Projects & demos

Research in motion

A field map of active and in-progress work, organized by the four research vectors that drive the lab: LLMs, autonomous agents, verification & reward design, and program analysis & AI safety.

LLMs for security reasoning

Active

Probing how large language models reason about code, exploits, and patches, from zero-shot detection to chain-of-thought patch synthesis and reproducible benchmark design.

DVDR-LLM paper preview
ICSE 2026 LLM4Code Detection · Repair

Diverse LLMs vs. Vulnerabilities

Zibaeirad, Arastoo, & Vieira, M.

A head-to-head comparison of diverse LLMs on detecting and fixing vulnerabilities, uncovering capability gaps between families.

PDF arXiv Venue

AI agents for autonomous vulnerability discovery

Active

Agent loops that read, instrument, and probe codebases. They plan experiments, execute tools (static analysis, fuzzing harnesses, dynamic tracing), and proposing exploit hypotheses without human prompting.

In-progress Agentic

Agent planner for autonomous code audit

Zibaeirad, Arastoo, & collaborators

Goal-directed tool use over real repositories: build, instrument, hypothesize, verify. Drafts in progress, follow this space.

Verification & reward design for software agents

In-progress

Training against verifiable rewards works when checking is free and exact. Security breaks that: sanitizers only see bugs that crash, and a model asked to grade another model can be talked into agreeing with a confident wrong answer. This line of work studies what sits in between.

In-progress Verification Reward design

Grounding the Reward — Verifiers for Security Reasoning

Zibaeirad, Arastoo, & collaborators

Three ways to check a security claim: run the code, ask another model, or demand a real dependency path through the program graph. Measuring what each one can cover, and how often each can be fooled when a model optimizes against it.

Program analysis & AI safety

Active

Static and dynamic analysis married to neural models: benchmarks, datasets, and adversarial stress tests that ground evaluation in real CVEs, with safety-conscious deployment in mind.