Grounded in the theoretical foundations of robust statistics and non-convex optimization, I propose robustness-informed neural networks (RINNs), a principled framework applicable across diverse architectures and domains. I instantiate RINNs for transformers via robust attention [ProTransformer, NeurIPS'24], for graph neural networks via unbiased robust aggregation [RUNG, NeurIPS'24], and for convolutional networks via robust dictionary structure [EDLNets].

Real-world deployment is constrained by limited training budgets, heterogeneous compute, and ever-changing environments, raising three practical questions I pursue:

1. How to accelerate robust training? I cut the cost of robust training by removing redundancy across iterative attack/defense steps, matching standard adversarial training's robustness with only 30% of the training budget [Spiking Attacks, ICLR'26].
2. How to robustify models with limited resource? I enable resource-adaptive robustification of pretrained models through training-free integration [ProTransformer, NeurIPS'24] and versatile robustness reprogramming across paradigms spanning training-free adaptation to full fine-tuning [Robustness Reprogramming, ICLR'25].
3. How can a single model handle dynamic environments? I train one all-in-one model conditioned on risk type, so new risks are met with a lightweight adapter rather than retraining the backbone [CAN].

I systematically cut computational overhead across all three levels:

1. Algorithm-wise: I eliminate redundant operations across iterative trustworthy-AI procedures, accelerating iterative attacks and adversarial training [Spiking Attacks, ICLR'26], randomized smoothing [SRS, NeurIPS'24], and memory-enhanced graph learning [IncAgg-GNN, NeurIPS'26].
2. Kernel-wise: I design hardware-aware GPU kernels that minimize memory traffic, fusing robust reweighting into IO-aware attention kernels to safeguard LLM agents in real time [ProFlashAttention].
3. Precision-wise: I compute with fewer bits by quantizing the small, stabilizing updates in iterative procedures rather than full activations, as in accelerated generative modeling [ModDiff, ICML'25], extending to quantized iterative attacks and adversarial training.