Security Red-Teaming & Adversarial Hardening for Frontier LLM Series

Overview

The project provides specialized, project-based Senior ML Security Engineering consultation for Alibaba Group's proprietary LLM division. Operating within an airgapped, SCIF-level laboratory, the focus is adversarial robustness and operational security redteaming for frontier models. Alibaba's Qwen series began with the beta release in April 2023 under the name Tongyi Qianwen, with Qwen-7B open-sourced in August 2023 and Qwen-72B released in December 2023. The Qwen2 series launched in June 2024 with 72B parameters, Qwen3 followed in April 2025, and Qwen3-Coder was open-sourced in July 2025.

Achievements

Identified and patched a Unicode Tag Sequence Injection vulnerability in a prerelease customer-support agent. Developed a fuzzing harness using Hypothesis (property-based testing library first released circa 2016) that revealed a 12% edge-case failure rate in the RLHF safety classifier. The implemented double-model supervision framework reduced false negatives in security audits by 41% compared to single-model filtering.

Responsibilities

• Researched BPE tokenizer manipulation to construct prompts that appear benign visually but decode into malicious system instructions, exploiting ASCII smuggling and Unicode normalization gaps.
• Engineered an air-gapped automated fuzzing framework to probe the safety refusal vector, focusing on multi-turn dialogue poisoning where an attacker gradually shifts the context window before injection.
• Designed and validated a hierarchical supervision mechanism in which a smaller, older-generation model (e.g., Qwen-7B, released August 2023) acts as a policy sentinel, monitoring and evaluating the outputs of a newer, more capable model (e.g., Qwen2-72B, released June 2024). The sentinel model detects alignment drift and potential security bypasses by leveraging its simpler, more predictable decision boundaries, flagging anomalous responses for further inspection without requiring human oversight in the loop.
• Quantified memorization rates using canary string injection methodology to assess the efficacy of differential privacy applied during fine-tuning.
• Directed kernel-level isolation strategies using gVisor (open-sourced by Google in May 2018) and seccomp profiles to enforce air-gap integrity at the container runtime. Integrated eBPF (introduced with Linux 3.18 in 2014) for unauthorized syscall tracing.

Technologies Used