Fengyu Liu

Fengyu Liu

ETH Zürich

I am a postdoctoral researcher in the Advanced Software Technologies (AST) Lab at ETH Zürich, working under the supervision of Prof. Zhendong Su. I received my Ph.D. from Fudan University in 2026, advised by Prof. Yuan Zhang and Prof. Min Yang, and received my B.Eng. from Northwestern Polytechnical University in 2021.

My research focuses on web security and LLM-based agent security. My work has appeared in leading security conferences, including IEEE S&P, ACM CCS, and USENIX Security. My papers have received Distinguished Paper Awards at IEEE S&P 2025 and ACM CCS 2025, as well as Honorable Mention Award at USENIX Security 2025. My research has been adopted by leading technology companies, including Alibaba, ByteDance, and Huawei, and acknowledged in security advisories published by Apple, Microsoft, and Intel.

📝 Selected Publications [Full List]

  • ACM CCS'26 BACAgent: LLM-Powered Detection of Broken-Access-Control Vulnerabilities in Web Applications [PDF]
    Fengyu Liu, Yuan Zhang, Zheng Lou, Tian Chen, Youkun Shi, Jiarun Dai, Enhao Li, Guangyu Zhou, Zhongfu Su, Zequn Fang.
    In Proceedings of the 33rd ACM Conference on Computer and Communications Security (CCS), November 2026. (CCF-A)

  • USENIX Security'25 Make Agent Defeat Agent: Automatic Detection of Taint-Style Vulnerabilities in LLM-based Agents [PDF]
    Fengyu Liu, Yuan Zhang, Jiaqi Luo, Jiarun Dai, Tian Chen, Letian Yuan, Zhengmin Yu, Youkun Shi, Ke Li, Hao Chen, Min Yang.
    In Proceedings of the 34th USENIX Security Symposium (USENIX Security), August 2025. (CCF-A)
    Presented at BlackHat Europe 2025 [Talk Abstract]

  • IEEE S&P'25 Detecting Taint-Style Vulnerabilities in Microservice-Structured Web Applications [PDF]
    Fengyu Liu, Yuan Zhang, Tian Chen, Youkun Shi, Guangliang Yang, Zihan Lin Min Yang, Junyao He, Qi Li.
    In Proceedings of the 46th IEEE Symposium on Security and Privacy (S&P), May 2025. (CCF-A)
    ★ Distinguished Paper Award (<1% submission), Presented at BlackHat USA 2025 [Talk Abstract]

  • IEEE S&P'25 MOCGuard: Automatically Detecting Missing-Owner-Check Vulnerabilities in Java Web Applications [PDF]
    Fengyu Liu, Youkun Shi, Yuan Zhang, Guangliang Yang, Enhao Li, Min Yang.
    In Proceedings of the 46th IEEE Symposium on Security and Privacy (S&P), May 2025. (CCF-A)

  • ACM CCS'25 BACScan: Automatic Black-Box Detection of Broken-Access-Control Vulnerabilities in Web Applications [PDF]
    Fengyu Liu, Yuan Zhang, Enhao Li, Wei Meng, Youkun Shi, Qianheng Wang, Chenlin Wang, Zihan Lin, Min Yang.
    In Proceedings of the 32nd ACM Conference on Computer and Communications Security (CCS), October 2025. (CCF-A)
    ★ Distinguished Paper Award (<1% submission)

  • ACM CCS'25 Be Aware of What You Let Pass: Demystifying URL-based Authentication Bypass Vulnerability in Java Web Applications [PDF]
    Qiyi Zhang*, Fengyu Liu*, Zihan Lin, Yuan Zhang (* co-first authors).
    In Proceedings of the 32nd ACM Conference on Computer and Communications Security (CCS), October 2025. (CCF-A)

🎖 Honors and Awards

🏆 Selected Competitions

  • 2022, 🏆 Champion, 4th “QiangWang” Cup International Elite Challenge On Cyber Mimic Defense (￥80,000)
  • 2021, 🏆 Champion, 6th XCTF International League (￥100,000)
  • 2021, 🏆 Champion, 13th National College Student Information Security Contest
  • 2020, 🏆 Champion, 4th Peak Geek Cyber Security Skills Challenge (￥100,000)
  • 2020, 🏆 Champion, 2nd “WangDing” Cup Qinglong Group (￥30,000)
  • 2019, 🏆 Champion, 4th “Hu-Xiang” Cup (￥160,000)

💻 Internships