An open-source framework for running and developing discrete text-trigger optimizers—against any NLP model and any loss. TROPT ships 40+ recipes spanning LLM jailbreaks, model auditing, and interpretability, lowering the barrier to adopting discrete text optimization methods.
@inproceedings{bentov2026troptopenframeworkunifying,title={{TROPT}: {A}n {O}pen {F}ramework for {U}nifying and {A}dvancing {D}iscrete {T}ext {O}ptimization},author={Ben-Tov, Matan and Sharif, Mahmood},booktitle={NeurIPS E\&D Track},year={2026}}
Analyzing the underlying mechanism of suffix-based LLM jailbreaks, we find it relies on aggressively hijacking the model context 🥷, which intensifies with the suffix’s universality. Exploiting this, we enhance and mitigate existing attacks.
@article{bentov2025universaljailbreaksuffixesstrong,title={{U}niversal {J}ailbreak {S}uffixes {A}re {S}trong {A}ttention {H}ijackers},author={Ben-Tov, Matan and Geva, Mor and Sharif, Mahmood},journal={TACL},year={2026}}
Through introducing a strong, new SEO attack ⛽💡, we extensively evaluate widely-used embedding-based retrievers’ susceptibility to SEO attacks via corpus poisoning, linking it to key properties in embedding space.
@inproceedings{BenTov2025GASLITE,title={{GASLITE}ing the {R}etrieval: {E}xploring {V}ulnerabilities in {D}ense {E}mbedding-based {S}earch},author={Ben-Tov, Matan and Sharif, Mahmood},booktitle={ACM CCS},year={2025}}
We propose an efficient attack against neural tabular classifiers for automatic robustness evaluation, addressing attacker objectives such as feasibility (via incorporation of database constraints) and cost-efficiency.
@inproceedings{BenTov24CaFA,title={{CaFA}: {C}ost-aware, Feasible Attacks With Database Constraints Against Neural Tabular Classifiers},author={Ben-Tov, Matan and Deutch, Daniel and Frost, Nave and Sharif, Mahmood},booktitle={IEEE S\&P},year={2024}}