28 citations · 28 across the 15 of their papers we have counts for
16 papers
Narratives Mislead: An Empirical Study of How LLMs Misjudge CVSS Severity in Bug Bounty Reports
Ruitao Feng, Yuekang Li, Yao Zhang
Bug bounty platforms receive vulnerability reports faster than vendors can triage them, and Large Language Models (LLMs) are increasingly considered for assigning the Common Vulner…
Do Input-Level Defenses Transfer to Observation-Level Attacks on VideoLLMs?
Bangshuo Zhu, Wei Song, Yuxin Cao +4
Video Large Language Models (VideoLLMs) are increasingly deployed in safety-critical applications such as content moderation and video analytics. To process long videos efficiently…
Decoupling is a Necessity: Transformation-Agnostic Decompiled Code Recovery under Optimization and Obfuscation
Zhiping Zhou, Xiaohong Li, Ruitao Feng +3
Reverse engineering is essential for software security analysis and vulnerability detection. Decompilation, the process of lifting binaries to high-level pseudocode, is central to…
AI Slop and Hallucinations in Vulnerability Assessment: A Survey on Reasoning Failures and Trustworthy Mitigation
Junchen Ding, Jialiang Dong, Yichen Zhu +5
The integration of Large Language Models (LLMs) into cybersecurity has transformed vulnerability assessment, but it has also produced a trustworthiness crisis driven by the uncheck…
MaliciousSkillBench: A Comprehensive Benchmark for Malicious Agent Skill Detection
Yue Wang, Yi Liu, Gelei Deng +4
Agent Skills extend LLM agents with reusable instruction packages that may also include scripts, resources, and service configuration. This creates a direct distribution channel fo…
Rethinking Complexity Metrics for LLM-Integrated Applications: Beyond Source Code
Zihao Xu, Yuekang Li, Gelei Deng +2
LLM-integrated applications blend natural language prompts with program code, and much of their runtime behavior originates in the prompt layer rather than in the code itself. Exis…
PUFFERDOS: Efficient and Effective Attack String Generation for Regular Expression Denial of Service Vulnerabilities
Shangzhi Xu, Ziqi Ding, Xiao Cheng +5
ReDoS attacks constitute a critical class of resource-exhaustion vulnerabilities. In such attacks, adversaries exploit the pathological worst-case execution behavior of regular exp…
SNARE: Adaptive Scenario Synthesis for Eliciting Overeager Behavior in Coding Agents
Yubin Qu, Yi Liu, Gelei Deng +4
A coding agent executes a benign task as a sequence of shell, file, and network actions, any of which can quietly exceed the authorized scope while the task still completes. We cal…
MIRAGE: Context-Aware Prompt Injection against Mobile GUI Agents via User-Generated Content
Ruoqi Guo, Yi Liu, Gelei Deng +7
Mobile graphical user interface (GUI) agents driven by vision-language models (VLMs) perceive the screen as rendered pixels and choose actions from what they see, so they cannot re…
Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks
Yubin Qu, Ying Zhang, Yanjun Zhang +4
Coding agents now run autonomously with shell, file, and network privileges. When a user issues a benign request, the agent sometimes does more than asked: it deletes unrelated fil…
How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study
Zhihao Chen, Ying Zhang, Yi Liu +7
Large Language Model (LLM) agents increasingly rely on third-party skills that operate within privileged execution environments and routinely handle sensitive credentials, yet how…
Reachability Across the NL/PL Boundary: A Taxonomy-Driven Dataflow Model for LLM-Integrated Applications
Zihao Xu, Xiao Cheng, Ruijie Meng +1
LLM API calls have become a standard programming primitive, but they create a program boundary that disrupts traditional dataflow analysis. A runtime value may be inserted into a n…
"Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild
Yi Liu, Zhihao Chen, Yanjun Zhang +4
LLM-based coding agents increasingly rely on third-party extensions called skills, which bundle natural language instructions and helper scripts that execute with full user privile…
DiverseClaire: Simulating Students to Improve Introductory Programming Course Materials for All CS1 Learners
Wendy Wong, Yuchao Jiang, Yuekang Li
Although CS programs are booming, introductory courses like CS1 still adopt a one-size-fits-all formats that can exacerbate cognitive load and discourage learners with autism, ADHD…
TransferFuzz: Fuzzing with Historical Trace for Verifying Propagated Vulnerability Code
Siyuan Li, Yuekang Li, Zuxin Chen +5
Code reuse in software development frequently facilitates the spread of vulnerabilities, making the scope of affected software in CVE reports imprecise. Traditional methods primari…
Demystifying RCE Vulnerabilities in LLM-Integrated Apps
Tong Liu, Zizhuang Deng, Guozhu Meng +2
LLMs show promise in transforming software development, with a growing interest in integrating them into more intelligent apps. Frameworks like LangChain aid LLM-integrated app dev…