Hi there! I am Yuyang, a first-year Ph.D. student in the College of Computing and Data Science (CCDS) at Nanyang Technological University, advised by Prof. XiaoFeng Wang. I am also very fortunate to work closely with Zihao Wang. Before that, I received my B.S. from Wuhan University, where I was fortunate to work with Prof. Wei Lu and Dr. Jiawei Liu.
Now my research lies at the intersection of security and large language models. Real-world LLM applications increasingly rely on untrusted external data, from retrieved documents and web pages to tool outputs. I study how such data can manipulate what models see and what models do, and how to build LLM systems and agents that stay reliable under manipulation.
Feel free to reach out by email if you share similar interests or would like to collaborate.
Research Interests
- Prompt injection defense and alignment. Making LLMs robust to instructions hidden in untrusted data, e.g. alignment training with near-target adversarial examples (LocalAlign, CCS '26).
- RAG security and adversarial retrieval. Black-box opinion manipulation attacks against retrieval-augmented generation (FlippedRAG, CCS '25; Topic-FlipRAG, USENIX Sec '25; DiscourseFlip, Preprint) and the defenses they motivate.
- Red-teaming LLM agents. Building benchmarks and adversarial environments that stress-test LLM-powered agents against manipulation in open, dynamic information environments (NTBench, Preprint).
Publications
On Task, Off Track: Benchmarking LLM and Agent Robustness to Near-Target Prompt Injection
arXiv preprint, 2026 [arXiv] [Project page]
NTBench benchmarks near-target prompt injection: attacks whose target responses or tool calls resemble the legitimate answer but make it incorrect or harmful. Across seven LLMs on language and agentic tasks, such near targets succeed far more often than the fixed targets used in existing benchmarks.
ACM CCS 2026 (CCF-A, Big4) [Paper] [Code] [Models (Llama-3.1-8B)] [Models (Qwen3-4B)] Acceptance rate: 15.8%
LocalAlign is an adversarial-training-style prompt injection defense. It automatically generates near-but-wrong adversarial examples and aligns the model with a margin-aware objective, enforcing a tight robustness boundary around the correct response and generalizing to unseen attacks that prior defenses miss.
arXiv preprint, 2026 [arXiv] [Code]
DiscourseFlip introduces discourse-level opinion manipulation against black-box RAG: an agentic, graph-guided attack that allocates a limited poisoning budget across a semantic query network to shift opinions over a whole multi-topic query space while staying well camouflaged.
USENIX Security 2025 (CCF-A, Big4) [Paper] [arXiv] [Code] Acceptance rate: 17.1%
Topic-FlipRAG is a two-stage knowledge poisoning attack that shifts the opinion polarity of RAG outputs across all queries on a topic, combining adversarial ranking perturbations with LLM-crafted semantic-level perturbations.
ACM CCS 2025 (CCF-A, Big4) [DOI] [arXiv] [Code] Acceptance rate: 14.5%
FlippedRAG is a transfer-based opinion manipulation attack on black-box RAG: it reverse-engineers the retriever into a surrogate, then crafts poisoning triggers that alter very few documents to flip the opinion polarity of generated responses on controversial topics.
* Equal contribution. Big4 = the four top-tier security conferences (IEEE S&P, ACM CCS, USENIX Security, NDSS). See Google Scholar for the full list and citation counts.
Other Publications
- RobustMask: Certified Robustness against Adversarial Neural Ranking Attack via Randomized MaskingPreprint arXiv preprint, 2025 · arXiv / Code
- Medical Knowledge-Enhanced ICD Coding PredictionESWA Expert Systems with Applications, Vol. 321, 132312, 2026 · DOI
Education
- 2026 – presentPh.D. student, College of Computing and Data Science, Nanyang Technological University, SingaporeAdvisor: Prof. XiaoFeng Wang
- 2022 – 2026B.S., Wuhan University, Wuhan, ChinaAdvisors: Prof. Wei Lu and Dr. Jiawei Liu