Publications

2026

USENIX Sec
From Assistance to Autonomy: An Empirical Study of AI Use in a Live Capture-the-Flag (CTF) Competition
Tingxuan Tang, Nicolas Janis, Kalyn Asher Montague, Kevin Eykholt, Dhilung Kirat, Youngja Park, Jiyong Jang, Adwait Nadkarni, Yue Xiao
USENIX Security Symposium, 2026
PDF Artifact Website
CCS
AVP-Inspect: Coordinated Cyber-Physical Testing for Privacy Analysis of COTS Apple Vision Pro Applications
Yichang Xiong, Vamsi Shankar Simhadri, Yue Xiao, Xiaokuan Zhang
ACM Conference on Computer and Communications Security (CCS), 2026
PDF Code
ASE
TheBotCompany: Self-Organizing Multi-agent Systems for Continuous Software Development
Wenhan Lyu, Yue Xiao, Yixuan Zhang, Yifan Sun
IEEE/ACM International Conference on Automated Software Engineering (ASE), 2026
PDF Code Artifact
KDD
OmniVul: A Holistic, Multi-Turn Conversational Benchmark for LLM-Based Vulnerability Assessment
Vishnu Teja Kandalam, Viet Duong, Xiaochang Li, Minghui Yin, Vamsi Shankar Simhadri, Hung Pham, Huajie Shao, Xiaokuan Zhang, Yue Xiao
ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD), 2026
Code
ICML
One Bug, Hundreds Behind: LLMs for Large-Scale Bug Discovery
Qiushi Wu, Yue Xiao, Dhilung Kirat, Kevin Eykholt, Jiyong Jang, Douglas Schales
International Conference on Machine Learning (ICML), 2026
PDF Code

NDSS
JBomAudit: Assessing the Landscape, Compliance, and Security Implications of Java SBOMs
Yue Xiao, Dhilung Kirat, Douglas Lee Schales, Jiyong Jang, Luyi Xing, Xiaojing Liao
ISOC Network and Distributed System Security Symposium (NDSS), 2025
PDF Code
Distinguished Artifact Award
NDSS
Automated Expansion of Privacy Data Taxonomy for Compliant Data Breach Notification
Yue Qin*, Yue Xiao*, Xiaojing Liao (* co-first authors)
ISOC Network and Distributed System Security Symposium (NDSS), 2025
PDF Project

CCS
Understanding Legal Professionals’ Practices and Expectations in Data Breach Incident Reporting
Ece Gumusel*, Yue Xiao*, Yue Qin, Jiaxin Qin, Xiaojing Liao (* co-first authors)
ACM Conference on Computer and Communications Security (CCS), 2024
PDF
CCS
Measuring Compliance Implications of Third-party Libraries’ Privacy Label Disclosure Guidelines
Yue Xiao, Chaoqi Zhang, Yue Qin, Fares Fahad S Alharbi, Luyi Xing, Xiaojing Liao
ACM Conference on Computer and Communications Security (CCS), 2024
PDF Project
USENIX Sec
iHunter: Hunting Privacy Violations at Scale in the Software Supply Chain on iOS
Dexin Liu*, Yue Xiao*, Chaoqi Zhang, Kaitao Xie, Xiaolong Bai, Shikun Zhang, Luyi Xing (* co-first authors)
USENIX Security Symposium, 2024
PDF Project
SCORED
Enhancing Transparency and Accountability of Third-party Libraries with PBOM: A Privacy Bill of Materials
Yue Xiao, Adwait Nadkarni, Xiaojing Liao
ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED), 2024
PDF

USENIX Sec
Lalaine: Measuring and Characterizing Non-Compliance of Apple Privacy Labels at Scale
Yue Xiao, Zhengyi Li, Yue Qin, Xiaolong Bai, Jiale Guan, Xiaojing Liao, Luyi Xing
USENIX Security Symposium, 2023
PDF Code Artifact Appendix Project
Showcased at the 2023 NSA CAE-R Research Symposium
CCS
Vulnerability Intelligence Alignment via Masked Graph Attention Networks
Yue Qin, Yue Xiao, Xiaojing Liao
ACM Conference on Computer and Communications Security (CCS), 2023
PDF Code

USENIX Sec
OS-Aware Vulnerability Prioritization via Differential Severity Analysis
Qiushi Wu*, Yue Xiao*, Xiaojing Liao, Kangjie Lu (* co-first authors)
USENIX Security Symposium, 2022
PDF Project

USENIX Sec
Understanding Malicious Cross-library Data Harvesting on Android
Jice Wang*, Yue Xiao*, Xueqiang Wang, Yuhong Nan, Luyi Xing, Xiaojing Liao, JinWei Dong, Nicolas Serrano, XiaoFeng Wang, Yuqing Zhang, Haoran Lu (* co-first authors)
USENIX Security Symposium, 2021
PDF Dataset

CCS
Demystifying Resource Management Risks in Emerging Mobile App-in-App Ecosystems
Haoran Lu, Luyi Xing, Yue Xiao, Yifan Zhang, Xiaojing Liao, XiaoFeng Wang, Xueqiang Wang
ACM Conference on Computer and Communications Security (CCS), 2020
PDF