🧑‍🔬 Chaowei Xiao

🏛️ Affiliations

🏢NvidiaSanta Clara · United States2018–2026 · 29 papersEmploymentcurrent🎓Johns Hopkins UniversityBaltimore · United States2025–2026 · 21 papersEmploymentcurrent🏢NvidiaReading · United Kingdom2018–2026 · 18 paperscurrent🔬Johns Hopkins University Applied Physics LaboratoryNorth Laurel · United States2026 · 1 papercurrent🎓University of Southern CaliforniaLos Angeles · United States2026 · 1 papercurrent🎓University of Wisconsin–MadisonMadison · United States2023–2025 · 44 papers🎓Arizona State UniversityTempe · United States2021–2023 · 20 papersEmployment🎓University of MichiganAnn Arbor · United States2015–2021 · 16 papersEducation since 2015 · Computer Science and Engineering🎓University of California, DavisDavis · United States2023–2025 · 4 papers🎓Washington University in St. LouisSt Louis · United States2017–2024 · 2 papers

From the bylines of their papers (OpenAlex, 2026-10-14), ORCID and Wikidata; institutions on papers are matched by machine. 7 more institutions on single bylines are not listed.

🧭 Fields, topics and concepts

Of its works in our library, with the number of works on each.

📅 Works by year

2020s

📄 Papers

The most cited first (OpenAlex and our library).

1. AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models (2023 · 350 citations)
   Jailbreak attacks push safety-aligned LLMs into answering requests they should refuse. Earlier approaches fall into two camps. Hand-written prompts, such as the "Do-Anything-Now (DAN)" family, scale poorly and lose effectiveness as models are updated. Gradient-guided token search, such as GCG, produces gibberish…
2. AGrail: A Lifelong Agent Guardrail with Effective and Adaptive Safety Detection (2025 · 20 citations)
   LLM-based agents that run shell commands, browse websites or query databases can cause harm in two ways. Task-specific risks break rules that an administrator sets for a given job, such as access restrictions on medical records. Systemic risks threaten confidentiality, integrity or availability, for example through…
3. PIGuard: Prompt Injection Guardrail via Mitigating Overdefense for Free (2025 · 16 citations)
   Lightweight prompt guard classifiers screen LLM inputs for prompt injection, but they often learn a shortcut.

All works

20 works of theirs in our library, the most cited first; 3 with a page here, the others link their original until we summarise them.

1. Robust Physical-World Attacks on Deep Learning Visual Classification ↗IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · no summary yetKevin Eykholt et al.2018 · 2,112 citations
2. Generating Adversarial Examples with Adversarial Networks ↗International Joint Conference on Artificial Intelligence · no summary yetChaowei Xiao et al.2018 · 928 citations
3. Voyager: An Open-Ended Embodied Agent with Large Language Models ↗arXiv:2305.16291 · no summary yetGuanzhi Wang et al.2023 · 639 citations
4. AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language ModelsarXiv:2310.04451Xiaogeng Liu, Nan Xu, Muhao Chen, et al.2023 · 350 citations
5. Spatially Transformed Adversarial Examples ↗arXiv (Cornell University) · no summary yetChaowei Xiao et al.2018 · 287 citations
6. VoxFormer: Sparse Voxel Transformer for Camera-based 3D Semantic Scene Completion ↗arXiv:2302.12251 · no summary yetYiming Li et al.2023 · 263 citations
7. Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentation ↗Lecture notes in computer science · no summary yetChaowei Xiao et al.2018 · 94 citations
8. Test-Time Prompt Tuning for Zero-Shot Generalization in Vision-Language Models ↗neural information processing systems · no summary yetManli Shu et al.2022 · 85 citations
9. JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks ↗arXiv:2404.03027 · no summary yetWeidi Luo et al.2024 · 66 citations
10. MuirBench: A Comprehensive Benchmark for Robust Multi-image Understanding ↗arXiv (Cornell University) · no summary yetFei Wang et al.2024 · 48 citations
11. Re-ViLM: Retrieval-Augmented Visual Language Model for Zero and Few-Shot Image Captioning ↗Findings of the Association for Computational Linguistics: EMNLP 2023 · no summary yetZhuolin Yang et al.2023 · 44 citations
12. AdvIT: Adversarial Frames Identifier Based on Temporal Consistency in Videos ↗IEEE/CVF International Conference on Computer Vision (ICCV) · no summary yetChaowei Xiao et al.2019 · 44 citations
13. Data Poisoning Attack against Unsupervised Node Embedding Methods ↗arXiv (Cornell University) · no summary yetMingjie Sun et al.2018 · 39 citations
14. AGrail: A Lifelong Agent Guardrail with Effective and Adaptive Safety DetectionAnnual Meeting of the Association for Computational Linguistics (ACL)Weidi Luo, Shenghong Dai, Xiaogeng Liu, et al.2025 · 20 citations
15. DensePure: Understanding Diffusion Models towards Adversarial Robustness ↗CaltechAUTHORS (California Institute of Technology) · no summary yetChaowei Xiao et al.2022 · 18 citations
16. PIGuard: Prompt Injection Guardrail via Mitigating Overdefense for FreeAnnual Meeting of the Association for Computational Linguistics (ACL)Hao Li, Xiaogeng Liu, Ning Zhang, et al.2025 · 16 citations
17. When Are Teacher Tokens Reliable? Position-Weighted On-Policy Self-Distillation for Reasoning ↗arXiv:2605.21606 · no summary yetXiaogeng Liu et al.2026 · 8 citations
18. AI Risk Management Should Incorporate Both Safety and Security ↗arXiv (Cornell University) · no summary yetXiangyu Qi et al.2024 · 3 citations
19. DecodingTrust-Agent Platform (DTap): A Controllable and Interactive Red-Teaming Platform for AI Agents ↗arXiv (Cornell University) · no summary yetZhaorun Chen et al.2026
20. ADVM'21 ↗ACM International Conference on Multimedia (ACM MM) · no summary yetAishan Liu et al.2021

🤝 Co-authors here

8 co-authors with a page, the most papers together first.

• Xiaogeng Liu ×3
• Muhao Chen ×2
• Hao Li
• Huan Sun
• Nan Xu
• Ning Zhang
• Suman Banerjee
• Weidi Luo

Venues

Where their works here were published, the most works first, with the editions of those that have a page.

• Annual Meeting of the Association for Computational Linguistics (ACL) ×2: ACL 2025 ×2
• ACM International Conference on Multimedia (ACM MM)
• CaltechAUTHORS (California Institute of Technology)
• Findings of the Association for Computational Linguistics: EMNLP 2023
• IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings
• IEEE/CVF International Conference on Computer Vision (ICCV)
• International Joint Conference on Artificial Intelligence
• Lecture notes in computer science
• neural information processing systems

🔗 Cited by

Papers of our library cite their works 1,203 times (of the 149,439 papers whose bibliographies we read); 237 citing papers with a page here →.

Updated 30 October 2026

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/authors/chaowei-xiao/