How to prove your model belongs to you: a blind-watermark based framework to protect intellectual property of DNN. - Zheng Li 023; Chengyu Hu; Yang Zhang 016; Shanqing Guo (ACSAC, 2019)

DeepKeyStego: Protecting Communication by Key-Dependent Steganography with Deep Networks. - Zheng Li 023; Ge Han; Shanqing Guo; Chengyu Hu (HPCC/SmartCity/DSS, 2019)

Label-Leaks: Membership Inference Attack with Label. - Zheng Li 023; Yang Zhang 016 (CoRR, 2020)

Membership Leakage in Label-Only Exposures. - Zheng Li 023; Yang Zhang 016 (CCS, 2021)

Auditing Membership Leakages of Multi-Exit Networks. - Zheng Li 023; Yiyong Liu; Xinlei He 001; Ning Yu 006; Michael Backes 001; Yang Zhang 016 (CCS, 2022)

FuzzGAN: A Generation-Based Fuzzing Framework for Testing Deep Neural Networks. - Ge Han; Zheng Li 023; Peng Tang; Chengyu Hu; Shanqing Guo (HPCC/DSS/SmartCity/DependSys, 2022)

Membership-Doctor: Comprehensive Assessment of Membership Inference Against Machine Learning Models. - Xinlei He 001; Zheng Li 023; Weilin Xu; Cory Cornelius; Yang Zhang 016 (CoRR, 2022)

Membership Inference Attacks Against Text-to-image Generation Models. - Yixin Wu 001; Ning Yu 006; Zheng Li 023; Michael Backes 001; Yang Zhang 016 (CoRR, 2022)

Backdoor Attacks in the Supply Chain of Masked Image Modeling. - Xinyue Shen 001; Xinlei He 001; Zheng Li 023; Yun Shen; Michael Backes 001; Yang Zhang 016 (CoRR, 2022)

DE-FAKE: Detection and Attribution of Fake Images Generated by Text-to-Image Diffusion Models. - Zeyang Sha; Zheng Li 023; Ning Yu 006; Yang Zhang 016 (CoRR, 2022)

NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Models. - Kai Mei; Zheng Li 023; Zhenting Wang; Yang Zhang 016; Shiqing Ma (ACL (1), 2023)

DE-FAKE: Detection and Attribution of Fake Images Generated by Text-to-Image Generation Models. - Zeyang Sha; Zheng Li 023; Ning Yu 006; Yang Zhang 016 (CCS, 2023)

Data Poisoning Attacks Against Multimodal Encoders. - Ziqing Yang 002; Xinlei He 001; Zheng Li 023; Michael Backes 001; Mathias Humbert; Pascal Berrang; Yang Zhang 016 (ICML, 2023)

Backdoor Attacks Against Dataset Distillation. - Yugeng Liu; Zheng Li 023; Michael Backes 001; Yun Shen; Yang Zhang 016 (NDSS, 2023)

UnGANable: Defending Against GAN-based Face Manipulation. - Zheng Li 023; Ning Yu 006; Ahmed Salem 001; Michael Backes 001; Mario Fritz; Yang Zhang 016 (USENIX Security Symposium, 2023)

Watermarking Diffusion Model. - Yugeng Liu; Zheng Li 023; Michael Backes 001; Yun Shen; Yang Zhang 016 (CoRR, 2023)

Generative Watermarking Against Unauthorized Subject-Driven Image Synthesis. - Yihan Ma 001; Zhengyu Zhao 001; Xinlei He 001; Zheng Li 023; Michael Backes 001; Yang Zhang 016 (CoRR, 2023)

SeqMIA: Sequential-Metric Based Membership Inference Attack. - Hao Li 092; Zheng Li 023; Siyuan Wu; Chengrui Hu; Yutong Ye 002; Min Zhang 043; Dengguo Feng; Yang Zhang 016 (CCS, 2024)

Membership Inference Attacks Against In-Context Learning. - Rui Wen 002; Zheng Li 023; Michael Backes 001; Yang Zhang 016 (CCS, 2024)

BadMerging: Backdoor Attacks Against Model Merging. - Jinghuai Zhang; Jianfeng Chi; Zheng Li 023; Kunlin Cai; Yang Zhang 016; Yuan Tian 001 (CCS, 2024)

Inside the Black Box: Detecting Data Leakage in Pre-Trained Language Encoders. - Yuan Xin; Zheng Li 023; Ning Yu 006; Dingfan Chen; Mario Fritz; Michael Backes 001; Yang Zhang 016 (ECAI, 2024)

ModSCAN: Measuring Stereotypical Bias in Large Vision-Language Models from Vision and Language Modalities. - Yukun Jiang 001; Zheng Li 023; Xinyue Shen 001; Yugeng Liu; Michael Backes 001; Yang Zhang 016 (EMNLP, 2024)

Detection and Attribution of Models Trained on Generated Data. - Ge Han; Ahmed Salem 001; Zheng Li 023; Shanqing Guo; Michael Backes 001; Yang Zhang 016 (ICASSP, 2024)

PRJack: Pruning-Resistant Model Hijacking Attack Against Deep Learning Models. - Ge Han; Zheng Li 023; Shanqing Guo (IJCNN, 2024)

SecurityNet: Assessing Machine Learning Vulnerabilities on Public Models. - Boyang Zhang; Zheng Li 023; Ziqing Yang 002; Xinlei He 001; Michael Backes 001; Mario Fritz; Yang Zhang 016 (USENIX Security Symposium, 2024)

Jailbreaking Text-to-Image Models with LLM-Based Agents. - Yingkai Dong; Zheng Li 023; Xiangtao Meng; Ning Yu 006; Shanqing Guo (CoRR, 2024)

Membership Inference Attack Against Masked Image Modeling. - Zheng Li 023; Xinlei He 001; Ning Yu 006; Yang Zhang 016 (CoRR, 2024)

ModSCAN: Measuring Stereotypical Bias in Large Vision-Language Models from Vision and Language Modalities. - Yukun Jiang 001; Zheng Li 023; Xinyue Shen 001; Yugeng Liu; Michael Backes 001; Yang Zhang 016 (CoRR, 2024)

Fuzz-Testing Meets LLM-Based Agents: An Automated and Efficient Framework for Jailbreaking Text-to-Image Generation Models. - Yingkai Dong; Xiangtao Meng; Ning Yu 006; Zheng Li 023; Shanqing Guo (SP, 2025)

A Comprehensive Study of Privacy Risks in Curriculum Learning. - Joann Qiongna Chen; Xinlei He 001; Zheng Li 023; Yang Zhang 016; Zhou Li 001 (Proc. Priv. Enhancing Technol., 2025)

Trajectory-user linking via supervised encoding. - Chengrui Hu; Zheng Li 023; Siyuan Wu; Bowen Shu; Min Zhang 043; Hao Li 092 (Secur. Saf., 2025)

Advancing membership inference attacks: The present and the future. - Zheng Li 023; Yang Zhang 016 (Secur. Saf., 2025)

AIPAG/DHAttack: DHAttack. - Hao Li 092; Zheng Li 023; Siyuan Wu; Yutong Ye 002; Min Zhang 043; Dengguo Feng; Yang Zhang 016 (Zenodo, 2025)

AIPAG/DHAttack: v2. - Hao Li 092; Zheng Li 023; Siyuan Wu; Yutong Ye 002; Min Zhang 043; Dengguo Feng; Yang Zhang 016 (Zenodo, 2025)

FaceSwapGuard: Safeguarding Facial Privacy from DeepFake Threats through Identity Obfuscation. - Li Wang 120; Zheng Li 023; Xuhong Zhang 002; Shouling Ji; Shanqing Guo (CoRR, 2025)

PDA: Generalizable Detection of AI-Generated Images via Post-hoc Distribution Alignment. - Li Wang 120; Wenyu Chen; Zheng Li 023; Shanqing Guo (CoRR, 2025)

Safe Driving Adversarial Trajectory Can Mislead: Toward More Stealthy Adversarial Attack Against Autonomous Driving Prediction Module. - Yingkai Dong; Li Wang 120; Zheng Li 023; Hao Li 092; Peng Tang; Chengyu Hu; Shanqing Guo (ACM Trans. Priv. Secur., 2025)

Watermarking LLM-Generated Datasets in Downstream Tasks. - Yugeng Liu; Tianshuo Cong; Michael Backes 001; Zheng Li 023; Yang Zhang 016 (CoRR, 2025)

Amplifying Machine Learning Attacks Through Strategic Compositions. - Yugeng Liu; Zheng Li 023; Hai Huang 014; Michael Backes 001; Yang Zhang 016 (CoRR, 2025)