Research

🔬 Current Work

Compute verification

MATS Research, with James Petrie (Future of Life Institute)

Compute verification asks whether a third party can check what a GPU has been running without trusted hardware. I am designing software-based protocols that combine memory-state challenges on high-bandwidth memory with subsampled zero-knowledge proofs, and I am building the security argument that bounds the undeclared workload an operator can run while still passing verification.

Training-time safety monitoring

ERA:AI Fellowship, with Alan Cooney (Google DeepMind)

This project asks whether a fine-tuning job that removes a model’s safety training can be detected while it is still running. The monitor runs below the privilege level of the party running the job and is outside that party’s control.

Constraint drift through delegation hierarchies

SPAR (Supervised Program for Alignment Research) mentor, Fall 2026, with Abhejit Rajagopal (Allen Institute and UCSF)

When an orchestrator agent delegates work to sub-agents, the constraints it was given can weaken along the way. This project measures that loss across constraint types and delegation depths, and tests whether constraints lose force partly because delegation strips them of their system-level status, not only because their wording changes.

📚 Earlier Work

Trace wringing: privacy for program traces

UC Santa Barbara, with Tim Sherwood

Hardware designers need program traces from real workloads, but traces leak what the program was doing. Trace wringing forces a trace through a channel of only a few thousand bits, so the amount of information shared is bounded, while keeping the memory behavior that matters for performance evaluation. My dissertation built this into a system-level framework for privacy.

Diagram: a sensitive trace is forced through an n-bit channel, with public information and a utility check, to produce a proxy trace.
Wringing a trace through an n-bit channel (IEEE Micro 2020).

Security and privacy for extended reality

Meta Reality Labs Research

Augmented reality devices send image features and other sensor data to services. We showed that sparse local feature descriptors can be reverse engineered into recognizable images, set up a privacy threat model for feature sharing, and studied mitigations and their cost to localization. Later work strengthened the attack with diffusion priors. Alongside this, the SoK maps where hardware, software, and cryptography can be co-designed for secure computing, and Porcupine is a synthesizing compiler for vectorized homomorphic encryption.

Grid of landmark photos: original images in the top row, and images reconstructed from SIFT, FREAK, and SOSNet feature descriptors below.
Images reconstructed from SIFT, FREAK, and SOSNet descriptors (BMVC 2021).

Agile hardware design and architecture modeling

UC Santa Barbara, with Tim Sherwood

PyRTL is a hardware description language embedded in Python, built for rapid prototyping, instrumentation, and teaching. Charm is a language for closed-form, high-level architecture modeling that lets designers state models and constraints and explore a design space symbolically. I also led the development of OpenTPU, an open-source tensor processing unit written in PyRTL.

Diagram of the Charm interpreter: source code becomes types, models, and analysis; a dependency graph becomes a functional graph that is optimized, evaluated, and checked against constraints.
How Charm turns models into a functional graph (ISCA 2018).