Applied Scientist
About
1Introduction
These days I mainly work on two things: memory and routing. Memory is deciding what an agent should keep from what it has seen, what to let go, and how to find it again later; routing is deciding which model should answer a question, how well, and at what cost. Unassuming work, but a system that runs for years rests on it. People are not so different: what you remember and what you forget is, slowly, who you become. Back in school I wrote two papers on agent security. Off hours: video games, football, pool, and board games, always.
2Research Interests
In rough order of time spent.
- Agent Memory
- What to write down, when to merge it, how to recall it without poisoning the context.
- LLM Routing
- Quality, latency, cost. The three rarely agree.
- LLM Security
- How retrieval and tool-calling break, and what that says about building them.
3Experience
- 2025 — Present
Applied Scientist ·Tencent
Memory and routing for production assistants.
- 2025
Research Intern ·Siemens
An agent for automated code review.
- 2023 — 2024
Backend Intern ·NetEase Youdao
Backend for youdaoads, the overseas advertising platform.
4Education
- 2022 — 2025
M.Eng. in Computer Software and Theory
Institute of Software, Chinese Academy of Sciences
Security of retrieval-augmented and tool-calling LLM systems.
- 2019 — 2023
B.Eng. in Software Engineering
Beijing Jiaotong University
Where the software half started.
5Publications
* denotes equal contribution.
- [1]
Joint-GCG: Unified Gradient-Based Poisoning Attacks on Retrieval-Augmented Generation Systems
Haowei Wang*, Rupeng Zhang*, Junjie Wang, Mingyang Li, Yuekai Huang, Dandan Wang, Qing Wang
Proceedings of the AAAI Conference on Artificial IntelligenceAAAI 2026· Co-first author
A framework that unifies gradient-based poisoning against RAG systems by jointly optimizing the attack for the retriever and the generator, rather than treating them as two separate targets.
- [2]
ToolCommander: Adversarial Tool Injection against LLM Tool-Calling Systems
Rupeng Zhang, Haowei Wang, Junjie Wang, Mingyang Li, Yuekai Huang, Dandan Wang, Qing Wang
Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the ACL (Main, Long Papers)NAACL 2025· First author
A framework that exploits vulnerabilities in LLM tool-calling systems, enabling privacy theft, denial-of-service attacks, and business competition manipulation through adversarial tool injection.
6Elsewhere
Colophon
Nuxt and Nuxt Content, set in Latin Modern after LaTeX.css. The front-page figure is drawn in three.js. Deployed on Cloudflare, source on GitHub.