Dr Xiaoyu Sun, Lecturer at the ANU School of Computing.
ANU School of Computing Lecturer Xiaoyu Sun’s passion for programming languages and software engineering stems from a desire to identify “zero-day bugs.” A zero-day bug is an unknown software or hardware flaw where the developer has had zero days to fix it because they were unaware of its existence, while hackers can already use it to break into systems.
Sun’s doctoral research focused on developing program analysis techniques for bug detection in Android mobile applications.
“I can identify root causes and design limitations within an Android framework,” Sun said. “When you find a real-world issue, it becomes very interesting.”
Since receiving her PhD, Sun’s research has broadened as software itself has changed. Her work has been published in top-tier conferences and journals, including the IEEE/ACM International Conference on Software Engineering (ICSE) and International Conference on Machine Learning (ICML).
“Modern software is no longer a self-contained program developed and operated entirely by humans,” she said. “It increasingly depends on complex software ecosystems, is deployed through highly automated cloud infrastructure, and is now being generated, operated, and even autonomously controlled by AI.”
As software has changed, so has Sun’s research. She now looks at software in three stages: finding bugs and security issues before software is released, making sure software deploys reliably to cloud systems, and ensuring AI agents behave safely and stay within their intended limits once they’re up and running.
Visual privacy detection research published at ICML
One of Sun’s recent papers was well-received at ICML, one of the top conferences for machine learning. It focused on privacy concerns in livestreams, recorded videos, and screensharing, where users can easily expose sensitive information by accident, such as passwords, private messages, or location information. Existing visual privacy detection models struggle with these scenarios.
The fine-grained visual privacy taxonomy developed for the VPD-100k dataset, covering 33 privacy categories across human presence, on-screen information, physical identifiers, and location indicators.
Together with her team of PhD, master’s, and honours student researchers, Sun created VPD-100k, a large-scale, fine-grained visual privacy detection dataset. Over two years, they collected and manually annotated 100,000 images from real-world photos and video streams. The dataset contains 33 fine-grained privacy categories and more than 190,000 annotated instances, covering human presence, on-screen personally identifiable information, physical identifiers, and location indicators.
Machine learning, deep neural networks, and large language models all learn from data. As high-quality data is often hard to come by, datasets like this form a foundational bedrock for training better AI. Sun’s dataset provides a significant milestone for high-quality expert and manually curated data that annotates privacy-sensitive categories to enable machines to understand what parts of an image may be privacy-sensitive.
Small but high-stakes details, like a verification code flashed briefly on screen and often covering less than a tenth of the frame, are especially easy for older detection tools to miss, which is the gap Sun’s team targeted.
Their model correctly detected privacy risks far more often than existing tools, with an 8.9% improvement in detection accuracy over the best previous method, while still processing video in a fraction of a second per frame. That’s fast enough to flag exposed passwords, IDs, or other sensitive information live, as a stream is happening, rather than after the fact. The dataset is publicly available for the broader community to build upon.
Collaboration and mentorship at ANU and abroad
Sun currently supervises a team of three PhD students and has supervised thirteen honours and master’s project students. She expresses pride that six of her project students have gone on to fully funded PhD positions. Useful skills for future research students include expertise in a focus area like AI agents or web applications.
Dr Sun’s research group, including PhD, master’s, and honours students, collaborating and celebrating milestones together.
Sun sees ANU and Canberra’s sizes as a boon to academics and a good place to focus on research. She likes that ANU’s School of Computing has researchers diving into the core fundamentals.
Lecturer, ANU School of Computing
“ANU’s computing researchers are enhancing the technology itself, not just applications,” she said.
Sun has found mentorship from her colleague Associate Professor Alex Potanin, who helped her take over teaching the software engineering course.
“I stand on top of his shoulders,” she said. “His help makes my life easier. And many of my colleagues have given me good advice on how to supervise students.”
Other key mentors include Zhenchang Xing at the Commonwealth Scientific and Industrial Research Organisation (CSIRO), with whom she supervises two PhD students, and ANU Associate Professor Alwen Tiu, with whom she supervises PhD students and collaborates on research in bug detection and security assurance for agentic software frameworks.
“My work with Tiu has identified several real bugs in agentic frameworks, several of which have been confirmed and fixed by the developers,” Sun said. “And since we both work broadly in software engineering, [Xing] has been a valuable mentor and helped me broaden my research vision.”
Sun was part of a recent grant linking the ANU with Singapore Management University, consistently ranked as one of the top five universities in the world for software engineering research output. The grant provides an opportunity for Sun and fellow ANU researchers to deepen ties with one of the field’s fastest-rising research hubs.