Current funded research appears first, followed by selected research projects and their associated publications, artifacts, or demonstrations.
Research challenge: Critical-infrastructure IoT devices often use custom firmware that is difficult to validate at scale, creating risks involving functional correctness, software vulnerabilities, and hardware incompatibility.
Project direction: The project develops a hardware-aware LLM verification framework for IoT firmware. The funded project description organizes the approach across input-level optimization, representation-level graph/semantic reasoning, and system-level integration with external security scanners and hardware simulators.
Research challenge: Mobile LLM agents interact with applications, notifications, third-party SDKs, and privileged system resources. These interactions can expose agents to adversarial inputs and confused-deputy behavior across application boundaries.
Project direction: The funded project studies automated generation of realistic adversarial scenarios, principled measurement of agent misbehavior, and graph-based runtime defenses for detecting and mitigating confused-deputy behavior.
Research challenge: AI agents act on a user's behalf: reading files, checking accounts, sending messages, and moving money. Instructions hidden in the content they read can redirect them toward an attacker's goal, and sometimes the attacker writes the request itself. Existing safeguards either trust the user's request as the standard for good behavior or rely on another AI to judge, which the same hidden instructions can fool, and neither bounds how often legitimate work is wrongly interrupted.
Approach: A lightweight checker steps in before every action the agent proposes. It trusts nothing it sees and instead scores the path that led to the action, represented as a connected map of past steps showing order, tool responses, and where earlier information reappears. The risk score only accumulates: low risk proceeds, rising risk is flagged, and high risk is stopped before harm occurs. Thresholds are calibrated in advance on harmless runs so that interruptions of normal work stay rare.
Associated paper: Under double-blind review.
Research challenge: Mobile LLM agents act with user-granted authority while processing content from advertisements, messages, and third-party applications. This work formalizes security-UI preconditioning, in which untrusted content predicts a future protected event, such as a TLS privacy warning or an installation confirmation, frames it as expected, and prescribes a crossing action before the event appears. The warning itself stays authentic. An audit of 437 released mobile-agent traces shows that authentic security UI can interrupt a diverted trajectory, but also that a safe response can fail during execution and be followed by replanning toward a crossing action.
Approach: Prospective Security-Event Taint (PSET) records prospective claims from untrusted content together with their source in trusted state, matches them against later protected events, and, when a matching claim prescribes a crossing action, removes that event's crossing actions from the agent's autonomous choices and escalates. A deterministic reference implementation over four protected-event classes produces the specified decision in all six controlled validation cases. A six-condition protocol for controlled causal evaluation is defined and left to future work.
Associated paper: M. Nazzal, M. Rabiu, and Y. Xiao, “Trusted Warnings, Untrusted Context: Security-UI Preconditioning in Mobile LLM Agents,” AAAI 2026 Fall Symposium on Trustworthy Agentic Systems (TAS 2026), Arlington, VA, USA, Nov. 2026. [Accepted]
Research challenge: LLM-generated code can be functional while still containing security vulnerabilities.
Approach: PromSec develops prompt optimization for secure and functional code generation.
Associated paper: M. Nazzal, I. Khalil, A. Khreishah, and N. H. Phan, “PromSec: Prompt Optimization for Secure Generation of Functional Source Code with Large Language Models (LLMs),” 31st ACM Conference on Computer and Communications Security (CCS 2024), Salt Lake City, UT, USA, Oct. 2024. [Acceptance rate: 16.7%] [Covered by a U.S. provisional patent.]
Research challenge: Graph-based malicious-domain detectors can be targeted by coordinated changes to multiple attacker-controlled entities.
Approach: MintA studies black-box multi-instance evasion against GNN-based malicious-domain detection and evaluates the attack against defenses including outlier detection and graph purification.
Associated paper: M. Nazzal, I. Khalil, A. Khreishah, N. H. Phan, and Y. Ma, “Multi-Instance Adversarial Attack on GNN-Based Malicious Domain Detection,” 45th IEEE Symposium on Security and Privacy (IEEE S&P 2024), San Francisco, CA, USA, May 2024. [Acceptance rate: 17.8%]
Research challenge: Deepfake detection requires methods that can leverage complementary visual and semantic evidence while remaining robust across manipulation types.
Approach: ViGText combines vision-language model explanations with graph neural networks for deepfake image detection.
Associated paper: A. Al-Barqawi, M. Nazzal, I. Khalil, A. Khreishah, and N. H. Phan, “ViGText: Deepfake Image Detection with Vision-Language Model Explanations and Graph Neural Networks,” 33rd Network and Distributed System Security Symposium (NDSS 2026), San Diego, CA, USA, Feb. 2026. [Acceptance rate: 16–18%]
Research direction: Explore LLM-based methods and datasets for artificial-intelligence accelerator design generation.
Selected outcomes: FedChip studies federated LLMs for AI accelerator chip design; SA-DS provides a dataset for LLM-driven AI accelerator design generation.
Associated paper(s): M. Nazzal*, K. Nguyen*, D. Vungarala*, R. Zand, H. Phan, A. Khreishah, and S. Angizi, “FedChip: Federated LLM for Artificial Intelligence Accelerator Chip Design,” IEEE International Conference on LLM-Aided Design (ICLAD 2025), Stanford University, Stanford, CA, Jun. 2025.
D. Vungarala*, M. Nazzal*, M. Morsali, C. Zhang, A. Ghosh, A. Khreishah, and S. Angizi, “SA-DS: A Dataset for Large Language Model-Driven AI Accelerator Design Generation,” 58th IEEE International Symposium on Circuits and Systems (IEEE ISCAS), London, UK, May 2025.
(*Equal contribution)
Research direction: Edge-computing inference with heterogeneous graph neural networks for traffic demand forecasting.
Associated paper: M. Nazzal, A. Khreishah, J. Lee, S. Angizi, A. Al-Fuqaha, and M. Guizani, “Semi-decentralized Inference in Heterogeneous Graph Neural Networks for Traffic Demand Forecasting: An Edge-Computing Approach,” IEEE Transactions on Vehicular Technology, Jan. 2024.