterfactual test of whether a mapped mitigation would actually have interrupted the step it is mapped to.
How reliable are LLM graders on security mapping work?
Language models are being used to map detections, alerts and log fields to ATT&CK, ATLAS, D3FEND and OCSF, and often to grade each other's mappings. I could not find an inter-rater study on these schemas that sets model graders against a panel of human experts, or one that measures how often a model invents an entry that does not exist in a closed vocabulary.
How much of the security capability an organization already owns goes unused or misconfigured?
My own experience is that most of what a team needs for AI governance is already licensed and mostly switched off or half-configured, but that is an observation, not a measurement, and the public evidence is indirect. The study I would like to see audits reference environments against five states (enabled, scoped, exported, alerted, owned) and pairs that with a practitioner survey, so the drop between owning a feature and getting value from it is measured rather than asserted.
Models and the AI supply chain
Questions that come with open-weight, locally run and fine-tuned models.
Can backdoored open-weight models be caught when an organization pulls them in?
Published work already shows model-file scanners erring in both directions, flagging benign files and missing real exploits, and very little covers detecting weight-level backdoors at the point where an enterprise downloads a model. A related practical gap is that scanner verdicts rarely carry a digest or package identifier that would let the result follow the artifact through a pipeline.
How much does a small enterprise fine-tune memorize, and what changes extraction?
The research on memorization mostly studies large pre-training corpora. The questions that matter for a team fine-tuning on its own tickets or documents are less covered: how decoding settings change what comes back out, whether templated near-duplicate records behave like repeats, and what leaks from an adapter file handled on its own.
What do extraction and model-abuse attempts look like in serving logs?
Membership-inference and extraction attacks are well studied as attacks, and stolen-credential abuse of model APIs is a documented pattern, but I found little on what either looks like in the invocation and serving logs a defender actually has. That is a detection-engineering question with real data-science depth.
Agents, identity and telemetry
Questions about seeing and governing what agents do on someone's behalf.
How well do prompt-injection detectors work on agent tool output?
The literature suggests small detectors do worst exactly where agents need them, on injected instructions arriving inside retrieved content and tool results, with high false-positive rates on harmless tool output. What is not studied is whether accumulating many noisy verdicts per identity over time turns a weak classifier into a usable detection, and how often the verdict fields platforms export are wrong in practice.
How should delegated authority be recorded so an agent's action traces back to a person and a policy?
When an agent exchanges a user's token for a narrower one and calls a tool, the record of who asked for what, and what was actually granted at each hop, is often incomplete. The work here is measuring what several identity providers write today and testing an OCSF representation of multi-hop delegation that could go upstream.
Can the lethal trifecta be detected from telemetry?
An agent with access to private data, exposure to untrusted content and a way to send data out is the combination that turns prompt injection into exfiltration. I found no published detection rules for that pattern over agent telemetry, either within a session or across a chain of delegated agents.
Privacy, law and people
Questions that need security, law and human-factors researchers working together.
Can prompt logging be privacy-preserving and still useful for security?
European data-protection law points toward capturing metadata by default and prompt text only when a detector or an incident calls for it. Whether that design still answers the security questions, how resistant hashed prompt records are to guessing, how well redaction works on coding-agent traffic, and how employees respond to being logged are all largely unmeasured.
How much enterprise AI use is invisible to network controls?
Surveys put unsanctioned AI use high, but I could not find a measured comparison of endpoint and network discovery methods on the same machines, or a defensible estimate of the share of use that network controls never see because it runs locally or off the managed network.
How this list works
The list should shrink as the field catches up.
A question goes on the list when a structured search of the published and preprint literature did not answer it, and the most recent search ran in November 2026. "I could not find" means exactly that, so if you know of work that answers one of these, I would genuinely like to hear about it, and the question comes off the list with the citation. I re-run the search at least quarterly, and I add questions as lab results open new ones.
If you supervise graduate students in security, machine learning, privacy law or human factors and one of these fits a student's interests, I am open to talking about it. The terms I would ask for are simple: public or synthetic data, the student owns the publication, and I contribute the practitioner framing, the starting artifacts and a reviewer's time.
The analyses these questions came out of
The research page holds the coverage frameworks and securing-AI analyses behind most of this list, and the lab page describes the benches that act as pilots for several of the questions.
