Hengkai Ye

Bio

I am a fourth-year Ph.D. student at Penn State University, advised by Prof. Hong Hu. Before joining Penn State University, I obtained my Bachelor's degree from Huazhong University of Science and Technology and Master's degree from Purdue University. My research interests include Software and System Security.

Publications

Conference Proceedings

1. ContractGuard: Auditing Semantic Contracts of MCP Tools for Security Violations
   Hengkai Ye, Zhechang Zhang, Ruibo Lu, Jinyuan Jia and Hong Hu
   In Proceedings of the ACM Conference on Computer and Communications Security (CCS 2026)
   Model Context Protocol (MCP) is rapidly emerging as a standard interface for connecting large language model (LLM) applications to external tools. An MCP tool exposes two semantic views of the same functionality: a developer-provided description that guides the LLM’s tool selection, and an implementation that determines the actual runtime behavior. Security issues arise when these two views diverge, leading to instruction injection, misleading descriptions, malicious code, or unsafe implementations. Existing defenses analyze descriptions or implementations largely in isolation, and thus, fail to address this broader threat space in a unified manner. We present ContractGuard, the first security-oriented framework for bidirectional semantic contract auditing of MCP tools. Our observation is that diverse MCP threats can be unified as violations of a semantic contract between a tool’s description and its implementation. ContractGuard combines reachability-aware static analysis with LLM-based cross-view reasoning for auditing. It extracts a tool-specific code slice, generates a code-grounded description, compares it against the developer-provided one, and validates and classifies detected inconsistencies. We evaluate our method on 3,586 MCP tools from 1,000 real-world MCP servers and 5,661 benchmark cases. Our tool uncovers 116 security issues in the wild, including 21 misleading descriptions, 29 instances of potentially malicious code, and 66 unsafe implementations. It achieves 96.0% true positive rate on malicious-code benchmarks, and more than 92.8% true positive rate on description-attack benchmarks. Results show that contract auditing can effectively identify security-relevant description–implementation mismatches in MCP tools.
   

2. NCFuzz: Configuration-guided Network Service Fuzzing
   Xuesong Bai, Hengkai Ye, Shenghan Zheng, Fenglu Zhang, Hong Hu and Zhou Li
   In Proceedings of the 35th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA 2026)
   Network services like FTP and DNS are critical components of modern dependable cyberspace infrastructure. Software fuzzing, especially network protocol fuzzing, is widely used to uncover flaws in these systems. However, conventional fuzzers operate under a single, fixed configuration throughout the fuzzing campaign, leaving the service’s rich configuration space unexplored. Incorporating configurations as a dynamic input dimension is challenging due to complex semantics, trigger conditions, and the resulting enlarged search space. We tackle the problem of finding bugs under non-default configurations, termed ConfBug, by designing a new fuzzer called NCFuzz. The non-default configurations can be esoteric but the administrators may enable them, which cannot be exercised by conventional fuzzers. With the assumption of the availability of software documentation that describes configuration options, NCFuzz leverages two key observations: 1) software documentation contains rich information about configurations; 2) interactions between configuration and network messages can be tracked through code instrumentation and data-flow analysis. Using these insights, NCFuzz uses configuration knowledge and configuration-network-message relation to guide the fuzzer towards new software states. The quality and completeness of the documentation will impact the effectiveness of NCFuzz. Evaluations on six network service implementations show NCFuzz achieves higher coverage than baseline fuzzers. Five ConfBug were discovered during fuzzing.
   

3. SACK: Systematic Generation of Function Substitution Attacks Against Control-Flow Integrity
   Zhechang Zhang, Hengkai Ye, Song Liu and Hong Hu
   In Proceedings of the 33th Annual Network and Distributed System Security Symposium (NDSS 2026)
   Control-flow integrity (CFI) is a widely adopted defense against control-flow hijacking attacks, designed to restrict indirect control transfers to a set of legitimate targets. However, even under a precise static CFI policy, attackers can still hijack control flow through function substitution attacks (Sub attacks), by replacing one valid target with another that remains within the allowed set. While prior work has demonstrated the feasibility of such attacks through manual construction, their practical prevalence and systematic generation remain largely unexplored. In this work, we present SACK, the first systematic framework for automatically constructing Sub attacks at scale. SACK collects triggered indirect call targets from benign executions and synthesizes security oracles with the assistance of a large language model. It then automatically performs target substitutions and leverages security oracles to detect security violations, while ensuring that execution strictly adheres to precise CFI policies. We apply SACK to seven widely used applications and successfully construct 419 Sub attacks that compromise critical security features. We further develop five end-to-end exploits based on historical bugs in SQLite3, V8 and Nginx, enabling arbitrary command execution or authentication bypass. Our results demonstrate that Sub attacks are practical, prevalent, and systematically constructible, posing a serious threat even under ideal CFI enforcement.
   

4. Too Subtle to Notice: Investigating Executable Stack Issues in Linux System
   Hengkai Ye and Hong Hu
   In Proceedings of the 32th Annual Network and Distributed System Security Symposium (NDSS 2025)
   Code injection was a favored technique for attackers to exploit buffer overflow vulnerabilities decades ago. Subsequently, the widespread adoption of lightweight solutions like write-xor-execute (W⊕X) effectively mitigated most of these attacks by disallowing writable-and-executable memory. However, we observe multiple concerning cases where software developers accidentally disabled W⊕X and reintroduced executable stacks to popular applications. Although each individual violation has been properly fixed, a lingering question remains: what underlying factors contribute to these recurrent mistakes among developers, even in contemporary software development practices? In this paper, we conduct two investigations aimed at gaining a comprehensive understanding of the challenges associated with properly enforcing W⊕X in Linux systems. First, we delve into program-hardening tools to assess whether experienced security developers consistently catch the necessary steps to avoid executable stacks. Second, we analyze the enforcement of W⊕X on Linux by inspecting the source code of the compilation toolchain, the kernel and the loader. Our investigation reveals that properly enforcing W⊕X on Linux requires close collaboration among multiple components. These tools form a complex chain of trust and dependency to safeguard the program stack. However, developers, including security researchers, may overlook the subtle yet essential .note.GNU-stack section when writing assembly code for various purposes, and inadvertently introduce executable stacks. For example, 11 program-hardening tools implemented as inlined reference monitors (IRM) introduce executable stacks to all hardened applications. Based on these findings, we discuss potential exploitation scenarios by attackers and provide suggestions to mitigate this issue.
   

5. VIPER: Spotting Syscall-Guard Variables for Data-Only Attacks
   Hengkai Ye, Song Liu, Zhechang Zhang and Hong Hu
   In Proceedings of the 32nd USENIX Security Symposium (Security 2023)
   As control-flow protection techniques are widely deployed, it is difficult for attackers to modify control data, like function pointers, to hijack program control flow. Instead, data-only attacks corrupt security-critical non-control data (critical data), and can bypass all control-flow protections to revive severe attacks. Previous works have explored various methods to help construct or prevent data-only attacks. However, no solution can automatically detect program-specific critical data. In this paper, we identify an important category of critical data, syscall-guard variables, and propose a set of solutions to automatically detect such variables in a scalable manner. Syscall-guard variables determine to invoke security-related system calls (syscalls), and altering them will allow attackers to request extra privileges from the operating system. We propose branch force, which intentionally flips every conditional branch during the execution and checks whether new security-related syscalls are invoked. If so, we conduct dataflow analysis to estimate the feasibility to flip such branches through common memory errors. We build a tool, VIPER, to implement our ideas. VIPER successfully detects 34 previously unknown syscall-guard variables from 13 programs. We build four new data-only attacks on sqlite and v8, which execute arbitrary command or delete arbitrary file. VIPER completes its analysis within five minutes for most programs, showing its practicality for spotting syscall-guard variables
   

6. BET: Black-box Efficient Testing for Convolutional Neural Networks
   Jialai Wang, Han Qiu, Yi Rong, Hengkai Ye, Qi Li, Zongpeng Li and Chao Zhang
   In Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA 2022)
   Testing Convolutional neural networks (CNNs) to find defects (e.g. error-inducing inputs) before deploying them in security-sensitive scenarios is crucial. Although existing white-box testing methods can effectively test CNN models with high coverage achieved, requiring full knowledge of target CNN models which may not always be available in privacy-sensitive scenarios. In this paper, we propose a novel Black-box Efficient Testing (BET) method for CNN models. The core insight of BET is that CNNs are generally prone to be affected by continuous perturbations. Thus, by generating such continuous perturbations in a black-box manner, we design a tunable objective function to guide our testing process for thoroughly exploring defects in different decision boundaries of target CNN models. We also design an efficiency-centric policy to find more error-inducing inputs with a fixed query budget. We conduct extensive evaluations with three well-known datasets and five popular CNN structures. The results show that BET significantly outperforms existing white-box or black-box testing methods considering the effective error-inducing inputs found in a fixed query/inference budget. We further show that the error-inducing inputs found by BET can be used to fine-tune the target model to improve the accuracy by up to 3%.
   

Journal Articles

1. Interpreting Deep Learning-based Vulnerability Detector Predictions Based on Heuristic Searching
   Deqing Zou, Yawei Zhu, Shouhuai Xu, Zhen Li, Hai Jin and Hengkai Ye
   In ACM Transactions on Software Engineering and Methodology (TOSEM), 2021
   Detecting software vulnerabilities is an important problem and a recent development in tackling the problem is the use of deep learning models to detect software vulnerabilities. While effective, it is hard to explain why a deep learning model predicts a piece of code as vulnerable or not because of the black-box nature of deep learning models. Indeed, the interpretability of deep learning models is a daunting open problem. In this article, we make a significant step toward tackling the interpretability of deep learning model in vulnerability detection. Specifically, we introduce a high-fidelity explanation framework, which aims to identify a small number of tokens that make significant contributions to a detector's prediction with respect to an example. Systematic experiments show that the framework indeed has a higher fidelity than existing methods, especially when features are not independent of each other (which often occurs in the real world). In particular, the framework can produce some vulnerability rules that can be understood by domain experts for accepting a detector's outputs (i.e., true positives) or rejecting a detector's outputs (i.e., false-positives and false-negatives). We also discuss limitations of the present study, which indicate interesting open problems for future research.
   

Others

1. Executable Stack Issues in Software Transformation
   (Workshop)
   Hengkai Ye, Hong Hu
   In Workshop on Forming an Ecosystem Around Software Transformation (FEAST 2024)
2. One Flip is All It Takes: Identifying Syscall-Guard Variables for Data-Only Attacks
   (Industry Conference)
   Hengkai Ye, Hong Hu, Song Liu and Zhechang Zhang
   Black Hat Asia Briefings (Black Hat Asia 2024)

Preprint

1. TrustDesc: Preventing Tool Poisoning in LLM Applications via Trusted Description Generation
   Hengkai Ye, Zhechang Zhang, Jinyuan Jia and Hong Hu
   arXiv preprint arXiv:2604.07536, 2026
   Large language models (LLMs) increasingly rely on external tools to perform time-sensitive tasks and real-world actions. While tool integration expands LLM capabilities, it also introduces a new prompt-injection attack surface: tool poisoning attacks (TPAs). Attackers manipulate tool descriptions by embedding malicious instructions (explicit TPAs) or misleading claims (implicit TPAs) to influence model behavior and tool selection. Existing defenses mainly detect anomalous instructions and remain ineffective against implicit TPAs. In this paper, we present TrustDesc, the first framework for preventing tool poisoning by automatically generating trusted tool descriptions from implementations. TrustDesc derives implementation-faithful descriptions through a three-stage pipeline. SliceMin performs reachability-aware static analysis and LLM-guided debloating to extract minimal tool-relevant code slices. DescGen synthesizes descriptions from these slices while mitigating misleading or adversarial code artifacts. DynVer refines descriptions through dynamic verification by executing synthesized tasks and validating behavioral claims. We evaluate TrustDesc on 52 real-world tools across multiple tool ecosystems. Results show that TrustDesc produces accurate tool descriptions that improve task completion rates while mitigating implicit TPAs at their root, with minimal time and monetary overhead.