Publications

2026

1. Representative Atlas or World Models for Robotic Ultrasound Navigation

   Shijie Zhou^*, Feng Li^*, Chaoyu Zeng, Jingze Ye, Yuan Bi, Zhongliang Jiang, and Nassir Navab * Co-first authors, equal contribution

   Under review, 2026
2. 

   

   How to “Train” a Surgeon? Benchmarking Generalist Agents in Surgical Scene Understanding

   Gengyuan Zhang, Xiao Han^*, Shijie Zhou^*, Abdullah Koukash^*, Ghazal Ghazaei, Jindong Gu, Jingpei Wu, Yuqicheng Zhu, Nassir Navab, and Volker Tresp * Co-second authors, equal contribution

   Conference on Neural Information Processing Systems (NeurIPS), 2026

   Paper/Abs/Bib

   Evaluating general-purpose multimodal large language models (MLLMs) for surgical scene understanding remains limited by scarce surgical data and fragmented evaluation protocols. We address these challenges through a two-stage evaluation framework for surgical scene understanding. In Stage I, we introduce SurgKnowBench, a diagnostic benchmark that harmonizes public surgical datasets across procedures and tasks and evaluates proprietary and open-weight MLLMs to map the boundary of pretrained surgical competence. SurgKnowBench reveals that current models retain partial visual priors but remain weak on procedural reasoning and workflow assessment. Building on this failure frontier, and motivated by the scaffolded nature of surgical training, we introduce SurgAgentGym, a controlled environment where general-purpose MLLM agents can use bounded knowledge search over SurgWiki and general-purpose visual grounding for surgical tasks. SurgAgentGym evaluates whether generalist agents can improve surgical understanding at inference time through tool-mediated evidence use, without additional surgical training. Our results show that agentic inference narrows the gap mainly for perception-heavy tasks, while fine-grained localization and expert-style assessment remain persistent bottlenecks. This opens a path toward future studies of agentic surgical understanding.

   @inproceedings{zhang-etal-2026-surgagentgym,
     title = {How to ``Train'' a Surgeon? Benchmarking Generalist Agents in Surgical Scene Understanding},
     author = {Zhang, Gengyuan and Han, Xiao and Zhou, Shijie and Koukash, Abdullah and Ghazaei, Ghazal and Gu, Jindong and Wu, Jingpei and Zhu, Yuqicheng and Navab, Nassir and Tresp, Volker},
     booktitle = {Advances in Neural Information Processing Systems (NeurIPS), Evaluations and Datasets Track},
     year = {2026},
     url = {https://neurips.cc/virtual/2026/loc/sydney/poster/139078},
   }

3. 

   

   PrivacyEvalClaw: A Tool-Augmented Deliberative Agent for Auditing Privacy Leakage in LLM Jailbreak Responses

   Krishna Kanth Nakka, Yujun Wang, Shijie Zhou, Tu Nguyen, Gabriele Gelardi, and Xuebing Zhou

   Conference of the Asia-Pacific Chapter of the ACL (AACL-IJCNLP), 2026

   Paper/Abs/Bib

   Privacy auditing of large language models (LLMs) increasingly relies on advanced jailbreak attacks to uncover unintended disclosures of personal information; the reliability of such audits, however, hinges on evaluators that can accurately determine whether a response constitutes privacy leakage. This evaluation remains challenging because disclosures may be indirect, contextual, partial, or obfuscated, and different evaluators can interpret the same response differently. We conduct a systematic study of guard models and LLM-as-Judges and find substantial disagreement among evaluators, particularly in ambiguous cases that require additional evidence or targeted analysis to resolve. Motivated by these findings, we introduce PrivacyEvalClaw, a training-free deliberative agent for evaluating privacy leakage in LLM jailbreak responses. Rather than relying on isolated single-pass judgments, PrivacyEvalClaw treats evaluators and analysis modules as tools, adaptively gathers evidence, investigates uncertain disclosures, and reconciles conflicting signals before producing a final judgment. Our primary experiments use pairwise LLM-as-Judge evaluation of complete trajectories, showing that PrivacyEvalClaw achieves favorable win rates against competing baselines across outcome, process, and overall quality, while also producing explicit reasoning traces that make the evaluation process more transparent and auditable.

   @inproceedings{nakka-etal-2026-privacyevalclaw,
     title = {{P}rivacy{E}val{C}law: A Tool-Augmented Deliberative Agent for Auditing Privacy Leakage in {LLM} Jailbreak Responses},
     author = {Nakka, Krishna Kanth and Wang, Yujun and Zhou, Shijie and Nguyen, Tu and Gelardi, Gabriele and Zhou, Xuebing},
     booktitle = {Findings of the Association for Computational Linguistics: AACL-IJCNLP 2026},
     year = {2026},
     publisher = {Association for Computational Linguistics},
     url = {https://openreview.net/forum?id=4r0W7fUjBm},
   }

2025

1. 

   

   SwarmAgentic: Towards Fully Automated Agentic System Generation via Swarm Intelligence

   Yao Zhang, Chenyang Lin, Shijie Tang, Haokun Chen, Shijie Zhou, Yunpu Ma, and Volker Tresp

   Conference on Empirical Methods in Natural Language Processing (EMNLP), 2025

   Project Page/Paper/arXiv/Code/Abs/Bib

   The rapid progress of Large Language Models has advanced agentic systems in decision-making, coordination, and task execution. Yet, existing agentic system generation frameworks lack full autonomy, missing from-scratch agent generation, self-optimizing agent functionality, and collaboration, limiting adaptability and scalability. We propose SwarmAgentic, the first framework that fully automates agentic system generation, optimization, and collaboration, constructing agents from scratch and jointly refining functionality and coordination via language-driven exploration. To enable efficient search over system-level structures, SwarmAgentic maintains a population of candidate systems and evolves them via feedback-guided updates, drawing inspiration from Particle Swarm Optimization (PSO). We evaluate our method on six real-world, open-ended, and exploratory tasks involving high-level planning, system-level coordination, and creative reasoning. Given only a task description and an objective function, SwarmAgentic outperforms all baselines, achieving a +261.8% relative improvement over ADAS on the TravelPlanner benchmark, highlighting the effectiveness of full automation in structurally unconstrained tasks. This framework marks a significant step toward scalable and autonomous agentic system design, bridging swarm intelligence with fully automated system multi-agent generation.

   @inproceedings{zhang-etal-2025-swarmagentic,
     title = {{S}warm{A}gentic: Towards Fully Automated Agentic System Generation via Swarm Intelligence},
     author = {Zhang, Yao and Lin, Chenyang and Tang, Shijie and Chen, Haokun and Zhou, Shijie and Ma, Yunpu and Tresp, Volker},
     editor = {Christodoulopoulos, Christos and Chakraborty, Tanmoy and Rose, Carolyn and Peng, Violet},
     booktitle = {Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing},
     month = nov,
     year = {2025},
     address = {Suzhou, China},
     publisher = {Association for Computational Linguistics},
     url = {https://aclanthology.org/2025.emnlp-main.93/},
     doi = {10.18653/v1/2025.emnlp-main.93},
     pages = {1778--1818},
     isbn = {979-8-89176-332-6},
   }