Safety Research Lead, Foundation Model · TikTok
I lead foundation-model safety research at TikTok, working to make safety a capability models learn and retain. Together with research, engineering, and policy teams, I build the data, training, and evaluation systems that put this research into practice.
Ph.D. in Computer Engineering, Virginia Tech, advised by Ruoxi Jia.
Our earlier work showed that fine-tuning can undo alignment. I study safety across the full model lifecycle: how it is learned from data during pretraining and mid-training, shaped by post-training, and retained through adaptation. Evaluation and deployment feedback guide the next round of data and training.
Across all model stages
The flywheel connects platform-wide data with foundation-model training and evaluation. Shared infrastructure supports data discovery, curation, and coverage analysis for both general capabilities and safety; evaluation gaps guide the next round of data development.
A platform-wide data flywheel supporting general model capabilities and safety. Concept illustration, without specific data sources, implementation details, or measured results.
Related research
I study how safety understanding can develop alongside general knowledge. This research treats pretraining as a place to learn safety capabilities, and evaluation as a way to distinguish those capabilities from refusal alone.
The research question of learning safety alongside knowledge. This is not a training recipe or an experimental result.
Related research
I co-developed an α-divergence dial for post-training: choose how strongly learning concentrates on a few high-reward responses or covers a broader range. Tests across reasoning, agentic tasks, and safety show that the useful setting depends on the task and reference model.
A conceptual view of post-training geometry, not an original paper figure or a universally optimal setting. Conference listing
Related research
Earlier work on fine-tuning safety raised a practical question: how can a model learn new tasks without losing useful behavior? I proposed the method, co-developed it with a research intern, and directed the experimental design.
The question of capability retention during adaptation. No method implementation or measured outcome is depicted.
Related research
Refusal scores capture only part of safety. Pan-Safety connects risk understanding, generation, agent behavior, and robustness in a shared evaluation framework. We also study whether signals from mid-training checkpoints can predict how training approaches rank on safety behavior after post-training, so training decisions can be informed earlier.
Connected research dimensions, not model scores, institutional comparisons, or an exhaustive safety taxonomy.
Related research
Our post-training work focuses on increasing the models' propensity to generate attacks and improving attack quality across diverse target models. Evaluation checks whether those attacks reveal genuine target-model failures.
A functional red-teaming loop. The illustration does not encode attack results.
Related research
My work spans misuse, persuasion-related behavior, political bias, and agentic evaluation. Each asks a different measurement question; a model response, an action in an environment, and an effect on a person are not interchangeable evidence.
Distinct measurement questions inform risk review. The illustration names no data sources and reports no results.
Related research
I connected regional safety requirements to alignment data and model evaluation, including work on bias mitigation and deliberative alignment. That production experience shaped my current focus on how safety is learned throughout training.
The alignment workflow, not a claim of universal safety or legal compliance.
Related research
NeurIPS / Accepted / Conference listing
An α-divergence dial controls whether post-training concentrates on a few high-reward responses or preserves broader support. The useful setting depends on the task and reference model.
TMLR
Do models follow their own developers' rules? An automated audit compares published specifications, model responses, and the developers' own models as judges, revealing gaps between stated and observed behavior.
NeurIPS
A red-teaming agent generates and runs tests while a second agent integrates new attacks from research. Memory-guided selection lets the system reuse what it learns as threats evolve.
ICLR / Spotlight
Turns risks specified in government regulations and company policies into a shared taxonomy and safety benchmark, making gaps in model coverage easier to compare across jurisdictions.
ICLR
Balances unsafe topics and varies how requests are phrased to make refusal evaluation more systematic. Human annotations also support smaller, less costly automated judges.
ICLR / Oral
Even fine-tuning on benign, commonly used datasets can erode safety alignment. The findings show why safety needs to be checked through model adaptation, not only before release.
ACL / Best Social Impact Paper
Uses social-science persuasion techniques to construct readable jailbreaks. These attacks expose weaknesses in safeguards that can miss harmful intent when it is wrapped in convincing language.
NeurIPS / Datasets and Benchmarks
Tests risky code generation and execution in code agents. Execution tests inspect what actually happens in a sandbox, so evaluation goes beyond whether an agent says it will refuse.
ICML
Proposes legal and technical protections for independent, good-faith AI evaluation, so researchers can investigate failures without risking account suspension or legal reprisal.
EMNLP
Uses adversarial embedding perturbations to expose safety backdoors, then fine-tunes on safe responses to mitigate them without needing to know the hidden trigger.
NeurIPS
Treats conflicts between demographic groups' learning signals as a bargaining problem. A two-stage method first reconciles those signals, then optimizes the chosen fairness objective.
USENIX Security
Many poisoning defenses assume they already have trusted data. Meta-Sift addresses that missing first step by selecting a clean reference subset from a potentially contaminated dataset.
ACM CCS
Shows that correctly labeled data can still implant a backdoor, even when the attacker knows only examples from one target class. The findings expose a gap between label correctness and training-data integrity.
USENIX Security
Separates poisoned training examples from clean data by inducing different model responses. The detection framework works across supervised, self-supervised, and transfer learning.
ICML
Data-free distillation can pass a teacher's backdoor to its student. A plug-in defense limits that transfer while preserving useful task knowledge.
ICLR
Certifies robustness against a perturbation shared across many inputs, rather than treating each input independently. This gives tighter guarantees for universal attacks and a way to analyze backdoor behavior.
NeurIPS
Traces generated images to a candidate model by measuring how well it can reconstruct them. Attribution requires neither a watermark nor changes to the model's training or generation process.
ICLR / Spotlight
Values training data before a downstream learning algorithm is chosen. An optimal-transport formulation identifies noisy, mislabeled, and poisoned examples without repeatedly training a model to score each point.
TMLR
Uses model inversion to reconstruct reference data for backdoor removal when clean training-distribution samples are unavailable. Stable model predictions, not visual similarity alone, make the reconstructed data useful for defense.
ICLR
Removes learned backdoors using a small clean dataset. Implicit gradients couple the search for adversarial behavior with the model updates that unlearn it.
NeurIPS
Embeds conditional watermarks in text-generation API outputs to help identify imitation models. The design limits changes to generated text and makes the watermark harder to detect through word-frequency statistics.
ICCV
Finds high-frequency artifacts in many backdoor triggers and uses them for detection. Studying smoother triggers then reveals where frequency-based defenses can fail.
IJCAI
Tests model-ownership watermarks under input transformations and limited fine-tuning. The results motivate watermark augmentation to make ownership checks harder to evade.
ACM ASIA CCS
Systematically tests data augmentation for backdoor defense. Combining model fine-tuning with input preprocessing helps weaken learned backdoors and disrupt their triggers at inference.