Matan Ben-Tov
I am a Computer Science PhD student at Tel Aviv University and a Google PhD Fellow, advised by Prof. Mahmood Sharif. I am also currently interning at Google. In the past, I worked as a software engineer at Check Point Research.
My research focuses on the security of Natural Language Processing (NLP) models (e.g., LLMs) and the systems built on them. I study how attacks against these models work, how they can be made stronger, how practical they are, and how they can be mitigated. I am especially interested in automating red-teaming efforts, and in analyzing attacks with interpretability methods to better understand what makes these models vulnerable.
Selected Publications
TROPT: An Open Framework for Unifying and Advancing Discrete Text Optimization
An open-source framework for running and developing discrete text-trigger optimizers—against any NLP model and any loss. TROPT ships 40+ recipes spanning LLM jailbreaks, model auditing, and interpretability, lowering the barrier to adopting discrete text optimization methods.
@inproceedings{bentov2026troptopenframeworkunifying,title={{TROPT}: {A}n {O}pen {F}ramework for {U}nifying and {A}dvancing {D}iscrete {T}ext {O}ptimization},author={Ben-Tov, Matan and Sharif, Mahmood},booktitle={NeurIPS E\&D Track},year={2026}}
Universal Jailbreak Suffixes Are Strong Attention Hijackers
Analyzing the underlying mechanism of suffix-based LLM jailbreaks, we find it relies on aggressively hijacking the model context 🥷, which intensifies with the suffix’s universality. Exploiting this, we enhance and mitigate existing attacks.
@article{bentov2025universaljailbreaksuffixesstrong,title={{U}niversal {J}ailbreak {S}uffixes {A}re {S}trong {A}ttention {H}ijackers},author={Ben-Tov, Matan and Geva, Mor and Sharif, Mahmood},journal={TACL},year={2026}}
GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Search
Through introducing a strong, new SEO attack ⛽💡, we extensively evaluate widely-used embedding-based retrievers’ susceptibility to SEO attacks via corpus poisoning, linking it to key properties in embedding space.
@inproceedings{BenTov2025GASLITE,title={{GASLITE}ing the {R}etrieval: {E}xploring {V}ulnerabilities in {D}ense {E}mbedding-based {S}earch},author={Ben-Tov, Matan and Sharif, Mahmood},booktitle={ACM CCS},year={2025}}
CaFA: Cost-aware, Feasible Attacks With Database Constraints Against Neural Tabular Classifiers
We propose an efficient attack against neural tabular classifiers for automatic robustness evaluation, addressing attacker objectives such as feasibility (via incorporation of database constraints) and cost-efficiency.
@inproceedings{BenTov24CaFA,title={{CaFA}: {C}ost-aware, Feasible Attacks With Database Constraints Against Neural Tabular Classifiers},author={Ben-Tov, Matan and Deutch, Daniel and Frost, Nave and Sharif, Mahmood},booktitle={IEEE S\&P},year={2024}}