Applied research at the frontier of AI security

Research Question

"Can a meta-learning adversarial generation system achieve 85%+ coverage of known LLM vulnerability classes with a false positive rate below 12%, across diverse enterprise deployment configurations?"

Most AI security testing relies on static attack libraries that age quickly as models and deployments evolve. CAG is a meta-learning algorithm that generates novel adversarial inputs dynamically, based on the target system's own behavior — asking "given how this system responds, what attacks are most likely to succeed?" The result is adaptive, systematic coverage of the OWASP LLM Top 10 that remains effective as AI systems evolve.

Research Question

"What is the minimal permission set required for an AI agent to perform a given task, and how can that boundary be formally characterized, tested, and enforced across diverse agent orchestration frameworks?"

AI agents — systems that browse the web, execute code, send emails, and take autonomous actions — represent the fastest-growing and least understood AI security challenge. When manipulated, the consequences are real actions in the world: files deleted, transactions executed, unauthorized API calls made. This research develops a structured methodology for mapping the authorization boundary of AI agents — what an agent should be able to do versus what it can actually be made to do under adversarial conditions.

Research Question

"What should an AI Bill of Materials contain, how should it be generated, and what verification mechanisms can give organizations warranted confidence in AI supply chain integrity?"

When an organization deploys an AI system, they are trusting a supply chain they largely cannot see: model weights, training data, APIs, and plugins they did not create and may not have audited. This research develops practical AI supply chain security frameworks — analogous to the Software Bill of Materials (SBOM) concept, but adapted for AI components including model weights, datasets, embedding models, vector databases, and AI service dependencies.

Research Question

"What organizational structures, processes, and controls most effectively translate the NIST AI RMF and EU AI Act into operational practice — and what distinguishes successful implementation from compliance theater?"

The NIST AI RMF and EU AI Act explain what good AI governance looks like. What they don't provide is an answer to the question every compliance officer is actually asking: what do I do on Monday morning? This research studies how organizations successfully operationalize AI governance frameworks — what structures work, what evidence satisfies regulators, how governance integrates with enterprise risk management, and what the most common implementation failures look like and why.