Applied Scientist

About

1Introduction

These days I mainly work on two things: memory and routing. Memory is deciding what an agent should keep from what it has seen, what to let go, and how to find it again later; routing is deciding which model should answer a question, how well, and at what cost. Unassuming work, but a system that runs for years rests on it. People are not so different: what you remember and what you forget is, slowly, who you become. Back in school I wrote two papers on agent security. Off hours: video games, football, pool, and board games, always.

2Research Interests

In rough order of time spent.

Agent Memory
What to write down, when to merge it, how to recall it without poisoning the context.
LLM Routing
Quality, latency, cost. The three rarely agree.
LLM Security
How retrieval and tool-calling break, and what that says about building them.

3Experience

  • 2025 — Present

    Applied Scientist ·Tencent

    Memory and routing for production assistants.

  • 2025

    Research Intern ·Siemens

    An agent for automated code review.

  • 2023 — 2024

    Backend Intern ·NetEase Youdao

    Backend for youdaoads, the overseas advertising platform.

4Education

  • 2022 — 2025

    M.Eng. in Computer Software and Theory

    Institute of Software, Chinese Academy of Sciences

    Security of retrieval-augmented and tool-calling LLM systems.

  • 2019 — 2023

    B.Eng. in Software Engineering

    Beijing Jiaotong University

    Where the software half started.

5Publications

* denotes equal contribution.

  1. [1]

    Joint-GCG: Unified Gradient-Based Poisoning Attacks on Retrieval-Augmented Generation Systems

    Haowei Wang*, Rupeng Zhang*, Junjie Wang, Mingyang Li, Yuekai Huang, Dandan Wang, Qing Wang

    Proceedings of the AAAI Conference on Artificial IntelligenceAAAI 2026· Co-first author

    A framework that unifies gradient-based poisoning against RAG systems by jointly optimizing the attack for the retriever and the generator, rather than treating them as two separate targets.

  2. [2]

    ToolCommander: Adversarial Tool Injection against LLM Tool-Calling Systems

    Rupeng Zhang, Haowei Wang, Junjie Wang, Mingyang Li, Yuekai Huang, Dandan Wang, Qing Wang

    Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the ACL (Main, Long Papers)NAACL 2025· First author

    A framework that exploits vulnerabilities in LLM tool-calling systems, enabling privacy theft, denial-of-service attacks, and business competition manipulation through adversarial tool injection.

6Elsewhere

Colophon

Nuxt and Nuxt Content, set in Latin Modern after LaTeX.css. The front-page figure is drawn in three.js. Deployed on Cloudflare, source on GitHub.