This page lists the internship projects currently available in the Center for Cybersecurity of Fondazione Bruno Kessler (FBK). Please note that these are curricular internship projects (which does not include financial compensation) intended specifically for bachelor’s and master’s university students, and not employment contracts. Please refer to jobs.fbk.eu/ for job offers and open positions.
Procedure
- Application: submit your application for the internship project you are interested in using the designated online form and providing the required information. Make sure to apply before the specified deadline. You are advised not to apply to more than two projects at the same time.
- Selection: project supervisors will review the applications and choose the most suitable candidate. If needed, they may request an oral interview during the selection process. Each project is evaluated independently.
- Results: once the selection process is complete, all applicants (both selected and not selected) will be notified of the outcome for the specific project.
For general inquiries, you can email internships-cs@fbk.eu. If you have specific questions about a project, please reach out to the project supervisor directly.
Please note that applications sent via email will not be considered.
Projects are listed starting with those that have the earliest submission deadlines.
Automated Cross-Regulation Compliance for Digital Regulations via Requirements Engineering CLEANSE SaFEWaRe ST
ID: p-2026-cs-002
Published on: Friday, 17 July 2026
Deadline for Applications: Tuesday, 1 September 2026 at 23:59 Wednesday, 30 September 2026 at 23:59 (extended)
Description:
Organizations operating in the digital space must simultaneously comply with multiple legal frameworks: data protection laws, AI-specific legislation, platform regulations, cybersecurity directives, and more. These regulations are developed independently, use inconsistent and not fully comparable terminology, and overlap in scope, creating a compliance landscape that is fragmented, contradictory, and costly to navigate. In practice, compliance is largely a manual, expert-driven process that does not scale.
This project investigates how Requirements Engineering (RE) methods can be leveraged to automate cross-regulation compliance in the digital domain. The central research question is: how can legal obligations drawn from heterogeneous regulatory sources be extracted, formally represented, aligned, and reasoned over in a unified framework to be comprehensible for different stakeholders?
Applicants will contribute to one or more of the following activities: 1) extraction and formalization of requirements from selected EU digital regulations into a unified goal model representation; 2) design of cross-regulation alignment and conflict detection mechanisms; 3) development and evaluation of a context-aware compliance navigation framework with users from heterogeneous backgrounds.
This project offers the opportunity to engage with research at the intersection of legal analysis, requirements engineering, and knowledge representation, contributing to tools and methods with direct applicability across industry and policy contexts.
Type: Internship + Thesis
Level: BSc
Supervisors: Livia Marini (lmarini@fbk.eu), Pietro De Matteis (pdematteis@fbk.eu), Magdalena Maria Solitro (msolitro@fbk.eu), Luca Piras (l.piras@fbk.eu)
Prerequisites:
- Ability to read, interpret, and critically analyze legal texts in English and Italian.
- Familiarity with EU digital regulation (e.g. GDPR, AI Act, DSA, or similar) is strongly advantageous.
- Proficiency in digital tools for research and a good understanding of knowledge representation fundamentals and methodologies (semantic networks, ontologies, logic-based systems, graph databases) to manage complex project data.
- Curiosity for interdisciplinary work at the boundary between law and computer science is essential.
Objectives:
- Familiarization with the state of the art in regulatory requirements engineering and cross-regulation compliance.
- Extraction and formalization of requirements from one or more EU digital regulations.
- Design and evaluation of mechanisms for cross-regulation alignment, conflict detection, and context-aware compliance navigation.
Topics: EU Digital Regulations, Requirements Engineering
Sensitive Data Detection and Prompt Sanitization for Large Language Models DAISY
ID: p-2026-cs-003
Published on: Tuesday, 15 September 2026
Deadline for Applications: Saturday, 31 October 2026 at 23:59
Description:
Large Language Models (LLMs) are increasingly integrated into applications that process user-generated content. When users access these models through external services, prompts may contain sensitive information such as names, locations, organizations, contact details, financial information, or other attributes that should not leave the local environment.
One possible approach to reduce this exposure is to detect and sanitize sensitive information before sending a prompt to an external LLM. Named Entity Recognition (NER) and newer PII detection models can support this process. However, traditional NER models usually focus on a limited set of entities, while privacy-oriented applications may require a broader definition of sensitive information. At the same time, simply removing or masking all detected information may reduce the quality of the context provided to the LLM.
This project aims to study and evaluate techniques for detecting and sanitizing sensitive information in LLM prompts. The work will start with an analysis and comparison of existing NER and PII detection approaches, including transformer-based and open-label models. Based on this analysis, the student will develop a prototype to evaluate sanitization strategies such as masking, pseudonymization, and information generalization, and analyze their impact on both privacy and LLM output quality.
Depending on time and interest, the project may also investigate query-aware sanitization, where information is removed or generalized based on its relevance to the user's requested task.
Type: Internship + Thesis
Levels: BSc, MSc
Supervisor: Luis Augusto Dias Knob (l.diasknob@fbk.eu)
Prerequisites:
- Basic knowledge of Python.
- Basic knowledge of Machine Learning and Natural Language Processing.
- Knowledge of LLMs, transformers, or Hugging Face is a plus.
Objectives:
- Study existing approaches for NER, PII detection, and prompt sanitization.
- Evaluate existing models for detecting sensitive information, with particular attention to missed sensitive data.
- Develop a prototype to compare different sanitization strategies.
- Evaluate the trade-off between sensitive information exposure and the quality of downstream LLM responses.
Topic: Large Language Models, Natural Language Processing, Named Entity Recognition, Personally Identifiable Information, Privacy, Prompt Sanitization
References:
Web Content Poisoning in Retrieval-Augmented Large Language Models DAISY
ID: p-2026-cs-004
Published on: Tuesday, 15 September 2026
Deadline for Applications: Saturday, 31 October 2026 at 23:59
Description:
Large Language Models (LLMs) increasingly rely on external sources to access recent or domain-specific information. Search engines, Retrieval-Augmented Generation (RAG), and Web-enabled agents let models retrieve information at inference time, but they also introduce a new security problem: retrieved content may come from untrusted or manipulated sources.
An attacker may create or modify online content to be retrieved for specific user queries and influence the LLM's generated answer. This can include misleading information intended to change a response's factual content, as well as content designed to influence the model's behavior through indirect prompt injection.
This project aims to study how malicious or manipulated Web content affects retrieval-enabled LLM applications. The work will start with an analysis of existing attacks against RAG and Web-enabled LLM systems. The student will then develop a controlled environment where an LLM can retrieve benign and adversarial content and evaluate how different types of poisoned content affect retrieval and generated responses.
Type: Internship + Thesis
Levels: BSc, MSc
Supervisor: Luis Augusto Dias Knob (l.diasknob@fbk.eu)
Prerequisites:
- Basic knowledge of Python.
- Basic knowledge of cybersecurity.
- Knowledge of RAG, information retrieval, or Web technologies is a plus.
- Basic knowledge of Large Language Models.
Objectives:
- Develop a test environment for retrieving benign and adversarial Web content.
- Investigate techniques to detect or reduce the impact of malicious retrieved content, such as source validation, cross-source comparison, and detection of suspicious or inconsistent information.
- Study existing attacks against RAG and Web-enabled LLM systems.
- Evaluate how poisoned content affects retrieval and LLM responses.
Topic: Large Language Models, Web Security, Retrieval-Augmented Generation, Information Retrieval, Data Poisoning, Indirect Prompt Injection
References:
- [1] Chang et al., Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems, USENIX Security 2026. • Link
- [2] Zou et al., PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models, USENIX Security 2025. • Link
- [3] Syros et al., MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks, USENIX Security 2026. • Link