# Publications · SEPT Lab at USC

Canonical page: https://septlab.com/publications.html

This list covers SEPT Lab publications since 2024, grouped by year\. Lab members are shown in bold\. An asterisk \(\*\) marks equal contribution\. Earlier work and up\-to\-date records are on the principal investigator’s [Google Scholar](https://scholar.google.com/citations?user=cgjqyuoAAAAJ) and [DBLP](https://dblp.org/pid/157/4437-4.html) profiles\.

## 2026 \(11\)

### MC\-ORAM: A Mask\-Assisted and Counter\-Based Non\-Deterministic ORAM Inside VM\-Based TEEs\.

Yongqin Wang, Rachit Rajat, Jonghyun Lee, **Mengyuan Li**, and Murali Annavaram\. In *ISCA*, 2026\.

- [Paper](https://doi.org/10.1109/ISCA66397.2026.00047)

### Hollow\-LLM Attack: Computationally Trivial Weights in Zero\-Knowledge Verification of LLM Inference\.

**Chen Gong**, **Beijie Liu**, and **Mengyuan Li**\. In *IEEE S&P*, 2026\.

- [Paper](https://doi.org/10.1109/SP63933.2026.00258)
- [arXiv](https://arxiv.org/abs/2607.28884)

### SCALE: Tackling Communication Bottlenecks in Confidential Distributed Machine Learning\.

Joongun Park, Yongqin Wang, Huan Xu, Hanjiang Wu, **Mengyuan Li**, and Tushar Krishna\. In *HPCA*, 2026\.

- [Paper](https://doi.org/10.1109/HPCA68181.2026.11408582)

### WAVE: Leveraging Architecture Observation for Privacy\-Preserving Model Oversight\.

**Haoxuan Xu**, **Chen Gong**, **Beijie Liu**, Haizhong Zheng, Beidi Chen, and **Mengyuan Li**\. In *ASPLOS*, 2026\.

- [Paper](https://doi.org/10.1145/3779212.3790247)
- [Code](https://github.com/sept-usc/Wave)

### Query Cost Model Calibration in Confidential Virtual Machines\.

Qihan Zhang, **Mengyuan Li**, and Ibrahim Sabek\. In *SeQureDB* \(workshop\), 2026\.

- [arXiv](https://arxiv.org/abs/2606.26385)
- [PDF](https://arxiv.org/pdf/2606.26385)

### Safety Offset Learning: When Benign Fine\-Tuning Misaligns LLMs\.

Jesson Wang, Zhanhao Hu, **Minghao Lin**, Yuchen Wu, Aylin Caliskan, and **Mengyuan Li**\. *arXiv preprint arXiv:2610\.25611*, 2026\.

- [arXiv](https://arxiv.org/abs/2610.25611)
- [PDF](https://arxiv.org/pdf/2610.25611)
- [Code](https://github.com/JessonWong/safety-offset-learning)

### CatchBench: When Can an Agent Failure Be Caught?

Yue Zhao, **Mengyuan Li**, Ruolin Li, Prince Zizhuang Wang, Shuli Jiang, Linsey Pang, Xiongye Xiao, and Xiyang Hu\. *arXiv preprint arXiv:2608\.22808*, 2026\.

- [arXiv](https://arxiv.org/abs/2608.22808)
- [PDF](https://arxiv.org/pdf/2608.22808)
- [Code](https://github.com/yzhao062/catchbench)

### Hiding Directions, Leaking Structure: Breaking ArrowCloak through Low\-Rank Structure\.

**Beijie Liu**, Junyi Ouyang, **Haoxuan Xu**, Vincent Quentin Ulitzsch, **Potung Yu**, Yajie Zhao, and **Mengyuan Li**\. *arXiv preprint arXiv:2608\.21615*, 2026\.

- [arXiv](https://arxiv.org/abs/2608.21615)
- [PDF](https://arxiv.org/pdf/2608.21615)

### Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills\.

Peichun Hua, **Haoxuan Xu**, and **Mengyuan Li**\. *arXiv preprint arXiv:2608\.04192*, 2026\.

- [arXiv](https://arxiv.org/abs/2608.04192)
- [PDF](https://arxiv.org/pdf/2608.04192)

### OTRO: Oblivious Tokenization Path with Square\-Root ORAM\.

Jonghyun Lee, Yongqin Wang, Rachit Rajat, Daniel Wong, **Mengyuan Li**, and Murali Annavaram\. *arXiv preprint arXiv:2606\.17358*, 2026\.

- [arXiv](https://arxiv.org/abs/2606.17358)
- [PDF](https://arxiv.org/pdf/2606.17358)

### Infrastructure for Valuable, Tradable, and Verifiable Agent Memory\.

**Mengyuan Li**, Lei Gao, **Haoxuan Xu**, Jiate Li, **Potung Yu**, Lingke Cheng, Yue Zhao, and Murali Annavaram\. *arXiv preprint arXiv:2603\.24564*, 2026\.

- [arXiv](https://arxiv.org/abs/2603.24564)
- [PDF](https://arxiv.org/pdf/2603.24564)
- [GitHub](https://github.com/sept-usc/ClawGang)

## 2025 \(9\)

### Chekhov’s Gun: Uncovering Hidden Risks in macOS Application\-Sandboxed PID\-Domain Services\.

**Minghao Lin**, Jiaxun Zhu, Tingting Yin, Zechao Cai, Guanxing Wen, Yanan Guo, and **Mengyuan Li**\. In *ACM CCS*, 2025\.

- [Paper](https://doi.org/10.1145/3719027.3765205)

### Writing in Symbiosis: Mapping Human Creative Agency in the AI Era\.

**Vivan Doshi** and **Mengyuan Li**\. In *NeurIPS*, Creative AI Track, 2025\.

- [Paper](https://proceedings.neurips.cc/paper_files/paper/2025/hash/615229550c97d1c4d006a4bf6b54590e-Abstract-Creative_AI_Track.html)
- [PDF](https://papers.neurips.cc/paper_files/paper/2025/file/615229550c97d1c4d006a4bf6b54590e-Paper-Creative_AI_Track.pdf)

### A Close Look at RMP Entry Caching and Its Security Implications in SEV\-SNP\.

Alexis Bagia, Vincent Quentin Ulitzsch, Daniël Trujillo, **Mengyuan Li**, Mengjia Yan, and Jean\-Pierre Seifert\. In *HASP* \(workshop\), 2025\.

- [Paper](https://doi.org/10.1145/3768725.3768727)
- [Vendor disclosure: AMD\-SB\-3036](https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3036.html)

### Few\-Shot Graph Out\-of\-Distribution Detection with LLMs\.

**Haoyan Xu**, Zhengtao Yao, Yushun Dong, Ziyi Wang, Ryan A\. Rossi, **Mengyuan Li**, and Yue Zhao\. In *ECML PKDD*, 2025\.

- [Paper](https://doi.org/10.1007/978-3-032-06078-5_18)
- [arXiv](https://arxiv.org/abs/2503.22097)

### LEGO\-Learn: Label\-Efficient Graph Open\-Set Learning\.

**Haoyan Xu**, Kay Liu, Zhengtao Yao, Philip S\. Yu, **Mengyuan Li**, Kaize Ding, and Yue Zhao\. In *TMLR*, 2025\.

- [Paper](https://openreview.net/forum?id=J6oxTJPOyN)
- [arXiv](https://arxiv.org/abs/2410.16386)
- [Code](https://github.com/zhengtaoyao/lego)

### A Systematic Study of Model Extraction Attacks on Graph Foundation Models\.

**Haoyan Xu**, Ruizhi Qian, Jiate Li, Yushun Dong, **Minghao Lin**, Hanson Yan, Zhengtao Yao, Qinghua Liu, Junhao Dong, Ruopeng Huang, Yue Zhao, and **Mengyuan Li**\. *arXiv preprint arXiv:2511\.11912*, 2025\.

- [arXiv](https://arxiv.org/abs/2511.11912)
- [PDF](https://arxiv.org/pdf/2511.11912)

### VReaves: Eavesdropping on Virtual Reality App Identity and Activity via Electromagnetic Side Channels\.

Wei Sun, Minghong Fang, and **Mengyuan Li**\. *arXiv preprint arXiv:2506\.17570*, 2025\.

- [arXiv](https://arxiv.org/abs/2506.17570)
- [PDF](https://arxiv.org/pdf/2506.17570)

### GLIP\-OOD: Zero\-Shot Graph OOD Detection with Graph Foundation Model\.

**Haoyan Xu**, Zhengtao Yao, Xuzhi Zhang, Ziyi Wang, Langzhou He, Yushun Dong, Philip S\. Yu, **Mengyuan Li**, and Yue Zhao\. *arXiv preprint arXiv:2504\.21186*, 2025\.

- [arXiv](https://arxiv.org/abs/2504.21186)
- [PDF](https://arxiv.org/pdf/2504.21186)

### Graph Synthetic Out\-of\-Distribution Exposure with Large Language Models\.

**Haoyan Xu**, Zhengtao Yao, Ziyi Wang, Zhan Cheng, Xiyang Hu, **Mengyuan Li**, and Yue Zhao\. *arXiv preprint arXiv:2504\.21198*, 2025\.

- [arXiv](https://arxiv.org/abs/2504.21198)
- [PDF](https://arxiv.org/pdf/2504.21198)

## 2024 \(3\)

### SoK: Understanding Design Choices and Pitfalls of Trusted Execution Environments\.

**Mengyuan Li**, Yuheng Yang, Guoxing Chen, Mengjia Yan, and Yinqian Zhang\. In *ACM ASIACCS*, 2024\.

- [Paper](https://doi.org/10.1145/3634737.3644993)
- [PDF](https://mengyuan-l.github.io/files/asiaccs_sok.pdf)

### Ditto: Elastic Confidential VMs with Secure and Dynamic CPU Scaling\.

Shixuan Zhao, **Mengyuan Li**, Mengjia Yan, and Zhiqiang Lin\. *arXiv preprint arXiv:2409\.15542*, 2024\.

- [arXiv](https://arxiv.org/abs/2409.15542)
- [PDF](https://arxiv.org/pdf/2409.15542)

### Bridge the Future: High\-Performance Networks in Confidential VMs without Trusted I/O devices\.

**Mengyuan Li**, Shashvat Srivastava, and Mengjia Yan\. *arXiv preprint arXiv:2403\.03360*, 2024\.

- [arXiv](https://arxiv.org/abs/2403.03360)
- [PDF](https://arxiv.org/pdf/2403.03360)