Research

Security of AI, from attack to defense

My research asks how machine learning systems can be compromised during training and use, and how to detect, measure and prevent it. Today the focus is healthcare: hospitals that train AI together, patient data, and the AI agents that will work with them.

Selected results

PARIS: robust federated learning · IEEE FLTA 2026, 2nd Best Paper Award
A defense that keeps federated learning robust when some participants send malicious or corrupted updates, designed with hospital federations in mind.

GHOST: backdoors that persist in federated learning · IEEE TIFS 2026
Shows how one malicious participant can keep a hidden behavior alive when hospital data differ from site to site. Knowing this is the first step to defenses that hold.

RoSe and Mixer: proving who owns a model · IEEE TDSC 2026 and ICASSP 2023, Top 3% paper
Black-box watermarking that lets a model owner verify ownership from the model outputs alone, with security that can be measured.

A backdoor attack without label poisoning · IEEE ICIP 2019, 700+ citations
One of the first clean-label backdoor attacks on CNNs: the training labels stay correct, so the poisoning is hard to spot.

Books

Trojan Code: Adversarial Machine Learning and Secure AI Systems · Springer, 2026 · Author
How AI systems are attacked and how to secure them, for engineers who build defenses and for the leaders who fund them.

Adversarial Multimedia Forensics · Springer, 2024 · Editor, with E. Nowroozi and A. Jolfaei

Information Fusion in Distributed Sensor Networks with Byzantines · Springer, 2021 · Co-author, with A. Abrardo, M. Barni and B. Tondi

Funded programs

On each program my role was researcher and key contributor, not principal investigator.

Awards and service