Justin Cappos
New York University, NY·Computer Science
Software now underpins science, government and daily life, yet it is hard to know exactly what code went into a program, whether it was tampered with, or whether a computed result can be trusted and repeated. These projects treat this as a supply chain problem.
- Fields
Computer Science
Engineering
- Topics
software supply chain security
computational reproducibility
reproducible research
- Grants
- 4 known grants, through Aug 2029
What they work on
- Build a command-line framework that automatically records software artifacts, environments, dependencies and actions during experiments, so computational studies can be rebuilt and rerun in the cloud for independent verification.
- Index captured experiment records in a large repository and reconstruct experiments in cloud environments to support long-term reproducibility of computational research.
- Develop GRISL, a lightweight userspace containment system that wraps unsafe C and C++ scientific libraries with runtime safety checks at about 1% overhead, protecting against memory bugs without code changes.
- Enable safe communication between isolated libraries in GRISL and validate hardened libraries with advanced testing on the CloudLab and Chameleon testbeds.
- Create SBOMit, an open-source ecosystem that uses in-toto cryptographic attestations to produce tamper-resistant Software Bills of Materials that can be checked automatically.
- Secure the digital legal supply chain by building authentication into lawmaking, verifiable redacted documents and long-term archiving of laws, deployed through The Archive Framework (TAF).
More about the research
Software, scientific experiments and even laws pass through many steps, and each step can be recorded and checked using cryptography, math-based methods that make tampering detectable. The work spans tools for reproducing scientific computations, making unsafe scientific code libraries safer, verifying lists of software components, and securing how laws are published.
Why it matters
Software supply chain attacks, unreliable scientific code and tampered records threaten industry, government and research. These tools could help scientists repeat and trust computational results and prevent crashes and silent data corruption in physics, biology and climate simulations. They could also give organizations free ways to verify what is in their software, and help governments ensure that published laws are authentic and unaltered.
Known grants
From NIH and NSF research grants. Labs often have other funding we can't see.
CICI: TCR: Improving Computational Research Reproducibility
NSF · Sep 2026 – Aug 2029
CICI: TCR: Protecting and Hardening Scientific Use Of Software Libraries With GRISL
NSF · Jan 2026 – Dec 2028
NSF POSE: Phase II: Building an Open-Source Ecosystem to Secure Software Bills of Materials
NSF · Sep 2024 – Aug 2027
Closest labs
Yueqi Chen
University of Colorado Boulder, CO·Computer Science
Refactor the Community Earth System Model (CESM) codebase by decoupling its computational and control logic and rewriting the control layer in Python, so that modern security practices can be integrated.
Xing Gao
University of Delaware, DE·Computer Science·Early-career
Build a security testing system that combines dynamic execution and static analysis to examine every critical component of continuous software development pipelines and how each interacts with the people and organizations involved.
Luyi Xing
University of Illinois Urbana-Champaign, IL·Computer Science·Early-career
Analyze attacks on AI agent messaging under the NLIP open standard, including authorization weaknesses, session hijacking, cost-amplification abuse, memory poisoning, prompt injection and semantic manipulation of message content.
The school
New York University: 72 labs on PI Pages, $1.5B a year on research, 540 research doctorates a year.
Reach out
A start for your email. Fill in the brackets.