Publication

2025

• Towards Sample-specific Backdoor Attack with Clean Labels via Attribute Trigger [ PDF ] [ Bibtex ]
  Yiming Li, Mingyan Zhu, Junfeng Guo, Tao Wei, Shu-Tao Xia, Zhan Qin
  TDSC 2025.

• SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models [ PDF ] [ Bibtex ]
  Zilan Wang, Junfeng Guo, Jiacheng Zhu, Yiming Li, Heng Huang, Muhao Chen, Zhengzhong Tu
  CVPR 2025.

• Audio Watermark: Dynamic and Harmless Watermark for Black-box Voice Dataset Copyright Protection [ PDF ] [ Bibtex ]
  Hanqing Guo, Junfeng Guo (Co-first Author), Heng Huang, Qiben Yan, Li Xiao
  USENIX Security 2025.

• Pattern Mark: A Watermark for Order-Agnostic Language Models [ PDF ] [ Bibtex ]
  Ruibo Chen, Yihan Wu, Yanshuo Chen, Chenxi Liu, Junfeng Guo, Heng Huang
  ICLR 2025.

• Mind Control through Causal Inference: Predicting Clean Images from Poisoned Data [ PDF ] [ Bibtex ]
  Mengxuan Hu, Zihan Guan, Yi Zeng, Junfeng Guo, Zhongliang Zhou, Jielu Zhang, Ruoxi Jia, Anil Kumar Vullikanti, Sheng Li
  ICLR 2025.

2024

• BBCaL: Black-box Backdoor Detection under the Causality Lens [ PDF ] [ Bibtex ]
  Mengxuan Hu, Zihan Guan, Junfeng Guo, Zhongliang Zhou, Jielu Zhang, Sheng Li
  TMLR 2024.

• ZeroMark: Towards Dataset Ownership Verification without the Verification Watermark Disclosure [ PDF ] [ Bibtex ]
  Junfeng Guo, George Li, Ruibo Chen, Yihan Wu, Chenxi Liu, Heng Huang
  NeurIPS 2024.

• Training A Secure Model against Data-Free Model Extraction [ PDF ] [ Bibtex ]
  Zhenyi Wang, Li Shen, Junfeng Guo, Tiehang Duan, Siyu Luan, Tongliang Liu and Mingchen Gao
  ECCV 2024.

• Few-Shot Class Incremental Learning with Attention-Aware Self-Adaptive Prompt [ PDF ] [ Bibtex ]
  Chenxi Liu, Zhenyi Wang, Tianyi Xiong, Ruibo Chen, Yihan Wu, Junfeng Guo, Heng Huang
  ECCV 2024.

• Your Vision-Language Model Itself Is a Strong Filter: Towards High-Quality Instruction Tuning with Data Selection [ PDF ] [ Bibtex ]
  Ruibo Chen, Yihan Wu, Lichang Chen, Guodong Liu, Qi He, Tianyi Xiong,Chenxi Liu, Junfeng Guo, Heng Huang
  ACL 2024 (findings).

• DiPMark: A Stealthy, Provable Robust Watermark for LLM [ PDF ] [ Bibtex ]
  Yihan Wu, Zhengmian Hu, Junfeng Guo, Hongyang Zhang, Heng Huang
  ICML 2024.

2023

• Domain Watermark: Effective and Harmless Dataset Copyright Verification is Closed at Hand [ PDF ] [ Bibtex ]
  Junfeng Guo, George Li, Lixu Wang, Heng Huang, Cong Liu, Bo Li
  NeurIPS 2023.

• PolicyCleanse: Detecting and Mitigating Trojan Attacks in Reinforcement Learning [ PDF ] [ Bibtex ]
  Junfeng Guo, Ang Li, Cong Liu
  ICCV 2023.

• MasterKey: Practical Backdoor Attack Against Speaker Verification Systems [ PDF ] [ Bibtex ]
  Hanqing Guo, Xun Chen, Junfeng Guo, Xiao Li, Qiben Yan
  MobiCom 2023.

• Sibling-Attack: Rethinking Transferable Adversarial Attacks against Face Recognition [ PDF ] [ Bibtex ]
  Zexin Li, Bangjie Yin, Taiping Yao, Junfeng Guo, Shouhong Ding, Simin Chen, Cong Liu
  CVPR 2023.

• SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistency [ PDF ] [ Bibtex ]
  Junfeng Guo, Yiming Li, Xun Chen, Hanqing Guo, Lichao Sun and Cong Liu
  ICLR 2023.

2022

• AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysis [ PDF ] [ Bibtex ]
  Junfeng Guo, Ang Li and Cong Liu
  ICLR 2022.

  
  @inproceedings{
  guo2022aeva,
  title={{AEVA}: Black-box Backdoor Detection Using Adversarial Extreme Value Analysis},
  author={Junfeng Guo and Ang Li and Cong Liu},
  booktitle={International Conference on Learning Representations},
  year={2022},
  url={https://openreview.net/forum?id=OM_lYiHXiCL}
  }              

• Neural Mean Discrepancy for Efficient Out-of-Distribution Detection [ PDF ] [ Bibtex ]
  Xin Dong, Junfeng Guo, Ang Li, Wei-Te Ting, Cong Liu, H.T. Kung1
  CVPR 2022.

  
  @misc{dong2021lightweight,
        title={Lightweight Detection of Out-of-Distribution and Adversarial Samples via Channel Mean Discrepancy}, 
        author={Xin Dong and Junfeng Guo and Wei-Te Ting and H. T. Kung},
        year={2021},
        eprint={2104.11408},
        archivePrefix={arXiv},
        primaryClass={cs.LG}
  }            

2021

• Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognition [ PDF ] [ Bibtex ]
  Bangjie Yin, Wenxuan Wang, Taiping Yao, Junfeng Guo, Zelun Kong, Shouhong Ding, Jilin Li and Cong Liu
  IJCAI 2021.

  
  @misc{yin2021advmakeup,
        title={Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognition}, 
        author={Bangjie Yin and Wenxuan Wang and Taiping Yao and Junfeng Guo and Zelun Kong and Shouhong Ding and Jilin Li and Cong Liu},
        year={2021},
        eprint={2105.03162},
        archivePrefix={arXiv},
        primaryClass={cs.CV}
  }               

• PredCoin: Defense against Query-based Hard-label Attack [ PDF ] [ Bibtex ]
  Junfeng Guo, Yaswanth Yadlapalli, Thiele Lothar, Ang Li, Cong Liu
  Arxiv.

  
  @misc{guo2021predcoin,
        title={PredCoin: Defense against Query-based Hard-label Attack}, 
        author={Junfeng Guo and Yaswanth Yadlapalli and Thiele Lothar and Ang Li and Cong Liu},
        year={2021},
        eprint={2102.02923},
        archivePrefix={arXiv},
        primaryClass={cs.CR}
  }      

2020

• PoisHygiene: Detecting and Mitigating Poisoning Attacks in Neural Networks [ PDF ] [ Bibtex ]
  Junfeng Guo, Cong Liu
  Arxiv.

  
  @misc{guo2020poishygiene,
        title={PoisHygiene: Detecting and Mitigating Poisoning Attacks in Neural Networks}, 
        author={Junfeng Guo and Ting Wang and Cong Liu},
        year={2020},
        eprint={2003.11110},
        archivePrefix={arXiv},
        primaryClass={cs.CR}
  }     

• LINTS: A Learning-driven Testbed for Intelligent Scheduling in Embedded Systems [ PDF ] [ Bibtex ]
  Zelun Kong, Yaswanth Yadlapalli, Soroush Bateni, Junfeng Guo, Cong Liu
  Arxiv.

  
  @misc{kong2020lintsrt,
        title={LINTS^RT: A Learning-driven Testbed for Intelligent Scheduling in Embedded Systems}, 
        author={Zelun Kong and Yaswanth Yadlapalli and Soroush Bateni and Junfeng Guo and Cong Liu},
        year={2020},
        eprint={2007.05136},
        archivePrefix={arXiv},
        primaryClass={cs.OS}
  }              

• Deep Partial Updating [ PDF ] [ Bibtex ]
  Zhongnan Qu, Junfeng Guo, Cong Liu
  Arxiv.

  
  @misc{qu2020deep,
        title={Deep Partial Updating}, 
        author={Zhongnan Qu and Cong Liu and Junfeng Guo and Lothar Thiele},
        year={2020},
        eprint={2007.03071},
        archivePrefix={arXiv},
        primaryClass={cs.LG}
  }                 

• Practical Poisoning Attack on Deep Neural Networks [ PDF ] [ Bibtex ]
  Junfeng Guo, Cong Liu
  ECCV 2020.

  
  @inproceedings{guo2020practical,
    title={Practical Poisoning Attacks on Neural Networks},
    author={Guo, Junfeng and Liu, Cong},
    booktitle={European Conference on Computer Vision},
    pages={142--158},
    year={2020},
    organization={Springer}
  }                      

• PhysGAN: Generating Physical-World-Resilient Adversarial Examples for Autonomous Driving [ PDF ] [ bibtex ]
  Zelun Kong, Junfeng Guo, Ang Li, Cong Liu
  CVPR 2020.

  
  @misc{kong2019physgan,
      title={PhysGAN: Generating Physical-World-Resilient Adversarial Examples for Autonomous Driving},
      author={Zelun Kong and Junfeng Guo and Ang Li and Cong Liu},
      year={2019},
      eprint={1907.04449},
      archivePrefix={arXiv},
      primaryClass={cs.CV}
  }
                                  

• DeepBillboard: Systematic Physical-World Testing of Autonomous Driving Systems [ PDF ] [ Bibtex ]
  Husheng Zhou, Wei Li, Zelun Kong, Junfeng Guo, Yuqun Zhang, Bei Yu, Lingming Zhang, Cong Liu
  ICSE 2020

  
  @inproceedings{10.1145/3377811.3380422,
  author = {Zhou, Husheng and Li, Wei and Kong, Zelun and Guo, Junfeng and Zhang, Yuqun and Yu, Bei and Zhang, Lingming and Liu, Cong},
  title = {DeepBillboard: Systematic Physical-World Testing of Autonomous Driving Systems},
  year = {2020},
  isbn = {9781450371216},
  publisher = {Association for Computing Machinery},
  address = {New York, NY, USA},
  url = {https://doi.org/10.1145/3377811.3380422},
  doi = {10.1145/3377811.3380422},
  abstract = {Deep Neural Networks (DNNs) have been widely applied in autonomous systems such as self-driving vehicles. Recently, DNN testing has been intensively studied to automatically generate adversarial examples, which inject small-magnitude perturbations into inputs to test DNNs under extreme situations. While existing testing techniques prove to be effective, particularly for autonomous driving, they mostly focus on generating digital adversarial perturbations, e.g., changing image pixels, which may never happen in the physical world. Thus, there is a critical missing piece in the literature on autonomous driving testing: understanding and exploiting both digital and physical adversarial perturbation generation for impacting steering decisions. In this paper, we propose a systematic physical-world testing approach, namely DeepBillboard, targeting at a quite common and practical driving scenario: drive-by billboards. DeepBillboard is capable of generating a robust and resilient printable adversarial billboard test, which works under dynamic changing driving conditions including viewing angle, distance, and lighting. The objective is to maximize the possibility, degree, and duration of the steering-angle errors of an autonomous vehicle driving by our generated adversarial billboard. We have extensively evaluated the efficacy and robustness of DeepBillboard by conducting both experiments with digital perturbations and physical-world case studies. The digital experimental results show that DeepBillboard is effective for various steering models and scenes. Furthermore, the physical case studies demonstrate that DeepBillboard is sufficiently robust and resilient for generating physical-world adversarial billboard tests for real-world driving under various weather conditions, being able to mislead the average steering angle error up to 26.44 degrees. To the best of our knowledge, this is the first study demonstrating the possibility of generating realistic and continuous physical-world tests for practical autonomous driving systems; moreover, DeepBillboard can be directly generalized to a variety of other physical entities/surfaces along the curbside, e.g., a graffiti painted on a wall.},
  booktitle = {Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering},
  pages = {347–358},
  numpages = {12},
  location = {Seoul, South Korea},
  series = {ICSE '20}
  }
                              

Professional Service

• Program Committee or Reviewer:
  • ACL HomeAssociation for Computational Linguistics (ACL)
  • Association for the Advancement of Artificial Intelligence (AAAI)
  • IEEE Conference on Computer Vision and Pattern Recognition (CVPR)
  • European Conference on Computer Vision (ECCV)
  • International Conference on Learning Representation (ICLR)
  • International Conference on Machine Learning (ICML)
  • Conference on Neural Information Processing Systems (NeurIPS)
  • IEEE/CVF Winter Conference on Applications of Computer Vision (WACV)
  • IEEE Transaction on Pattern Analysis and Machine Intelligence (TPAMI)
  • IEEE Transaction on Neural Network Learning System (TNNLS)