Experience

Coverage analysis and test design

• Audited GemIFT, a microarchitectural taint-tracking extension to the gem5 out-of-order CPU model, mapping all formal taint propagation rules to existing test coverage and identifying 12 rules with no validating test.

• Designed and implemented 25+ RISC-V assembly microtests validating previously untested propagation rules across the cache hierarchy, MSHRs, store queue, control flow, and speculative execution.

• Built deterministic cache-eviction scaffolding (2 KiB direct-mapped L1, set-aliasing address strides at a 0x800 gap chosen so the tag changes without touching set index bits and stays within the page offset) to force microarchitectural conditions unreachable in straight-line code, including controlled cache-line conflict evictions and load-ahead-of-store memory ordering hazards.

• Discovered that an entire class of control-flow taint checks had never executed in the existing suite, because a required environment configuration was never set by any test harness in the package, leaving the corresponding rule structurally unreachable.

• Predicted from source analysis that two independent taint counters shared a single detection path and had to fire in lockstep, then designed a test that confirmed the prediction in a single run.

Findings

• Identified and characterized a systemic detection gap in the framework's transient-execution counters: taint derived on a mispredicted path is invisible to the instrumentation because destination taint is computed at execute while the counter samples operands after the squash has reclaimed the physical register carrying the label. Proposed an execute-stage taint snapshot as the fix.

• Isolated the gap using a single-operand differential control, building two microtests identical except for one register operand to eliminate competing explanations, and reproduced the behavior across both store-side and load-side counters.

• Traced an apparent store-queue rule failure to store-to-load forwarding rather than an engine defect: the provided microtest resolved the store address early enough that the load forwarded from the store buffer and no hazard existed. Constructed a pointer-chase gadget that defers store address resolution so the load genuinely executes ahead of the store, confirming the rule fires correctly.

Differential testing

• Implemented a Spectre v1 attack in gem5 (branch predictor mistraining, cache flush, out-of-bounds speculative access, timing probe) and verified its execution profile against theoretical behavior using instruction-sequence trace visualization.

• Built an annotation-free differential oracle that identifies secret-dependent addresses and cache lines by sweeping secret values across runs and treating cross-run variation as ground truth for secret dependence. Validated true positives on the Spectre address channel and attributed residual divergence to squashed speculative accesses rather than missed leaks. The oracle is reusable against any secret-carrying gadget without special annotations.

Simulator and tooling work

• Extended the simulator in C++, adding an MSHR deallocation taint counter and per-event trace instrumentation to convert an indirectly-inferred rule into a directly assertable one.

• Extended the simulator's Python configuration layer to expose MSHR depth as a command-line parameter, enabling queue-saturation tests the default configuration could not produce.

• Developed automated regression harnesses in Bash driving gem5 across per-test cache and MSHR configurations, parsing statistics and trace output into pass/fail reports with full-suite tallies.

Dissemination

• Co-authoring a research paper documenting the coverage analysis and the design rationale for each microtest (in progress).

• Presented findings to Princeton faculty and Intel mentors.

• Leading development of a cycle-accurate CPU pipeline simulator in C++ to analyze microarchitectural bottlenecks and inform RTL improvements for SiliconJackets' custom RISC-V core. Models per-stage latencies, branch prediction, hazard/forwarding logic, and stall/flush behavior to quantify performance impacts.

• Authored coverage-driven SystemVerilog testbenches and test plans in collaboration with RTL designers; module-level regressions consistently achieved 98% statement/branch coverage with justified waivers. Used Verdi, VCS, and Xcelium.

• Applied protocol SVAs and constrained-random stimulus to expose edge cases; introduced targeted functional coverage (covergroups) on one module to exercise spec scenarios.

• Refactoring module-level benches into a full UVM architecture (agent, driver, sequencer, monitor, scoreboard), adding protocol SVA and constrained-random / virtual sequences.

• Designed test plans for a CPU module and created a SystemVerilog testbench to validate design functionality for module sign-off.

• Developed an AI support bot using Google's Gemini API and past support data to assist new members with onboarding. Open-source code and information is available in the projects tab.

• As Treasurer, managing a budget of $20,000+ for procurement of tools, software, and venues, optimizing resource allocation and cost efficiency.

• Built a Teams migration platform (PowerShell + Express.js + Microsoft REST APIs) that transferred 12k+ chats, 1M+ messages, and meetings across 500 users with incremental sync, caching, external user handling, parallelism, and corruption recovery. Delivered functionality otherwise available through Microsoft Partners under $30k+ multi-year contracts, eliminating vendor dependency.

• Engineered a SharePoint migration system (PowerShell + PnP modules) with error handling, API throttling, and full metadata preservation, migrating terabytes of files. Built and deployed before Microsoft's own solution was released from private preview.

• Worked directly with clients across the full engagement: gathering requirements, authoring migration documentation so teams knew what to expect before, during, and after cutover, and following up post-migration to surface and resolve issues.

• Automated cybersecurity forensics for Microsoft 365 by scripting mailbox investigations that parsed sign-in and access logs from compromised accounts to reconstruct attacker activity, establishing compromise onset, login frequency, and access patterns across the incident timeline.

• Developed enterprise automation scripts to strengthen compliance and efficiency: a VPN reporting system (Python + PowerShell + syslog) that filtered key security events into Excel and emailed daily summaries to management; mailbox audit tools (VBA + PowerShell) for insider threat analysis and unread email tracking, giving executives visibility into employee activity and organizational risk.

• Implemented custom-trained AI chatbots with LLM APIs and built web applications for clients using HTML, CSS, JavaScript, and PHP. Also trained an LLM to generate strategically structured targeted ads, reducing marketing cycle times.