An End-to-End Approach to Safe and Secure AI Systems
SRI Director David Lie leads a community of researchers across four Canadian universities in a landmark initiative to solve challenges in AI safety and security, from data acquisition to model deployment.
Artificial intelligence holds transformative promise across sectors—but its adoption has been hindered by fundamental challenges: a reliance on labeled data, vulnerability to adversarial attack, lack of interpretability, and limited support for regulatory compliance. These are not isolated technical problems. They constitute a systemic gap in how AI systems are designed, trained, and deployed in the real world.
An End-to-End Approach to Safe and Secure AI Systems addresses this gap comprehensively. Rather than tackling any single stage of the AI pipeline, this research community examines the full lifecycle—from how data is acquired and cleaned, to how models are trained, deployed, and audited for compliance. The initiative brings together 19 principal investigators and more than 40 graduate and postdoctoral researchers from four Canadian universities, combining expertise in machine learning, cybersecurity, formal verification, philosophy, and law.
The project's three core goals are:
Mission
As AI systems are adopted at unprecedented speed—in healthcare, finance, national security, and public administration—the safety implications are becoming urgent. AI models can cause harm through biased or unfair outputs, susceptibility to adversarial manipulation, unpredictable emergent behaviors, and a lack of transparency about how decisions are made.
Regulatory frameworks around AI, including Canada's Treasury Board Directive on Automated Decision-Making, are beginning to impose meaningful requirements around fairness, interpretability, and accountability. But the technical mechanisms to meet those requirements—particularly in data-scarce or security-critical environments—are still underdeveloped.
At the same time, AI safety research represents only an estimated 1 to 3 per cent of all AI publications globally. Canada's decision to resource this work through a dedicated NSERC–CSE partnership signals a recognition that building trustworthy AI requires sustained, focused investment in the hard technical and sociotechnical problems that too often go unaddressed.
"Our work will cover everything from privacy to interpretability to auditing the formal verification to data cleaning and management. It's not just everything in AI—it's the entire AI pipeline, from where you acquire data to make sure that it hasn't been tampered with, all the way through training to make sure that the training is protecting privacy."
— David Lie
The project also responds directly to CSE's mission of protecting Canada's digital infrastructure. By training a new generation of AI security researchers with deep technical skills and strong ties to government, this initiative builds domestic capacity that cannot easily be replicated abroad.
Project lead
David Lie
Director, Schwartz Reisman Institute for Technology and Society
Professor, Edward S. Rogers Sr. Department of Electrical & Computer Engineering, University of Toronto
Cross-appointed in the Department of Computer Science and Faculty of Law, University of Toronto
Canada Research Chair in Secure and Reliable Systems (Tier 1)
Faculty Affiliate, Vector Institute
David Lie's research focuses on making computer systems more secure and trustworthy, drawing on computer architecture, formal verification, operating systems, and networking. His collaborative work at the intersection of technology and law—including research on privacy policy compliance in mobile applications—has shaped SRI's interdisciplinary approach to AI safety. As SRI Director, he brings both deep technical expertise and experience bridging the technical, legal, and policy dimensions of AI governance.
Research streams
The research community organizes its work into four interconnected streams, spanning the full AI development pipeline. Synergies across streams—shared datasets, shared algorithms, and cross-cutting insights—are a core design principle of the initiative.
Stream 1
Data Acquisition and Cleaning
Developing strategies to identify the most valuable data samples for learning, recruit edge devices for improving data quality, and identify safe avenues for using pre-trained foundation models—addressing both training and inference scenarios, including distribution drift.
Stream 2
Data Labeling and Augmentation
Reducing AI's reliance on labeled data through active learning, programmatic weak supervision (data programming), and principled simulation and data synthesis methods—with a focus on security problems where malicious events are rare by nature.
Stream 3
Fair and Safe AI
Designing AI systems with predictable, explainable, and interpretable behaviours that are fair, robust to distributional shifts, and resilient against adversarial examples and data poisoning attacks. Includes developing temporal fairness metrics and algorithmic reparation methods.
Stream 4
Compliance and Auditing
Integrating formal guarantees—inspired by safety-critical engineering processes—into AI model development from acquisition to deployment, and developing methods for estimating risk and enabling auditing for regulatory compliance.
Research community
The initiative convenes 19 principal investigators from four Canadian universities—the University of Toronto, the University of Waterloo, Concordia University, and York University—supported by more than 40 graduate students and postdoctoral researchers. The community includes 10 Vector Institute Faculty Affiliates and Fellows, 2 CIFAR AI Chairs, and 2 Alfred P. Sloan Research Fellows.
University of Toronto
Director, SRI · Professor, Electrical & Computer Engineering
Associate Director & Research Lead, SRI · Professor, Computer Science
Research Lead, SRI · Assistant Professor, Computer Science
Faculty Affiliate, SRI · Professor, Computer Science
Faculty Affiliate, SRI · Assistant Professor, Computer Science
Faculty Affiliate, SRI · Assistant Professor, Electrical & Computer Engineering
Faculty Affiliate, SRI · Assistant Professor, Electrical & Computer Engineering
Professor, Electrical & Computer Engineering
Professor, Computer Science
Professor, Computer Science
Assistant Professor, Computer Science
Assistant Professor, Computer Science
Assistant Professor, Computer Science
Assistant Professor, Electrical & Computer Engineering
Assistant Professor, Computer Science
University of Waterloo
Professor, Electrical and Computer Engineering
Concordia University
Associate Professor, Concordia Institute for Information Systems Engineering
Professor, Concordia Institute for Information Systems Engineering
York University
Professor, Electrical Engineering and Computer Science
Expected impact
Beyond publications and technical breakthroughs, the research community is structured to advance Canada's national capacity in AI safety and security. All outputs—publications, software, and datasets—will be made openly available wherever responsible disclosure permits. Researchers will pursue security clearances to enable direct collaboration with CSE, and visiting scholar programs will create opportunities for CSE staff to engage with academic labs.
By training a cohort of more than 160 researchers in areas of direct strategic relevance to the Government of Canada—and fostering close ties between academia and a national security agency that can only employ Canadian citizens for classified work—the initiative builds the kind of domestic expertise that cannot be imported or outsourced.
The interdisciplinary design of the research community reflects a broader conviction: that solving AI safety requires not only technical innovation, but the integration of legal expertise, ethical reasoning, and policy insight. At SRI, those conversations happen in the same building.
Learn more
SRI Director David Lie and collaborators awarded $5.6 million for cutting-edge research on robust, secure, and safe AI— SRI news story on the announcement of the NSERC–CSE grant.
CSE and NSERC to fund research on robust, secure, and safe artificial intelligence— Government of Canada announcement.
Managing extreme AI risks amid rapid progress — Collaborative paper in Science by McIlraith, Hinton, and colleagues, published ahead of the 2024 AI Safety Summit in South Korea.
SRI leadership team welcomes David Lie, David Duvenaud, and Roger Grosse — Announcement of Lie's appointment as SRI Director.
A look at security and privacy on smartphones — David Lie's talk in the SRI Seminar Series.
“We need a 21st century framework for 21st century problems” — Op-ed by Lisa Austin, David Lie, Aleksandar Nikolov, and Nicolas Papernot.
For inquiries about this initiative, contact SRI’s Research Team at sri.research@utoronto.ca.