Chi Zhang

Software System Security Assurance Group — WingTecher Lab

Tsinghua University,

Beijing, China

I am a Postdoctoral Researcher in the Software System Security Assurance Group — WingTecher Lab at Tsinghua University, supervised by Professor Yu Jiang. I received my Ph.D. in 2025 from the Software Engineering Group at Nanjing University, under the supervision of Professor Linzhang Wang. In 2018, I earned dual bachelor’s degrees in Computer Science and Economics from Sichuan University. From August 2022 to August 2023, I conducted research at the Trustworthy Engineering of Software Technologies (TEST) Lab at the National University of Singapore, supervised by Manuel Rigger.

My research focuses on software bug detection, leveraging techniques such as fuzzing, static analysis, and machine learning. Recently, my work has centered on detecting logic and performance bugs in database management systems (DBMSs), where I have identified and confirmed over 400 bugs in widely-used DBMSs.

Selected Publications

CCS’26

Accio: Detecting Privilege Escalation Vulnerabilities in DBMSs via Minimum Privilege Set Calculation

Jingzhou Fu, Zongrui Peng, Jie Liang, and 3 more authors

In Proceedings of the 2026 ACM SIGSAC Conference on Computer and Communications Security, 2026

Bib

@inproceedings{fu2026ccs,
  author = {Fu, Jingzhou and Peng, Zongrui and Liang, Jie and Wu, Zhiyong and Zhang, Chi and Jiang, Yu},
  title = {Accio: Detecting Privilege Escalation Vulnerabilities in DBMSs via Minimum Privilege Set Calculation},
  booktitle = {Proceedings of the 2026 ACM SIGSAC Conference on Computer and Communications Security},
  year = {2026},
}

SIGMOD’26

EPSC: Testing Database Management Systems via Equivalent Prepared Statement Construction

Chi Zhang, Jie Liang, Zhiyong Wu, and 3 more authors

Proc. ACM Manag. Data, Jun 2026

DOI Bib

@article{zhang2026sigmod,
  author = {Zhang, Chi and Liang, Jie and Wu, Zhiyong and Shi, Dalong and Wang, Linzhang and Jiang, Yu},
  title = {EPSC: Testing Database Management Systems via Equivalent Prepared Statement Construction},
  year = {2026},
  issue_date = {June 2026},
  publisher = {Association for Computing Machinery},
  address = {New York, NY, USA},
  volume = {4},
  number = {3},
  url = {https://doi.org/10.1145/3802053},
  doi = {10.1145/3802053},
  journal = {Proc. ACM Manag. Data},
  month = jun,
  articleno = {176},
  numpages = {25},
}

SIGMOD’25

Constant Optimization Driven Database System Testing

Chi Zhang and Manuel Rigger

Proc. ACM Manag. Data, Feb 2025

Abs DOI

Logic bugs are bugs that can cause database management systems (DBMSs) to silently produce incorrect results for given queries. Such bugs are severe, because they can easily be overlooked by both developers and users, and can cause applications that rely on the DBMSs to malfunction. In this work, we propose Constant-Optimization-Driven Database Testing (CODDTest) as a novel approach for detecting logic bugs in DBMSs. This method draws inspiration from two well-known optimizations in compilers: constant folding and constant propagation. Our key insight is that for a certain database state and query containing a predicate, we can apply constant folding on the predicate by replacing an expression in the predicate with a constant, anticipating that the results of this predicate remain unchanged; any discrepancy indicates a bug in the DBMS. We evaluated CODDTest on five mature and extensively-tested DBMSs–SQLite, MySQL, CockroachDB, DuckDB, and TiDB–and found 45 unique, previously unknown bugs in them. Out of these, 24 are unique logic bugs. Our manual analysis of the state-of-the-art approaches indicates that 11 logic bugs are detectable only by CODDTest. We believe that CODDTest is easy to implement, and can be widely adopted in practice.

OOPSLA’24

Finding Cross-Rule Optimization Bugs in Datalog Engines

Chi Zhang, Linzhang Wang, and Manuel Rigger

In Proceedings of the 39th ACM SIGPLAN International Conference on Object-Oriented Programming, Systems, Languages, and Applications, 2024

Bib HTML

@inproceedings{zhang2024oopsla,
  title = {Finding Cross-Rule Optimization Bugs in Datalog Engines},
  booktitle = {Proceedings of the 39th ACM SIGPLAN International Conference on Object-Oriented Programming, Systems, Languages, and Applications},
  author = {Zhang, Chi and Wang, Linzhang and Rigger, Manuel},
  journal = {Proc. ACM Program. Lang.},
  volume = {8},
  number = {OOPSLA1},
  article = {98},
  pages = {1--27},
  year = {2024},
  publisher = {ACM},
}

Service

Program Committee
- ISSTA AEC 2026
- ASE AEC 2026
- PLDI AEC 2024, 2025
- SIGMOD AEC 2025
- ChinaSys 2025
Journal Reviewer
- Empirical Software Engineering

Teaching

Teaching Assistant
- Nanjing University, Advanced Programming, Fall 2023
- Nanjing University, Software Engineering, Spring 2020, Fall 2018