Research.

How do foundation models fail, and how would we know?

I run adversarial multi-turn evaluations at frontier scale, measure instruction adherence and guardrail robustness across hundreds of open-weight and commercial models, and study chain-of-thought faithfulness in reasoning systems. The 2026 paper "Why Models Know But Don't Say" documents how open-weight reasoning models diverge between what their thinking tokens compute and what their final answers state, a gap that undermines any oversight scheme that trusts the visible reasoning trace. A nineteen-paper series on reasoning models is in flight, covering sandbagging detection, Model Context Protocol safety, steganographic encoding, and machine unlearning. The through-line is empirical: measure failure at deployment scale first, then propose mitigations. Every benchmark ships as an open dataset on Hugging Face so results can be reproduced and extended rather than taken on trust; the papers in this thread are in the Library with DOI or arXiv links.

Can a coding model tell a weapon from security knowledge?

With Dr. Gregory D. Moody, Director of Cybersecurity Programs at the UNLV Lee Business School, I am building a four-paper program that treats malicious code generation as its own evaluation axis, distinct from general content safety. One paper is a systematic review of thirteen malicious-code prompt corpora published between 2023 and 2025, showing how inconsistently the field has defined a harmful coding request. Another is a validated prompt bank of 1,554 consensus-labeled prompts that separates executable weapons from defensive security knowledge, with inter-rater agreement of Fleiss' kappa 0.876. The remaining papers run the bank across ten coding LLMs to compare refusal behavior between vendors, and test mechanistically whether code safety and content safety are separable directions in activation space. Together they give practitioners a benchmark, a behavioral baseline, and an interpretability result for the same question.

What happens when foundation models meet real patient data?

My clinical work asks what breaks when a foundation model meets real patient data and real clinical workflows. CardioEmbed (arXiv 2511.10930, November 2025) adapts Qwen3-Embedding-8B with LoRA on roughly 150,000 sentences from seven cardiology textbooks and reaches 99.6% retrieval accuracy on cardiac-specific tasks, 15.94 percentage points above the prior medical embedding baseline; a companion study (arXiv 2511.19739) compares LoRA-adapted encoder and decoder architectures for the same domain. EQUITRIAGE (2026) is a fairness audit of gender bias in LLM-based emergency department triage. Other papers benchmark LLMs for clinical trial data extraction, measure PHI leakage in medical OCR, compare LLM and human expert responses to problem-gambling questions, and analyze clinical and cost outcomes after post-acute care in Medicare Advantage. As Co-Chair of the UnitedHealth Group Enterprise IRB, I also review research touching more than 110 million lives.

Does the research survive contact with production?

Research without deployment is theater, so part of my work is building the systems that put models in front of real users at UnitedHealth Group. CxS Insights is a conversational-analytics platform on Databricks covering 47.5 million members and 26.4 million call transcripts through 53 LLM-routed tools. Ask Lucky exposes member insights through 27 tools on Postgres with pgvector. Ask Thaur replaced a workflow that cost five to six thousand dollars a month plus two to three full-time analysts with a conversational interface that runs for about one hundred dollars a month. Ask Richard is used daily by more than 80 data scientists. Each system doubles as a test bed for the safety and evaluation research: tool routing, retrieval grounding, and guardrails are measured in production rather than assumed from benchmarks, and the failure modes feed back into the papers.

Can anyone else run it?

Every paper ships with an artifact, because a result that cannot be rerun is an anecdote. Across Hugging Face and Ollama I maintain more than 80 public model releases, six open datasets, and nine interactive Spaces, with roughly 33,000 cumulative downloads and pulls. CardioEmbed and its BioLinkBERT and MPNet variants are published as model weights with training and evaluation code on GitHub, and the malicious-code prompt bank and safety benchmarks are released as datasets. Teaching material follows the same rule: the NeuroAI Handbook and the Healthcare Analytics and AI textbook are free to read online, and the interactive demos used in UNLV courses run as public Spaces. The goal is that a reader can verify any number on this site by downloading the artifact behind it.