AI Evaluation & AI Safety. I build the evidence that decides whether a benchmark number means anything — contamination controls, safety evaluation pipelines, red-teaming, and disclosure artifacts.
PhD researcher in Intelligent Systems (Madrid). Thesis: a neuro-symbolic multi-agent system for variant prioritisation in ultra-rare disease — and the contamination-controlled benchmarks needed to trust it.
Benchmark validity. Memorisation and reasoning produce the same output on a passing benchmark, and the output then gets attributed to reasoning. Most of my work is designing evaluations where that confusion is impossible: stratified cohorts, phenotype-similar distractors, temporal splits, held-out regeneration.
Contamination control and disclosure. A score is a joint property of the model, the harness, the elicitation budget, the sampled population, and contamination status — leaderboards publish two of those five. I work on the taxonomy, the measurement, and the score-side artifact that closes the gap.
Red-teaming and judge reliability. Adversarial evaluation of both the system under test and the grader scoring it, including inter-rater reliability on human and LLM judges. An evaluation is only as trustworthy as its rubric applies consistently.
EU AI Act operationalisation. Turning Articles 9, 15 and 55 obligations — risk management, robustness, systemic-risk model evaluation — into pipelines that emit auditable evidence, rather than compliance prose written after the fact.
| Repository | What it is | Paper / artifact |
|---|---|---|
| contamination-disclosure-paper | Five-type contamination taxonomy organised by the mitigation each type defeats (direct, derivative, temporal, distributional, acquired), operationalised as a four-field disclosure protocol where unknown is a valid entry. Ships a JSON Schema, validator, worked examples, and the pre-registered audit instrument. CC BY 4.0 — copy it into your model card. |
Benchmark Contamination: A Taxonomy Organized by Defeated Mitigation — arXiv preprint (https://arxiv.org/abs/2608.29463), Aug 2026 |
| safety-eval-pipeline | Runs AISI Inspect safety benchmarks across multiple models under identical conditions — same items, same generation parameters, same grader — and fails the build when a model breaches a threshold. Per-benchmark reporting, scores broken out by the dataset's own categories, ranking by threshold violations rather than a composite. | Published run: leaderboard, gate report and logs in results/published |
| geno_agent | Agentic multi-agent RAG for causal gene prioritisation in rare Mendelian disease, evaluated under annotation-overlap stratification with clustered inference over 1,047 cases from 415 publications. The substrate is genomics; the result is about measurement. | Benchmark Contamination in Rare-Disease Gene Prioritisation — in review, 2026 Code and analysis: 10.5281/zenodo.22182323 |
| agent-channel-observability | A CoT monitor's measured recall can be an artifact of the serving configuration. Measures readable-reasoning share per arm from Inspect evaluation logs, separates withheld reasoning from reasoning never produced, and fails a build gate on it. | Paper: Coverage, Not Faithfulness 10.5281/zenodo.22847509 - Apart Research × CeSIA AI Incident Response Sprint, 11–13 Sep 2026 |
Open benchmark datasets. GenoAgent Benchmark — annotation-overlap-flagged rare-disease cohort, n = 1,047 · GenoAgent Benchmark (Hard) — phenotype-similar distractor variants. Both CC BY 4.0.
Talk. The model passed, but should we believe it? Contamination, memorisation and trustworthy safety evaluations, 2026 — 10.5281/zenodo.21750018
Most active research lives in private repositories until the corresponding paper is public. That currently includes a contamination-controlled benchmark for multimodal scientific summarisation, and the parts of the PhD gene-prioritisation work still under review. They open on publication.
In the pipeline for the rest of 2026:
- An open Spanish-language safety benchmark, with harm categories grounded in the EU AI Act rather than US content policy — native-speaker annotators welcome (get in touch)