Zheng Gao
Menu

ZhengGao

We are what we repeatedly do. Excellence, then, is not an act, but a habit.

after Aristotle, Nicomachean Ethics

M.Phil. researcher at UNSW Sydney, working on the security and safety of generative AI.

Read the papers

Can we trust what a machine made?

Generative models now make pictures, voices and decisions that pass for ours. My research keeps track of what they made.

Mark. Watermarks hidden in generated images, audio-visual media and the trajectories of LLM agents, built to survive attempts to erase them.

Break. Attacks on those watermarks, to find where they fail before anyone else does.

Detect. What forensics can and cannot recover, and how to tell the genuine from the forged.

Around it. The reliability and privacy of LLM agents, robust graph learning, and efficient diffusion sampling and architecture search.

Advised by Dr Jiaojiao Jiang in the School of Computer Science and Engineering.

The starting noise of a diffusion model, with a key planted in its Fourier spectrum: invisible in the pixels, plain in the frequencies. Move the lens (or use the arrow keys) to switch domains.

Selected work

  • SLICE

    Mark · BMVC 2026, oral

    A watermark kept in compartments of the semantic latent, so it outlives regeneration.

    Figure 1 of the paper. The overall framework of SLICE.

  • CSI

    Break · WWW 2026

    An LLM rewrites what a picture means, coherently, and the semantic watermark lets go.

    Figure 1 of the paper. The overall workflow of the proposed Coherence-Preserving Semantic Injection (CSI) attack.

  • SHIFT

    Break · NeurIPS 2026 STODY workshop, oral

    A training-free deflection of the denoising path that removes diffusion watermarks.

    Figure 1 of the paper. The overall framework of SHIFT.

  • LAVA

    Mark and detect · ACM MM 2026

    A layered audio-visual watermark that finds a deepfake and the moment it was cut in.

    Figure 1 of the paper. Overview of the LAVA pipeline.

  • TRACE

    Mark · preprint, with a live demo

    Two channels sign an LLM agent’s trajectory and still name it after steps are cut.

    Figure 1 of the paper. The reseller threat model: the adversary owns the evidence it audits.

Publications, accepted

Capacity Meters That Change SignWACV2027
Quantize Where the Noise HidesWACV2027
SHIFTNeurIPS workshop, STODYOral2026
Sharp Privacy ProfilesNeurIPS workshop, InfPrivPoster2026
How Much Must We Test After an Agent Update?NeurIPS workshop, CLPoster2026
SLICEBMVCOral2026
LAVAACM Multimedia2026
BIPECCV2026
Breaking Semantic-Aware WatermarksWWW2026
Conformal Calibration of Co-Visibility ScoresDICTA2026
GSCNetJVCIRJournal2026
G-RXADAICIT2024

All 22 publications, with preprints

About

Portrait of Zheng Gao
Based in
Sydney, Australia
Programme
M.Phil., Computer Science and Engineering, UNSW
Advisor
Dr Jiaojiao Jiang, Senior Lecturer and ARC DECRA Fellow

Before UNSW I studied data science at City University of Macau, where I published my first paper, on attack detection.

Off hours, with Xiaoyu Li, I make AI pictures, short films and a small pixel-art game. They hang in the Playground.

Record

Experience

  • Research assistant (casual), UNSW: a watermark benchmarkOct 2026–
  • Research assistant, UNSW: TRACE and its demoJul 2026–
  • M.Phil. researcher, UNSW Sydney2025–
  • Undergraduate researcher, CityU Macau2023–24

Education

  • M.Phil., Computer Science and Engineering, UNSW Sydney2025–
  • B.Sc., Data Science, CityU Macau, GPA 3.59/4.00Sep 2021–Jun 2025

Projects: the TRACE demo (code), a Tech4HSE project with CSIRO’s Data61 and UNSW; the CSI Attack site (code); Baton, a multi-account dispatcher for Claude Code (code). Recent news.

Write to me about watermarking, provenance, or the security of AI agents.

zheng.gao1@unsw.edu.au

UNSW Sydney, Kensington NSW, Australia

Google ScholarGitHubORCID