I work on the gap between how safe a model looks and how safe it is — from the inside and under attack. Mechanistic interpretability and LLM security. Ph.D., NYU Tandon (2026); before that, 15+ years shipping software at Microsoft.
- Surgical Repair of Insecure Code Generation in LLMs (2026) — mechanistic diagnosis of why LLMs generate insecure code they can already recognize, and conditional activation steering to repair it at inference time.
- Suppression is not Deletion: Adversarial Probes Recover Unlearned Knowledge in Code LLMs (ICML 2026 MemFM Workshop, with Dhairyasheel Patil) — CodeUnlearn-Bench, a 6-level adversarial benchmark for unlearning evaluation.
- Locating is not Repairing (2026, with Anh Dang) — the same decimal-comparison bug arises from a different circuit in each model family, and published fixes fail to transfer. Code: surgeon.
- Lost at C (USENIX Security 2023) — N=58 user study of the security of AI-assisted code.
- Red-Teaming Language Models — blog series on red-team measurement; applied in marin_red_teaming, an independent safety audit of Marin-8B.