A stop sign is an unusually impatient piece of writing. One word. Four letters. No footnotes. Bo Li and her collaborators found a way to give a machine a different reading: add carefully designed black-and-white stickers, then watch a road-sign classifier label the result as a 45 mph speed-limit sign. To a person, the instruction remained legible. To the tested network, the meaning had changed. It was a small act of experimental mischief with a serious question inside it: how much should we trust a machine that sees differently from us? ↗
The work, first posted in 2017, took adversarial examples beyond altered pixels on a screen. The team designed physical perturbations to survive changes in viewpoint and other conditions, then tested them in the laboratory and with video captured from a moving vehicle. For the particular classifier and sticker attack described in the paper, targeted misclassification occurred in all laboratory images and 84.8 percent of captured field-test frames. Those results concerned a tested classifier, rather than the behavior of an entire self-driving vehicle. The experiment was useful precisely because its claim was specific. ↗
The sign had an afterlife. In 2019, Li’s lab announced that its physical adversarial stop sign had entered the permanent collection of London’s Science Museum. Research usually reaches the public through a headline or a diagram. Here was something you could stand in front of: an ordinary object made troublesome by an extraordinary difference in perception. A museum visitor could read STOP and understand the problem before learning a single equation. ↗
Learning to think like an opponent
Li’s interest in difficult inputs predates the stickers. She earned a computer science bachelor’s degree at Tongji University in Shanghai in 2011, then pursued doctoral research at Vanderbilt. By 2015, she was working on adversarial machine learning and game-theoretic analysis of secure learning systems. Her projects included robust spam classification and anomaly detection against poisoning attacks. Spam is a rather unglamorous teacher, but a useful one: someone on the other side is actively trying to persuade the system to make the wrong decision. ↗
That year she received a Symantec Research Labs Graduate Fellowship, one of three recipients nationwide. The fellowship included support for research collaboration, and she was offered an internship at the company’s San Jose laboratory. Her adviser at Vanderbilt was Eugene Vorobeychik. The outline of her later career was already visible: a mathematical account of an adversary’s choices, followed by contact with the engineering work required to defend against them. ↗
She completed her computer science Ph.D. in 2016, worked as a Berkeley postdoctoral researcher with Dawn Song in 2017 and 2018, and joined the Illinois faculty in 2018. Those moves brought her into a network that would matter well beyond a single paper. Song would eventually become a co-founder of Virtue AI. Academic collaboration had become a lasting working relationship, able to travel from an experiment to a company. ↗
The pleasure of a difficult question
At Illinois, Li built her work around the connections between robustness, privacy, and generalization. A robust system should withstand certain disturbances or attacks. A private system should protect information. A generalizable system should remain useful beyond the examples it learned from. Her research asks how those demands interact. It is easy to write three desirable words on a slide. Making them coexist, with guarantees, is considerably more demanding. ↗
Recognition arrived along the way: the global Innovators Under 35 list in 2020, a Sloan Research Fellowship in 2022, and the Computers and Thought Award that same year. The latter recognized her work on the links between robustness, privacy, and generalization, together with mathematical approaches to protection. It was an award for understanding relationships inside a problem, as well as for exposing failures on its surface. ↗
The award also gave Li a moment to look at the names beside her own. She had respected earlier recipients for years. She spoke about the pleasure of joining their company, then returned to the practical business of explaining the research to peers. In the same conversation, she credited students who suggested experiments she had never considered and faculty colleagues David Forsyth and Carl Gunter who opened doors to collaborations. Her account of progress had other people in it. ↗
“I feel quite honored and happy”Bo Li, on the 2022 Computers and Thought Award
Eight ways to ask whether you trust a model
As language models became more widely used, the object of scrutiny changed again. Li co-authored DecodingTrust, an evaluation project organized around eight perspectives on trustworthiness. Its original assessment examined GPT-3.5 and GPT-4. The questions ranged from privacy and fairness to adversarial robustness, machine ethics, and how models respond outside familiar data conditions. That range gave a broad word, trust, a set of handles. ↗
A model may answer a routine question competently while behaving poorly when the framing changes. It may avoid one kind of undesirable response while remaining susceptible to another. The value of an evaluation with several dimensions is that it makes those differences visible. In everyday terms, it resembles checking several references before giving someone responsibility. One agreeable conversation is a thin basis for confidence. ↗
DecodingTrust received an Outstanding Paper Award at NeurIPS in 2023 and the NSA’s Best Scientific Cybersecurity Paper Award in 2024. The project also made data and evaluation scripts available for others to use. That matters in a field where demonstrations arrive quickly and the conditions behind them can be easy to overlook. ↗
A paper acquires customers
Li co-founded Virtue AI in 2024 with Dawn Song, Sanmi Koyejo, and Carlos Guestrin. She served as CEO. The team brought together researchers across Illinois, Berkeley, and Stanford to work on security and compliance for AI applications. Their working territory extended from identifying vulnerabilities to helping enterprises put defenses into operation. The company gave the research a new audience: people responsible for systems that had to function every day. ↗
In April 2025, Virtue AI announced $30 million in combined seed and Series A funding, led by Walden Catalyst Ventures and Lightspeed Venture Partners. The financial milestone bought attention for a less photogenic task: testing risks, adding guardrails, and connecting security tools to the places where AI was being used. For a researcher becoming a chief executive, the argument now had to survive both technical scrutiny and the practical questions of prospective customers. ↗
Li described the motivation as a gap between foundational security research and what enterprises could actually deploy. Turning a finding into a product requires decisions a paper can leave open: how the defense connects to a customer’s tools, how it responds quickly enough, and how it keeps working as the surrounding system changes. Her company was built to work in that awkward middle distance between a known vulnerability and an operational defense. ↗
“The research existed. The production reality didn’t.”Bo Li, March 2026 interview
When the assistant gets the keys
By 2026, her public arguments increasingly centered on agents. An agent can browse, execute code, call an API, or chain decisions together. The relevant question expands from what it says to what it does next. A persuasive answer is one thing; a persuasive answer followed by an unauthorized action is a different operational problem. The appeal of delegation rests on giving a system room to act. That room also needs boundaries. ↗
Virtue AI’s AgentSuite brought together red-team testing, checks on Model Context Protocol servers and tools, runtime guardrails, and governance. Its design included a gateway between agents and tools, intended to provide a consistent place to enforce policy. This is where the research becomes a question of placement. A rule has practical value when it can affect the action before the action is completed. ↗
Consider an illustrative assistant asked to assemble a report. It may need to read documents and retrieve information, yet have no permission to send those documents elsewhere. Merely producing an acceptable final paragraph would tell you little about whether it respected that boundary along the way. Following tool calls, permissions, and actions provides a fuller picture. Li’s work on agent security addresses that expanding distance between an attractive result and an acceptable process. ↗
A different room, the same problem
At the 2026 Citi AI Summit, Li joined Nick Sands, Vibhav Sreekanti, and Manoj Saxena for a discussion of security in an agentic world. The panel considered both AI used by attackers and enterprise agents that could themselves be manipulated or compromised. The setting was a long way from a modified roadside sign. The concern about an adversarial environment was familiar. ↗
One point from that discussion was especially concrete: agents need policies that govern behavior, alongside permissions to access systems. Human employees receive instructions about what they may do with information. Software agents also need rules that remain meaningful as they move among tools. The analogy is useful because it brings the issue down to ordinary workplace responsibility. Being allowed into a room does not settle what you are allowed to carry out of it. ↗
In March 2026, Li received the SC Award for Innovator of the Year. The recognition reflected both her academic work and her effort to turn AI security research into enterprise tools. By then, her career had supplied several versions of the same practical exercise: choose a system, identify the conditions under which it can be manipulated, and build a way to examine or constrain that behavior. ↗
From stickers to a larger stage
The company chapter changed in June 2026. Virtue AI announced that Li and Koyejo were leaving, appointed Sohaib Shaikh CEO, and confirmed Daniel Le would continue as Chief Financial and Operating Officer. The startup continued under new leadership. Li’s story moved elsewhere. Keeping those two developments distinct helps explain what happened: a founder’s departure and a company’s next phase can occur at the same time. ↗
Illinois confirmed in September that Li, other Virtue AI founders, and team members had joined Meta Superintelligence Labs to strengthen AI agent security. She described the opportunity in terms of scale: research and early prototypes could reach systems used by far more people. Her stated ambition includes secure, trustworthy personalized agents. The move brought the old questions about manipulation into a setting with a much larger potential audience. ↗
The stop sign makes a useful closing image because it remains so wonderfully plain. People supplied an instruction. A machine found a different pattern. Li and her collaborators made the disagreement visible. Since then, her work has followed AI into language, software tools, and delegated action. An agent can do more than misread four letters. It can carry its misunderstanding into the next task. There is plenty of work between giving it the keys and being comfortable letting it drive.
“There is still an enormous amount to learn and build.”Bo Li, September 2026