Florian Tramèr
Assistant Professor of Computer Science
ETH Zürich
Florian Tramèr is an assistant professor of computer science at ETH Zürich, where he leads the SPY Lab and studies the security of machine learning systems. With Fredrik Nestaas and Edoardo Debenedetti, he showed that text planted on a web page can steer LLM search engines into recommending an attacker's product.
Showing How AI Search Can Be Gamed
"As LLMs are increasingly used to rank third-party content, we expect Preference Manipulation Attacks to emerge as a significant threat," Tramèr and his co-authors wrote in Adversarial Search Engine Optimization for Large Language Models, presented at ICLR 2025. The attacks hide instructions or misleading claims in website copy or plugin descriptions so that an LLM promotes one product and discredits its rivals.
Against Bing's LLM search, an attack made a targeted camera 2.5 times more likely to be recommended, and a GPT-4 news plugin became 2 to 8 times more likely to be selected over a competing one. The paper also described a prisoner's dilemma: each site gains by attacking, but when several attack the same model, all of them lose search presence.
Prompt Injection and AI Agents
Preference manipulation borrows from prompt injection, which Tramèr has also studied in AI agents. "The particularly scary part about prompt injections is that the place where the attack occurs is just in completely static data," he told Schmidt Sciences in 2025. Agents have to tell instructions apart from data, and "models have gotten quite a bit better at doing this. But they're still very, very far from being reliable." With collaborators he built CaMeL, a defense that splits an agent's work between two language models and, in tests published in March 2025, fended off known prompt injection attacks while still handling most of its intended tasks.
Asked by ETH News in April 2026 about Anthropic's Claude Mythos Preview, he said such models "could help less-experienced attackers achieve much more than before."
Stanford, Google Brain and ETH Zürich
Tramèr earned his PhD at Stanford University under Dan Boneh and spent a year at Google Brain before joining ETH Zürich. His first AI security paper, on model stealing attacks, won the 2026 USENIX Security Test of Time Award.
He is co-chairing SaTML 2027, a conference on secure and trustworthy machine learning, and his personal site lists his papers, recorded talks and the SPY Lab's students.