Research

Verifiable AI

Evidence about what model ran, how it ran, and whether its results can be trusted, without revealing sensitive data.

As AI systems enter high-stakes workflows, users need evidence that a result came from the claimed model and computation, ideally without revealing sensitive data. We study how such evidence can be produced for LLM inference and where proof-based (zero-knowledge) approaches fail. Hollow-LLM Attack identifies a security problem in zero-knowledge verification of LLM inference, while WAVE uses architecture-level observation to oversee model execution without exposing model data.

SEPT Lab also maintains verifiable.pro, a public resource on verifiable AI, starting with trusted execution environments. It offers news, explainers, and guides on what evidence can establish about an AI service’s claims, and where the limits remain.

Topics: zero-knowledge verification, LLM inference, model oversight, architecture observation.

Representative papers

Hollow-LLM Attack: Computationally Trivial Weights in Zero-Knowledge Verification of LLM Inference.

Chen Gong, Beijie Liu, and Mengyuan Li. In IEEE S&P, 2026.

WAVE: Leveraging Architecture Observation for Privacy-Preserving Model Oversight.

Haoxuan Xu, Chen Gong, Beijie Liu, Haizhong Zheng, Beidi Chen, and Mengyuan Li. In ASPLOS, 2026.
All 2 papers in this direction since 2024

TEEs and Confidential Computing

Make hardware-isolated execution practical: efficient, secure TEE-based systems for cloud and AI workloads.

Trusted execution environments (TEEs) such as AMD SEV-SNP and Intel SGX let cloud tenants run code and data in hardware-isolated contexts, and confidential VMs and GPUs extend this isolation to entire workloads. We build TEE-based systems and study what it takes for them to run efficiently, from oblivious memory access inside VM-based TEEs to communication in confidential multi-GPU machine learning. We also build defenses, such as automated detection of ciphertext side-channel vulnerabilities in cryptographic implementations.

Topics: AMD SEV-SNP, Intel SGX, confidential VMs, confidential GPUs, oblivious memory (ORAM).

Representative papers

MC-ORAM: A Mask-Assisted and Counter-Based Non-Deterministic ORAM Inside VM-Based TEEs.

Yongqin Wang, Rachit Rajat, Jonghyun Lee, Mengyuan Li, and Murali Annavaram. In ISCA, 2026.

SCALE: Tackling Communication Bottlenecks in Confidential Distributed Machine Learning.

Joongun Park, Yongqin Wang, Huan Xu, Hanjiang Wu, Mengyuan Li, and Tushar Krishna. In HPCA, 2026.

SoK: Understanding Design Choices and Pitfalls of Trusted Execution Environments.

Mengyuan Li, Yuheng Yang, Guoxing Chen, Mengjia Yan, and Yinqian Zhang. In ACM ASIACCS, 2024.

Ditto: Elastic Confidential VMs with Secure and Dynamic CPU Scaling.

Shixuan Zhao, Mengyuan Li, Mengjia Yan, and Zhiqiang Lin. arXiv preprint arXiv:2409.15542, 2024.
All 8 papers in this direction since 2024

System and Hardware Vulnerabilities

Find the design flaws and side channels that break security guarantees, and disclose them to vendors.

We look for design flaws and side channels that break the security guarantees of systems and hardware, across cloud systems, CPUs, GPUs, and AI systems. Recent work examines RMP entry caching in AMD SEV-SNP, for which AMD published security bulletin AMD-SB-3036; hidden risks in macOS application-sandboxed PID-domain services; electromagnetic side channels that reveal virtual reality app identity and activity; and attacks on AI models.

Earlier work on AMD SEV uncovered attacks through unprotected I/O operations, ciphertext side channels, TLB poisoning, and the power reporting interface; AMD confirmed several of these findings through security bulletins and CVEs.

Topics: side channels, SEV-SNP, macOS sandboxing, electromagnetic leakage, attacks on AI models.

Representative papers

A Close Look at RMP Entry Caching and Its Security Implications in SEV-SNP.

Alexis Bagia, Vincent Quentin Ulitzsch, Daniël Trujillo, Mengyuan Li, Mengjia Yan, and Jean-Pierre Seifert. In HASP (workshop), 2025.

Chekhov’s Gun: Uncovering Hidden Risks in macOS Application-Sandboxed PID-Domain Services.

Minghao Lin, Jiaxun Zhu, Tingting Yin, Zechao Cai, Guanxing Wen, Yanan Guo, and Mengyuan Li. In ACM CCS, 2025.

VReaves: Eavesdropping on Virtual Reality App Identity and Activity via Electromagnetic Side Channels.

Wei Sun, Minghong Fang, and Mengyuan Li. arXiv preprint arXiv:2506.17570, 2025.
All 7 papers in this direction since 2024

AI Agent Security

Observe and protect agent execution with TEEs and runtime monitoring.

AI agents increasingly run on shared cloud infrastructure and handle sensitive data. We use TEEs and runtime monitoring to observe agent execution and to build trusted infrastructure for LLM systems and agents. Open problems include isolating tool execution and protecting long-lived memory and secrets.

Topics: runtime monitoring, tool isolation, agent memory and secrets, trusted infrastructure.

Open problems

  • How to use TEEs or runtime monitoring to observe agent execution
  • How to isolate tool execution
  • How to protect long-lived memory and secrets
  • How to build trusted infrastructure for LLM systems and agents
  • How to defend against cloud- and hardware-level leakages in agent backends

Representative papers

Infrastructure for Valuable, Tradable, and Verifiable Agent Memory.

Mengyuan Li, Lei Gao, Haoxuan Xu, Jiate Li, Potung Yu, Lingke Cheng, Yue Zhao, and Murali Annavaram. arXiv preprint arXiv:2603.24564, 2026.

Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills.

Peichun Hua, Haoxuan Xu, and Mengyuan Li. arXiv preprint arXiv:2608.04192, 2026.

CatchBench: When Can an Agent Failure Be Caught?

Yue Zhao, Mengyuan Li, Ruolin Li, Prince Zizhuang Wang, Shuli Jiang, Linsey Pang, Xiongye Xiao, and Xiyang Hu. arXiv preprint arXiv:2608.22808, 2026.

WAVE: Leveraging Architecture Observation for Privacy-Preserving Model Oversight.

Haoxuan Xu, Chen Gong, Beijie Liu, Haizhong Zheng, Beidi Chen, and Mengyuan Li. In ASPLOS, 2026.
All 4 papers in this direction since 2024

Projects and artifacts

These and other repositories are in the lab’s GitHub organization, github.com/sept-usc.

  • WAVE artifact. Code for the ASPLOS 2026 paper WAVE. It observes GPU performance counters to check claims about model execution, such as a minimum model size, without exposing model data. Running it requires an NVIDIA GPU. Paper: WAVE (ASPLOS 2026). GitHub
  • ClawGang. Infrastructure for valuable, tradable, and verifiable agent memory. ClawGang binds agent memory to verifiable computational provenance through TEE-based certification on AMD SEV-SNP. The repository includes the white paper. Paper: Infrastructure for Valuable, Tradable, and Verifiable Agent Memory (Preprint 2026). WebsiteGitHub
  • Muse MCP Adapter. A user-controlled bridge between the Muse personal agent and MCP servers. The agent sees only the capabilities the user has reviewed, and every write is confirmed by the user first and runs at most once. GitHub

Lab members are shown in bold. An asterisk (*) marks equal contribution.