Ankush Achwani

Computer Engineering senior at UMass Amherst. Securing machine learning and large-scale, real-world systems.

I'm a senior in Computer Engineering at UMass Amherst (Commonwealth Honors College). I'm interested in making machine learning and other large-scale, real-world systems secure and trustworthy, from cellular networks and phone infrastructure down to small devices. So far I've worked on post-quantum security for 5G and embedded devices, attacks on small quantized models, and embedded ML for health sensing. I also TA and coordinate courses in probability, ML math, and security, and I'm cofounder and CTO of StageLink. I'm applying to PhD programs for Fall 2027.

Email / CV / GitHub / LinkedIn

aachwani [at] umass [dot] edu  ยท  ankushachwani [at] gmail [dot] com

Portrait of Ankush Achwani

Selected work

Published signature sizes on a log scale: ES256 64 bytes, Falcon-512 666, ML-DSA-44 2,420, ML-DSA-65 3,309, SLH-DSA-128s 7,856 and SLH-DSA-128f 17,088, against the 1,300-byte limit for SIP over UDP.

Post-quantum signatures for STIR/SHAKEN in 5G

Post-quantum signatures are too large for SIP call setup, so simply replacing ECDSA in caller-ID authentication makes calls fail or slow down. This work develops a post-quantum design that matched today's ECDSA performance in testing on real SIP stacks, where the alternatives fall short.

Time per polynomial product on the ESP32 for six cases. A tuned NTT is faster than the RSA unit in five; the RSA unit wins only ML-DSA c times s.

Polynomial products for post-quantum cryptography on the ESP32 RSA unit

Runs ML-KEM, ML-DSA and Falcon products on the chip's big-integer multiplier. 4.0 to 4.6x faster than the naive packed path, but a tuned NTT still wins five of six products.

code and data

Mean accuracy against targeted bit flips for int8 models. DS-CNN-S falls to about the 15 percent target within 6 flips. TC-ResNet8 is still at 73 percent after 30 flips. Random flips leave accuracy near 94 percent.

Bit-flip attacks on microcontroller-scale keyword spotting

Targeted bit flips broke DS-CNN-S in a mean of 5.3 to 8.0 flips, while TC-ResNet8 held out past a 30-flip cap. Architecture mattered more than bit-width. White-box software simulation.

code and data

Membership-inference attack AUC for five keyword-spotting models at int8 and 4-bit. All values sit between 0.51 and 0.53, near chance, and the two bit-widths nearly coincide.

Does 4-bit quantization change membership-inference leakage in keyword spotting?

Across five small models, loss-attack AUC stays at 0.513 to 0.533 with no detectable difference between int8 and 4-bit. Membership is assumed from the standard split.

code and data

Eight true MNIST digits above their reconstructions from gradients. The reconstructions are noise. The label was recovered on 40 of 40 images, and the median SSIM of the rebuilt image is 0.05.

Gradient inversion against a federated MNIST model

Trains a model with federated averaging, then attacks it. iDLG recovered the label on 40 of 40 images but rarely the image, with a median SSIM of 0.05.

code

Summed inference time for ten models: 171 seconds unoptimized, 102 with no copies, 63 with a direct driver, 44 with all changes, against 15 seconds on the CPU kernel.

Cryptonite: neural-network inference on the ESP32 RSA accelerator

Group course project. Runs keyword-spotting networks as big-integer multiplies. Data-path changes made it 3.93x faster across ten models, though still 0.33x the speed of an optimized CPU kernel.

Still from the StageLink video: the logo, the line Your booking agent, in software, and a dashboard with demo data.

StageLink

Artist app live, access by waitlist

Booking and show-running software for live music, with an artist side and a venue side on one system, so one booking stays a single thread from first pitch to final payout. The artist app is live; the venue app is built and not yet released.

join the waitlist / video, 10 s

News