Hongyan Chang

hongyan-2026.jpg

I am Hongyan Chang (常红燕), a postdoctoral researcher at FAIR, Meta, in the Content Seal team. My research focuses on AI security, particularly agentic security, data and model distillation, and model provenance. I study how AI systems can be attacked, how training data and model capabilities are reused, and how we can detect and mitigate these risks.

Before joining Meta, I was a postdoctoral researcher at MBZUAI working with Prof. Ting Yu. I obtained my Ph.D. in Computer Science from the National University of Singapore, advised by Prof. Reza Shokri. I received my bachelor’s degree in 2018 from the University of Electronic Science and Technology of China (UESTC).

I was a research intern at Brave (2024), mentored by Ali Shahin Shamsabadi and Kleomenis Katevas, and at Intel’s Security and Privacy Lab (2022), mentored by Brandon Edwards and Anindya S. Paul.

Selected Publications

My work is organized around the following research questions.

Security of LLM systems & agents

Can untrusted information redirect an AI system?

We study indirect prompt injection end to end: from getting malicious content retrieved to compromising retrieval-augmented generation and agent workflows.

  • Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems
    Hongyan Chang, Ergute Bao, Xinjian Luo, Ting Yu
    USENIX Security 2026
    [Paper]

AI provenance & model accountability

Can we trace AI-generated text and detect how it is reused?

We develop watermarks for text provenance and model distillation detection, and evaluate their robustness to removal and changes to the model.

  • Watermark Basins: Black-Box Detection of Distilled LLMs
    Hongyan Chang, Hady Elsahar, Tom Sander, Pierre Fernandez, Saeed Mahloujifar, Sylvestre-Alvise Rebuffi, Tomáš Souček, Tuan Tran, Valeriu Lacatusu, Surya Parimi, Rashel Moritz, Vanessa Stark, Alexandre Mourachko
    Preprint 2026
    [Paper]

  • TextSeal: A Localized LLM Watermark for Provenance & Distillation Protection
    Tom Sander, Hongyan Chang, Tomáš Souček, Tuan Tran, Valeriu Lacatusu, Sylvestre-Alvise Rebuffi, Alexandre Mourachko, Surya Parimi, Christophe Ropers, Rashel Moritz, Vanessa Stark, Hady Elsahar, Pierre Fernandez
    NeurIPS 2026 (accepted / to appear)
    [Paper] [Code]

  • Watermark Smoothing Attacks against Language Models
    Hongyan Chang, Hamed Hassani, Reza Shokri
    EMNLP Findings 2025
    [Paper] [Code]

Privacy auditing & data protection

What can models reveal about the data they learn from or process?

We audit training-data membership, study image-input leakage in distributed multimodal inference, and design private text synthesis without a trusted curator.

  • Distributed and Private Textual Data Synthesis from Embeddings
    Ergute Bao, Hongyan Chang, Ali Shahin Shamsabadi, Ting Yu, Xiaokui Xiao
    PETS 2027 (accepted / to appear)
    [Paper]

  • Image Prompt Reconstruction Attacks on Distributed MLLM Inference Frameworks
    Xinjian Luo, Hongyan Chang, Jianxin Wei, Yuncheng Wu, Xiaofeng Gao, Meikang Qiu, Ting Yu, Xue Liu
    Preprint 2026
    [Paper]

  • Context-Aware Membership Inference Attacks against Pre-trained Large Language Models
    Hongyan Chang, Ali Shahin Shamsabadi, Kleomenis Katevas, Hamed Haddadi, Reza Shokri
    EMNLP 2025 · Oral
    Outstanding Paper Award nomination
    [Paper] [Code] [Blogpost]

  • Efficient Privacy Auditing in Federated Learning
    Hongyan Chang, Brandon Edwards, Anindya S. Paul, Reza Shokri
    USENIX Security 2024
    [Paper] [Code]

Fairness & robust collaborative learning

When does learning amplify bias, and how can collaboration be more robust?

We examine the effects of training randomness, federated collaboration, adversarial manipulation, and fairness constraints on equity, robustness, and privacy.

  • On the Impact of Machine Learning Randomness on Group Fairness
    Prakhar Ganesh, Hongyan Chang, Martin Strobel, Reza Shokri
    FAccT 2023
    Best Paper Award
    [Paper] [Code]

  • Bias Propagation in Federated Learning
    Hongyan Chang, Reza Shokri
    ICLR 2023
    [Paper] [Code]
    Talk: FL@FM-Singapore, 2024.
    Presentation: ICLR, 2024 (poster).

  • Cronus: Robust and Heterogeneous Collaborative Learning with Black-Box Knowledge Transfer
    Hongyan Chang*, Virat Shejwalkar*, Reza Shokri, Amir Houmansadr
    NFFL @ NeurIPS 2021 · Workshop
    (* Equal contribution)
    [Paper]

  • On the Privacy Risks of Algorithmic Fairness
    Hongyan Chang, Reza Shokri
    IEEE EuroS&P 2021
    [Paper] [Slides]
    Invited talks: Private AI Collaborative Research Institute held by Intel, 2022; CyberSec&AI, 2021; PrivacyCon, 2021 by the US Federal Trade Commission (FTC).

  • On Adversarial Bias and the Robustness of Fair Machine Learning
    Hongyan Chang, Ta Duy Nguyen, Sasi Kumar Murakonda, Ehsan Kazemi, Reza Shokri
    Preprint 2020
    [Paper] [Code]

Academic Service

Program Committee Member

  • IEEE SaTML, 2027
  • VLDB, 2026
  • ACM CCS, 2026
  • IEEE Symposium on Security and Privacy, 2024 (Certificate)
  • NDSS, 2025 (Artifact Evaluation), 2026 (Artifact Evaluation)
  • USENIX Security, 2025 (Artifact Evaluation), 2026 (Artifact Evaluation)

Reviewer

  • ICLR, 2025–2026
  • NeurIPS, 2025
  • ACM FAccT, 2022–2023

Selected Awards

  • Distinguished Reviewer Awards in USENIX 2025 (Artifact Evaluation)
  • Notable Reviewer in ICLR 2025
  • Best paper award at FAccT in 2023 (Certificate)
  • Research Achievement Award in 2023 by NUS School of Computing
  • Funded participant of the IPAM Graduate Summer School on Algorithmic Fairness in 2022
    • Organized by Noa Dagan, Cynthia Dwork, and Guy N. Rothblum
  • National University of Singapore Research Scholarship (2018–2022)
  • First Prize of the 10th National Information Security Competition (2017) on fake news detection for WeiBo
  • National Scholarship (2015 & 2016, top 1%)

Open-source Projects

  • TextSeal @ Meta: Text watermarking for provenance and distillation detection. GitHub.
    My role: contributing to the research, including the watermark-based distillation detection study in TextSeal.

  • Privacy Meter @ NUS: A system for evaluating the privacy risks of machine learning models. GitHub
    My role: leading the development team and spearheading the initial 1.0.1 release.

  • OpenFL @ Intel: Auditing privacy risks in real-time. GitHub. Blogpost.
    My role: leading the integration of privacy meter into OpenFL.

Teaching Experience

  • Teaching Assistant for Trustworthy Machine Learning (Summer 2021, 2022, 2023)
  • Teaching Assistant for Computer Security (Spring and Summer 2020)
  • Teaching Assistant for Introduction to Artificial Intelligence (Spring 2019)
Visitor counter