Selected work — Ainsley Woo
Projects and research by Ainsley Woo across custom AI agents, LLM and agent security, AI red-teaming, post-quantum cryptography and malware analysis.
Agent security · 2026 — Dual-stream anomaly detection for LLM-agent servers.
Fuses OS telemetry and LLM action logs through a Mamba + Transformer cross-attention architecture to catch prompt injection, exfiltration, resource abuse, and persistence attacks invisible to either signal alone — F1 0.95 / AUROC 0.995, beating five baselines.
- Signal: OS + action logs
- Model: Mamba × Transformer
- Result: AUROC 0.995
- Cross-attention fusion catches attacks single streams miss
- Hybrid recon + contrastive + classification loss for anomaly detection
- Stratified k-fold and multi-seed CV to trust F1
LLM security · 2026 — A runtime adversarial firewall for LLM applications.
A taxonomy-aware safety layer for LLM apps: it screens prompts through multi-layer intent analysis and is hardened with adversarial self-play, shipping a core library plus benchmark suites that score it ~500% over a Qwen baseline.
- Method: Intent analysis
- Hardening: Adversarial self-play
- Stack: Python
- Adversarial self-play hardens a defense against its own attacks
- Multi-layer intent analysis beats keyword-based prompt filtering
- Benchmark suites needed to claim gains over a baseline
Agentic coding harness · 2026 — A Rust-native agentic coding harness — CLI + supervised daemon.
A CLI plus a supervised daemon that run LLM-driven coding sessions locally, in Rust. Carries CI, codecov, and an OpenSSF Scorecard badge under Apache-2.0 — built for safe, observable autonomous coding.
- Lang: Rust
- Shape: CLI + daemon
- License: Apache-2.0
- Splitting CLI from supervised daemon for long-running sessions
- OpenSSF Scorecard and CI as supply-chain hygiene
- Rust's safety guarantees suit autonomous code execution
AI SOC analyst · 2026 — An AI-augmented SOC analyst that triages and explains.
An AI-powered Security Operations Center system that triages alerts, suggests investigations, explains its reasoning, and learns from analyst corrections without model drift — multi-dimensional alert classification end to end.
- Role: Alert triage
- Trait: Drift-free learning
- Stack: Python
- Learning from analyst corrections without drifting the model
- Explainable reasoning matters for analyst trust in triage
- Multi-dimensional classification structures noisy alert streams
Post-quantum networking · 2026 — A post-quantum secure protocol for agent-to-agent comms.
A post-quantum secure network protocol for AI agent-to-agent communication on TCP/QUIC with a sans-I/O state-machine core: a custom handshake combining ML-KEM-768 / ML-DSA-65 with hybrid X25519, stream multiplexing, OCSP-style revocation, capability tokens, Bayesian trust scoring, and MCP/A2A bridges.
- PQC: ML-KEM-768 / ML-DSA-65
- Transport: TCP / QUIC
- Interop: MCP / A2A
- Hybrid X25519 + ML-KEM hedges against PQC immaturity
- Sans-I/O state machine keeps transport-agnostic protocol testable
- Capability tokens and trust scoring layered onto the handshake
Malware analysis · 2025 — Static + dynamic malware analysis across platforms.
An enterprise-grade sandbox for static and dynamic analysis: PE/ELF/script/document parsing, YARA, entropy + packer detection, isolated Docker execution with API/syscall tracing, PCAP network analysis with IOC extraction, and Volatility-3 memory forensics.
- Static: YARA · entropy
- Dynamic: Docker · syscalls
- Forensics: Volatility 3
- Entropy and packer detection flag obfuscated binaries statically
- Docker isolation to safely run untrusted samples
- Combining static, dynamic, and memory forensics for coverage
AI Attack Validation Suite
AI red-teaming · 2026 — Runnable coverage of 92 AI/LLM attack types.
A red-teaming harness implementing all 92 attack types from a taxonomy of AI/LLM attacks — one runnable script per attack, pointed at OpenAI, Anthropic, or Gemini models through a unified client.
- Coverage: 92 attacks
- Targets: OpenAI · Claude · Gemini
- Form: One script / attack
- A taxonomy turns red-teaming into systematic coverage
- Unified client abstracts away per-provider API differences
- One runnable script per attack keeps tests reproducible
BenchAudit
Eval integrity · 2026 — A meta-evaluator that audits agentic-AI benchmarks.
Statically detects, then live-demonstrates, substrate-layer exploits that inflate scores on real eval harnesses (SWE-bench Verified, Terminal-Bench) — scoring each harness per the SEALED whitepaper and reporting in SARIF + Markdown.
- Targets: SWE-bench · Terminal-Bench
- Method: Static + live exploit
- Output: SARIF
- Writable conftest and PATH dirs let benchmarks be gamed
- Co-resident adversary measures real score inflation vs baseline
- Misuse boundary and opt-in submission gating are part of the design
HELIX
LLM-agent memory · 2026 — A unified memory architecture for LLM agents.
A layered memory substrate for LLM agents built on a unified causal-provenance graph that every layer queries, with an episodic layer and a retrieval-fuse stage — so an agent's memory is one coherent, auditable store rather than scattered caches.
- Core: Causal-provenance graph
- Layers: Episodic + retrieval
- Goal: Auditable memory
- One bitemporal append-only graph as the shared substrate
- Cryptographically chained audit log makes memory provenance auditable
- Protocol backends let in-memory tests mirror FalkorDB/LanceDB production
JANUS
Theory-of-mind / belief · 2026 — A recursive belief ledger for tool-composing agents.
A reference implementation of the JANUS recursive belief ledger and PVU runtime — modelling an agent's nested beliefs about other agents (theory of mind) so tool-composing multi-agent systems reason about who knows what.
- Core: Recursive belief ledger
- Runtime: PVU
- Lens: Theory of mind
- Modelling nested beliefs about other agents (theory of mind)
- Typed effect specs let a verifier chain check tool actions
- Postcondition-checked subgoals ground belief updates in observed state
VAC
Multi-agent trust · 2026 — A Verifiable Agent Compact for multi-agent AI.
A trust architecture for multi-agent AI — the Verifiable Agent Compact — starting at Layer 0 with cryptographic identity and attestation so agents can prove who they are and what they ran before any cross-agent action is trusted.
- Layer 0: Identity + attestation
- Frame: Verifiable Agent Compact
- Domain: Multi-agent trust
- W3C DIDs and verifiable credentials anchor agent identity
- TEE attestation proves what hardware an agent runs on
- Trust is layered: identity at Layer 0 before authorization
CALYPSO
World models / planning · 2026 — A goal-projected one-step latent world model.
Component 1 of CALYPSO: a trained goal-projected one-step latent operator T̂ with a calibrated uncertainty head, plus the data/training/eval pipelines that produce it — the thesis that a one-step world model is enough for planning.
- Operator: One-step T̂
- Head: Calibrated σ̂
- Claim: One step is enough
- Goal-projection beats reconstruction loss for planning AUC
- Calibrated uncertainty (ECE, conformal coverage) gates predictions
- A small operator on a frozen LLM encoder suffices
RLP
Latent planning · 2026 — A plan-space encoder for retrocausal latent planning.
Retrocausal Latent Planning — a plan-space encoder that represents whole plans in a latent space, letting a planner reason backward from goals rather than only forward from the current state.
- Unit: Plan-space encoder
- Idea: Retrocausal planning
- Space: Latent
- Encoding plans as typed predicate-graphs, not just text
- Frozen LLM plus small adapter avoids full fine-tuning
- Typed adjacency over precondition/achieves/conflicts edges structures plans
AINSLEY
Efficient ML inference · 2026 — Runs a frontier MoE on a 16 GB laptop GPU.
Adaptive Indexer-driven N-tier Storage with Layered Entropy Yield: puts a frontier hybrid-sparse-attention MoE model (DeepSeek-V4-Flash class) onto a 16 GB laptop GPU at interactive throughput by exploiting the workload's redundancy across model architecture, per-vector quantization, and serving systems at once.
- Target: 16 GB laptop GPU
- Model: Sparse-MoE (V4-class)
- Lever: 3-layer redundancy
- Rolling-hash + MinHash-LSH dedup of KV cache spans
- Entropy-stratified quantization spends bits where they matter
- VRAM/DRAM/NVMe tiering with future-use-driven eviction
Beyond the Reflexion Ceiling
Agent training · 2026 — A production training recipe past the reflexion ceiling.
The π_a training recipe for the AHV-CRC component — a production recipe aimed at pushing reasoning agents past the ceiling that pure reflexion-style self-correction hits.
- Recipe: π_a
- Component: AHV-CRC
- Aim: Past reflexion
- Vanilla GRPO collapses Pass@K; auxiliary loss preserves diversity
- Semantic-DPP sampling draws diverse rollouts from one actor
- A reproducible recipe = code, configs, infra, not just an idea
Post-quantum crypto · 2026 — Forecasts quantum threats to cryptographic systems.
An enterprise-grade predictive vulnerability engine (Rust + Python) combining symbolic reasoning and ML to forecast quantum threats, scan codebases across six languages for at-risk primitives, and automate FIPS-140-2 / FedRAMP-compliant migration to PQC (Kyber, Dilithium, SPHINCS+).
- Stack: Rust + Python
- Scan: 6 languages
- Migrate: Kyber · Dilithium
- Combining symbolic reasoning with ML for threat forecasting
- Multi-language scanning to find at-risk crypto primitives
- Compliance (FIPS-140-2, FedRAMP) shapes a migration tool
Zero-trust security · 2026 — Maps attack paths across a zero-trust estate.
A Rust tool that models a zero-trust environment and maps the reachable attack paths through it — surfacing how an adversary could chain identities and resources despite per-request verification.
- Lang: Rust
- Models: Zero-trust estate
- Finds: Attack paths
- Zero-trust still leaves chainable identity/resource attack paths
- Modelling an estate as a graph to reason about reachability
- Per-request verification doesn't stop privilege chaining
Malware analysis · 2026 — Behavioural-GNN malware attribution at scale.
An autonomous malware attribution platform in Rust + Python combining behavioural graph neural networks with rule-based detection across Windows/Linux/macOS, scaling to 10,000+ hosts with sub-second attribution and automatic MITRE ATT&CK mapping.
- Model: Behavioural GNN
- Scale: 10,000+ hosts
- Maps: MITRE ATT&CK
- Graph neural nets capture behaviour better than static signatures
- Pairing GNNs with rules trades recall against explainability
- Auto-mapping to MITRE ATT&CK standardizes attribution output
Supply-chain security · 2026 — Continuously vets dependencies across ecosystems.
A Rust supply-chain platform (11-crate workspace, REST/GraphQL API, Leptos dashboard, Postgres worker queue) that continuously scans npm, PyPI, Maven, Cargo and more for typosquatting, tampering, and provenance attacks — emitting CycloneDX/SPDX SBOMs and SARIF.
- Ecosystems: npm · PyPI · Cargo +
- Catches: Typosquat · tamper
- Emits: SBOM · SARIF
- A multi-crate Rust workspace organizes a large platform
- Postgres worker queue decouples scanning from the API
- Standard formats (CycloneDX/SPDX SBOM, SARIF) aid interop
Network analysis · 2025 — A premium network monitor + packet analyzer.
Network Monitor & Analysis Tool — an Electron packet-analysis app with a glassmorphic, Apple-inspired UI: live capture, protocol analysis, and a frameless, blur-backdropped interface that makes deep network inspection feel premium.
- Built on: Electron
- Does: Live capture + analysis
- UI: Glassmorphic
- Electron ships a desktop capture tool with web UI
- Live packet capture and protocol parsing in one pipeline
- Glassmorphic, frameless UI to make inspection feel premium
AI safety · AAAI 2026 · 2026 — Why AI hallucinates, and what it costs enterprises.
Presented at the AAAI 2026 Undergraduate Consortium: research on why AI systems hallucinate and how that harms enterprises and consumers — framing hallucination as a security-relevant failure mode at the application boundary.
- Venue: AAAI 2026 UC
- Topic: Hallucination
- Angle: Enterprise risk
- Framing hallucination as a security failure at the app boundary
- Presenting research at a peer-reviewed AAAI venue
- Tying a model limitation to concrete enterprise cost
Prompt Refiner
Web app · prompt engineering · 2026 — Improve prompts via best-practice refinement.
A web app that evaluates a prompt against eight prompt-engineering criteria, asks multiple-choice questions to fix the unmet ones, then generates responses from the original and refined prompts side by side.
- Scores: 8 criteria
- Refines: MCQ-driven
- Compares: Side by side
- Scoring prompts against explicit criteria makes quality concrete
- MCQ elicitation fills gaps without free-text burden
- Side-by-side original vs refined output shows the delta
Agendaler
Proptech · SG real estate · 2026 — AI-powered Singapore property search.
An AI-powered property-search platform for Singapore real estate — turning natural-language intent into ranked, explained listings.
- Market: SG real estate
- Mode: AI search
- Stack: TypeScript
- Turning natural-language intent into ranked, explained listings
- Domain knowledge of SG property shapes the search
- Explaining a ranking matters as much as producing it
Sports Month 2026
Event platform · 2026 — An enterprise event platform for Sports Month.
A full event-management platform for Sports Month 2026 — Next.js 15 + PostgreSQL 16 + TypeScript, with enterprise-grade documentation, run as student-leadership infrastructure.
- Stack: Next.js · Postgres
- Scope: Event ops
- Role: Student lead
- Next.js 15 + Postgres 16 for a real event-ops platform
- Documentation is part of shipping infrastructure others run
- Building software as student-leadership, not just a class project
Website · 2025 — A sleek team portfolio site.
A clean, minimalist team-portfolio website built with Next.js 16, Tailwind CSS, and Anime.js — responsive, animated, and fast.
- Stack: Next.js · Tailwind
- Motion: Anime.js
- Feel: Minimalist
- Tailwind keeps a minimalist site consistent and fast
- Anime.js adds motion without a heavy animation framework
- Responsive layout is a baseline expectation, not a feature
Balance My Life
Game · SUTD · 2023 — A decision-making life-balance game in Python.
A top-down life-sim built from scratch on a Python/tkinter canvas for SUTD: juggle resources across a daily schedule, move through scenarios with NPCs and a cat companion, and make choices that keep a virtual life in balance — sprites, a HUD, clock, and progress bars all hand-built, running at 60 FPS.
- Engine: Python · tkinter
- Loop: 60 FPS canvas
- Theme: Work–life balance
- Hand-building a game loop and sprites on a tkinter canvas
- Tracking resources and HUD state across a daily schedule
- Arrow-key input and scenarios drive a choice-based life-sim