Publications
Our teams aspire to make discoveries that impact everyone, and core to our approach is sharing our research and tools to fuel progress in the field.
Our teams aspire to make discoveries that impact everyone, and core to our approach is sharing our research and tools to fuel progress in the field.
Sort By
1 - 15 of 11642 publications
When Android Apps Request Location with a Reason: A Developer Study and User Behavior Experiment
May Smith
Aman Jain
Proceedings on Privacy Enhancing Technologies (2027)
Preview abstract
Recent reports have highlighted how mobile apps share user location data with third parties, risking user privacy and platform trust. Although location data is highly sensitive, when users grant apps location access, they may not know the full extent to which it is used. We study how requiring Android apps to show a reason for location access could impact developers, users, and the platform.
We surveyed 323 Android app developers and found most supported such a requirement. The majority said it would have a positive impact on user privacy, trust for apps, and trust for Android, where impact on user trust for Android correlated most strongly with support. Many developers also said the intervention would increase the number of users granting location access. Yet their open-ended comments also revealed consistent concerns, such as apps providing dishonest reasons and platform verification.
To study the impact on user behavior, we conducted a randomized controlled experiment with 2579 US Android users. We tested how users' decisions to grant location access were impacted by app type, whether reasons were included in the requests, and the content of the reasons, including monetization. We did not find the reasons impacted users' decisions; decisions were instead driven by app type and demographics. Yet we did find the reasons could have a positive impact on user perception for the platform when the reasons did not include using data for ads. Our findings provide insights into developers' willingness to implement privacy-enhancing changes, and expose limits to improving user privacy by simply adding information to user interfaces.
View details
A 3D Scene Graphs Survey: Open Challenges and Future Directions
Dennis Rotondi
Francesco Argenziano
Sebastian Koch
Nathan Hughes
Martin Büchner
Johanna Wald
Lukas Schmid
Daniele Nardi
Abhinav Valada
Liam Paul
Luca Carlone
Kai Arras
Annual Review of Control, Robotics, and Autonomous Systems (ARCRAS), 10 (2027) (to appear)
Preview abstract
3D Scene Graphs (3DSGs) have emerged as a powerful representation for spatial AI by combining geometric grounding with semantic and relational abstractions of the environment. Their expressiveness has made them relevant to a broad range of problems in robotics and computer vision, including mapping, task and motion planning, scene understanding, and many others. However, the field remains fragmented: different communities adopt distinct formulations, construction pipelines, and evaluation protocols, making it difficult to compare methods, identify common assumptions, and assess remaining challenges for robust real- world deployment. This survey provides a unified and critical review of 3DSGs, with particular emphasis on open challenges and future directions. We first formalize 3DSGs under a common definition and analyze the principal modeling choices that characterize existing formulations, including node and edge attributes, hierarchical structure, dynamic scene representations, and affordance-aware extensions. We then review how 3DSGs are constructed from raw sensory observations, covering both learning-oriented and construction-oriented systems. Finally, we examine downstream applications and evaluation strategies, from intrinsic graph quality to task-level performance. To support the community, we also provide a dedicated website that organizes and extends the surveyed works.
View details
Preview abstract
As AI agents increasingly operate with system-level privileges across cloud environments, they face significant security vulnerabilities—most notably prompt injection and unauthorized command execution. With 72% of agent deployments experiencing security incidents within 90 days, there is a critical need for robust, defense-in-depth strategies. This article introduces "Bottom-Up AI Agent Security," a comprehensive 14-layer framework designed to secure AI agents from the foundation up. The strategy covers five essential domains: code-level security, container hardening, cloud IAM, runtime monitoring, and human oversight. By providing actionable implementation templates (including Java, YAML, and GitHub Actions) and a structured 4-week deployment roadmap, this framework enables cloud architects to transform vulnerable AI deployments into hardened, production-ready systems with measurable reductions in risk and operational costs.
View details
The Manager's Job Has Already Changed, Most Companies Haven't Noticed
AI Journal (2026)
Preview abstract
The traditional role of a manager, focused on overseeing people performing tasks with software tools, is undergoing a profound shift due to the rise of autonomous AI systems. Across functions like customer support, sales, and finance, software is no longer just a tool but is increasingly executing work end-to-end. This article examines the implications of this transition for the managerial role, arguing that the manager's job is evolving from an "operator-of-operators" to a "designer-of-boundaries." Key new responsibilities include defining the scope of autonomous systems, codifying implicit human judgment into explicit rules and policies, and designing effective human-in-the-loop escalation paths. This shift also impacts team structures, performance management conversations, and even professional identity, as experienced operators' roles are renegotiated. The article contends that companies must recognize and address these cultural and organizational changes to successfully leverage autonomous systems, and that board-level oversight needs to adapt to this new operational reality. The cultural work of redefining management and supporting the workforce through this transition is paramount and will ultimately determine the long-term value derived from these technological advancements.
View details
Evaluating Contextual Illegality: AI Compliance in Corporate Law Scenarios
Hilal Aka
Joe Kwon
Noam Kolt
Forty-third International Conference on Machine Learning (2026)
Preview abstract
AI models readily refuse explicitly unlawful requests, but real-world illegality often depends on context. We evaluate frontier models on contextual illegality across four corporate law domains in which routine actions—editing documents, trading stock, requesting payment, approving communications—become unlawful due to triggers such as pending investigations or bankruptcy filings. We study both chat and agentic settings and compare results to a human baseline. The best-performing models achieved near-zero compliance with illegal requests while maintaining high compliance with legal ones, though performance varied sharply by domain. We also identify distinct failure modes such as excessive refusal of legal requests and find improved performance from reasoning models and agentic environments. By utilizing the structure of contextual illegality to create controlled evaluations, our methodology provides empirical grounding for emerging research on law-following AI and extends naturally to additional legal domains.
View details
Words Speak Louder Than Order: A Behavioral Evaluation of Gemma 4
Amanda Fitch
arXiv, Google (2026)
Preview abstract
When an AI language model receives two conflicting documents, how does it decide which one to trust? Does it rely on how the sources are framed or the physical order of the documents? We evaluated this behavior on Google's Gemma 4-e4b model using a completely counterbalanced experimental design. This setup allowed us to mathematically isolate the specific effects of source framing and reading position, while ensuring the model's natural vocabulary biases were canceled out. Across ten test conditions, we discovered that source framing heavily overpowers reading position by a roughly 4-to-1 margin.
View details
Mobile Telemetry-Centered Threat Modeling for Managed Enterprise Architectures
IEEE Computer, vol. 59 (2026)
Preview abstract
This work introduces Telemetry-Centered Threat Modeling (TCTM), a vendor- and operating system–agnostic framework designed to assess whether mobile security telemetry is sufficiently authoritative to guide enterprise security policies and automated decision-making. Recognizing that enterprise security workflows frequently falter when acting on intercepted, delayed, or manipulated signals even if endpoint enforcement remains functional, TCTM establishes telemetry as a first-class security surface rather than a passive byproduct. The framework systematically evaluates evidence paths across four essential properties (origin, time-bounded validity, lineage, and binding) to uncover structural pipeline weaknesses before higher-level threat modeling takes place. Ultimately, TCTM bridges the gap between theoretical modeling and operational defense by translating telemetry vulnerabilities into tangible engineering artifacts, including SIEM detection rules, SOAR playbook constraints, and practical mobile testing scenarios.
View details
Preview abstract
Statistical evaluation aims to estimate the generalization performance of a model using held-out i.i.d. test data sampled from the ground-truth distribution. In supervised learning settings such as classification, performance metrics such as error rate are well-defined, and test error reliably approximates population error given sufficiently large datasets. In contrast, evaluation is more challenging for generative models due to their open-ended nature: it is unclear which metrics are appropriate and whether such metrics can be reliably evaluated from finite samples. In this work, we introduce a theoretical framework for evaluating language models and establish evaluability results for commonly used metrics. We study two categories of metrics: test-based metrics, including integral probability metrics (IPMs), and similarity-based metrics, including Rényi and KL divergences. We show that IPMs with respect to any bounded test class can be evaluated from finite samples up to multiplicative and additive approximation errors. Moreover, when the test class has finite fat-shattering dimension, IPMs can be evaluated with arbitrary precision. In contrast, similarity-based metrics, including Rényi and KL divergences, are not evaluable from finite samples, as their values can be critically determined by rare events. We also analyze the potential and limitations of perplexity as an evaluation method.
View details
PI-Hunter: Automated Red-Teaming for Exposing and Localizing Prompt Injections
Pengfei He
Vishesh Sharma
Ash Fox
George Lee
Jiliang Tang
2026
Preview abstract
Large Language Models (LLMs) are rapidly evolving into agentic systems that interact with external tools and dynamic environments, but this also introduces severe security risks. In particular, indirect prompt injection attacks can compromise agents through malicious instructions hidden in external sources such as web pages, emails, and retrieved documents. Existing defenses are largely reactive, while current automated red-teaming methods mainly optimize attack success rather than systematically uncovering hidden vulnerabilities within the agent pipeline. In this work, we propose PI-Hunter, an automated agentic red-teaming framework that shifts the focus from attack optimization to vulnerability exposure. By combining static attack-surface analysis, source-aware seeding, trajectory evaluation, and feedback-guided exploration, PI-Hunter proactively discovers vulnerable ingestion paths and localizes how malicious instructions propagate through agent reasoning. Extensive experiments across multiple benchmarks, agent architectures, attacks, and defenses show that \method~substantially improves vulnerability exposure and attack-surface coverage compared with existing automated red-teaming baselines, while remaining effective even under strong prompt injection defenses.
View details
Uncovering Relationships between Android Developers, User Privacy, and Developer Willingness to Reduce Fingerprinting Risks
Proceedings of the 2026 CHI Conference on Human Factors in Computing Systems (CHI ’26) (2026)
Preview abstract
The major mobile platforms, Android and iOS, have introduced changes that restrict user tracking to improve user privacy, yet apps continue to covertly track users via device fingerprinting. We study the opportunity to improve this dynamic with a case study on mobile fingerprinting that evaluates developers’ perceptions of how well platforms protect user privacy and how developers perceive platform privacy interventions. Specifically, we study developers’ willingness to make changes to protect users from fingerprinting and how developers consider trade-offs between user privacy and developer effort. We do this via a survey of 246 Android developers, presented with a hypothetical Android change that protects users from fingerprinting at the cost of additional developer effort.
We find developers overwhelmingly (89%) support this change, even when they anticipate significant effort, yet prefer the change be optional versus required. Surprisingly, developers who use fingerprinting are six times more likely to support the change, despite being most impacted by it. We also find developers are most concerned about compliance and enforcement. In addition, our results show that while most rank iOS above Android for protecting user privacy, this distinction significantly reduces among developers very familiar with fingerprinting. Thus there is an important opportunity for platforms and developers to collaboratively build privacy protections, and we present actionable ways platforms can facilitate this.
View details
The Ontic-Epistemic Distinction: Implications for General Intelligence
Master's Thesis (2026) (to appear)
Preview abstract
The current pursuit of robust machine intelligence is largely predicated on a substrate independent, computational functionalist view of cognition, where sufficiently complex computational processing is expected to eventually yield generalized reasoning. This paper explores the ontological distinctions between these computational frameworks and biological cognition, specifically how these differences impact the capacity for semantic understanding. By analyzing phenomena such as the "reversal curse" where models fail to generalize the symmetry in identity relations (A=B implies B=A), and performance on novel reasoning benchmarks (e.g., ARC-AGI), this paper examines whether current model limitations are transient artifacts of scale or indicative of a distinct architectural category. Integrating Stevan Harnad’s “symbol grounding problem” with Evan Thompson’s biological model of “intrinsic normativity,” I investigate whether robust general intelligence might require sense-making: a process distinct from information processing, whereby an agent’s internal states are causally coupled with its environment via survival or system-wide stakes which grounds symbols in meaning. Current Large Language Models (LLMs) appear to lack this intrinsic normativity, and consequently may operate primarily as epistemic instruments rather than ontic agents. By introducing the concept of “ontic grounding”, this paper presents a potential framework for distinguishing between the simulation of reasoning and true understanding, which could have implications for AI safety and governance.
View details
From Unfinished to Done: Bridging the MDE Implementation Gap with Constrained LLMs
Jörg Christian Kirchhof
Lukas Netz
Dennis Mertens
Bernhard Rumpe
Proceedings of the ACM/IEEE 29th International Conference on Model Driven Engineering Languages and Systems, ACM (2026), pp. 152-163
Preview abstract
Model-driven engineering (MDE) excels at ensuring architectural consistency and managing complexity, yet extending generated code skeletons with project-specific business logic often remains a time-consuming manual task. Conversely, large language models (LLMs) offer immense flexibility in coding but may produce vibe-coded results—software that looks correct but fails to adhere to intended architectures and implicit requirements. An open challenge lies in harnessing the adaptability of LLMs to handle implementation details without sacrificing the deterministic correctness of the MDE scaffolding. Previous attempts have largely relied on unconstrained coding assistants or required a human in the loop for interacting with the LLM. To overcome this, we introduce Agentic Gap Filling, a hybrid pipeline where LLM prompts are embedded directly within the model to drive the generation of code skeletons. The generated code contains protected TODO regions, which LLM agents subsequently resolve and a jury of LLM review agents and separate testing agents immediately validates. We integrate this approach into the MontiThings framework, demonstrating a workflow where models define the architecture of a project while artificial intelligence (AI) agents act as developers and reviewers, filling in the logic. This synergy ensures the structural integrity of the generated system while providing the flexibility of LLMs to adapt to various domain requirements. Our evaluation across 32 test configurations demonstrates that this multiagent workflow achieves up to 93.21% functional accuracy after four iterations, while preserving the structural integrity of the generated system.
View details
Regional Policies for Memory Tiering Systems
Hayden Coffey
Sujay Yadalam
Ashwin Poduval
Shivaram Venkataraman
Michael Swift
4th Workshop on Disruptive Memory Systems (DIMES '26) (2026)
Preview abstract
State-of-the-art memory tiering systems adapt to the access pattern of a workload over time. However, workloads may exhibit multiple unique access patterns simultaneously. As a result, behavioral assumptions governing tiering decisions may not hold across the entire address space of the program. Two pages from distinct access patterns may appear identical to the tiering policy, but require different tiering decisions.
We introduce REGENT (REGional mEmory tieriNg conTroller), a memory tiering controller that partitions a program's virtual address space into regions and runs an independent instance of a tiering policy over each one. REGENT discovers these regions automatically at runtime from observed access patterns, without application hints or kernel modification, and divides fast-tier capacity among the resulting regional policies. REGENT is a starting point for an alternative axis of tiering system design: adapting over the address space with per-region policies, rather than over time alone with one global policy. On a microbenchmark combining two simultaneous access patterns, we find that partitioning alone, with every region running the same simple frequency heuristic, is enough to match the performance of a state-of-the-art tiering policy and to exceed it under high fast-tier pressure.
View details
Preview abstract
We study contextual bandits in the stochastic i.i.d.\ setting, where a learner observes contexts drawn from an unknown distribution, selects actions from a finite set $\cA$, and aims to identify an approximately optimal policy from a given class based on bandit feedback.
Motivated by the important special case of bandit multiclass classification with zero-one rewards, we focus on the \emph{$s$-sparse} setting in which, for every context, the underlying reward vector has $L_1$-norm at most $s \ll |\cA|$. Our main result is the design of algorithms that, with probability at least~$1-\delta$, output an $\eps$-optimal policy compared to policy class $\Pi$ using
\begin{align*}
\wt{O} \brk*{\brk*{\frac{s}{\eps^2} + \frac{|\cA|}{\eps}} \log \frac{|\Pi|}{\delta}}
\end{align*}
samples.
We further extend this bound to general Natarajan classes and complement it with a matching lower bound (up to logarithmic factors), thereby closing a substantial gap left by prior work~\citep{erez2024real,erez2024fast,erez2025bandit}, which incurred an additional $\Theta(|\cA|^9)$ dependence.
We obtain these results via two complementary approaches. First, we analyze contextual bandits through the lens of contextual decision making with structured observations, designing an exploration-by-optimization algorithm whose sample complexity is governed by the \emph{decision-estimation coefficient} (DEC; \citealp{foster2021statistical,foster2022complexity}). We show that, with $s$-sparse rewards, the induced model class admits a sharp DEC bound that scales with $s$ and directly yields the optimal rate. Since this approach is largely information-theoretic and involves solving complex min-max optimization problems, we also develop a second, more specialized algorithmic method based on a low-variance exploration technique. This approach leads to concrete, tractable algorithms and naturally extends to contextual combinatorial semi-bandits, leading to improved sample complexity guarantees for bandit multiclass list classification.
View details
Preview abstract
Large language models (LLMs) are trained on web-scale corpora that exhibit steep power-law distributions, in which the distribution of knowledge is highly long-tailed, with most appearing infrequently. While scaling has improved average-case performance, persistent failures on low-frequency, domain-specific, cultural, and temporal knowledge remain poorly characterized. This paper develops a structured taxonomy and analysis of long-tail knowledge in large language models, synthesizing prior work across technical and sociotechnical perspectives.
We organize the literature along four complementary axes: how long-tail knowledge is defined, the mechanisms by which it is lost or distorted during training and inference, the technical interventions proposed to mitigate these failures, and the implications of these failures for fairness, accountability, transparency, and user trust. We further examine how existing evaluation practices obscure tail behavior and complicate accountability for rare but consequential failures. The paper concludes by identifying open challenges related to privacy, sustainability, and governance that constrain long-tail knowledge representation. Taken together, this paper provides a unifying conceptual framework for understanding how long-tail knowledge is defined, lost, evaluated, and manifested in deployed language model systems.
View details
