Daniel Poncelas

Machine learning engineer | AI security

Daniel Poncelas Vargas

I build machine learning systems and I measure how they fail. My thesis puts eight prompt injection defenses through roughly 40,000 agent runs on eight models, and I run two products of my own on the side.

Everything on this page links to something you can open.

danielponcelasvar@gmail.com LinkedIn Download CV

Heatmap of attack success rate for every defense and model pair on AgentDojo
Fig. 01 Attack success rate for every defense and model pair on AgentDojo. Lighter is safer.
Based in
Valencia, Spain
Eligibility
Spanish citizen, EU work permit. Open to relocation and to visa sponsorship.
Available
Immediately, no date I need to protect
Languages
Spanish and Catalan native, English C1 (Cambridge)

Master’s thesis

A Systematic Evaluation of Prompt Injection Defenses in LLM Agents, with a Mechanistic Analysis of Failure Modes

Defending September 2026 | MSc in Artificial Intelligence, Pattern Recognition and Digital Imaging, UPV

An LLM agent that reads external content can be hijacked by instructions hidden inside that content. OWASP ranks prompt injection the top security risk for LLM applications. The literature proposes defenses faster than it compares them, and every paper reports under its own conditions, so none of the numbers can be read side by side.

So I built one harness and ran all of them under identical conditions: same benchmarks, same models, same metrics, same statistical treatment. Then I opened up the model to ask why the defenses that fail, fail.

Scale of the study

8
defenses evaluated
8
models, 3B to 70B
~40,000
agent runs
2
benchmarks
Defending Sep 2026

  1. Result 1

    Size does not buy robustness

    Within both Llama and Qwen, attack success rate climbs at every step up in parameters: Llama goes from 0.02 at 3B to 0.36 at 70B. The small models are not safe, they are incapable, and their utility scores say so. Across families it is not a clean law, because Qwen 7B is more capable than GPT 4.1 nano and still harder to hijack, so provider and training weigh as much as size.

  2. Result 2

    H1 refuted: training is not the answer

    I expected the fine tuned defense to win. It does not. SecAlign is Pareto dominated by plain prompting defenses: at 8B, prompting reaches the same attack success rate while keeping more utility.

  3. Result 3

    A distributed circuit, not a handful of heads

    Activation patching and logit lens on Llama 3.2 3B, over 28 layers by 24 heads and 119 hijack cases, found no small set of culprit attention heads. Reported as the negative result it is.

Defenses
Spotlighting, SecAlign, PromptGuard, paraphrasing, sandwich, reminder and baseline. StruQ was evaluated and dropped as technically unworkable.
Models
GPT 4.1, Claude 4.x, Gemini 2.5, Llama 3.2 3B, Llama 3.1 8B, Llama 3.3 70B, Qwen 2.5 7B and 32B.
Benchmarks
AgentDojo 0.1.35 and InjecAgent, with utility, robustness and refusal metrics, cross validated and tested for significance.
Infrastructure
vLLM serving the open models with tool calling on a SLURM cluster. AgentDojo’s harness extended to take arbitrary model backends.
Line chart of attack success rate against model size for Llama and Qwen
Fig. 02 Within both Llama and Qwen, attack success rate rises with parameter count.
Scatter plot of utility against attack success rate at 8B for prompting and for SecAlign
Fig. 03 Utility against attack success rate at 8B. Prompting matches the fine tuned defense at higher utility, which refutes H1.
Logit lens curve showing the attacker token margin by layer in Llama 3.2 3B
Fig. 04 Logit lens on Llama 3.2 3B. The attacker token margin crosses zero around layer 15, so the model commits late.

Products I built and run

Two things I shipped alone, and the numbers they actually make

Registered as self employed in Spain, invoicing since 2025

GenTotalAI

Started March 2026

Live now

AI video generation for Spanish speaking creators and small businesses: talking avatars, product spots, short form ads. Credits and subscriptions, sold entirely through paid social.

gentotal.ai Open it and check for yourself

Measured 4 August 2026

5,247 €
MRR+16.4% MoM
190
active subscribers
14,158
generation jobs processed
~24,000 €
billed to datein 5 months
78.09 €
lifetime value
27.6%
monthly churn
What I own
Product, pricing, acquisition and the economics. I designed and operate the system, and I read the cohort, churn and LTV numbers that decide what gets built next. Registered as self employed and invoicing.
Generation pipeline
Multi provider and multi modal: text to JSON, text to image, image to image, image to video, multi image to video and video to video with identity and voice replacement. Routed across GPT 4.1 nano, Grok, Gemini, Flux, Kling v2.6 and ElevenLabs.
Platform
Next.js and Express, PostgreSQL on Supabase, Supabase Auth, Redis and BullMQ for async jobs, Socket.io for live progress, Stripe, Cloudflare R2, Nginx and PM2, GitHub Actions deploying over SSH to a DigitalOcean VPS. Instrumented with PostHog.
Honest caveat
The margin is thin and some months close negative, because ad spend is the growth lever. I am holding growth flat until the unit economics improve rather than buying revenue.

StudyOS

Launched June 2025, peaked October 2025

On the App Store

An LLM study assistant for iOS. Course notes go in, study sessions, quizzes and flashcards come out. Built and shipped alone, from the Swift app to the App Store listing.

apps.apple.com Open it and check for yourself

Figures at peak, reported by me

~77,000
new users in the first year
~300
subscribers at peak
~42,000 $
ARR at peak
~24,000 $
billed in the first yearover 12 months
Stack
Swift, Firebase, Supabase and LLM APIs. Around 25 € per month of infrastructure against subscription revenue.
Where it stands
Still downloadable and still earning, kept at low intensity. Distribution turned out to be the bottleneck, not the product, and that lesson is what GenTotalAI was built on.

Experience

Computer Vision & AI Research Engineer

Evestel Iberia | computer vision for retail analytics and driver monitoring

  • Sep 2023 → Jan 2024 Internship, part time
  • May 2024 → Aug 2024 Internship
  • Mar 2025 → Oct 2025 Full time contract
In production

Computer vision startup working on person tracking for retail and public spaces, and on driver monitoring systems for somnolence and alcohol, which are becoming mandatory in public transport. Small team, reporting to the CTO.

  • Owned person detection, tracking and re identification end to end, from the first detection through to identity matching across cameras.
  • Evaluated candidate architectures and proposed the migration from YOLOv5 to YOLOv11 with embedding based re identification, then carried it out.
  • Exported and optimised models with ONNX and TensorRT for deployment.
  • Ran accelerated inference on NVIDIA CUDA and on AMD ROCm, where YOLO support was thin enough to make it the hard part of the job.
  • Built datasets of 10,000 to 15,000 images in Roboflow with automation scripts, and ran error analysis on false positives and false negatives.
  • Models I trained and tuned reached production and are still running there.

Background

Five cities, one subject

Valencia, Munich, Stockholm, Dublin, Zürich

  1. Sep 2025 → Sep 2026 MSc in Artificial Intelligence, Pattern Recognition and Digital Imaging Universitat Politècnica de València 8.7 / 10, two distinctions
  2. Sep 2021 → Jul 2025 BSc in Computer Engineering, Artificial Intelligence specialisation Universitat Politècnica de València, 240 ECTS 9.1 / 10, top 1% of the cohort, ten distinctions
  3. Jan → Dec 2025 Honours Degree in Technology Management CDTM, a joint centre of TU Munich and LMU Munich Around 15 admitted per cohort. R&D project with Rover on worker safety on construction sites.
  4. Aug 2024 → Jan 2025 Master’s courses in AI: machine learning, deep learning, computer vision, applied GPU programming KTH Royal Institute of Technology, Stockholm, 30 ECTS 8.6 / 10
  5. Jan → Jun 2024 Erasmus exchange, minor in Artificial Intelligence Trinity College Dublin, 30 ECTS 9.5 / 10
  6. Jun 2025 Summer school in AI and machine learning ETH Zürich One week. Admitted on CV and motivation letter. Fine tuned Llama models.

I am looking for my first role after the master’s: machine learning, AI security, computer vision, data or MLOps. Europe or fully remote. No date I need to protect, so I can start whenever suits.

danielponcelasvar@gmail.com

linkedin.com/in/daniel-poncelas-vargas One page CV, PDF Valencia, Spain