Mathematics PhD positions

*****

4 PhD positions within the UU-NLDA collaboration (Deadline: Please contact Kees Oosterlee <c.w.oosterlee@uu.nl>) 

We offer four full-time PhD positions within a research collaboration between Utrecht University(UU) and the Netherlands Defence Academy (NLDA).

1) PhD Position 1: Anomaly Detection in Cyber-Security Data Streams

Title: Robust, Interpretable Anomaly Detection in High-Dimensional Cyber-Security Data

Project description

Modern cyber-security environments generate vast streams of high-dimensional data, including network flows, authentication logs, system events, and endpoint telemetry. Within these streams, anomalous patterns may signal cyber intrusions, coordinated attacks, or system failures. Detecting such anomalies reliably and in real time remains a major scientific challenge, especially when labelled examples are scarce.

This PhD project focuses on robust, interpretable, and scalable anomaly detection methods for multivariate time-dependent cyber-security data. The research is motivated by realistic datasets originating from large-scale cyber defence exercises, providing high-quality labelled data in environments close to operational monitoring settings. A central challenge is the detection of structural deviations rather than isolated outliers. In practice, anomalous behaviour often appears through subtle changes in temporal dependence, persistence patterns, or coordinated deviations across multiple variables. Cyber environments are inherently non-stationary, with evolving behaviour and adversarial attempts to conceal malicious activity within otherwise normal patterns. The project builds on recent developments in anomaly detection, including isolation-based and distance-based methods, and extends these ideas toward multivariate temporal data with concept drift. Research directions include feature representations capturing temporal structure, algorithms robust under distributional change, and interpretable anomaly scores that can be decomposed into contributions of variables and time segments. Particular emphasis is placed on interpretability and computational scalability. The goal is not only to detect anomalies, but also to explain them meaningfully, enabling analysts to understand which variables or time windows drive detected deviations. Since cyber-security data streams are often high-frequency and high-dimensional, the project will also explore efficient algorithms, including randomised methods, subsampling strategies, and compact feature representations.

The project lies at the intersection of high-dimensional statistics, machine learning, time series analysis, and large-scale data processing, combining mathematical analysis with algorithmic development and validation on realistic datasets.

Environment and supervision

The project is part of a collaboration between Utrecht University and the Netherlands Defence Academy. The PhD candidate will be supervised by prof. Kees Oosterlee and Dr. Ioana Karnstedt-Hulpus, and will work in close collaboration with ir. Allard Dijk from NLDA. The research environment combines expertise in mathematics, machine learning, data mining, graph-based data analysis, and cyber-security applications, with strong interaction between theory and practice.

You will receive strong training in modern machine learning and data science, develop a deep understanding of high-dimensional statistical methods, and gain experience working with large-scale real-world datasets. The project offers a unique opportunity to work at the interface of theory, algorithms, and applications. This research is considered to be at a low Technology Readiness Level (TRL). TRL is a commonly used scale to indicate the maturity of a technology, ranging from early-stage fundamental research (low TRL) to fully developed and deployed systems (high TRL). The present project focuses on the development of new mathematical methods, algorithms, and theoretical insights, rather than on immediate operational deployment. As a result, a central objective of the project is the dissemination of results through high-quality scientific publications in leading journals and conferences. The work is expected to contribute to the academic literature in machine learning, statistics, and anomaly detection.

Requirements

We are looking for a talented student who has completed or is nearing completion of an MSc. degree in mathematics, computer science, or artificial intelligence. Prior experience and interest in the (probabilistic) machine learning is beneficial, but not required. Eligibility is restricted to citizens of  member states of the North Atlantic Treaty Organization (NATO).

2) PhD Position 2: Anomaly Detection for Maritime Situational Awareness

Title: Spatio-Temporal Anomaly Detection for Maritime Surveillance and Sensor Data

Project description

Maritime environments generate complex streams of spatio-temporal data from vessel tracking systems, radar networks, satellite observations, and emerging sensing technologies such as distributed acoustic sensing. Detecting anomalous behaviour in these streams is essential for maritime security, protection of critical infrastructure, and monitoring of vessel activity.

This PhD project develops advanced anomaly detection methods for spatio-temporal maritime data, with emphasis on robustness, interpretability, and scalability. The central challenge is the detection of weak and context-dependent signals indicating unusual or suspicious behaviour. Maritime behaviour is highly structured: vessel trajectories contain both geometric and behavioural information, while normal patterns depend strongly on location, traffic density, and operational conditions. As a result, anomalies are often subtle and cannot be identified by simple threshold-based methods. The project is supported by realistic datasets, including AIS trajectory data and distributed acoustic sensing data, where fibre-optic cables act as large-scale sensor arrays capturing vessel-induced acoustic signals. These datasets provide a unique opportunity to develop and validate methods in realistic monitoring environments. The research focuses on extending modern anomaly detection frameworks toward spatio-temporal structured data. This includes representing vessel trajectories and sensor signals through feature structures capturing motion regularity, interaction patterns, and temporal dynamics. Detection is formulated as identifying deviations from suitable reference behaviour within these structured representations. Interpretability plays a central role. Detected anomalies will be decomposed into behavioural components such as changes in speed profiles, heading persistence, stopping behaviour, or vessel interactions, enabling analysts to distinguish meaningful anomalies from noise. Another major objective is computational efficiency. Since maritime datasets can be extremely large, the project will investigate scalable algorithms, efficient distance computations, and multi-resolution approaches enabling near real-time anomaly detection.

The research connects to developments in machine learning for trajectory data, probabilistic modelling, spatio-temporal data analysis, and sensor-based monitoring technologies. The project combines stochastic processes, time series analysis, machine learning, geometric data analysis, and large-scale algorithm design in a realistic applied setting.

Environment and supervision

The PhD candidate will be embedded in a joint research programme between Utrecht University and the Netherlands Defence Academy. The project will be supervised by prof. Kees Oosterlee and prof. Jason Frank and Dr. Deb Panja, and will be carried out in close collaboration with ir. Sander van Oers from NLDA. The research environment brings together expertise in mathematics, machine learning, data-driven pattern recognition, operational modelling, decision-support systems, and maritime applications.

You will develop expertise in spatio-temporal data analysis and machine learning, gain experience with cutting-edge sensing technologies and realistic datasets, and receive strong mathematical and computational training. The project offers a PhD at the interface of theory, data science, and operational applications. This research is considered to be at a low Technology Readiness Level (TRL). TRL is a commonly used scale to indicate the maturity of a technology, ranging from early-stage fundamental research (low TRL) to fully developed and deployed systems (high TRL). The present project focuses on the development of new mathematical and computational methods, rather than on direct operational deployment. Accordingly, a key objective of the project is to publish the results in high-quality scientific journals and conferences, contributing to the academic literature in machine learning, data science, and spatio-temporal modelling.

Requirements

We are looking for a talented student who has completed or is nearing completion of an MSc. degree in mathematics, computer science, or artificial intelligence. Prior experience and interest in the (probabilistic) machine learning is beneficial, but not required. Eligibility is restricted to citizens of  member states of the North Atlantic Treaty Organization (NATO).

3) PhD Position 3: Exact Extraction of Neural Network Models (HADES)

Project description

Modern military and civilian systems increasingly rely on embedded artificial intelligence for perception, decision-making, and control. In operational environments, such AI systems may be captured, intercepted, or accessed through limited interfaces. However, their internal structure — including architecture, parameters, and decision logic — often remains inaccessible. This PhD project addresses the fundamental question: to what extent can neural network models be reconstructed from limited access? The focus is on developing mathematically grounded methods for exact or near-exact extraction of neural network architectures and parameters, under realistic constraints such as black-box or partial access.

A central aspect of the project is the development of provable guarantees and complexity bounds. When is exact reconstruction possible? How many queries are required? What is the computational complexity of extraction? These questions connect to fundamental problems in high-dimensional approximation theory and learning theory. In addition to theoretical work, the project includes the development of practical extraction algorithms and demonstrators. These will be tested on representative neural network architectures relevant for applications such as image recognition and sensor data processing. The goal is to bridge the gap between theoretical feasibility and practical applicability.

The project lies at the interface of machine learning, cryptography, high-dimensional mathematics, and theoretical computer science. It connects to recent work on model extraction attacks, identifiability of neural networks, and the mathematical structure of deep learning models.

Environment and supervision

You will be part of a joint research programme between Utrecht University and the Netherlands Defence Academy (NLDA). You will be based at the Mathematical Institute at Utrecht University. Supervision will be provided by profs. Kees Oosterlee and Sjoerd Dirksen, with close collaboration with NLDA researchers, including dr. Relinde Jurrius and ir. Sander van Oers. The environment combines strong expertise in mathematics, machine learning theory, and defence-related AI applications. You will work together closely with a second PhD student on the HADES project and will interact with two additional PhD students in the joint research programme, who will work on related topics.

You will develop a deep understanding of the mathematical structure of neural networks, gain experience with cutting-edge research at the intersection of AI and cryptography, and contribute to a rapidly developing field with both theoretical and practical impact. This research is considered to be at a low Technology Readiness Level (TRL). TRL is a commonly used scale to indicate the maturity of a technology, ranging from early-stage fundamental research (low TRL) to fully developed and deployed systems (high TRL). The present project focuses on the development of new mathematical methods, algorithms, and theoretical insights, rather than on immediate operational deployment. As a result, a central objective of the project is the dissemination of results through high-quality scientific publications in leading journals and conferences. The work is expected to contribute to the academic literature in machine learning, cryptography, and theoretical aspects of artificial intelligence.

Requirements

We are looking for a talented student who has completed or is nearing completion of an MSc. degree in mathematics, computer science, or artificial intelligence. Prior experience and interest in cryptography or machine learning is beneficial, but not required. Eligibility is restricted to citizens ofmember states of the North Atlantic Treaty Organization (NATO).

4) PhD Position 4: Probabilistic Reconstruction and Modelling of AI Systems(HADES)

Project description

In many practical situations, exact reconstruction of an artificial intelligence model is not feasible. Instead, one aims to construct a surrogate model that approximates the behaviour of the original system as accurately as possible. Such surrogate models can be used to analyse, predict, or even manipulate the behaviour of the original model.

This PhD project, which is part of the HADES project, focuses on the development of statistical and probabilistic methods for reconstructing surrogate models of neural networks under realistic access constraints. The goal is to approximate complex AI systems based on limited input-output observations, while maintaining both accuracy and robustness.

The project will develop methods based on probabilistic modelling, statistical learning, and optimisation, including techniques for parameter estimation, uncertainty quantification, and model calibration. Particular attention will be given to constructing surrogate models that remain stable under distributional shifts and adversarial perturbations. A key application of surrogate modelling is the design of defensive strategies, where the surrogate model is used to identify vulnerabilities in the original system. The project will therefore also study how surrogate models can be used to analyse and influence the behaviour of AI systems.

The project includes both theoretical and computational components. On the theoretical side, the aim is to understand approximation quality, sample complexity, and robustness properties of surrogate models. On the computational side, scalable algorithms will be developed and tested on realistic datasets and neural network architectures. The project combines ideas from machine learning, statistics, stochastic processes, and optimisation. It connects to current research on model distillation, black-box learning, adversarial machine learning, and uncertainty quantification.

Environment and supervision

You will be part of a joint research programme between Utrecht University and the Netherlands Defence Academy (NLDA). You will be based at the Mathematical Institute at Utrecht University. Supervision will be provided by profs. Kees Oosterlee and Sjoerd Dirksen, with close collaboration with NLDA researchers, including dr. Relinde Jurrius and ir. Sander van Oers. The environment combines strong expertise in mathematics, machine learning theory, and defence-related AI applications. You will work together closely with a second PhD student on the HADES project and will interact with two additional PhD students in the joint research programme, who will work on related topics. 

You will gain strong expertise in probabilistic machine learning and data-driven modelling, work on cutting-edge problems in AI robustness and security, and develop both theoretical insight and practical algorithmic skills. This research is considered to be at a low Technology Readiness Level (TRL). TRL is a commonly used scale to indicate the maturity of a technology, ranging from early-stage fundamental research (low TRL) to fully developed and deployed systems (high TRL). The present project focuses on the development of new mathematical and statistical methods, rather than on direct operational deployment. Accordingly, a key objective of the project is to publish the results in high-quality scientific journals and conferences, contributing to the academic literature in machine learning, statistics, and AI robustness.

Requirements

We are looking for a talented student who has completed or is nearing completion of an MSc. degree in mathematics, computer science, or artificial intelligence. Prior experience and interest in the (probabilistic) machine learning is beneficial, but not required. Eligibility is restricted to citizens of  member states of the North Atlantic Treaty Organization (NATO).

*****

PhD position on dissecting algorithmic collusion (Deadline: 14 June 2026)

https://utwentecareers.nl/en/vacancies/2484/phd-position-on-dissecting-algorithmic-collusion/