Papers by Zonghao Ying
SecureWebArena: A Holistic Security Evaluation Benchmark for LVLM-based Web Agents (2026.findings-acl)
Copied to clipboard
Zonghao Ying, Yangguang Shao, Jianle Gan, Gan Xu, Wenxin Zhang, Quanchen Zou, Junzheng Shi, Zhenfei Yin, Mingchuan Zhang, Aishan Liu, Xianglong Liu
| Challenge: | Existing security benchmarks only cover user-level prompts and environmental threats . however, these models are vulnerable to pop-up attacks and prompt injections . |
| Approach: | They propose a security benchmark that covers a set of six attack vectors that span both user-level and environment-level manipulations. |
| Outcome: | The proposed security benchmarks cover a set of six real-world web environments with 2,970 adversarial trajectories and a multi-layered evaluation protocol dissecting agent failures across internal reasoning, behavioral execution, and task outcomes. |
Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models (2025.findings-emnlp)
Copied to clipboard
Zonghao Ying, Deyue Zhang, Zonglei Jing, Yisong Xiao, Quanchen Zou, Aishan Liu, Siyuan Liang, Xiangzheng Zhang, Xianglong Liu, Dacheng Tao
| Challenge: | Existing methods for implementing multi-turn jailbreaks struggle to balance semantic coherence with attack effectiveness, resulting in benign semantic drift or ineffective detection evasion. |
| Approach: | They propose a framework that reformulates harmful queries into benign reasoning tasks and leverages LLMs’ strong reasoning capabilities to compromise safety alignment. |
| Outcome: | The proposed framework achieves state-of-the-art attack effectiveness in complex conversational scenarios, with average ASRs increasing by up to 96%. |
Uncovering Strategic Egoism Behaviors in Large Language Models (2026.findings-acl)
Copied to clipboard
| Challenge: | Extensive experiments on 9 proprietary LLMs reveal that SE behaviors are widespread . study identifies egoistic decision-making as a risk for large language models . |
| Approach: | They propose a benchmark to measure egoistic behavior in large language models . they propose toxicity, jailbreak vulnerability and a lightweight mitigation that reinforces situational constraints . |
| Outcome: | The proposed model has a 67.96% occurrence rate and frequently manifests as manipulative coercion. |
DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs (2026.acl-long)
Copied to clipboard
| Challenge: | Existing jailbreak methods only use a single image, restricting the attack space . Existing frameworks only use single image to distribute harmful requests across multiple images . |
| Approach: | They propose a compositional jailbreak framework that leverages Distributed instruction, Multimodal evidence and a Number chain task to fully enhance the jailbreak performance. |
| Outcome: | The proposed framework achieves attack success rates of over 90% on GPT-4o, Gemini-2.5-pro and Claude Sonnet 4 . |