Adel Bibi is a Senior Researcher in Machine Learning and Computer Vision at the Department of Engineering Science at the University of Oxford, a Research Member of the Common Room and a former Junior Fellow at Kellogg College, and a member of the ELLIS Society. He is also an R&D Distinguished Advisor at SoftServe. Previously, he was a Senior Research Associate and postdoctoral researcher in the Torr Vision Group at Oxford working with Philip H.S. Torr. He obtained his MSc and PhD from KAUST in 2016 and 2020, respectively, under the supervision of Bernard Ghanem.
His research focuses on trustworthy and robust AI, agentic AI safety, and adversarial machine learning. His recent work on vulnerabilities in AI agents, transferable adversarial attacks, and AI safety evaluations has received broad international attention, including coverage by Scientific American, The Guardian, NBC News, Computerphile, TLDR News, Globo TV, and the Hugging Face Evaluation Guidebook. His work has received multiple paper and service distinctions, including four best/outstanding workshop paper awards (NeurIPS'23, ICML'23, CVPR'22, OBD'18), four outstanding reviewer awards (CVPR18, CVPR19, ICCV19, ICLR22), and a Notable Area Chair Award at NeurIPS 2023. He regularly serves as a Senior Area Chair and Area Chair for major AI conferences including NeurIPS, ICML, ICLR, etc. Bibi has authored more than 50 publications in top-tier machine learning and computer vision venues, including NeurIPS, ICML, ICLR, CVPR, ICCV, ECCV, AAAI, and TPAMI.
Download my resume
[Note!] I am always looking for strong self-motivated PhD students. If you are interested in AI Safety, Trustworthy, and Security of AI models and Agentic AI, reach out!
[Consulting Expertise] I have consulted in the past on projects spanning core machine learning and data science, computer vision, certification and AI safety, optimization formulations for matching and resource allocation problems, among other areas.
King Abdullah University of Science and Technology (KAUST)
PhD in Electrical Engineering (4.0/4.0)
2020
Machine Learning & Optimization Track
MSc in Electrical Engineering (4.0/4.0)
2016
Computer Vision Track
BSc in Electrical Engineering (3.99/4.0)
2014
Thesis: Synthetic Artificial Intelligent Clothes
Senior Researcher
Mar 2023 – Present
Senior Research Associate
Dec 2021 – Feb 2023
Postdoctoral Research Assistant
Oct 2020 – Dec 2021
R&D Distinguished Advisor
Aug 2024 – Present
Executive Director
Aug 2025 – Present
Chief AI Officer
Feb 2023 – Present
PhD Research Intern
Jun – Nov 2018
~~ End of 2025 ~~
~~ End of 2023 ~~
~~ End of 2022 ~~
~~ End of 2021 ~~
~~ End of 2020 ~~
~~ End of 2019 ~~
~~ End of 2018 ~~
~~ End of 2017 ~~
~~ End of 2016 ~~
~~ End of 2015 ~~
Research grants and funding received, and media coverage of our work
A skill is a modular package of natural-language instructions, executable scripts, and reference resources that an agent can load at runtime to extend its capabilities for a specific task. Skill-based agent systems therefore enable flexible reuse of third-party capabilities, but the openness of this skill ecosystem also opens up a new attack surface. Prior work has focused on vulnerabilities within individual skills, but little attention has been paid to risks that arise from interactions across skills. In this paper, we introduce skill cascading attacks, a threat paradigm in which a malicious objective is distributed across multiple skills so that each modification looks benign in isolation, yet their combined execution is harmful. For instance, in a prescription-review pipeline, the first skill weakens signals of recently discontinued medications in the extracted history, the second downgrades the severity of any drug interaction tied to them, and the third suppresses the resulting low-priority alert in the final summary, so that a severe drug-interaction warning silently disappears before reaching the physician. To systematically study this safety blind spot, we develop SkillCascade, an automated multi-agent red-teaming framework, and release SkillCascade-Bench, a benchmark of 213 validated cascading test cases across multiple agent systems and domains. Across representative agents (e.g., OpenClaw, Claude Code, Codex) and LLM backbones, cascaded interactions reliably induce harmful behaviors while evading existing per-skill scanners and runtime monitors. Our findings highlight a gap between component-level integrity and system-level safety, and call for defenses that reason over cross-skill interactions rather than individual skills in isolation.
Recent advances in end-to-end trained omni-models have substantially improved audio capabilities by strengthening text-audio modality alignment. However, whether such alignment inadvertently facilitates the transfer of safety vulnerabilities across modalities remains underexplored. This question is critical as text-based jailbreak attacks are considerably more mature than audio-based ones; if they transfer systematically, current audio safety evaluations may underestimate risks originating from the text modality. In this paper, we introduce the Alignment Curse, a formally characterized and empirically validated principle showing that stronger modality alignment enables more effective transfer of attacks from text to audio, revealing a fundamental tension between capability and safety. Motivated by this principle, we conduct a comprehensive black-box evaluation of three attack categories on recent omni-models (e.g., Qwen2.5-Omni, Qwen3-Omni): text attacks, text-transferred audio attacks, and audio attacks. We find that text-transferred audio attacks perform comparably to, and often better than, audio-based attacks, exhibiting a clear advantage under audio-only access. This suggests that text-based vulnerabilities play a pivotal role in shaping audio safety risks. Finally, we empirically analyze the relationship between modality alignment and transfer effectiveness across attack methods and models, observing consistent support for the Alignment Curse: tighter modality alignment leads to more effective cross-modality attack transfer.
Chains-of-thought (CoT) allow language models to verbalise multi-step rationales before producing their final answer. While this technique often boosts task performance and offers an impression of transparency into the model’s reasoning, we argue that rationales generated by current CoT techniques can be misleading and are neither necessary nor sufficient for trustworthy interpretability. By analysing faithfulness in terms of whether CoTs are not only human-interpretable, but also reflect underlying model reasoning in a way that supports responsible use, we synthesise evidence from previous studies. We show that verbalised chains are frequently unfaithful, diverging from the true hidden computations that drive a model’s predictions, and giving an incorrect picture of how models arrive at conclusions. Despite this, CoT is increasingly relied upon in high-stakes domains such as medicine, law, and autonomous systems—our analysis of 1,000 recent CoT-centric papers find that ~25% explicitly treat CoT as an interpretability technique—and among them, papers in high-stakes domains specifically hinge on such interpretability claim heavily. Building on prior work in interpretability, we make three proposals: (i) avoid treating CoT as being sufficient for interpretability without additional verification while continuing to use CoT for its communicative benefits, (ii) adopt rigorous methods that assess faithfulness for downstream decision-making, and (iii) develop causal validation methods (e.g., activation patching, counterfactual interventions, verified models) to ground explanations in model internals.