Skip to main content

Research

Our group works across the computer security spectrum, with a focus on software and systems security. Our recent work spans the security of AI and LLM-based agents, hardware and microarchitectural attacks and defenses, confidential computing, automated vulnerability discovery, and OS/kernel attack and defense.

The following introduce our major research areas:

AI Agent Security​

Large language models and autonomous agents are rapidly being deployed into real systems, where they read untrusted data and invoke powerful tools. This creates an entirely new attack surface—prompt injection, tool misuse, and privilege escalation across an agent's data and control flow. We study how agentic AI systems can be attacked, and how to build principled, system-level defenses for them.

SoK: Agentic AI Systems [USENIX Sec 26] systematizes the attack and defense landscape of agentic AI systems, organizing emerging threats and mitigations into a coherent framework that maps where current defenses hold and where they fall short.

PFI [arXiv 25] (Prompt Flow Integrity) prevents privilege escalation in LLM agents by tracking the provenance of every piece of data flowing through the agent and enforcing the most restrictive attribute, so that untrusted inputs cannot escalate into privileged actions.

Hardware & Microarchitectural Security​

Modern CPUs and accelerators ship increasingly complex microarchitectural features—speculative execution, memory tagging, and shared GPU memory—whose security implications are not fully understood. We discover new microarchitectural attacks against commodity hardware, design hardware and software defenses, and build tools that automatically find such bugs before they ship.

GHost in the SHELL [SP 26] presents a GPU-to-host memory attack that crosses the isolation boundary between the GPU and the CPU, together with a mitigation that closes the leak.

TikTag [SP 25] breaks ARM's Memory Tagging Extension (MTE) using speculative execution, leaking MTE tags to defeat a memory-safety defense deployed in commodity devices such as Google Pixel phones.

SpecDoctor [CCS 22] applies differential fuzz testing to RTL designs to automatically discover transient-execution (Spectre-class) vulnerabilities directly in CPU hardware.

DiFuzzRTL [SP 21] is a register-coverage-guided RTL fuzzer that found previously unknown bugs across several open-source CPU designs.

Vulnerability Finding​

We automatically find previously unknown vulnerabilities in large, complex software, primarily through fuzzing. Our tools have uncovered numerous bugs across operating-system kernels, hypervisors, web browsers, and CPU hardware.

OZZ [SOSP 24] discovers kernel out-of-order concurrency bugs by reordering in-vivo memory accesses, exposing bugs that only manifest under weak memory ordering. It received a Best Paper Award at SOSP 2024.

SegFuzz [SP 23] segmentizes thread interleavings to systematically explore concurrency, discovering kernel data races that interleaving-oblivious fuzzers miss.

FuzzOrigin [USENIX Sec 22] detects universal cross-site scripting (UXSS) vulnerabilities in web browsers through origin fuzzing.

MundoFuzz [USENIX Sec 22] fuzzes hypervisors using statistical coverage testing and grammar inference to reach deep virtualization code.

System Attack & Defense​

To secure a system we must first understand how it breaks. We study emerging attack and exploitation techniques against OS kernels and systems software, and use that understanding to build practical defenses that nullify whole classes of attacks.

DMGuard [USENIX Sec 26] safeguards kernels against physical-page use-after-free vulnerabilities, a class of bugs that evades conventional virtual-address-based protections.

PeTAL [CCS 24] ensures the integrity of Linux access control against data-only attacks that corrupt security-critical data without ever hijacking control flow.

Pspray [USENIX Sec 23] turns a timing side channel in the Linux kernel heap allocator into a reliable exploitation primitive, making kernel heap exploits far more deterministic.

ExpRace [USENIX Sec 21] exploits hard-to-trigger kernel races by raising interrupts (e.g., reschedule and TLB-shootdown IPIs) to widen the race window, exploiting 10 real-world kernel races within seconds each.

Confidential Computing & Trusted Execution​

Trusted execution environments (e.g., Intel SGX/TDX and AMD SEV) let sensitive computation run on untrusted infrastructure with confidentiality and integrity guarantees, and are now offered by major clouds. We build secure systems on top of confidential computing and design new protections for emerging workloads such as machine-learning training and large-scale data analytics.

DLBox [NDSS 25] is a new model-training framework that protects training data end-to-end, keeping datasets confidential even from the party running the training.

Laputa [NDSS 25] brings secure data analytics to Apache Spark with fine-grained policy enforcement and isolated execution inside TEEs.

Chancel [NDSS 21] builds a two-way sandbox for multi-client SGX enclaves, using per-thread software-fault isolation so that all data leaving an enclave is encrypted.