Luyi Xing
University of Illinois Urbana-Champaign, IL·Computer Science·Early-career
Connected software now acts on our behalf: smart-home and industrial devices talk to cloud services, and AI agents exchange messages with other agents and with people. In both cases the machines are trusted to take real actions, yet the protocols and cloud platforms that carry those messages were not designed with strong security guarantees.
- Fields
Computer Science
Engineering
- Topics
IoT security
Internet of Things
cloud security
- Grants
- 3 known grants, through Aug 2028
What they work on
- Analyze attacks on AI agent messaging under the NLIP open standard, including authorization weaknesses, session hijacking, cost-amplification abuse, memory poisoning, prompt injection and semantic manipulation of message content.
- Design and implement protocol-level defenses that use NLIP's message envelopes and control fields as enforcement points for message validation, authorization checks and policy constraints, and test them across multiple agent frameworks and enterprise systems.
- Establish FHS-IoT, a nonprofit open-source ecosystem for IoT standards security, with a continuous integration and delivery pipeline that runs formal and human-centered verification tools, plus governance models and a contributor community.
- Formalize the security threats introduced by IoT interoperability between devices from different vendors, and formally verify the security of IoT cloud systems and protocols against those threats.
- Characterize attacks that exploit manufacturer misconfiguration of cloud IoT access policies, and develop formal modeling and verification approaches that raise assurance for policy specification and cloud-based device deployments.
- Build a systematized IoT-cloud security framework including a clean-slate secure design for interoperability protocols, an in-device channel control mechanism, and a hardened supply chain for IoT brokers, the message-routing core of IoT clouds.
More about the research
The common thread across these projects is securing the communication and configuration layer itself, rather than patching each application separately, and building open-source tools and communities so the protections keep being maintained.
Why it matters
Compromised IoT cloud deployments can have physical consequences in homes, hospitals, factories and city infrastructure, and insecure AI agent messaging risks unintended actions, data exposure and system failures in government and business systems. Protocol-level defenses, verified standards and open-source verification tooling could let device makers and developers build secure-by-design systems and meet emerging compliance requirements, with the tools freely available to industry analysts, researchers and students.
Known grants
From NIH and NSF research grants. Labs often have other funding we can't see.
NSF Safe-OSE: Center for Security-Assuring AI Agent Communication and Interoperability Standard and the Open-Source Ecosystem
NSF · Sep 2026 – Aug 2028
POSE: Phase I: Center for Formal and Human-Centered Security Verification in Internet of Things (IoT) Standards and Standardization
NSF · Oct 2025 – Aug 2027
CAREER: Foundations for IoT Cloud Security
NSF · Sep 2025 – Jul 2027
Closest labs
Xing Gao
University of Delaware, DE·Computer Science·Early-career
Build a security testing system that combines dynamic execution and static analysis to examine every critical component of continuous software development pipelines and how each interacts with the people and organizations involved.
Justin Cappos
New York University, NY·Computer Science
Build a command-line framework that automatically records software artifacts, environments, dependencies and actions during experiments, so computational studies can be rebuilt and rerun in the cloud for independent verification.
Yueqi Chen
University of Colorado Boulder, CO·Computer Science
Refactor the Community Earth System Model (CESM) codebase by decoupling its computational and control logic and rewriting the control layer in Python, so that modern security practices can be integrated.
The school
University of Illinois Urbana-Champaign: 41 labs on PI Pages, $907M a year on research, 870 research doctorates a year.
Reach out
A start for your email. Fill in the brackets.