Most people do not feel free to leave a police interrogation room, VCU research finds

The study, which used virtual reality headsets to let participants experience the scene, could have implications for custody determinations in criminal cases.

Virginia Commonwealth University

FacebookXLinkedInWeChatBlueskyMessageWhatsAppEmail

RICHMOND, Va. (Nov. 17, 2025) – Criminal suspects may feel unable to leave an interrogation room after only three minutes of questioning, according to new Virginia Commonwealth University research.

Hayley Cleary, Ph.D., a professor of criminal justice in VCU’s L. Douglas Wilder School of Government and Public Affairs, led the study, which used virtual reality to examine how people perceive police custody from “inside” the interrogation room. During an immersive, 30-minute simulated homicide interrogation, study participants wore a virtual reality headset to watch the session, experiencing the scene as if they were seated next to the suspect.

Whether or not a suspect is legally in custody can determine if their statements are admissible in court during criminal trials. Police must read suspects in custody their Miranda rights, including the right to remain silent, before questioning. Incriminating statements made by a suspect who is in custody, but has not been read their Miranda rights, typically cannot be used against them in court.

But it can be difficult to determine if a suspect is formally in custody, especially if they have not been formally arrested. Courts rely on whether a “reasonable person” in the suspect’s position would feel free to leave the interrogation room, but that standard is hard to define. Police and prosecutors may argue that leaving the door open, offering food or telling the suspect they are free to go are enough to make the suspect feel free to leave – a claim that research increasingly disputes.

“Sometimes suspects are questioned for long periods of time and eventually give an incriminating statement, or even a confession, without ever being read their Miranda rights,” Cleary said. “Police and prosecutors often argue – usually successfully – that they didn’t need to Mirandize the suspect because they weren’t in custody.”

But suspects rarely leave during those supposedly voluntary police interrogations, even when told that they are free to do so, most likely due to power disparities and fear of negative consequences.

To explore how suspects perceive police custody, Cleary and co-investigator Lucy Guarnera, Ph.D., an assistant professor and forensic psychologist at the University of Virginia School of Medicine, developed VISE – the Virtual Interrogation Subjective Experience project. They filmed a 30-minute simulated homicide interrogation using a 360-degree camera in a local police department interrogation room.

The study was supported by the VCU Presidential Research Quest Fund and featured VCU School of the Arts graduate Joel DeVaughn and Richmond-based actor Doug Blackburn. It enrolled 168 psychologically healthy participants aged 18 to 25, who perceived themselves to be seated directly next to the subject during the immersive virtual reality experience.

The video, based on a real police interrogation, contained three segments: a three-minute rapport-building section, a 16-minute stress-inducing “maximization” section and an 11-minute “minimization” section, in which the police officer used less aggressive tactics, including explanations and justifications, in an attempt to elicit a confession from the suspect.

The results were striking:

• Over half of the study participants believed that the suspect, whose custody status was not defined throughout the video, was not free to leave the interrogation room after just three minutes of questioning.
• By the end of the virtual interrogation, fewer than 20% of the participants thought that the suspect was allowed to leave the room.
• And by the end, over 90% believed that the suspect himself would not have felt free to leave.

That means that almost all participants thought that the suspect was in custody after only a short period of time, even though he had not been formally arrested, told that he could not leave the room or read his Miranda rights by the police officer.

“Our research shows that simply being in the interrogation room creates a feeling of a lack of perceived autonomy,” Cleary said, who also noted that most police interrogations are longer than the 30-minute video used in the study.

The effect was consistent across most demographic groups. Two groups of participants – those with educational difficulties, and Black participants who reported feeling vulnerable to racial stereotyping by police – were even more likely to perceive that the suspect was not free to leave.

“We found that, across all of these different demographic and background characteristics, our participants converged around the idea that the person that they were sitting next to in this interrogation room did not feel like they could get up and walk away,” Cleary said. “And this effect happened fast. That’s the message that we want legal decision-makers to understand.”

Viewing the video through a virtual reality headset allowed research participants to experience the interrogation far more vividly than by simply watching a video recording or reading a transcript. The findings highlight a gap between what suspects experience and how judges and juries later interpret those moments in court — a disconnect that psychologists call the actor-observer effect.

“The courts have to make really difficult decisions about what they believe a suspect was thinking or feeling during an interrogation,” Cleary said. “And research increasingly suggests that judges and juries systematically overestimate how free to leave a suspect actually felt at the time.”

The researchers were recently awarded $450,000 from the National Science Foundation to expand the project. Future studies will include different police interrogation techniques, biometric measurement of participants’ stress levels and comparisons between different interviewing approaches.

---

DOI

10.1037/lhb0000631 

Article Title

Almost no one feels free to leave an interrogation room: Findings from a virtual reality study of custody perceptions in police interrogations

Article Publication Date

30-Nov-2025

Better governance needed for palliative care

University of Gothenburg




Prof. Cecilia Larsdotter, Sophiamettet University, and Prof. Joakim Öhlén, University of Gothenburg.
Credit: Photo: Private, Malin Arnesson.

Researchers have studied developments since the introduction of ‘National knowledge support for good palliative care at the end of life’ in 2013. Their findings show that despite national palliative care policy, there are significant differences in terms of what type of healthcare service people utilise end-of-life care. This applies to both children and adults and depends not only on diseases or age, but also to a high degree on where they live.

“Our studies highlight very complex challenges,” says Cecilia Larsdotter, Professor in Health Care Sciences at Sophiahemmet University.

Most Swedish people wish to be cared for and die at home. The reality is different and only one in five people do so. Instead, hospitals and nursing homes are the dominant care places for the population to die in.

Unequal conditions across the country

“If the variations we have identified reflect different care preferences for people in different regions, then that’s not a problem,” says Professor of Nursing Joakim Öhlén from the University of Gothenburg’s Centre for Person-centred Care and Sahlgrenska University Hospital’s Palliative Centre. “But we have good reason to believe that it is more a matter of unequal conditions.”

The researchers emphasise that person-centred palliative care, especially for older people, needs to be be systematically implemented and integrated with both care for older people, primary care and hospital care.

Fortunately, the number of children and young people who die is only small. However, children have specific needs and challenges that requires competence in paediatric palliative care and access to resources.

“The organisation of palliative care for children needs to be developed further,” adds Stefan Nilsson, a professor of nursing at the University of Gothenburg and the Children’s Cancer Centre at Queen Silvia Children’s Hospital.

Enhanced monitoring and guidance

Research shows that the existing national policy are often vague and that regions and municipalities may choose to opt out of them. As a result, the prioritisation of palliative care – which, according to the Swedish Health and Medical Services Act, should be the highest priority – is not always implemented in practice.

The research team is now proposing a series of reforms. For example, they want palliative care to be recognised as a public health concern at national level, in line with the WHO recommendations, and for follow-up and guidance for municipalities and regions to be reinforced.

“It’s important – and clear – that palliative care should be prioritised,” Stina Nyblom concludes, associate professor at the University of Gothenburg, and consultant in palliative medicine at Sahlgrenska University Hospital’s Palliative Centre. “But the problem is how to achieve this. It needs to be concretised, both in terms of early integrated and end-of-life palliative care.”

To the report (in Swedish): Förutsättningar för jämlik personcentrerad palliativ vård, https://hdl.handle.net/2077/90107

Article Title

Förutsättningar för jämlik personcentrerad palliativ vård (“Prerequisites for equal person-centred palliative care”)

Article Publication Date

14-Nov-2025

 

Duke-NUS study: Over 90% of older adults with dementia undergo burdensome interventions in their final year

In their final year of life, older adults with advanced dementia undergo frequent hospitalisations and invasive interventions such as tube feeding and physical restraints

Duke-NUS Medical School

FacebookXLinkedInWeChatBlueskyMessageWhatsAppEmail

Singapore, 17 November 2025—A new study by researchers from Duke-NUS Medical School has revealed that almost all community-dwelling older adults with advanced dementia in Singapore experience at least one potentially burdensome intervention in their last year of life. The findings highlight an urgent need for new strategies to support families and reduce unnecessary interventions at the end of life.

Although the number of individuals living with dementia in the Asia-Pacific region is projected to rise to 71 million by 2050[1], current understanding of the last year of life with dementia is mostly informed by studies conducted in western contexts.

Published in the Journal of Gerontology: Medical Sciences, the study, examining individuals with dementia’s care experience in their last year of life in Singapore, found that 92 per cent of older adults with advanced dementia experienced burdensome interventions such as feeding tubes or restraints—approaches that experts say may not improve comfort or survival.

From surveys, the researchers found that the below key issues affected the quality of end-of-life care experienced by older adults with dementia living at home:

1. Overreliance on burdensome medical interventions: Nearly all older adults experienced taxing interventions in their final year of life, including antibiotics (49 per cent), IV fluids (22 per cent), and feeding tubes, restraints or both (74 per cent). The proportion of tube-fed older adults was significantly higher than in western contexts, and tube feeding often triggers the use of physical restraints to prevent tube removal. Clinical guidelines recommend careful hand feeding instead of tube feeding.
2. High hospitalisation rate: Almost half (48 per cent) of older adults were hospitalised for at least a night in their final year, and 35 per cent died in hospital—proportions notably higher than in western studies where long-term care facilities such as nursing homes are the primary place of death. Such increased hospitalisation can expose patients to taxing and costly care experiences with limited clinical benefit.
3. Heavy burden on informal caregivers: Family members bore the brunt of care, with 42 per cent providing at least 60 per cent of total care for their loved ones with dementia, and 30 per cent quitting their jobs to do so. Caregivers provided an average of 42 hours of care per week—more than a full-time job--equivalent to an annual wage of S$32,125.
4. Insufficient caregiving support: A majority of caregivers (62 per cent) reported receiving inadequate information when making care or treatment decisions, and only 15 per cent were told how much longer their loved ones might live. The findings highlight critical gaps in caregiver communication and end-of-life preparedness.

The data was culled from a longitudinal cohort, titled Panel study Investigating Status of Cognitively impaired Elderly in Singapore (PISCES), in which the researchers surveyed family caregivers of individuals with advanced dementia every four months, between 2018 and 2023.

Caregivers also generally agreed (98 per cent) comfort was a primary care goal, however, close to a third (31 per cent) of caregivers—mostly children of the older adults—considered prolonging life a priority.

Dr Ellie Bostwick Andres, first author of the paper and a senior research fellow from the Lien Centre for Palliative Care at Duke-NUS, said:

“Our study highlights a mismatch between caregivers’ stated values and the reality of older adults’ experience in their last year of life. Frequent hospitalisations and the widespread use of interventions generally deemed ‘low-value’ among older adults living at home highlights the need to adopt a palliative approach at home to alleviate symptoms and minimise burden on older adults and their caregivers.”

Dr Andres also said that as reliance on family caregivers increases in an ageing society like Singapore, more needs to be done to support and equip family caregivers to provide compassionate care for their loved ones at home.

Senior author Associate Professor Chetna Malhotra and Research Director at the Duke-NUS’ Lien Centre for Palliative Care, added:

“In Asia, cultural values shape approaches towards caring for end-of-life individuals with dementia living at home. For instance, children with strong filial values may be more inclined to try to help their parents live longer instead of opting for a palliative approach. This means that strategies to promote palliative care need to be driven by caregiver education and tailored to the region.”

Insights from the team’s study are now being used to curate tools that support caregivers—including CareBuddy, a mobile application that promotes healthy and graceful ageing, and decision aids that help them make informed care decisions for their loved ones.

Professor Patrick Tan, Duke-NUS’ Dean-designate and Senior Vice-Dean for Research, said:

“These findings reveal the human reality of dementia care in Asia—one defined by love, sacrifice, and difficult choices. As more older adults spend their final days at home, it’s critical that we build systems of care that show compassion not only to patients, but also their caregivers who sustain them.”

This research, which was supported by the Singapore Ministry of Health through the National Medical Research Council (NMRC) Office, MOH Holdings Pte Ltd, under the NMRC Health Services Research Grant (NMRC/HSRG/0081/2017) and COVID19TUG21 (MOH-000786), is part of Duke-NUS’ ongoing efforts to improve care for individuals with serious illnesses and their caregivers through groundbreaking discoveries and education. 

 

About Duke-NUS Medical School

Duke-NUS is Singapore’s flagship graduate entry medical school, established in 2005 with a strategic, government-led partnership between two world-class institutions: Duke University School of Medicine and the National University of Singapore (NUS). Through an innovative curriculum, students at Duke-NUS are nurtured to become multi-faceted ‘Clinicians Plus’ poised to steer the healthcare and biomedical ecosystem in Singapore and beyond. A leader in ground-breaking research and translational innovation, Duke-NUS has gained international renown through its five Signature Research Programmes and ten Centres. The enduring impact of its discoveries is amplified by its successful Academic Medicine partnership with Singapore Health Services (SingHealth), Singapore’s largest healthcare group. This strategic alliance has led to the creation of 15 Academic Clinical Programmes, which harness multi-disciplinary research and education to transform medicine and improve lives.   

For more information, please visit www.duke-nus.edu.sg 

 

About the National Medical Research Council (NMRC)
The NMRC was established in 1994 to oversee research funding from the Ministry of Health (MOH) and support the development and advancement of biomedical research in Singapore, particularly in the public healthcare clusters and medical schools. NMRC engages in research strategy and planning, provides funding to support competitive research grants and core research enablers, and is responsible for the development of clinician scientists through awards and fellowships. The council’s work is supported by the NMRC Office which is part of MOH Holdings Pte Ltd. Through its management of the various funding initiatives, NMRC promotes healthcare research in Singapore, for better health and economic outcomes.

---

[1] Alzheimer's Disease International DA. Dementia in the Asia Pacific Region. 2014. https://www.alzint.org/resource/dementia-in-the-asia-pacific-region/

---

Journal

The Journals of Gerontology Series A

DOI

10.1093/gerona/glaf227 

Method of Research

Survey

Subject of Research

People

Article Title

The final year for community-dwelling older adults with dementia in an Asian setting: admissions, interventions and caregiver burden

Article Publication Date

17-Nov-2025

 

How AI can rig polls

Study shows how AI can mimic humans and complete surveys.

Dartmouth College

FacebookXLinkedInWeChatBlueskyMessageWhatsAppEmail

Public opinion polls and other surveys rely on data to understand human behavior.

New research from Dartmouth reveals that artificial intelligence can now corrupt public opinion surveys at scale—passing every quality check, mimicking real humans, and manipulating results without leaving a trace.

The findings, published in the Proceedings of the National Academy of Sciences, show just how vulnerable polling has become. In the seven major national polls before the 2024 election, adding as few as 10 to 52 fake AI responses—at five cents each—would have flipped the predicted outcome. 

Foreign adversaries could easily exploit this weakness: the bots work even when programmed in Russian, Mandarin, or Korean, yet produce flawless English answers.

"We can no longer trust that survey responses are coming from real people," says study author Sean Westwood, associate professor of government at Dartmouth and director of the Polarization Research Lab, who conducted the research.

To examine the vulnerability of online surveys to large language models, Westwood created a simple AI tool ("an autonomous synthetic respondent") that operates from a 500-word prompt. In 43,000 tests, the AI tool passed 99.8% of attention checks designed to detect automated responses, made zero errors on logic puzzles, and successfully concealed its nonhuman nature. The tool tailored responses according to randomly assigned demographics, such as providing simpler answers when assigned less education.

"These aren't crude bots," said Westwood. "They think through each question and act like real, careful people making the data look completely legitimate."

When programmed to favor either Democrats or Republicans, presidential approval ratings swung from 34% to either 98% or 0%. Generic ballot support went from 38% Republican to either 97% or 1%.

The implications reach far beyond election polling. Surveys are fundamental to scientific research across disciplines—in psychology to understand mental health, economics to track consumer spending, and public health to identify disease risk factors. Thousands of peer-reviewed studies published each year rely on survey data to inform research and shape policy.

"With survey data tainted by bots, AI can poison the entire knowledge ecosystem," said Westwood.

The financial incentives to use AI to complete surveys are stark. Human respondents typically earn $1.50 for completing a survey, while AI bots can complete the same task for free or approximately five cents. The problem is already materializing, as a 2024 study found that 34% of respondents had used AI to answer an open-ended survey question.

Westwood tested every AI detection method currently in use and all failed to identify the AI tool. His study argues for transparency from companies that conduct surveys, requiring them to prove their participants are real people.

"We need new approaches to measuring public opinion that are designed for an AI world," says Westwood. "The technology exists to verify real human participation; we just need the will to implement it. If we act now, we can preserve both the integrity of polling and the democratic accountability it provides."

Westwood is available for comment at: Sean.J.Westwood@dartmouth.edu.

###

---

Journal

Proceedings of the National Academy of Sciences

DOI

10.1073/pnas.2518075122 

Subject of Research

Not applicable

Article Title

The Potential Existential Threat of Large Language Models to Online Survey Research

 

New study reveals high rates of fabricated and inaccurate citations in LLM-generated mental health research

JMIR Publications

FacebookXLinkedInWeChatBlueskyMessageWhatsAppEmail

 

image: 

New Study Reveals High Rates of Fabricated and Inaccurate Citations in LLM-Generated Mental Health Research

view more 

Credit: JMIR Publications

(Toronto, November 17, 2025) A new study published in the peer-reviewed journal JMIR Mental Health by JMIR Publications highlights a critical risk in the growing use of Large Language Models (LLMs) like GPT-4o by researchers: the frequent fabrication and inaccuracy of bibliographic citations. The findings underscore an urgent need for rigorous human verification and institutional safeguards to protect research integrity, particularly in specialized and less publicly known fields within mental health.

Nearly 1 in 5 Citations Fabricated by GPT-4o in Literature Reviews

The article, titled "Influence of Topic Familiarity and Prompt Specificity on Citation Fabrication in Mental Health Research Using Large Language Models: Experimental Study," found that 19.9% of all citations generated by GPT-4o across six simulated literature reviews were entirely fabricated, meaning they could not be traced to any real publication. Furthermore, among the seemingly real citations, 45.4% contained bibliographic errors, most commonly incorrect or invalid Digital Object Identifiers (DOIs).

This timely research is highly relevant as academic journals have encountered instances of seemingly AI-hallucinated references in recent submissions. These bibliographic hallucinations and errors are not just formatting issues; they break the chain of verifiability, mislead readers, and fundamentally compromise the integrity and trustworthiness of scientific results and the cumulative knowledge base. This makes the need for careful scrutiny and verification paramount to safeguard academic rigor.

Reliability Varies by Topic Familiarity and Specificity

The research, conducted by a team including Jake Linardon, PhD, from Deakin University and his colleagues, systematically tested the reliability of GPT-4o's output across mental health topics with varying levels of public awareness and scientific maturity: major depressive disorder (high familiarity), binge eating disorder (moderate), and body dysmorphic disorder (low). They also tested general versus specialized review prompts (e.g., focusing on digital interventions).

• Fabrication Risk is Highest for Less Familiar Topics: Fabrication rates were significantly higher for topics with lower public familiarity and research coverage, such as binge eating disorder (28%) and body dysmorphic disorder (29%), compared to major depressive disorder (6%).

• Specialized Topics Pose a Higher Risk: While not universally true, stratified analysis showed that fabrication rates were significantly higher for specialized reviews (e.g., evidence for digital interventions) compared to general overviews for certain disorders, such as binge eating disorder.

• Overall Inaccuracy is Pervasive: In total, nearly two-thirds of all citations generated by GPT-4o were either fabricated or contained errors, indicating a major reliability issue.

Urgent Call for Human Oversight and New Safeguards

The study’s conclusions issue a strong warning to the academic community: Citation fabrication and errors remain common in GPT-4o outputs. The authors stress that the reliability of LLM-generated citations is not fixed but is contingent on the topic and the way the prompt is designed.

Key Implications Highlighted in the Study:

• Rigorous Verification is Mandatory: Researchers and students must subject all LLM-generated references to careful human verification to validate their accuracy and authenticity.

• Journal and Institutional Role: Journal editors and publishers must implement stronger safeguards, potentially using detection software that flags citations that do not match existing sources, signaling a potential hallucination.

• Policy and Training: Academic institutions must develop clear policies and training to equip users with the skills to critically assess LLM outputs and to design strategic prompts, especially when exploring less visible or highly specialized research topics.

 

Original article:

Linardon J, Jarman H, McClure Z, Anderson C, Liu C, Messer M. Influence of Topic Familiarity and Prompt Specificity on Citation Fabrication in Mental Health Research Using Large Language Models: Experimental Study. JMIR Ment Health 2025;12:e80371

URL: https://mental.jmir.org/2025/1/e80371

DOI: 10.2196/80371

 

About JMIR Publications

JMIR Publications is a leading open access publisher of digital health research and a champion of open science. With a focus on author advocacy and research amplification, JMIR Publications partners with researchers to advance their careers and maximize the impact of their work. As a technology organization with publishing at its core, we provide innovative tools and resources that go beyond traditional publishing, supporting researchers at every step of the dissemination process. Our portfolio features a range of peer-reviewed journals, including the renowned Journal of Medical Internet Research.

To learn more about JMIR Publications, please visit jmirpublications.com or connect with us via X, LinkedIn, YouTube, Facebook, and Instagram.

Head office: 130 Queens Quay East, Unit 1100, Toronto, ON, M5A 0P6 Canada

Media Contact:

Dennis O’Brien, Vice President, Communications & Partnerships

JMIR Publications

communications@jmir.org

The content of this communication is licensed under the terms of the Creative Commons Attribution License (https://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work, published by JMIR Publications, is properly cited.

---

Journal

JMIR Mental Health

DOI

10.2196/80371 

Method of Research

Literature review

Subject of Research

Not applicable

Article Title

Influence of Topic Familiarity and Prompt Specificity on Citation Fabrication in Mental Health Research Using Large Language Models: Experimental Study

Article Publication Date

12-Nov-2025

Researchers unveil first-ever defense against cryptanalytic attacks on AI

North Carolina State University

FacebookXLinkedInWeChatBlueskyMessageWhatsAppEmail

Security researchers have developed the first functional defense mechanism capable of protecting against “cryptanalytic” attacks used to “steal” the model parameters that define how an AI system works.

“AI systems are valuable intellectual property, and cryptanalytic parameter extraction attacks are the most efficient, effective, and accurate way to ‘steal’ that intellectual property,” says Ashley Kurian, first author of a paper on the work and a Ph.D. student at North Carolina State University. “Until now, there has been no way to defend against those attacks. Our technique effectively protects against these attacks.”

“Cryptanalytic attacks are already happening, and they’re becoming more frequent and more efficient,” says Aydin Aysu, corresponding author of the paper and an associate professor of electrical and computer engineering at NC State. “We need to implement defense mechanisms now, because implementing them after an AI model’s parameters have been extracted is too late.”

At issue are cryptanalytic parameter extraction attacks. Parameters are the essential information used to describe an AI model. Essentially, parameters are how AI systems perform tasks. Cryptanalytic parameter extraction attacks are a purely mathematical way of determining what a given AI model’s parameters are, allowing a third party to recreate the AI system.

“In a cryptanalytic attack, someone submits inputs and looks at outputs,” Aysu says. “They then use a mathematical function to determine what the parameters are. So far, these attacks have only worked against a type of AI model called a neural network. However, many – if not most – commercial AI systems are neural networks, including large language models such as ChatGPT.”

So, how do you defend against a mathematical attack?

The new defense mechanism relies on a key insight the researchers had regarding cryptanalytic parameter extraction attacks. While analyzing these attacks, the researchers identified a core principle that every attack relied on. To understand what they learned, you have to understand the basic architecture of a neural network.

The fundamental building block of a neural network model is called a “neuron.” Neurons are arranged in layers and are used in sequence to assess and respond to input data. Once the data has been processed by the neurons in the first layer, the outputs of that layer are passed to a second layer. This process continues until the data has been processed by the entire system, at which point the system determines how to respond to the input data.

“What we observed is that cryptanalytic attacks focus on differences between neurons,” says Kurian. “And the more different the neurons are, the more effective the attack is. Our defense mechanism relies on training a neural network model in a way that makes neurons in the same layer of the model similar to each other. You can do this only in the first layer, or on multiple layers. And you could do it with all of the neurons in a layer, or only on a subset of neurons.”

“This approach creates a ‘barrier of similarity’ that makes it difficult for attacks to proceed,” says Aysu. “The attack essentially doesn’t have a path forward. However, the model still functions normally in terms of its ability to perform its assigned tasks.”

In proof-of-concept testing, the researchers found that AI models which incorporated the defense mechanism had an accuracy change of less than 1%.

“Sometimes a model that was retrained to incorporate the defense mechanism was slightly more accurate, sometimes slightly less accurate – but the overall change was minimal,” Kurian says.

“We also tested how well the defense mechanism worked,” says Kurian. “We focused on models that had their parameters extracted in less than four hours using cryptanalytic techniques. After retraining to incorporate the defense mechanism, we were unable to extract the parameters with cryptanalytic attacks that lasted for days.”

As part of this work, the researchers also developed a theoretical framework that can be used to quantify the success probability of cryptanalytic attacks.

“This framework is useful, because it allows us to estimate how robust a given AI model is against these attacks without running such attacks for days,” says Aysu. “There is value in knowing how secure your system is – or isn’t.”

“We know this mechanism works, and we’re optimistic that people will use it to protect AI systems from these attacks,” says Kurian. “And we are open to working with industry partners who are interested in implementing the mechanism.”

“We also know that people trying to circumvent security measures will eventually find a way around them – hacking and security are engaged in a constant back and forth,” says Aysu. We’re hopeful that there will be sources of funding moving forward that allow those of us working on new security efforts to keep pace.”

The paper, “Train to Defend: First Defense Against Cryptanalytic Neural Network Parameter Extraction Attacks,” will be presented at the Thirty-Ninth Annual Conference on Neural Information Processing Systems (NeurIPS) being held Dec. 2-7 in San Diego, California.

This work was done with support from the National Science Foundation under grant 1943245.

---

Method of Research

Experimental study

Subject of Research

Not applicable

Article Title

Train to Defend: First Defense Against Cryptanalytic Neural Network Parameter Extraction Attacks

Article Publication Date

2-Dec-2025

COI Statement