UC San Diego

In the era of artificial intelligence (AI), foundation models have become engines for producing text, code, images, and complex design artifacts through human–AI interaction. This paradigm shift transforms not only how content is created but also changes the security landscape. As AI systems are increasingly deployed in critical domains such as software engineering, hardware design, scientific discovery, and digital media, ensuring the trustworthiness of both models and their generated artifacts becomes a fundamental challenge. Key concerns include ownership attribution, provenance tracking, authenticity verification, misuse prevention, and regulatory compliance across the lifecycle. However, achieving trustworthy and secure AI at scale is inherently difficult due to the massive volume of generated content, the need for real-time interaction, and the risk that artifacts can be adversarially modified and redistributed. Effective protection mechanisms must, therefore, be scalable, efficient, fidelity-preserving, and robust, while remaining seamlessly integrated into high-throughput AI systems. My research addresses this pressing issue through a holistic, multi-level co-design of machine learning algorithms, security protocols, and system infrastructure. For AI-generated content, I developed REMARK-LLM and RoSeMary to enable provenance tracing and misuse identification for both natural language and programming code generated by cloud-hosted foundation models. These frameworks use learning-based watermarking techniques to embed ownership signals while preserving the semantics and utility of generated outputs, and support efficient and secure ownership verification through zero-knowledge proofs. For on-device LLMs, which are prone to being reverse-engineered in the supply chain, I proposed EmMark and AttestLLM, which jointly protect the software IP of edge-deployed models and the hardware IP of execution platforms by ensuring that only legitimate large language models can run on vendors’ devices. These systems leverage adaptive watermarking algorithms with trusted execution environments to authenticate the execution of legitimate LLMs with efficiency, robustness, and practical deployability. For human–AI collaborative creations, I introduced OptiMarks to protect the IP of AI-assisted scientific discovery artifacts, and ICMarks and AutoMarks to protect the IP of AI-assisted chip design layouts. The protection mechanisms not only preserve design quality but also ensure automation and scalability as complex artifacts are generated at high volume and scale.