In addition to Sophos’ presence at Black Hat USA this year, data scientists from the Sophos AI team will present two talks on novel AI security research at the BSides Las Vegas conference. A three-headed dog On Monday August 3, Adarsh Kyadige presents ‘CerBERTus,’ a three-headed BERT-based model for prompt security. LLM jailbreak detection is often framed as a binary task: is a prompt harmful or benign? However, this framing is brittle. Harmful requests can be concealed inside roleplay, fiction, urgency, or ‘academic’ pretexts, while legitimate prompts can be topically close to unsafe content without malicious intent. As a result, single-label detectors overfit to surface patterns, yielding both false negatives (adversarial rewrites) and false positives (adjacent-benign prompts). CerBERTus addresses this issue because it does not treat jailbreak detection as a flat binary classifier; instead, it models the attacker’s degrees of freedom by disentangling what is being asked (goal) from how it is being asked (frame). The method involves a single shared encoder that feeds three classification heads: - Harmfulness (primary) - Goal category (what the user is trying to do) - Framing style (how the request is presented). To train and stress-test this separation, Adarsh and team built a structured factorial prompt corpus that systematically crosses goals with frames: - Goals include harmful, adjacent-benign, and generic-benign requests spanning categories such as cyberattacks, fraud/social engineering, explosives, chemical/biological weapons, conventional weapons, drug synthesis, privacy/doxxing, human trafficking, extremist propaganda, and racism/nativism. - Frames include adversarial jailbreak styles (e.g., roleplay/persona, screenplay/fiction, urgency/crisis, academic pretext, obfuscation, injection-like prefixes) as well as benign and null/plain framing. The team will demonstrate that the model generalizes to both novel attack goals and novel presentation styles it had not encountered during training. In the talk, they’ll cover the threat model, dataset construction, training objective, and evaluation strategy, and discuss