I build the systems and networking layer underneath agentic AI. The work runs in four lines, from the serving and execution runtime for agents, through learning that systems can afford to trust, to networked systems pointed at orbit, and finally agents placed inside the network itself.
One direction with two-way traffic. Networked systems built for agents, and agents held safely inside networked systems.
How to read this page. Green is accepted work, blue is under review, amber is in progress and open, and the purple pill marks the newest lines. Every card is a live project, not an archive.
I am always looking for motivated undergrad and grad students, and other collaborators around the world, to work with! If one of these problems pulls at you, email me with the project name in the subject and one paragraph on what you would try first.
See also The Agent Stack, the reference model and measurement agenda tying these together.
Serving recomputes overlapping context across requests instead of reusing it; the cache that could carry the load is thrown away.
Per-call metrics grade agentic systems healthy while whole plans fail. Nothing in the stack accounts at the level of the plan the user asked for.
An agent that dies mid-plan cannot tell which external effects already landed, so restart means redo or double-do.
Learned systems assume datacenter-grade GPUs. The commodity fleet the world actually owns fails in ways training loops do not survive, priced with production failure data from Meta's Llama 3 Herd report.
Agent plans are scheduled one call at a time. A plan-level budget covers the retries, verification, and waste that single-call scheduling never sees. Full version in progress.
Failure labels for agents assume annotators agree on what broke. Measured agreement varies by failure mode, and routing needs reliability contracts that survive the disagreement.
Agent steps stall waiting for state the plan already announced. PALSE reads the plan while generation is in flight and stages what the next step needs at the edge.
Inference serving stops at the cloud edge while direct-to-cell satellites sit overhead as compute nobody schedules. A four-tier serving path for agent workloads includes the satellite.
A room of idle Apple silicon sits beside a phone paying cloud latency for every agent token. Tether routes inference across the personal device mesh.
Reasoning tokens never appear in carbon accounting; test-time thinking is off the books.
Safe RL still learns by violating. Systems that cannot afford a single violation cannot use it. VETO acts only when a verified ensemble agrees the action is safe.
No theory predicts when cooperating learned agents snap under distribution shift; operators discover the phase transition by outage.
Multi-tier LLM serving reacts to 5G handovers and thermal throttling after they hit. At mobile timescales reaction is too late; prediction has a thirty-second window.
RL for rate and power control learns by violating the limits the RAN exists to hold. A decision-time mask removes violating actions from play, so it learns clean.
Direct-to-cell LEO handovers strike mid-session with no warning, at orbital cadence. An O-RAN Near-RT RIC rApp predicts them with a GBM and LLM pair.
Satellite IoT uplinks transmit blind into poor passes, spending the scarcest link budget there is. Pass-aware deferral waits for the right window across two orbits.
A LEO constellation crosses jurisdictions every few minutes. No mechanism keeps data flows legal while they move.
Mobile LLM requests route on latency alone while carbon differs by an order of magnitude across device, edge, and cloud. Full version in progress.
Cellular signaling includes a path that can quiet a device. The paper asks who can trigger it and at what cost.
A network can only act on what it sees early enough. Lead Time measures how far ahead predictions land against the cost of acting on them.
One trained predictor turns sparse mobility signals into persistent tracking.
Vehicles navigate on a signal anyone can forge. With Rivian, detecting GPS spoofing before the planner believes the lie.
MAC layers freeze at standardization time and conditions do not. Loom lets an LLM agent recompose a live wireless MAC while a safety certificate keeps every action inside proven bounds.
Learned MAC controllers act unmasked, so one bad action reaches the air. A safety mask filters actions before transmission.
Protocol synthesis emits code, not guarantees. Arachne composes MAC protocols from verified blocks, and every composition carries an interference-safety proof.
Agents propose changes to systems they should never control directly. Vouch splits proposer from deployment license; a small certificate, not the model, decides what may run.
Networks treat LLM traffic as one workload. Measured at packet level, it is three, and designs tuned for chat mis-serve the agentic traffic growing fastest.
RAN automation is adopting LLM agents with no effect contract and no plan-level accounting. The RIC is about to run agents blind.