Research

I build robust AI as a foundation for trustworthy AI, in general-purpose models and AI-driven security systems.

Research Areas

Research framework. Robust AI, a foundation for trustworthy AI, in two directions. General-purpose AI models: adversarial robustness of deep neural networks across image, graph, tabular, text and multimodal data, through adversarial attack, adversarial learning and robustness transfer. AI-driven security systems: robust AI in network intrusion detection and IoT security, covering intrusion classification, concept drift and early detection, through adversarial evasion, adversarial defense and robustness certification.
1

General-Purpose AI Models

Adversarial robustness of deep neural networks

ImageGraphTabularTextMultimodal

How deep models break, how to make them robust, and how robustness carries over when pretrained models are adapted.

Adversarial Attack
Attacks under realistic access: transfer attacks that cross architectures, datasets, and label spaces at once, evasion in vertical federated learning, model stealing, and membership inference against large vision-language models. TDSC 2026ESORICS 20221 under review
Adversarial Learning
Training models that stay robust: adversarial training, latent-space mixup that defends against both off- and on-manifold attacks, and certified robustness through bounding activation functions for neural network verification. AsiaCCS 2023ICSE 20271 under review
Robustness Transfer
Keeping robustness when pretrained models are adapted downstream: robustness-preserving transfer learning and distillation, robust fine-tuning of vision foundation models, robust transfer for graphs under data scarcity, and instruction tuning. TDSC 20251 under review
2

AI-Driven Security Systems

Robust AI in network intrusion detection and IoT security

Intrusion classificationConcept driftEarly detection

Here the deep model is itself the defense, facing attackers who must keep their malicious traffic working, on heterogeneous, protocol-constrained traffic features.

Adversarial Evasion
How attackers slip past deep intrusion detectors: adversarial perturbations of traffic features, multi-stage attacks against IoT devices, and realizable evasion that keeps malicious traffic functional.
Adversarial Defense
Detectors that hold up under attack: representation learning that transfers robustness to new networks with little labeled data, consistency learning for Transformer-based detectors, and self-evolving early defense against multi-stage IoT attacks. TDSC 2025TIOT 2024CIC 20231 under review
Robustness Certification
Provable guarantees for intrusion detectors: randomized smoothing with dimension-wise certified radii for heterogeneous traffic, covering both evasion attacks and natural corruptions such as latency and packet loss. TOPS 2025TrustCom 2024

Representative Publications

Workflow of the TriXfer attack in downstream adaptation
TDSC 2026

TriXfer: Triple-Cross Transfer Attack on Vision Transformer–Adapted Downstream Classifiers

Adversarial vulnerabilities in pretrained Vision Transformers can propagate to the downstream classifiers built on them. TriXfer is the first untargeted triple-cross transfer attack: adversarial examples crafted on clean surrogate data transfer across model architectures, datasets, and label spaces at once, even when both the pretrained ViT and the downstream classifier are black boxes. Experiments across supervised, self-supervised, and vision-language backbones reveal persistent inherited vulnerabilities.

paper
Transfer learning scenarios where CARD applies
TDSC 2025

CARD: Robustness-Preserving Transfer Learning for Network Intrusion Detection via Contrastive Adversarial Representation Distillation

Adversarially training robust network intrusion detectors demands abundant labeled data and large models, while standard fine-tuning and distillation transfer accuracy but not robustness. CARD transfers both robustness and performance from a robust source model to a target task that differs in data domain, model architecture, or both. With only 5% of the training data, it achieves 17.67% and 8.38% higher adversarial robust accuracy than adversarial fine-tuning and distillation.

paper
Certified radius obtained through MARS
TOPS 2025

Dimensional Robustness Certification for Deep Neural Networks in Network Intrusion Detection Systems

Certified defenses give provable robustness guarantees, but existing ones target homogeneous image features and fit poorly to heterogeneous network traffic. MARS (Multi-order Adaptive Randomized Smoothing) certifies deep network intrusion detectors, enlarging the ℓ2 certified radius by 12.23% and improving detection under evasion attacks and natural corruptions. Its dimension-wise certified radii also reveal how robustness differs across traffic features. A shorter version received the Best Paper Award at TrustCom 2024.

paper
Interpolation points and object manifolds in latent space
AsiaCCS 2023

Boost Off/On-Manifold Adversarial Robustness for Deep Learning with Latent Representation Mixup

Adversarial training yields attack-specific robustness that generalizes poorly to unseen attacks, and mixup has rarely been studied in latent space or against on-manifold attacks. LarepMixup interpolates disentangled latent representations in two modes, convex mixing and binary-mask mixing, to synthesize semantic samples, then trains with soft-label cross-entropy to refine the decision boundary. On CIFAR-10, SVHN, and ImageNet-Mixed10, it yields models robust to both off- and on-manifold adversarial attacks.

paper
Spatial influence models for angular intra prediction and motion vector prediction
JIT 2019

Sparse Selective Encryption for HEVC 4K Video Using Spatial Error Spread

Encrypting entire 4K video streams is too costly for delay- and power-constrained systems. Sparse Selective Encryption (SSE) encrypts only a few bits of the HEVC bitstream without coupling to the encoder, letting the error from encrypted units spread through the spatial correlation of prediction units. Two spatial influence models, based on angular intra prediction and motion vector prediction, sparsely select the key units, with adjustable encryption density and format compliance preserved.

paper
Block weight model over the reference structure of a group of pictures
ICCT 2018

Selective Encryption of H.264/AVC based on Block Weight Model

The growth of 4K and 8K streaming calls for selective encryption with as low an encryption ratio as possible. For H.264/AVC, a block weight model exploits the reference structure of a video sequence to quantify how each block affects the motion compensation of others, so only the key bytes of the compressed bitstream are encrypted. The scheme resists both cryptographic and sketch attacks, and an adjustable parameter supports different security levels.

paper