avatar

Zihan Wang

Postdoctoral Research Fellow
School of EECS,
The University of Queensland
zihan.wang[at]uq[dot]edu[dot]au


About Me

I am a Research Fellow at the University of Queensland, previously a visiting scientist at CSIRO. My research focuses on AI usage control: technically enforcing how trained models and their training data can be reused, repurposed, or queried after release.

During my PhD at UQ, I was fortunate to be advised by A/Prof. Guangdong Bai, Dr. Jason Xue, and Dr. Naipeng Dong. I was funded by the Australian Government RTP Scholarship and the CSIRO Top-up Scholarship. I am a recipient of the 2024 Google PhD Fellowship in Security, Privacy, and Abuse Prevention.

I serve on the program committees of top security conferences such as USENIX Security’27 and NDSS’27, and machine learning venues such as NeurIPS, ICLR, CVPR, and AAAI. I am also the HDR representative for the CSS discipline at UQ.

News

  • [Sep. 2026] 🏆 Catch-Only-One was accepted to NeurIPS’26 as an Oral (top 0.4%)!
  • [Sep. 2026] 🏆 Our NTE work won the Best Paper Award (Runner-Up) at ECCV’26 LifeGenIP!
  • [Jul. 2026] I will serve as a PC member for NDSS’27 and USENIX Security’27.
  • [Apr. 2026] Our paper on data privacy tracing has been accepted to IEEE TDSC’26.
  • [Mar. 2026] Our paper on usage control has been accepted to IEEE EuroS&P’26.
  • [Feb. 2026] I will serve as a reviewer for ECCV’26 and NeurIPS’26.
  • [Nov. 2025] I will serve as a PC member for USENIX Security AE’26.
  • [Nov. 2025] Our paper on GIA defense has been accepted to AsiaCCS’26.
  • [Sep. 2025] I will serve as a reviewer for ICLR’26 and CVPR’26.
  • [Aug. 2025] Our paper on NNV has been accepted to OOPSLA’25.
  • [Mar. 2025] I will serve as a reviewer for IEEE TDSC, IEEE TIFS, and TSC.
  • [Jan. 2025] Our paper on AI model modulation has been accepted to WWW’25.
  • [Oct. 2024] 🏆 Awarded the Google PhD Fellowship!
  • [Oct. 2024] I will serve as a PC member for PAKDD’25.
  • [Aug. 2024] Our paper on GIA in language models has been accepted to ACM CCS’24.
  • [Mar. 2024] Our paper on AI model usage control has been accepted to IEEE S&P’24.
  • [Feb. 2024] Our paper on purpose limitation has been accepted to USENIX Security’24.
  • [Dec. 2023] Our paper on deep data hiding has been accepted to IEEE TCSS.
  • [Oct. 2023] Our paper on knowledge distillation has been accepted to WACV’24.
  • [Aug. 2023] Our paper on formalizing LMs perturbation has been accepted to ICFEM’23.
  • [Dec. 2022] Graduated with a B.CS (Adv.) from the University of Adelaide (2020–22).
  • [Nov. 2022] 🏆 Presented at my first conference, NeurIPS, in New Orleans!
  • [Sep. 2022] Our paper on multi-modal model MIA has been accepted to NeurIPS’22.

Selected Projects

Data Purpose Limitation (USENIX Security’24, NeurIPS’26) Model-specific data authorization: recoding preserves authorized utility while degrading unauthorized models
Model Usage Control (S&P’24, WWW’25, Euro S&P’26)
Selective weight extraction from a trained network Utility disparity between authorized and unauthorized models Proximity and disparity bounds among the original, degraded, and restored models
Neural Network Verification (OOPSLA’25) Convex hull approximation for activation functions in neural network verification

Selected Publications

  1. NeurIPS'26
    Catch-Only-One: Non-Transferable Examples for Model-Specific Authorization
    Zihan Wang, Zhiyong (Ethan) Ma, Zhongkui Ma, Shuofeng Liu, Akide Liu, Derui Wang, Minhui Xue, Guangdong Bai.
    Neural Information Processing Systems (NeurIPS), Sep. 2026.
    Oral (top 0.4%)
    PDF
    BibTeX 
    @inproceedings{wang2025nontransfer,
  title={{Catch-Only-One}: Non-Transferable Examples for Model-Specific Authorization},
  author={Wang, Zihan and Ma, Zhiyong and Ma, Zhongkui and Liu, Shuofeng and Liu, Akide and Wang, Derui and Xue, Minhui and Bai, Guangdong},
  booktitle={Advances in Neural Information Processing Systems (NeurIPS)},
  year={2026}
}
  2. S&P'24
    CoreLocker: Neuron-level Usage Control
    Zihan Wang, Zhongkui Ma, Xinguo Feng, Ruoxi Sun, Hu Wang, Minhui Xue, Guangdong Bai.
    IEEE Symposium on Security and Privacy (S&P), Mar. 2024.
    PDF Website
    BibTeX 
    @inproceedings{wang2024corelocker,
  title={{CoreLocker}: Neuron-level Usage Control},
  author={Wang, Zihan and Ma, Zhongkui and Feng, Xinguo and Sun, Ruoxi and Wang, Hu and Xue, Minhui and Bai, Guangdong},
  booktitle={IEEE Symposium on Security and Privacy (S\&P)},
  pages={2497--2514},
  doi={10.1109/SP54263.2024.00233},
  year={2024}
}
  3. EuroS&P'26
    Re-Key-Free, Risky-Free: Adaptable Model Usage Control
    Zihan Wang, Zhongkui Ma, Xinguo Feng, Chuan Yan, Dongge Liu, Ruoxi Sun, Derui Wang, Minhui Xue, Guangdong Bai.
    IEEE European Symposium on Security and Privacy (Euro S&P), Jul. 2026.
    PDF
    BibTeX 
    @inproceedings{wang2025rekey,
  title={Re-Key-Free, Risky-Free: Adaptable Model Usage Control},
  author={Wang, Zihan and Ma, Zhongkui and Feng, Xinguo and Yan, Chuan and Liu, Dongge and Sun, Ruoxi and Wang, Derui and Xue, Minhui and Bai, Guangdong},
  booktitle={IEEE European Symposium on Security and Privacy (Euro S\&P)},
  pages={696--711},
  doi={10.1109/EuroSP68448.2026.00051},
  year={2026}
}
  4. OOPSLA'25
    Convex Hull Approximation for Activation Functions
    Zhongkui Ma†, Zihan Wang†, Guangdong Bai.
    The ACM SIGPLAN Conference on Object-Oriented Programming, Systems, Languages, and Applications (OOPSLA), Oct. 2025.
    PDF
    BibTeX 
    @article{ma2025wraact,
  title={Convex Hull Approximation for Activation Functions},
  author={Ma, Zhongkui and Wang, Zihan and Bai, Guangdong},
  journal={Proceedings of the ACM on Programming Languages (OOPSLA)},
  volume={9},
  number={OOPSLA2},
  pages={1007--1033},
  doi={10.1145/3763086},
  year={2025}
}
  5. USENIX'24
    Being Transparent is Merely the Beginning: Enforcing Purpose Limitation with Polynomial Approximation
    Shuofeng Liu, Zihan Wang, Minhui Xue, Long Wang, Yuanchao Zhang, Guangdong Bai.
    USENIX Security, Feb. 2024.
    PDF
    BibTeX 
    @inproceedings{liu2024purpose,
  title={Being Transparent is Merely the Beginning: Enforcing Purpose Limitation with Polynomial Approximation},
  author={Liu, Shuofeng and Wang, Zihan and Xue, Minhui and Wang, Long and Zhang, Yuanchao and Bai, Guangdong},
  booktitle={33rd USENIX Security Symposium (USENIX Security 24)},
  pages={6507--6524},
  publisher={USENIX Association},
  year={2024}
}
  6. WWW'25
    AI Model Modulation with Logits Redistribution
    Zihan Wang, Zhongkui Ma, Xinguo Feng, Zhiyang Mei, Zhiyong Ma, Derui Wang, Minhui Xue, Guangdong Bai.
    The Web Conference (WWW), Apr. 2025.
    PDF
    BibTeX 
    @inproceedings{wang2025aim,
  title={{AI} Model Modulation with Logits Redistribution},
  author={Wang, Zihan and Ma, Zhongkui and Feng, Xinguo and Mei, Zhiyang and Ma, Zhiyong and Wang, Derui and Xue, Minhui and Bai, Guangdong},
  booktitle={Proceedings of the ACM on Web Conference 2025 (WWW)},
  pages={4699--4709},
  doi={10.1145/3696410.3714737},
  year={2025}
}
  7. NeurIPS'22
    M4I: Multi-modal Models Membership Inference
    Pingyi Hu†, Zihan Wang†, Ruoxi Sun, Hu Wang, Minhui Xue.
    Neural Information Processing Systems (NeurIPS), Sep. 2022.
    PDF
    BibTeX 
    @inproceedings{hu2022m,
  title={{M$^4$I}: Multi-modal Models Membership Inference},
  author={Hu, Pingyi and Wang, Zihan and Sun, Ruoxi and Wang, Hu and Xue, Minhui},
  booktitle={Advances in Neural Information Processing Systems (NeurIPS)},
  volume={35},
  pages={1867--1882},
  year={2022}
}
  8. CCS'24
    Uncovering Gradient Inversion Risks in Practical Language Model Training
    Xinguo Feng, Zhongkui Ma, Zihan Wang, Eu Joe Chegne, Mengyao Ma, Alsharif Abuadbba, Guangdong Bai.
    ACM Conference on Computer and Communications Security (CCS), Aug. 2024.
    PDF
    BibTeX 
    @inproceedings{feng2024grab,
  title={Uncovering Gradient Inversion Risks in Practical Language Model Training},
  author={Feng, Xinguo and Ma, Zhongkui and Wang, Zihan and Chegne, Eu Joe and Ma, Mengyao and Abuadbba, Alsharif and Bai, Guangdong},
  booktitle={Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS)},
  pages={3525--3539},
  doi={10.1145/3658644.3690292},
  year={2024}
}
  9. TDSC'26
    Leveraging Robustness-Aware Channel Activation for Privacy Protection and Tracing Forensics
    Haodi Wang, Zihan Wang, Kai Dong, Jiakai Wang, Xianglong Liu, Guangdong Bai.
    IEEE Transactions on Dependable and Secure Computing (TDSC), Apr. 2026.
    BibTeX 
    @article{wang2026atp,
  title={Leveraging Robustness-Aware Channel Activation for Privacy Protection and Tracing Forensics},
  author={Wang, Haodi and Wang, Zihan and Dong, Kai and Wang, Jiakai and Liu, Xianglong and Bai, Guangdong},
  journal={IEEE Transactions on Dependable and Secure Computing (TDSC)},
  volume={23},
  number={4},
  pages={8745--8759},
  doi={10.1109/TDSC.2026.3688154},
  year={2026}
}
  10. AsiaCCS'26
    Mitigating Gradient Inversion Risks in Language Models via Token Obfuscation
    Xinguo Feng, Zhongkui Ma, Zihan Wang, Alsharif Abuadbba, Guangdong Bai.
    ACM Asia Conference on Computer and Communications Security (AsiaCCS), Feb. 2026.
    BibTeX 
    @inproceedings{feng2026ghost,
  title={Mitigating Gradient Inversion Risks in Language Models via Token Obfuscation},
  author={Feng, Xinguo and Ma, Zhongkui and Wang, Zihan and Abuadbba, Alsharif and Bai, Guangdong},
  booktitle={Proceedings of the ACM Asia Conference on Computer and Communications Security (AsiaCCS)},
  pages={1832--1848},
  doi={10.1145/3779208.3785389},
  year={2026}
}
  11. TCSS
    Data Hiding With Deep Learning: A Survey Unifying Digital Watermarking and Steganography
    Zihan Wang, Olivia Byrnes, Hu Wang, Ruoxi Sun, Congbo Ma, Huaming Chen, Qi Wu, Minhui Xue.
    IEEE Transactions on Computational Social Systems (TCSS), Dec. 2023.
    PDF
    BibTeX 
    @article{wang2023data,
  title={Data Hiding With Deep Learning: A Survey Unifying Digital Watermarking and Steganography},
  author={Wang, Zihan and Byrnes, Olivia and Wang, Hu and Sun, Ruoxi and Ma, Congbo and Chen, Huaming and Wu, Qi and Xue, Minhui},
  journal={IEEE Transactions on Computational Social Systems (TCSS)},
  volume={10},
  number={6},
  pages={2985--2999},
  doi={10.1109/TCSS.2023.3268950},
  year={2023}
}