Contextual deception in tool-using agents
How do comment-level and context-level attacks transfer from isolated LLM completions to agents that call tools over MCP and persist memory across sessions?
Research
Agentic systems and LLM security
How production agents fail when memory, tools, and multi-agent handoff are involved, and how those failures can be measured.
Production agents are not chat completions with extra steps. Once a system has long-term memory, authenticated tools, and multi-agent handoff, it acquires failure modes that single-turn jailbreak benchmarks do not capture: silent harm, memory leakage, and unsafe tool execution in regulated settings.
My work sits at that boundary. I co-authored an IEEE evaluation of contextual deception in code-generating LLMs, and I design production multi-agent systems in healthcare. I want to study how those systems can be evaluated and governed under the constraints that actually appear in deployment: authentication, observability, and persistent context.
Questions
Evaluating “harmful and unaware” behaviour
More than half of successful attacks in our ICCIT study produced harmful output without harm awareness. How should that failure mode be measured when agents retrieve, remember, and act?
Governance for memory in regulated deployments
What evaluation and control points are needed for long-term memory and tool-use in healthcare and finance, where a silent failure is worse than a refusal?
Interests
- Multi-agent orchestration, long-term memory, and tool-use safety
- Evaluation and governance of production LLM deployments
- Contextual deception, prompt injection, and jailbreaking as empirical phenomena
- AI safety in regulated settings such as healthcare and finance
Publications
Published2025
Code Poisoning Through Misleading Comments: Jailbreaking Large Language Models via Contextual Deception
Aftar Ahmad Sami, Gourob Debnath, Rajon Dey, Abdulla Nasir Chowdhury
2025 28th International Conference on Computer and Information Technology (ICCIT), IEEE · pp. 3812–3817
Contribution. Second author. Dataset curation and evaluation on a 200-prompt, 1,800-generation benchmark.
We show that deceptive comments in short code snippets can bypass alignment: attack success ranged from 63% to 93.5% across Gemini 2.0 Flash, DeepSeek-R1-Distill-LLaMA-70B, and LLaMA-3.3-70B-Versatile. More than half of successful outputs were harmful and unaware. The result argues for comment-level auditing whenever LLMs sit in code workflows.
Under review2026
Agentic Artificial Intelligence: A Survey of Architectures, Evolutionary Dynamics, and Governance
Co-authored with EARL collaborators (full list on the submitted manuscript)
Submitted to Information Processing & Management (Elsevier)
Contribution. Survey of agentic architectures, how those systems evolve in practice, and the governance questions that follow from deploying them.
A survey of agentic AI architectures, evolutionary dynamics, and governance. Listed as under review; not yet published.
Dataset
Published2025
LLM Comment Vulnerability Dataset
200 adversarial prompts across seven harm categories, each expressed as short Python snippets with deceptive comments. Supports the ICCIT 2025 paper. Includes narrative frames such as research simulation and penetration-testing, plus model responses used in the evaluation.
Published on Zenodo for the research community
Graduate Researcher
EARL Research Network
Lab site · earl-research.orgMember of a multi-lab collaborative research network. Co-authored the ICCIT 2025 paper and the Zenodo dataset with network researchers now at the University of Tsukuba, the University of Houston, and other institutions.
Contribution. Dataset curation and experimental evaluation of comment-based contextual deception.
Software Engineer
SJ Innovation LLC · 2024 – Present
Production multi-agent systems, including a healthcare assistant with memory and MCP tools, are the empirical setting for questions on tool-use safety, memory leakage, and governance under real constraints.
Production case studies →Education and service
B.Sc. in Computer Science & Engineering
Metropolitan University, Sylhet · CGPA 3.54 / 4.00
Service
- Invited reviewer, Information Processing & Management (Elsevier), 2 reviews ORCID
- Judge and problem setter, MU Intra Programming Contest
- Participant, ICPC Dhaka Preliminary (multiple years)
- 750+ problems solved across competitive programming judges