Yinqian Zhang's Homepage

[NDSS'25] I Know What You Asked: Prompt Leakage via KV-Cache Sharing in Multi-Tenant LLM Serving

Yinqian Zhang

Network and Distributed System Security Symposium

[NDSS'25] WAVEN: WebAssembly Memory Virtualization for Enclaves

Yinqian Zhang

Network and Distributed System Security Symposium

[EuroSys'25] Achilles: Efficient TEE-Assisted BFT Consensus via Rollback Resilient Recovery

Yinqian Zhang

European Conference on Computer Systems

[EuroSys'25] Ladon: High-Performance Multi-BFT Consensus via Dynamic Global Ordering

Yinqian Zhang

European Conference on Computer Systems

[TDSC] CAPE: Commitment-based Privacy-Preserving Payment Channel Scheme in Blockchain

Yinqian Zhang

IEEE Transactions on Dependable and Secure Computing

[TDSC] Chained HotStuff Under Performance Attack

Yinqian Zhang

IEEE Transactions on Dependable and Secure Computing

2024

[ACSAC'24] Breaking the Privacy Barrier: On the Feasibility of Reorganization Attacks on Ethereum Private Transactions

Yinqian Zhang

Annual Computer Security Applications Conference

[CCS'24] DoubleUp Roll: Double-spending in Arbitrum by Rolling It Back

Yinqian Zhang

ACM Conference on Computer and Communications Security

Distinguished Paper Award

[CCS'24] HyperTheft: Thieving Model Weights from TEE-Shielded Neural Networks via Ciphertext Side Channels

Yinqian Zhang

ACM Conference on Computer and Communications Security

[APSys'24] Framekernel: A Safe and Efficient Kernel Architecture via Rust-based Intra-kernel Privilege Separation

Yinqian Zhang

ACM Asia-Pacific Workshop on Systems

[RAID'24] Security of Cross-chain Bridges: Attack Surfaces, Defenses, and Open Problems

Yinqian Zhang

27th International Symposium on Research in Attacks, Intrusions and Defenses

[ESORICS'24] SAEG: Stateful Automatic Exploit Generation

Yinqian Zhang

29th European Symposium on Research in Computer Security

[ESORICS'24] ReminISCence: Trusted Monitoring Against Privileged Preemption Side-channel Attacks

Yinqian Zhang

29th European Symposium on Research in Computer Security

[Security'24] π-Jack: Physical-World Adversarial Attack on Monocular Depth Estimation with Perspective Hijacking

Yinqian Zhang

USENIX Security Symposium

[Security'24] HIVE: A Hardware-assisted Isolated Execution Environment for eBPF on AArch64

Yinqian Zhang

USENIX Security Symposium

[FORTE'24] Formally Verifying a Rollback-Prevention Protocol for TEEs

Yinqian Zhang

44th International Conference on Formal Techniques for Distributed Objects, Components, and Systems

[ICMC'24] SoK: AI-Powered Security Analysis of Smart Contract

Yinqian Zhang

IEEE International Conference on Meta Computing

[AsiaCCS'24] SoK: Understanding Design Choices and Pitfalls of Trusted Execution Environments

Yinqian Zhang

ACM ASIA Conference on Computer and Communications Security

[SEED'24] SoK: Opportunities for Accelerating Multi-Party Computation via Trusted Hardware

Yinqian Zhang

International Symposium on Secure and Private Execution Environment Design

[HPCA'24] Uncovering and Exploiting AMD Speculative Memory Access Predictors for Fun and Profit

Yinqian Zhang

IEEE International Symposium on High-Performance Computer Architecture

[TDSC] Ensuring State Continuity for Confidential Computing: A Blockchain-based Approach

Yinqian Zhang

Transactions on Dependable and Secure Computing

2023

[CCS'23] PANIC: PAN-assisted Intra-process Memory Isolation on ARM

Yinqian Zhang

ACM Conference on Computer and Communications Security

Distinguished Paper Award

[Security'23] Reusable Enclaves for Confidential Serverless Computing

Yinqian Zhang

USENIX Security Symposium

[Security'23] Panda: Security Analysis of Algorand Smart Contracts

Yinqian Zhang

USENIX Security Symposium

[Security'23] Controlled Data Races in Enclaves: Attacks and Detection

Yinqian Zhang

USENIX Security Symposium

[Security'23] CipherH: Automated Detection of Ciphertext Side-channel Vulnerabilities in Cryptographic Implementations

Yinqian Zhang

USENIX Security Symposium

[ISCA'23] TEESec: Pre-Silicon Vulnerability Discovery for Trusted Execution Environments

Yinqian Zhang

International Symposium on Computer Architecture

[DIMVA'23] PWRLEAK: Exploiting Power Reporting Interface for Side-channel Attacks on AMD SEV

Yinqian Zhang

Conference on Detection of Intrusions and Malware & Vulnerability Assessment

[TCAD] SPECWANDS: An Efficient Priority-based Scheduler Against Speculation Contention Attacks

Yinqian Zhang

IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems

[TDSC] VERITRAIN: Validating MLaaS Training Efforts via Anomaly Detection

Yinqian Zhang

Transactions on Dependable and Secure Computing

[TCC] SvTPM: SGX-based Virtual Trusted Platform Modules for Cloud Computing

Yinqian Zhang

Transactions on Cloud Computing

2022

[CCS'22] Narrator: Secure and Practical State Continuity for Trusted Execution in the Cloud

Yinqian Zhang

ACM Conference on Computer and Communications Security

[CCS'22] ENGRAFT: Enclave-guarded Raft on Byzantine Faulty Nodes

Yinqian Zhang

ACM Conference on Computer and Communications Security

[CCS'22] CETIS: Retrofitting Intel CET for Generic and Efficient Intra-process Memory Isolation

Yinqian Zhang

ACM Conference on Computer and Communications Security

Best Paper Award Honorable Mention

[S&P'22] A Systematic Look at Ciphertext Side Channels on AMD SEV-SNP

Yinqian Zhang

IEEE Symposium on Security and Privacy

Top 10 Finalists of CSAW Best Applied Research Paper Award

[S&P'22] vSGX: Virtualizing SGX Enclaves on AMD SEV

Yinqian Zhang

IEEE Symposium on Security and Privacy

[Source Code]

[NDSS'22] Multi-Certificate Attacks against Proof-of-Elapsed-Time And Their Countermeasures

Yinqian Zhang

Network and Distributed System Security Symposium

[Security'22] MAGE: Mutual Attestation for a Group of Enclaves without Trusted Third Parties

Yinqian Zhang

USENIX Security Symposium

[Source Code]

[SEED'22] ENCLYZER: Automated Analysis of Transient Data Leaks on Intel SGX

Yinqian Zhang

IEEE International Symposium on Secure and Private Execution Environment Design

[book] Cloud Computing Security: Foundations and Research Directions

Yinqian Zhang

Foundations and Trends® in Privacy and Security: Vol. 3: No. 2

[CC'22] Cape: Compiler-Aided Program Transformation for HTM-Based Cache Side-Channel Defense

Yinqian Zhang

ACM International Conference on Compiler Construction

[CAL] A Pre-Silicon Approach to Discovering Microarchitectural Vulnerabilities in Security Critical Applications

Yinqian Zhang

IEEE Computer Architecture Letters

Best of CAL Award

[TDSC] Crystal: Enhancing Blockchain Mining Transparency with Quorum Certificate

Yinqian Zhang

Transactions on Dependable and Secure Computing

[TDSC] Securing TEEs with Verifiable Execution Contracts

Yinqian Zhang

Transactions on Dependable and Secure Computing

[TDSC] Dancing with Wolves: An Intra-process Isolation Technique with Privileged Hardware

Yinqian Zhang

Transactions on Dependable and Secure Computing

[TDSC] SPECBOX: A Label-Based Transparent Speculation Scheme Against Transient Execution Attacks

Yinqian Zhang

Transactions on Dependable and Secure Computing

[IJIS] Defeating Traffic Analysis via Differential Privacy: A Case Study on Streaming Traffic

Yinqian Zhang

International Journal of Information Security

2021

[ACSAC'21] TLB Poisoning Attacks on AMD Secure Encrypted Virtualization

Yinqian Zhang

Annual Computer Security Applications Conference

[Security'21] Towards Formal Verification of State Continuity for Enclave Programs

Yinqian Zhang

USENIX Security Symposium

[Security'21] CIPHERLEAKS: Breaking Constant-time Cryptography on AMD SEV via the Ciphertext Side Channel

Yinqian Zhang

USENIX Security Symposium

[Project Homepage]

[Security'21] SelectiveTaint: Efficient Data Flow Tracking With Static Binary Rewriting

Yinqian Zhang

USENIX Security Symposium

[Source Code]

[ISCA'21] INTROSPECTRE: A Pre-Silicon Framework for Discovery and Analysis of Transient ExecutionVulnerabilities

Yinqian Zhang

International Symposium on Computer Architecture

[CCS'21] CROSSLINE: Breaking "Security-by-Crash" based Memory Isolation in AMD SEV

Yinqian Zhang

ACM Conference on Computer and Communications Security

Best Paper Award Runner-up

[DIMVA'21] SPECULARIZER: Detecting Speculative Execution Attacks via Performance Tracing

Yinqian Zhang

Conference on Detection of Intrusions and Malware & Vulnerability Assessment

[AsiaCCS'21] See through Walls: Detecting Malware in SGX Enclaves with SGX-Bouncer

Yinqian Zhang

ACM ASIA Conference on Information, Computer and Communications Security

[TDSC] Making Information Hiding Effective Again

Yinqian Zhang

Transactions on Dependable and Secure Computing

[CSUR] A Survey of Microarchitectural Side-channel Vulnerabilities, Attacks and Defenses in Cryptography

Yinqian Zhang

ACM Computer Surveys

2020

[CCS'20] FirmXRay: Detecting Bluetooth Link Layer Vulnerabilities From Bare-Metal Firmware

Yinqian Zhang

ACM Conference on Computer and Communications Security

[Security'20] TXSPECTOR: Uncovering Attacks in Ethereum from Transactions

Yinqian Zhang

USENIX Security Symposium

[S&P'20] SEIMI: Efficient and Secure SMAP-Enabled Intra-process Memory Isolation

Yinqian Zhang

IEEE Symposium on Security and Privacy

[NDSS'20] SPEECHMINER: A Framework for Investigating and Measuring Speculative Execution Vulnerabilities

Yinqian Zhang

Network and Distributed System Security Symposium

2019

[DSC'19] Defeating Speculative-Execution Attacks on SGX with HyperRace

Yinqian Zhang

IEEE Conference on Dependable and Secure Computing

[CCS'19] OPERA: Open Remote Attestation for Intel’s Secure Enclaves

Yinqian Zhang

ACM Conference on Computer and Communications Security

[CCS'19] Automatic Fingerprinting of Vulnerable BLE IoT Devices with Static UUIDs from Mobile Apps

Yinqian Zhang

ACM Conference on Computer and Communications Security

[PACT'19] SpecShield: Shielding Speculative Data from Microarchitectural Covert Channels

Yinqian Zhang

International Conference on Parallel Architectures and Compilation Techniques

[RAID'19] Time and Order: Towards Automatically Identifying Side-Channel Vulnerabilities in Enclave Binaries

Yinqian Zhang

International Symposium on Research in Attacks, Intrusions and Defenses

[Security'19] Exploiting Unprotected I/O Operations in AMD’s Secure Encrypted Virtualization

Yinqian Zhang

USENIX Security Symposium

[Presentation]

[Security'19] SafeHidden: An Efficient and Secure Information Hiding Technique Using Re-randomization

Yinqian Zhang

USENIX Security Symposium

[CAL] Isolating Speculative Data to Prevent Transient Execution Attacks

Yinqian Zhang

IEEE Computer Architecture Letters (CAL)

[AsiaCCS'19] Running Language Interpreters Inside SGX: A Lightweight Legacy-Compatible Script Code Hardening Approach

Yinqian Zhang

(Short Paper)

ACM ASIA Conference on Information, Computer and Communications Security

[DSN'19] Your IoTs Are (Not) Mine: On the Remote Binding Between IoT Devices and Users

Yinqian Zhang

IEEE/IFIP International Conference on Dependable Systems and Networks

[EuroS&P'19] SGXPECTRE: Stealing Intel Secrets from SGX Enclaves via Speculative Execution

Yinqian Zhang

IEEE European Symposium on Security and Privacy (EuroS&P)

[Project Homepage]

[NDSS'19] Statistical Privacy for Streaming Traffic

Yinqian Zhang

Network and Distributed System Security Symposium

[NDSS'19] OBFUSCURO: A Commodity Obfuscation Engine on Intel SGX

Yinqian Zhang

Network and Distributed System Security Symposium

[S&P'19] Why Does Your Data Leak? Uncovering the Data Leakage in Cloud From Mobile Apps

Yinqian Zhang

IEEE Symposium on Security and Privacy

2018

[ACSAC'18] Analyzing Cache Side Channels Using Deep Neural Networks

Yinqian Zhang

Annual Computer Security Applications Conference

[ACSAC'18] A Measurement Study of Authentication Rate-Limiting Mechanisms of Modern Websites

Yinqian Zhang

Annual Computer Security Applications Conference

[ICCD'18] NVCool: When Non-Volatile Caches Meet Cold Boot Attacks

Yinqian Zhang

IEEE International Conference on Computer Design

[CCS'18] HoMonit: Monitoring Smart Home Apps from Encrypted Traffic

Yinqian Zhang

ACM Conference on Computer and Communications Security

[TDSC] CPU Elasticity to Mitigate Cross-VM Runtime Monitoring

Yinqian Zhang

Transactions on Dependable and Secure Computing

[ATC'18] Peeking Behind the Curtains of Serverless Platforms

Yinqian Zhang

Usenix Annual Technical Conference

[AsiaCCS'18] Leveraging Hardware Transactional Memory for Cache Side-Channel Defenses

Yinqian Zhang

(Short Paper)

ACM ASIA Conference on Information, Computer and Communications Security

[S&P'18] Static Evaluation of Noninterference Using Approximate Model Counting

Yinqian Zhang

IEEE Symposium on Security and Privacy

[S&P'18] Racing in Hyperspace: Closing Hyper-Threading Side Channels on SGX with Contrived Data Races

Yinqian Zhang

IEEE Symposium on Security and Privacy

[INFOCOM'18] Differentially Private Access Patterns for Searchable Symmetric Encryption

Yinqian Zhang

IEEE International Conference on Computer Communications

[Source code]

[NDSS'18] OS-level Side Channels without Procfs: Exploring Cross-App Information Leakage on iOS

Yinqian Zhang

Network and Distributed System Security Symposium

Top 10 Finalists of CSAW Best Applied Research Paper Award

[Video]

[NDSS'18] Face Flashing: A Secure Liveness Detection Protocol based on Light Reflections

Yinqian Zhang

Network and Distributed System Security Symposium

2017

[CCS'17] Stacco: Differentially Analyzing Side-Channel Traces for Detecting SSL/TLS Vulnerabilities in Secure Enclaves

Yinqian Zhang

ACM Conference on Computer and Communications Security

(The CCS version of this paper supersedes arxiv 1707.03473.)

[CCS'17] Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX

Yinqian Zhang

ACM Conference on Computer and Communications Security

(The CCS version of this paper supersedes arxiv 1705.07289.)

[PETS'17] Personalized Pseudonyms for Servers in the Cloud

Yinqian Zhang

Privacy Enhancing Technologies Symposium

[AsiaCCS'17] Detecting Privileged Side-Channel Attacks in Shielded Execution with DEJA VU

Yinqian Zhang

ACM Asia Conference on Computer and Communications Security

[AsiaCCS'17] DoS Attacks on Your Memory in the Cloud

Yinqian Zhang

ACM Asia Conference on Computer and Communications Security

(The AsiaCCS version of this paper supersedes arxiv 1603.03404.)

[CODASPY'17] Transparent Backward-Edge Control Flow Violation Detection Using Intel Processor Trace

Yinqian Zhang

ACM Conference on Data and Applications Security and Privacy

2016

[CCS'16] Return-Oriented Flush-Reload Side Channels on ARM and Their Implications for Android Devices

Yinqian Zhang

ACM Conference on Computer and Communications Security

[CCS'16] A Software Approach to Defeating Side Channels in Last-Level Caches

Yinqian Zhang

ACM Conference on Computer and Communications Security

(The CCS version of this paper supersedes arxiv 1603.05615.)

[RAID'16] CloudRadar: A Real-Time Side-Channel Attack Detection System in Clouds

Yinqian Zhang

International Symposium on Research in Attacks, Intrusions and Defenses

[Security'16] One Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks and Privilege Escalation

Yinqian Zhang

USENIX Security Symposium

Top 10 Finalists of CSAW Best Applied Research Paper Award

2015

[CCS'15] Mitigating Storage Side Channels Using Statistical Privacy Mechanisms

Yinqian Zhang

ACM Conference on Computer and Communications Security

[Security'15] A Placement Vulnerability Study in Multi-Tenant Public Clouds

Yinqian Zhang

USENIX Security Symposium

2014 and before

[CCS'14] Cross-Tenant Side-Channel Attacks in PaaS Clouds

Yinqian Zhang

ACM Conference on Computer and Communications Security

[CCS'13] Düppel: Retrofitting Commodity Operating Systems to Mitigate Cache Side Channels in the Cloud

Yinqian Zhang

ACM Conference on Computer and Communications Security

[CCS'12] Cross-VM Side Channels and Their Use to Extract Private Keys

Yinqian Zhang

ACM Conference on Computer and Communications Security

ACM CCS Test-of-Time Award

[S&P'11] HomeAlone: Co-Residency Detection in the Cloud via Side-Channel Analysis

Yinqian Zhang

IEEE Symposium on Security and Privacy

[CCS'10] The Security of Modern Password Expiration: An Algorithmic Framework and Empirical Analysis

Yinqian Zhang

ACM Conference on Computer and Communications Security

[ACSAC'08] Attack Grammar: A New Approach to Modeling and Analyzing Network Attack Sequences

Yinqian Zhang

Annual Computer Security Applications Conference