My research sits between optimization theory and the security of deployed machine learning systems. On one side, I design first-order stochastic algorithms with provable convergence rates and sample complexities for decentralized, bilevel, and multi-objective learning. On the other, I study the poisoning, backdoor, and Byzantine attacks that determine whether those systems survive real-world deployment, and the defenses that hold up against them.
Modern LLM pipelines are assembled from components that no single party fully controls: retrieved documents, third-party fine-tunes, code-completion models, and cooperating agents. Each of these is an attack surface. My group works on three questions.
We also maintain benchmarks for poisoning attacks against RAG, so that defenses are evaluated against a common and realistic threat model rather than bespoke attacks.
Many learning problems are not simple empirical risk minimization. Hyperparameter optimization, meta-learning, and data reweighting are bilevel; adversarial training and robust learning are min-max; recommendation and multi-task systems are multi-objective. These structured problems are far harder to analyze than single-level stochastic optimization, especially in the decentralized setting where no node sees the full objective.
Distributed training is usually bottlenecked by communication, not computation, and the standard fixes for communication cost tend to weaken robustness and privacy at the same time. We study designs that improve all three together: variance-reduced and semi-asynchronous methods that cut communication rounds, Byzantine-robust aggregation for ring-all-reduce and decentralized topologies, differentially private decentralized optimization, and defenses for split and asynchronous federated learning.
A complete list of papers is available on the Publications page; supporting grants are listed under Grants.
Back to Top ↑