Demo Data from SIGIR 2026 / reviewers in the wild / expert
Kai Tu
dblp:87/1149
· DBLP profile ↗
11ranked-venue papers
3as first author
8since 2021 · last 2026
—ORCID · conflict
Domains — the database's venue-derived domains; a paper can count in several
Security and privacy · 6 · 1 first-author · 6 since 2021Artificial intelligence and machine learning · 2 · 2 since 2021Theory of computation · 2 · 1 first-authorSystems, architecture and hardware · 1 · 1 since 2021Graphics, computer vision, multimedia, augmented reality and games · 1 · 1 first-author
Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.
| Network and information security
7 papers |
Systems and software security · 54% Network security · 36% Cryptographic protocols and secure computation · 11% | |
| Computer networks
6 papers |
Cellular and mobile networks · 66% Network management and operations · 26% Wireless networking · 4% | |
| Software engineering, system software, and programming languages
1 paper |
Debugging and program repair · 100% |
Topics — the 14 heaviest of 18, each with the papers that count most for it
| Topic | Weight | Papers | Last | Evidence papers |
|---|---|---|---|---|
Cellular and mobile networks
5g |
1.8 | 2 | 2026 | Guardians of the Air: In-Device Detection of 5G Control-Plane Threats · SP 2026 Logic Gone Astray: A Security Analysis Framework for the Control Plane Protocols of 5G Basebands · USENIX Security Symposium 2024 |
Systems and software security
vulnerability discovery |
1.7 | 2 | 2025 | CoreCrisis: Threat-Guided and Context-Aware Iterative Learning and Fuzzing of 5G Core Networks · USENIX Security Symposium 2025 Stateful Analysis and Fuzzing of Commercial Baseband Firmware · SP 2025 |
Network security › intrusion detection and prevention
intrusion detection |
1.0 | 1 | 2026 | Guardians of the Air: In-Device Detection of 5G Control-Plane Threats · SP 2026 |
Debugging and program repair
automated program repair |
1.0 | 1 | 2026 | LogicEval: A Systematic Framework for Evaluating Automated Repair Techniques for Logical Vulnerabilities in Real-World Software · ACL (1) 2026 |
Cellular and mobile networks
5g core network |
0.9 | 1 | 2025 | CoreCrisis: Threat-Guided and Context-Aware Iterative Learning and Fuzzing of 5G Core Networks · USENIX Security Symposium 2025 |
Network management and operations
fuzzing |
0.9 | 1 | 2025 | CoreCrisis: Threat-Guided and Context-Aware Iterative Learning and Fuzzing of 5G Core Networks · USENIX Security Symposium 2025 |
Systems and software security › vulnerability discovery
fuzzing |
0.9 | 1 | 2025 | Stateful Analysis and Fuzzing of Commercial Baseband Firmware · SP 2025 |
Systems and software security › vulnerability discovery › fuzzing
protocol fuzzing |
0.9 | 1 | 2025 | CoreCrisis: Threat-Guided and Context-Aware Iterative Learning and Fuzzing of 5G Core Networks · USENIX Security Symposium 2025 |
Network security › protocol security
protocol vulnerability discovery |
0.8 | 1 | 2024 | State Machine Mutation-based Testing Framework for Wireless Communication Protocols · CCS 2024 |
Cryptographic protocols and secure computation
security protocol analysis |
0.8 | 1 | 2024 | Logic Gone Astray: A Security Analysis Framework for the Control Plane Protocols of 5G Basebands · USENIX Security Symposium 2024 |
Cellular and mobile networks › cellular network security
radio access network security |
0.3 | 1 | 2026 | Guardians of the Air: In-Device Detection of 5G Control-Plane Threats · SP 2026 |
Systems and software security
vulnerability patching |
0.3 | 1 | 2026 | LogicEval: A Systematic Framework for Evaluating Automated Repair Techniques for Logical Vulnerabilities in Real-World Software · ACL (1) 2026 |
Cellular and mobile networks
5G NR |
0.3 | 1 | 2025 | Stateful Analysis and Fuzzing of Commercial Baseband Firmware · SP 2025 |
Software-defined and programmable networks
control plane |
0.2 | 1 | 2024 | Logic Gone Astray: A Security Analysis Framework for the Control Plane Protocols of 5G Basebands · USENIX Security Symposium 2024 |
Methods — techniques the papers use, named apart from their topics
large language model · 2.0threat-guided fuzzing · 1.7symbolic analysis · 1.7iterative learning · 1.7fuzzing · 1.7state machine mutation · 1.5property-guided testing · 1.5natural language processing · 1.5formal analysis · 1.5
| Year | Publication | Venue | Position |
|---|---|---|---|
| 2026 | LogicEval: A Systematic Framework for Evaluating Automated Repair Techniques for Logical Vulnerabilities in Real-World SoftwareabstractSyed Md Mukit Rashid, Abdullah Al Ishtiaq, Kai Tu, Yilu Dong, Tianwei Wu, Ali Ranjbar, Tianchang Yang, Najrin Sultana, Shagufta Mehnaz, Syed Rafiul Hussain. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2026. Syed Md. Mukit Rashid, Abdullah Al Ishtiaq, Kai Tu, Yilu Dong, Tianwei Wu, Ali Ranjbar, Tianchang Yang, Najrin Sultana, Shagufta Mehnaz, Syed Rafiul Hussain |
ACL (1) | 3 |
| 2026 | Guardians of the Air: In-Device Detection of 5G Control-Plane Threats
Tianwei Wu, Abdullah Al Ishtiaq, Tianchang Yang, Yilu Dong, Kai Tu, Ridwanul Hasan Tanvir, Md. Toufikuzzaman, Shagufta Mehnaz, Syed Rafiul Hussain |
SP | 5 |
| 2025 | MCTrack: A Unified 3D Multi-Object Tracking Framework for Autonomous DrivingabstractThis paper introduces MCTrack, a new 3D multi-object tracking method that achieves performance across KITTI, nuScenes, and Waymo datasets. Addressing the gap in existing tracking paradigms, which often perform well on specific datasets but lack generalizability, MCTrack offers a unified solution. Additionally, we have standardized the format of perceptual results across various datasets, termed BaseVersion, facilitating researchers in the field of MOT) to concentrate on the core algorithmic development without the undue burden of data preprocessing. Finally, recognizing the limitations of current evaluation metrics, we introduce a novel set of metrics designed to evaluate the output of motion information, including velocity and acceleration, which are essential for subsequent tasks. The source codes of the proposed method are available at this link: https://github.com/megvii-research/MCTrack Xiyang Wang 0002, Shouzheng Qi, Jieyou Zhao, Hangning Zhou, Siyu Zhang 0002, Guoan Wang, Kai Tu, Songlin Guo, Jianbo Zhao 0001, Hailong Qin, Mu Yang |
IROS | 7 |
| 2025 | Stateful Analysis and Fuzzing of Commercial Baseband FirmwareabstractBaseband firmware plays a critical role in cellular communication, yet its proprietary, closed-source nature and complex, stateful processing logic make systematic security testing challenging. Existing methods often fail to account for the interdependencies between baseband tasks and the statefulness of input processing logic, limiting their scope and effectiveness. We present Loris, a stateful fuzz testing frame-work designed to explore and analyze baseband firmware implementations effectively. We employ iterative symbolic analysis to progressively identify state variables and the predicates over them that define different protocol states, while alleviating the state explosion problem. It enables Loris to perform targeted exploration and fuzzing of program regions with high potential for vulnerabilities. We evaluated Loris across 5 commercial devices from two major vendors, covering both 4G Long-Term Evolution (LTE) and 5G New Radio (NR), demonstrating its broad applicability. Our testing revealed 7 new vulnerabilities exploitable by over-the-air attackers, potentially leading to baseband crashes, remote code execution, and denial of service. Ali Ranjbar, Tianchang Yang, Kai Tu, Saaman Khalilollahi, Syed Rafiul Hussain |
SP | 3 |
| 2025 | CoreCrisis: Threat-Guided and Context-Aware Iterative Learning and Fuzzing of 5G Core Networks
Yilu Dong, Tianchang Yang, Abdullah Al Ishtiaq, Syed Md. Mukit Rashid, Ali Ranjbar, Kai Tu, Tianwei Wu, Md. Sultan Mahmud, Syed Rafiul Hussain |
USENIX Security Symposium | 6 |
| 2024 | State Machine Mutation-based Testing Framework for Wireless Communication ProtocolsabstractThis paper proposes Proteus, a protocol state machine, property-guided, and budget-aware automated testing approach for discovering logical vulnerabilities in wireless protocol implementations. Proteus maintains its budget awareness by generating test cases (i.e., each being a sequence of protocol messages) that are not only meaningful (i.e., the test case mostly follows the desirable protocol flow except for some controlled deviations) but also have a high probability of violating the desirable properties. To demonstrate its effectiveness, we evaluated Proteus in two different protocol implementations, namely 4G LTE and BLE, across 23 consumer devices (11 for 4G LTE and 12 for BLE). Proteus discovered 25 unique issues, including 112 instances. Affected vendors have positively acknowledged 14 vulnerabilities through 5 CVEs. Syed Md. Mukit Rashid, Tianwei Wu, Kai Tu, Abdullah Al Ishtiaq, Ridwanul Hasan Tanvir, Yilu Dong, Omar Chowdhury, Syed Rafiul Hussain |
CCS | 3 |
| 2024 | Hermes: Unlocking Security Analysis of Cellular Network Protocols by Synthesizing Finite State Machines from Natural Language Specifications
Abdullah Al Ishtiaq, Sarkar Snigdha Sarathi Das, Syed Md. Mukit Rashid, Ali Ranjbar, Kai Tu, Tianwei Wu, Zhezheng Song, Mujtahid Akon, Rui Zhang 0037, Syed Rafiul Hussain |
USENIX Security Symposium | 5 |
| 2024 | Logic Gone Astray: A Security Analysis Framework for the Control Plane Protocols of 5G Basebands
Kai Tu, Abdullah Al Ishtiaq, Syed Md. Mukit Rashid, Yilu Dong, Tianwei Wu, Syed Rafiul Hussain |
USENIX Security Symposium | 1 |
| 2020 | A hybrid Bregman alternating direction method of multipliers for the linearly constrained difference-of-convex problems
Kai Tu, Junkai Feng |
J. Glob. Optim. | 1 |
| 2018 | Optimality analysis on partial l1 -minimization recovery
Zhibao Li, Kai Tu |
J. Glob. Optim. | 4 |
| 2007 | Tracking the Path Shape Qualities of Human MotionabstractWe propose a probabilistic generative model for extracting intended path shape qualities of an object moving under human control in real time. At each instant, we decide whether the object is moving in a straight, curved, or random path, or whether it has stopped moving. Our model incorporates sensor noise as well as human imperfections in the intended motion. As well as tracking the object's position, velocity, and motion direction, we compute the posterior probability of each shape quality hypothesis given all sensed-data in the horizon [t - N + 1,t]; the hypothesis maximizing this posterior is taken as the decision. The posterior is computed using the unscented Kalman filter (UKF), as our model is inherently nonlinear. The path-shape quality tracking is successfully embedded in a hybrid physical-digital interface where the position of an illuminated ball, sensed by a low-cost video camera array, triggers multimodal feedback in a mediated learning environment. We show successful results on a variety of real-world motion paths where the participant is given only verbal descriptions of how to move. Our generative model is further validated by user studies involving a simple color-based interaction, where participants discover shape quality controls as they interact. Kai Tu, Harvey D. Thornburg, Matthew Fulmer, Andreas Spanias |
ICASSP (2) | 1 |