Research
Research in secure software engineering, LLM security, and AI/ML security.
LLMs for security
LLM4SEC
Automated Vulnerability Repair
We investigate whether language models can repair vulnerable code without changing its intended behaviour. Candidate patches are tested for security and functional correctness.
- Patch Generation
- Root-Cause Repair
- Build and Test Validation
Current work Validation-guided root-cause analysis and repair
Related paper Rethinking the Capability of Fine-Tuned Language Models for Automated Vulnerability Repair
Vulnerability Detection
We combine local code context with validation to identify security flaws while reducing false positives. The goal is to make automated findings more precise and actionable.
- Local Context Analysis
- Candidate Verification
- False-Positive Reduction
Related paper VulScope: Software Vulnerability Detection via Local Context Analysis and Verification
Secure Code Generation
We study how language models can generate code that satisfies both functional requirements and security constraints. Validation is used to identify weaknesses early.
- Security-Aware Generation
- Functional Correctness
- Code Validation
Current work Secure code generation under functional and security requirements
Kernel Code Fault Localization
We are building a benchmark for locating faults in kernel code, where low-level behaviour and long-range dependencies challenge conventional methods.
- Linux Kernel
- Fault Localization
- Benchmarking
Current work LLM-based fault localization for Linux kernel code
Security for LLMs and AI/ML systems
SEC4LLM & AI/ML Security
RAG Security
We examine attacks on retrieval-augmented generation, including malicious or misleading retrieved content. Attacks and defences are compared under shared evaluation criteria.
- Retrieval Poisoning
- Prompt Injection
- Attack–Defence Evaluation
Related paper Security Analysis and Defense Comparison in RAG
IaC Agent Assurance
We evaluate AI-generated infrastructure-as-code beyond syntax and execution, asking whether it matches user intent and aligns with relevant security policies.
- Terraform
- Intent Alignment
- Security Policy Compliance
Current work Intent- and policy-aware evaluation of Terraform-generating agents
ROS 2 Agent Assurance
We develop execution-grounded evaluations for AI-generated ROS 2 software, covering build and launch success, interface correctness, and expected runtime behaviour.
- ROS 2
- Interface Correctness
- Runtime Validation
Related paper Evaluating Open-Source LLM Performance for ROS 2 Code Generation: An Execution-Centric Pilot Study
Federated Learning Security
We study privacy and integrity risks in federated learning, including inference, inversion, backdoor, and Byzantine attacks, together with practical defences.
- Privacy Leakage
- Byzantine Robustness
- Backdoor Defence
Related paper FLGuard: Byzantine-Robust Federated Learning via Ensemble of Contrastive Models