Marcelo Moreno · Cybersecurity

01read the instruction02find candidate places03compare routes with an LLM04commit to the best one

[01]ToT-Nav · Robot Navigation with a Tree of Thoughts

In submission

PurSec Lab · since 2024

Turning a plain-language instruction into a robot route, with a language model comparing possible routes side by side.

Imagine telling a robot to go past the red car, turn left, and stop at the blue building. ToT-Nav turns that sentence into a route without any navigation training data, because a language model reads the instruction, a vision model finds the places it mentions on a map, and a Tree-of-Thoughts search compares possible routes side by side until only the one that really follows what you said is left. I built the system end to end and evaluated it in indoor homes and on outdoor streets against LM-Nav, the system it extends.

GPT-4o · CLIP ViT-L/14 · Tree-of-Thoughts beam search · Matterport3D R2R · Python

where untrusted input reaches a decisionthe route that was asked for

[02]ToT-Nav Security · Attacking the Navigator

Ongoing

PurSec Lab · since 2026

Looking at the navigator I built through an attacker's eyes, to find where untrusted input can steer it.

Once ToT-Nav worked, the natural next question was how someone could break it. So I'm now looking at the system through an attacker's eyes, mapping every point where untrusted input reaches a decision, from the instruction a user types to the images stored in the map, and designing attacks that could send the robot somewhere it was never told to go. It's still early work, and the goal is to understand these risks well enough to defend against them.

threat modeling · adversarial ML · prompt injection · vision-language models

the change being testedthe car driven by the modelthe loop that decides what to try next

[03]Red-Teaming Vision-Language Driving Models

Ongoing

PurSec Lab · since 2026

A framework that searches for the everyday street situations where AI driving models fail.

Self-driving cars are starting to be driven by vision-language models, so I built a framework that searches for the everyday situations where they fail. Instead of invisible pixel noise it changes things that really happen on a street, like a pedestrian in a hi-vis vest or someone in a bear costume, then lets the model drive through the scene in simulation, judges whether it acted unsafely, and compares every run against the same scene without the change, so a failure only counts when the change caused it. The framework is built, and finding those failure cases is what I'm working on now.

NVIDIA AlpaSim · Alpamayo · 3D Gaussian splatting · Gemini · Python

the attacker's dataanother tenant's data

[04]Timing Side Channels in Vector Databases

Exploratory study

PurSec Lab · Aug – Dec 2025

Whether timing alone can leak what other customers store in a shared vector database.

Many AI apps keep their knowledge in vector databases, and to save money several customers often share the same index behind the scenes. Building on a classic attack against shared search engines, I studied whether timing alone could leak what other customers store, because an attacker can time their own writes, and those writes may slow down when someone else's data sits nearby in the index. I compared how Qdrant, Milvus and Chroma keep tenants apart and built a harness in Qdrant to measure those delays.

Qdrant · HNSW · sentence embeddings · side-channel analysis · Python