Publications
My research is on the security and oversight of LLM agents: how they can be attacked through memory and shared content, and how to tell when one is about to misbehave.
Papers
- Pre-Crime for Agents, at the Last Second: Probing When a Recruited Agent Gives In
Leonidas Raghav
arXiv preprint, 2026
A peer agent presses a target agent to leak a secret it was told to keep. A linear probe on the target's activations, read before each reply is written, flags the reply that will leak: on held-out Qwen3-32B episodes it catches 82% of leaking calls while flagging 5% of benign ones, against 26% for a zero-shot text monitor. On gpt-oss-20b it reaches AUROC 0.91.
- Share-Borne AI Virus: Memory-Hopping Attacks Across LLM Agents
Sidharth Pulipaka, Ansh Sharma, Stanislau Hlebik, Leonidas Raghav, Vyas Raina, Ivaxi Sheth, Mario Fritz
arXiv preprint, 2026
Adversarial content in a shared artifact, such as a report, gets stored in one assistant's memory, copied into the next artifact it writes, and picked up by another assistant. In larger simulated environments, even GPT-5.6 Luna spreads the attack to 60–80% of agents, along chains up to eight hops long.
- Autonomous Event-Driven Multi-Agent Orchestration for Enterprise AI at Scale REALM Workshop · EMNLP 2026
Harsh Rao Dhanyamraju, Leonidas Raghav, Aaron Lee
arXiv preprint, 2026
On a sanitized enterprise snapshot (208 scenarios, 393 events), compares plan-and-execute with ReAct agents, and adds a task manager for priority, merging and preemption that cuts high-priority queue latency by 14–75%.
- Hidden in Memory: Sleeper Memory Poisoning in LLM Agents Spotlight · ICML 2026 AIWILD Workshop
Sidharth Pulipaka, Stanislau Hlebik, Leonidas Raghav, Sahar Abdelnabi, Vyas Raina, Ivaxi Sheth, Mario Fritz
arXiv preprint, 2026
A document, webpage or repository can make a memory-enabled assistant store a fabricated memory about its user, which lies dormant and resurfaces in later conversations. Poisoned memories were stored up to 99.8% of the time on GPT-5.5 and 95% on Kimi-K2.6, and led to attacker-intended agentic actions in 60–89% of evaluations across models.
Research sprints
Short research projects from Apart Research hackathons and sprints.
- Recruited: Pre-Crime for Collusion? Predicting When an Agent Gives In to a Recruiting Peer, with Activation Probes and Text Monitors
Leonidas Raghav
Apart Research AI Collusion Research Sprint, 2026
A peer agent presses another to reveal a secret. A linear probe on the target model's activations, read before it writes its reply, predicts whether that reply will give in, with AUROC 0.95 on Qwen3-32B and 0.91 on gpt-oss-20b (1.0 is perfect, 0.5 is chance).
- Agent Attacks via Memory Injection 4th place AIMII Workshop · IASEAI '26
Leonidas Raghav, Choong Kai Zhe
Apart Research AI Manipulation Hackathon, 2026
Web pages that inject instructions into an agent's long-term memory led to harmful behaviour more often than direct pressure for 4 of 5 models, e.g. GPT-4o 92% vs 60% and Claude Sonnet 4 84% vs 35%. GPT-4.1 was the exception, accepting only 16% of injections.