Hanzhi Liu
Santa Barbara, California
I’m a Ph.D. candidate in computer science at UC Santa Barbara, advised by Yu Feng.
I work on programming languages, formal verification, and security. Much of my research asks how we can understand and check the behavior of AI agents, blockchain protocols, and zero-knowledge systems.
I also co-founded Nubit in 2023, where we build Bitcoin infrastructure and verification tools.
Conference publications
Preprints ↓- NDSS2027To appear
- ACM CCS2026To appear
Thunderbolt: Fast Asynchronous Off-Chain Bitcoin Transfers
- OOPSLA2025
Tabby: A Synthesis-Aided Compiler for High-Performance Zero-Knowledge Proof Circuits
- SBC2025
Tessel: An Optimizing Compiler for Efficient Zero-Knowledge Circuits
- ACM CCS2024
FORAY: Towards Effective Attack Synthesis against Deep Logical Vulnerabilities in DeFi Protocols
- IEEE S&P2024
Certifying Zero-Knowledge Circuits with Refinement Types
Writing & thoughts
All writing →Preprints
- arXiv2026
VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills
- arXiv2026
No Attack Required: Semantic Fuzzing for Specification Violations in Agent Skills
- arXiv2026
Semia: Auditing Agent Skills via Constraint-Guided Representation Synthesis
- arXiv2026
Synthesizing Multi-Agent Harnesses for Vulnerability Discovery
- arXiv2026
Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain
- IACR ePrint2024
Programmable Bitcoin Verification via Synthesis-Aided Lifting
- IACR ePrint2024
Stateless and Verifiable Execution Layer for Meta-Protocols on Bitcoin
Earlier journal publication
- J. SJTU (Sci.)2020
CIRD-F: Spread and Influence of COVID-19 in China
Things I help build
AgentFlow synthesizes multi-agent harnesses for vulnerability discovery.
Puffer Code is a Rust agent runtime and CLI. It has an interactive TUI, a WebSocket daemon for desktop shells such as Bobo, and support for connectors, permissions, skills, tools, provider transports, and session storage.
Pomelo lifts Bitcoin Script into a form we can symbolically verify. It grew out of our work on programmable Bitcoin.
Thunderbolt is our implementation of asynchronous off-chain Bitcoin transfers. The 1.0 release includes a Rust implementation, Bitcoin Core integration, and reproducibility tools.
I also work on finding bugs in real systems, from Ethereum serialization with Alma to Bitcoin Script and AI coding agents. I keep a small collection of public reports and upstream fixes.
Teaching
I really enjoy teaching programming languages, formal verification, and blockchain security. My research on Coda, Tabby, and FORAY connects these areas through proofs of circuit correctness, compiler optimization for zero-knowledge proofs, and attack synthesis for DeFi protocols. My TA work includes programming-language instruction and contributions to blockchain assignments on automated market maker pricing and transaction ordering.
TA (Teaching Assistant)
- CS 162: Programming Languages (Instructor: Yu Feng)Winter 2026, 2025, 2024
- CS 190J: Blockchain Technologies and Security (Instructor: Yu Feng)Fall 2025
Talks & presentations
2026
2025
2024
- TOKEN2049, Singapore: How to Onboard the Next Million Consumer Apps
A little more
Before UCSB, I studied electrical engineering and computer science at Shanghai Jiao Tong University (2019–2023), advised by Qinxiang Cao. I started my Ph.D. in 2023.
My research has been supported by Ethereum Foundation Academic Grants in 2024 and 2025. At Nubit, we raised $12M by June 2024, including a seed round led by Polychain.
I wrote the Tornado Crash challenge for BlazCTF 2023. The solution is here, if you’re curious.