AI security · · 2 min read
Designing Teger AI to explain phishing
How Teger AI, an explainable social-engineering defence for Gmail and Slack, pairs deterministic signals with AI analysis and treats every message as untrusted.
Emmanuel Effiom DukeAI security engineer
Social-engineering and phishing detection, prompt-injection-aware LLM design, and auditing models for hidden behaviour.
Social engineering works because it targets people, not systems: urgency, false authority, requests that bypass process. My security work applies AI to that problem while treating AI as an attack surface in its own right.
Defending people from manipulation
Teger AI is the product side. It doesn't give an unexplained verdict. It shows the concrete cues behind each warning (credential requests, payment changes, authority claims, secrecy, suspicious links) and recommends a safe next action, so users learn to recognise the pattern themselves. It's in private beta as MVP v0.2.
How detection works
Each scan runs in two stages. Deterministic code first extracts signals that need no model: urgency, credential requests, financial requests, authority claims, secrecy or process-bypass requests, and the shape of any links. The AI analysis then reads the message alongside those signals. It returns a threat level, a confidence, the manipulation tactics it found from a shared taxonomy, the concrete cues behind them, its reasoning and a recommended action. The deterministic signals count as hints, not proof, and tactics outside the taxonomy are dropped.
Securing the AI itself
- Prompt injection. Every analysed message is marked as untrusted, attacker-controlled data at the model boundary, and model output is validated against a fixed threat taxonomy.
- Credential and abuse protection. Provider keys never leave the server. Clients use HMAC-signed anonymous tokens, with rate limits per installation and per IP.
- Privacy by design. Users choose what gets scanned, and local history keeps metadata only.
- Honest limits. The threat model documents what the MVP doesn't yet do, such as attachment detonation and full URL reputation.
Looking inside models
On the research side I study how models internally represent deception cues, and how to audit fine-tuned models for hidden objectives without being fooled by false positives. See the AI safety research page.
Certification: Cisco IT Essentials (UNITeS Cisco Networking Academy).
Selected work
- Teger AIExplainable social-engineering defence for suspicious email and chat messages (Gmail and Slack).
- Teger AI source and threat modelOpen-source extension, API and documented threat model.
- mechinterp-phishing-probeLooking for social-engineering circuits inside language models.
- Deception Feature UniversalityDo different models represent phishing cues alike?
- Secret Loyalties auditDetecting hidden allegiances in fine-tuned models.
Related writing
AI safety · · 2 min read
Do models represent deception alike?
Do different architectures learn similar internal representations of deception cues? A toy-scale test, and why the first null was too weak to answer.
AI safety · · 2 min read
Four false positives and one real signal
A weights-first audit of three model organisms for secret loyalties at the Apart Research hackathon, and the workflow that rejected four false positives.
Other areas
Expertise
AI engineer
LLM products, agents and evaluation tooling, built end to end and shipped.
Expertise
AI safety researcher
Mechanistic interpretability, model auditing and alignment experiments, with open code and honest negative results.
Expertise
AI forecasting and LLM evaluation
Automated forecasting with LLM ensembles, calibration measured offline, and probes that test what models really know.
Expertise
Mechanical engineer and energy researcher
CFD modelling, machine-learning energy optimisation and air-quality research, grounded in a mechanical-engineering degree and hands-on HVAC work.