Formal verification & program analysis
Modular static analysis, separation logic, bi-abductive inference, and machine-checked correctness for systems software.
Formal methods · Program analysis · Information-flow security
I reason formally about how information flows — inside software, and against AI-scale adversaries.
I am an independent researcher and formal-methods specialist with over a decade of experience building industry-grade static analysis for memory safety, information-flow security, and constant-time verification of cryptographic code. I now work on my own research and ventures full-time.
Most recently, at CEA-LIST in Saclay, France, I worked on the side-channel security of post-quantum cryptography — including a systematic timing-leakage study of NIST PQDSS candidates and scalable constant-time verification tooling, presented at the NIST PQC Standardization Conference.
Earlier, I built separation-logic verifiers at the National University of Singapore, the National Institute of Informatics (Japan), and the University of Tokyo — tools applied to autonomous-driving software and open-source library security. My doctoral work proved completeness and expressiveness results for pointer-program verification in separation logic.
Today my curiosity points outward: extending the same information-flow mathematics from inside programs to the open world of personal and business data, where large-language-model adversaries change what "leakage" even means.
Modular static analysis, separation logic, bi-abductive inference, and machine-checked correctness for systems software.
Non-interference, logic-based IFC, declassification, and a dual notion I call non-conclusivity against inference adversaries.
Systematic timing-leak analysis of post-quantum primitives; scalable constant-time verification tooling.
Scalable symbolic reasoning, function-pointer elimination, and reverse engineering of LLVM back toward analyzable source.
Formal and information-theoretic guarantees for privacy defenses when the adversary is an LLM-powered correlation engine.
Asynchronous unfold/fold transformation for fixpoint logic and its use in functional-program verification.
Shifa proves non-interference for C programs: that a function's public
outputs cannot depend on its secret inputs. It combines separation-logic reasoning
about the heap with information-flow analysis over a Z3 backend, checking each
function against a lightweight stub specification of its security signature
(Hi → Lo).
Navigate presentations. Study together. In real-time. SeenSlide captures slides live during lectures and conferences and syncs them to every device in the room — no app, just a link or QR code. Around that live feed it adds a collaborative study layer: shared annotations, slide-linked chat, study groups, and an AI assistant that can explain a selected region, summarize a slide, or translate it on the spot.
Take live classes. Learn from wherever you are. Ostudi turns an ordinary phone into a complete online classroom — show slides, write on a live board, talk in real time, take attendance, and lean on an AI helper. No laptop, no expensive software, and it holds up on weak connections. Built for teachers and students in exactly the conditions most edtech ignores.
Blood of Bengal — from '52 to '24. An open, Bengali-language archive of those who gave their lives for the freedom and rights of the people of Bangladesh — spanning from the 1952 Language Movement to the 2024 student uprising. A work of remembrance, built so these names and stories cannot be quietly erased.
Not merely sending workers abroad — building a trusted human-excellence export hub. SeekSync is an operational prototype (BGCDP 3.1) for Bangladesh's overseas-labour ecosystem: an 8-layer pipeline that connects workers, training providers, recruiters, foreign employers, returnees, and the ministry around a single, dignified digital identity for every worker.
My most ambitious project: adversary-aware privacy under an explicit LLM-amplified adversary threat model. SafeSelf measures how well intelligent analyzers — cloud LLMs, local LLMs, even humans — can reconstruct a person from their OSINT footprint, and how effectively decoy interventions degrade that reconstruction without making the footprint implausible. Where most tools just hide or delete data, SafeSelf attacks the adversary's confidence itself.
A social network built for calm, meaningful connection — no rage-bait algorithms, no ads mining your attention, no strangers in your feed. Just the people you actually trust. Spheres is peer-to-peer: your data stays on your device, and metadata stays private by construction.
arXiv preprint · NIST PQC Standardization Conference
Science of Computer Programming
Asian Symposium on Programming Languages and Systems (APLAS)
Information and Computation
International Conference on Verification, Model Checking, and Abstract Interpretation (VMCAI)
Theoretical Computer Science
IEEE International Conference on Software Engineering and Formal Methods (SEFM)
A quieter pursuit. Light, geometry, and the occasional accident — gathered slowly, added when something earns it.