2027
-
TPUZZ: Cross-Domain State-Aware Fuzzing of Google Pixel TPU
In Proceedings of the 2027 Network and Distributed System Security Symposium (To Appear) , 2027
-
Argus: Hardware-Rooted Inference-Time Verification for LLM Execution on Untrusted GPUs
In Proceedings of the 2027 Network and Distributed System Security Symposium (To Appear) , 2027
2026
-
From Fault to Oracle: Breaking Google Pixel TPU Hardware Memory Isolation via Trusted Deserialization Faults
In Proceedings of the 2026 ACM SIGSAC Conference on Computer and Communications Security (To Appear) , 2026
Modern mobile systems increasingly rely on dedicated AI/ML accelerators, such as neural processing units (NPUs) and Tensor Processing Units (TPUs), to meet the latency, energy, and privacy demands of on-device inference. These accelerators are often treated as part of the trusted hardware base (THB), with their code and memory protected by surrounding trusted components. On Google’s Pixel platform, the TPU is intended to remain inaccessible even to a compromised host, with protection anchored by the Google Tensor Security Core (GSC). In this paper, we analyze the isolation architecture of the Pixel TPU and the protection boundary enforced by GSC. We show that, although the host cannot directly cross the hardware isolation boundary, it can still break the intended confidentiality guarantee by using two legitimate channels: the kernel control interface (KCI) and the fault-log buffer. This composition yields a fault-oracle attack that enables arbitrary reads from protected TPU memory, with fault metadata exposed through the log interface serving as a repeatable disclosure channel. The underlying issue is a structural disconnect in GSC’s boundary enforcement. While GSC validates the top-level host-supplied buffer at the isolation boundary, the zero-copy parser could reinterpret attacker-controlled offsets as trusted derived pointers, without re-establishing the original memory-safety invariant.
We further build a lightweight static taint analyzer and systematically identify fault-oracle gadgets across command handlers. On the two Google Pixel A-series production devices, the Pixel 9a and the Pixel 10a, we found 21 reachable sites, through which we could recover the complete protected TPU image, including both the protected DRAM contents and the on-chip runtime state. We responsibly disclosed the vulnerabilities to Google through the Android Vulnerability Reward Program, and Google acknowledged the report and initiated remediation.
-
Hiding Directions, Leaking Structure: Breaking ArrowCloak through Low-Rank Structure
arXiv preprint arXiv:2608.21615, 2026
TEE-shielded inference keeps sensitive state in a trusted execution environment (TEE) while offloading linear algebra to an untrusted accelerator. Wang et al., in Game of Arrows (USENIX Security 2025), showed that five widely adopted lightweight defenses preserve vector directions and introduced ArrowMatch to exploit this leakage. They then proposed ArrowCloak, which adds a different multiple of one shared mask direction to each vector and bases its weight-recovery hardness argument on Learning with Errors (LWE). ArrowCloak successfully reduces ArrowMatch to near-black-box levels.
In this paper, we revisit ArrowCloak from cryptographic and structural perspectives. Its LWE formulation does not by itself establish standard LWE hardness: the reduction direction, quantized arithmetic, and joint instance distribution do not meet the required conditions. Reusing one mask direction leaves a recoverable rank-one component across the released matrix. We exploit this structure with our proposed attack, an end-to-end, query-free recovery attack. Given a public checkpoint and the obfuscated weights, the attack removes the masking subspace, recovers the hidden one-to-one correspondence, and reconstructs protected weights without transformation secrets, victim queries, or fine-tuning data. Across six model-task pairs spanning classification, segmentation, and diffusion, the attack recovers 99.92%-100% of hidden vector correspondences. Reconstructed classification models achieve 94.39%-99.54% victim agreement and differ by at most 1.59 percentage points in accuracy; the recovered segmentation model achieves 98.35% output agreement. These findings suggest that lightweight protection should address both per-vector geometry and joint structure across released weights.
-
Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills
arXiv preprint arXiv:2608.04192, 2026
Closed source agent skills may encode proprietary instructions, scripts, constants, and data. Providers may offer their capabilities as services while keeping the underlying packages hidden. Prior work focuses on prompt injection attacks that directly disclose these artifacts, and existing defenses accordingly aim to prevent such leakage. However, preventing file disclosure does not prevent users from recovering the functionality those files implement. This raises a fundamental question: can a user reconstruct a skill’s functionality through ordinary use while its files remain hidden? We study behavioral skill reconstruction (BSR), in which an attacker uses valid task requests and observed responses to build a functional clone of a hidden skill. We introduce SkillClone, a black-box attack that clones a target skill by forming an interface hypothesis from its public advertisement, issuing structured benign probes, synthesizing an executable replica, and iteratively repairing it through differential validation against the victim skill. Across 30 skills spanning rules, tables, procedures, and algorithms, SkillClone achieves exact or partial recovery on held-out inputs for several targets. Iterative requerying closes gaps missed by single-round reconstruction. Because SkillClone uses only legitimate interactions, disclosure-focused defenses provide limited coverage, and less detailed skill descriptions offer limited protection. These results show that file secrecy alone does not ensure functional secrecy. Defenses must also limit cumulative information leakage from ordinary use.
-
Wave: Leveraging Architecture Observation for Privacy-Preserving Model Oversight
In Proceedings of the 31st ACM International Conference on Architectural Support for Programming Languages and Operating Systems, 2026
Large Language Models (LLMs) inference increasingly require mechanisms that provide runtime visibility into what is actually executing, without exposing model weights or code. We present WAVE, a hardware-grounded monitoring framework that leverages GPU performance counters (PMCs) to observe LLM inference. WAVE is built on the insight that legitimate executions of a given model must satisfy hardware-constrained invariants, such as memory accesses, instruction mix, and tensor-core utilization, induced by the model’s linear-algebraic structure. WAVE collects lightweight PMC traces and applies a two-stage pipeline: (1) inferring architectural properties (e.g., parameter count, layer depth, hidden dimension, batch size) from the observed traces; and (2) using an SMT-based consistency checker to assess whether the execution aligns with the provisioned compute and the claimed model’s constraints. We evaluate WAVE on common open-source LLM architectures, such as LLaMA, GPT, and Qwen, across multiple GPU architectures, including NVIDIA Ada Lovelace, Hopper, and Blackwell. Results show that WAVE recovers key model parameters with an average error of 6.8% and identifies disguised executions under realistic perturbations. By grounding oversight in hardware invariants, WAVE provides a practical avenue for continuous, privacy-preserving runtime monitoring of LLM services.
2025
-
Latte: Layered Attestation for Portable Enclaved Applications
In IEEE 10th European Symposium on Security and Privacy (EuroS&P), 2025
Trusted Execution Environment (TEE) has become increasingly popular in privacy-protected cloud computing, and its rapid development has led to the availability of various heterogeneous TEE platforms on cloud servers. To facilitate portable TEE applications on heterogeneous TEE platforms, portable languages or intermediate representations (IRs) with platform-dependent TEE runtimes are adopted. However, existing remote attestation solutions for portable TEE applications follow a nested attestation pattern, i.e., attesting only the TEE runtime and relying on the TEE runtime to measure the loaded portable application, leading to potential security issues. On the other hand, directly packing the TEE runtime and the portable application into an enclave for secure attestation undermines the portability of the portable TEE applications. In this paper, we introduce the concept of portable identities to identify portable TEE applications, and propose a layered attestation framework, Latte, achieving both security and portability in attesting portable TEE applications. We provide a prototype implementation of Latte to validate its practicality, with WebAssembly as the portable IR, and Intel SGX and RISC-V Penglai as the exemplar heterogeneous TEEs. The evaluation demonstrates that Latte introduces minimal performance overhead compared with the nested attestation pattern.
* indicates equal contribution