Ari Azarafrooz

Ari Azarafrooz founded Intrinsec AI, where he uses an inference engine’s key-value cache to spot unusual behavior before an AI agent calls a tool. The cache holds calculations the model would otherwise have to repeat as it generates a response. By comparing those calculations with patterns from ordinary traffic, Ari gives operators a way to flag a suspicious request even when they cannot read the prompt.

Recognizing related files and imitation login pages

At Stevens Institute of Technology, Ari studied how wireless users could share crowded radio spectrum. He and Rajarathnam Chandramouli modeled channel selection as a game and showed that even a small signal about congestion could help users settle on a channel allocation faster.

In 2018, Ari and John Brock applied game theory to a problem in malware analysis. Two executable files can be related even after someone inserts or deletes bytes. Ari and John trained two networks that alternated roles in a competitive game to learn which differences mattered. In their tests, the resulting file fingerprints recognized related executables more accurately than conventional fuzzy hashes. By 2019, the two were collaborating at Cylance, where they also studied exploration in reinforcement learning.

At Netskope, Ari worked as a senior staff machine learning scientist. He and Yihua Liao described a phishing detector their team built with contributions from Najmeh Miramirkhani. A fake login page can look like the real one even when its HTML differs. The team trained an encoder to produce an image from HTML, teaching it which features of the code shaped the page’s appearance. Once trained, the classifier needed only the HTML and URL. In 2022, it scanned pages in live traffic in under ten milliseconds on average.

In 2024, Ari and Farshid Faal developed LANA to train language models without a dataset of human-ranked answers. Their method used an opponent that improved during training to supply feedback, allowing the model to keep learning even when individual judgments were noisy.

Which parts of an agent’s history matter?

Ari created CSTM-Bench to test whether a security monitor could recognize a policy violation spread across conversations. He included legitimate work that could also look suspicious, such as a series of approvals. A monitor had to connect the relevant requests early enough to flag an attack while allowing those ordinary sequences to proceed.

In Ari’s 2026 experiments with Claude, both versions of the benchmark fit within the model’s context window. What changed was the wording of individual requests, which made the attacks harder to recognize in isolation. With room for 50 fragments, Ari’s reader detected 19 of the 26 attacks on the harder version, down from 25 on the original. The full-log judge detected 13 on the harder version, down from 23. Ari also measured whether the reader kept the selected fragments in the same order between requests. Changing their order can force an inference engine to repeat calculations for the beginning of a sequence it could otherwise reuse.

Finding an anomaly before a tool call

Ari chose a voice agent to test cache monitoring because incoming speech gave a text filter nothing to inspect. His team used ordinary voice clips to establish a baseline. When a clip contained a hidden spoken instruction, the detector pinpointed the cache page where the model’s calculations departed from that baseline.

Intrinsec’s Tessera and Plato use that signal at different points. Tessera examines stored cache pages through LMCache so operators can investigate unusual requests after the fact. Plato monitors the running inference engine and can pass an alert to the application’s policy check before the next tool call. Ari identifies two practical limits on that early warning. A model update can change what an ordinary cache page looks like, and moving a large page for analysis takes time while the agent is preparing to act.