I’m a research engineer at Google, where I work on LLM post-training for specialized language models. Most of my time goes into reinforcement learning, knowledge distillation, and improving serving efficiency.
Before this, I worked on evaluation and quality hill-climbing for Gemini’s audio models in enterprise voice agents. Earlier, at Google Research, I spent six years building large-scale personalization and recommendation models across multiple product areas. I earned my Ph.D. in Computer Science at UCLA, working with Mani Srivastava on the adversarial robustness of language, vision, and speech models.
My mission is to help build a future where AI empowers people rather than replaces them—advancing education, helping cure diseases, and fostering a more prosperous and peaceful world for everyone. Outside of work, I love reading, camping, and photographing the night sky.
News
- Paper: New preprint: First-Order In-Context Shapley, scalable data auditing for LLM alignment and evaluation.
- Role: Started a new role at Google on LLM post-training for specialized language models: distillation, RL, and serving efficiency.
- Role: Joined Google Cloud AI to make Gemini audio models better for enterprise voice agents, turning customer feedback into new benchmarks and automatic evals.
- Paper: CALRec, on contrastive alignment of LLMs for sequential recommendation, appeared at RecSys 2024.
Experience
- Staff Research Engineer, LLM post-training, Google
- Staff Research Engineer, Gemini audio evaluation & quality for enterprise voice agents, Google Cloud AI
- Senior Research Engineer, Google Research
- Ph.D., Computer Science, UCLA
Writing
Selected papers
-
First-Order In-Context Shapley: Scalable Data Auditing for LLM Alignment and Evaluation We score each alignment training record by its first-order in-context influence on similar examples, using only forward passes, to flag label errors in HelpSteer2 and HH-RLHF.
Figure 1. Overview of the data valuation pipeline. Phase 1 constructs a directed k-NN graph weighted by one-shot log-likelihood shifts (ΔLL). Post-training alignment of Large Language Models is increasingly bottlenecked by data quality: preference and instruction-tuning corpora accumulate label noise, safety inversions, and inter-annotator contradictions that deduplication misses and full-corpus LLM judging cannot afford. While Data Shapley offers a principled valuation framework, exact computation requires intractable retraining, and embedding surrogates like KNN-Shapley fail to separate high- from low-utility demonstrations (ρ = 0.0003 with generative utility). We introduce an inference-only valuation pipeline that computes the first-order term of an in-context cooperative game over semantic k-NN neighborhoods in O(k) forward passes without parameter updates, correlating positively with multi-shot Monte-Carlo in-context Shapley on 100% of targets at 19x less compute. Projecting pairwise log-likelihood shifts onto a directed influence graph characterizes each record via three signals: outgoing Exemplifying Advantage, incoming Exemplified Advantage, and a topological One-of-a-Kind Score protecting rare prompts. Pre-filtering restricts LLM twin arbitration to 1%-5% of records while achieving 4.5x enrichment in confirmed errors on HelpSteer2 and 2.2x on Anthropic HH-RLHF, catching contradictions that zero-shot likelihood and margin filters miss. During DPO training, confirmed contradictions oppose the update far more often than clean records (56.7% vs. 37.0% in LoRA gradients) and stay below chance in reward accuracy. Finally, auditing the HH-RLHF benchmark exposes label errors where aligned models disagree with human labels 73%-83% of the time, and retraining DPO after repairing or filtering flagged records improves reward accuracy by +0.5%-0.6% overall and +3.1%-3.5% on repaired inversions, even without LLM arbitration.
-
CALRec: Contrastive Alignment of Generative LLMs for Sequential Recommendation We fine-tune an LLM for sequential recommendation in two stages (multi-domain, then target domain) with contrastive and language-modeling losses, improving Recall@1 by 37% over strong baselines.
Figure 1. CALRec: Training Framework. Traditional recommender systems such as matrix factorization methods have primarily focused on learning a shared dense embedding space to represent both items and user preferences. Subsequently, sequence models such as RNN, GRUs, and, recently, Transformers have emerged and excelled in the task of sequential recommendation. This task requires understanding the sequential structure present in users' historical interactions to predict the next item they may like. Building upon the success of Large Language Models (LLMs) in a variety of tasks, researchers have recently explored using LLMs that are pretrained on vast corpora of text for sequential recommendation. To use LLMs for sequential recommendation, both the history of user interactions and the model's prediction of the next item are expressed in text form. We propose CALRec, a two-stage LLM finetuning framework that finetunes a pretrained LLM in a two-tower fashion using a mixture of two contrastive losses and a language modeling loss: the LLM is first finetuned on a data mixture from multiple domains followed by another round of target domain finetuning. Our model significantly outperforms many state-of-the-art baselines (+37% in Recall@1 and +24% in NDCG@10) and our systematic ablation studies reveal that (i) both stages of finetuning are crucial, and, when combined, we achieve improved performance, and (ii) contrastive alignment is effective among the target domains explored in our experiments.
-
GenAttack: Practical Black-box Attacks with Gradient-Free Optimization GenAttack uses a genetic algorithm to craft black-box adversarial images from model queries alone, needing orders of magnitude fewer queries than ZOO and breaking several ImageNet defenses.
Figure 3. Adversarial example generated by GenAttack against the InceptionV3 model (L∞ = 0.05). Left figure: original, right figure: adversarial example. Deep neural networks are vulnerable to adversarial examples, even in the black-box setting, where the attacker is restricted solely to query access. Existing black-box approaches to generating adversarial examples typically require a significant number of queries, either for training a substitute network or performing gradient estimation. We introduce GenAttack, a gradient-free optimization technique that uses genetic algorithms for synthesizing adversarial examples in the black-box setting. Our experiments on different datasets (MNIST, CIFAR-10, and ImageNet) show that GenAttack can successfully generate visually imperceptible adversarial examples against state-of-the-art image recognition models with orders of magnitude fewer queries than previous approaches. Against MNIST and CIFAR-10 models, GenAttack required roughly 2,126 and 2,568 times fewer queries respectively, than ZOO, the prior state-of-the-art black-box attack. In order to scale up the attack to large-scale high-dimensional ImageNet models, we perform a series of optimizations that further improve the query efficiency of our attack leading to 237 times fewer queries against the Inception-v3 model than ZOO. Furthermore, we show that GenAttack can successfully attack some state-of-the-art ImageNet defenses, including ensemble adversarial training and non-differentiable or randomized input transformations. Our results suggest that evolutionary algorithms open up a promising area of research into effective black-box attacks.
-
Generating Natural Language Adversarial Examples A black-box population-based search swaps words for semantically similar ones to fool sentiment and entailment models (97% and 70% success), while human annotators still assign the original labels.
Table 1. Example of attack results for the sentiment analysis task. Modified words are highlighted in green and red for the original and adversarial texts, respectively. Deep neural networks (DNNs) are vulnerable to adversarial examples, perturbations to correctly classified examples which can cause the model to misclassify. In the image domain, these perturbations are often virtually indistinguishable to human perception, causing humans and state-of-the-art models to disagree. However, in the natural language domain, small perturbations are clearly perceptible, and the replacement of a single word can drastically alter the semantics of the document. Given these challenges, we use a black-box population-based optimization algorithm to generate semantically and syntactically similar adversarial examples that fool well-trained sentiment analysis and textual entailment models with success rates of 97% and 70%, respectively. We additionally demonstrate that 92.3% of the successful sentiment analysis adversarial examples are classified to their original label by 20 human annotators, and that the examples are perceptibly quite similar. Finally, we discuss an attempt to use adversarial training as a defense, but fail to yield improvement, demonstrating the strength and diversity of our adversarial examples. We hope our findings encourage researchers to pursue improving the robustness of DNNs in the natural language domain.