Selected Work
My work is organized here in two connected views. The research themes cover the main intellectual areas: trustworthy AI, AI security, AI applications in security, AI-assistant quality, multimedia security, privacy-preserving computation, and systems, with publications, patents, and product outcomes listed under the relevant topic. The product-team themes cover direct work in Microsoft product organizations. The complete record is on the publications and patents pages.
Research Themes
Representative research topics grouped by intellectual theme.
Trustworthy AI & AI Security
This theme covers the security, robustness, and integrity of modern AI systems: backdoor detection and purification, adversarial robustness, model tamper detection and IP protection, LLM jailbreak and prompt-injection risks, and agentic-system poisoning.
- Backdoor detection, purification, and robust learning This line of work studies how hidden backdoors enter models, how to detect whether a model has been compromised, and how to remove poisoned behavior while preserving useful model capability. It also includes work on adversarial transfer attacks and defenses that stress-test whether robustness survives realistic attacker adaptation. Papers: PVDI (IEEE TIFS 2026); ABDP (IEEE TIFS 2026); Consensus-Robust Transfer Attacks (NeurIPS 2025); DorPatch (NDSS 2024).
- LLM and agent security This work studies how LLMs and agentic systems fail under malicious instructions, indirect prompt injection, poisoning, or modality-specific attacks. It combines attack analysis with defensive benchmarking so that future assistants can be evaluated against realistic security risks. Papers: Indirect Prompt Injection (KDD 2025); SoK: LLM Jailbreak Robustness (IEEE S&P 2026); Sirens' Whisper (USENIX Security 2026); Quantifying LLM Attacks (USENIX Security 2026); Fact2Fiction (AAAI 2026).
- Model tamper detection and IP protection This topic asks whether a model has been copied, modified, or tampered with when only limited access is available. The work develops black-box and hard-label verification methods for tamper detection and intellectual-property protection in deployed AI services. Papers: ESF (ACL Findings 2025); RESF (EMNLP 2025); SDBF (CVPR 2025); Intersecting-Boundary-Sensitive Fingerprinting (ICML 2024); Backdoor Watermark for LLM Copyright (ACL 2023).
AI Applications in Security
This theme applies AI and machine learning to practical security problems: phishing and fraud detection, malicious URL and malicious script detection, compromised-account detection, ransomware defense, abuse prevention, and explainable signals for security operations.
- BehaviorGuard for human-operated ransomware defense This topic uses multi-resolution user-behavior modeling to detect account compromise during human-operated ransomware attacks. The goal is not just classification accuracy, but a defense that can operate under enterprise constraints and catch lateral movement early enough to matter. Patent: Detecting and Mitigating Ransomware Attacks. Product outcome: BehaviorGuard in Microsoft Defender for Endpoint detects compromised accounts during human-operated ransomware attacks.
- AI-based malicious PowerShell script and malicious URL detection This subtopic uses AI to detect malicious URLs and malicious PowerShell scripts, including work that first identifies detector weaknesses through strong evasion attacks and then hardens the detector against realistic adversarial changes. Paper: Detecting Malicious Web Links and Identifying Their Attack Types (USENIX WebApps 2011). Patent: Malicious Uniform Resource Locator Detection. Product outcome: malicious-PowerShell hardening for Microsoft Defender for Endpoint.
- Phishing, fraud, and account-abuse detection This work combines webpage classification, logo detection, invariant content features, account information, and user behavior signals to reduce phishing and fraud risk. Several systems were designed under strong privacy and deployability constraints, such as Microsoft Forms defenses without access to private user inputs. Papers/patents: Protect Sensitive Sites from Phishing Attacks (ICC 2013); Detecting Malicious Web Links and Identifying Their Attack Types (USENIX WebApps 2011); ML-based account classification; malicious URL detection; detection and categorization of malicious URLs. Product outcomes: Office 365, Microsoft Forms, and account-protection systems.
AI Assistants, Search & Optimization
This theme covers the quality of AI assistants and search systems: prompt optimization, multi-turn agent evaluation, model selection, deep search, document understanding, search-grounded reasoning, and multi-vector retrieval.
- Automatic prompt optimization This subtopic treats prompts as objects that can be searched, evaluated, and improved systematically rather than hand-tuned one at a time. The work includes tree/multi-branch exploration and strategy-guided optimization for practical LLM application quality. Papers: AMPO (EMNLP 2024); StraGo (EMNLP Findings 2024). Patent applications: Automatic Tree-Structured Prompt Optimization; Strategic-Guided Prompt Optimization. Product outcome: practical prompt-optimization workflows used across Bing teams.
- AI-assistant and agent evaluation This topic focuses on how to evaluate AI assistants beyond single-turn answer correctness: multi-turn coherence, search-grounded reasoning, citation quality, model choice, and agent behavior over longer tasks. Paper: Evaluating LLM-Based Agents for Multi-Turn Conversations: A Survey (ACM TIST 2026).
- Web systems, caching, and search infrastructure This work explores how web and search systems can improve caching, measurement, storage efficiency, and long-tail document freshness while respecting production constraints such as latency and infrastructure cost. Papers/patents: Smart Caching for Web Browsers (WWW 2010); WPBench (WWW 2009); Structure-Based Adaptive Document Caching. Product outcome: Bing document-understanding pipelines.
Human Interactive Proofs (CAPTCHA) & Authentication
This theme covers authentication and human-verification systems: image, overlay, manipulable, and audio HIP/CAPTCHA designs; graphical-password security analysis; and device-assisted or zero-effort authentication concepts.
- CAPTCHA and human-interactive-proof design This work designs human-verification mechanisms that are usable for people and difficult for automated attackers. It spans image-recognition CAPTCHAs, audio HIPs, overlay and manipulable HIPs, and human-computation frameworks that treat deployability and adversarial resistance as first-order design constraints. Papers: Attacks and Design of Image Recognition CAPTCHAs (ACM CCS 2010); Comprehensive Human Computation Framework (ACM MM 2008). Patents: image-based CAPTCHA; Audio HIP; manipulable HIPs; overlay HIP. Product outcome: Visual HIP and Audio HIP in Windows Live.
- Graphical password security This subtopic analyzes click-based graphical passwords and shows that proposed discretization methods leak password information. The result overturned an important assumption in graphical-password design and connected human memorability, image structure, and attack feasibility. Papers: Security Implications of Password Discretization (WWW 2013); Security Analyses of Click-Based Graphical Passwords (ACM CCS 2014); CAPTCHA as Graphical Passwords (IEEE TIFS 2014).
- User and device authentication This work explores authentication schemes that reduce user burden while strengthening security, including privacy-protecting distributed single sign-on, zero-effort smartphone locking with wristwear, and hardware-assisted password strengthening concepts. Patents: Distributed Single Sign-On Technologies; privacy-protecting SSO. Product outcome: mobile integrity checking in MSN Mobile v6.5.
Multimedia Security, Watermarking & Content Protection
This theme covers audio, image, and video watermarking; multimedia authentication; scalable media encryption and DRM; content protection; and data embedding for charts, slides, and other visual media.
- Watermarking and multimedia authentication This subtopic began with Ph.D. research and continued into startup products. It covers robust audio, image, and video watermarking; perceptual masking; multimedia authentication; copyright protection; tracking; linking; and covert communication through media carriers. Papers/chapters: Multimedia Authentication and Watermarking (Springer chapter 2003); Robust Audio Watermarking (Signal Processing 1998); Video Watermarking Using Perceptual Models (IEEE JSAC 1998); Robust Data Hiding for Images (DSP Workshop 1996). Product outcome: Cognicity AudioKey, tMark, and TurnKey commercial watermarking products.
- Scalable encryption, DRM, and content protection This work protects multimedia while preserving scalability and adaptation. It includes syntax-compliant encryption, layered access control, transcoding-compatible protection, and DRM designs that allow differentiated access to scalable media layers. Papers/chapters/patents: Multimedia Encryption (Academic Press chapter 2006); Scalable Encryption and Multi-Access Control (Academic Press chapter 2006); Scalable Protection for MPEG-4 FGS (IEEE TMM 2005); Syntax-compliant JPEG 2000 encryption (EURASIP JIS 2007); Secure Key Management for Scalable Codestreams (MMSP 2005); Scalable Layered Access Control for Multimedia (ISCAS 2005); JPEG 2000 Encryption Enabling Fine Granularity Scalability (ISCAS 2005); Fully Scalable Encryption for MPEG-4 FGS (ISCAS 2003); Scalable Layered Access Control for Multimedia; Secure Key Management for Scalable Codestreams; Fully Scalable Encryption for Scalable Multimedia; Scalable, Error Resilient DRM for Scalable Media. Product outcome: music-industry copyright-protection work including MUSE, 4C DVD-Audio proposal, and SDMI screening.
- Data embedding in charts, slides, and images This later line of work embeds and recovers information from chart/slide images, enabling applications such as reconstructing chart objects from screenshots and making chart content more accessible. Papers: ChartStamp (ACM MM 2022); OneLabeler (CHI 2022). Patent: Data Embedding and Data Extraction in Image.
Privacy-Preserving Computation & Systems Reliability
This theme covers computation on protected data and reliability for large services: homomorphic-encryption-domain media processing, encrypted-video analytics, anomaly detection, outage prediction, and compression for web-scale infrastructure.
- Media processing in the encrypted domain This work asks whether useful media processing can happen without exposing the media itself. It includes JPEG decompression and FLAC decoding directly in the homomorphic-encryption domain, showing that parts of conventional media pipelines can be redesigned for protected computation. Papers: JPEG Decompression in the Homomorphic Encryption Domain (ACM MM 2018); Decoding Homomorphically Encrypted FLAC Audio without Decryption (ICASSP 2019).
- Encrypted-video analytics and multimedia privacy This topic studies how to perform useful surveillance-video analytics while preserving privacy. The work includes motion detection and trajectory inference directly on encrypted, HEVC-compressed video with little loss in compression efficiency or detection quality. Papers: Privacy-Preserving Motion Detection for HEVC-Compressed Surveillance Video (ACM TOMM 2022); Privacy-Preserving Cloud-Based Video Surveillance (ICIP 2018); Efficient Privacy-Preserving Motion Detection for HEVC Video (INFOCOM WKSHPS 2018).
- Systems reliability, anomaly detection, and compression This line connects machine learning and systems analysis to large-scale service reliability and efficiency: predicting/triaging incidents, detecting anomalies without clean labels, reducing search-index storage through Microsoft Research Asia (MSRA) research, and improving web-system performance. Papers/patents: Smart Caching for Web Browsers (WWW 2010); WPBench (WWW 2009); Structure-Based Adaptive Document Caching. Product outcome: Microsoft Research Asia (MSRA) reverse-index compression research transferred to Bing PDI, reducing storage by roughly 23% on average with no loss in compression/decompression speed.
Product and Startup Work Themes
Representative product and startup work grouped by application area, separate from the research themes above.
M365 Core: Copilot, BizChat & Researcher Agent
Applied research and development for enterprise AI assistants that reason over organizational knowledge. The work centers on making Copilot and related agents easier to evaluate and improve: diagnosing reasoning traces, measuring citation quality, comparing model choices, supporting deep search, and improving reliable multi-turn behavior for real enterprise tasks.
- Reasoning evaluation and replay infrastructure Built infrastructure that replays and analyzes production reasoning traces, helping teams diagnose answer quality, citation quality, intent understanding, search-grounded reasoning, and model-selection behavior in a repeatable way.
- Researcher agent and agentic deep search Advanced deep-search and agentic capabilities for enterprise information work, with attention to task decomposition, evidence gathering, grounded synthesis, and evaluation methods that reveal where multi-turn agents succeed or drift.
Bing Core Search: Retrieval, Prompts & Document Understanding
Product-team work on Bing Core Search retrieval and Web-scale document understanding. The focus was to turn LLM and multi-vector retrieval capabilities into practical search workflows: developing a new multi-vector retrieval mechanism to replace sparse+dense retrieval, improving prompt optimization, representing documents more richly, creating signals for fresh and long-tail pages, and measuring retrieval and recommendation impact.
- Prompt optimization workflows Built practical prompt-optimization workflows that helped multiple Bing teams search, compare, and improve prompts systematically instead of relying only on manual trial-and-error tuning.
- Multi-vector retrieval replacing sparse+dense retrieval Built a flexible multi-vector retrieval mechanism for Bing Core Search, along with LLM-based document-understanding pipelines and synthetic queries/click signals for fresh and long-tail Web documents where real interaction data is sparse.
Cognicity: Commercial Watermarking Products
Startup work as co-founder and lead scientist, turning Ph.D. research in multimedia watermarking and data embedding into commercial audio, image, and video products. The work combined algorithm design, product architecture, implementation of core modules, and direct engagement with copyright-protection and media-industry requirements.
- AudioKey, tMark, and TurnKey Led product architecture and core watermarking-module development for retail audio watermarking, transactional download-time watermarking, and per-CD unique-ID watermarking at burn time.
- Image, video, and data-embedding products Extended the product line beyond audio to image and video watermarking, fingerprinting, copyright protection, access control, tracking, linking, and covert communication scenarios.
- Music-industry copyright-protection efforts Contributed watermarking technology to industry efforts for copyright protection and access control, including MUSE, the 4C Entity DVD-Audio proposal, and SDMI Phase 2 screening.