Texas A&M University
Ph.D. Student, Computer Science & Engineering Graduate Researcher, Texas A&M Cybersecurity Center
I study how AI systems fail under attack, and how to measure those failures honestly. My current work red-teams the defenses placed in front of large language models: prompt-injection detectors, and the LLM judges they hand uncertain inputs to. I also study how far LLM judges and the uncertainty signals in retrieval-augmented generation can be trusted. Before that I worked on industrial control system security, building digital-twin testbeds for intrusion-detection research and machine-learning detectors for threats in operational-technology networks.
I am advised by Dr. J. A. “Drew” Hamilton at the Texas A&M Cybersecurity Center.
Most of my current work is on the security and evaluation of LLM systems. It grew out of earlier work on cyber-physical systems, where the question was also how a detector holds up once an adversary knows it is there.
Prompt-injection defenses are usually evaluated against attacks that were never aimed at them. I build the defenses and then attack them with white-box gradient search, black-box query search, and paraphrase attacks. The target is not only the detector but the whole pipeline around it, including the gates that decide when an expensive LLM judge is consulted.
LLM judges and uncertainty scores are increasingly the instruments that other results are measured with. I study when those instruments can be trusted: how judges behave when the evidence is buried in ordinary text, and whether disagreement among retrieved sources predicts a wrong answer in retrieval-augmented generation. That work runs on frozen protocols, paired controls, and blinded human review.
Attack traffic cannot be injected into a running plant, so I built digital-twin software that reproduces SCADA networks faithfully enough to test intrusion detection on. I have evaluated learned and similarity-based detectors for advanced persistent threats in industrial control networks, and contributed to a post-quantum protocol for satellite links that must also survive radiation-induced faults.
Peer-reviewed conference papers. A current list is also on Google Scholar.
2026
2025
39th ACM SIGSIM Conference on Principles of Advanced Discrete Simulation (SIGSIM-PADS) · 2025 · pp. 83–87
2024
2024 Cyber Awareness and Research Symposium (CARS) · 2024 · pp. 1–5
Research code and tooling. Code for papers in preparation is released alongside them.
A prompt-injection pre-filter for retrieval-augmented generation that scores documents from attention-entropy features of a frozen Longformer, packaged with the adaptive-attack suite that breaks it: white-box GCG through a differentiable surrogate, black-box query search, and paraphrase attacks. The README reports where it fails and lists the evaluation bugs found and fixed after the original runs.
Runs a 27B-parameter open model on a single GPU through llama.cpp, with multi-token-prediction speculative decoding, settings sized to the card's VRAM, and an OpenAI-compatible endpoint that the Cursor IDE can use.
PSAA 608: Cybersecurity Policy Issues & Operations Guest instructor, Bush School of Government & Public Service. I wrote the course's six hands-on labs from scratch (Linux, steganography, metadata forensics, password cracking, disk forensics, packet-capture analysis) with their datasets and answer keys, built the course VMs, and teach 8 of the 15 weeks.
CSCE 489/712: Digital Forensics Teaching assistant. I build the graded assignments: forensic evidence with planted ground truth, a blinded steganalysis benchmark that mixes classical and LLM-generated payloads, and hidden tests.
Capstone and competition mentoring Mentor undergraduate capstone teams on U.S. Space Force-sponsored projects. As Blue Team Officer of the Texas A&M Cybersecurity Club, lead and train teams for CCDC, NSA NCX, and DOE CyberForce.
Occasional writing on methodology, tooling, and results that do not belong in a paper: negative results, testbed notes, and reproducibility details.