PentestEval: Benchmarking LLM-based Penetration Testing with Modular and Stage-Level Design
IEEE Transactions on Information Forensics and Security · 2026 · Accepted
About
I’m a Ph.D. student in Computer Science at Singapore Management University, advised by Prof. Xiaofei Xie. My research focuses on automated penetration testing, black-box web security testing, and LLM agents.
My research builds on hands-on experience in CTF competitions, attack-and-defense exercises, and real-world penetration testing.
Research
RepoTune: Co-evolving Vulnerability Detection with a Repository’s Genome
FSE · SWGeno 2026 · 2nd International Workshop on Software Genomics
The Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitation
arXiv · 2026
JANUS: Synthesizing Cross-Layer Defenses Against Web Deserialization Attacks
arXiv · 2026
Before Acting, Change the State: Prospective State Intervention for Web Agents under Deceptive Interfaces
arXiv · 2026
AutoEG: Exploiting Known Third-Party Vulnerabilities in Black-Box Web Applications
arXiv · 2026
What Makes a Good LLM Agent for Real-world Penetration Testing?
arXiv · 2026
Education
Singapore Management University
2025–PresentPh.D. in Computer Science
Advisor: Prof. Xiaofei Xie
Tianjin University
2020–2024B.Eng. in Computer Science and Technology
Thesis: Visual Analysis Model of APT Attack Samples
Advisor: Prof. Tao Luo
CTF
Web security competitor. Captain of D.I.E, Tianjin University’s official team (2022–2024); core member of Dest0g3 (2021–2023); co-founder of TTT-team (2021).
Domestic competitions
- 第四届“第五空间”网络安全大赛冠军
- 第四届“长城杯”信息安全铁人三项赛一等奖（亚军）
- 第十五届全国大学生信息安全竞赛国家级二等奖
等
International competitions
- 7th XCTF Finals2nd Prize
- SUSCTF — Meritorious Winner4 / 308
- SCTF6 / 206
- L3HCTF10 / 275
- *CTF13 / 372
- Azure Assassin Alliance CTF26 / 310
- BSidesNoida CTF26 / 411
- RCTF34 / 363
- CyBRICS 202144 / 482
- Real World CTF 4th68 / 947
...