Luigi Coniglio's personal blog about security, computer science and miscellaneous
Neural networks are trained to learn patterns, but sometimes they learn a bit too well. Under the right conditions, ML models can memorize specific samples from their training data, and spit them back out. This has real consequences for privacy, intellectual property, and legal compliance: GitHub Copilot has been caught reproducing GPL-licensed code without attribution, leading to a class-a...
Update: 12 May 2026 I have just released Prompt Injection Defence Atlas, a taxonomy of defences against prompt injection. It includes and summarizes most of the available literature to date. You can explore the interactive graph here. Prompt injection is a class of attacks where an adversary embeds malicious instructions into content that an LLM will process. As LLMs increasingly gain th...
TL;DR: JavaScript engines are fascinating and challenging from a security perspective due to their exposure to malicious code, memory corruption risks, frequent vulnerabilities, and exploit-friendly nature. I work at Meta on enhancing the security of the widely used Hermes JS engine, which powers React Native and various other applications. I recently published an article about a unique Hermes ...
I have recently published a blogpost showing some of the work I have done during my internship at Quarkslab. The blogpost can be found here.
Recently as part of a small project I have been wondering what is the most efficient data structure for implementing associative arrays when symbolic keys are involved. An associative array is a data type consisting in a collection of key-value pairs such that each key in unique. Normally this data type allows for operations such as lookup, insertion, removal and modification of values associ...