Qiao Xiang
Current Organizations / Institutes
The organizations/institutes from the scholar's latest article
Research Subjects
Qiao Xiang has a total of 219 co-authors. Here are the top co-authors by number of shared publications:
- Linghe Kong
Shanghai Jiao Tong University
14 shared publications - Yuwei Xu
Southeast University
11 shared publications - Jiwu Shu
Tsinghua University
10 shared publications - Guang Cheng
School of Cyber Science and Engineering, Southeast University, Nanjing 211189, China
8 shared publications - Xue Liu
Mohamed bin Zayed University of Artificial Intelligence, Abu Dhabi, United Arab Emirates and McGill University, Montreal, Canada
8 shared publications - Jie Cao
Queen’s University
7 shared publications
Latest Publications
- 10 November 2026
- Published by Elsevier in Computers & Security
OnionAdapt: Cross-domain few-shot website fingerprinting attack from surface sites to onion services
- 10 November 2026
- Published by Elsevier in Computers & Security
OnionAdapt: Cross-domain few-shot website fingerprinting attack from surface sites to onion services
- Open Access
- 11 August 2026
- Published by Association for Computing Machinery (ACM)
- p. 1630-1648
RepLLM: Toward Automatically Reproducing Network Research Results
Result reproduction of computer networking research is challenging as the scarcity of open-source implementations and the complexity of heterogeneous system architectures. Even though Large Language Models have demonstrated potential in code generation, existing code generation frameworks often fail to address the long-context constraints and intricate logical dependencies, which are vital in reproducing network systems from academic papers. Thus, we introduce RepLLM, an end-to-end multi-agent framework designed to automate code reproduction from paper content. RepLLM features a collaborative architecture comprising four specialized agents—Content Parsing, Architecture Design, Code Generation, and Audit & Repair, which are coordinated through Shared Memory mechanism to ensure global context consistency. With the enhancement of Structured Chain-of-Thought LLM reasoning and a sandbox-isolated static-dynamic debugging methodology, our framework effectively resolves semantic discrepancies and runtime errors, thereby improving reliable reproductions. Extensive evaluations on representative papers in top conferences demonstrate that RepLLM outperforms state-of-the-art system-level LLM frameworks in generating compile-ready and logically correct systems. Our results show that, with the aid of RepLLM, we can reproduce 95% of the original benchmarks within approximately two hours while reducing token consumption by up to 10% compared with state-of-the-art baselines.
- 11 August 2026
- Published by Association for Computing Machinery (ACM)
- p. 1630-1648
Open AccessRepLLM: Toward Automatically Reproducing Network Research Results
Result reproduction of computer networking research is challenging as the scarcity of open-source implementations and the complexity of heterogeneous system architectures. Even though Large Language Models have demonstrated potential in code generation, existing code generation frameworks often fail to address the long-context constraints and intricate logical dependencies, which are vital in reproducing network systems from academic papers. Thus, we introduce RepLLM, an end-to-end multi-agent framework designed to automate code reproduction from paper content. RepLLM features a collaborative architecture comprising four specialized agents—Content Parsing, Architecture Design, Code Generation, and Audit & Repair, which are coordinated through Shared Memory mechanism to ensure global context consistency. With the enhancement of Structured Chain-of-Thought LLM reasoning and a sandbox-isolated static-dynamic debugging methodology, our framework effectively resolves semantic discrepancies and runtime errors, thereby improving reliable reproductions. Extensive evaluations on representative papers in top conferences demonstrate that RepLLM outperforms state-of-the-art system-level LLM frameworks in generating compile-ready and logically correct systems. Our results show that, with the aid of RepLLM, we can reproduce 95% of the original benchmarks within approximately two hours while reducing token consumption by up to 10% compared with state-of-the-art baselines.
- Open Access
- 11 August 2026
- Published by Association for Computing Machinery (ACM)
- p. 74-91
Towards Efficient Verification of Distributed In-Network Computing Programs
- 11 August 2026
- Published by Association for Computing Machinery (ACM)
- p. 74-91
Open AccessTowards Efficient Verification of Distributed In-Network Computing Programs
- Open Access
- 11 August 2026
- Published by Association for Computing Machinery (ACM)
- p. 1708-1723
Verifying Non-Deterministic Convergence on a Global Production WAN
This paper presents our experience deploying TianYan on Alibaba Cloud's global production WAN, which is, to the best of our knowledge, the first system for verifying non-deterministic convergence on a global production WAN. In daily operation, we rely on simulation-based configuration verifiers that assume a single converged data plane to ensure reliability and performance. However, non-deterministic convergence—where a configuration yields different converged data planes—undermines verification accuracy and has caused a production incident, motivating the need to analyze non-deterministic convergence itself. At scale, this is challenging because the analysis space grows exponentially with the number of routers. TianYan addresses this challenge with a key insight: by leveraging routing similarity among routers within the same group—a common fault-tolerance practice—it reduces exponential complexity from the number of routers to the number of groups, enabling efficient convergence analysis. Over a year of deployment, TianYan identified non-deterministic convergence in ~2% of all prefixes, exposed unnoticed design flaws, and improved simulation-based verification accuracy through integration. We share representative cases and evaluation results from our production WAN, distilling key operational lessons and practical guidelines for managing nondeterminism at scale.
- 11 August 2026
- Published by Association for Computing Machinery (ACM)
- p. 1708-1723
Open AccessVerifying Non-Deterministic Convergence on a Global Production WAN
This paper presents our experience deploying TianYan on Alibaba Cloud's global production WAN, which is, to the best of our knowledge, the first system for verifying non-deterministic convergence on a global production WAN. In daily operation, we rely on simulation-based configuration verifiers that assume a single converged data plane to ensure reliability and performance. However, non-deterministic convergence—where a configuration yields different converged data planes—undermines verification accuracy and has caused a production incident, motivating the need to analyze non-deterministic convergence itself. At scale, this is challenging because the analysis space grows exponentially with the number of routers. TianYan addresses this challenge with a key insight: by leveraging routing similarity among routers within the same group—a common fault-tolerance practice—it reduces exponential complexity from the number of routers to the number of groups, enabling efficient convergence analysis. Over a year of deployment, TianYan identified non-deterministic convergence in ~2% of all prefixes, exposed unnoticed design flaws, and improved simulation-based verification accuracy through integration. We share representative cases and evaluation results from our production WAN, distilling key operational lessons and practical guidelines for managing nondeterminism at scale.
- Open Access
- 8 August 2026
- Published by Association for Computing Machinery (ACM)
- p. 4058-4068
LLM-as-a-Judge for Reliable and Explainable Offline Evaluation in Top-K Recommendation
- 8 August 2026
- Published by Association for Computing Machinery (ACM)
- p. 4058-4068
Open AccessLLM-as-a-Judge for Reliable and Explainable Offline Evaluation in Top-K Recommendation
- Open Access
- 5 August 2026
- Published by Association for Computing Machinery (ACM)
- p. 16-22
AegisPath: Privacy-Preserving Interdomain Data-Plane Verification with Versioned Verifiable Evidence
- 5 August 2026
- Published by Association for Computing Machinery (ACM)
- p. 16-22
Open AccessAegisPath: Privacy-Preserving Interdomain Data-Plane Verification with Versioned Verifiable Evidence
- 1 June 2026
- Published by Institute of Electrical and Electronics Engineers (IEEE) in IEEE Transactions on Mobile Computing
- Vol. PP (15361233) , 1-16
An Overwriting Vulnerability in IoT Authentication Protocols: Attacks and Countermeasures
Authentication protocols are the foundation for se cure communication between Internet of Things (IoT) entities, enabling different entities to mutually authenticate each other and negotiate a session key. We discover an “overwriting vulnerability” that exists in two authentication protocols: [IEEE TMC, 2025, 24(5): 4529-4542] and [JSA, 2024, 152, 103176]. By exploiting this vulnerability, an adversary can easily overwrite the authentication information of honest users on the server side, thus permanently preventing them from completing the authentication. We provide concrete attack methods for the protocols and implement the two protocols with code and successfully conduct attacks on them within a local area network. Then, we propose two distinct countermeasures designed to address the deployment status of the protocol: one is intended for protocols that have already been deployed, and the other for those that are yet to be deployed. Finally, we take the TMC protocol as an example for repair, subsequently discussing the security of the repaired protocol, and conducting comparative experiments and analysis with existing protocols. The experiments demonstrate that the repaired protocol still holds an advantage in terms of security and efficiency.
- 1 June 2026
- Published by Institute of Electrical and Electronics Engineers (IEEE) in IEEE Transactions on Mobile Computing
- Vol. PP (15361233) , 1-16
An Overwriting Vulnerability in IoT Authentication Protocols: Attacks and Countermeasures
Authentication protocols are the foundation for se cure communication between Internet of Things (IoT) entities, enabling different entities to mutually authenticate each other and negotiate a session key. We discover an “overwriting vulnerability” that exists in two authentication protocols: [IEEE TMC, 2025, 24(5): 4529-4542] and [JSA, 2024, 152, 103176]. By exploiting this vulnerability, an adversary can easily overwrite the authentication information of honest users on the server side, thus permanently preventing them from completing the authentication. We provide concrete attack methods for the protocols and implement the two protocols with code and successfully conduct attacks on them within a local area network. Then, we propose two distinct countermeasures designed to address the deployment status of the protocol: one is intended for protocols that have already been deployed, and the other for those that are yet to be deployed. Finally, we take the TMC protocol as an example for repair, subsequently discussing the security of the repaired protocol, and conducting comparative experiments and analysis with existing protocols. The experiments demonstrate that the repaired protocol still holds an advantage in terms of security and efficiency.
- 18 May 2026
- Published by Institute of Electrical and Electronics Engineers (IEEE) in IEEE Transactions on Networking
- Vol. 34, 5303-5318
Loss-Tolerant RDMA Network Over Commodity Devices
This paper proposes the concept of a “loss-tolerant” RDMA network, instantiating as NüWa. It reveals the fundamental issues under a lossy fabric — packet losses and repetitive retransmission timeouts (RTOs) cause severe performance degradation and even service interruption. The loss-tolerant RDMA must avoid “important” packet losses that trigger RTOs. However, existing loss-protection mechanisms fail to identify these packets precisely. They either generate massive misprotection or ignore selective repeat loss recovery, resulting in buffer overflows and failures of RTO protection. To tackle these issues, NüWa thoroughly analyzes distinct loss-recovery schemes and RTO reasons for commodity NICs. It designs switch mode and NIC mode to accurately identify and protect all important packets. The switch mode inherently supports the widely deployed non-programmable NICs, while the NIC mode offloads identification complexity to advanced programmable NICs. With effective RTO avoidance, it improves flow completion time (FCT) by 2 ∼ 10× compared to state-of-the-art (SOTA) solutions. In severe incast and large-scale networks, it reduces FCT by 100× compared with a lossless fabric. In storage applications, N¨uWa improves IOPS by ∼ 300% compared to vanilla lossy fabric. For typical AI Workloads, it accelerates AllReduce/AlltoAll communication by 5.5 ∼ 13.7× compared to SOTA lossy network solutions.
- 18 May 2026
- Published by Institute of Electrical and Electronics Engineers (IEEE) in IEEE Transactions on Networking
- Vol. 34, 5303-5318
Loss-Tolerant RDMA Network Over Commodity Devices
This paper proposes the concept of a “loss-tolerant” RDMA network, instantiating as NüWa. It reveals the fundamental issues under a lossy fabric — packet losses and repetitive retransmission timeouts (RTOs) cause severe performance degradation and even service interruption. The loss-tolerant RDMA must avoid “important” packet losses that trigger RTOs. However, existing loss-protection mechanisms fail to identify these packets precisely. They either generate massive misprotection or ignore selective repeat loss recovery, resulting in buffer overflows and failures of RTO protection. To tackle these issues, NüWa thoroughly analyzes distinct loss-recovery schemes and RTO reasons for commodity NICs. It designs switch mode and NIC mode to accurately identify and protect all important packets. The switch mode inherently supports the widely deployed non-programmable NICs, while the NIC mode offloads identification complexity to advanced programmable NICs. With effective RTO avoidance, it improves flow completion time (FCT) by 2 ∼ 10× compared to state-of-the-art (SOTA) solutions. In severe incast and large-scale networks, it reduces FCT by 100× compared with a lossless fabric. In storage applications, N¨uWa improves IOPS by ∼ 300% compared to vanilla lossy fabric. For typical AI Workloads, it accelerates AllReduce/AlltoAll communication by 5.5 ∼ 13.7× compared to SOTA lossy network solutions.
- 2 April 2026
- Published by Institute of Electrical and Electronics Engineers (IEEE) in IEEE Transactions on Mobile Computing
- Vol. PP (15361233) , 1-18
Development and Deployment of Jami: Experiences with a Mobile Distributed Communication Platform
This paper introduces Jami, a pioneering mobile communication platform that significantly departs from conventional online communication norms. Unlike traditional platforms that depend on centralized servers and intermediaries, Jami is constructed on a distributed architecture that harnesses the power of peer-to-peer (P2P) technology. This innovative design enables secure, end-to-end encrypted communication, ensuring that users maintain full control over their data without reliance on third-party entities. By prioritizing decentralization, Jami significantly enhances user privacy and security while democratizing the communication process, empowering individuals with unparalleled autonomy over their interactions. As an officially recognized GNU package, Jami upholds the highest standards of transparency, freedom, and trust, embodying the principles of open-source development. It fosters a collaborative, community-oriented development model, ensuring continuous innovation and adaptability. This paper delves into Jami's architectural intricacies and real-world deployment experiences, showcasing how its novel design challenges conventional paradigms and highlights its transformative potential to reshape the future landscape of digital communication. Through this exploration, the study aims to contribute to a deeper understanding of mobile distributed systems and their pivotal role in advancing secure, equitable, and user-focused technological solutions.
- 2 April 2026
- Published by Institute of Electrical and Electronics Engineers (IEEE) in IEEE Transactions on Mobile Computing
- Vol. PP (15361233) , 1-18
Development and Deployment of Jami: Experiences with a Mobile Distributed Communication Platform
This paper introduces Jami, a pioneering mobile communication platform that significantly departs from conventional online communication norms. Unlike traditional platforms that depend on centralized servers and intermediaries, Jami is constructed on a distributed architecture that harnesses the power of peer-to-peer (P2P) technology. This innovative design enables secure, end-to-end encrypted communication, ensuring that users maintain full control over their data without reliance on third-party entities. By prioritizing decentralization, Jami significantly enhances user privacy and security while democratizing the communication process, empowering individuals with unparalleled autonomy over their interactions. As an officially recognized GNU package, Jami upholds the highest standards of transparency, freedom, and trust, embodying the principles of open-source development. It fosters a collaborative, community-oriented development model, ensuring continuous innovation and adaptability. This paper delves into Jami's architectural intricacies and real-world deployment experiences, showcasing how its novel design challenges conventional paradigms and highlights its transformative potential to reshape the future landscape of digital communication. Through this exploration, the study aims to contribute to a deeper understanding of mobile distributed systems and their pivotal role in advancing secure, equitable, and user-focused technological solutions.