Edoardo Debenedetti

The SPY Lab at ETH Zürich announced in July 2026 that Debenedetti had defended his PhD thesis, "Security and Privacy of Machine Learning Systems." His advisor was Florian Tramèr. On his personal site he describes his research as focused on prompt injection attacks and the security of AI agents.

With Fredrik Nestaas and Tramèr, Debenedetti wrote Adversarial Search Engine Optimization for Large Language Models, posted in June 2024 and presented at the Thirteenth International Conference on Learning Representations. It introduced Preference Manipulation Attacks, in which crafted website content or plugin documentation steers an LLM-powered search engine toward an attacker's product.

The paper sits beside work by Aounon Kumar, Himabindu Lakkaraju, and Samuel Pfrommer as one of three 2024 studies on manipulating LLM recommendations. Chapter 7 of the GEO/AEO History places all three in 2024, the year after the first Generative Engine Optimization paper.

Debenedetti's other work builds the test environments that security research depends on. AgentDojo, a dynamic environment for evaluating prompt injection attacks and defenses against LLM agents, appeared in the NeurIPS 2024 Datasets and Benchmarks Track and won a SafeBench first prize. He was a joint first author of JailbreakBench and of RobustBench, and his 2026 paper "Defeating Prompt Injections by Design," written with collaborators including Tramèr, appeared at the IEEE Conference on Secure and Trustworthy Machine Learning.