Chair: Dr. Carla Di Cairano-Gilfedder (BT)

Guang Yang (Imperial College, London)

Beyond the Pixel: Trustworthy and Safe Generative AI for Medical Image Quality Transfer

In the era of precision medicine, medical imaging has become a cornerstone of diagnosis, treatment planning, and disease monitoring. However, acquiring high-quality, clinically valuable images often requires longer acquisition times, increased radiation exposure, or resource-intensive equipment. This talk explores the transformative potential of Image Quality Transfer (IQT), which combines advanced machine learning with image reconstruction and registration techniques to enhance image quality without requiring additional scanning resources. By transferring high-quality characteristics to lower-quality or heterogeneous medical images, IQT can enable more efficient, safer, and scalable imaging practices. The talk will introduce some novel methodologies underpinning IQT, with particular emphasis on generative AI and deep learning approaches for bridging quality gaps across imaging modalities, acquisition protocols, and clinical centres. Crucially, it will examine the trustworthiness and safety challenges associated with generative image enhancement, including the risk of hallucinating plausible but incorrect anatomical structures, obscuring subtle pathology, propagating bias, and producing unreliable outputs under distribution shifts. Strategies such as data-consistency constraints, uncertainty quantification, explainability, external validation, and human oversight will be discussed as essential safeguards. The talk will conclude by considering how trustworthy and clinically validated IQT can advance diagnosis, prognosis, and therapeutic decision-making while protecting data integrity and patient safety.

Dr. Guang Yang is an Associate Professor (Reader) in the Bioengineering Department and Imperial-X at Imperial College London. He holds a UKRI Future Leaders Fellowship and serves as an Honorary Senior Lecturer in the School of Biomedical Engineering & Imaging Sciences at King`s College London. He is an Associate Editor of IEEE Transactions and npj Digital Medicine. His research group is dedicated to developing novel and translational techniques for imaging and biomedical data analysis. The group’s focus encompasses research and development in data-driven fast imaging, data harmonization, data synthesis, federated learning, explainable AI, and AI in drug discovery. Currently, his work spans a wide range of clinical applications in ageing, cardiovascular disease, lung disease, and oncology. For more information about Yang’s Lab, visit: https://www.yanglab.fyi/ and Twitter: @gyangMedIA

Prof. Simon Hadfield (University of Surrey)

Spoofing Deep Leakage Attacks in Federated Learning

Federated learning is often described as privacy-preserving because clients keep their raw data locally and share only gradients or model updates. However, deep leakage and gradient inversion attacks have shown that these updates can still reveal sensitive training examples or task semantics. Existing defences typically try to obscure this information through noise, clipping, pruning, compression, or related perturbations, but these approaches can degrade utility and may still leave enough structure for an attacker to infer private content.

This talk presents SpooFL, a defence that reframes the problem from hiding information to misleading reconstruction attacks. Rather than merely degrading the attacker’s output, SpooFL uses a generative model trained on an unrelated external dataset to produce plausible but false samples. These spoofed samples are optimised so that they induce training behaviour similar to the private data, allowing federated learning to proceed while causing leakage attacks to reconstruct convincing images from the wrong domain.

The key contribution is therefore not just technical, but conceptual: privacy can be achieved by deception as well as suppression. A failed attack is not necessarily one that produces noise; it may be one that produces a confident but incorrect reconstruction. The talk will discuss SpooFL’s mechanism, its evaluation against established defences, and the proposed metric of Private Leakage Confidence, which measures whether leaked reconstructions still resemble the private data. It will also consider broader implications for privacy-preserving machine learning, including adaptive attackers, semantic leakage, and whether spoofing-based defences can extend beyond image-based federated learning to multimodal or sensor-driven systems.

Simon Hadfield is Professor of Robot Vision and Autonomous Systems at the University of Surrey. He manages a research team of 10 people, looking at various aspects of perception and decision making within robotics and autonomous systems. He has supervised thirteen successfully completed PhD students, including the winners of three Sullivan Thesis Prizes for the best UK PhD thesis in Computer Vision. He has been named Surrey`s `Early Career Teacher of the Year` and `Research Supervisor of the Year` for the Faculty of Engineering and Physical Sciences.

Ilya Ilyankou (UCL) and James Haworth (UCL)

The Scenic Route to Deception: Dark Patterns and Explainability Pitfalls in Conversational Navigation

As generative AI shifts from producing content to mediating decisions, the explanation a system gives for its choices becomes a surface for both manipulation and unintended harm. When a conversational agent justifies a recommendation in fluent natural language, that justification is hard to verify against ground truth, opening a semantic gap between what the system optimises for and what the user believes it is doing. We examine this gap through the case of conversational navigation, where the consequences are embodied and immediate, but the failure modes generalise to any agent that persuades rather than just computes.

We propose a 2×2 framework that classifies trust failures along two axes: intent (deliberate dark patterns vs accidental explainability pitfalls) and origin (the system`s hidden logic vs its interface and tone). This separates intentional steering (for example, directing a user toward a commercial partner under the guise of `atmosphere`) from unintended harms, such as an overconfident, reassuring persona that lowers user vigilance in a genuinely risky setting.

To operationalise trust, we argue against seamless design and for seamful design: systems should expose, rather than conceal, the gap between their internal reasoning and what the user can see. One way to enforce this is to confine the language model to interpretation and explanation while a separate, verifiable engine grounds its outputs, deterministically triggering disclosures and uncertainty-aware hedging that the conversational layer cannot suppress. In the navigation case, this lets the system compute the asymmetry between user cost and third-party benefit, making the distinction between deliberate deception and accidental error auditable and legible to both users and regulators. The underlying move of pairing a persuasive neural surface with a constraint layer it cannot override generalises to any high-stakes conversational agent.

Ilya Ilyankou is a PhD candidate at UCL SpaceTimeLab, funded by UKRI (EPSRC) and Ordnance Survey, researching how people communicate about place, working across GeoAI, NLP, and HCI to study spatial information needs across interfaces, from query logs to conversational AI. Ilya is also co-founder and CTO of Safest Way, a Geovation-backed startup building safety-focused pedestrian navigation.

James Haworth is Associate Professor in Spatio-temporal Analytics at SpaceTimeLab in the Department of Civil, Environmental and Geomatic Engineering. Before coming to UCL, James studied Geography at the University of Leeds, where he focussed on geodemographics and retail geography. He obtained his MSc in Geographic Information Science from UCL in 2009, before embarking on his PhD study as part of the EPSRC funded STANDARD project (Spatio-Temporal Analysis of Network Data and Route Dynamics, EPSRC: EP/G023212/1).After completing his PhD, James worked as a teaching fellow at CEGE and as research associate on the Crime, Policing and Citizenship (CPC) project (EPSRC: EP/J004197/1), before taking up his lectureship in 2014 and Associate Professorship in 2021. His research focuses on machine learning and artificial intelligence techniques for spatiotemporal data modelling and analysis, with applications in transportation, geodemographics and crime, amongst others.

Prof. Simon Hadfield (University of Surrey)

Differential Adjusted Parity for Learning Fair Representations

Learning fair representations requires reducing sensitive information while preserving the structure needed for accurate downstream prediction. Adversarial debiasing methods address this by training a representation model against a sensitive-attribute classifier, but this can be unstable, computationally expensive, and sensitive to hyperparameters. Simpler non-adversarial methods are easier to optimise, but may achieve apparent fairness by degrading performance equally across sensitive groups, yielding representations that are fair only because they are weakly informative.

This paper introduces Differential Adjusted Parity (DAP), a non-adversarial loss for fair representation learning. DAP is based on an adjusted parity metric that combines task performance with consistency across sensitive feature domains. The paper generalises this metric to multiple sensitive domains and makes it differentiable using soft balanced accuracy, computed from predicted class probabilities rather than hard class decisions. By measuring balanced accuracy within each sensitive group and penalising variation between groups, DAP encourages representations that remain task-relevant while reducing sensitive-attribute leakage. This avoids the degenerate solution of making all groups equally poorly served.

The method is evaluated on the Adult dataset, using income prediction with gender as the sensitive attribute, and COMPAS, using recidivism prediction with race as the sensitive attribute. DAP is compared against NODEBIAS, LAFTR, CFAIR, and FAIR/ALFR using task accuracy, sensitive-feature predictability, demographic parity difference, equalised odds difference, and adjusted parity. Across both datasets, DAP improves fairness while retaining competitive task performance. It achieves strong adjusted parity, reduces sensitive-attribute predictability, and supports multi-class sensitive attributes.

Overall, DAP offers a stable, differentiable alternative to adversarial debiasing. Its main contribution is a practical objective that jointly promotes predictive utility and fairness across sensitive groups.

Simon Hadfield is Professor of Robot Vision and Autonomous Systems at the University of Surrey. He manages a research team of 10 people, looking at various aspects of perception and decision making within robotics and autonomous systems. He has supervised thirteen successfully completed PhD students, including the winners of three Sullivan Thesis Prizes for the best UK PhD thesis in Computer Vision. He has been named Surrey`s `Early Career Teacher of the Year` and `Research Supervisor of the Year` for the Faculty of Engineering and Physical Sciences.

Ciaran Bench (National Physical Laboratory)

Decision-theoretic uncertainty quantification in generative deep learning

Although deep learning has achieved remarkable success across a wide range of tasks, unreliable performance on previously unseen data remains a major obstacle to deployment in real-world settings. In principle, uncertainty quantification (UQ) can facilitate this by providing some indication of the trustworthiness of predictions (i.e. how likely they are to be correct).

However, popular approaches for evaluating the quality of predicted uncertainties are not always effective. Among several drawbacks, common approaches mostly cater to supervised models and do not trivially extend to the case where there are no ground truths (e.g. generative models). Furthermore, the decision-making process underpinning the use of model predictions is not usually considered, limiting the practical insights that can be drawn about the utility of corresponding uncertainty estimates (i.e. their ability to encode information about decision consequences).

Here, we discuss how decision-theoretic uncertainty quantification (DTUQ) provides a convenient means to tackle these challenges. We consider case studies in wearable photoplethysmography (a biomedical sensing modality). We demonstrate how DTUQ provides a means to evaluate and estimate uncertainties in generative modelling with an example from a GAN-driven domain-adaptation task. We also describe efforts to formulate a separate decision-centric evaluation framework for UQ in Atrial Fibrillation Classification.

This work illustrates how considering the decision making process can help form actionable insights about uncertainty reliability that are relevant to the deployment of generative models. Ultimately, this helps realise the impact AI can have on healthcare.

Ciaran Bench is a research scientist at the Department of Data Science and AI at the National Physical Laboratory, with expertise in trustworthy model development and uncertainty quantification in deep learning. Prior to this, he undertook postdoctoral research at the University of Exeter, and a PhD at University College London applying deep learning to problems in biomedical engineering.

Ikenna Umeh (BT Research)

Zero Trust Architectures for Secure Multi-Agent AI Systems: From Identity to Collaboration Integrity

The emergence of autonomous AI agents and large-scale multi-agent systems introduces a fundamental security challenge: trust can no longer be assumed and must be continuously established across identity, behaviour, and collaboration. Traditional approaches, based on static credentials, centralised orchestration, and implicit trust, are insufficient in dynamic environments where agents may evolve or be compromised. This work presents a holistic Zero Trust architecture for multi-agent systems, integrating four core layers: semantic identity, graph-native orchestration, distributed integrity, and behavioural assurance.

Semantic authentication enables continuous identity verification using behavioural and knowledge-based fingerprints, allowing detection of impersonation and drift. A graph-native collaboration model replaces message-passing with a shared knowledge graph that drives coordination through dependency-aware execution, parallel dispatch, recalibration cascades, and persistent inter-agent feedback. In parallel, distributed integrity mechanisms enforce tamper-evident collaboration using hash-chained contribution ledgers and gossip-based validation, providing cryptographic provenance and non-repudiation of agent outputs.

Finally, multi-dimensional behavioural monitoring establishes baselines and detects compromise through deviations across semantic, temporal, and coordination signals. Together, these components form a Zero Trust collaboration model in which every agent interaction is continuously verified within the system itself, without reliance on a central authority. This approach enables secure, scalable, and auditable multi-agent AI systems for high-assurance domains such as cybersecurity, defence, and regulated enterprise environments.

Cyber Defence Research Specialist at BT, working within Security Research and Threat Detection. My work focuses on AI-driven cybersecurity, particularly multi-agent systems, threat intelligence prioritisation, and autonomous defence frameworks. I actively contribute to innovation through patented technologies and lead initiatives that translate advanced research into operational security capabilities. Alongside this, I mentor early-career talent and deliver talks on responsible AI adoption in cyber defence.

Dr Yunxiao Zhang (Exeter University)

Can We Trust the Voice on the Line? Robust Audio Deepfake Detection from Real-World Calls to the First “Hi”

Generative AI can now produce highly convincing synthetic speech, creating growing risks of impersonation, fraud and voice-based social engineering. Although existing Audio Deepfake Detection systems achieve strong results on clean recordings, their performance can decline substantially when speech is transmitted through telephone and internet communication systems. This talk presents our work towards practical and trustworthy audio deepfake detection. We first introduce ADD-C, a benchmark that evaluates detection systems under realistic communication conditions involving speech codec compression and packet loss. We then present a communication-aware detection framework based on Multi-Granularity Adaptive Time–Frequency Attention, which identifies and strengthens subtle forgery traces that may be obscured during transmission. Finally, we consider whether a deepfake can be detected at the very beginning of a conversation. Our Short-MGAA framework operates on only 0.5–2 seconds of speech, potentially allowing detection from a caller’s first “Hi”, while remaining sufficiently lightweight for real-time and edge-device deployment. The talk demonstrates that trustworthy audio deepfake detection requires not only accuracy, but also robustness to real communication environments, rapid decision-making and practical computational efficiency.

Dr Yunxiao Zhang is a Lecturer in Cyber Security in the Department of Computer Science at the University of Exeter and also a member of TurGeen AI Lab at Exeter (https://trugreen-ai-lab.github.io/TruGreen-AI-Lab/#/). He received his PhD from Imperial College London. His research focuses on cybersecurity risk management, trustworthy artificial intelligence and decision support, with particular interests in audio deepfake detection, AI-agent security, and security games. His recent audio deepfake research investigates how detection systems perform under realistic communication conditions, including speech codec compression, packet loss and ultra-short conversational inputs. This work has contributed new benchmarking datasets and communication-aware, lightweight detection methods designed for practical deployment. He has published research in venues including IEEE TIFS, IEEE TDSC, Decision Support Systems, Computers & Security, IEEE CSF, CVPR, IEEE ICASSP, and EUSIPCO.