Qiyang Song

Institute of Information Engineering, Chinese Academy of Sciences

- Email: songqiyang@iie.ac.cn

I received my B.S. degree in Information Security from the University of Electronic Science and Technology of China (UESTC), and my M.S. degree in Computer Science and Technology from Tsinghua University under the supervision of Prof. Qi Li. In 2021, I also worked as a research assistant at George Mason University (GMU) under the supervision of Prof. Kun Sun. I have received my Ph.D. degree and am currently an Assistant Professor at the Institute of Information Engineering (IIE), Chinese Academy of Sciences, where I have been selected for the Young Talent Program.

My current research interests include:

Software Security
Agent and LLM Security
Web3 Security
Intrusion Detection Systems

I welcome collaboration and am always open to discussing related academic topics. Feel free to contact me via email—I’m eager to connect with researchers from around the world.

news

Sep 08, 2026	[Paper] Our recent work on training-free backdoor attacks against MCP-enabled agents has been accepted to the Annual Computer Security Applications Conference (ACSAC) 2026!
Jul 17, 2026	[Paper] Our recent work on preference manipulation attacks against MCP agents has been published in IEEE Transactions on Cognitive Communications and Networking (TCCN) 2026!
Dec 05, 2025	[Paper] Our recent work on integrity verification for provenance-based causality analysis has been accepted to USENIX Security 2026!
Nov 08, 2025	[Paper] Our recent work on multilingual interpretability has been accepted to the Association for the Advancement of Artificial Intelligence (AAAI) Conference 2026!
Jul 11, 2025	[Paper] Our recent work in model editing has been accepted to the European Conference on Artificial Intelligence (ECAI) 2025!

selected publications

TCCN26
BiasAgent: Exploiting Agent Bias for Preference Manipulation Attacks on Model Context Protocol

Ji Guo, Zhijing Wang, Wenbo Jiang, Rui Zhang, Jian Xiong, and 3 more authors

IEEE Transactions on Cognitive Communications and Networking, 2026

Abs DOI Bib HTML PDF

The Model Context Protocol (MCP) connects large language model agents with external tools and applications, but it is vulnerable to preference manipulation attacks. Existing approaches inject manipulative keywords or phrases into tool names or descriptions, making them detectable. BiasAgent instead leverages agent bias to manipulate tool selection without modifying tool descriptions or user inputs. The authors construct a biased dataset that favors a designated tool and train a biased agent using Decoupled Clip and Dynamic Sampling Policy Optimization (DAPO). The resulting agent prefers the attacker-specified tool for relevant tasks while maintaining normal functionality on other tasks, achieving high effectiveness and strong stealthiness across multiple LLM agents and task settings.
@article{guo2026biasagent, title = {BiasAgent: Exploiting Agent Bias for Preference Manipulation Attacks on Model Context Protocol}, author = {Guo, Ji and Wang, Zhijing and Jiang, Wenbo and Zhang, Rui and Xiong, Jian and Song, Qiyang and Wu, Hao and Liu, Yijing}, journal = {IEEE Transactions on Cognitive Communications and Networking}, volume = {12}, pages = {10358--10371}, year = {2026}, publisher = {IEEE}, doi = {10.1109/TCCN.2026.3714063}, }
ACSAC26
The Devil’s Whisper to Agents: Unveiling and Formalizing Training-Free Backdoor Attacks Across the MCP-Enabled Agent Execution Lifecycle

Yirui Bai, Qiyang Song, Qihang Zhou, Xin Liu, Wenbo Jiang, and 4 more authors

In Annual Computer Security Applications Conference (ACSAC) 2026, 2026

Abs Bib HTML

Unlike training-based backdoors that rely on model training or parameter modification, this work systematically defines lightweight training-free backdoors for MCP-enabled agents. By poisoning MCP tool metadata, it formalizes multiple trigger forms spanning the agent execution lifecycle, including Query, Thought, and Observation, and introduces a large-scale benchmark of realistic backdoor attacks. Experiments on mainstream large language models, including Claude and GPT, show attack success rates of up to 97.53%.
@inproceedings{bai2026devils, title = {The Devil’s Whisper to Agents: Unveiling and Formalizing Training-Free Backdoor Attacks Across the MCP-Enabled Agent Execution Lifecycle}, author = {Bai, Yirui and Song, Qiyang and Zhou, Qihang and Liu, Xin and Jiang, Wenbo and Du, Haichao and Jiang, Nan and Xu, Shaowen and Jia, Xiaoqi}, booktitle = {Annual Computer Security Applications Conference (ACSAC) 2026}, year = {2026}, }
USENIX Security26
vCause: Efficient and Verifiable Causality Analysis for Cloud-based Endpoint Auditing

Qiyang Song, Qihang Zhou, Xiaoqi Jia, Zhenyu Song, Wenbo Jiang, and 3 more authors

In 35th USENIX Security Symposium (USENIX Security 26), 2026

Abs Bib HTML PDF

In cloud-based endpoint auditing, an untrusted cloud may manipulate causality analysis over versioned provenance graphs. vCause combines a graph accumulator with a verifiable provenance graph to validate provenance queries and causal component identification, providing secure analysis with less than 1% endpoint overhead and 3.36% cloud overhead.
@inproceedings{song2026vCause, title = {vCause: Efficient and Verifiable Causality Analysis for Cloud-based Endpoint Auditing}, author = {Song, Qiyang and Zhou, Qihang and Jia, Xiaoqi and Song, Zhenyu and Jiang, Wenbo and Huang, Heqing and Liu, Yong and Meng, Dan}, booktitle = {35th USENIX Security Symposium (USENIX Security 26)}, pages = {3579--3598}, year = {2026}, publisher = {USENIX Association}, }
AAAI26
Focusing on Language: Revealing and Exploiting Language Attention Heads in Multilingual Large Language Models

Xin Liu, Qiyang Song, Qihang Zhou, Haichao Du, Shaowen Xu, and 3 more authors

In the 40th Association for the Advancement of Artificial Intelligence Conference (AAAI) 2026, 2026

Abs DOI Bib HTML PDF

This work studies language attention heads in multilingual large language models and shows how they can be identified and exploited to improve language-specific behavior. Experiments demonstrate that focusing on these heads reveals interpretable multilingual mechanisms and enables effective targeted manipulation across languages.
@inproceedings{liu2026focusing, title = {Focusing on Language: Revealing and Exploiting Language Attention Heads in Multilingual Large Language Models}, author = {Liu, Xin and Song, Qiyang and Zhou, Qihang and Du, Haichao and Xu, Shaowen and Jiang, Wenbo and Zhang, Weijuan and Jia, Xiaoqi}, booktitle = {the 40th Association for the Advancement of Artificial Intelligence Conference (AAAI) 2026}, pages = {32195--32203}, year = {2026}, doi = {10.1609/aaai.v40i38.40492}, }
MMAsia25
When Hallucinated Concepts Cross Modals: Unveiling Backdoor Vulnerability in Multi-modal In-context Learning

Guanyu Hou, Jiaming He, Yitong Qiao, Jiachen Li, Qiyang Song, and 3 more authors

In the 7th ACM International Conference on Multimedia in Asia (MMAsia) 2025, 2025

Abs Bib PDF

This work explores backdoor vulnerabilities in multimodal in-context learning. It introduces a black-box multimodal backdoor based on cross-modal concept mismatching, where an adversary manipulates demonstration examples to mislead the victim model. Experiments show high attack effectiveness, preserved clean-task functionality, and robustness against defenses and real-world conditions.
@inproceedings{hou2025when, title = {When Hallucinated Concepts Cross Modals: Unveiling Backdoor Vulnerability in Multi-modal In-context Learning}, author = {Hou, Guanyu and He, Jiaming and Qiao, Yitong and Li, Jiachen and Song, Qiyang and Guo, Ji and Wang, Zihan and Jiang, Wenbo}, booktitle = {the 7th ACM International Conference on Multimedia in Asia (MMAsia) 2025}, year = {2025}, }
ECAI25
Latent Knowledge Scalpel: Precise and Massive Knowledge Editing for Large Language Models

Xin Liu, Qiyang Song, Shaowen Xu, Kerou Zhou, Wenbo Jiang, and 4 more authors

In European Conference on Artificial Intelligence (ECAI) 2025, 2025

Abs Bib PDF

The Latent Knowledge Scalpel (LKS) edits the internal representations of specific entities through a lightweight hypernetwork, enabling precise and large-scale knowledge editing. Experiments on Llama-2 and Mistral show that LKS can perform up to 10,000 simultaneous edits while preserving general model capabilities.
@inproceedings{liu2025latent, title = {Latent Knowledge Scalpel: Precise and Massive Knowledge Editing for Large Language Models}, author = {Liu, Xin and Song, Qiyang and Xu, Shaowen and Zhou, Kerou and Jiang, Wenbo and Jia, Xiaoqi and Zhang, Weijuan and Huang, Heqing and Li, Yakai}, booktitle = {European Conference on Artificial Intelligence (ECAI) 2025}, year = {2025}, }
ICC25
Stealthy Physical Backdoor Attacks against Traffic Sign Recognition Systems

Wenbo Jiang, Hongwei Li, Yuxin Lu, Shuai Yuan, Rui Zhang, and 3 more authors

In IEEE International Conference on Communications (ICC) 2025, 2025

Abs Bib PDF

This work proposes two stealthy physical backdoor attacks against traffic sign recognition systems. One uses naturally occurring chipped paint on signs as a trigger, while the other optimizes a camera filter lens with a genetic algorithm. Experiments on GTSRB and TSRD demonstrate effectiveness in both digital and physical settings.
@inproceedings{jiang2025stealthy, title = {Stealthy Physical Backdoor Attacks against Traffic Sign Recognition Systems}, author = {Jiang, Wenbo and Li, Hongwei and Lu, Yuxin and Yuan, Shuai and Zhang, Rui and Wang, Zihan and Song, Qiyang and Liu, Dongxiao}, booktitle = {IEEE International Conference on Communications (ICC) 2025}, year = {2025}, }
ICME25
Weaponizing Tokens: Backdooring Text-to-Image Generation via Token Remapping

Jiaming He, Wenbo Jiang, Guanyu Hou, Qiyang Song, Ji Guo, and 1 more author

In IEEE International Conference on Multimedia & Expo (ICME) 2025, 2025

Abs Bib HTML PDF

This work introduces AROT, an automated remapping framework that attacks text-to-image generation by remapping trigger tokens in the tokenizer space. Experiments on Stable Diffusion show that the approach is effective, stealthy, and robust without the extensive poisoned data and computation required by prior attacks.
@inproceedings{he2025weaponing, title = {Weaponizing Tokens: Backdooring Text-to-Image Generation via Token Remapping}, author = {He, Jiaming and Jiang, Wenbo and Hou, Guanyu and Song, Qiyang and Guo, Ji and Li, Hongwei}, booktitle = {IEEE International Conference on Multimedia & Expo (ICME) 2025}, year = {2025}, }
NDSS25
Silence False Alarms: Identifying Anti-Reentrancy Patterns on Ethereum to Refine Smart Contract Reentrancy Detection

Qiyang Song, Heqing Huang, Xiaoqi Jia, Yuanbo Xie, and Jiahao Cao

In The Network and Distributed System Security (NDSS) Symposium 2025, 2025

Abs Bib HTML PDF Slides

This work presents AutoAR, an automated system for recognizing anti-reentrancy patterns in Ethereum contracts. It combines RentPDG graph representations, data filtration, and a graph autoencoder with clustering to identify 12 prevalent patterns with 89% accuracy and reduce false positives in reentrancy detection by more than 85%.
@inproceedings{song2025silence, title = {Silence False Alarms: Identifying Anti-Reentrancy Patterns on Ethereum to Refine Smart Contract Reentrancy Detection}, author = {Song, Qiyang and Huang, Heqing and Jia, Xiaoqi and Xie, Yuanbo and Cao, Jiahao}, booktitle = {The Network and Distributed System Security (NDSS) Symposium 2025}, year = {2025}, }
ACSAC21
Try before You Buy: Privacy-preserving Data Evaluation on Cloud-based Machine Learning Data Marketplace

Qiyang Song, Jiahao Cao, Kun Sun, Qi Li, and Ke Xu

In Annual Computer Security Applications Conference (ACSAC) 2021, 2021

Abs Bib HTML PDF Slides

This work develops a privacy-preserving framework for evaluating and selecting machine-learning data in cloud marketplaces. It encrypts models and data while preserving their functionality, and provides private data selection and validation protocols. Experiments show a 60% reduction in prediction errors compared with random data selection.
@inproceedings{qiyang2021try, title = {Try before You Buy: Privacy-preserving Data Evaluation on Cloud-based Machine Learning Data Marketplace}, author = {Song, Qiyang and Cao, Jiahao and Sun, Kun and Li, Qi and Xu, Ke}, booktitle = {Annual Computer Security Applications Conference (ACSAC) 2021}, pages = {260--272}, year = {2021}, }
TIFS20
SAP-SSE: Protecting search patterns and access patterns in searchable symmetric encryption

Qiyang Song, Zhuotao Liu, Jiahao Cao, Kun Sun, Qi Li, and 1 more author

IEEE Transactions on Information Forensics and Security, 2020

Abs Bib HTML PDF

SAP-SSE is a searchable symmetric encryption scheme that protects both search and access patterns in a generic multi-user database setting. It uses multi-cloud index shuffling and index redistribution to reduce leakage, with a configurable security policy balancing security and efficiency.
@article{song2020sap, title = {SAP-SSE: Protecting search patterns and access patterns in searchable symmetric encryption}, author = {Song, Qiyang and Liu, Zhuotao and Cao, Jiahao and Sun, Kun and Li, Qi and Wang, Cong}, journal = {IEEE Transactions on Information Forensics and Security}, volume = {16}, pages = {1795--1809}, year = {2020}, publisher = {IEEE}, }
TKDE21
GPSC: A grid-based privacy-reserving framework for online spatial crowdsourcing

Haoda Li, Qiyang Song, Guoliang Li, Qi Li, and Rengui Wang

IEEE Transactions on Knowledge and Data Engineering, 2021

Abs Bib HTML PDF

GPSC is a grid-based privacy-preserving framework for online spatial crowdsourcing. It lets a platform assign tasks to nearby workers without learning their exact locations, using encrypted locations and privacy-aware indexing. The paper proves an efficiency-security trade-off and validates the design on real-world datasets.
@article{li2021gpsc, title = {GPSC: A grid-based privacy-reserving framework for online spatial crowdsourcing}, author = {Li, Haoda and Song, Qiyang and Li, Guoliang and Li, Qi and Wang, Rengui}, journal = {IEEE Transactions on Knowledge and Data Engineering}, volume = {34}, number = {11}, pages = {5378--5390}, year = {2021}, publisher = {IEEE}, }
SecureComm20
Sgx-cube: An sgx-enhanced single sign-on system against server-side credential leakage

Songsong Liu, Qiyang Song, Kun Sun, and Qi Li

In Security and Privacy in Communication Networks: 16th EAI International Conference, SecureComm 2020, 2020

Abs Bib HTML PDF

SGX-Cube is an Intel SGX-enhanced single sign-on system that protects credentials from server-memory leakage and offline brute-force attacks. It uses record-based encrypted storage and places authentication functions inside the enclave to address SGX memory and threading limits. A prototype shows effective protection with small performance overhead.
@inproceedings{liu2020sgx, title = {Sgx-cube: An sgx-enhanced single sign-on system against server-side credential leakage}, author = {Liu, Songsong and Song, Qiyang and Sun, Kun and Li, Qi}, booktitle = {Security and Privacy in Communication Networks: 16th EAI International Conference, SecureComm 2020}, pages = {275--290}, year = {2020}, organization = {Springer International Publishing}, }