I am an Assistant Professor at the School of Computing and Data Science at The University of Hong Kong. I lead the System Security Lab, where we design and build systems to enhance computer security. Our research leverages methodologies and theories from programming languages, software engineering, operating systems, and artificial intelligence.
I earned my PhD in Computer Science from the Georgia Institute of Technology, advised by Prof. Wenke Lee and Dr. William Harris. I got my BA in Software Engineering from Nanjing University. Before pursuing my PhD, I spent one and a half years at Hong Kong PolyU doing research on Android security, advised by Prof. Daniel Xiapu Luo.
I am looking for highly-motivated PhD students and postdocs interested in security, program analysis, software engineering, and operating systems. If you are interested, please feel free to reach out.
Most recent publications on Google Scholar.
‡ indicates first author is my student.
Specializing Language Models for Textual Fuzzing via Reinforcement Learning ‡
Jiayi Lin, Liangcai Su, Junzhe Li, Chenxiong Qian
S&P'26: 2026 IEEE Symposium on Security and Privacy. 2026.
Scaling Agents via Continual Pre-training ‡
Liangcai Su, Zhen Zhang, Guangyu Li, Zhuo Chen, Chenxi Wang, Maojia Song, Xinyu Wang, Kuan Li, Jialong Wu, Xuanzhong Chen, Zile Qiao, Zhongwang Zhang, Huifeng Yin, Shihao Cai, Runnan Fang, Zhengwei Tao, Wenbiao Yin, Rui Ye, Yong Jiang, Ningyu Zhang, Pengjun Xie, Fei Huang, Kai Ye, Kewei Tu, Chenxiong Qian, Jingren Zhou
ICLR'26: The Fourteenth International Conference on Learning Representations. 2026.
XGuardian: Towards Explainable and Generalized AI Anti-Cheat on FPS Games ‡
Jiayi Zhang, Chenxin Sun, Chenxiong Qian
SEC'26: The 35th USENIX Security Symposium. 2026.
IsolatOS: Detecting Double Fetch Bugs in COTS RTOS by Re-enabling Kernel Isolation
Yingjie Cao, Xiaogang Zhu, Dean Sullivan, Haowei Yang, Lei Xue, Xian Li, Chenxiong Qian, Minrui Yan, Xiapu Luo
NDSS'26: The 33rd Network and Distributed System Security Symposium. 2026.
Fuzzing JavaScript Engines by Fusing JavaScript and WebAssembly ‡
Jiayi Lin, Changhua Luo, Mingxue Zhang, Lanteng Lin, Penghui Li, Chenxiong Qian
ICSE'26: The 48th IEEE/ACM International Conference on Software Engineering. 2026.
ImportSnare: Directed "Code Manual" Hijacking in Retrieval-Augmented Code Generation ‡
Kai Ye, Liangcai Su, Chenxiong Qian
CCS'25: The 32nd ACM Conference on Computer and Communications Security. 2025.
How Far Are We from True Unlearnability? ‡
Kai Ye, Liangcai Su, Chenxiong Qian
ICLR'25: The Thirteenth International Conference on Learning Representations. 2025.
Daredevil: Rescue Your Flash Storage from Inflexible Kernel Storage Stack ‡
Junzhe Li, Ran Shu, Jiayi Lin, Qingyu Zhang, Ziyue Yang, Jie Zhang, Yongqiang Xiong, Chenxiong Qian
EuroSys'25: Twentieth European Conference on Computer Systems. 2025.
Automatic Library Fuzzing through API Relation Evolvement ‡
Jiayi Lin, Qingyu Zhang, Junzhe Li, Chenxin Sun, Changhua Luo, Hao Zhou, Chenxiong Qian
NDSS'25: The 32nd Network and Distributed System Security Symposium. 2025.
Invisibility Cloak: Proactive Defense Against Visual Game Cheating ‡
Chenxin Sun, Kai Ye, Liangcai Su, Jiayi Zhang, Chenxiong Qian
SEC'24: 33rd USENIX Security Symposium. 2024.
Beyond the Surface: Uncovering the Unprotected Components of Android Against Overlay Attack
Hao Zhou, Shuohan Wu, Chenxiong Qian, Xiapu Luo, Haipeng Cai, Chao Zhang
NDSS'24: The 31st Network and Distributed System Security Symposium. 2024.
Revisiting Automotive Attack Surfaces: a Practitioners' Perspective
Pengfei Jing, Zhiqiang Cai, Yingjie Cao, Le Yu, Yuefeng Du, Wenkai Zhang, Chenxiong Qian, Xiapu Luo, Sen Nie, Shi Wu
S&P'24: 2024 IEEE Symposium on Security and Privacy. 2024.
Slimium: Debloating the Chromium Browser with Feature Subsetting
Chenxiong Qian, Hyungjoon Koo, ChangSeok Oh, Taesoo Kim, Wenke Lee
CCS'20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. 2020.
RAZOR: a Framework for Post-deployment Software Debloating
Chenxiong Qian, Hong Hu, Mansour Alharthi, Pak Chung, Taesoo Kim, Wenke Lee
SEC'19: Proceedings of the 28th USENIX Conference on Security Symposium. 2019.
Enforcing Unique Code Target Property for Control-Flow Integrity
Hong Hu, Chenxiong Qian, Carter Yagemann, Simon Chung, William Harris, Taesoo Kim, Wenke Lee
CCS'18: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. 2018.
Precise and Scalable Detection of Double-Fetch Bugs in OS Kernels
Meng Xu, Chenxiong Qian, Kangjie Lu, Michael Backes, Taesoo Kim
S&P'18: 2018 IEEE Symposium on Security and Privacy. 2018.
Cloak and Dagger: From Two Permissions to Complete Control of the UI Feedback Loop
Yanick Fratantonio, Chenxiong Qian, Simon Chung, Wenke Lee
S&P'17: 2017 IEEE Symposium on Security and Privacy. 2017.
Specializing Language Models for Textual Fuzzing via Reinforcement Learning ‡
Jiayi Lin, Liangcai Su, Junzhe Li, Chenxiong Qian
S&P'26: 2026 IEEE Symposium on Security and Privacy. 2026.
Scaling Agents via Continual Pre-training ‡
Liangcai Su, Zhen Zhang, Guangyu Li, Zhuo Chen, Chenxi Wang, Maojia Song, Xinyu Wang, Kuan Li, Jialong Wu, Xuanzhong Chen, Zile Qiao, Zhongwang Zhang, Huifeng Yin, Shihao Cai, Runnan Fang, Zhengwei Tao, Wenbiao Yin, Rui Ye, Yong Jiang, Ningyu Zhang, Pengjun Xie, Fei Huang, Kai Ye, Kewei Tu, Chenxiong Qian, Jingren Zhou
ICLR'26: The Fourteenth International Conference on Learning Representations. 2026.
XGuardian: Towards Explainable and Generalized AI Anti-Cheat on FPS Games ‡
Jiayi Zhang, Chenxin Sun, Chenxiong Qian
SEC'26: The 35th USENIX Security Symposium. 2026.
Bones of Contention: Exploring Query-Efficient Attacks Against Skeleton Recognition Systems
Yuxin Cao, Kai Ye, Derui Wang, Minhui Xue, Hao Ge, Chenxiong Qian, Jin Song Dong
TIFS'26: IEEE Transactions on Information Forensics and Security. 2026.
Identify as a Human Does: A Pathfinder of Next-Generation Anti-Cheat Framework for First-Person Shooter Games ‡
Jiayi Zhang, Chenxin Sun, Yue Gu, Qingyu Zhang, Jiayi Lin, Xiaojiang Du, Chenxiong Qian
TIFS'26: IEEE Transactions on Information Forensics and Security. 2026.
IsolatOS: Detecting Double Fetch Bugs in COTS RTOS by Re-enabling Kernel Isolation
Yingjie Cao, Xiaogang Zhu, Dean Sullivan, Haowei Yang, Lei Xue, Xian Li, Chenxiong Qian, Minrui Yan, Xiapu Luo
NDSS'26: The 33rd Network and Distributed System Security Symposium. 2026.
Fuzzing JavaScript Engines by Fusing JavaScript and WebAssembly ‡
Jiayi Lin, Changhua Luo, Mingxue Zhang, Lanteng Lin, Penghui Li, Chenxiong Qian
ICSE'26: The 48th IEEE/ACM International Conference on Software Engineering. 2026.
Merlin: Improving Page Prefetching via Online Reinforcement Learning ‡
Yingying Liu, Junzhe Li, Junzhou Fang, Chenxiong Qian
PACMI'25: Practical Adoption Challenges of ML for Systems. 2025.
Indispensable CPU-centric Checkpointing for GPUs ‡
Junzhe Li, Ran Shu, Ziyue Yang, Shuotao Xu, Chenxiong Qian, Yongqiang Xiong
APSys'25: The 16th ACM SIGOPS Asia-Pacific Workshop on Systems. 2025.
ImportSnare: Directed "Code Manual" Hijacking in Retrieval-Augmented Code Generation ‡
Kai Ye, Liangcai Su, Chenxiong Qian
CCS'25: The 32nd ACM Conference on Computer and Communications Security. 2025.
How Far Are We from True Unlearnability? ‡
Kai Ye, Liangcai Su, Chenxiong Qian
ICLR'25: The Thirteenth International Conference on Learning Representations. 2025.
Daredevil: Rescue Your Flash Storage from Inflexible Kernel Storage Stack ‡
Junzhe Li, Ran Shu, Jiayi Lin, Qingyu Zhang, Ziyue Yang, Jie Zhang, Yongqiang Xiong, Chenxiong Qian
EuroSys'25: Twentieth European Conference on Computer Systems. 2025.
Automatic Library Fuzzing through API Relation Evolvement ‡
Jiayi Lin, Qingyu Zhang, Junzhe Li, Chenxin Sun, Changhua Luo, Hao Zhou, Chenxiong Qian
NDSS'25: The 32nd Network and Distributed System Security Symposium. 2025.
WizardMerge - Save Us From Merging Without Any Clues ‡
Qingyu Zhang, Junzhe Li, Jiayi Lin, Jie Ding, Lanteng Lin, Chenxiong Qian
TOSEM'25: Transactions on Software Engineering and Methodology. 2025.
CherryPicker: A Parallel Solving and State Sharing Hybrid Fuzzing System ‡
Qingyu Zhang, Jiayi Lin, Chenxin Sun, Chenxiong Qian, Xiapu Luo
TDSC'25: IEEE Transactions on Dependable and Secure Computing. 2025.
Invisibility Cloak: Proactive Defense Against Visual Game Cheating ‡
Chenxin Sun, Kai Ye, Liangcai Su, Jiayi Zhang, Chenxiong Qian
SEC'24: 33rd USENIX Security Symposium. 2024.
Beyond the Surface: Uncovering the Unprotected Components of Android Against Overlay Attack
Hao Zhou, Shuohan Wu, Chenxiong Qian, Xiapu Luo, Haipeng Cai, Chao Zhang
NDSS'24: The 31st Network and Distributed System Security Symposium. 2024.
Revisiting Automotive Attack Surfaces: a Practitioners' Perspective
Pengfei Jing, Zhiqiang Cai, Yingjie Cao, Le Yu, Yuefeng Du, Wenkai Zhang, Chenxiong Qian, Xiapu Luo, Sen Nie, Shi Wu
S&P'24: 2024 IEEE Symposium on Security and Privacy. 2024.
Unearthing Gas-Wasting Code Smells in Smart Contracts with Large Language Models
Jinan Jiang, Zihao Li, Haoran Qin, Muhui Jiang, Xiapu Luo, Xiaoming Wu, Haoyu Wang, Yutian Tang, Chenxiong Qian, Ting Chen
TSE'24: IEEE Transactions on Software Engineering. 2024.
CydiOS: A Model-Based Testing Framework for iOS Apps
Shuohan Wu, Jianfeng Li, Hao Zhou, Yongsheng Fang, Kaifa Zhao, Haoyu Wang, Chenxiong Qian, Xiapu Luo
ISSTA'23: Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis. 2023.
DeView: Confining Progressive Web Applications by Debloating Web APIs
ChangSeok Oh, Sangho Lee, Chenxiong Qian, Hyungjoon Koo, Wenke Lee
ACSAC'22: Proceedings of the 38th Annual Computer Security Applications Conference. 2022.
Slimium: Debloating the Chromium Browser with Feature Subsetting
Chenxiong Qian, Hyungjoon Koo, ChangSeok Oh, Taesoo Kim, Wenke Lee
CCS'20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. 2020.
RAZOR: a Framework for Post-deployment Software Debloating
Chenxiong Qian, Hong Hu, Mansour Alharthi, Pak Chung, Taesoo Kim, Wenke Lee
SEC'19: Proceedings of the 28th USENIX Conference on Security Symposium. 2019.
NDroid: Toward Tracking Information Flows Across Multiple Android Contexts
Lei Xue, Chenxiong Qian, Hao Zhou, Xiapu Luo, Yajin Zhou, Yuru Shao, Alvin Chan
TIFS'19: IEEE Transactions on Information Forensics and Security. 2019.
Enforcing Unique Code Target Property for Control-Flow Integrity
Hong Hu, Chenxiong Qian, Carter Yagemann, Simon Chung, William Harris, Taesoo Kim, Wenke Lee
CCS'18: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. 2018.
Precise and Scalable Detection of Double-Fetch Bugs in OS Kernels
Meng Xu, Chenxiong Qian, Kangjie Lu, Michael Backes, Taesoo Kim
S&P'18: 2018 IEEE Symposium on Security and Privacy. 2018.
Rampart: Protecting Web Applications from CPU-Exhaustion Denial-of-Service Attacks
Wei Meng, Chenxiong Qian, Shuang Hao, Kevin Borgolte, Giovanni Vigna, Christopher Kruegel, Wenke Lee
SEC'18: 27th USENIX Security Symposium. 2018.
Enhancing the Description-to-Behavior Fidelity in Android Apps with Privacy Policy
Le Yu, Xiapu Luo, Chenxiong Qian, Shuai Wang, Hareton Leung
TOSE'18: IEEE Transactions on Software Engineering. 2018.
Cloak and Dagger: From Two Permissions to Complete Control of the UI Feedback Loop
Yanick Fratantonio, Chenxiong Qian, Simon Chung, Wenke Lee
S&P'17: 2017 IEEE Symposium on Security and Privacy. 2017.
Efficient Protection of Path-Sensitive Control Security
Ren Ding, Chenxiong Qian, Chengyu Song, Bill Harris, Taesoo Kim, Wenke Lee
SEC'17: 26th USENIX Security Symposium. 2017.
Revisiting the Description-to-Behavior Fidelity in Android Applications
Le Yu, Xiapu Luo, Chenxiong Qian, Shuai Wang
SANER'16: 2016 IEEE 23rd International Conference on Software Analysis, Evolution, and Reengineering. 2016.
Toward Engineering a Secure Android Ecosystem: A Survey of Existing Techniques
Meng Xu, Chengyu Song, Yang Ji, Ming-Wei Shih, Kangjie Lu, Cong Zheng, Ruian Duan, Yeongjin Jang, Byoungyoung Lee, Chenxiong Qian, Sangho Lee, Taesoo Kim
ACM Computing Surveys. 2016.
VulHunter: Toward Discovering Vulnerabilities in Android Applications
Chenxiong Qian, Xiapu Luo, Yu Le, Guofei Gu
IEEE Micro. 2015.
AndroidPerf: A Cross-layer Profiling System for Android Applications
Lei Xue, Chenxiong Qian, Xiapu Luo
IWQoS'15: 2015 IEEE 23rd International Symposium on Quality of Service. 2015.
Towards a Scalable Resource-driven Approach for Detecting Repackaged Android Applications
Yuru Shao, Xiapu Luo, Chenxiong Qian, Pengfei Zhu, Lei Zhang
ACSAC'14: Proceedings of the 30th Annual Computer Security Applications Conference. 2014.
On Measuring One-Way Path Metrics from a Web Server
Xiapu Luo, Lei Xue, Cong Shi, Yuru Shao, Chenxiong Qian, Edmond Chan
ICNP'14: 2014 IEEE 22nd International Conference on Network Protocols. 2014.
On Tracking Information Flows through JNI in Android Applications
Chenxiong Qian, Xiapu Luo, Yuru Shao, Alvin Chan
DSN'14: 2014 44th Annual IEEE/IFIP International Conference on Dependable Systems and Networks. 2014.
RootGuard: Protecting Rooted Android Phones
Yuru Shao, Xiapu Luo, Chenxiong Qian
Computer. 2014.
Full Resume in PDF.