Selected work

Large-scale model training depends on a high-throughput fabric connecting accelerators, hosts, and storage. That performance-sensitive layer also creates security questions that conventional cloud controls do not always address directly.

This research is a collaboration with Matt Schultz and Ilil Blum Shem-Tov.

Research agenda

• Memory exposure and unauthorized data movement across RDMA-capable systems
• Multi-tenant isolation at the interconnect layer
• Security boundaries around NVIDIA GPUDirect and NCCL/RCCL communication patterns
• Detection opportunities for misuse without undermining training performance

The current research agenda organizes these questions into trust boundaries, abuse cases, and potential control points. The goal is to translate network, systems, and cloud-security principles into practical controls for large-scale AI infrastructure.

It studies a security boundary that becomes increasingly important as AI agents gain persistent, read-write memory.

This project is a collaboration with Zhejun Jiang and William Cheng advised by Thomas Pasquier.

Research question

Can a query-only adversary cause malicious instructions to be written into an agent's long-term memory, then retrieved in a later session to manipulate otherwise benign behavior?

What we tested

We evaluated the MINJA Progressive Shortening Strategy against an EHRAgent implementation using mem0, with a static RAG pipeline as a comparison. The experiments used MIMIC-III and eICU healthcare tasks and measured injection success, downstream attack success, and utility degradation.

Key findings

• On MIMIC-III Q&A, mem0 reached 100% injection success and 99.12% attack success with no measured degradation on unrelated benign queries.
• When poisoned memory had to propagate through multi-step reasoning and tool calls, attack success fell to 33.33% on the MIMIC-III identity-swap variant and 80% on eICU.
• The write stage was the most consistent point of failure. Model-level conversational safety did not reliably protect the external memory layer.

The results suggest that persistent memory should be treated as a security-sensitive input channel, not merely a personalization feature.

Developed through the ML4Good Technical AI Safety Program, Patient Zero asks whether exposure to a fine-tuned, power-seeking agent changes a neutral agent during and after repeated multi-agent games.

This project is a collaboration with Lily Wen.

What the pilot found

The experiments found strong in-game behavioral spillover in Iterated Prisoner's Dilemma: neutral agents defected more after exposure to a bad agent. Controls showed that a trait-free always-defect script produced a comparable effect, pointing toward strategic reciprocity rather than transmission of a specific misaligned trait.

Two post-game evaluation methods did not detect a durable shift in the neutral agent's stated power-seeking propensity. The current result is therefore a partial behavioral replication, not evidence of persistent trait contagion.

Limits

The pilot used small samples and relatively small models. The write-up documents uncertainty, confounds, and follow-up tests rather than presenting the result as settled.

As Head of Information Security at AIPO Cloud, the operator for Apple iCloud services in mainland China, I had a clear mandate: build a world-class Security Operations Center. I joined before the data center was operational. The site was literally still a hole in the ground. From there, I led security through buildout, launch, and mature 24/7 operations for infrastructure serving more than 200 million users.

Selected outcomes

• Built the security function end to end, including its people, technology, operating model, and round-the-clock coverage
• Built and led the multidisciplinary security engineering organization spanning vulnerability management, detection engineering, incident response, security-tooling development, and site reliability engineering
• Held responsibility for a $15M+ security program spanning strategy, engineering, operations, procurement, and executive-level risk decisions
• Directed security architecture, operational readiness, and regulatory certification work in a highly regulated market
• Implemented programs aligned with NIST Cybersecurity Framework and ISO 27001 practices