Awesome Physical AI Safety
An open, continuously updated research catalog of Physical AI safety, security, and robustness, featuring structured threat taxonomies and interactive visualizations.
Ph.D., The University of Tokyo (2026)
Trustworthy AI for Physical and Multimodal Systems
I study adversarial robustness, reliable vision-language systems, and Vision-Language-Action (VLA) safety evaluation toward safe and trustworthy Physical AI.
- Physical AI SafetyEvaluating the safety and robustness of VLA models (preprint).
- AI Security and PrivacyResearching model ownership verification, predictive confidence, and content protection (ACL'25 Main, APSIPA'25, SMC'26, preprint).
Research Experience & Collaborations
TUM, NII, NEC, CyberAgent AI Lab, SB Intuitions, and Turing.
Open to Collaborations
I welcome enquiries about research collaborations, research internship supervision, and research and technical consulting. Contact me
Interests
- Physical AI Safety
- Adversarial Robustness & Generalization
- Reliable Vision-Language Models
- Model Ownership & Content Protection
- Safety Evaluation & Benchmarking
Education
Ph.D., 2026
The University of Tokyo
MS in Informatics, 2023
The University of Tokyo
Exchange Student, 2022
Technical University of Munich
BEng in Systems Innovation, 2020
The University of Tokyo
News
- 2026.10: Released Awesome Physical AI Safety, a curated collection of research resources on physical AI safety.
- 2026.10: I will serve as an Area Chair for ICLR 2027 🎓
- 2026.07: Awarded a JSPS KAKENHI Research Activity Start-up grant as Principal Investigator 📜
- 2026.07: One co-authored paper accepted at SMC 2026 🎉
- 2026.06: One 1st-authored paper accepted at ECCV 2026 🎉
- 2026.04: Selected as an ICLR 2026 Top 200 Reviewer 🏆
- 2026.03: Received PhD in Informatics from The University of Tokyo 🎓
- 2026.02: One co-authored paper accepted at CVPR 2026 🎉
- 2026.01: One co-authored paper accepted at ICLR 2026 🎉
- 2025.11: One 1st-authored paper accepted at WACV 2026 🎉
- 2025.10: Our paper Uncolorable Examples was selected as a Best Paper Finalist at APSIPA ASC 2025 🏆
- 2025.09: Received NII Inose Outstanding Student Award, 2025 🏆
- 2025.07: One 1st-authored paper accepted at ACM MM 2025 🎉
- 2025.05: One 1st-authored paper accepted at ACL 2025 Main 🎉
- 2025.01: One 1st-authored paper accepted at ICLR 2025 🎉
- 2024.09: One 1st-authored paper accepted at ICIP 2024 🎉
- 2024.05: One 1st-authored paper accepted at MIRU 2024 Oral 🎉
- 2023.09: Selected for research fellowship JSPS DC2 📜
- 2023.07: Received a research grant of 1 million yen from AIP Challenge Program, JST 📜
- 2023.04: One 1st-authored paper accepted at ICML 2023 🎉
- 2023.03: Selected for research fellowship JST SPRING GX 📜
- 2022.10: One 1st-authored paper accepted at WACV 2023 🎉
Featured Resource
Recent Publications
Semantic Color Naturalness Breaker: Preventing Illegitimate Colorization via Content-Aware Color Priors
- Degrades unauthorized AI colorization of grayscale images.
- Introduces CaCDD, a content-aware color plausibility metric.
- Robust to modest perturbation constraints and common post-processing.
Read or Ignore? A Unified Benchmark for Typographic-Attack Robustness and Text Recognition in Vision-Language Models
- Introduces RIO-Bench for selective reading of text in images.
- Measures typographic robustness alongside text recognition.
- Learns when to read useful text and ignore misleading text.
Text-Printed Image: Bridging the Image-Text Modality Gap for Text-centric Training of Large Vision-Language Models
- Renders text as images for low-cost VLM training.
- Bridges the image-text modality gap without real images.
- Outperforms diffusion-generated training images.
Understanding Sensitivity of Differential Attention through the Lens of Adversarial Robustness
- Reveals adversarial sensitivity in Differential Attention.
- Explains amplification through opposing gradient directions.
- Identifies a trade-off between selective attention and robustness.
Multimodal Adversarial Defense for Vision-Language Models by Leveraging One-To-Many Relationships
- Defends VLMs against attacks on both images and text.
- Uses one-to-many image-text pairs in adversarial training.
- Achieves SOTA defense performance against multimodal attacks.
Quality Text, Robust Vision: The Role of Language in Enhancing Visual Robustness of Vision-Language Models
- Guides adversarial training with high-quality captions.
- Uses richer language supervision for robustness across diverse semantics.
- Improves zero-shot robustness and accuracy on 16 datasets.
Uncolorable Examples: Preventing Unauthorized AI Colorization via Perception-Aware Chroma-Restrictive Perturbation
- Protects grayscale images from unauthorized AI colorization.
- Adds imperceptible, transferable chroma-restrictive perturbations.
- Maintains protection under compression and other processing.
MergePrint: Merge-Resistant Fingerprints for Robust Black-box Ownership Verification of Large Language Models
- Embeds LLM fingerprints that resist model merging.
- Verifies ownership by querying models even with only black-box access.
- Preserves fingerprint detection with limited utility loss.
Rethinking Invariance Regularization in Adversarial Training to Improve Robustness-Accuracy Trade-off
- Improves the robustness-accuracy trade-off in training.
- Uses asymmetric regularization to resolve gradient conflict.
- Separates clean and adversarial distributions with split BN.
Defending Against Physical Adversarial Patch Attacks on Infrared Human Detection
- Proposes the first defense against physical patches on infrared human detection.
- Detects adversarial patches through patch-aware training.
- Improves unseen-patch robustness and clean-image precision.
Closer Look at the Transferability of Adversarial Examples: How They Fool Different Models Differently
- Separates transferred attacks into same and different mistakes.
- Shows different mistakes even between similar models.
- Explains transfer through model-specific non-robust features.
Experience
Project Assistant Professor
National Institute of Informatics
Tokyo, Japan.Research focus: trustworthy AI, adversarial robustness, and vision-language model reliability.
Research Internship → Contractor
Turing
Tokyo, Japan.Research Internship (Apr 2025 – Mar 2026) → Research Contractor (Apr 2026 – present). Research focus: reliable vision-language models.
Research Internship
CyberAgent AI Lab
Tokyo, Japan.Research focus: adversarial robustness of vision-language models.
Research Internship
NEC Corporation
Tokyo, Japan.Research focus: parameter-efficient methods for improving adversarial robustness in image recognition models.
Technical Advisor
Madori LABO（まどりLABO）
Tokyo, Japan.Co-founding engineer at a startup building an AI-driven floor-plan design assistant.
Technical Advisor
Ollo inc.
Tokyo, JapanStarted as a machine learning engineer and now provide technical guidance from a researcher’s perspective.
Research Assistant
National Institute of Informatics
Tokyo, Japan.Research focus: understanding the mechanisms of adversarial vulnerability in deep learning and developing defenses.
Awards
NII Inose Outstanding Student Award (NII猪瀬優秀学生賞), 2025
Received the NII Inose Outstanding Student Award (NII猪瀬優秀学生賞).
MIRU'24 Student Encouragement Award (MIRU'24 学生奨励賞)
Received the MIRU 2024 Student Encouragement Award (MIRU'24 学生奨励賞).
Won the special prize at SAS analytics hackathon 2019.（SAS Institute Japan, The Analytics Hackathon 2019 特別賞）
In the contest, participants were given data and asked to construct machine learning system with high accuracy. (article url: https://enterprisezine.jp/article/detail/12209?p=2)
Won the first prize at MDS data science contest 2018.（MDSデータサイエンスコンテスト 優勝）
In the contest, participants were given big data and asked to perform value-generating analysis freely. Our group won the first prize and we were able to submit a paper. See the publication section.
Research Grants
Grant-in-Aid for Research Activity Start-up (Kakenhi)
Grant-in-Aid for Research Activity Start-up (Kakenhi). Principal Investigator. “Building a Safety Evaluation Framework for Trustworthy Vision-Language-Action Models.” Total: ¥2,600,000 (direct: ¥2,000,000; indirect: ¥600,000).
PhD Research Fellowship (DC2)
PhD Research Fellowship (DC2). $1,300/month. Acceptance rate: 17.9%.
AIP Challenge Program
Research grant from the AIP Challenge Program. $7,000.
SPRING GX
SPRING GX scholarship. $1,200/month. Acceptance rate: 25%.
Special Research Assistant 2023
Special Research Assistant, Department of Information Science and Technology. Selected as A+ prioritized research assistant (declined after SPRING GX acceptance).
UTokyo-TOYOTA Study Abroad Scholarship 2021
UTokyo-TOYOTA Study Abroad Scholarship. $1,920/month. Top 2 students in the university. Supported an exchange year at the Technical University of Munich (TUM), Germany.
Academic Activities
Professional Service
- Area Chair: ICLR('27)
- Reviewer: ICLR('26,'25,'24), CVPR('26), NeurIPS('26,'25,'23), ICML('26,'25,'24), ECCV('26), IEEE TIFS('24), APSIPA('23)
Organization
- Program Committee: CVIM
Conference Travel History
- 2026: ECCV (Malmö, Sweden), WACV (Tucson, Arizona, USA)
- 2025: ACM MM (Dublin, Ireland), ACL (Vienna, Austria), ICLR (Singapore)
- 2024: ICIP (Abu Dhabi, UAE)
- 2023: ICML (Honolulu, Hawaii, USA), WACV (Waikoloa, Hawaii, USA)
Side Projects
Floor Plan App (間取り生成アプリ)
Floor Plan App is a web application that generates a floor plan from a given request.
Twitter Image Captioning
Made a model which outputs text from a image like human tweets, using Encoder-Decoder Model. Application of image captioning technique.
Oshaberi-Bot（おしゃべりぼっと）
My first twitter bot app. He learns japanese from his followers, by fitting retrieved data to Markov model.
trip map
Demo web application I made in school. In this app, you can clip the place you want to go in the future, find the shortest way to go through the chosen spots. I was responsible for front-end system using html, css, javascript.