Ningfei Wang

About Me

I am a fifth-year Ph.D. candidate in Department of Computer Science at University of California, Irvine advised by Prof. Alfred Chen. My research focuses on security aspects of safety-critical Cyber-Physical Systems (CPS), including the security of Autonomous Driving (AD) and robotics systems, as well as machine learning security.

Before joining UCI, I received my M.S. and B.E. degree from Lehigh University and Beijing University of Posts and Telecommunications. During my time at Lehigh University, I was fortunate to work with Prof. Ting Wang, Prof. Yinzhi Cao, and Prof. Mooi Choo Chuah.

Publications

* denotes equal contribution

Preprint

[arXiv'22] SoK: On the Semantic AI Security in Autonomous Driving
Junjie Shen, Ningfei Wang, Ziwen Wan, Yunpeng Luo, Takami Sato, Zhisheng Hu, Xinyang Zhang, Shengjian Guo, Zhenyu Zhong, Kang Li, Ziming Zhao, Chunming Qiao, Qi Alfred Chen
arXiv:2203.05314 2022
[Paper arXiv] [Website] [bibtex]

@article{shen2022sok,
  title={{SoK: On the Semantic AI Security in Autonomous Driving}},
  author={Shen, Junjie and Wang, Ningfei and Wan, Ziwen and Luo, Yunpeng and Sato, Takami and Hu, Zhisheng and Zhang, Xinyang and Guo, Shengjian and Zhong, Zhenyu and Li, Kang and others},
  journal={arXiv preprint arXiv:2203.05314},
  year={2022}
}

Conference and Workshop

2025

[NDSS'25] Revisiting Physical-World Adversarial Attack on Traffic Sign Recognition: A Commercial Systems Perspective
Ningfei Wang, Shaoyuan Xie, Takami Sato, Yunpeng Luo, Kaidi Xu, Qi Alfred Chen
The Network and Distributed System Security Symposium 2025 (NDSS 2025)
[Paper] [Paper arXiv] [bibtex]

@inproceedings{wang2025revisiting,
  title={{Revisiting Physical-World Adversarial Attack on Traffic Sign Recognition: A Commercial Systems Perspective}},
  author={Wang, Ningfei and Xie, Shaoyuan and Sato, Takami and Luo, Yunpeng and Xu, Kaidi and Chen, Qi Alfred},
  booktitle={2025 The Network and Distributed System Security Symposium (NDSS)},
  year={2025}
}

2024

[WWW'24] Towards Robustness Analysis of E-Commerce Ranking System
Ningfei Wang, Yupin Huang, Han Cheng, Jiri Gesi, Xiaojie Wang, Vivek Mittal
The ACM Web Conference 2024 (WWW 2024)
[Paper] [Paper arXiv] [Promo Video] [bibtex]

@inproceedings{wang2024towards,
  title={{Towards Robustness Analysis of E-Commerce Ranking System}},
  author={Wang, Ningfei and Huang, Yupin and Cheng, Han and Gesi, Jiri and Wang, Xiaojie and Mittal, Vivek},
  booktitle={Proceedings of the ACM Web Conference 2024 (WWW 2024)},
  year={2024}
}

[AAAI'24] SlowTrack: Increasing the Latency of Camera-based Perception in Autonomous Driving Using Adversarial Examples
Chen Ma*, Ningfei Wang*, Qi Alfred Chen, Chao Shen
The 38th Annual AAAI Conference on Artificial Intelligence (AAAI 2024)
[Paper] [Paper arXiv] [ Code] [bibtex]

@inproceedings{ma2024slowtrack,
  title={{SlowTrack: Increasing the Latency of Camera-Based Perception in Autonomous Driving Using Adversarial Examples}},
  author={Ma, Chen and Wang, Ningfei and Chen, Qi Alfred and Shen, Chao},
  booktitle={Proceedings of the AAAI Conference on Artificial Intelligence},
  volume={38},
  number={5},
  pages={4062--4070},
  year={2024}
}

[CVPR'24] Intriguing Properties of Diffusion Models: A Large-Scale Dataset for Evaluating Natural Attack Capability in Text-to-Image Generative Models
Takami Sato*, Justin Yue*, Nanze Chen*, Ningfei Wang, Qi Alfred Chen
The IEEE/CVF Conference on Computer Vision and Pattern Recognition 2024 (CVPR 2024)
[Paper] [Paper arXiv] [bibtex]

@inproceedings{sato2024intriguing,
  title={{Intriguing Properties of Diffusion Models: A Large-Scale Dataset for Evaluating Natural Attack Capability in Text-to-Image Generative Models}},
  author={Sato, Takami and Yue, Justin and Chen, Nanze and Wang, Ningfei and Chen, Qi Alfred},
  booktitle={Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2024)},
  year={2024}
}

[VehicleSec'24] A Cross-Verification Approach with Publicly Available Map for Detecting Off-Road Attacks against Lane Detection Systems
Takami Sato, Ningfei Wang, Yueqiang Cheng, and Qi Alfred Chen
Inaugural Symposium on Vehicle Security and Privacy 2024 (VehicleSec 2024)
[Paper] [bibtex]

@inproceedings{ma2023wip,
  title={{A Cross-Verification Approach with Publicly Available Map for Detecting Off-Road Attacks against Lane Detection Systems}},
  author={Sato, Takami and Wang, Ningfei and Cheng, Yueqiang and Chen, Qi Alfred},
  booktitle={ISOC Symposium on Vehicle Security and Privacy (VehicleSec)},
  year={2024}
}

2023

[ICCV'23] Does Physical Adversarial Example Really Matter to Autonomous Driving? Towards System-Level Effect of Adversarial Object Evasion Attack
Ningfei Wang, Yunpeng Luo, Takami Sato, Kaidi Xu, Qi Alfred Chen
International Conference on Computer Vision 2023 (ICCV 2023)
[Paper] [Paper arXiv] [Website] [bibtex]

@InProceedings{Wang_2023_ICCV,
    author = {Wang, Ningfei and Luo, Yunpeng and Sato, Takami and Xu, Kaidi and Chen, Qi Alfred},
    title = {{Does Physical Adversarial Example Really Matter to Autonomous Driving? Towards System-Level Effect of Adversarial Object Evasion Attack}},
    booktitle = {Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV)},
    month = {October},
    year = {2023},
    pages = {4412-4423}
}

[VehicleSec'23] WIP: Towards the Practicality of the Adversarial Attack on Object Tracking in Autonomous Driving
Chen Ma, Ningfei Wang, Qi Alfred Chen, Chao Shen
Inaugural Symposium on Vehicle Security and Privacy 2023 (VehicleSec 2023)
[Paper] [bibtex]

@inproceedings{ma2023wip,
  title={{WIP: Towards the Practicality of the Adversarial Attack on Object Tracking in Autonomous Driving}},
  author={Ma, Chen and Wang, Ningfei and Chen, Qi Alfred and Shen, Chao},
  booktitle={ISOC Symposium on Vehicle Security and Privacy (VehicleSec)},
  year={2023}
}

[DAC’23] Invited: Waving the Double-Edged Sword: Building Resilient CAVs with Edge and Cloud Computing
Xiangguo Liu, Yunpeng Luo, Anthony Goeckner, Trishna Chakraborty, Ruochen Jiao, Ningfei Wang, Yixuan Wang, Takami Sato, Qi Alfred Chen, and Qi Zhu
The 60th ACM/IEEE Design Automation Conference 2023 (DAC 2023)
[Paper] [bibtex]

@inproceedings{liu2023waving,
  title={{Waving the Double-Edged Sword: Building Resilient CAVs with Edge and Cloud Computing}},
  author={Liu, Xiangguo and Luo, Yunpeng and Goeckner, Anthony and Chakraborty, Trishna and Jiao, Ruochen and Wang, Ningfei and Wang, Yixuan and Sato, Takami and Chen, Qi Alfred and Zhu, Qi},
  booktitle={2023 60th ACM/IEEE Design Automation Conference (DAC)},
  pages={1--4},
  year={2023},
  organization={IEEE}
}

2022

[AutoSec'22] WIP: Infrastructure-Aided Defense for Autonomous Driving Systems: Opportunities and Challenges
Yunpeng Luo, Ningfei Wang, Bo Yu, Shaoshan Liu, Qi Alfred Chen
The 4th International Workshop on Automotive and Autonomous Vehicle Security (AutoSec 2022)
[Paper] [bibtex]

@inproceedings{luo2022infrastructure,
title={{WIP: Infrastructure-Aided Defense for Autonomous Driving Systems: Opportunities and Challenges}},
author={Luo, Yunpeng and Wang, Ningfei and Yu, Bo and Liu, Shaoshan and Chen, Qi Alfred},
booktitle={NDSS Workshop on Automotive and Autonomous Vehicle Security (AutoSec)},
year={2022}
}

2021

[IEEE S&P'21] Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks
Yulong Cao*, Ningfei Wang*, Chaowei Xiao*, Dawei Yang*, Jin Fang, Ruigang Yang, Qi Alfred Chen, Mingyan Liu, Bo Li
The 42nd IEEE Symposium on Security and Privacy (IEEE S&P 2021)
[Paper] [Paper arXiv] [Preview] [Talk] [Slides] [Website] [bibtex]

@inproceedings{cao2021invisible,
  title={{Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks}},
  author={Cao, Yulong and Wang, Ningfei and Xiao, Chaowei and Yang, Dawei and Fang, Jin and Yang, Ruigang and Chen, Qi Alfred and Liu, Mingyan and Li, Bo},
  booktitle={2021 IEEE Symposium on Security and Privacy (SP)},
  pages={176--194},
  year={2021},
  organization={IEEE}
}

[USENIX Security'21] Dirty Road Can Attack: Security of Deep Learning based Automated LaneCentering under Physical-World Attack
Takami Sato*, Junjie Shen*, Ningfei Wang, Yunhan Jack Jia, Xue Lin, Qi Alfred Chen
The 30th USENIX Security Symposium, Winter Quarter (USENIX Security 2021)
[Paper] [Extended Version] [Website] [bibtex]

@inproceedings{sato2021dirty,
  title={{Dirty Road Can Attack: Security of Deep Learning based Automated LaneCentering under Physical-World Attack}},
  author={Sato, Takami and Shen, Junjie and Wang, Ningfei and Jia, Yunhan and Lin, Xue and Chen, Qi Alfred},
  booktitle={30th USENIX Security Symposium (USENIX Security 21)},
  pages={3309--3326},
  year={2021}
}

[AutoSec'21] WIP: Deployability Improvement, Stealthiness User Study, and Safety Impact Assessment on Real Vehicle for Dirty Road Patch Attack
Takami Sato*, Junjie Shen*, Ningfei Wang, Yunhan Jack Jia, Xue Lin, Qi Alfred Chen
The 3rd International Workshop on Automotive and Autonomous Vehicle Security (AutoSec 2021)
[Paper] [bibtex]

@inproceedings{sato2021wip,
title={{WIP: Deployability Improvement, Stealthiness User Study, and Safety Impact Assessment on Real Vehicle for Dirty Road Patch Attack}},
author={Sato, Takami and Shen, Junjie and Wang, Ningfei and Jia, Yunhan Jack and Lin, Xue and Chen, Qi Alfred},
booktitle={Workshop on Automotive and Autonomous Vehicle Security (AutoSec)},
volume={2021},
pages={25},
year={2021}
}

2020

[USENIX Security'20] Interpretable Deep Learning under Fire
Xinyang Zhang, Ningfei Wang, Hua Shen, Shouling Ji, Xiapu Luo, Ting Wang
The 29th USENIX Security Symposium, Spring Quarter (USENIX Security 2020)
[Paper] [bibtex]

@inproceedings{zhang2020interpretable,
  title={{Interpretable Deep Learning under Fire}},
  author={Zhang, Xinyang and Wang, Ningfei and Shen, Hua and Ji, Shouling and Luo, Xiapu and Wang, Ting},
  booktitle={29th $\{$USENIX$\}$ Security Symposium ($\{$USENIX$\}$ Security 20)},
  year={2020}
}

2019

[USENIX Security'19] Rendered Private: Making GLSL Execution Uniform to Prevent WebGL-based Browser Fingerprinting
Shujiang Wu, Song Li, Yinzhi Cao, Ningfei Wang
The 28th USENIX Security Symposium, Fall Quarter (USENIX Security 2019)
[Paper] [bibtex]

@inproceedings{wu2019rendered,
  title={{Rendered Private: Making GLSL Execution Uniform to Prevent WebGL-based Browser Fingerprinting}},
  author={Wu, Shujiang and Li, Song and Cao, Yinzhi and Wang, Ningfei},
  booktitle={28th USENIX Security Symposium (USENIX Security 19)},
  pages={1645--1660},
  year={2019}
}

2018

[AISec'18] Integration of Static and Dynamic Code Stylometry Analysis for Programmer De-anonymization
Ningfei Wang, Shouling Ji, Ting Wang
The 11th ACM Workshop on Artificial Intelligence and Security (AISec 2018)
Best Paper Award
[Paper] [bibtex]

@inproceedings{wang2018integration,
  title={{Integration of Static and Dynamic Code Stylometry Analysis for Programmer De-anonymization}},
  author={Wang, Ningfei and Ji, Shouling and Wang, Ting},
  booktitle={Proceedings of the 11th ACM Workshop on Artificial Intelligence and Security},
  pages={74--84},
  year={2018}
}

Selected Poster and Demo

[CCS'22] Poster: On the System-Level Effectiveness of Physical Object-Hiding Adversarial Attack in Autonomous Driving
Ningfei Wang, Yunpeng Luo, Takami Sato, Kaidi Xu, Qi Alfred Chen
The ACM Conference on Computer and Communications Security (CCS 2022)
[Poster]
[MLSys'20] Demonstration: 3D Adversarial Object against MSF-based Perception in Autonomous Driving
Yulong Cao*, Ningfei Wang*, Chaowei Xiao*, Dawei Yang*, Jin Fang, Ruigang Yang, Qi Alfred Chen, Mingyan Liu, Bo Li
The 3rd Conference on Machine Learning and Systems (MLSys 2020) Demonstration Track
[Demonstration] [Poster]
[NDSS'20] Poster: Security of Deep Learning based Lane Keeping Assistance System under Physical-World Adversarial Attack
Takami Sato*, Junjie Shen*, Ningfei Wang, Yunhan Jack Jia, Xue Lin and Qi Alfred Chen
Network and Distributed System Security Symposium (NDSS 2020) Poster session, 2020
Best Technical Poster Award
[Poster]

Teaching

Teaching Assistant: COMPSCI 134 Computer and Network Security, 2022 Fall
Teaching Assistant: COMPSCI 134 Computer and Network Security, 2021 Fall

Industry Experience

Applied Scientist Intern at Amazon A9, Palo Alto, CA (2023), working with Yupin Huang and Han Cheng.
Machine Learning Intern at Cheetah Mobile, China (2016), working with Hang Xiao.

Professional Services

Program Committee

EuroS&P: IEEE European Symposium on Security and Privacy, 2025
IJCAI: International Joint Conference on Artificial Intelligence, 2023, 2024
MSN: International Conference on Mobility, Sensing and Networking, 2023
USENIX Security (AE): USENIX Security Symposium Artifact Evaluation (AE), 2023
KDD: ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2023

Reviewer

ICML: International Conference on Machine Learning, 2023, 2024
ICLR: International Conference on Learning Representations, 2023, 2024
SecureComm: International Conference on Security and Privacy in Communication Networks, 2023
NeurIPS: Conference on Neural Information Processing Systems, 2022, 2023
JSS: The Journal of Systems & Software, 2022

Organizer

Autonomous Driving CTF at DEF CON 30, 31 (AutoDriving CTF), Las Vegas, NV, 2022, 2023