Xinfeng Li

Xinfeng Li

The Hong Kong Polytechnic University

I am a tenure-track Assistant Professor in the Department of Data Science and Artificial Intelligence (DSAI) at The Hong Kong Polytechnic University (PolyU). Previously, I was a Research Fellow in the College of Computing and Data Science at NTU, working with Prof. XiaoFeng Wang and Prof. Wei Dong. I completed my Ph.D. with honors at Zhejiang University, co-supervised by Prof. Wenyuan Xu, Prof. Xiaoyu Ji, and Prof. Chen Yan. I obtained my B.Eng. with honors from Zhejiang University.

My research focuses on AI security and privacy, especially the security, privacy, and safety of multimodal LLMs & agentic AI systems. I study how to secure interactions between agentic AI systems and the real world. My goal is to help AI agents become robust and responsible partners. Robust agents should be resilient to external attacks, and responsible agents should behave in a helpful, harmless, and honest manner. My work has appeared in security and AI/ML venues: IEEE S&P, ACM CCS, USENIX Security, NDSS, NeurIPS, ICML, ICLR, KDD, CVPR, ACL, etc.

My group is broadly interested in the following research directions:

  • Security and Privacy of Agentic AI Systems: building robust and responsible agentic AI systems and protecting their interactions with the physical and digital world.
  • Responsible AI in Social Contexts: improving the safety, security, and privacy of multi-agent and human-agent interactions, as well as addressing risks in multimodal AIGC (e.g., deepfake generation and detection).
  • Trustworthy AI for X (e.g., Science, Systems): enabling reliable AI deployment in healthcare, power grids, software engineering, IoT, and telecommunications systems.

We have multiple openings for PhD students 2027Fall and 2028Fall intake, postdoctoral fellows, and (remote) research assistants/interns. Please see Openings for current opportunities and application instructions.

News

  • 2026.09:  Two papers have been accepted to NDSS 2027: MobileProbe, on the security evaluation of Mobile Agents, and Policy Effective Jailbreak (POEF), on the security evaluation of embodied AI.
  • 2026.07:  iFinder (multi-agent flaw discovery for core carrier networks) and Inception (multi-turn jailbreak against T2I systems) have been accepted to USENIX Security 2026.
  • 2026.06:  PoisonLoRA (plugin poisoning in the text-to-image ecosystem) has been accepted to CCS 2026.
  • 2026.04:  A-MemGuard and CentaurEval have been accepted to ICML 2026.
  • 2026.03:  GIFT has been accepted to IEEE S&P 2026.
  • 2026.03:  ELS (Energy Landscape Steering), AudioStealer, and MDTeamGPT have been accepted to ACL Main/Findings 2026.
  • 2026.01:  Refusal-Index and PISTOLE have been accepted to ICLR 2026.
  • 2025.11:  EmoRAG has been accepted to SIGKDD 2026. It’s great working with Xinyun to investigate RAG robustness.
  • 2025.10:  WebCloak, EnchTable have been accepted to S&P 2026. Congratulations to Jialin and all collaborators.
  • 2025.09:  AgentAuditor has been accepted to NeurIPS 2025. Congratulations to Hanjun and Shenyu.
  • 2025.06:  AudioTrust has been accepted to ICLR’26! We hope this can serve as a solid foundation for academia and industry for safe audio-based LLM system development. [Github] (Media Coverage: [量子位])
  • 2025.06:  Neural Invisibility Cloak has been accepted to USENIX Security’25. Congratulations to Wenjun.
  • 2025.04:  Led/Contributed to 3 (Trustworthy) LLM Agent survey papers are now released: (1) TrustAgent: A survey on trustworthy LLM agents: Threats and countermeasures [Paper (accepted to KDD’25)]; (2) Advances and challenges in foundation agents: From brain-inspired intelligence to evolutionary, collaborative, and safe systems [Paper Github] [HuggingFace] (Media Coverage, e.g., [SANER, 机器之心]); (3) A Comprehensive Survey in LLM (-Agent) Full Stack Safety: Data, Training, and Deployment.
  • 2024.11:  LightAntenna has been accepted to NDSS 2025.
  • 2024.08:  Raconteur has been accepted to NDSS 2025 [website].
  • 2024.08:  Legilimens has been accepted to CCS 2024.
  • 2024.05:  SafeGen has been accepted to CCS 2024! More information is on [code][pretrained model].
  • 2024.05:  SafeEar has been accepted to CCS 2024! More information is on [website][code].
  • 2023.08:  VRifle has been accepted to NDSS 2024.
  • 2023.08:  I attended the USENIX Security 2023 Symposium and presented our work NormDetect in person.
  • 2023.07:  SMA has been accepted to ACM MM 2023.
  • 2022.09:  Tuner and UltraBD were accepted to IoT-J 2023 and ICPADS 2022.
  • 2022.07:  NormDetect has been accepted to USENIX Security 2023.
  • 2021.07:  PROLE Score has been accepted to USENIX Security 2022.
  • 2020.12:  EarArray has been accepted to NDSS 2021.

📝 Selected Research

📚 Professional Services

I actively contribute to the academic community through program organization and peer review for leading conferences and journals in security, AI, and systems.

Program Organization

  • KDD 2025: Tutorial Organizer

Conference

  • Area Chair: ICLR’27,26, NeurIPS’26
  • PC Member: USENIX Security’27, AsiaCCS’27, CCS’26, SaTML’27,26, AAAI’26
  • Reviewer: ICML’26, CVPR’26
  • External Reviewer: IEEE S&P’19, ‘20; CCS’21, ‘22, ‘23, ‘24; USENIX Security’19, ‘20, ‘21, ‘24; NDSS’20, ‘22, ‘23, ‘24

Journal

  • Reviewer: IEEE TIFS, TDSC, TMC, TNNLS, TOSEM, IoT-J, TOIT, TCCN; ACM TOPS; IJCV.

🎖 Honors and Awards

  • ACM SIGSAC China Doctoral Dissertation Award, 2025
  • CCS 2024 Student Grant, 2024
  • NDSS 2024 Student Grant, 2024
  • WANG G.S. PhD Research Excellence Award, 2023
  • Best Security Partner Award (OPPO Inc.), 2022
  • Edison Honors Class@ZJU, Outstanding Graduate Award, 2019
  • EE@ZJU Top-10 Scholars Award, 2018
  • National Scholarship, 2018

Openings

I am recruiting PhD students for Fall 2027 and Fall 2028, postdoctoral fellows, and (remote) interns/RAs.

We look for motivated researchers who want to work on valuable problems carefully. Joining the group means building a strong track record through focused projects, close mentoring, and papers held to a high standard.

PhD Students

Prospective students should have a strong foundation in computer science, artificial intelligence, cybersecurity, or a related field, solid programming skills, and a clear interest in our research. All PhD applicants need to meet PolyU’s admission requirements and complete the University’s formal application process.

Strong candidates with a top educational background and high GPA (>3.8/4.0), especially those with National Scholarship, are particularly encouraged to apply for HKPFS (~HK$28,700/month). Prior top-tier publications are a big plus.

A PhD is a long-term research partnership. The goal is to help students become independent researchers with a coherent agenda and a competitive track record. Research fit and working style matter as much as prior credentials. Collaboration experience with the group, for example through a visiting internship, or thesis project, will be given priority.

Postdoctoral Fellows

We are looking for applicants with strong motivation and want to deepen their research agenda and strengthen their track record. Applicants should hold, or be close to completing, a PhD in computer science, electrical engineering, or a related field. We typically look for at least one or two first-author papers at IEEE S&P, ACM CCS, USENIX Security, NDSS, NeurIPS, ICML, or ICLR, and a good match to our research directions.

Intern/RA

We welcome interns who are highly motivated to build a strong research record in AI security, safety, and privacy. Solid programming skills, critical thinking, careful reading, and curiosity about important research problems matter most.

Mentoring Philosophy

“While we’re very proud of our research ideas and their impact, the lab’s real goal is to help students become professors, entrepreneurs, and researchers.” — Prof. Christopher Ré. This is the mentoring bar we hold ourselves to.

How to Apply

Please email xinfeng.li(at)polyu.edu.hk or lxfmakeit(at)gmail.com. Use one of these subject lines: [PhD Application] Your Name+Institution, [Postdoc Application] Your Name+Institution, or [Intern/RA Application] Your Name+Institution. In the email, briefly answer:

  1. Which research question or topic would you like to work on?
  2. Which one or two of my papers are most relevant to your interest, and what would you extend or question?
  3. What is the strongest evidence of your research ability, and what was your contribution?

PhD applicants should submit a CV and academic transcript. Postdoctoral and intern/RA applicants should submit a CV. A 1–2 page research statement and contact information for two referees are strongly encouraged for all applicants, as they can help us better understand your background and research interests. Where relevant, applicants are also welcome to include links to publications, code repositories, or project pages that showcase their research experience. Due to the volume of inquiries, my apology if you don’t receive my reply.