Yue Zhao - Auditable AI Systems

Yue Zhao is an Assistant Professor of Computer Science at the University of Southern California, where he leads the FORTIS Lab and serves as Associate Co-Director of the USC Institute on Ethics and Trust in Computing for 2026-2027. He builds the methods, benchmarks, and open-source infrastructure that make AI systems auditable, from anomaly detection in data to the auditability of agent systems across their lifecycle. He created PyOD, the canonical Python anomaly-detection library, which has passed 50 million downloads and is listed as a production-stage, high-maturity out-of-distribution detection tool in the U.S. Department of Defense CDAO Generative AI Responsible AI Toolkit. Reach him at yue.z@usc.edu, or the lab at fortis@usc.edu.

Current Focus. Founding Auditable AI , the auditable layer for AI agents, anchored by our own stack from method and benchmark to open-source tool. Also serving as Chief Scientific Advisor to Figwork , an AI platform for early-career talent.
Community. I founded and run 博士栈 CSPhD.org , a free, volunteer-run community for CS / AI / EE / Stats PhDs. Since 2022 it has grown to several thousand members and helped many land PhDs, internships, and jobs through peer groups and a searchable board of 500+ openings.

Research Summary

AI systems are deployed faster than their risks can be measured or controlled. My lab builds the methods, benchmarks, and open-source infrastructure that make AI systems auditable across the deployment stack: anomaly and out-of-distribution detection in data, trust and robustness evaluation of foundation models, and auditability and control of agent systems across their lifecycle. One agenda runs through the work: detect, diagnose, and control departures from expected behavior, from anomalous data and foundation-model failures to consequential agent actions. The current frontier is agent auditability: deployable open-source infrastructure that audits agents from before deployment to after a run.

The Auditable AI Ecosystem from data anomalies to agent decisions

Foundation, data layer. PyOD, the canonical open-source anomaly-detection library: 50M+ downloads, named by OpenAI, used in Amazon and European Space Agency anomaly-detection work, deployed in a UK Government care service, and listed by the U.S. DoD CDAO.
Frontier, agent layer. The open-source family below carries the same audit agenda to AI agents, built to cite and reinforce one another: a research method, the tool built on it, and a curated knowledge base.

Tool
auditable
The open-source SDK: capture each agent decision, replay it against live state, and roll back when it no longer holds.
Method
GRADE
The research engine the tool is built on: a typed two-layer graph of agent execution and dependency. code.
Resource
awesome-auditable-ai
A curated map of papers, tools, datasets, and standards for reliable, auditable AI agents.
Auditing Across the Agent Lifecycle

Auditable Agents is our framework for what agent auditability requires: five dimensions and three mechanism classes (detect, enforce, recover). The research below instantiates them across an agent's life. arXiv.

Pre · before deploy
FORTIS: a benchmark for over-privilege in agent skills.
agent-audit: a static scan of agent code for security and over-privilege.
Live · while running
Cross-User Contamination: one user's data leaking into another's in shared-state agents.
Topology Matters: measuring memory leakage in multi-agent LLMs.
Aegis: a pre-execution firewall that gates each tool call.
Post · after a run
Implicit Execution Tracing: recovering which agent caused a harmful result after the logs are gone.
GRADE: localizing the faulting step in a completed multi-agent run.
  1. Agent Layer: Auditability and Control

    At the agent layer, deployed systems act through tools, APIs, and shared state, making behavior the primary failure surface. I work on auditability frameworks (reconstruction, checking, and attribution of agent behavior after deployment), runtime control surfaces that intercept tool calls before they fire, agent-specific failure modes (over-privilege, cross-user contamination, the autonomy tax of defense training), and category-adaptive training-time defenses. These span the full lifecycle: pre-deployment audit, runtime tool-call mediation, and post-run attribution and recovery. My Auditable Agents position paper organizes these into five dimensions of auditability and three mechanism classes (detect, enforce, recover). These methods are moving from research into deployable open-source infrastructure that audits agents from before deployment to after a run.

    Keywords: Agent Auditability, Runtime Audit, Pre-Execution Mediation, Agent Failure Modes, Over-Privilege, Cross-User Contamination, Defense Training, Behavior Verification, Multi-Agent Systems, AI Agent Security

  2. Foundation-Model Layer: Trust and Robustness

    Between data and agents, foundation models add a new failure surface: behavior under attack, hallucination of fact and reasoning, and adversarial robustness of retrieval, all of which propagate downstream once the model is used by an agent or a user-facing system. My lab's targeted work measures these surfaces through jailbreak detection for vision-language models, causal analysis of hallucination, query-agnostic attacks on retrieval-augmented generation, and LLM-as-anomaly-detector benchmarks. Community efforts like TrustLLM are tracked as collaborative consortium contributions, separate from lab-led work.

    Keywords: Foundation-Model Trust, Trustworthiness Benchmarks, LLM Hallucination, Jailbreak Detection, RAG Security, Adversarial Retrieval, Vision-Language Models, LLM-as-Judge

  3. Data Layer: Anomaly and Out-of-Distribution Detection

    All audit eventually grounds in distinguishing in-distribution behavior from out-of-distribution behavior. This is my methodological root, started during my PhD with the PyOD ecosystem and ADBench, and continuing as a PI through benchmark infrastructure for NLP, automatic OOD detector selection, modality-specific OOD methods for graphs, multimodal data, and video, and few-shot cross-domain OOD detection. PyOD remains the flagship open-source artifact, now in its third major release. These methods provide the measurement backbone that gets re-used at higher layers of the stack.

    Keywords: Anomaly Detection, Outlier Detection, Out-of-Distribution Detection, PyOD Ecosystem, Benchmark Design, Multimodal OOD, Graph OOD, Few-Shot OOD, OOD Detector Selection

Biography. Dr. Yue Zhao is an Assistant Professor of Computer Science at the University of Southern California, where he leads the FORTIS Lab. He serves as Associate Co-Director of the USC Institute on Ethics and Trust in Computing for 2026-2027. His lab builds the methods, benchmarks, and open-source infrastructure that make AI systems auditable across the deployment stack: anomaly and out-of-distribution detection in data, trust and robustness evaluation of foundation models, and auditability and control of agent systems across their lifecycle. His research develops methods to detect, diagnose, and control departures from expected behavior, from anomalous data and foundation-model failures to consequential agent actions. The program extends a decade of research on anomaly and outlier detection at scale, and its current frontier is agent auditability: deployable open-source infrastructure that audits AI agents from before deployment to after a run. He also advises early-stage AI startups and is founding Auditable AI, a startup building the auditable layer for AI agents on his lab's open-source stack.

Dr. Zhao has authored over 80 peer-reviewed papers in top-tier venues and is internationally recognized for his open-source contributions, including PyOD, ADBench, TrustLLM, agent-audit, and Aegis, which collectively exceed 50 million downloads and 24,000 GitHub stars. PyOD is the subject of five published books, is named by OpenAI, and is used by Apache Beam, Amazon, Walmart, Databricks, and the European Space Agency. It is recommended in the U.S. Department of Defense CDAO Generative AI Responsible AI Toolkit and named in the official guidance of defense ministries, central banks, financial regulators, and national AI authorities across Europe, Asia, and the Middle East. TrustLLM is cited in a U.S. Senate committee report, a NIST special publication on adversarial machine learning, the U.S. Department of Defense CDAO Generative AI Responsible AI Toolkit, and the International AI Safety Report 2026, and serves as an official benchmark in all four editions of the Future of Life Institute AI Safety Index.

He has received numerous honors, including the NVIDIA Academic Grant Program Award, the Foresight Institute AI for Safety & Science Nodes Grant, the Capital One Research Award, multiple Amazon Research Awards, AAAI New Faculty Highlights, Google Cloud Research Innovators, the Norton Labs Fellowship, the Meta AI4AI Research Award, the Carnegie Mellon University Presidential Fellowship, the 2025 SIGSPATIAL Best Short Paper Award, and the Second Prize CCC Award at the IEEE ICDM 2025 BlueSky Track.

He serves as an Associate or Action Editor for Transactions on Machine Learning Research, ACM Transactions on AI for Science, IEEE Transactions on Neural Networks and Learning Systems, and the Journal of Data-Centric Machine Learning Research, and as an Area Chair for major conferences including ICLR, ICML, and NeurIPS. Beyond academic service, he founded and runs 博士栈 (CSPhD.org), a non-profit community for CS / AI / EE / Stats PhDs that has grown to several thousand members since 2022.

Lab openings & PhD applications: see FORTIS Lab. For research collaborations, advising, and speaking requests, see collaboration or write to yue.z@usc.edu.

✈ News and Travel

[Aug 2026] Our position paper Auditable Agents has been accepted to the inaugural ACM AI Leadership Summit, held in Atlanta from August 30 to September 2. It argues that no agent system can be accountable without auditability, a position the Summit puts in front of industry leaders and policymakers rather than a research audience alone. [arXiv]

[Aug 2026] New preprint led by Shawn Li: JigShape: Evaluating Visual-Geometric Reasoning in VLMs through Jigsaw Puzzles. Tab-and-blank interlocking pieces remove the ambiguous ground truth that rectangular cuts create in texture-repeated regions, giving 95K puzzle instances with a single correct answer. Only one of five frontier models beats a random baseline on 4x4 grids, and every model collapses on larger ones even after fine-tuning, a scaling cliff that leaves geometric reasoning open for vision-language models. [arXiv]

[Jul 2026] Yue has been appointed Associate Co-Director of the USC Institute on Ethics and Trust in Computing for 2026-2027. He will work with Co-Directors John Hawthorne and Yan Liu on interdisciplinary research, education, and engagement around trustworthy and responsible computing.

[Jun 2026] Our group heads to ACL 2026 and ICML 2026. At ACL, Shawn Li presents his first-author Defenses Against Prompt Attacks Learn Surface Heuristics in the main conference. Yi Nian presents his first-author Auditable Agents at the KnowFM workshop (arXiv), with Tiankai Yang and Chenxiao Yu also attending ACL. At ICML, Jiate Li presents his first-author “Someone Hid It”: Query-Agnostic Black-Box Attacks on LLM-Based Retrieval. Come say hello!

[Jun 2026] We released auditable, an open-source system of record for AI-agent decisions: it captures what each decision relied on, replays it against live state, and rolls back the committed action when it no longer holds, on one typed graph across an agent's plan, run, and review. [GitHub]

[Jun 2026] New preprint: GRADE: Graph Representation of LLM Agent Dependency and Execution. GRADE models any agent run as one graph with two layers, execution (what ran in what order) and dependency (what each step relied on), and uses it to predict run failure and localize the faulting step in multi-agent runs. [arXiv] [GitHub]

[Jun 2026] Our open-source projects have been accepted into OpenAI's Codex for Open Source program. Thank you, OpenAI logo

Show more news

[May 2026] A collaborative paper Yue co-authored, CoAct: Co-Active LLM Preference Learning with Human-AI Synergy, has been selected for an Oral presentation at ACL 2026. Congratulations to the lead team. [arXiv]

[May 2026] Two collaborative papers Yue co-authored have been accepted to the KDD 2026 Datasets and Benchmarks Track: AutoDavis, an automatic and dynamic evaluation protocol for LVLMs on VQA, and Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation (Oral). Congratulations to the lead teams. [AutoDavis OpenReview] [RAG Benchmark arXiv]

[Apr 2026] Our paper “Someone Hid It”: Query-Agnostic Black-Box Attacks on LLM-Based Retrieval has been accepted to ICML 2026! Congratulations to lead author Jiate Li and the team. [arXiv] [GitHub]

[Apr 2026] We released agent-style, a drop-in rules package that shapes how AI coding and writing agents produce prose at generation time: 21 curated English style rules (12 from canonical writing authorities; 9 from field observation of LLM output) loaded into the agent's system prompt, with an opt-in style-review skill for a second pass. Works with Claude Code, Codex, Copilot, Cursor, Aider, and other AGENTS.md-compliant tools. [GitHub] [PyPI]

[Apr 2026] We released anywhere-agents, one config to rule all your AI agents: portable across every project and session, effective through curated writing, routing, and skills, and safer via a PreToolUse guard that blocks destructive Git and GitHub commands. Supports Claude Code and Codex today, with plans to grow. [GitHub] [Docs]

[Apr 2026] We received a Foresight Institute AI for Safety & Science Nodes grant for our work on audit-to-patch pipelines for LLM agent systems, building on our Auditable Agents framework. Thank you, Foresight Institute logo

[Apr 2026] We released PyOD 3, the agentic anomaly detection library: 60+ detectors across tabular, time series, graph, text, and image data, a new ADEngine orchestration core, and an agentic investigation layer that lets AI agents run expert-level anomaly detection via natural language. [GitHub] [Docs]

[Apr 2026] Our position paper Auditable Agents has been accepted to the ACL 2026 Workshop on Towards Knowledgeable Foundation Models (KnowFM). It defines what auditability means for LLM agent systems: five jointly necessary dimensions, three mechanism classes (detect, enforce, recover), and layered evidence from agent-audit, Aegis, and implicit execution tracing. [arXiv]

[Apr 2026] Our work on Multimodal Generative Engine Optimization (MGEO), a cross-modal ranking attack on vision-language model rankers, has also been accepted (archival) to the ACL 2026 KnowFM workshop. [arXiv]

[Apr 2026] Our group has three papers at ACL 2026 (two in the main conference, one in Findings), spanning prompt-attack defenses, human-AI preference learning, and memory leakage in multi-agent LLMs. See the publications page!

[Mar 2026] Congratulations to Shawn Li for successfully passing his qualifying exam!

[Mar 2026] Our open-source projects have been accepted into the Anthropic Claude for Open Source Program. Thank you, Anthropic logo

[Mar 2026] We received an NVIDIA Academic Grant Program Award for our project Inference-Time Safety for Multi-Agent Generative AI. Thank you, nvidia logo

[Mar 2026] We received an Amazon Research Award under the AI for Information Security program for work on securing agentic AI systems through auditing and guardrails. Thank you, Amazon logo

[Mar 2026] We contributed to Aegis, the open-source firewall for AI agents, with pre-execution blocking, human-in-the-loop approvals, and tamper-evident audit trails. A quick demo is available in the repository; if relevant to your workflows, please star it on GitHub.

[Mar 2026] We released agent-audit, an open-source security auditing tool for AI agent code with OWASP Agentic Top 10 style checks, taint analysis, and MCP configuration auditing. On ClawHub, agent-audit scanned 18,899 skills and found 13,947 vulnerabilities. If useful, please star it on GitHub.

[Feb 2026] Our work on premise verification via retrieval-augmented logical reasoning for reducing hallucinations has been accepted to TMLR. See publications page!

[Jan 2026] Our group contributed to five papers accepted to ICLR 2026 and WWW 2026. Hats off to the collaborators. See publications page!

🏅 Awards and Grants

As Principal Investigator (August 2023 onwards)
Prior to Principal Investigator Role (Before August 2023)