Research
We build security foundations for AI systems by studying how they make decisions, where they fail, and how they can be made safer — and we use those systems in turn to strengthen cybersecurity. Our work spans four areas.
AI Security/Privacy
We study how the models themselves can be attacked and protected. Our work spans data poisoning and backdoors, adversarial robustness, memorization and membership inference, extraction of personally identifiable information from language models, and provenance mechanisms such as watermarking.
- Private Investigator: Extracting Personally Identifiable Information from Large Language Models Using Optimized Prompts — USENIX Sec. 2025
- IF-Guide: Influence Function-Guided Detoxification of LLMs — NeurIPS 2025
- SoK: Watermarking for AI-Generated Content — IEEE S&P 2025
- Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models — NeurIPS 2024
- Handcrafted Backdoors in Deep Neural Networks — NeurIPS 2022 ★ Oral
AI Reliability
We examine where AI systems degrade once they leave the lab: hardware faults and parameter corruptions, the robustness cost of compression techniques such as quantization and early exits, and the end-to-end resilience of large-scale inference pipelines.
- Hessian-aware Training for Enhancing DNNs Resilience to Parameter Corruptions — TMLR 2026
- Demystifying the Resilience of Large Language Model Inference: An End-to-End Perspective — SC 2025
- Harnessing Input-adaptive Inference for Efficient VLN — ICCV 2025
- Qu-ANTI-zation: Exploiting Neural Network Quantization for Achieving Adversarial Outcomes — NeurIPS 2021
- Terminal Brain Damage: Exposing the Graceless Degradation in Deep Neural Networks Under Hardware Fault Attacks — USENIX Sec. 2019
Agentic AI Systems
As LLM-driven agents gain the ability to browse, execute, and act on a user's behalf, they inherit both model-level and systems-level attack surfaces. We study indirect prompt injection in web agents, time-of-check to time-of-use vulnerabilities, and how long-standing browser isolation guarantees break down in agentic settings.
- Site Isolation is Dead: How Site Isolation is Broken in Agentic Browsers and Extensions — IEEE S&P 2026
- AgentBreaker: Evaluating Context-Aware Indirect Prompt Injection Risks in Modern Web Agents — ISSTA 2026
- Mind the Gap: Time-of-Check to Time-of-Use Vulnerabilities in LLM-Enabled Agents — NeurIPS-W 2025
AI for Cybersecurity
We turn AI systems back toward defense, using them to find and triage real security problems at scale, while measuring how far the resulting detectors can be trusted. Our work covers Internet-scale exposure discovery, malware and phishing detection under evasion and concept drift, and audio deepfake detection.
- Exposure is All You Need: Using LLMs to Identify Critical Endpoints at Internet Scale — AISec 2026
- When Does Wasm Malware Detection Fail? A Systematic Analysis of Their Robustness to Evasion — ASE 2025
- Evaluating Robustness of Reference-based Phishing Detectors — AsiaCCS 2025
- MADCAT: Combating Malware Detection Under Concept Drift with Test-Time Adaptation — ICML-W 2025
- Enhancing Audio Deepfake Detection by Improving Representation Similarity of Bonafide Speech — Interspeech 2025