Dr. Mingyi Zhou

Email: zhoumingyi [AT] buaa [DOT] edu [DOT] cn

I joined Beihang University as an assistant professor in February 2025, working closely with Prof. Chunming Hu and Prof. Li Li at SMAT Lab. I obtained my Ph.D. from Monash University in Dec 2024. From 2021 to 2024, I have the privilege of being mentored by Prof. Li Li, Prof. John Grundy, Prof. Chunyang Chen, and Dr. Xiao Chen (in a sequence of the length of supervision) at Monash HumaniSE Lab (led by Prof. John Grundy) and SMAT Lab (led by Prof. Li Li). Prior to joining Monash University, I worked with Prof. Yipeng Liu and Prof. Ce Zhu in UESTC from 2017 to 2021.

My current research interests include SE4AI, AI4SE, mobile software engineering, AI security, program analysis and computer vision, especially for the on-device AI security and efficiency. Our research outcomes (e.g., ArkAnalyzer, HapTest, HapRay) have been applied to OpenHarmony products and popular commercial apps. If you are interested in my research, please feel free to contact me.

news

Aug 29, 2026	Invited talk at Huawei Shanghai - Performance analysis for openHarmony apps: from rule-based methods to autonomous agents!
Jul 26, 2026	Our paper “Security of Cross-Platform and Cross-Language Software Technologies: A Systematic Review” has been accepted by ACM TOSEM. Congratulations to Yutong, Jiatong and the team!
Jul 10, 2026	Our paper “Perceptual Alignment Reveals Vulnerability in Unlearned Diffusion Models” has been accepted by ACM Multimedia. Congratulations to Jing and the team!
Jun 28, 2026	Two papers have been accepted by issta’26! Congratulations to Zhihao and the team!
May 14, 2026	Received a Fund from Beihang-Huawei Joint Laboratory Program! Thank you to our industry partners and Huawei company.
May 08, 2026	Our paper “HapCiD: Detecting API-related Compatibility Issues in OpenHarmony Apps” has been accepted by Internetware’26! Congratulations to Daihang, and the team!
Apr 17, 2026	Our paper “Privacy Protection Against Personalized Text-to-Image Synthesis via Cross-image Consistency Constraints” has been accepted by ICMR2026! Congratulations to Guanyu, and the team!
Mar 09, 2026	Our paper “Effective Fine-tuning for Low-resource Languages: A Case Study of Cangjie” has been accepted by Empirical Software Engineering (EMSE)! Congratulations to Zhihao, Zhaofeng, and the team!

selected publications

Security of Cross-Platform and Cross-Language Software Technologies: A Systematic Review

Mingyi Zhou, Yutong Zhang, Jiatong Han, Li Li, and Xiapu Luo

ACM Transactions on Software Engineering and Methodology, 2026

DOI Bib

@article{zhou2026security,
  title = {Security of Cross-Platform and Cross-Language Software Technologies: A Systematic Review},
  author = {Zhou, Mingyi and Zhang, Yutong and Han, Jiatong and Li, Li and Luo, Xiapu},
  journal = {ACM Transactions on Software Engineering and Methodology},
  year = {2026},
  publisher = {ACM New York, NY},
  doi = {10.1145/3841182},
  url = {https://doi.org/10.1145/3841182},
}

Perceptual Alignment Reveals Vulnerability in Unlearned Diffusion Models

Jing Wu, Trung Le, Mingyi Zhou#, Dinh Phung, Jianfei Cai, and Mehrtash Harandi

34th ACM International Conference on Multimedia, 2026

Bib

@article{wu2026perceptual,
  author = {Wu, Jing and Le, Trung and Zhou#, Mingyi and Phung, Dinh and Cai, Jianfei and Harandi, Mehrtash},
  title = {Perceptual Alignment Reveals Vulnerability in Unlearned Diffusion Models},
  year = {2026},
  journal = {34th ACM International Conference on Multimedia},
}

How Much Static Structure Do Code Agents Need? A Study of Deterministic Anchoring

Zhihao Lin, Mingyi Zhou#, Yizhuo Yang, and Li Li#

the 35th SIGSOFT International Symposium on Software Testing and Analysis (ISSTA 2026), 2026

DOI Bib

@article{ling2026how,
  author = {Lin, Zhihao and Zhou#, Mingyi and Yang, Yizhuo and Li#, Li},
  title = {How Much Static Structure Do Code Agents Need? A Study of Deterministic Anchoring},
  year = {2026},
  journal = {the 35th SIGSOFT International Symposium on Software Testing and Analysis (ISSTA 2026)},
  doi = {10.1145/3832115},
  url = {https://doi.org/10.1145/3832115},
}

To Run or Not to Run: Analyzing the Cost-Effectiveness of Code Execution in Code Agents

Zhihao Lin, Junhua Zhu, Mingyi Zhou, Xin Wang, Zhensu Sun, Renyu Yang, David Lo, and Li Li

the 35th SIGSOFT International Symposium on Software Testing and Analysis (ISSTA 2026), 2026

DOI Bib

@article{ling2026to,
  author = {Lin, Zhihao and Zhu, Junhua and Zhou, Mingyi and Wang, Xin and Sun, Zhensu and Yang, Renyu and Lo, David and Li, Li},
  title = {To Run or Not to Run: Analyzing the Cost-Effectiveness of Code Execution in Code Agents},
  year = {2026},
  journal = {the 35th SIGSOFT International Symposium on Software Testing and Analysis (ISSTA 2026)},
  doi = {10.1145/3832113},
  url = {https://doi.org/10.1145/3832113},
}

HapCiD: Detecting API-related Compatibility Issues in OpenHarmony Apps

Daihang Chen, Yonghui Liu, Mingyi Zhou, and Li Li

Internetware, 2026

Bib

@article{chen2026hapcid,
  author = {Chen, Daihang and Liu, Yonghui and Zhou, Mingyi and Li, Li},
  title = {HapCiD: Detecting API-related Compatibility Issues in OpenHarmony Apps},
  year = {2026},
  journal = {Internetware},
}

Privacy Protection Against Personalized Text-to-Image Synthesis via Cross-image Consistency Constraints

Guanyu Wang, Kailong Wang#, Yihao Huang, Mingyi Zhou#, Geguang Pu, and Li Li

In Proceedings of the 2026 International Conference on Multimedia Retrieval, 2026

DOI Bib

@inproceedings{wang2026privacy,
  title = {Privacy Protection Against Personalized Text-to-Image Synthesis via Cross-image Consistency Constraints},
  author = {Wang, Guanyu and Wang#, Kailong and Huang, Yihao and Zhou#, Mingyi and Pu, Geguang and Li, Li},
  booktitle = {Proceedings of the 2026 International Conference on Multimedia Retrieval},
  pages = {2003--2011},
  year = {2026},
  doi = {10.1145/3805622.3810856},
  url = {https://doi.org/10.1145/3805622.3810856},
}

Effective Fine-tuning for Low-resource Languages: A Case Study of Cangjie

Zhihao Lin, Zhaofeng Liu, Mingyi Zhou, Zihan Huang, Chi Chen, Wei Ma, and Li Li

Empirical Software Engineering, 2026

DOI Bib Code

@article{lin2026effective,
  title = {Effective Fine-tuning for Low-resource Languages: A Case Study of Cangjie},
  author = {Lin, Zhihao and Liu, Zhaofeng and Zhou, Mingyi and Huang, Zihan and Chen, Chi and Ma, Wei and Li, Li},
  journal = {Empirical Software Engineering},
  volume = {31},
  number = {6},
  pages = {150},
  year = {2026},
  publisher = {Springer},
  doi = {10.1007/s10664-026-10878-4},
  url = {https://doi.org/10.1007/s10664-026-10878-4},
}

HapFlow: The Taint Analysis Framework for OpenHarmony Apps

Haonan Chen, Mingyi Zhou, Yanjie Zhao, and Li Li

ACM Transactions on Software Engineering and Methodology, 2026

DOI Bib

@article{chen2026hapflow,
  title = {HapFlow: The Taint Analysis Framework for OpenHarmony Apps},
  author = {Chen, Haonan and Zhou, Mingyi and Zhao, Yanjie and Li, Li},
  journal = {ACM Transactions on Software Engineering and Methodology},
  year = {2026},
  publisher = {ACM New York, NY},
  doi = {10.1145/3793863},
  url = {https://doi.org/10.1145/3793863},
}

Phantom Rendering Detection: Identifying and Analyzing Unnecessary UI Computations

Zhihao Lin^*, Mingyi Zhou^*, Bo Sun, Han Hu, Gang Fan, and Li Li

The ACM International Conference on the Foundations of Software Engineering (FSE), 2026

DOI Bib Code

@article{lin2026phantom,
  title = {Phantom Rendering Detection: Identifying and Analyzing Unnecessary UI Computations},
  author = {Lin, Zhihao and Zhou, Mingyi and Sun, Bo and Hu, Han and Fan, Gang and Li, Li},
  journal = {The ACM International Conference on the Foundations of Software Engineering (FSE)},
  volume = {3},
  pages = {1628--1649},
  year = {2026},
  publisher = {ACM New York, NY, USA},
  doi = {10.1145/3797101},
  url = {https://doi.org/10.1145/3797101},
}

MazeBreaker: Multi-Agent Reinforcement Learning for Dynamic Jailbreaking of LLM Security Defenses

Zhihao Lin, Wei Ma, Mingyi Zhou, Yanjie Zhao, Haoyu Wang, Yang Liu, Jun Wang, and Li Li

International Conference on Software Engineering, 2026

DOI Bib Code

@article{lin2025mazeBreaker,
  title = {MazeBreaker: Multi-Agent Reinforcement Learning for Dynamic Jailbreaking of LLM Security Defenses},
  author = {Lin, Zhihao and Ma, Wei and Zhou, Mingyi and Zhao, Yanjie and Wang, Haoyu and Liu, Yang and Wang, Jun and Li, Li},
  journal = {International Conference on Software Engineering},
  year = {2026},
  doi = {10.1145/3744916.3764558},
  url = {https://doi.org/10.1145/3744916.3764558},
}

HapCheck: DSL-Based Static Bug Detection Framework for OpenHarmony

Xitong Zhong, Chang Liu, Runlin Liu, Zifu Xu, Zhengyao Liu, Juqi Zhou, Gang Fan, Mingyi Zhou, Xiang Gao, and Li Li

International Conference on Software Engineering, SEIP, 2026

DOI Bib

@article{zhong2025hapcheck,
  title = {HapCheck: DSL-Based Static Bug Detection Framework for OpenHarmony},
  author = {Zhong, Xitong and Liu, Chang and Liu, Runlin and Xu, Zifu and Liu, Zhengyao and Zhou, Juqi and Fan, Gang and Zhou, Mingyi and Gao, Xiang and Li, Li},
  journal = {International Conference on Software Engineering, SEIP},
  year = {2026},
  doi = {10.1145/3786583.3786895},
  url = {https://doi.org/10.1145/3786583.3786895},
}

An Empirical Study on UI Overlap in OpenHarmony Applications

Farong Liu, Mingyi Zhou#, and Li Li#

In 2025 40th IEEE/ACM International Conference on Automated Software Engineering (ASE), Industry Track, 2025

DOI Bib Code

@inproceedings{11334419,
  author = {Liu, Farong and Zhou#, Mingyi and Li#, Li},
  booktitle = {2025 40th IEEE/ACM International Conference on Automated Software Engineering (ASE), Industry Track},
  title = {An Empirical Study on UI Overlap in OpenHarmony Applications},
  year = {2025},
  doi = {10.1109/ase63991.2025.00274},
  url = {https://doi.org/10.1109/ase63991.2025.00274},
}

Context-Sensitive Pointer Analysis for ArkTS

Yizhuo Yang, Lingyun Xu, Mingyi Zhou#, and Li Li#

In 2025 40th IEEE/ACM International Conference on Automated Software Engineering (ASE), Industry Track, 2025

DOI Bib

@inproceedings{11334534,
  author = {Yang, Yizhuo and Xu, Lingyun and Zhou#, Mingyi and Li#, Li},
  booktitle = {2025 40th IEEE/ACM International Conference on Automated Software Engineering (ASE), Industry Track},
  title = {Context-Sensitive Pointer Analysis for ArkTS},
  year = {2025},
  doi = {10.1109/ase63991.2025.00269},
  url = {https://doi.org/10.1109/ase63991.2025.00269},
}

UICOMPASS: UI Map Guided Mobile Task Automation via Adaptive Action Generation

Yuanzhang Lin, Zhe Zhang, He Rui, Qingao Dong, Mingyi Zhou, Jing Zhang, Xiang Gao, and Hailong Sun

In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, 2025

DOI Bib

@inproceedings{lin2025uicompass,
  title = {UICOMPASS: UI Map Guided Mobile Task Automation via Adaptive Action Generation},
  author = {Lin, Yuanzhang and Zhang, Zhe and Rui, He and Dong, Qingao and Zhou, Mingyi and Zhang, Jing and Gao, Xiang and Sun, Hailong},
  booktitle = {Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing},
  pages = {26497--26517},
  year = {2025},
  doi = {10.18653/v1/2025.emnlp-main.1346},
  url = {https://doi.org/10.18653/v1/2025.emnlp-main.1346},
}

IMU: Influence-guided Machine Unlearning

Xindi Fan, Jing Wu, Mingyi Zhou, Pengwei Liang, and Dinh Phung

arXiv preprint arXiv:2508.01620, 2025

arXiv Bib

@article{fan2025imu,
  title = {IMU: Influence-guided Machine Unlearning},
  author = {Fan, Xindi and Wu, Jing and Zhou, Mingyi and Liang, Pengwei and Phung, Dinh},
  journal = {arXiv preprint arXiv:2508.01620},
  year = {2025},
  url = {https://arxiv.org/abs/2508.01620},
}

HapTest: The Dynamic Analysis Framework for OpenHarmony

Farong Liu^*, Mingyi Zhou^*, Yakun Zhang, Ting Su, Bo Sun, Jacques Klein, Xiang Gao, and Li Li

In Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering, Industry Track, 2025

DOI Bib Code

@inproceedings{liu2025haptest,
  title = {HapTest: The Dynamic Analysis Framework for OpenHarmony},
  author = {Liu, Farong and Zhou, Mingyi and Zhang, Yakun and Su, Ting and Sun, Bo and Klein, Jacques and Gao, Xiang and Li, Li},
  booktitle = {Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering, Industry Track},
  pages = {422--431},
  year = {2025},
  url = {https://doi.org/10.1145/3696630.3728565},
  doi = {10.1145/3696630.3728565},
}

HapRepair: Learn to Repair OpenHarmony Apps

Zhihao Lin^*, Mingyi Zhou^*, Wei Ma, Chi Chen, Yun Yang, Jun Wang, Chunming Hu, and Li Li

In Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering, Industry Track, 2025

DOI Bib Code

@inproceedings{lin2025haprepair,
  title = {HapRepair: Learn to Repair OpenHarmony Apps},
  author = {Lin, Zhihao and Zhou, Mingyi and Ma, Wei and Chen, Chi and Yang, Yun and Wang, Jun and Hu, Chunming and Li, Li},
  booktitle = {Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering, Industry Track},
  pages = {319--330},
  year = {2025},
  url = {https://doi.org/10.1145/3696630.3728556},
  doi = {10.1145/3696630.3728556},
}

ArkAnalyzer: The Static Analysis Framework for OpenHarmony

Haonan Chen, Daihang Chen, Yizhuo Yang, Lingyun Xu, Liang Gao, Mingyi Zhou, Chunming Hu, and Li Li

In 2025 IEEE/ACM 47th International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP), 2025

DOI Bib Code

@inproceedings{11121726,
  author = {Chen, Haonan and Chen, Daihang and Yang, Yizhuo and Xu, Lingyun and Gao, Liang and Zhou, Mingyi and Hu, Chunming and Li, Li},
  booktitle = {2025 IEEE/ACM 47th International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP)},
  title = {ArkAnalyzer: The Static Analysis Framework for OpenHarmony},
  year = {2025},
  volume = {},
  number = {},
  pages = {136-147},
  keywords = {Computer languages;Privacy;Codes;Operating systems;Focusing;Static analysis;Detectors;Maintenance engineering;Leak detection;Software engineering;n/a},
  doi = {10.1109/ICSE-SEIP66354.2025.00018},
  url = {https://doi.org/10.1109/ICSE-SEIP66354.2025.00018},
}

LLM for Mobile: An Initial Roadmap

Daihang Chen, Yonghui Liu, Mingyi Zhou, Yanjie Zhao, Haoyu Wang, Shuai Wang, Xiao Chen, Tegawende F. Bissyande, Jacques Klein, and Li Li

ACM Trans. Softw. Eng. Methodol., Dec 2024

Abs DOI Bib PDF

When mobile meets LLMs, mobile app users deserve to have more intelligent usage experiences. For this to happen, we argue that there is a strong need to apply LLMs for the mobile ecosystem. We therefore provide a research roadmap for guiding our fellow researchers to achieve that as a whole. In this roadmap, we sum up six directions that we believe are urgently required for research to enable native intelligence in mobile devices. In each direction, we further summarize the current research progress and the gaps that still need to be filled by our fellow researchers.
@article{10.1145/3708528, author = {Chen, Daihang and Liu, Yonghui and Zhou, Mingyi and Zhao, Yanjie and Wang, Haoyu and Wang, Shuai and Chen, Xiao and Bissyande, Tegawende F. and Klein, Jacques and Li, Li}, title = {LLM for Mobile: An Initial Roadmap}, year = {2024}, publisher = {Association for Computing Machinery}, address = {New York, NY, USA}, issn = {1049-331X}, url = {https://doi.org/10.1145/3708528}, doi = {10.1145/3708528}, journal = {ACM Trans. Softw. Eng. Methodol.}, month = dec, }
DynaMO: Protecting Mobile DL Models through Coupling Obfuscated DL Operators

Mingyi Zhou, Xiang Gao, Xiao Chen, Chunyang Chen, John Grundy, and Li Li

In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, Sacramento, CA, USA, Dec 2024

Abs DOI Bib PDF Code

Deploying deep learning (DL) models on mobile applications (Apps) has become ever-more popular. However, existing studies show attackers can easily reverse-engineer mobile DL models in Apps to steal intellectual property or generate effective attacks. A recent approach, Model Obfuscation, has been proposed to defend against such reverse engineering by obfuscating DL model representations, such as weights and computational graphs, without affecting model performance. These existing model obfuscation methods use static methods to obfuscate the model representation, or they use half-dynamic methods but require users to restore the model information through additional input arguments. However, these static methods or half-dynamic methods cannot provide enough protection for on-device DL models. Attackers can use dynamic analysis to mine the sensitive information in the inference codes as the correct model information and intermediate results must be recovered at runtime for static and half-dynamic obfuscation methods. We assess the vulnerability of the existing obfuscation strategies using an instrumentation method and tool, DLModelExplorer, that dynamically extracts correct sensitive model information (i.e., weights, computational graph) at runtime. Experiments show it achieves very high attack performance (e.g., 98.76% of weights extraction rate and 99.89% of obfuscating operator classification rate). To defend against such attacks based on dynamic instrumentation, we propose DynaMO, a Dynamic Model Obfuscation strategy similar to Homomorphic Encryption. The obfuscation and recovery process can be done through simple linear transformation for the weights of randomly coupled eligible operators, which is a fully dynamic obfuscation strategy. Experiments show that our proposed strategy can dramatically improve model security compared with the existing obfuscation strategies, with only negligible overheads for on-device models. Our prototype tool is publicly available at https://github.com/zhoumingyi/DynaMO.
@inproceedings{10.1145/3691620.3694998, author = {Zhou, Mingyi and Gao, Xiang and Chen, Xiao and Chen, Chunyang and Grundy, John and Li, Li}, title = {DynaMO: Protecting Mobile DL Models through Coupling Obfuscated DL Operators}, year = {2024}, isbn = {9798400712487}, publisher = {Association for Computing Machinery}, address = {New York, NY, USA}, url = {https://doi.org/10.1145/3691620.3694998}, doi = {10.1145/3691620.3694998}, booktitle = {Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering}, pages = {204-215}, numpages = {12}, keywords = {SE for AI, AI safety, on-device AI}, location = {Sacramento, CA, USA}, series = {ASE '24}, }
Model-less Is the Best Model: Generating Pure Code Implementations to Replace On-Device DL Models

Mingyi Zhou, Xiang Gao, Pei Liu, John Grundy, Chunyang Chen, Xiao Chen, and Li Li

In Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis, Vienna, Austria, Dec 2024

Abs DOI Bib PDF Code

Recent studies show that on-device deployed deep learning (DL) models, such as those of Tensor Flow Lite (TFLite), can be easily extracted from real-world applications and devices by attackers to generate many kinds of adversarial and other attacks. Although securing deployed on-device DL models has gained increasing attention, no existing methods can fully prevent these attacks. Traditional software protection techniques have been widely explored. If on-device models can be implemented using pure code, such as C++, it will open the possibility of reusing existing robust software protection techniques. However, due to the complexity of DL models, there is no automatic method that can translate DL models to pure code. To fill this gap, we propose a novel method, CustomDLCoder, to automatically extract on-device DL model information and synthesize a customized executable program for a wide range of DL models. CustomDLCoder first parses the DL model, extracts its backend computing codes, configures the extracted codes, and then generates a customized program to implement and deploy the DL model without explicit model representation. The synthesized program hides model information for DL deployment environments since it does not need to retain explicit model representation, preventing many attacks on the DL model. In addition, it improves ML performance because the customized code removes model parsing and preprocessing steps and only retains the data computing process. Our experimental results show that CustomDLCoder improves model security by disabling on-device model sniffing. Compared with the original on-device platform (i.e., TFLite), our method can accelerate model inference by 21.0% and 24.3% on x86-64 and ARM64 platforms, respectively. Most importantly, it can significantly reduce memory consumption by 68.8% and 36.0% on x86-64 and ARM64 platforms, respectively.
@inproceedings{10.1145/3650212.3652119, author = {Zhou, Mingyi and Gao, Xiang and Liu, Pei and Grundy, John and Chen, Chunyang and Chen, Xiao and Li, Li}, title = {Model-less Is the Best Model: Generating Pure Code Implementations to Replace On-Device DL Models}, year = {2024}, isbn = {9798400706127}, publisher = {Association for Computing Machinery}, address = {New York, NY, USA}, url = {https://doi.org/10.1145/3650212.3652119}, doi = {10.1145/3650212.3652119}, booktitle = {Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis}, pages = {174-185}, numpages = {12}, keywords = {AI safety, SE for AI, software optimization for AI deployment}, location = {Vienna, Austria}, series = {ISSTA 2024}, }

Concealing Sensitive Samples against Gradient Leakage in Federated Learning

Jing Wu, Munawar Hayat, Mingyi Zhou, and Mehrtash Harandi

Proceedings of the AAAI Conference on Artificial Intelligence, Mar 2024

DOI Bib PDF Code

@article{Wu_Hayat_Zhou_Harandi_2024,
  title = {Concealing Sensitive Samples against Gradient Leakage in Federated Learning},
  volume = {38},
  url = {https://doi.org/10.1609/aaai.v38i19.30171},
  doi = {10.1609/aaai.v38i19.30171},
  abstractnote = {Federated Learning (FL) is a distributed learning paradigm that enhances users’ privacy by eliminating the need for clients to share raw, private data with the server.
    Despite the success, recent studies expose the vulnerability of FL to model inversion attacks, where adversaries reconstruct users’ private data via eavesdropping on the shared gradient information. We hypothesize that a key factor in the success of such attacks is the low entanglement among gradients per data within the batch during stochastic optimization. This creates a vulnerability that an adversary can exploit to reconstruct the sensitive data. Building upon this insight, we present a simple, yet effective defense strategy that obfuscates the gradients of the sensitive data with concealed samples. To achieve this, we propose synthesizing concealed samples to mimic the sensitive data at the gradient level while ensuring their visual dissimilarity from the actual sensitive data. Compared to the previous art, our empirical evaluations suggest that the proposed technique provides the strongest protection while simultaneously maintaining the FL performance. Code is located at https://github.com/JingWu321/DCS-2.},
  number = {19},
  journal = {Proceedings of the AAAI Conference on Artificial Intelligence},
  author = {Wu, Jing and Hayat, Munawar and Zhou, Mingyi and Harandi, Mehrtash},
  year = {2024},
  month = mar,
  pages = {21717-21725},
}

Investigating White-Box Attacks for On-Device Models

Mingyi Zhou, Xiang Gao, Jing Wu, Kui Liu, Hailong Sun, and Li Li

In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering, Lisbon, Portugal, Mar 2024

Abs DOI Bib PDF Code

Numerous mobile apps have leveraged deep learning capabilities. However, on-device models are vulnerable to attacks as they can be easily extracted from their corresponding mobile apps. Although the structure and parameters information of these models can be accessed, existing on-device attacking approaches only generate black-box attacks (i.e., indirect white-box attacks), which are less effective and efficient than white-box strategies. This is because mobile deep learning (DL) frameworks like TensorFlow Lite (TFLite) do not support gradient computing (referred to as non-debuggable models), which is necessary for white-box attacking algorithms. Thus, we argue that existing findings may underestimate the harm-fulness of on-device attacks. To validate this, we systematically analyze the difficulties of transforming the on-device model to its debuggable version and propose a Reverse Engineering framework for On-device Models (REOM), which automatically reverses the compiled on-device TFLite model to its debuggable version, enabling attackers to launch white-box attacks. Our empirical results show that our approach is effective in achieving automated transformation (i.e., 92.6%) among 244 TFLite models. Compared with previous attacks using surrogate models, REOM enables attackers to achieve higher attack success rates (10.23%→89.03%) with a hundred times smaller attack perturbations (1.0→0.01). Our findings emphasize the need for developers to carefully consider their model deployment strategies, and use white-box methods to evaluate the vulnerability of on-device models. Our artifacts 1 are available.
@inproceedings{10.1145/3597503.3639144, author = {Zhou, Mingyi and Gao, Xiang and Wu, Jing and Liu, Kui and Sun, Hailong and Li, Li}, title = {Investigating White-Box Attacks for On-Device Models}, year = {2024}, isbn = {9798400702174}, publisher = {Association for Computing Machinery}, address = {New York, NY, USA}, url = {https://doi.org/10.1145/3597503.3639144}, doi = {10.1145/3597503.3639144}, booktitle = {Proceedings of the IEEE/ACM 46th International Conference on Software Engineering}, articleno = {152}, numpages = {12}, location = {Lisbon, Portugal}, series = {ICSE '24}, }
ModelObfuscator: Obfuscating Model Information to Protect Deployed ML-Based Systems

Mingyi Zhou, Xiang Gao, Jing Wu, John Grundy, Xiao Chen, Chunyang Chen, and Li Li

In Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis, Seattle, WA, USA, Mar 2023

Abs DOI Bib PDF Code

More and more edge devices and mobile apps are leveraging deep learning (DL) capabilities. Deploying such models on devices – referred to as on-device models – rather than as remote cloud-hosted services, has gained popularity because it avoids transmitting user’s data off of the device and achieves high response time. However, on-device models can be easily attacked, as they can be accessed by unpacking corresponding apps and the model is fully exposed to attackers. Recent studies show that attackers can easily generate white-box-like attacks for an on-device model or even inverse its training data. To protect on-device models from white-box attacks, we propose a novel technique called model obfuscation. Specifically, model obfuscation hides and obfuscates the key information – structure, parameters and attributes – of models by renaming, parameter encapsulation, neural structure obfuscation, shortcut injection, and extra layer injection. We have developed a prototype tool ModelObfuscator to automatically obfuscate on-device TFLite models. Our experiments show that this proposed approach can dramatically improve model security by significantly increasing the difficulty of parsing models’ inner information, without increasing the latency of DL models. Our proposed on-device model obfuscation has the potential to be a fundamental technique for on-device model deployment. Our prototype tool is publicly available at https://github.com/zhoumingyi/ModelObfuscator.
@inproceedings{10.1145/3597926.3598113, author = {Zhou, Mingyi and Gao, Xiang and Wu, Jing and Grundy, John and Chen, Xiao and Chen, Chunyang and Li, Li}, title = {ModelObfuscator: Obfuscating Model Information to Protect Deployed ML-Based Systems}, year = {2023}, isbn = {9798400702211}, publisher = {Association for Computing Machinery}, address = {New York, NY, USA}, url = {https://doi.org/10.1145/3597926.3598113}, doi = {10.1145/3597926.3598113}, booktitle = {Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis}, pages = {1005-1017}, numpages = {13}, keywords = {AI safety, SE for AI, model deployment, model obfuscation}, location = {Seattle, WA, USA}, series = {ISSTA 2023}, }

Deep learning based diagnosis of Parkinson’s Disease using diffusion magnetic resonance imaging

Hengling Zhao, Chih-Chien Tsai, Mingyi Zhou, Yipeng Liu, Yao-Liang Chen, Fan Huang, Yu-Chun Lin, and Jiun-Jie Wang

Brain imaging and behavior, Mar 2022

DOI Bib

@article{zhao2022deep,
  title = {Deep learning based diagnosis of Parkinson’s Disease using diffusion magnetic resonance imaging},
  author = {Zhao, Hengling and Tsai, Chih-Chien and Zhou, Mingyi and Liu, Yipeng and Chen, Yao-Liang and Huang, Fan and Lin, Yu-Chun and Wang, Jiun-Jie},
  journal = {Brain imaging and behavior},
  volume = {16},
  number = {4},
  pages = {1749--1760},
  year = {2022},
  publisher = {Springer},
  doi = {10.1007/s11682-022-00631-y},
  url = {https://doi.org/10.1007/s11682-022-00631-y},
}

[Oral, Top 4.5%] DaST: Data-Free Substitute Training for Adversarial Attacks

Mingyi Zhou^*, Jing Wu^*, Yipeng Liu, Shuaicheng Liu, and Ce Zhu

In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, Mar 2020

DOI Bib PDF Code

@inproceedings{zhou2020dast,
  author = {Zhou, Mingyi and Wu, Jing and Liu, Yipeng and Liu, Shuaicheng and Zhu, Ce},
  booktitle = {Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition},
  title = {[Oral, Top 4.5%] DaST: Data-Free Substitute Training for Adversarial Attacks},
  year = {2020},
  pages = {231-240},
  doi = {10.1109/CVPR42600.2020.00031},
  url = {https://doi.org/10.1109/CVPR42600.2020.00031},
}

Tensor rank learning in CP decomposition via convolutional neural network

Mingyi Zhou, Yipeng Liu, Zhen Long, Longxi Chen, and Ce Zhu

Signal Processing: Image Communication, Mar 2019

DOI Bib Code

@article{zhou2019tensor,
  title = {Tensor rank learning in CP decomposition via convolutional neural network},
  author = {Zhou, Mingyi and Liu, Yipeng and Long, Zhen and Chen, Longxi and Zhu, Ce},
  journal = {Signal Processing: Image Communication},
  volume = {73},
  pages = {12--21},
  year = {2019},
  publisher = {Elsevier},
  doi = {10.1016/j.image.2018.03.017},
  url = {https://doi.org/10.1016/j.image.2018.03.017},
}