For over a decade, my research has focused on establishing trust in systems where users, computation, and adversaries interact across boundaries.

My work spans physical systems security, browser architecture, trustworthy machine learning, and privacy-preserving computation. The common thread is understanding how technical systems can provide meaningful, mathematically sound security under real-world commercial constraints.

Research Themes

1. Security of Physical Systems

Investigating physical authentication, paper fingerprinting, acoustic emanations, and mobile-sensor side channels. This includes research on deriving object-specific cryptographic material from paper texture and demonstrating practical deep-learning-based acoustic side-channel attacks.

2. Socio-Technical Machine Learning

Developing privacy-preserving auditing frameworks, fairness metrics, and socio-technical security models for machine learning systems. This includes verifiable fairness frameworks that do not expose underlying training data, and work on the relationship between user trust and AI accountability.

3. Web Security & Privacy

Investigating vulnerabilities in browser extensions, hardware sensor APIs, tracking mechanisms, and Web integrity. This includes benchmarking the privacy impact of real-world extensions, protecting the DOM against malicious injections, and conducting forensic analyses of private browsing modes.

4. Privacy-Preserving & Verifiable Systems

Researching the practical deployment of cryptographic protocols, verifiable computation, decentralized auditing, and e-voting. This includes engineering self-enforcing electronic voting systems using homomorphic encryption and zero-knowledge proofs.

Research leading to Platform Impact

Academic research is only half the equation; I focus on real-world deployment and platform mitigation.

• 2014 — Private browsing: Research identified privacy leakage in private-browsing implementations across major browsers.
• 2016 — Web Sensor APIs: Research on browser sensor attacks contributed to work on privacy and security protections for sensor APIs.
• 2018 — Browser security: Research on mobile-sensor side channels and private-browsing privacy informed browser security work, including fixes in Mozilla Firefox and Apple Safari.
• 2023 — W3C pressure sensors: Research was acknowledged in pressure-sensor standardisation work.

Research Leadership

My research leadership has involved multidisciplinary teams working across security, privacy, and trustworthy AI, alongside funded programmes including AGENCY, AP4L, CyFer, and industry Knowledge Transfer Partnerships.

Current Direction

My current work focuses on Web platform architecture. Through Samsung Research UK and W3C, I work on how privacy, identity, language capabilities, and emerging AI technologies should fit into the browser and the wider Web platform.

Publications

Most updated list is in my Scholar Profile, but more detail for each paper is here