Research

I study how to make software-intensive systems reliable and secure. My research begins with engineering practice: I study how software is built and used, identify where existing assumptions and engineering methods break down, and turn those findings into new methods, tools, and ways of engineering software.

I pursue this problem from several directions: understanding how software fails in practice; developing analysis and assurance methods that prevent failures; making dependencies and reused components easier to understand and govern; and studying how emerging technologies, including AI, change the way software is built and engineered.

My current research is organized around six programs.

Model-Based Agentic Software Engineering

How should we engineer software when implementation becomes abundant but engineering judgment remains scarce?

10 publications

Embedded Software Engineering

How can analysis and assurance become practical for embedded software?

10 publications

Failure-Aware Software Development

What can we learn from the ways software systems fail?

9 publications

Software Engineering for Pre-Trained Models

What changes about software engineering when the reused component is a learned model?

20 publications

Software Supply Chains

How can software reuse remain trustworthy at ecosystem scale?

17 publications

Regular Expression Engineering

What can small programs teach us about large software-engineering problems?

15 publications

Other research

My research also extends beyond these six programs, often through collaborations in which software-engineering questions intersect with other areas.

Software security, reliability, and systems. I have studied software security and reliability across areas including GraphQL, provenance, privacy, trust and safety, anti-phishing interventions, and software testing. Examples include:

Anti-Phishing Training (Still) Does Not Work: A Large-Scale Reproduction of Phishing Training Inefficacy Grounded in the NIST Phish Scale (WWW ’26)
Engineering Patterns for Trust and Safety on Social Media Platforms: A Case Study of Mastodon and Diaspora (JSS ’25)
A Principled Approach to GraphQL Query Cost Analysis (ESEC/FSE ’20)

Efficient computing systems. My work on efficient computing systems includes adaptive models, inference optimization, edge computing, and energy efficiency:

AdaPerceiver: Transformers with Adaptive Width, Depth, and Tokens (CVPR-Findings ’26)
Pruning One More Token is Enough: Leveraging Latency-Workload Non-Linearities for Vision Transformers on the Edge (WACV ’25)
EdgeWise: A Better Stream Processing Engine for the Edge (USENIX ATC ’19)

Engineering education. I study how software engineering and systems thinking can be taught through project-based learning and increasingly capable AI tools:

Introducing Systems Thinking as a Framework for Teaching and Assessing Threat Modeling Competency (ASEE ’24)
An Exploratory Study on Upper-Level Computing Students' Use of Large Language Models as Tools in a Semester-Long Project (ASEE ’24)

The complete record is on the Publications page.

Patents