Md Rizwan Parvez

Research

Auditable agentic AI: attributed, verifiable, and grounded.

The full version is in my research statement (PDF).

Large language models (LLMs) have made natural language a powerful interface to computation: non-experts seek answers through chat, developers describe software in English, and agents use tools on our behalf. Yet these systems fail in ways that are difficult for users to detect. Answers cite nonexistent or unsupported sources. Generated code runs but silently returns incorrect results. Agents act confidently on outdated or incomplete views of their environments. These failures are especially consequential in software, medicine, law, and finance.

Never let the model be its own only witness. An answer should be checked against its cited passages, a program against specifications and execution, and an action against observations of the environment it will change.

My research develops these checks throughout an agent’s workflow rather than only at the end. The resulting toolkit combines provenance-aware retrieval, execution-driven automation that reconciles parallel hypotheses, simulation-guided planning, and diagnostic evaluation that isolates failures.

Auditable agents
Attributed
Knowledge
What does the agent know?
Open-RAGFiLCoDelucionQACoT-PoTXolver
retrieval seeds code generationRedCoder
execution as a second witnessCoT-PoT
Verifiable
Code
What does the agent produce?
RedCoderMapCoderCodeSimxCodeEvalXolver
simulation and tree searchWebOperator
Grounded
Action
How does the agent act?
MapEvalWebOperatorSpatiaLabChartQAPro
Trust and safety, across all three Can the agent be trusted? X-TeamingPoison with StyleAI DebateAgentic SecurityAgentTell

Language–Knowledge: Retrieval, attribution, and evolving memory

Before an agent can be trusted to act, it must be trusted to know. Retrieval-augmented generation (RAG) grounds output in external text, but production RAG still retrieves misleading passages, cannot say which source supports which claim, and treats outdated content as current. My organizing claim is that attribution is a pipeline property, not a post-hoc citation: provenance survives to the output only if valuation, retrieval, filtering, and generation each expose an auditable, overridable decision.

Language–Code: Code generation and software engineering agents

Code is the scalable lever for natural-language automation, and because code can be executed, tested, and analyzed, the property that gives it power also lets us verify it. Today’s systems still produce code that runs but returns wrong results: the bottleneck is correctness, not fluency. This is my flagship line.

End-to-end language–code pipeline: federated coding agents retrieve, plan, simulate and verify, and execute and debug; a judge agent reconciles feedback into evolving memory; discussion and reviewer agents resolve issues behind safety guardrails.
End-to-end language–code pipeline: federated coding agents propose; a Xolver judge reconciles into evolving memory; SWE-Discussion and Agent-as-a-Reviewer resolve and review; safety guardrails gate the loop.

Language–Action: Grounded agents

An agent that knows and makes must finally act: navigate maps, fill forms, and compose workflows across tools. Across physical space, organizational data, and software screens, the failure is the same (models recite state they cannot operate on) and so is the method: instrument first, then build the agent.

Trustworthy agents

Trustworthiness has to be built in and then audited. Our critical review of LLM evaluation (top-29 most-cited at EMNLP 2024) diagnoses why model comparisons mislead; our agentic security survey (TMLR 2026) offers a three-pillar taxonomy across 274 papers; AgentTell studies behavioural side-channel leakage in browser-use agents; X-Teaming (COLM 2025) reaches 98.1% multi-turn attack success with collaborative planner–attacker–verifier agents; AI Debate (NeurIPS 2025) helps human judges beat single-advisor consultancy by 4–10 points; and CTF failure attribution shows security-agent failures are dominated by a reasoning ceiling rather than tooling.

Future directions

A unified, attributed, and safe knowledge substrate

Treat every form of knowledge an agent consumes (documents, memories, skills, and tools, in any modality) as one class of attributable object, with a cross-modal provenance graph, a continually red-teamed certification layer for the knowledge supply chain, and compounding memory whose provenance and safety certificates travel with it.

Trustworthy human–AI software engineering

A research platform that instruments the full development lifecycle across interactive, hybrid, and autonomous loops, gating review, repair, and vulnerability remediation behind formal verifiers and calibrated abstention, with SWE-Bench-style evaluation that scores a wrong fix against a safe abstention.

Grounding agents in a changing world

Agents are built and tested against static snapshots, so their grounding decays the moment the world moves. I aim to build agents that discover and compose unseen tools from documentation alone, long-horizon agents that solve memory-conditioned credit assignment over days to weeks, and a living evaluation infrastructure regenerated from live maps, feeds, repositories, and interfaces faster than it can leak into training data.