When a 99% Safety Score Is Not Enough: Introducing SSP-Bench
A dynamic approach to evaluating the safety, security, and privacy of large language models (LLMs). LLMs are advancing rapidly, but the benchmarks used to evaluate them are struggling to keep pace. Most evaluations of model safety, security, and privacy (SSP) rely on fixed collections of prompts. These static benchmarks have been essential for reproducibility and […]
Unified Black-Box Evaluation of Cross-Dimensional Trade-offs in LLM SSP
A Model Can Be Safe—and Still Be Untrustworthy! Large language models (LLMs) are increasingly used in healthcare, finance, software development, customer service, and other high-impact settings. Yet the way we evaluate these models has not kept pace with the complexity of deploying them. A model might refuse harmful requests but also reject harmless ones. It […]
When the Benchmark Measures the Pipeline: Auditing Cybersecurity LLM Evaluation
A benchmark score looks deceptively simple. A model answers a set of questions, an evaluator calculates a number, and that number becomes evidence of the model’s capability. But what if the same model, answering the same underlying questions, can receive dramatically different scores depending on how the evaluation is configured? In our new paper, “Benchmark […]
When Native Dependencies Betray: An Integer Overflow in libxml2 with Cross-Language Impact on PHP and Swift
Author: Ahmed Lekssays Executive Summary During security research at the Qatar Computing Research Institute, we discovered a critical integer overflow vulnerability in libxml2’s xmlBuildQName() function (CVE-2025-6021) that cascaded into multiple high-profile projects including PHP’s SOAP extension (CVE-2025-6491) and Swift’s FoundationXML library. This research demonstrates how a single flaw in a widely-used native library can create […]
From VEX to Critical Bug
A subtle normalization mismatch inside an SBOM tool can break dependency relationships even when all packages are detected correctly. When edges between components silently disappear, downstream processes like vulnerability scanning and VEX reasoning become unreliable. This post walks through how such an issue surfaced in Syft, why it happened, and why small normalization inconsistencies pose […]