I audit the things people
are afraid to look inside.

I wanted to know something simple: of the most-downloaded AI models in the world, how many can you actually verify?

I built QResP — an open-source Python package that crawls HuggingFace, parses every model’s cryptographic metadata, and classifies it by quantum vulnerability. Then I ran it on the top 1,000 models by all-time downloads.

99.8% carry no cryptographic signature at all. The two that do — IBM and OpenAI — both use ECDSA P-256. That’s broken by Shor’s algorithm. Post-quantum adoption: 0%.

I’ve mapped every finding to the EU AI Act’s provenance and technical documentation requirements. The gap between what the regulation asks for and what actually exists is, to put it mildly, substantial.

The tool is MIT-licensed and open. I thought it was important that anyone who wanted to check my work could.

The question was whether you could think about a compromised language model not as a broken artefact, but as an adversary in a well-defined game — and whether, if you framed it that way, you could prove something useful about how to catch it.

I led the game-theoretic component. We model the interaction between an auditor and a LoRA-poisoner as a two-player Stackelberg Security Game on Pythia-410M. My contribution was the equilibrium analysis: deriving the defender’s best response under attacker-type uncertainty, and the robustness proofs that make the audit policy meaningful rather than just elegant.

The ongoing extensions include a multi-type attacker model across six threat intensities, fairness benchmarks on COMPAS and Adult Income datasets, and scaling across Pythia 410M through 6.9B and Llama-2-7B/13B.

Phase one: implement Patch-based PGD and Greedy Coordinate Gradient attacks against SmolVLM as a VLA proxy, comparing image-space versus text-space attack difficulty. We achieved 76% untargeted and 34% targeted attack success rate.

Phase two — XTransferBench — was the more interesting question: do CLIP-trained universal adversarial perturbations transfer to VLA action prediction via SigLIP? Three open gaps in the literature, directly addressed.

The short answer is that they do, partially, in ways that are specific enough to matter.

The standard ELO model for tennis has been stuck below 70% accuracy on Grand Slam data for years. The literature ceiling from Wilkens 2021 sits at 70%.

We augmented standard ELO with a learned contextual shift — Ω = β₁F + β₂C + β₃B, where F is fatigue, C is clutch, and B is a biometric edge proxy — using a surface-specific XGBoost ensemble trained on 16,000+ Grand Slam matches from 1990 to 2024.

On a fully unbiased 2024 test set: 73.5% accuracy, AUC 0.818. Above the literature ceiling. I mention it because the methodology generalises to places tennis doesn’t.

A cross-institutional project on what surveillance-capable vision systems owe to the people they watch. The technical question is how to build re-identification that works without building a permanent record of everywhere someone has ever been.

I find it’s one of those problems where the engineering decisions are genuinely ethical decisions wearing different clothes.