I'm looking for PhD students and postdocs, as well as MS and undergraduate interns. If you know how to build systems, tools, or models, we should talk. Just shoot me a human-written email.
Students and alumni include NSF GRFP and NDSEG fellows, professors, and founders. 27 MS and undergraduate researchers have gone on to PhD programs.
I create principled, practical techniques to make AI and software systems more reliable and secure. My earlier work strengthened Linux, used by billions, by revealing bug hotspots and helping fix dozens of kernel security and file-system bugs. We coined machine unlearning in 2015, helping launch the field. DeepXplore (2017) helped establish systematic neural-network testing and influenced Google’s TensorFuzz. More recently, Radshield was deployed aboard NASA’s Perseverance Mars rover to protect an autonomous navigation algorithm from radiation-induced faults, entirely in software.
Previously, I co-founded and led NimbleDroid, turning our research into automated mobile-app performance tools used by Pinterest, Flipkart, Tinder, and The New York Times.
My awards include Mark Weiser, IEEE S&P Test-of-Time, and Best Paper/Artifact at OSDI, SOSP, IEEE S&P, CCS, USENIX ATC, and CIDR. I earned my PhD and MS from Stanford and BS from Tsinghua.
Recent Papers
- Automatically Learning Vulnerability Patterns for Scalable Static Analysis of Web Applications
- Efficient Branch-and-Bound Testing and Verification of zkVMs
-
Jailbreaking Jailbreaks: A Proactive Defense for LLMs
Gist
To our knowledge, ProAct is the first proactive jailbreak defense. Its decoy responses make the attacker’s model believe a jailbreak succeeded, stopping iterative searches early. ProAct cuts attack success rates by up to 94% without harming utility; combined with existing defenses, it reduces them to 0%.
-
TRIM: Reducing AI-Generated CodeSlop via Agent Trajectory Minimization
Gist
The key diagnosis is that coding agents leave behind speculative and abandoned edits from their search trajectories. Minimizing those trajectories cuts functionally unnecessary code by 17.9–32.9% across agent scaffolds with negligible regression, while using about half the validation cost of delta-debugging baselines.
-
Understanding Automated Program Repair Agents Through the Lens of Traceability: An Empirical Study
Gist
Tracing five repair agents across 500 real bugs reveals why benchmark wins do not always translate into sound patches: weak test generation, skipped regression tests, and primitive tooling encourage verbose, overfit fixes. The study argues for shifting effort toward early reproduction and validation.
-
Outrunning LLM Cutoffs: A Live Kernel Crash Resolution Benchmark for All
Gist
A continuously refreshed kernel-crash benchmark keeps evaluation ahead of model knowledge cutoffs, while a standardized execution environment makes agent comparisons fair and scalable. It exposes a sizable contamination gap and shows that execution feedback improves crash resolution by 29%.
-
kAgent: An execution-guided crash resolution agent for the Linux kernel
Gist
Rather than treating kernel crashes like ordinary bug reports, the agent follows an execution-grounded developer workflow: inspect logs, form hypotheses, patch, reproduce, and refine. It repairs 54.5% of crashes without localization and 65% when given the correct file.
-
zkFuzz: Foundation and Framework for Effective Fuzzing of Zero-Knowledge Circuits
Gist
A language-independent consistency test unifies under- and over-constrained zero-knowledge circuit bugs, then mutation-guided fuzzing turns that foundation into a practical detector. Across 452 Circom circuits, it found 85 bugs, including 59 zero-days; developers confirmed 39 and fixed 14.
-
Detecting Privilege Escalation in Polyglot Microservices via Agentic Program Analysis
Gist
Combining LLM-directed search with classic program analysis lets one analysis follow privilege checks across services and seven programming languages. The system found 24 zero-day privilege-escalation vulnerabilities with 81% precision and 85% recall, then uncovered 18 more vulnerabilities in other domains.
-
Your Compiler is Backdooring Your Model: Understanding and Exploiting Compilation Inconsistency Vulnerabilities in Deep Learning Compilers
IEEE S&P Distinguished Paper Award
Gist
An official, unmodified deep-learning compiler can silently change model semantics enough to activate a backdoor that is absent before compilation. The attack reaches 100% success after compilation, and a survey of popular Hugging Face models finds naturally occurring triggers in 31 of 100 models.
-
Radshield: Software Radiation Protection for Commodity Hardware in Space
Gist
Radshield protects commodity hardware used in space from radiation-induced short circuits and silent data corruption entirely in software. It was deployed aboard NASA’s Perseverance Mars rover to protect an autonomous navigation algorithm.
-
SWE-Spot: Building Small Repo-Experts with Repository-Centric Learning
Gist
Small coding models can become more capable by mastering one repository rather than training broadly across many. Repository-specific experience lets a 4B model outperform models up to 8× larger on average across bug fixing, test generation, and feature implementation, with lower inference costs than task-centric training.
Selected Papers (or see all)
These papers trace my research from foundational work on reliable storage and concurrency to today’s trustworthy AI systems.
-
Diversity Helps Jailbreak Large Language Models
NAACL Oral Presentation
Gist
A state-of-the-art, fully automated red-teaming tool that turns prompt diversity into an efficient black-box jailbreak strategy, exposing 5× more safety failures across leading LLMs with 10× fewer queries.
-
Raidar: geneRative AI Detection viA Rewriting
Gist
RAIDAR introduced divergence under rewriting, an interpretable signal that generalizes across domains and requires only black-box LLM access. Ask another LLM to rewrite the text: AI-generated text changes less because it lies closer to the rewriter’s statistical norm. The idea later extended to AI-generated video and audio.
-
DeepXplore: Automated Whitebox Testing of Deep Learning Systems
CSAW 2018 Applied Research Second PlaceCACM Research HighlightSOSP Best Paper Award
Gist
DeepXplore was the first white-box testing tool to bring coverage-guided fuzzing and differential testing to neural networks. It introduced neuron coverage, uncovered thousands of flaws, helped launch a new research field, and influenced Google’s TensorFuzz.
-
Towards Making Systems Forget with Machine Unlearning
IEEE S&P Test-of-Time AwardICBS Frontiers of Science Award
Gist
This paper coined the term machine unlearning: the idea that models should efficiently forget selected training data and its influence. It helped launch a field that has grown from classical learning algorithms to deep neural networks and LLMs.
-
Making Parallel Programs Reliable with Stable Multithreading
Invited Article
Gist
StableMT introduced a new concurrency model built on a radical question: do parallel programs need exponentially many thread schedules? Reusing a small set of tested schedules across inputs makes production behavior more predictable, testable, and reliable.
-
Using Model Checking to Find Serious File System Errors
OSDI Best Paper Award
Gist
FiSC leveraged model checking to systematically explore crash states beyond conventional testing. It found serious bugs in every file system checked—32 across ext3, JFS, and ReiserFS—including failures that could irrecoverably destroy entire directories, even the file-system root; most were patched within a day.