Towards Robust and Trustworthy AI
I study the robustness, reliability, and safety of intelligent systems, from vision-language models to embodied AI.
- Adversarial Vulnerabilities: Analyzing model failures under adversarial perturbations (WACV'23).
- Robust Learning & Defense: Developing robust training and defense methods for computer vision (ICLR'25, ICIP'24).
- Multimodal Robustness: Improving the robustness of vision-language models (ECCV'26, WACV'26, ACM MM'25).
- AI Reliability & Security: Exploring model IP protection and post-hoc calibration (ACL'25 Main, ICML'23).
- Visual Content Protection: Developing colorization defenses and image-editing watermarks (APSIPA’25, SMC’26, preprint).
Research Experience & Collaborations
TUM, NII, NEC, CyberAgent AI Lab, SB Intuitions, and Turing.
Open to Collaborations
I welcome enquiries about research collaborations with academic and industry partners, research internship supervision and mentoring, and research and technical consulting. Feel free to get in touch!
Interests
- Physical AI Safety
- Adversarial Robustness & Generalization
- Reliable Vision-Language Models
- Model Ownership & Content Protection
- Safety Evaluation & Benchmarking
Education
PhD in Informatics, 2026
The University of Tokyo
MS in Informatics, 2023
The University of Tokyo
Exchange Student, 2022
Technical University of Munich
BEng in Systems Innovation, 2020
The University of Tokyo
News
- 2026.10: I will serve as an Area Chair for ICLR 2027 🎓
- 2026.07: Awarded a JSPS KAKENHI Research Activity Start-up grant as Principal Investigator 📜
- 2026.07: One co-authored paper accepted at SMC 2026 🎉
- 2026.06: One 1st-authored paper accepted at ECCV 2026 🎉
- 2026.04: Selected as an ICLR 2026 Top 200 Reviewer 🏆
- 2026.03: Received PhD in Informatics from The University of Tokyo 🎓
- 2026.02: One co-authored paper accepted at CVPR 2026 🎉
- 2026.01: One co-authored paper accepted at ICLR 2026 🎉
- 2025.11: One 1st-authored paper accepted at WACV 2026 🎉
- 2025.10: Our paper Uncolorable Examples was selected as a Best Paper Finalist at APSIPA ASC 2025 🏆
- 2025.09: Received NII Inose Outstanding Student Award, 2025 🏆
- 2025.07: One 1st-authored paper accepted at ACMMM 2025 🎉
- 2025.05: One 1st-authored paper accepted at ACL 2025 Main 🎉
- 2025.01: One 1st-authored paper accepted at ICLR 2025 🎉
- 2024.09: One 1st-authored paper accepted at ICIP 2024 🎉
- 2024.05: One 1st-authored paper accepted at MIRU 2024 Oral 🎉
- 2023.09: Selected for research fellowship JSPS DC2 📜
- 2023.07: Received a research grant of 1 million yen from AIP Challenge Program, JST 📜
- 2023.04: One 1st-authored paper accepted at ICML 2023 🎉
- 2023.03: Selected for research fellowship JST SPRING GX 📜
- 2022.10: One 1st-authored paper accepted at WACV 2023 🎉
Recent Publications
Semantic Color Naturalness Breaker: Preventing Illegitimate Colorization via Content-Aware Color Priors
- Degrades unauthorized AI colorization of grayscale images.
- Introduces CaCDD, a content-aware color plausibility metric.
- Robust to modest perturbation constraints and common post-processing.
Read or Ignore? A Unified Benchmark for Typographic-Attack Robustness and Text Recognition in Vision-Language Models
- Introduces RIO-Bench for selective reading of text in images.
- Measures typographic robustness alongside text recognition.
- Learns when to read useful text and ignore misleading text.
Text-Printed Image: Bridging the Image-Text Modality Gap for Text-centric Training of Large Vision-Language Models
- Renders text as images for low-cost VLM training.
- Bridges the image-text modality gap without real images.
- Outperforms diffusion-generated training images.
Understanding Sensitivity of Differential Attention through the Lens of Adversarial Robustness
- Reveals adversarial sensitivity in Differential Attention.
- Explains amplification through opposing gradient directions.
- Identifies a trade-off between selective attention and robustness.
Multimodal Adversarial Defense for Vision-Language Models by Leveraging One-To-Many Relationships
- Defends VLMs against attacks on both images and text.
- Uses one-to-many image-text pairs in adversarial training.
- Achieves SOTA defense performance against multimodal attacks.
Quality Text, Robust Vision: The Role of Language in Enhancing Visual Robustness of Vision-Language Models
- Guides adversarial training with high-quality captions.
- Uses richer language supervision for robustness across diverse semantics.
- Improves zero-shot robustness and accuracy on 16 datasets.
Uncolorable Examples: Preventing Unauthorized AI Colorization via Perception-Aware Chroma-Restrictive Perturbation
- Protects grayscale images from unauthorized AI colorization.
- Adds imperceptible, transferable chroma-restrictive perturbations.
- Maintains protection under compression and other processing.
MergePrint: Merge-Resistant Fingerprints for Robust Black-box Ownership Verification of Large Language Models
- Embeds LLM fingerprints that resist model merging.
- Verifies ownership by querying models even with only black-box access.
- Preserves fingerprint detection with limited utility loss.
Rethinking Invariance Regularization in Adversarial Training to Improve Robustness-Accuracy Trade-off
- Improves the robustness-accuracy trade-off in training.
- Uses asymmetric regularization to resolve gradient conflict.
- Separates clean and adversarial distributions with split BN.
Defending Against Physical Adversarial Patch Attacks on Infrared Human Detection
- Proposes the first defense against physical patches on infrared human detection.
- Detects adversarial patches through patch-aware training.
- Improves unseen-patch robustness and clean-image precision.
Beyond In-Domain Scenarios: Robust Density-Aware Calibration
- Calibrates confidence using local feature density.
- Improves reliability under domain shifts and OOD inputs.
- Maintains performance across models and datasets.
Closer Look at the Transferability of Adversarial Examples: How They Fool Different Models Differently
- Separates transferred attacks into same and different mistakes.
- Shows different mistakes even between similar models.
- Explains transfer through model-specific non-robust features.
Experience
Project Assistant Professor
National Institute of Informatics
Tokyo, Japan.Research focus: trustworthy AI, adversarial robustness, and vision-language model reliability.
Research Internship → Contractor
Turing
Tokyo, Japan.Research Internship (Apr 2025 – Mar 2026) → Research Contractor (Apr 2026 – present). Research focus: reliable vision-language models.
Research Internship
CyberAgent AI Lab
Tokyo, Japan.Research focus: adversarial robustness of vision-language models.
Research Internship
NEC Corporation
Tokyo, Japan.Research focus: parameter-efficient methods for improving adversarial robustness in image recognition models.
Technical Advisor
Madori LABO（まどりLABO）
Tokyo, Japan.Co-founding engineer at a startup building an AI-driven floor-plan design assistant.
Technical Advisor
Ollo inc.
Tokyo, JapanStarted as a machine learning engineer and now provide technical guidance from a researcher’s perspective.
Research Assistant
National Institute of Informatics
Tokyo, Japan.Research focus: understanding the mechanisms of adversarial vulnerability in deep learning and developing defenses.
Awards
NII Inose Outstanding Student Award (NII猪瀬優秀学生賞), 2025
Received the NII Inose Outstanding Student Award (NII猪瀬優秀学生賞).
MIRU'24 Student Encouragement Award (MIRU'24 学生奨励賞)
Received the MIRU 2024 Student Encouragement Award (MIRU'24 学生奨励賞).
Won the special prize at SAS analytics hackathon 2019.（SAS Institute Japan, The Analytics Hackathon 2019 特別賞）
In the contest, participants were given data and asked to construct machine learning system with high accuracy. (article url: https://enterprisezine.jp/article/detail/12209?p=2)
Won the first prize at MDS data science contest 2018.（MDSデータサイエンスコンテスト 優勝）
In the contest, participants were given big data and asked to perform value-generating analysis freely. Our group won the first prize and we were able to submit a paper. See the publication section.
Side Projects
Floor Plan App (間取り生成アプリ)
Floor Plan App is a web application that generates a floor plan from a given request.
Twitter Image Captioning
Made a model which outputs text from a image like human tweets, using Encoder-Decoder Model. Application of image captioning technique.
Oshaberi-Bot（おしゃべりぼっと）
My first twitter bot app. He learns japanese from his followers, by fitting retrieved data to Markov model.
trip map
Demo web application I made in school. In this app, you can clip the place you want to go in the future, find the shortest way to go through the chosen spots. I was responsible for front-end system using html, css, javascript.