Research Statements

My research asks one question in three settings: does a safety claim survive contact with the system it is supposed to protect? A model that refuses in English may comply in Bengali. A guard that blocks a prompt may not block the tool call that prompt eventually produces. A benchmark that reports a reassuring number may be measuring something other than safety. I work on LLM safety, agentic AI safety, and multilingual safety evaluation, and the common thread is rebuilding the measurement until the answer means what it appears to mean.

The four projects named below are work in progress; their write-ups are not yet public, so the descriptions here are of the ideas rather than of results. My published work is on the publications page.

LLM Safety Evaluation

A safe-looking answer is not the same as a safe model

Lost in Speech measures what happens to safety alignment under two independent perturbations — translation out of English, and conversion from text to synthesized speech — with the harmful intent held fixed. It is a root-controlled, paired design over a 100-language stratified sample, with speech synthesized for 75 of those languages across two open TTS backends, evaluated on speech-language models spanning several distinct text–audio integration strategies.

The concept that matters most to me came out of the measurement itself: unsafe-compliance rate is uninterpretable on its own. A model that does not understand a spoken request in a low-resource language produces a response that any judge scores as safe. Comprehension and refusal are different properties, and reporting only the second lets poor multilingual understanding masquerade as good multilingual alignment. Safety metrics for non-English and non-text conditions have to be read against a comprehension rate, or they silently reward the wrong thing. A related discipline I try to hold: call it unsafe compliance rather than attack success when no adversarial optimization was performed — the name should describe what the experiment actually did.

The judge is the bottleneck

CritiqLM distills a three-judge safety ensemble into a small critic model that predicts a four-way safety label plus continuous severity scores, trained with QLoRA on consensus verdicts drawn from a multilingual corpus of judged prompt–response pairs.

The motivating concept is economic as much as scientific: at benchmark scale the cost of judging dominates the cost of generating, so the judge determines which experiments are affordable at all. A critic that runs in a couple of gigabytes changes what questions can be asked. The open question I care about is the promotion criterion — what evidence would justify moving a distilled critic from an evaluation instrument to a deployment-time guardrail? Beating a majority-class baseline is necessary and nowhere near sufficient, and I would rather state that plainly than let a convenient tool drift into a safety claim it cannot support.

Agentic AI Safety

Once a model has tools, memory, and other agents to talk to, it can be wrong and act on it. Safety then has to be a property of trajectories and authority, not of output text.

Authority is the invariant worth enforcing

FlowGuard formalizes a security provenance label — source, trust, authority, sensitivity, principal, purpose, timestamp, version, retention, lineage — carried by data as it moves through databases, ETL, vector stores, agents, and action tools, together with the default rule that a transform may not increase authority, Authority(T(d)) ≤ Authority(d), unless an explicit and auditable upgrade operator is invoked. The enforcement principle is a single sentence: never trust a transform’s self-reported label; re-derive each hop’s label independently instead.

Two ideas from this project generalize beyond it. First, enforcement should not depend on the agent resisting the injection — a defense whose correctness rests on the model making a good decision is not a defense. Second, label persistence is not label correctness: a system can carry every provenance field intact through every stage and still be wrong about all of them, so a benchmark that checks only whether metadata survived will score a fooled pipeline identically to a sound one. That dissociation is an argument for multi-metric benchmark design in general.

Guards do not compose into safe actions

Guard-to-Action studies the guard → reason → act funnel in multimodal agents and asks where unsafe behavior actually leaks. The input guard’s verdict, the plan the model writes, and the tool call it finally emits are three distinct measurement points, and a block rate at the first does not bound the unsafe-action rate at the third. Reporting only the input-guard number — the field’s default — describes the least consequential stage of the pipeline. The project also looks at how adding an image changes the funnel relative to the same request in text alone, which makes modality a variable in agent safety rather than a separate topic.

This continues the line of my published agentic work: HALLPERM on implicit privilege escalation through under-specified tool schemas, When Safety Geometry Collapses on guard models losing alignment through ordinary benign fine-tuning, Semantic Intent Fragmentation on single-shot compositional attacks against multi-agent pipelines, and Agent-Fence on the vulnerability surface of deep research agents.

Multilingual Safety as a First-Class Axis

Most safety evaluation is conducted in English, and most of what we claim to know about alignment is therefore a claim about English. I maintain a multilingual safety benchmark of over 1.2M unsafe prompt–response pairs spanning 100 languages, assembled from several existing corpora through translation and alignment, with an evaluation framework built on the AEGIS taxonomy and S1–S23 harm scoring.

Treating language as a first-class axis rather than a robustness footnote changes what you find. Language is a distribution shift that safety training rarely covers explicitly; guard models and judges are weakest precisely where coverage is thinnest; and translation artifacts are easy to mistake for safety effects unless the design controls for them at the root prompt. CritiqLM and Lost in Speech both grew out of this benchmark — one because judging at this scale is otherwise unaffordable, the other because translation and speech are two perturbations that can be varied independently over the same intent.

Privacy as a Companion Constraint

My earlier work on social platforms — privacy risk scoring over attributes, graphs, and text; identity-attack defenses; federated pipelines that keep raw user data on device — informs how I think about agents that read personal context. Capability and privacy are the same question asked twice: what is this system allowed to know, and what is it allowed to do with what it knows? FlowGuard’s provenance labels carry sensitivity and purpose alongside authority for exactly that reason.

Directions

• Certifying guard robustness rather than reporting its average accuracy, given how easily benign fine-tuning moves a guard’s decision boundary.
• Comprehension-gated safety metrics as a default for any non-English or non-text evaluation.
• Attribution for agent failures: given a bad action, what evidence identifies the cause — the prompt, poisoned memory, a laundered provenance label, or the model itself?
• Capability-aware access control for agentic LLMs, taking least privilege from a slogan to something an agent runtime can enforce and audit.
• Contamination-resistant benchmark construction, so that difficulty is reproducible from fresh sources as models absorb the old ones.

More to come — this page is updated as projects move from pilot to write-up.