Work

Securing Multimodal Agents in the Wild

CMU capstone

I formulated the action gap, the distance between model-level and agent-level safety. I built a multi-step document-analysis agent that records action-level execution traces in MLflow, then ran attacks across six categories (direct, indirect, prompt, context, tool, hybrid) on an AgentHarm subset scored by an LLM judge. Qwen2.5-32B-Instruct and GPT-4.1-mini ran under identical agent logic. Stronger model-level refusal did not imply agent-level safety. GPT-4.1-mini refused more objectives yet had higher attack success under adaptive attacks, 45.7% against 37.5%, and per-action attack success reached 0.84.

Adversarial examples against vision-language models

Research

My research on the adversarial side, attacks on vision-language models. The idea is a reversible adversarial perturbation that protects image privacy from vision-language models while remaining recoverable. My part was the cross-prompt transfer evaluation. I tested whether perturbations built against one prompt still work on unseen prompts across BLIP-2, InstructBLIP and OpenFlamingo.

UsersFirst privacy threat taxonomy and LLM automation

CMU Software and Societal Systems Department

UsersFirst is a consumer privacy threat taxonomy with 4 categories, 19 threat types and 28 leaf threats. I decomposed it into individually decidable subtasks so that large language models can run parts of the analysis. I designed the ground-truth datasets and evaluation rubrics for those subtasks and wrote case-study threat analyses.

usersfirst.io

Gender bias in large language models

CMU course project

I audited GPT-4o and Llama-3.1-Instruct with Big Five personality profiles under gendered-name prompts. I measured stereotype alignment, empirical alignment and bias amplification. GPT-4o amplified stereotypical gaps, and both models produced unrealistically narrow trait distributions.

LLM security testing platform

Qiyuan Lab, AI security research intern

A desktop application for testing large language models against membership-inference attacks. The platform was mine end to end, and the attack research was the team’s. I built the application around those attacks and added a JavaScript analysis view that shows how attack outcomes shift across fine-tuning configurations and auxiliary-set choices.

IRS-aided task offloading in digital twin edge networks

HUST National Cybersecurity Center

A federated deep reinforcement learning algorithm for IRS-aided task offloading in digital twin edge networks. Published as Y. Dai, J. Wu, J. Zhao, B. Gong, Y. Lu, IEEE VTC2023-Fall.