Research

Making machine learning and large-scale, real-world systems secure and trustworthy.

Time per polynomial product on the ESP32 for six cases. A tuned NTT is faster than the RSA unit in five; the RSA unit wins only ML-DSA c times s.

Polynomial products for post-quantum cryptography on the ESP32 RSA unit

Runs ML-KEM, ML-DSA and Falcon polynomial products on the chip's big-integer multiplier. 4.0 to 4.6x faster than the naive packed path, but a tuned NTT still wins five of six products, and whole operations take 0.91 to 1.38x PQClean's time.

code and data

Membership-inference attack AUC for five keyword-spotting models at int8 and 4-bit. All values sit between 0.51 and 0.53, near chance, and the two bit-widths nearly coincide.

Does 4-bit quantization change membership-inference leakage in keyword spotting?

Across five small models, loss-attack AUC stays at 0.513 to 0.533 with no detectable difference between int8 and 4-bit. Membership is assumed from the standard split, and the attacks are simple threshold attacks.

code and data

Mean accuracy against targeted bit flips for int8 models. DS-CNN-S falls to about the 15 percent target within 6 flips. TC-ResNet8 is still at 73 percent after 30 flips. Random flips leave accuracy near 94 percent.

Bit-flip attacks on microcontroller-scale keyword spotting

Targeted bit flips broke DS-CNN-S, reaching 15% accuracy in a mean of 5.3 to 8.0 flips, while TC-ResNet8 never got there within a 30-flip cap and random flips broke neither. Architecture mattered more than bit-width, and 4-bit weights did not reduce the flip count. White-box software simulation, with three seeds per setting.

code and data

Summed inference time for ten models: 171 seconds unoptimized, 102 with no copies, 63 with a direct driver, 44 with all changes, against 15 seconds on the CPU kernel.

Cryptonite: neural-network inference on the ESP32 RSA accelerator

Group course project. Runs keyword-spotting networks as big-integer multiplies on a real board. Data-path changes made it 3.93x faster across ten models, though still 0.33x the speed of an optimized CPU kernel.

Published signature sizes on a log scale: ES256 64 bytes, Falcon-512 666, ML-DSA-44 2,420, ML-DSA-65 3,309, SLH-DSA-128s 7,856 and SLH-DSA-128f 17,088, against the 1,300-byte limit for SIP over UDP.

Post-quantum signatures for STIR/SHAKEN in 5G

Post-quantum signatures are too large for SIP call setup, so simply replacing ECDSA in caller-ID authentication makes calls fail or slow down. This work develops a post-quantum design that matched today's ECDSA performance in testing on real SIP stacks, where the alternatives fall short.

Eight true MNIST digits above their reconstructions from gradients. The reconstructions are noise. The label was recovered on 40 of 40 images, and the median SSIM of the rebuilt image is 0.05.

Gradient inversion against a federated MNIST model

Trains a model with federated averaging, then attacks it. Scored against the true images, iDLG on single-image gradients recovered the label on 40 of 40 images but rarely the image: median SSIM 0.05, using one attempt per image with the repository's settings. The GAN attack's digits look cleaner, but its generator trains on MNIST itself, so they don't show leakage.

code

Illustration of a needle-free wristband sending readings to a phone, which shows a low blood sugar alert. No results yet.

Needle-less hypoglycemia detection wristband

In progress, expected April 2027

An affordable wristband that alerts a phone to low blood sugar without needles. No results yet; evaluation will be subject-independent.