About me

Hi! I am Yuyang, an incoming Ph.D. student in the College of Computing and Data Science (CCDS) at Nanyang Technological University, fortunate to be advised Prof. XiaoFeng Wang. My research focuses on LLM Security, AI agents and Evaluation. I received my B.S. from Wuhan University, where I was advised by Prof. Wei Lu and Dr. Jiawei Liu.

Research Interest

My research focuses on developing secure and reliable LLMs and AI-powerd agents. I study both the attack / vulnerabilities and defense / robustness / alignment of LLMs, with a current focus on prompt injection. I also investigate how to evaluate the robustness of AI-powered agents in open, dynamic, and adversarial real-world information environments.

Selected Publications

• LocalAlign: Enabling Generalizable Prompt Injection Defense via Generation of Near-Target Adversarial Examples for Alignment Training
  Yuyang Gong^*, Zihao Wang^*, Jiawei Liu, XiaoFeng Wang
  ACM Conference on Computer and Communications Security (CCS), 2026 (accepted; to appear).

• DiscourseFlip: An Oblique Discourse-Level Opinion Manipulation Attack against Black-box Retrieval-Augmented Generation
  Yuyang Gong^*, Miaokun Chen^*, Jiawei Liu, Zhuo Chen, Guoxiu He, Wei Lu, XiaoFeng Wang, Xiaozhong Liu
  arXiv preprint, 2026.

• Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Models
  Yuyang Gong, Zhuo Chen, Jiawei Liu, Miaokun Chen, Fengchang Yu, Wei Lu, XiaoFeng Wang, Xiaozhong Liu
  34th USENIX Security Symposium, 2025.

• FlippedRAG: Black-Box Opinion Manipulation Adversarial Attacks to Retrieval-Augmented Generation Models
  Zhuo Chen, Yuyang Gong, Jiawei Liu, Miaokun Chen, Haotan Liu, Qikai Cheng, Fan Zhang, Wei Lu, Xiaozhong Liu
  ACM SIGSAC Conference on Computer and Communications Security, 2025.

^* Equal contribution.

For the complete publication list and updated citation counts, please visit my Google Scholar.

Details of My Research

Real-world LLM applications increasingly rely on external data—from retrieved documents and web pages to user files and tool outputs. My research asks how to keep these systems trustworthy when untrusted data can manipulate both what models see and what models do.

RAG Security: Manipulating What Models See

RAG grounds language models in external knowledge, but it also turns retrieval into a security boundary. Without accessing model parameters, an attacker can manipulate documents or rankings to control which evidence reaches the model and how information is presented to users.

My work studies this risk across layers and scales: from certifiable robustness for neural ranking, to black-box manipulation of individual answers (CCS 25), topic-wide viewpoints (USENIX 25), and discourse-level information exposure. These attacks are difficult to notice because the resulting responses may remain fluent and plausible. I aim to build defenses that keep RAG systems reliable in open, dynamic, and partially untrusted information environments.

Prompt Injection: Manipulating What Models Do

Untrusted data can also manipulate what an LLM does. In a prompt injection attack, instructions hidden in retrieved documents, web pages, emails, or tool outputs attempt to override the trusted task. OWASP lists prompt injection as LLM01 in its 2025 Top 10 for LLM applications.

Our work studies prompt injection as a robustness and alignment problem for LLM-integrated systems. Existing defenses often train models to distinguish trusted instructions from untrusted data using fixed, hand-crafted attack targets. However, this can leave a loose boundary around the correct response. In real deployments, injected commands may induce outputs that are very close to the benign response but still task-incorrect or harmful, making them harder to detect and defend against.

To address this target-side generalization challenge, we develop defenses based on near-target adversarial examples: responses that stay close to the correct task output while crossing the boundary into harmful behavior. This view leads to LocalAlign (CCS 2026), an alignment-training method that automatically generates near-but-wrong examples and weights them by their closeness to the correct response. LocalAlign tightens the robustness boundary, substantially improving robustness against prompt-injection attacks, including stronger input-side optimization attacks and target-side unseen attacks in out-of-distribution deployment scenarios, where attacker targets are data-specific and contextually close to the benign answer.

The key insight is that near-target outputs tend to have higher target probability under the model and smaller preference margins against the benign response, making them easier to push across the alignment boundary. Going forward, this suggests that both red-teaming and alignment should pay greater attention to a near-target view, rather than focusing only on fixed or far-away attack targets.

Education

• Ph.D., College of Computing and Data Science (CCDS), Nanyang Technological University, Singapore — incoming
• B.S., Wuhan University, 2022–2026