WraLUPOPL'24ReLU Hull Approximation
Approximate ReLU hulls by reusing their linear pieces and constructing enclosing upper faces, rather than building the exact hull.
PhD Candidate · Trustworthy AI Research
Hi, I'm Zhongkui Ma
Diving deep into my PhD journey at The University of Queensland.
I study the verification, security, and privacy of AI systems, with a focus on sound neural network verification.
Selected research
Selected work in verification, model control, and privacy.
WraLUPOPL'24WraActOOPSLA'25Convex Hull Approximation for Activation Functions
Use double-linear-piece functions to simplify local activation geometry and construct convex over-approximations beyond ReLU.
TiSumICSE'27Local Nonlinear Substitution for Bounding Activation Functions
Carry quadratic symbolic bounds through one local back-substitution step, then return to linear form before nonlinear terms proliferate, preserving cancellation that purely linear bounds lose.
NTENeurIPS'26Catch-Only-One: Non-Transferable Examples for Model-Specific Authorization
Recode released data along a designated model's low-sensitivity subspace so the intended model retains task utility while other models lose it, without retraining or control over deployment.
CoreLockerS&P'24CoreLocker: Neuron-level Usage Control
Lock a network behind a small subset of its own significant weights, so holding the key gives the whole capability and not holding it gives part of it.
GRABCCS'24Uncovering Gradient Inversion Risks in Practical Language Model Training
Recover private training text from shared language-model gradients under practical conditions, exposing how architecture and training choices shape leakage beyond idealized attacks in collaborative learning deployments.
Explore how these projects connect across my research, or browse the complete publication list.
Tutorial · A series in progress
A Guide to Neural Network Verification
29 chapters in 4 parts, from what a network can be asked to prove to how the relaxation is built and solved. Written to be read in order.
News
Acceptances, awards and releases.
📄
Oct. 2026Paper Accepted
Our paper Local Nonlinear Substitution for Bounding Activation Functions is accepted by ICSE'27. It is the third study in my neural network verification line and the third representative work of my PhD.
📄
Sept. 2026Paper Accepted
Our paper Catch-Only-One: Non-Transferable Examples for Model-Specific Authorization is accepted by NeurIPS'26 as an oral presentation (112 of 30709 submissions, about 0.36%). Congrats, Zihan and Zhiyong!
🏆
Aug. 2026Best Paper Award
Our paper Non-Transferable Examples receives the Best Paper Award - Runner Up at the ECCV'26 LifeGenIP Workshop. Congrats, Zihan!
7 earlier entries
📄
Mar. 2026Paper Accepted
Our paper Re-Key-Free, Risky-Free: Adaptable Model Usage Control is accepted by Euro S&P'26. Congrats, Zihan!
📄
Nov. 2025Paper Accepted
Our paper Mitigating Gradient Inversion Risks in Language Models via Token Obfuscation is accepted by Asia CCS'2026. Congrats, Xinguo!
📄
Aug. 2025Paper Accepted
Our paper Convex Hull Approximation for Activation Functions is accepted by OOPSLA'25 within SPLASH'25. Happy!
📄
Jan. 2025Paper Accepted
Our paper AI Model Modulation with Logits Redistribution is accepted by WWW'25. Congrats, Zihan!
📄
Aug. 2024Paper Accepted
Our paper Uncovering Gradient Inversion Risks in Practical Language Model Training is accepted by CCS'24. Congrats, Xinguo!
📄
Apr. 2024Paper Accepted
Our paper CORELOCKER: Neuron-level Usage Control is accepted by S&P'24. Congrats, Zihan! [Live Video]
📄
Nov. 2023Paper Accepted
Our paper ReLU Hull Approximation is accepted by POPL'24.
Writing
The questions behind the work, and the choices that turn them into methods.
Why Linear Bounds Lose Cancellation When They Are Summed
A valid bound for every activation can still produce a weak bound for their sum. The missing information is how their approximation errors move together.
October 2026Data That Only One Model Can Read
Adversarial examples exploit what a model notices; non-transferable examples use what it does not. How data can remain useful to a designated model without being equally useful to other models.
October 2026