[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ff-ynzLqR98jmOm7j7_phiDra7m71kOFywMEKBlPzJUY":3,"$fEJWsjwZHa7U89uj2NpR_1S7wKM1lbV1YuO4055V0CUk":55},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":51,"created_at":52,"updated_at":53,"published_at":54},"sophos-ai-unveils-cerbertus-three-headed-bert-model-for-llm-jailbreak-detection","Sophos AI Unveils CerBERTus: Three-Headed BERT Model for LLM Jailbreak Detection","Adarsh Kyadige presents a multi-task BERT architecture at BSides Las Vegas to detect prompt injection and jailbreaks in LLMs.","Sophos AI data scientist Adarsh Kyadige presents CerBERTus, a three-headed BERT-based model for LLM jailbreak detection, at BSides Las Vegas on August 3, 2026.",[10,11,12,13,14],"Sophos","LLM","jbreak","BERT","BSidesLV","# Sophos AI Unveils CerBERTus: Three-Headed BERT Model for LLM Jailbreak Detection\n\n*Adarsh Kyadige presents a multi-task BERT architecture at BSides Las Vegas to detect prompt injection and jailbreaks in LLMs.*\n\n**Tags:** `Sophos` `LLM` `jbreak` `BERT` `BSidesLV`\n\n> Sophos AI data scientist Adarsh Kyadige presents CerBERTus, a three-headed BERT-based model for LLM jailbreak detection, at BSides Las Vegas on August 3, 2026.\n\n---\n\n## CerBERTus: a three-headed BERT for LM jailbreaks\n\nSophos AI has released CerBERTus, a BERT-based model designed to detect jailbreaks in large language models, presented at BSides Las Vegas by Adarsh Kyadige on Monday, August 3.\n\nThe model uses a three-headed architecture that applies multi-task supervision to improve both robustness and interpretability compared to standard single-head BERT classifiers. Kyadige’s talk covers the training data, inference strategy, and when multi-task supervision actually helps over a single-head setup.\n\n## The second talk: anomaly detection for long-tail threats\n\nOn Wednesday, August 5, Ben Gelman, Tamas Nyiri, and Tibor Kristóf Lányi present their anomaly detection research, following on from work first shown at Black Hat USA 2025.\n\nThe three are data scientists on the Sophos AI team, and the talk targets a specific gap: supervised classifiers in cybersecurity are typically trained on data that doesn’t capture the long tail of real-world threats. This detector is built for Sophos’ own detection systems, where the long tail is where the misses hurt.\n\n## Where it fits in the Sophos stack\n\nCerBERTus and the anomaly detector are part of Sophos AI Defense, the layer that sits alongside Sophos Endpoint and Sophos Fusion in the company’s product stack. Sophos Fusion is the AI-native defense system that currently protects more than 625,000 organizations worldwide, and it is the same system that just got OpenAI’s frontier models via a newly announced partnership.\n\nThe OpenAI integration brings frontier model capability directly into the channel and managed service providers through Sophos Fusion, extending the system’s existing coverage of endpoint, network, email, cloud, identity, and security operations. Sophos also joined OpenAI’s Daybreak Cyber Partner Program for managed security services, which is the first time the program has been extended to MSSPs. The three pieces—security from AI, with AI, and for AI—map cleanly to what Sophos is shipping: Endpoint blocks the exploit techniques, the agentic SOC handles detection and response, and AI Defense governs the AI itself.\n\n## Key points\n\n- CerBERTus is a three-headed BERT model designed for LLM jailbreak detection.\n- Presented by Adarsh Kyadige on Monday, August 3, 2026 at BSides Las Vegas.\n- The model uses multi-task supervision to improve robustness and interpretability.\n- Sophos AI team is presenting two research talks at BSides LV, with a second anomaly detection talk on August 5.\n- Sophos will publish in-depth articles on both projects after the conference.\n\n## Further reading & sources\n\n- [Three-headed dogs and long tails: Sophos at BSides LV | SOPHOS](https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fblog\u002Fthree-headed-dogs-and-long-tails-sophos-at-bsides-lv) — Sophos\n- [When AI doesn’t know the target is real | SOPHOS](https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fblog\u002Fwhen-ai-doesnt-know-the-target-is-real)\n- [Sophos Ranked #1 Overall in Endpoint, XDR, MDR, and Firewall in G2 Fall 2026 Reports | SOPHOS](https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fblog\u002Fsophos-g2-fall-2026-reports)\n- [AI shrinks cyberattack timelines as attackers target AI identities, Sophos report finds](https:\u002F\u002Fwww.dqindia.com\u002Fnews\u002Fai-shrinks-cyberattack-timelines-attackers-target-ai-identities-sophos-report-12194185)\n- [AI compresses cyberattack timelines, targets ungoverned AI identities - IT-Online](https:\u002F\u002Fit-online.co.za\u002F2026\u002F07\u002F23\u002Fai-compresses-cyberattack-timelines-targets-ungoverned-ai-identities\u002F)\n- [Sophos Working with OpenAI on security from AI, with AI, and for AI | SOPHOS](https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fblog\u002Fsophos-working-with-openai)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsophos-ai-unveils-cerbertus-three-headed-bert-model-for-llm-jailbreak-detection.png?v=8e50c705f7",{"malware":18,"timeline":21,"technologies":37},[19],{"name":20},"CerBERTus",[22,26,29,33],{"date":23,"event":24,"description":25},"2025-08-03","Presentation","Adarsh Kyadige presents CerBERTus at BSides Las Vegas",{"date":27,"event":24,"description":28},"2025-08-05","Ben Gelman and team present anomaly detection research at BSides Las Vegas",{"date":30,"event":31,"description":32},"2026-01","Report release","Sophos AI Security 2026 report released",{"date":34,"event":35,"description":36},"2026-02","Partnership announcement","Sophos and OpenAI partnership announced",[38,40,42,44,46,47,49],{"vendor":10,"product":39},"Sophos AI Defense",{"vendor":10,"product":41},"Sophos Endpoint",{"vendor":10,"product":43},"Sophos Fusion",{"vendor":10,"product":45},"Endpoint Security",{"vendor":10,"product":20},{"vendor":10,"product":48},"Sophos MDR",{"vendor":10,"product":50},"Sophos Firewall","vulnerability_disclosure","2026-09-11T07:05:25.491171+00:00","2026-10-16T12:28:45.044416+00:00",null,{"articles":56},[57,69,82,95],{"slug":58,"title":59,"summary":60,"tags":61,"hero_image_url":66,"story_type":67,"created_at":68},"palo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production","Palo Alto Unit 42: 405 AI-enabled malware samples show 12 in production","Palo Alto Networks Unit 42 analyzed 405 AI-enabled malware samples and found the space is dominated by PoC and researcher code, with only 12 samples hitting production endpoints across five distinct malware families.",[62,63,64,65,11],"AI malware","FunkSec","Palo Alto Unit 42","ransomware","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production.png?v=efb3f6f578","threat_actor_activity","2026-09-26T12:10:59.266452+00:00",{"slug":70,"title":71,"summary":72,"tags":73,"hero_image_url":80,"story_type":51,"created_at":81},"red-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-","Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password","Red Hat disclosed a critical vulnerability in Keycloak's reset-credentials flow that allows a remote unauthenticated attacker to bypass the email verification step and reset the password for any user account in any realm.",[74,75,76,77,78,79],"Keycloak","Red Hat","CVE-2026-18963","CVSS 9.1","account takeover","password reset","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fred-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-.png?v=94dc54a17a","2026-09-30T12:09:12.456253+00:00",{"slug":83,"title":84,"summary":85,"tags":86,"hero_image_url":93,"story_type":51,"created_at":94},"trend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-","Trend Micro ZDI: Windows Shell Link zero-day exploited by 11 state-backed groups since 2017","Trend Micro's Zero-Day Initiative disclosed a new Windows Shell Link (.lnk) zero-day (ZDI-CAN-25373) exploited in the wild by 11 state-backed groups since 2017, which Microsoft declined to patch as 'not meeting the bar servicing'.",[87,88,89,90,91,92],"windows","shell-link","zero-day","ZDI","Trend Micro","state-sponsored","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-.png?v=a2818b0e7b","2026-09-30T12:04:13.324344+00:00",{"slug":96,"title":97,"summary":98,"tags":99,"hero_image_url":105,"story_type":51,"created_at":106},"head-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog","Head Mare Exploits Three Zero-Days to Trojanize TrueConf, Atlassian Rovo, and Progress LoadMaster","The Head Mare APT group is actively exploiting three zero-day vulnerabilities in Atlassian Rovo, Progress LoadMaster, and Metabase, with Progress LoadMaster CVE-2026-8037 now on CISA KEV after 792 observed exploitation attempts.",[100,89,101,102,103,104],"Head Mare","Atlassian Rovo","Progress LoadMaster","Metabase","CVE-2026-8037","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhead-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog.png?v=48acc20ab2","2026-09-22T12:04:22.141581+00:00"]