Research
Research agenda
One idea runs through all of it: safety is something a whole deployment has or doesn't have, not something a checkpoint has. A lab can sign off on the weights it releases. It can't sign off on the fine-tune, the quantization, or the agent someone builds around those weights a week later. I build the measurement tooling for that gap.
Threads
Open-weight & post-deployment safety
Once weights are public, a safety property either survives everything the world throws at it (fine-tuning, quantization, composition) or it doesn't really hold at all. There's no recall. So I want two things: probes you can run against any open-weight model to check whether someone has fine-tuned a safety behavior out of it, and training methods that reinforce the properties that actually stick. Read the threat model →
Compositional misalignment
Alignment gets tested on single models, but the world deploys compositions, and alignment doesn't compose in a straight line. My HCII 2026 paper shows this for multi-agent LLM systems: single-agent and multi-agent setups behave measurably differently on alignment. It's the thread I most want to pull on next.
Mechanistic interpretability & evaluation
Whichever intervention ends up winning, you still have to be able to measure it. I'm getting fluent in interpretability by actually doing it. Right now that's a causal, intra-trace analysis of why inverse scaling happens — what goes wrong inside a single reasoning chain when more thinking makes a model worse.
Inoculation against model poisoning
With Safe AI Germany, I'm testing whether data-level "antidote" datasets can contain emergent misalignment. The idea is to let a model absorb one narrow bad behavior without it spreading into broad misalignment, and then to see how that stacks up against representation- and weight-level defenses.