Wei Song has three, on output repetition in video LLMs (VideoSTF, with Yuxin Cao), audio-language model safety steering (CrossSteer) and agentic tool calling (with Ziqi Ding); Leo Zhang co-authors universal cross-prompt attacks on concept segmentation.
PhD students Xiaomei Zhang and Zhaoxi Zhang, with Yanjun Zhang and Leo Zhang, show that token compression, used to speed up large vision-language models, introduces new security vulnerabilities.
Six academics in the School of ICT bring cyber defence, applied cryptography, privacy-preserving computation, trustworthy AI and secure software engineering under one framework, with joint supervision of PhD students.
Wei Song arrives from a postdoctoral fellowship at UNSW Sydney, bringing adversarial machine learning, AI watermarking and AI security for energy systems. He is recruiting PhD students.
Wei Song's study of Model Context Protocol tools asks when they help and when they hinder LLM agents, with Haonan Zhong, Ziqi Ding and collaborators at UNSW Sydney and CSIRO.
An empirical study of credential leakage through LLM agent skills (Zhihao Chen, Yi Liu, Yanjun Zhang and Leo Zhang), RamFuzz, an LLM-guided greybox fuzzer (Wei Song), and SAF, a static analysis framework for LLVM IR (Wei Song and Yi Liu).
PhD student Zirui Gong and Leo Zhang show a scalable, practical gradient inversion attack on federated learning that recovers private training data from shared updates.
Wei Song is Lead Chief Investigator of the project, which builds privacy-preserving, attack-resilient federated learning for battery health across distributed energy storage assets.
Jiaheng Wei, Yanjun Zhang, He Zhang and Leo Zhang rethink federated unlearning through the lens of memorisation.
"Do Not Mention This to the User" detects malicious agent skills (Yi Liu, Zhihao Chen, Yanjun Zhang, Leo Zhang); Yanjun Zhang, Yi Liu and Leo Zhang defend jailbreaks via manifold trajectory kinetics; Leo Zhang co-authors a low-cost hard-label attack.
He Zhang's CIA infers the communication topology of LLM multi-agent systems; Wei Song has two Findings papers on dataset poisoning and on debiasing LLMs; Yi Liu's LLM-VA tackles the jailbreak versus over-refusal trade-off.
T3AT gives threshold-authorised, non-transferable anonymous tokens (Leo Zhang with collaborators); PROTheft steals deployed models using a projector in the physical world (Yanjun Zhang and Leo Zhang).
Wei Song leads the security theme of an industry partnership on trustworthy, energy-aware load balancing for a distributed network of residential GPUs.
He Zhang arrives from RMIT University. His research covers security for AI and trustworthy AI systems, including privacy-preserving technologies, graph learning, machine unlearning and LLM watermarking.
Qinyi Li and Leo Zhang, with Madusha Chathurangi and Ernest Foo, construct lattice-based anonymous credentials that remain traceable when abused.
Zhihao Chen and Zirui Gong show fine-grained control attacks on ranking-based federated learning, with Yanjun Zhang and Leo Zhang; Ziqi Ding and Wei Song demonstrate NgCaptcha.
Yanjun Zhang and Leo Zhang, with Guizhen Yang and collaborators, show poisoning-based link inference attacks against federated graph neural networks.
He Zhang on membership inference in unlearned GNNs and graph OOD detection; Wei Song and Yuxin Cao on harmful content in video LLMs; three papers from Leo Zhang and Yanjun Zhang's group with Lulu Xue, Shuyu Chang and Yuhang Zhou.
AdvEDM attacks VLM-based embodied agents (with Lulu Xue), MARS defends federated learning against malicious backdoors, and a cross-prompt universal attack makes SAM2 segment nothing at all.
PhD students Zhaoxi Zhang and Xiaomei Zhang, with Yanjun Zhang, He Zhang and Leo Zhang, show that character-level edits defeat current text watermarks.
Leo Zhang and collaborators present data duplication as a multi-purpose attack on machine unlearning, and data-free model-related attacks powered by generative AI.
Wei Song's video-transformer latent token defence detects adversarial video, with collaborators at CSIRO Data61 and UNSW Sydney.
Qinyi Li presents predicate-private asymmetric searchable encryption for conjunctive queries, built from lattices.
Hangtao Zhang, with Yanjun Zhang and Leo Zhang, detects backdoors in object detection models at inference time, without retraining.
Xiaoyan Feng, Yanjun Zhang, He Zhang and Leo Zhang propose unbiased multilayer watermarking for large language models.
Zirui Gong and Zhaoxi Zhang, with Yanjun Zhang and Leo Zhang, show that not all edges are equally robust in ranking-based federated learning; a second paper trains clean models on backdoored pre-trained encoders.
BadRobot, from Leo Zhang's group with Lulu Xue, jailbreaks embodied LLM agents in the physical world. He Zhang's dynamic graph unlearning and IllusionCAPTCHA by Ziqi Ding and Yi Liu appear at WWW 2025.
Wei Song's SecVID corrects adversarial video attacks, and PentestGPT, with Yi Liu as a core contributor, evaluates large language models for automated penetration testing.
Yanjun Zhang co-authors bounded and unbiased composite differential privacy; Leo Zhang's group presents topological backdoor detection, secure fine-tuning of encoders (with Lulu Xue) and a study of why a little robustness helps.
He Zhang's GraphGuard detects and counteracts training-data misuse in graph neural networks, and his survey of trustworthy graph neural networks appears in Proceedings of the IEEE.
Qinyi Li's simplified construction of public-key authenticated encryption with keyword search appears in IACR Communications in Cryptology.
Checking excessive data collection in voice-assistant apps (ICSE), and privacy-preserving, fairness-aware federated learning for critical infrastructure (WWW).
