Qian Lou
Bio
Qian Lou is a researcher and professor at the University of Central Florida, serving as Principal Investigator on projects supported by NSF, NIH, and Amazon. His research studies how AI systems fail under adversarial conditions and develops defenses, evaluation methods, and privacy-preserving systems. His work spans prompt and memory attacks, certified robustness, model and text provenance, and verifiable computation. His goal is to make increasingly capable and agentic AI more secure, accountable, and dependable in practice.
He received the NSF CAREER Award in 2026. His work appears in leading AI, security, and systems venues, including NeurIPS, ICML, ICLR, ACL, IEEE S&P, and DAC. Before joining UCF, he was a Senior Research Scientist at Samsung AI Center in Mountain View. His work has received a Samsung Research Best Paper Award and Best Paper Finalist honors at PACT and ICCAD.
Research
How can we understand, measure, and reduce the risks of AI systems as they learn, generate content, and act through agents?
Driven by this question, my research aims to expose hidden vulnerabilities, protect sensitive information, and strengthen the evidence behind trust in AI behavior and outputs. By connecting risk discovery with defenses and verification, we aim to enable broader use of AI without treating security, privacy, and accountability as afterthoughts, especially as agents accumulate memory, interact with other agents, and use external tools.
We pursue this goal through three connected directions: Attacks and red teaming, Defenses and reliable agents, and Privacy and provenance. We develop attacks and benchmarks that reveal failure modes; detection, mitigation, robustness certification, and external checks that address specific risks; and watermarking, fingerprinting, and cryptographic methods that protect data, assess provenance, and verify supported computations. Our approach connects empirical evaluation with explicit threat models and, where available, formal guarantees.
I. Attacks and red teaming
We study adversarial behavior across model adaptation, prompting, memory, and multi-agent interaction. These investigations identify where trust assumptions break and provide concrete tests for evaluating defenses.
- Prompt and model vulnerabilities. TrojLLM (NeurIPS 2023) studies automated black-box Trojan prompt attacks on LLMs. TrojText (ICLR 2023) examines invisible test-time Trojan insertion. [TrojLLM paper] [TrojText paper]
- Agent memory and collaboration. MemIncept (ICML 2026) investigates memory injections that steer LLM agents. Conjunctive Prompt Attacks (ACL 2026, Main Conference Oral) examines vulnerabilities in multi-agent LLM systems. [Memory attacks] [Multi-agent attacks]
- Multimodal red teaming. RealM (NeurIPS 2026, Evaluations and Datasets Track) provides a unified red-teaming benchmark for physical-world vision-language models, connecting attacks and defenses through shared evaluation. [Publication]
II. Defenses and reliable agents
We turn observed failures into targeted safeguards and measurable evaluation criteria. Detection and mitigation address known attack patterns; certification provides guarantees within a specified perturbation model; and external checks help assess whether an agent's output satisfies task and security requirements.
- Certified robustness. CR-UTP (Findings of ACL 2024) studies certified robustness against universal text perturbations using prompt ensembling and randomized smoothing. Its guarantees concern the specified perturbation setting, not arbitrary agent behavior. [Paper] [Code]
- Backdoor detection and mitigation. SSL-Cleanse (ECCV 2024) targets Trojan detection and mitigation in self-supervised learning, complementing our work on exposing vulnerabilities. [Paper] [Code]
- Externally checked agent outputs. FHE-Coder (ICLR 2026) uses functional and security checks in cryptographic code generation. It illustrates how task-specific validation can guide agents beyond simply producing plausible code. [Paper] [Project]
Evolving agent safety. Our ongoing agenda is to connect attack discovery, evaluation, and safeguards as agents change their memory, tools, and interaction patterns. The goal is to reassess protection as systems evolve rather than assume that a one-time test establishes lasting safety.
III. Privacy and provenance
We study complementary ways to protect sensitive computation and establish evidence about models, generated content, and computation results. Watermarking and fingerprinting address attribution; cryptographic methods address confidentiality and verification. Neither attribution nor confidentiality alone establishes that an output is correct or safe.
- Text and model provenance. PRO (NeurIPS 2026) studies robust text watermarking for open-source LLMs. SIF (CVPR 2026) develops semantically in-distribution fingerprints for large vision-language models. [PRO publication] [SIF publication]
- Provenance under realistic changes. Our EMNLP 2025 and 2026 studies evaluate watermarking under cross-lingual manipulation and in medical text, including factuality, detectability, style shifts, and helpfulness. These studies examine tradeoffs beyond detection alone. [Cross-lingual study] [Factuality study] [Clinical EHR study]
- Private and verifiable computation. SecureRoute (DAC 2026) protects routing and inference using secure multiparty computation. DataSeal (IEEE S&P 2025) adds checks for supported encrypted computations. These systems address data exposure and computation integrity, distinct from behavioral safety. [SecureRoute paper] [DataSeal paper]
Connecting the directions. Attacks reveal failure modes; defenses and evaluation test whether those risks are reduced; privacy and provenance mechanisms protect information and support accountability. Together, these directions aim to make trust in AI more evidence-based while keeping each method's assumptions and limitations explicit.
Selected Publications
* indicates students and staff under my supervision. Complete publication list.
[NeurIPS 26] RealM: A Unified Red-Teaming Benchmark for Physical-World VLMs |
[NeurIPS 26] PRO: Enabling Precise and Robust Text Watermark for Open-Source LLMs |
[EMNLP 26] Evaluating LLM Watermarking for Clinical EHR: Detectability, Style Shifts, and Helpfulness |
[ICML 26] MemIncept: Steering LLM Agents via Cooperative Stealthy Memory Injections |
[ACL 26] Conjunctive Prompt Attacks in Multi-Agent LLM Systems |
[DAC 26] SecureRoute: Input-Adaptive Encrypted Routing for Efficient and Accurate MPC-Based Transformer Inference |
[CVPR 26] SIF: Semantically In-Distribution Fingerprints for Large Vision-Language Models |
[ICLR 26] FHE-Coder: Secure Agentic Code Generation for Fully Homomorphic Encryption |
[EMNLP 25] Evaluating the Robustness and Accuracy of Text Watermarking Under Real-World Cross-Lingual Manipulations |
[EMNLP 25] Factuality Beyond Coherence: Evaluating LLM Watermarking Methods for Medical Texts |
[S&P 25] DataSeal: Ensuring the Verifiability of Private Computation on Encrypted Data |
[ACL 24] CR-UTP: Certified Robustness against Universal Text Perturbations on Large Language Models |
[ECCV 24] SSL-Cleanse: Trojan detection and mitigation in self-supervised learning. |
[NeurIPS 23] TrojLLM: A Black-box Trojan Prompt Attack on Large Language Models |
[ICLR 23] TrojText: Invisible Test-time Trojan Insertion |
Open Source
- CR-UTP: certified robustness against universal text perturbations.
- SSL-Cleanse: Trojan detection and mitigation in self-supervised learning.
- FHE-Coder: benchmark and resources for externally checked cryptographic programming.
- UCF-ML-Research and UCF-Lou-Lab-PET: our group's trustworthy learning and privacy-preserving computing resources.
People
Selected contributors across AI security, provenance, and verification include:
- Jiaqi Xue: TrojLLM, PRO, and private computation.
- Yifei Zhao: RealM, SIF, and watermarking.
- Nokimul Hasan Arif: conjunctive prompt attacks in multi-agent systems.
- Rochana Prih Hastuti: clinical-text evaluation and watermarking.
- Mansour Al Ghanim (alumnus): text watermarking and adversarial robustness.
- Mayank Kumar: FHE-Coder and secure cryptographic programming.
Funding & Recognition
Support across my research program spans AI security, private computing, healthcare AI, and education. The DoD Pathfinder project addresses LLM security testing; NSF CAREER and SaTC support secure infrastructure and privacy-preserving data synthesis. Other awards support complementary research and workforce development.
Research & Education Funding
PI: Principal Investigator. Co-PI: Co-Principal Investigator.
- 2026Amazon Research Award (PI)
Trainium-native controller-guided compression and alignment-preserving post-training.
$250K in AWS credits. [Program] - 2026NIH/NIAID R01 (PI)
Collaborative AI Agents for Bacterial Infections: A Knowledge-Grounded Framework to Support Clinical Practice Guidelines and Clinical Decision-Making. [Program]
- 2026NSF CyberAI Scholarship for Service (SFS) (Co-PI)
CyberAI SFS: Educating Florida's Federal CyberAI Workforce for Secure AI in Space, Defense, and Modeling & Simulation. [Award 2622846]
- 2026NSF CAREER (PI)
Scalable, General-Purpose, and Automated Secure Computing for AI Infrastructure. [Award OAC-2544047]
- 2026NSF Research Experiences for Undergraduates (REU)
Support for undergraduate research experiences. [Program]
- 2025NSF Secure and Trustworthy Cyberspace (SaTC) (PI)
Collaborative Research: Privacy-Preserving Synthetic Data Generation. [Award CCF-2523407]
- 2025Department of Defense Pathfinder Program (PI)
LLM Security Testing.
- 2024NSF CISE Core / CSR Small (PI)
System Support for Fast, Scalable, and Verifiable Fully Homomorphic Encryption. [Award CNS-2413232]
- 2024Arctic Wolf Networks, Inc. (Co-PI)
Industry research support.
Honors & Recognition
- 2026: NSF CAREER Award. [UCF feature]
- 2026: ASEM-FL Rising Star Award. [Program]
- 2022: Samsung Research Best Paper Award.
- 2020: Best Paper Finalist, PACT.
- 2018: Best Paper Finalist, ICCAD.
Selected Service & Outreach
- Program committee service: CCS and NDSS; area chair service for NeurIPS, ICLR, and ACL.
- DAC 2026 SPGAI Workshop Chair. Secure and Private System Design for Generative & Agentic AI. [Workshop]
- WESH 2 News interview. Public discussion of AI safety. [Interview]
- UCF research feature. Advancing AI security through the NSF CAREER program. [Read]