Saeid Asgari
About
My science team at Microsoft Security builds enterprise evals for Security AI agents: evaluations of how security agents perform on the open-ended, messy tasks of real enterprise environments, where there is rarely a single correct answer.
Previously, my team built general enterprise evals for Copilot Tuning, where I established closed-loop evaluation: evaluation signals feed directly into agent improvement, through inference-time optimization or reinforcement fine-tuning (RFT), and the improved agent is then evaluated again.
One idea runs through my work: evaluation is a central constraint on foundation-model reliability. Deployed systems face open-ended tasks, long multi-step trajectories, and sustained optimization pressure against the evaluation itself. Static benchmarks with fixed answer keys describe a different regime.
Before Microsoft I worked on reliable AI at Autodesk Research, where I contributed to Generative AI Content Authentication at the U.S. AI Safety Institute Consortium (NIST AISIC). Before that, I worked in startup environments. I completed my PhD in Computer Science at Simon Fraser University (Vancouver, Canada), with research visits at MILA (Montréal, Canada) and Siemens Healthineers (Princeton, US).
Research
My work sits at the intersection of evaluation, security, and self-improving, long-horizon agents. The threads below share one framing: as models become more capable, evaluation becomes the binding constraint on real-world reliability.
Security evaluations for agentic systems
My current focus. Security poses distinct challenges for agent evaluation: tasks are open ended, ground truth is scarce, real customer environments cannot simply be copied into a test harness, and both attackers and defenders adapt. My team builds enterprise evals for security agents under these constraints, aiming to measure agents against the environments they actually operate in rather than against generic benchmarks.
Closed-loop evaluation and capability assessment
Previously at Microsoft, I led the team that built the agentic evaluation infrastructure for Copilot Tuning. There I established a closed-loop system connecting customer-facing evaluation to agent improvement: evaluation results drive reinforcement fine-tuning (RFT) or inference-time optimization, and the updated agent goes back through evaluation. The focus was long-horizon, tool-using agents and evaluation signals that stay meaningful inside such a loop.
Two questions run through this work. First, what to measure: models can pass tests by exploiting structure in the test rather than by reasoning. Second, what happens to an evaluation once a system is trained against it: rubrics, judges, and synthetic evaluators can drift, saturate, or get gamed under sustained optimization pressure.
- SibylSense (arXiv 2026) adapts a rubric generator through a tunable memory bank and an adversarial policy loop, to slow rubric saturation under optimization.
- GoalCover (arXiv 2026) decomposes a high-level goal into subgoals to expose capability gaps in fine-tuning data before training.
- Explain-Query-Test (EQT) (ICLR 2025) proposes a label-free capability signal: the gap between how well a model explains a concept and how well it comprehends its own explanation.
- MMLU-Pro+ (NeurIPS 2024) studies shortcut selection in benchmark design, where models score well without the reasoning the benchmark is meant to test.
Memorization and content provenance
Generative models can memorize training data and reproduce parts of it, sometimes verbatim, which raises overlapping copyright, privacy, and reliability concerns.
- Detecting Generative Parroting (CVPR 2024) flags probable verbatim reproduction at inference time using overfit masked autoencoders, without access to the training set.
A longer discussion of why memorization happens, how to detect it, and what to do about it appears in a three-part essay series I wrote for Autodesk Research (part 1, part 2, part 3). Related to this work, I contributed to Generative AI Content Authentication at the NIST AISIC.
Vision-language and multimodal understanding
- Determining the Preferred Image Distribution of a Black-Box VLM (NeurIPS 2024) estimates a vision-language model's preferred input distribution without access to weights or training data, useful where input distribution matters (computer-aided design, medical, and industrial imagery).
- SLiMe (ICLR 2024) and SMITE (ICLR 2025) optimize textual embeddings for one-shot segmentation in images and video, respectively.
- Learned Visual Features to Textual Explanations (ICLR 2024) bridges learned visual features and natural-language explanations.
Robustness and earlier foundations
Earlier threads that shaped how I think about evaluation today.
- MaskTune (NeurIPS 2022) reduces reliance on spurious correlations by masking salient features, forcing models to find alternative discriminative signals.
- Robust Representation Learning via Perceptual Similarity Metrics (ICML 2021, Spotlight) proposes perceptual similarity as a robustness objective for self-supervised representations.
- A Kernelized Manifold Mapping (CVPR 2019) studies adversarial perturbations through learned manifold projection.
My PhD focused on reliable deep learning for medical imaging. Work from that period includes a Deep Semantic Segmentation review (AI Review 2020), widely cited in medical-image segmentation, and InfoMask (MICCAI 2019, Early Accept), which used masked variational latent representations for weakly-supervised chest disease localization during a research visit at MILA.
Service
- Contributed to Generative AI Content Authentication at the U.S. AI Safety Institute Consortium (NIST AISIC).
- Adjunct Research Professor, Simon Fraser University. Co-supervising PhD and Master's students on foundation models and reliable AI.
- Reviewer for NeurIPS, ICML, ICLR, CVPR, MICCAI, and NSERC Canada.
Selected Talks
- 2025Towards More Reliable Generative AI: Evaluation and Mitigation Strategies at Microsoft
- 2024The Parroting Problem of Generative AI at Autodesk TechX
- 2022Spurious Correlations in Computer Vision at Sony AI
- 2022Input Space Modifications for Reducing Spurious Correlations at Google Research
- 2021Robust Representation Learning via Perceptual Similarity Metrics at ICML
- 2020Towards Interpretable and Bias-Resilient Point Cloud Processing at ICML