Hi there 
Welcome to my Homepage!
Hi! My name is Xutao Mao. I am a Ph.D. student at the City University of Hong Kong, advised by Prof. Cong Wang. I also closely work with Prof. Xiang Zheng and Prof. Bo Han. Before that, I received my B.S. in Computer Science and Mathematics from Vanderbilt University.
My research focuses on the principles for building trustworthy AI — especially the safety and alignment of agentic and multimodal language models. Feel free to reach out if you are interested in collaboration or potential opportunities.
News
- 2026.09 🎓🎓 I am starting my Ph.D. at the City University of Hong Kong.
- 2026.07 🚀🚀 We released two agent-safety projects: AHA (Agent Hacks Agent) and PASB (Persistent Sycophancy Benchmark).
- 2026.05 🎉🎉 Our paper STARE accepted to ICML 2026 (Poster).
- 2025.11 🎉🎉 Our paper MindVote and LogicCat accepted to AAAI 2026 as Oral and Poster.
Experience
City University of Hong Kong
2026.09 - Present
Ph.D. in Computer Science, advised by Prof. Cong Wang
Research: agent safety and trustworthy AI.
2026.09 - Present
Ph.D. in Computer Science, advised by Prof. Cong Wang
Research: agent safety and trustworthy AI.
Vanderbilt University
2022.08 - 2026.04
B.S. in Computer Science & Mathematics
2022.08 - 2026.04
B.S. in Computer Science & Mathematics
Publications
(* equal contribution · † corresponding author)
STARE: Step-wise Temporal Alignment and Red-teaming Engine for Multi-modal Toxicity Attack
Xutao Mao, Liangjie Zhao, Tao Liu, Xiang Zheng†, Hongying Zan, Cong Wang†
A hierarchical-RL red-team engine with step-wise temporal attribution for multi-modal toxicity attacks, exceeding baselines by ~68% attack success rate with strong transferability.
ICML 2026 Poster [arXiv] [code]
Xutao Mao, Liangjie Zhao, Tao Liu, Xiang Zheng†, Hongying Zan, Cong Wang†
A hierarchical-RL red-team engine with step-wise temporal attribution for multi-modal toxicity attacks, exceeding baselines by ~68% attack success rate with strong transferability.
ICML 2026 Poster [arXiv] [code]
Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming
Xutao Mao, Xiang Zheng†, Cong Wang†
An autoresearch red-team framework that discovers reusable vulnerability concepts (a Vulnerability Concept Graph) in production LLM agents; the frozen graph, deployed single-shot on held-out data, beats the strongest baseline by 14.2 points.
Preprint · Under Review [arXiv] [code] [project]
Xutao Mao, Xiang Zheng†, Cong Wang†
An autoresearch red-team framework that discovers reusable vulnerability concepts (a Vulnerability Concept Graph) in production LLM agents; the frozen graph, deployed single-shot on held-out data, beats the strongest baseline by 14.2 points.
Preprint · Under Review [arXiv] [code] [project]
Agents Don't Just Agree, They Remember: Benchmarking Persistent Sycophancy in Stateful Personal Agents
Xutao Mao*, Liangjie Zhao*, Leyao Wang, Rui Qian, Qiang Huang, Wentao Wang, Bo Han†, Xiang Zheng†, Cong Wang†
A 1,600-task benchmark for persistent sycophancy in stateful personal agents; crossing the commit boundary is the single largest downstream-failure jump (+27 points), driven by attribution stripping.
Preprint · Under Review [arXiv] [code] [project] [dataset]
Xutao Mao*, Liangjie Zhao*, Leyao Wang, Rui Qian, Qiang Huang, Wentao Wang, Bo Han†, Xiang Zheng†, Cong Wang†
A 1,600-task benchmark for persistent sycophancy in stateful personal agents; crossing the commit boundary is the single largest downstream-failure jump (+27 points), driven by attribution stripping.
Preprint · Under Review [arXiv] [code] [project] [dataset]
Taming CoT Obfuscation in VLMs: From Mechanistic Evidence to Activation-Level Enforcement
Xutao Mao, Jianing Zhu, Jinman Zhao, Tongliang Liu, Xiaowen Chu, Cong Wang†, Bo Han†
Mechanistic analysis and activation-level enforcement that tame chain-of-thought obfuscation in RL-trained VLMs, improving reasoning monitorability by ~60% over GRPO.
Preprint · Under Review
Xutao Mao, Jianing Zhu, Jinman Zhao, Tongliang Liu, Xiaowen Chu, Cong Wang†, Bo Han†
Mechanistic analysis and activation-level enforcement that tame chain-of-thought obfuscation in RL-trained VLMs, improving reasoning monitorability by ~60% over GRPO.
Preprint · Under Review
What Happens Inside Agent Memory? Circuit Analysis from Emergence to Diagnosis
Xutao Mao, Jinman Zhao, Gerald Penn, Cong Wang†
A mechanistic circuit analysis tracing how agent-memory features emerge and specialize inside LLMs — from first-person subject anchoring to category-aggregation hubs — enabling diagnosis of memory behavior.
Preprint · Under Review [arXiv]
Xutao Mao, Jinman Zhao, Gerald Penn, Cong Wang†
A mechanistic circuit analysis tracing how agent-memory features emerge and specialize inside LLMs — from first-person subject anchoring to category-aggregation hubs — enabling diagnosis of memory behavior.
Preprint · Under Review [arXiv]
- ICML 2026 Poster STARE: Step-wise Temporal Alignment and Red-teaming Engine for Multi-modal Toxicity Attack
[arXiv][code] - AAAI 2026 Oral MindVote: When AI Meets the Wild West of Social Media Opinion
[arXiv][code] - AAAI 2026 Poster LogicCat: A Text-to-SQL Benchmark for Multi-Domain Reasoning Challenges
* equal contribution, listed in alphabetical order [arXiv][code] - Preprint · Under Review Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming
[arXiv][code][project] - Preprint · Under Review Agents Don't Just Agree, They Remember: Benchmarking Persistent Sycophancy in Stateful Personal Agents
[arXiv][code][project][dataset] - Preprint · Under Review Taming CoT Obfuscation in VLMs: From Mechanistic Evidence to Activation-Level Enforcement
- Preprint · Under Review What Happens Inside Agent Memory? Circuit Analysis from Emergence to Diagnosis
[arXiv] - Preprint · Under Review MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systems
[arXiv] - Preprint ParlAI Vote: A Web Platform for Analyzing Gender and Political Bias in Large Language Models
[arXiv] - Preprint Towards Bridging Review Sparsity in Recommendation with Textual Edge Graph Representation
[arXiv]
Scholarships
- 2026, Hong Kong Postgraduate Scholarships (during PhD study).
- 2025, Vanderbilt Summer Research Program Scholarship.
Services
- Reviewer, AAAI 2026 / 2027 · TheWebConf 2026 · NeurIPS 2026.