Andrew Ilyas

—

Unclaimed · AI-structured profilename-matched identity

LLM trustworthiness researcher spanning CoT-monitorability attacks, backdoor poison selection, and data attribution

papers here

reviewed by Evolve

first-author

corresponding

—

works · OpenAlex

—

h-index · OpenAlex

Bibliometric figures come from OpenAlex (2026-10-15) and cover the author's entire public record, not just the papers listed here. Reproducibility signal comes from Evolve's own reviews.

Research profile

Output—

No publication-volume data is available for this profile, so the output axis is unscored. It would measure the count and cadence of papers over time — preprints, peer-reviewed articles, and venue spread — once a fuller bibliographic record is linked.

Impact—

Impact data — citations, h-index, or per-paper influence — is not yet available, so this axis is unscored. It would measure how often the three reviewed papers are cited and taken up by follow-up work across research communities.

Focus0/100

The field distribution is an exact three-way split — AI safety / LLM monitorability, adversarial ML / LLM security, and ML data attribution each at about 33% — which yields a focus score of 0. Rather than concentration, the profile signals deliberate breadth: attacks that evade monitoring, attacks that strengthen backdoors, and attribution methods that analyze training data, all inside the LLM trustworthiness space.

Collaboration48/100

The record shows 10 distinct coauthors across the three reviewed papers, with a rotating cast — Keertana Chidambaram, Vasilis Syrgkanis, Aashiq Muhamed, Mona T. Diab, Virginia Smith, Matthew Jagielski, and others — rather than one dominant partner; this yields a moderate collaboration score of 48. All three cataloged papers place Ilyas in middle or last authorship, with none flagged as corresponding.

Activity—

Recent-activity signals, such as publication recency and per-year cadence beyond the reviewed set, are insufficient in the provided snapshot, so the activity axis is unscored. It would measure publishing tempo and sustained engagement over recent years from a complete, dated bibliographic record.

Reproducibility55/100

Evolve's reproducibility scoring averages 55 across 3 reviewed papers, and each is individually tagged medium reproducibility readiness. The pattern is consistent: strong empirical evidence in principle — for example, backdoor attack success rates swinging from 3% to 80% — but headline claims that depend on reporting choices, such as inconsistently reported steering rates or unmatched budgets.

Research summary

Andrew Ilyas is a machine learning researcher whose reviewed work spans three tightly connected fronts of large language model trustworthiness: monitoring, attacking, and attributing model behavior. The Evolve catalog holds three 2026 arXiv papers, each in a different subfield — AI safety / LLM monitorability, adversarial machine learning / LLM security, and data attribution — split evenly at roughly one-third each, which is why the profile's focus score registers 0: breadth by design rather than drift. On the safety side, 'Corrupt Plans, Clean Traces' introduces a plan-injection attack that evades chain-of-thought monitoring, with strong evidence tempered by inconsistently reported steering rates. On the attack-optimization side, 'Pick Your Poison' shows that poison-set selection alone swings LLM backdoor attack success from 3% to 80%, and proposes SAILS, a learned set scorer whose +30pp headline relies on unequal budgets versus +21pp matched. On the attribution side, 'Data Attribution via Sketched Metadifferentiation' recasts budgeted attribution as influence-matrix sketching, with MAGE/SPELL beating baselines on two modest benchmarks. The collaboration record lists 10 distinct coauthors — including Keertana Chidambaram, Vasilis Syrgkanis, Virginia Smith, Mona T. Diab, and Matthew Jagielski — with middle or last authorship on all three papers and no corresponding-author flag. Reproducibility averages 55 across the three papers, each rated medium readiness.

Collaboration pattern

The record lists 10 distinct coauthors, giving a moderate collaboration score of 48, with a rotating rather than fixed core: Keertana Chidambaram, Vasilis Syrgkanis, Aashiq Muhamed, Mona T. Diab, Virginia Smith, Matthew Jagielski, Yuxi Chen, Hamza Golubovic, Han Tong, and Arian Maleki. Across the three cataloged papers Ilyas sits in middle or last authorship and none is flagged corresponding, suggesting a contributor role within larger groups rather than a single long-running pairing.

Research keywords

chain-of-thought monitoringplan injectionprompt injectionLLM backdoor attacksdata poisoningpoison set selectiondata attributioninfluence functionsmetagradientsdatamodelssketchinglow-rank matrix estimation

Highlights

Plan-injection attack evades chain-of-thought monitoring
A 2026 arXiv paper presents a 'corrupt plans, clean traces' attack that injects plans to evade chain-of-thought monitoring; Evolve judges the evidence strong but flags that headline steering rates are inconsistently reported. Reproducibility readiness: medium.
Poison-set selection swings LLM backdoor success from 3% to 80%
In a 2026 arXiv study, the choice of poison set moves LLM backdoor attack success rate across a 3-80% range; the proposed SAILS learned set scorer is convincing, though its +30pp headline uses unequal budgets versus +21pp matched. Reproducibility readiness: medium.
Budgeted data attribution cast as influence-matrix sketching
The 2026 arXiv paper 'Data Attribution via Sketched Metadifferentiation' frames budgeted attribution as influence-matrix sketching; the resulting MAGE/SPELL methods beat baselines on two modest benchmarks, though core assumptions and scale remain unverified. Reproducibility readiness: medium.

Timeline

2026Co-authored 'Corrupt Plans, Clean Traces,' a plan-injection attack that evades chain-of-thought monitoring (middle authorship, arXiv).
2026Co-authored 'Data Attribution via Sketched Metadifferentiation,' casting budgeted attribution as influence-matrix sketching (last authorship, arXiv).
2026Co-authored 'Pick Your Poison,' showing poison-set choice swings LLM backdoor success from 3% to 80% (middle authorship, arXiv).

Papers in the Evolve catalog

Frequent co-authors

Keertana Chidambaram×1 Vasilis Syrgkanis×1 Aashiq Muhamed×1 Mona T. Diab×1 Virginia Smith×1 Matthew Jagielski×1 Yuxi Chen×1 Hamza Golubovic×1 Han Tong×1 Arian Maleki×1

About this profile

This profile is AI-structured by Evolve.Pub from public bibliographic data (OpenAlex) and Evolve's own paper reviews. It is not written or endorsed by the researcher unless the profile is claimed. Radar dimensions are computed from real bibliometrics with fixed formulas — raw figures are shown alongside; missing dimensions mean insufficient data, never zero. Errors? Claim the profile to correct or hide it.

Bibliometric scores are computed from OpenAlex-derived data only; no institution, country, or ORCID metadata was available, so this profile is name-resolved from public bibliographic records.
The output, impact, and activity axes are unscored because citation counts, publication volumes, and dated per-year records were absent from the provided snapshot.
The evidence base is the three 2026 arXiv papers reviewed by Evolve; venue acceptance, peer-review status, and earlier work are outside this profile's scope.
'Andrew Ilyas' is not a unique identifier — records from different people sharing the name could be merged; disambiguation here relies on coauthor overlap and field match.