publications
In reverse chronological order.
See also my Google Scholar profile.
2026
- AI’ve Got a Bad Feeling About This: A Privacy Threat Modeling Framework for GenAIIn Proceedings of the Twenty-Second Symposium on Usable Privacy and Security (SOUPS ’26), Aug 2026
As generative AI (GenAI) systems become increasingly prevalent across various technological stacks, the question of how such systems handle sensitive and personal data flows becomes increasingly important. Specifically, both the ability to harness and process large swaths of information as well as their stochastic nature raise key concerns related to both security and privacy. Unfortunately, while some of the traditional security threat modeling can effectively identify certain violations, privacy-related issues are often overlooked. To respond to these challenges, we introduce a novel domain-specific privacy threat modeling framework to support the privacy threat analysis of GenAI-based applications. This framework is constructed through a two-pronged approach: (i) a systematic review of the emerging literature on GenAI privacy threats, and (ii) a case-driven application to a representative Chatbot system. These efforts yield a foundational GenAI privacy threat modeling framework built on LINDDUN. The new framework extends three out of the seven privacy threat types of LINDDUN and introduces 100 GenAI examples to the entire knowledge base. Its effectiveness is validated on an AI Agent system, which demonstrates that a comprehensive privacy analysis can be supported by the new framework.
@inproceedings{liao2026privacy, title = {AI've Got a Bad Feeling About This: A Privacy Threat Modeling Framework for GenAI}, author = {Liao, Qianying and Bellemans, Jonah and Sion, Laurens and Jiang, Xue and Usynin, Dmitrii and Zhou, Xuebing and Van Landuyt, Dimitri and Desmet, Lieven and Joosen, Wouter}, booktitle = {Proceedings of the Twenty-Second Symposium on Usable Privacy and Security (SOUPS '26)}, pages = {625--645}, year = {2026}, month = aug, publisher = {USENIX Association}, address = {Hannover, Germany}, } - A Unified Evaluation Framework for Privacy-Preserving Data Publication TechniquesJenno Verdonck, Qianying Liao, Michiel Willocx, and 3 more authorsIn Proceedings of the 21st International Conference on Availability, Reliability and Security (ARES ’26), Aug 2026
Privacy-preserving data publication (PPDP) aims to reduce privacy risks before releasing datasets. As alternative techniques, (i) data de-identification alters original data values through generalization or suppression to weaken their link to data subject identities, whereas (ii) synthetic data generation produces artificial datasets that do not contain any original data yet preserve statistical similarity to the original data. Because their outcomes lack direct comparability, it remains unclear which technique provides better privacy protection while retaining data utility. To address this gap, we present: (i) a novel quantitative evaluation framework for comparing privacy and utility across synthetic and de-identified datasets, and (ii) a comparative study based on a location optimisation task and a predictive machine learning application. Our results reveal a nuanced trade-off. De-identified datasets perform better on traditional statistical privacy metrics but are more vulnerable to adversarial attacks such as attribute inference. Conversely, utility outcomes vary widely by use case, indicating that the selection of a PPDP technique remains highly dependent on the application context.
@inproceedings{verdonck2026unified, title = {A Unified Evaluation Framework for Privacy-Preserving Data Publication Techniques}, author = {Verdonck, Jenno and Liao, Qianying and Willocx, Michiel and Joosen, Wouter and Naessens, Vincent and Van Landuyt, Dimitri}, booktitle = {Proceedings of the 21st International Conference on Availability, Reliability and Security (ARES '26)}, year = {2026}, month = aug, address = {Linköping, Sweden}, } - The Right Tool for the Job: On the Selection of Mitigations for GenAI Privacy ThreatsIn 21st IFIP Summer School on Privacy and Identity Management, Aug 2026
Generative Artificial Intelligence (GenAI) has rapidly evolved from an experimental technology into a foundational component of modern software systems. However, as its adoption grows, protecting sensitive personal data becomes increasingly challenging. Specifically, GenAI systems not only amplify traditional privacy threats but also introduce new inference-based risks, such as constructing detailed user profiles from seemingly harmless inputs. In response, privacy threat modeling frameworks are beginning to capture GenAI-specific privacy threats with finer granularity. At the same time, a growing number of mitigation techniques have been proposed to address these threats. However, although knowledge of both threats and mitigations continues to mature, the problem- and solution-space have developed largely independently. This position paper argues that the primary challenge in GenAI privacy engineering is not the lack of knowledge about privacy threats or mitigation techniques, but the missing bridge between them. We decompose this gap into three sub-problems: (i) lack of fine-grained threat-to-mitigation mapping for GenAI systems, (ii) inapplicable solution-space assumptions in the GenAI context, and (iii) prioritization difficulty under GenAI constraints. We derive four recommendations for future mitigation-selection approaches, and outline a suggested approach that extends established threat-to-mitigation mapping methods to GenAI-specific threat characteristics. We propose a research agenda toward more systematic privacy mitigation selection for GenAI-based systems.
@inproceedings{bellemans2026righttool, title = {The Right Tool for the Job: On the Selection of Mitigations for GenAI Privacy Threats}, author = {Bellemans, Jonah and Liao, Qianying and Sion, Laurens and Desmet, Lieven and Joosen, Wouter}, booktitle = {21st IFIP Summer School on Privacy and Identity Management}, year = {2026}, month = aug, address = {Leuven, Belgium}, }
2025
- Security and Privacy of Large Language Models (Dagstuhl Seminar 25461)Stephan Günnemann, Pavel Laskov, Emil Lupu, and 3 more authorsDagstuhl Reports, Nov 2025
Large Language Models (LLMs) have rapidly evolved from experimental systems capable of generating simple text to powerful general-purpose tools that solve exam-level problems, assist human experts, summarize complex documents, and write code, leading to their widespread deployment in production environments to improve productivity. Their rapid adoption has outpaced scientific understanding of the associated security and privacy risks, creating a growing gap between real-world use and trust in LLM-based applications. Unlike traditional machine learning models, LLMs are inherently general-purpose, operate at unprecedented scale, are often proprietary, and are accessed through interactive dialog interfaces. This makes their behavior difficult to predict and introduces novel attack surfaces and emerging phenomena such as hallucinations. Existing methods and analyzes for conventional machine learning are insufficient to cope with these aspects. So, this Dagstuhl Seminar "Security and Privacy of Large Language Models" (25461) aimed to initiate a systematic scientific discussion on the security and privacy of language models by bringing together researchers from AI, security, privacy, and natural language processing to address three central questions: how safe and secure are LLMs in adversarial environments; to what extent users’ privacy may be at risk when interacting with LLMs; and what other categories of societal impact may arise from the rapid advancement of LLM technologies. The seminar sought to systematize existing knowledge, identify high-risk applications and prevalent attack vectors, discuss defense strategies and deployment challenges, and outline directions for future research in LLM security and privacy.
@article{gunnemann2025dagstuhl, title = {Security and Privacy of Large Language Models (Dagstuhl Seminar 25461)}, author = {Günnemann, Stephan and Laskov, Pavel and Lupu, Emil and Rimmer, Vera and Rizvani, Advije and Liao, Qianying}, journal = {Dagstuhl Reports}, volume = {15}, number = {11}, pages = {87--113}, year = {2025}, month = nov, publisher = {Schloss Dagstuhl -- Leibniz-Zentrum für Informatik}, doi = {10.4230/DagRep.15.11.87}, } - Book ChapterEmpowering Collaborative Healthcare with Federated Learning: Navigating Security and Privacy PrioritiesIn Handbook on Smart Health, Oct 2025
The trend to support healthcare outside of the premises and control of health institutions has given rise to a diversity of devices (e.g. wearables), services, and players contributing to the ecosystem. In consequence, health-related and medical data are frequently dispersed across multiple institutions and devices, posing a significant challenge to comprehensive data analysis and exploration for AI-driven research on new medicines or treatments. Centralizing such sensitive data is often unachievable due to the rigorous security and privacy demands imposed by various stakeholders, including patients, general practitioners, and pharmaceutical researchers. The decentralized and dispersed nature of healthcare data, in combination with stringent regulatory constraints such as HIPAA and GDPR, necessitate innovative approaches to collaborative healthcare research. Federated learning is a promising class of solutions to harness the collective intelligence of diverse datasets by allowing collaborative model training across decentralized data sources. Despite the many privacy-enhancing techniques proposed to ensure the confidentiality of data and intellectual property, this chapter discusses and illustrates the challenges of leveraging shared representations and knowledge transfer between smart health applications while addressing the intricacies of data fragmentation, security, and privacy.
@incollection{liao2025empowering, title = {Empowering Collaborative Healthcare with Federated Learning: Navigating Security and Privacy Priorities}, author = {Liao, Qianying and Preuveneers, Davy and Van Landuyt, Dimitri and Joosen, Wouter}, booktitle = {Handbook on Smart Health}, series = {Studies in Health Technology and Informatics}, volume = {330}, pages = {363--392}, year = {2025}, month = oct, publisher = {IOS Press}, doi = {10.3233/SHTI251441}, } - Data Chameleon: A Self-Adaptive Synthetic Data Management SystemQianying Liao, Maarten Kesters, Dimitri Van Landuyt, and 1 more authorIn Data and Applications Security and Privacy XXXIX (DBSec 2025), Jun 2025
The data economy thrives on data-centric collaboration between organizations. However, open data sharing remains a pipe dream without addressing pragmatic, regulatory, and strategic concerns – which include data protection and confidentiality. Generative artificial intelligence supports the production of realistic synthetic datasets on demand, and is a promising technology to alleviate such concerns. However, the replacement of an original dataset with a synthetic dataset incurs a specific trade-off between utility and privacy, and the appropriateness of this trade-off is highly context- and application-dependent. Manually establishing and managing different synthetic generators that have diverging properties is error-prone and time-consuming, lacks flexibility, and thus is costly and impractical. This paper introduces Data Chameleon, a novel self-adaptive data management architecture for different synthetic data generators. Data Chameleon adaptively samples from different synthetic data generators in function of the data request at hand. Furthermore, in a longer-term adaptation loop, Data Chameleon monitors and evaluates the overall suitability of the available generators, to monitor evolutions in data demand, or possible concept drifts. Based on this, the Chameleon autonomously decides to re-train existing generators, or instantiate additional ones in a self-adaptive manner. The Data Chameleon architecture enhances the practical applicability of synthetic data generation, enabling more efficient and secure data sharing in real-world scenarios.
@inproceedings{liao2025chameleon, title = {Data Chameleon: A Self-Adaptive Synthetic Data Management System}, author = {Liao, Qianying and Kesters, Maarten and Van Landuyt, Dimitri and Joosen, Wouter}, booktitle = {Data and Applications Security and Privacy XXXIX (DBSec 2025)}, series = {Lecture Notes in Computer Science}, pages = {44--56}, year = {2025}, month = jun, publisher = {Springer, Cham}, address = {Gjøvik, Norway}, doi = {10.1007/978-3-031-96590-6_3}, } - DeMeSSAITowards Golden Standards for Quantifying Privacy of Synthetic Tabular DataQianying Liao, Dimitri Van Landuyt, and Wouter JoosenIn 4th International Workshop on Designing and Measuring Security in Systems with AI (DeMeSSAI), Jul 2025
The rise of Generative Artificial Intelligence (GenAI) techniques has created numerous opportunities but also a few challenges, the most prominent of which relates to privacy and data confidentiality. Many different privacy metrics, evaluation techniques (and variants thereof) have been proposed and used in literature to evaluate the privacy of synthetic tabular data. These are roughly classified as (i) non-adversarial metrics – evaluating and comparing the data statistically–, and (ii) adversarial metrics –approaches that simulate adversarial approaches (privacy attacks) and evaluate their success. There is however a large discrepancy between these metrics. The adversarial metrics require significant resources (CPU, time, memory) whereas the non-adversarial metrics are less costly to calculate. In this paper, we highlight the lack of a ’golden standard’ for privacy auditing, i.e. for evaluating and quantifying the privacy of synthetic tabular data. We specifically present a research framework to support extensive experimentation with the intent to obtain the necessary knowledge and better inform metric selection and enable pragmatic trade-offs.
@inproceedings{liao2025golden, title = {Towards Golden Standards for Quantifying Privacy of Synthetic Tabular Data}, author = {Liao, Qianying and Van Landuyt, Dimitri and Joosen, Wouter}, booktitle = {4th International Workshop on Designing and Measuring Security in Systems with AI (DeMeSSAI)}, year = {2025}, month = jul, address = {Venice, Italy}, } - Towards a Common Task Framework for Distributed Collaborative Machine LearningIn 2025 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW), 2025
Distributed Collaborative Machine Learning (DCML) enables collaborative model training without the need to reveal or share datasets. However, its implementation incurs complexities in balancing performance, efficiency, and security and privacy. Different architectural approaches in how the learning can be distributed and coordinated over different parties have emerged, leading to significant diversity. Current academic work often lacks a comprehensive evaluation of the diverse architectural DCML approaches, which in turn hinders objective comparison of different DCML approaches and impedes broader adoption. This paper highlights the need for a general and holistic evaluation framework for DCML approaches, and proposes a number of relevant evaluation metrics and criteria.
@inproceedings{liao2025common, title = {Towards a Common Task Framework for Distributed Collaborative Machine Learning}, author = {Liao, Qianying and Van Landuyt, Dimitri and Preuveneers, Davy and Joosen, Wouter}, booktitle = {2025 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW)}, pages = {433--437}, year = {2025}, publisher = {IEEE}, address = {Naples, Italy}, doi = {10.1109/ICSTW64639.2025.10962497}, }
2024
- LAFEM: A Scoring Model to Evaluate Functional Landscape of Lysine AcetylomeJ.-Z. Liang, D.-H. Li, Y.-C. Xiao, and 5 more authorsMolecular & Cellular Proteomics, Jan 2024
Protein lysine acetylation is a critical post-translational modification involved in a wide range of biological processes. To date, about 20,000 acetylation sites of Homo sapiens were identified through mass spectrometry–based proteomic technology, but more than 95% of them have unclear functional annotations because of the lack of existing prioritization strategy to assess the functional importance of the acetylation sites on large scale. Hence, we established a lysine acetylation functional evaluating model (LAFEM) by considering eight critical features surrounding lysine acetylation site to high-throughput estimate the functional importance of given acetylation sites. This was achieved by selecting one of the random forest models with the best performance in 10-fold cross-validation on undersampled training dataset. The global analysis demonstrated that the molecular environment of acetylation sites with high acetylation functional scores (AFSs) mainly had the features of larger solvent-accessible surface area, stronger hydrogen bonding–donating abilities, near motif and domain, higher homology, and disordered degree. Importantly, LAFEM performed well in validation dataset and acetylome, showing good accuracy to screen out fitness directly relevant acetylation sites and assisting to explain the core reason for the difference between biological models from the perspective of acetylome. We further used cellular experiments to confirm that, in nuclear casein kinase and cyclin-dependent kinase substrate 1, acetyl-K35 with higher AFS was more important than acetyl-K9 with lower AFS in the proliferation of A549 cells. LAFEM provides a prioritization strategy to large scale discover the fitness directly relevant acetylation sites, which constitutes an unprecedented resource for better understanding of functional acetylome.
@article{liang2024lafem, title = {LAFEM: A Scoring Model to Evaluate Functional Landscape of Lysine Acetylome}, author = {Liang, J.-Z. and Li, D.-H. and Xiao, Y.-C. and Shi, F.-J. and Zhong, T. and Liao, Q.-Y. and Wang, Y. and He, Q.-Y.}, journal = {Molecular \& Cellular Proteomics}, volume = {23}, number = {1}, pages = {100700}, year = {2024}, month = jan, publisher = {Elsevier}, doi = {10.1016/j.mcpro.2023.100700}, }
2022
- Herb: Privacy-Preserving Random Forest with Partially Homomorphic EncryptionQianying Liao, Bruno Cabral, João Paulo Fernandes, and 1 more authorIn 2022 International Joint Conference on Neural Networks (IJCNN), Jul 2022
Building a Machine Learning model requires the use of large amounts of data. Due to privacy and regulatory concerns, these data might be owned by multiple sites and are often not mutually shareable. Our work deals with private learning and inference for the Weighted Random Forest model when data records are vertically distributed among multiple sites. Previous privacy-preserving vertical tree-based frameworks either adapt Secure Multi-party Computation or share intermediate results and are hard to generalize or scale. In contrast, our proposal contains efficient collaborative calculation algorithms of the Gini Index and Entropy for computing the impurity of decision tree nodes while protecting all intermediate values and disclosing minimal information. We offer a learning protocol based on the Paillier Cryptosystem and Digital Envelope. Also, we provide an inference protocol found on the Look-up Table. Our experiments show that the proposed protocols do not cause predictive performance loss while still establishing and utilizing the model within a reasonable time. The results imply that practitioners can overcome the barrier of data sharing and produce random forest models for data-heavy domains with strict privacy requirements, such as Health Prediction, Fraud Detection, and Risk Evaluation.
@inproceedings{liao2022herb, title = {Herb: Privacy-Preserving Random Forest with Partially Homomorphic Encryption}, author = {Liao, Qianying and Cabral, Bruno and Fernandes, João Paulo and Lourenço, Nuno}, booktitle = {2022 International Joint Conference on Neural Networks (IJCNN)}, pages = {1--10}, year = {2022}, month = jul, publisher = {IEEE}, address = {Padua, Italy}, doi = {10.1109/IJCNN55064.2022.9892321}, } - PRDCHERB+: Evolving an Industrial-Strength Privacy-Preserving Machine Learning FrameworkQianying Liao, Alexandre Cortez Santos, Bruno Cabral, and 2 more authorsIn 2022 IEEE 27th Pacific Rim International Symposium on Dependable Computing (PRDC), Nov 2022
Supervised machine learning does not hold without data. However, the needed data can be distributed in different locations and are non-shareable under privacy constraints. Methods to circumvent disclosure restrictions in collaborative machine learning are in strong demand. Thus, we propose HERB+ (Homomorphic Encryption for Random forest and gradient Boosting plus), a confidential learning framework for tree-based models under the scenario of vertically dispersed data. While previous related work focused on a specific algorithm, this work presents a wide variety of privacy-preserved and distributed tree-based algorithms (i.e., Decision Tree, Random Forest, and Gradient Boosting Decision Trees for both classification and regression tasks). HERB+ provides the most detailed and general discussions on using Fully Homomorphic Encryption for computing distributed tree-based algorithms during the training process. Our experiments show that although the learning protocols’ efficiencies are not optimal, the predictive performance and privacy are preserved. The results imply that practitioners can overcome the barrier of data sharing and produce tree-based models for data-heavy domains with strict privacy requirements, such as Health Prediction, Fraud Detection, and Risk Evaluation.
@inproceedings{liao2022herbplus, title = {HERB+: Evolving an Industrial-Strength Privacy-Preserving Machine Learning Framework}, author = {Liao, Qianying and Santos, Alexandre Cortez and Cabral, Bruno and Fernandes, João Paulo and Lourenço, Nuno}, booktitle = {2022 IEEE 27th Pacific Rim International Symposium on Dependable Computing (PRDC)}, pages = {212--223}, year = {2022}, month = nov, publisher = {IEEE Computer Society}, address = {Beijing, China}, doi = {10.1109/PRDC55274.2022.00035} }
2020
- ISSREWModelling CI/CD Pipeline Through Agent-Based SimulationQianying LiaoIn 2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW), Oct 2020
The need for rapid and efficient software development pushes the demand for automation in the phases of build, test, and release. Thereby, the methodology of Continuous Integration and Continuous Deployment (CI/CD) emerges, which then gives birth to a set of CI/CD enabling services, such as Travis CI and Jenkins. Those services facilitate the automatic compilation, connection tracking, and packaging of new features. They not only incorporate playgrounds for testing and functionality verification but also enable the final delivery.Poor understanding and execution in CI/CD operations can result in slowing and even halting the pace of a software project. Many bottlenecks of CI/CD pipeline might occur due to its incorrect configurations, i.e. the inadequate level of automation, the unsuitable load capacity and the suboptimal queueing strategy. However, understanding the actual CI/CD pipeline is hard since its performance varies significantly with different hosting machines, technologies and plugins. On the other hand, finding a way to analyse and improve the settings of CI/CD pipeline brings great managerial and economic benefits since an optimal configuration implies the eventual high efficiency. To that end, this study attempts to design a model that can not only capture the abstraction of the pipeline but also provides a testing environment for the impersonal influencers of CI/CD performance. The current study, therefore, aims to contribute (1) a pipeline model based on the logic of the queueing system and enabled by agent-based simulation, and (2) an experimental environment which allows the testing of different settings and operation scenarios.
@inproceedings{liao2020modelling, title = {Modelling CI/CD Pipeline Through Agent-Based Simulation}, author = {Liao, Qianying}, booktitle = {2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)}, pages = {155--156}, year = {2020}, month = oct, publisher = {IEEE}, address = {Coimbra, Portugal}, doi = {10.1109/ISSREW51248.2020.00059}, }