The Model Context Protocol (MCP) connects large language model agents with external tools and applications, but it is vulnerable to preference manipulation attacks. Existing approaches inject manipulative keywords or phrases into tool names or descriptions, making them detectable. BiasAgent instead leverages agent bias to manipulate tool selection without modifying tool descriptions or user inputs. The authors construct a biased dataset that favors a designated tool and train a biased agent using Decoupled Clip and Dynamic Sampling Policy Optimization (DAPO). The resulting agent prefers the attacker-specified tool for relevant tasks while maintaining normal functionality on other tasks, achieving high effectiveness and strong stealthiness across multiple LLM agents and task settings.
@article{guo2026biasagent,title={BiasAgent: Exploiting Agent Bias for Preference Manipulation Attacks on Model Context Protocol},author={Guo, Ji and Wang, Zhijing and Jiang, Wenbo and Zhang, Rui and Xiong, Jian and Song, Qiyang and Wu, Hao and Liu, Yijing},journal={IEEE Transactions on Cognitive Communications and Networking},volume={12},pages={10358--10371},year={2026},publisher={IEEE},doi={10.1109/TCCN.2026.3714063},}
ACSAC26
The Devil’s Whisper to Agents: Unveiling and Formalizing Training-Free Backdoor Attacks Across the MCP-Enabled Agent Execution Lifecycle
Yirui
Bai, Qiyang
Song, Qihang
Zhou, Xin
Liu, Wenbo
Jiang, and
4 more authors
In Annual Computer Security Applications Conference (ACSAC) 2026, 2026
Unlike training-based backdoors that rely on model training or parameter modification, this work systematically defines lightweight training-free backdoors for MCP-enabled agents. By poisoning MCP tool metadata, it formalizes multiple trigger forms spanning the agent execution lifecycle, including Query, Thought, and Observation, and introduces a large-scale benchmark of realistic backdoor attacks. Experiments on mainstream large language models, including Claude and GPT, show attack success rates of up to 97.53%.
@inproceedings{bai2026devils,title={The Devil’s Whisper to Agents: Unveiling and Formalizing Training-Free Backdoor Attacks Across the MCP-Enabled Agent Execution Lifecycle},author={Bai, Yirui and Song, Qiyang and Zhou, Qihang and Liu, Xin and Jiang, Wenbo and Du, Haichao and Jiang, Nan and Xu, Shaowen and Jia, Xiaoqi},booktitle={Annual Computer Security Applications Conference (ACSAC) 2026},year={2026},}
USENIX Security26
vCause: Efficient and Verifiable Causality Analysis for Cloud-based Endpoint Auditing
Qiyang
Song, Qihang
Zhou, Xiaoqi
Jia, Zhenyu
Song, Wenbo
Jiang, and
3 more authors
In 35th USENIX Security Symposium (USENIX Security 26), 2026
In cloud-based endpoint auditing, an untrusted cloud may manipulate causality analysis over versioned provenance graphs. vCause combines a graph accumulator with a verifiable provenance graph to validate provenance queries and causal component identification, providing secure analysis with less than 1% endpoint overhead and 3.36% cloud overhead.
@inproceedings{song2026vCause,title={vCause: Efficient and Verifiable Causality Analysis for Cloud-based Endpoint Auditing},author={Song, Qiyang and Zhou, Qihang and Jia, Xiaoqi and Song, Zhenyu and Jiang, Wenbo and Huang, Heqing and Liu, Yong and Meng, Dan},booktitle={35th USENIX Security Symposium (USENIX Security 26)},pages={3579--3598},year={2026},publisher={USENIX Association},}
AAAI26
Focusing on Language: Revealing and Exploiting Language Attention Heads in Multilingual Large Language Models
Xin
Liu, Qiyang
Song, Qihang
Zhou, Haichao
Du, Shaowen
Xu, and
3 more authors
In the 40th Association for the Advancement of Artificial Intelligence Conference (AAAI) 2026, 2026
This work studies language attention heads in multilingual large language models and shows how they can be identified and exploited to improve language-specific behavior. Experiments demonstrate that focusing on these heads reveals interpretable multilingual mechanisms and enables effective targeted manipulation across languages.
@inproceedings{liu2026focusing,title={Focusing on Language: Revealing and Exploiting Language Attention Heads in Multilingual Large Language Models},author={Liu, Xin and Song, Qiyang and Zhou, Qihang and Du, Haichao and Xu, Shaowen and Jiang, Wenbo and Zhang, Weijuan and Jia, Xiaoqi},booktitle={the 40th Association for the Advancement of Artificial Intelligence Conference (AAAI) 2026},pages={32195--32203},year={2026},doi={10.1609/aaai.v40i38.40492},}
2025
MMAsia25
When Hallucinated Concepts Cross Modals: Unveiling Backdoor Vulnerability in Multi-modal In-context Learning
Guanyu
Hou, Jiaming
He, Yitong
Qiao, Jiachen
Li, Qiyang
Song, and
3 more authors
In the 7th ACM International Conference on Multimedia in Asia (MMAsia) 2025, 2025
This work explores backdoor vulnerabilities in multimodal in-context learning. It introduces a black-box multimodal backdoor based on cross-modal concept mismatching, where an adversary manipulates demonstration examples to mislead the victim model. Experiments show high attack effectiveness, preserved clean-task functionality, and robustness against defenses and real-world conditions.
@inproceedings{hou2025when,title={When Hallucinated Concepts Cross Modals: Unveiling Backdoor Vulnerability in Multi-modal In-context Learning},author={Hou, Guanyu and He, Jiaming and Qiao, Yitong and Li, Jiachen and Song, Qiyang and Guo, Ji and Wang, Zihan and Jiang, Wenbo},booktitle={the 7th ACM International Conference on Multimedia in Asia (MMAsia) 2025},year={2025},}
ECAI25
Latent Knowledge Scalpel: Precise and Massive Knowledge Editing for Large Language Models
Xin
Liu, Qiyang
Song, Shaowen
Xu, Kerou
Zhou, Wenbo
Jiang, and
4 more authors
In European Conference on Artificial Intelligence (ECAI) 2025, 2025
The Latent Knowledge Scalpel (LKS) edits the internal representations of specific entities through a lightweight hypernetwork, enabling precise and large-scale knowledge editing. Experiments on Llama-2 and Mistral show that LKS can perform up to 10,000 simultaneous edits while preserving general model capabilities.
@inproceedings{liu2025latent,title={Latent Knowledge Scalpel: Precise and Massive Knowledge Editing for Large Language Models},author={Liu, Xin and Song, Qiyang and Xu, Shaowen and Zhou, Kerou and Jiang, Wenbo and Jia, Xiaoqi and Zhang, Weijuan and Huang, Heqing and Li, Yakai},booktitle={European Conference on Artificial Intelligence (ECAI) 2025},year={2025},}
ICC25
Stealthy Physical Backdoor Attacks against Traffic Sign Recognition Systems
Wenbo
Jiang, Hongwei
Li, Yuxin
Lu, Shuai
Yuan, Rui
Zhang, and
3 more authors
In IEEE International Conference on Communications (ICC) 2025, 2025
This work proposes two stealthy physical backdoor attacks against traffic sign recognition systems. One uses naturally occurring chipped paint on signs as a trigger, while the other optimizes a camera filter lens with a genetic algorithm. Experiments on GTSRB and TSRD demonstrate effectiveness in both digital and physical settings.
@inproceedings{jiang2025stealthy,title={Stealthy Physical Backdoor Attacks against Traffic Sign Recognition Systems},author={Jiang, Wenbo and Li, Hongwei and Lu, Yuxin and Yuan, Shuai and Zhang, Rui and Wang, Zihan and Song, Qiyang and Liu, Dongxiao},booktitle={IEEE International Conference on Communications (ICC) 2025},year={2025},}
ICME25
Weaponizing Tokens: Backdooring Text-to-Image Generation via Token Remapping
Jiaming
He, Wenbo
Jiang, Guanyu
Hou, Qiyang
Song, Ji
Guo, and
1 more author
In IEEE International Conference on Multimedia & Expo (ICME) 2025, 2025
This work introduces AROT, an automated remapping framework that attacks text-to-image generation by remapping trigger tokens in the tokenizer space. Experiments on Stable Diffusion show that the approach is effective, stealthy, and robust without the extensive poisoned data and computation required by prior attacks.
@inproceedings{he2025weaponing,title={Weaponizing Tokens: Backdooring Text-to-Image Generation via Token Remapping},author={He, Jiaming and Jiang, Wenbo and Hou, Guanyu and Song, Qiyang and Guo, Ji and Li, Hongwei},booktitle={IEEE International Conference on Multimedia & Expo (ICME) 2025},year={2025},}
NDSS25
Silence False Alarms: Identifying Anti-Reentrancy Patterns on Ethereum to Refine Smart Contract Reentrancy Detection
Qiyang
Song, Heqing
Huang, Xiaoqi
Jia, Yuanbo
Xie, and Jiahao
Cao
In The Network and Distributed System Security (NDSS) Symposium 2025, 2025
This work presents AutoAR, an automated system for recognizing anti-reentrancy patterns in Ethereum contracts. It combines RentPDG graph representations, data filtration, and a graph autoencoder with clustering to identify 12 prevalent patterns with 89% accuracy and reduce false positives in reentrancy detection by more than 85%.
@inproceedings{song2025silence,title={Silence False Alarms: Identifying Anti-Reentrancy Patterns on Ethereum to Refine Smart Contract Reentrancy Detection},author={Song, Qiyang and Huang, Heqing and Jia, Xiaoqi and Xie, Yuanbo and Cao, Jiahao},booktitle={The Network and Distributed System Security (NDSS) Symposium 2025},year={2025},}
2021
ACSAC21
Try before You Buy: Privacy-preserving Data Evaluation on Cloud-based Machine Learning Data Marketplace
Qiyang
Song, Jiahao
Cao, Kun
Sun, Qi
Li, and Ke
Xu
In Annual Computer Security Applications Conference (ACSAC) 2021, 2021
This work develops a privacy-preserving framework for evaluating and selecting machine-learning data in cloud marketplaces. It encrypts models and data while preserving their functionality, and provides private data selection and validation protocols. Experiments show a 60% reduction in prediction errors compared with random data selection.
@inproceedings{qiyang2021try,title={Try before You Buy: Privacy-preserving Data Evaluation on Cloud-based Machine Learning Data Marketplace},author={Song, Qiyang and Cao, Jiahao and Sun, Kun and Li, Qi and Xu, Ke},booktitle={Annual Computer Security Applications Conference (ACSAC) 2021},pages={260--272},year={2021},}
TKDE21
GPSC: A grid-based privacy-reserving framework for online spatial crowdsourcing
Haoda
Li, Qiyang
Song, Guoliang
Li, Qi
Li, and Rengui
Wang
IEEE Transactions on Knowledge and Data Engineering, 2021
GPSC is a grid-based privacy-preserving framework for online spatial crowdsourcing. It lets a platform assign tasks to nearby workers without learning their exact locations, using encrypted locations and privacy-aware indexing. The paper proves an efficiency-security trade-off and validates the design on real-world datasets.
@article{li2021gpsc,title={GPSC: A grid-based privacy-reserving framework for online spatial crowdsourcing},author={Li, Haoda and Song, Qiyang and Li, Guoliang and Li, Qi and Wang, Rengui},journal={IEEE Transactions on Knowledge and Data Engineering},volume={34},number={11},pages={5378--5390},year={2021},publisher={IEEE},}
2020
TIFS20
SAP-SSE: Protecting search patterns and access patterns in searchable symmetric encryption
Qiyang
Song, Zhuotao
Liu, Jiahao
Cao, Kun
Sun, Qi
Li, and
1 more author
IEEE Transactions on Information Forensics and Security, 2020
SAP-SSE is a searchable symmetric encryption scheme that protects both search and access patterns in a generic multi-user database setting. It uses multi-cloud index shuffling and index redistribution to reduce leakage, with a configurable security policy balancing security and efficiency.
@article{song2020sap,title={SAP-SSE: Protecting search patterns and access patterns in searchable symmetric encryption},author={Song, Qiyang and Liu, Zhuotao and Cao, Jiahao and Sun, Kun and Li, Qi and Wang, Cong},journal={IEEE Transactions on Information Forensics and Security},volume={16},pages={1795--1809},year={2020},publisher={IEEE},}
SecureComm20
Sgx-cube: An sgx-enhanced single sign-on system against server-side credential leakage
Songsong
Liu, Qiyang
Song, Kun
Sun, and Qi
Li
In Security and Privacy in Communication Networks: 16th EAI International Conference, SecureComm 2020, 2020
SGX-Cube is an Intel SGX-enhanced single sign-on system that protects credentials from server-memory leakage and offline brute-force attacks. It uses record-based encrypted storage and places authentication functions inside the enclave to address SGX memory and threading limits. A prototype shows effective protection with small performance overhead.
@inproceedings{liu2020sgx,title={Sgx-cube: An sgx-enhanced single sign-on system against server-side credential leakage},author={Liu, Songsong and Song, Qiyang and Sun, Kun and Li, Qi},booktitle={Security and Privacy in Communication Networks: 16th EAI International Conference, SecureComm 2020},pages={275--290},year={2020},organization={Springer International Publishing},}
2019
DSC19
Federated-cloud based deep neural networks with privacy preserving image filtering techniques
Isabelle
Choi, Qiyang
Song, and Kun
Sun
In 2019 IEEE Conference on Dependable and Secure Computing (DSC), 2019
This work proposes privacy-preserving federated-cloud training and classification for deep neural networks using application-specific image filtering. Multiple clouds train on differently distorted data, and their models are combined to recover accuracy while controlling privacy and distortion trade-offs.
@inproceedings{choi2019federated,title={Federated-cloud based deep neural networks with privacy preserving image filtering techniques},author={Choi, Isabelle and Song, Qiyang and Sun, Kun},booktitle={2019 IEEE Conference on Dependable and Secure Computing (DSC)},pages={1--8},year={2019},organization={IEEE},}
GlobeCom19
cSFC: Building credible service function chain on the cloud
Shengsheng
Yao, Mingwei
Xu, Qi
Li, Jiahao
Cao, and Qiyang
Song
In 2019 IEEE Global Communications Conference (GLOBECOM), 2019
cSFC builds credible service function chains on an untrusted cloud. It protects network functions, preserves the order of the chain, and keeps session data private while supporting a broad range of network functions. Prototype evaluation shows practical performance with acceptable overhead.
@inproceedings{yao2019csfc,title={cSFC: Building credible service function chain on the cloud},author={Yao, Shengsheng and Xu, Mingwei and Li, Qi and Cao, Jiahao and Song, Qiyang},booktitle={2019 IEEE Global Communications Conference (GLOBECOM)},pages={1--6},year={2019},organization={IEEE},}
