Hongyan Chang

Postdoctoral researcher at FAIR, Meta. Prior in MBZUAI. Obtained PhD from NUS, Singapore.

[BrendanEich @BrendanEich]

Paper is at https://t.co/nXkCsbHYdW. Thanks, @AliShahinShams1 and co-authors!

[Ali Shahin Shamsabadi @AliShahinShams1]

🎉 Our paper "Distributed and Private Textual Data Synthesis from Embeddings" has been accepted to Privacy Enhancing Technologies Symposium, @PET_Symposium 2027!

Synthetic text is a promising way to learn from user data without exposing it. But ...

[Hongyan Chang @Hongyan_Chang]

3) The takeaway: evaluating an LLM in isolation can dramatically underestimate the security risk of the agentic system built around it.

[Hongyan Chang @Hongyan_Chang]

AI agents are increasingly trusted with emails, files, tools, and even other agents. But can a single malicious piece of retrieved content actually compromise an agent end-to-end?

In our #USENIXSecurity work, we show that this threat is very real.
📄 https://t.co/7TQLI4aNNG

[Hongyan Chang @Hongyan_Chang]

2) And the agent evaluation is striking: in our multi-agent setting, one poisoned email caused GPT-4o to exfiltrate private SSH keys in up to 80% of runs, roughly 40× the single-agent attack success rate.

[Hongyan Chang @Hongyan_Chang]

1) We study indirect prompt injection under realistic retrieval and agent workflows—without assuming the malicious document is magically placed into the model’s context.

[Hongyan Chang @Hongyan_Chang]

We study indirect prompt injection under realistic retrieval and agent workflows—without assuming the malicious document is magically placed into the model’s context.

[AI at Meta @AIatMeta]

Introducing Muse Image and Muse Video, the first media generation models developed by Meta Superintelligence Labs.

Muse Image is our most advanced image generation model yet. It follows instructions faithfully, edits with precision, composes from multiple references, and draws on Instagram for social context. It also brings agentic tool use capabilities to image generation and integrates with Muse Spark.

You can try Muse Image in the Meta AI app and web, as well as in Instagram Stories and WhatsApp – starting in limited countries with more locations on the way.

Today we’re also previewing Muse Video, which is built upon the same pretraining base as Muse Image to deliver exceptional visual fidelity with native audio support.

Learn more about both models: https://t.co/QtKDPDZP5v

[Pierre Fernandez @pierrefdz]

Muse Image is live!
And it comes with a watermark detection tool available at https://t.co/WtdJMk3gHf, which the watermarking team at FAIR has worked on!

Would love your feedback on what you make with it and on the detection tool!

[Hongyan Chang @Hongyan_Chang]

@niloofar_mire So happy for you and thanks for sharing!!

[Tom Sander (Ph.D.) @RednasTom]

1/9 Excited to share TextSeal, our new state-of-the-art watermark for large language models at FAIR / Meta Superintelligence Labs (@AIatMeta) 🔐

Paper: https://t.co/XMJ1nYrEQF
Code: https://t.co/PAZygG69me

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[Hongyan Chang @Hongyan_Chang]

I’m excited to share that I’ve joined Meta FAIR Paris as a postdoctoral researcher 🎉

We’ve just open-sourced Meta Seal, a production-ready invisible watermarking suite for image, video, audio, and text, released under the MIT license. Please check out👇

[Pierre Fernandez @pierrefdz]

We're thrilled to share the open source release of Meta Seal, a comprehensive, SOTA, and MIT-licensed suite of AI watermarking research, models, & training code.

Learn more in the 🧵 below and explore the artifacts here:
https://t.co/yNqmMJWQ9z

[Hongyan Chang @Hongyan_Chang]

@niloofar_mire @AIatMeta @humansand Congratulations!!!

[Ali Shahin Shamsabadi @AliShahinShams1]

Today at #EMNLP2025 (Suzhou, China): @Hongyan_Chang presents CAMIA—Context-Aware Membership Inference Attacks against pre-trained LLMs. Room A104–105. Learn how to assess memorization & info leakage in LLMs.

[Hongyan Chang @Hongyan_Chang]

Excited to present two papers at #EMNLP2025 tomorrow 🎉

🧩 Poster: “Watermark Smoothing Attacks against LMs” — 12:30–13:30, Hall C3
🧠 Oral: “Context-Aware Membership Inference Attacks” — 17:00, Room A104-105

Come chat about LLM safety & privacy!

[Niloofar @niloofar_mire]

I'm recruiting students for fall 2026 thru @LTIatCMU & @CMU_EPP, in:

1. Privacy & security of LLMs, coding, long horizon & embodied agents (robotics)
2. Tiny local llms
3. AI for scientific reasoning, esp. chemistry
4. Latent reasoning
5. anything YOU are passionate about!

[Teodora Baluta @teobaluta]

I am recruiting PhD students!🐝 If you are interested in ML security and privacy, intersected with formal methods and rigorous frameworks, drop me an email!
Retweets are greatly appreciated! 🙏

https://t.co/PyVfRGtCrD

[Hongyan Chang @Hongyan_Chang]

@rzshokri @acm_ccs Big Congratulations!

[Hongyan Chang @Hongyan_Chang]

@minoskt @AliShahinShams1 @brave Thank you, @minoskt !!

[Hongyan Chang @Hongyan_Chang]

Excited to share that my internship project has been accepted at EMNLP! Grateful for the amazing experience working with @AliShahinShams1 and @minoskt in @Brave.

[Ali Shahin Shamsabadi @AliShahinShams1]

LLMs are everywhere, but can they pose privacy risks?

We introduce a Context-Aware Membership Inference Attack, assessing such privacy risks.

Paper: https://t.co/2REmFeAmKN
@brave blog: https://t.co/3UOzE153Jp
Authors: @Hongyan_Chang @AliShahinShams1 @minoskt Hamed @rzshokri