Institution profile

University of New South Wales

Academic institutionaustralasia · au
Official website
Research library1,044linked papers
Opportunities0open roles
Selected work

Representative Papers

Prompt Injection attack against LLM-integrated Applications

Jun 08, 2023arXiv.org

Prompt injection attacks pose an increasingly severe security threat to large language model (LLM) integrated applications, yet existing black-box attack methods suffer from limited practical efficacy. Method: This paper proposes HouYi—the first real-world-oriented, three-stage black-box prompt injection framework comprising pre-prompt injection, context-aware segmentation, and malicious payload delivery. HouYi uniquely enables automated triggering of high-impact consequences—including arbitrary LLM misuse and application-level prompt stealing—via black-box fuzzing, context-aware prompt engineering, and web-injection-inspired modeling. Contribution/Results: Evaluated through real-world penetration testing across 36 mainstream LLM applications, HouYi uncovered 31 critical vulnerabilities, independently confirmed by ten vendors—including Notion—with impact on millions of users. The work significantly advances LLM security practice by bridging the gap between theoretical attack models and deployable, scalable exploitation techniques.

536 citations38 influentialRead paper

Federated Large Language Models: Current Progress and Future Directions

Sep 24, 2024arXiv.org

To address the convergence difficulties and high communication overhead of large language models (LLMs) in federated learning (FL) caused by data heterogeneity, this paper introduces FedLLM—the first unified analytical framework for LLMs in FL. It systematically surveys two dominant paradigms: federated fine-tuning and federated prompt learning, while rigorously analyzing core challenges including data heterogeneity, communication efficiency, and privacy preservation. The work identifies promising future directions—namely, federated pre-training and LLM-augmented FL—and fills a critical gap in systematic literature review. A multidimensional taxonomy and evaluation framework is established to clarify key technical bottlenecks. Integrating insights from FL, LLM adaptation, prompt engineering, distributed optimization, and privacy-preserving computation, this study delivers a practical, robust, and privacy-aware methodology for deploying LLMs in real-world federated settings. (149 words)

16 citations1 influentialRead paper

Natural Language Processing and Deep Learning Models to Classify Phase of Flight in Aviation Safety Occurrences

Sep 06, 20232023 IEEE Region 10 Symposium (TENSYMP)

This study addresses the low efficiency and poor annotation consistency in manual flight-phase labeling (seven categories) for aviation safety analysis. We propose an automated classification method for unstructured accident report texts. Methodologically, we introduce simplified Recurrent Neural Networks (sRNNs) and simplified ResNets—novel applications to multi-phase aviation safety text classification—integrated with NLP preprocessing and a multi-class supervised learning framework. Evaluated on 27,000 real-world NTSB reports, the sRNN achieves >68% accuracy, outperforming both the simplified ResNet and a random baseline (14%) across precision, recall, and F1-score, thereby demonstrating its superior capability in modeling temporal semantics. This work provides a scalable, robust automation solution for aviation risk root-cause analysis and phase-specific safety assessment.

7 citationsRead paper

A Complete Axiomatization of Branching Bisimilarity for a Simple Process Language with Probabilistic Choice - (Extended Abstract)

Nov 04, 2019The Art of Modelling Computational Systems

This paper addresses the challenge of axiomatizing behavioral equivalence for process languages featuring both nondeterministic and probabilistic choice. We introduce the first sound and complete equational axiomatization for branching bisimilarity and its rooted variant—rooted branching probabilistic bisimilarity. Our method integrates structural operational semantics with probabilistic concurrency models to construct an equational proof system that supports mechanical verification of probabilistic behavioral equivalence. The key contribution is the first complete characterization of branching bisimulation for a basic, recursion-free process language with probabilistic choice—overcoming a longstanding limitation of classical process algebraic axiomatizations, which traditionally cannot accommodate probabilistic choice. This work bridges the theoretical gap between probabilistic semantics and standard axiomatic methods, thereby establishing a formal foundation for equivalence analysis in probabilistic concurrent systems.

5 citations1 influentialRead paper

Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale

Jan 15, 2026

This study addresses the critical lack of systematic security auditing in the current ecosystem of AI agent skills, which harbors widespread yet underrecognized security risks. The authors present the first security taxonomy for agent skills grounded in real-world vulnerabilities and introduce SkillScan, a multi-stage detection framework that integrates static code analysis with large language model–based semantic classification. Empirical evaluation across 42,447 skills from two major marketplaces reveals that 26.1% contain vulnerabilities, with data leakage and privilege escalation being the most prevalent; executable-script skills exhibit significantly higher risk. The proposed method achieves 86.7% precision and 82.5% recall in vulnerability detection. The dataset and toolkit are publicly released to support further research.

3 citationsRead paper
Recent publications

Latest Papers

Shared KV Caching for Replicated 27B Inference: Correctness Failures and Performance Boundaries

Sep 14, 2026

Shared host-memory caching can avoid repeated prefill when a request moves between inference replicas. Its usefulness depends on both correct state transfer and lost prefix locality. We study two single-GPU 27B vLLM replicas sharing a 256 GiB LMCache pool. After adopting an existing packed-page patch, we isolate a raw-pointer fallback that omits the dependency on the current CUDA stream. Controlled byte tests fail under an imposed delay and pass when the dependency is restored; the existing mixed allocator provides a working deployment path. Full-pool allocation checks and service regression complete the validation. A four-block OFF-ON-ON-OFF comparison contains 768 measured requests within two block pairs. Median cross-replica time to first content token falls from 31.715 to 0.605 seconds at 128k input and from 92.047 to 0.790 seconds at 256k. Six-turn synthetic sessions alternating replicas improve by approximately 35% and 45% at initial contexts of 32k and 128k, while fixed placement shows little benefit. This engineering case study identifies practical validation steps and the locality conditions in which shared caching pays off.

0 citationsRead paper