arXiv subjects

Shixuan Zhao

Publications and source records attributed to Shixuan Zhao.

11 recordsLinked to original sources

arXiv2026

OpenPCC: Open and Confidential LLM Serving on Commodity TEEs

Generative AI applications such as personal AI agents, image generators, and chat assistants offer advanced capabilities to improve user experience. Behind the scenes, Large Language Models (LLMs) that power these services require a massive amount of computation and are usually deployed in the cloud, available as APIs, meaning that a user's request has to be sent to a Cloud Inference Service (CIS) for processing. However, the strong capabilities of LLM also mean that user's requests now contain much more personal sensitive or enterprise confidential information, demanding equally strong protection in CIS. While early industry efforts such as Apple Private Cloud Compute (PCC) and Google Private AI Compute have emerged to show the potential of secure CIS, they are not adoptable for deployment by others due to their reliance on proprietary hardware and closed ecosystem. In addition, they all suffer from their own design glitches that can undermine the ambitious goal of bringing in true privacy protection to end users. In this paper, we present our analysis of the fundamental requirements of building a secure yet open CIS. We then present OpenPCC, a Confidential CIS framework that does not rely on proprietary hardware but instead uses commercially available TEEs. We implement an open-source prototype and characterize it end-to-end on a Llama-3 8B vLLM workload, separating OpenPCC's own cost from the underlying TEE hardware. Our analysis and evaluation demonstrated the feasibility and security of the system.

cs.CR↗

arXiv2026

Too Private to Tell: Practical Token Theft Attacks on Apple Intelligence

Apple Intelligence is a generative AI (GenAI) service provided by Apple on its devices. While offering a similar set of features as other similar GenAI services, Apple Intelligence is claimed to be designed with an extra focus on user security and privacy through a two-stage authentication and authorization design using anonymous access tokens. In this paper, we present our investigation into this token issuance mechanism with a goal to reveal possible vulnerabilities using traffic analysis, reverse engineering, and cross comparison with Apple's public documentation. Specifically, we present the Serpent attack, the first practical cross-device token replay attack against Apple Intelligence that allows the attacker to steal the access tokens from the victim's device and utilise them on a different device, with all usage rate-limited against the victim. We have achieved successful attacks on the latest macOS 26 Tahoe and demonstrated that an attacker, who even has used up its own allowance, can immediately regain access to Apple Intelligence service. We have responsibly disclosed the vulnerabilities to the vendors and received confirmation from Apple with CVE assigned and bounty given. Our results highlight a general lesson for built-in AI services: Anonymising identity does not by itself make the AI service secure; Enforcing non-transferability requires cryptographic binding to the rightful user.

cs.CR↗

arXiv2026

Styx: Collaborative and Private Data Processing With TEE-Enforced Sticky Policy

Protecting sensitive information in data-driven collaborations, such as AI training, while meeting the diverse requirements of multiple mutually distrusted stakeholders, is both crucial and challenging. This paper presents Styx, a novel framework to address this challenge by integrating sticky policies with Trusted Execution Environments (TEEs). At a high level, Styx employs a hardware-TEE-protected middleware with a programming language runtime to form a sandboxed environment for both the data processing and policy enforcement. We carefully designed a data processing workflow and pipelines to enable a strong yet flexible data-specific policy enforcement throughout the entire data lifecycle and data derivation to achieve data-in-use protection, data lifecycle protection and dynamic collaboration. We implemented Styx and demonstrated its ability to make collaborative computing, such as joint AI training, more secure, privacy-preserving, and policy-compliant. Our evaluation shows the performance overheads imposed by Styx are reasonable on single-node computation with the capability to scale to a large distributed multi-node deployment.

cs.CR↗

arXiv2025

Blueprint, Bootstrap, and Bridge: A Security Look at NVIDIA GPU Confidential Computing

NVIDIA GPU Confidential Computing (GPU-CC) aims to provide secure execution for AI workloads. For end users, enabling GPU-CC is seamless and requires no modifications to existing applications. However, this ease of adoption relies on a proprietary and highly complex system that is difficult to inspect, creating challenges for researchers seeking to understand its architecture and security landscape. In this work, we provide a security look at GPU-CC by reconstructing a coherent view of the system. We first examine the system's blueprint, focusing on the specialized architectural engines that support its security mechanisms. We then analyze the bootstrap process, which coordinates hardware and software components to establish these protections. Finally, we conduct targeted experiments to assess whether, under the GPU-CC threat model, data transfers along different paths remain protected across the bridge between trusted CPU and GPU domains. We responsibly disclosed all security findings presented in this paper to the NVIDIA Product Security Incident Response Team (PSIRT).

cs.CR↗

arXiv2024

VPBSD:Vessel-Pattern-Based Semi-Supervised Distillation for Efficient 3D Microscopic Cerebrovascular Segmentation

3D microscopic cerebrovascular images are characterized by their high resolution, presenting significant annotation challenges, large data volumes, and intricate variations in detail. Together, these factors make achieving high-quality, efficient whole-brain segmentation particularly demanding. In this paper, we propose a novel Vessel-Pattern-Based Semi-Supervised Distillation pipeline (VpbSD) to address the challenges of 3D microscopic cerebrovascular segmentation. This pipeline initially constructs a vessel-pattern codebook that captures diverse vascular structures from unlabeled data during the teacher model's pretraining phase. In the knowledge distillation stage, the codebook facilitates the transfer of rich knowledge from a heterogeneous teacher model to a student model, while the semi-supervised approach further enhances the student model's exposure to diverse learning samples. Experimental results on real-world data, including comparisons with state-of-the-art methods and ablation studies, demonstrate that our pipeline and its individual components effectively address the challenges inherent in microscopic cerebrovascular segmentation.

cs.CV↗

arXiv2024

Ditto: Elastic Confidential VMs with Secure and Dynamic CPU Scaling

Confidential Virtual Machines (CVMs) are a type of VMbased Trusted Execution Environments (TEEs) designed to enhance the security of cloud-based VMs, safeguarding them even from malicious hypervisors. Although CVMs have been widely adopted by major cloud service providers, current CVM designs face significant challenges in runtime resource management due to their fixed capacities and lack of transparency. These limitations hamper efficient cloud resource management, leading to increased operational costs and reduced agility in responding to fluctuating workloads. This paper introduces a dynamic CPU resource management approach, featuring the novel concept of "Elastic CVM. This approach allows for hypervisor-assisted runtime adjustment of CPU resources using a specialized vCPU type, termed Worker vCPU. This new approach enhances CPU resource adaptability and operational efficiency without compromising security. Additionally, we introduce a Worker vCPU Abstraction Layer to simplify Worker vCPU deployment and management. To demonstrate the effectiveness of our approach, we have designed and implemented a serverless computing prototype platform, called Ditto. We show that Ditto significantly improves performance and efficiency through finergrain resource management. The concept of "Elastic CVM" and the Worker vCPU design not only optimize cloud resource utilization but also pave the way for more flexible and cost-effective confidential computing environments.

cs.CR↗

arXiv2024

Retinal Vessel Segmentation with Deep Graph and Capsule Reasoning

Effective retinal vessel segmentation requires a sophisticated integration of global contextual awareness and local vessel continuity. To address this challenge, we propose the Graph Capsule Convolution Network (GCC-UNet), which merges capsule convolutions with CNNs to capture both local and global features. The Graph Capsule Convolution operator is specifically designed to enhance the representation of global context, while the Selective Graph Attention Fusion module ensures seamless integration of local and global information. To further improve vessel continuity, we introduce the Bottleneck Graph Attention module, which incorporates Channel-wise and Spatial Graph Attention mechanisms. The Multi-Scale Graph Fusion module adeptly combines features from various scales. Our approach has been rigorously validated through experiments on widely used public datasets, with ablation studies confirming the efficacy of each component. Comparative results highlight GCC-UNet's superior performance over existing methods, setting a new benchmark in retinal vessel segmentation. Notably, this work represents the first integration of vanilla, graph, and capsule convolutional techniques in the domain of medical image segmentation.

eess.IV↗

arXiv2022

Rethinking the Detection Head Configuration for Traffic Object Detection

Multi-scale detection plays an important role in object detection models. However, researchers usually feel blank on how to reasonably configure detection heads combining multi-scale features at different input resolutions. We find that there are different matching relationships between the object distribution and the detection head at different input resolutions. Based on the instructive findings, we propose a lightweight traffic object detection network based on matching between detection head and object distribution, termed as MHD-Net. It consists of three main parts. The first is the detection head and object distribution matching strategy, which guides the rational configuration of detection head, so as to leverage multi-scale features to effectively detect objects at vastly different scales. The second is the cross-scale detection head configuration guideline, which instructs to replace multiple detection heads with only two detection heads possessing of rich feature representations to achieve an excellent balance between detection accuracy, model parameters, FLOPs and detection speed. The third is the receptive field enlargement method, which combines the dilated convolution module with shallow features of backbone to further improve the detection accuracy at the cost of increasing model parameters very slightly. The proposed model achieves more competitive performance than other models on BDD100K dataset and our proposed ETFOD-v2 dataset. The code will be available.

cs.CV↗

arXiv2022

Quantum Fluctuations and Coherence of a Molecular Polariton Condensate

A full quantum theory beyond the mean-field regime is developed for an exciton polariton condensate, to gain a complete understanding of quantum fluctuations. We find analytical solution for the polariton density matrix, showing the polariton nonlinearity causing fast relaxation correlated with the pump so as to yield the condensation at threshold. Increasing the pump intensity, a nonequilibrium phase transition towards the condensation of lower polaritons emerges, with a statistics transiting from a thermal, through a super-Poissonian and to a nonclassical distribution beyond the understanding at the level of off-diagonal long-range order. The results signify the role of dark states for polariton fluctuations, and lead to a nonclassical counting statistics of emitted photons, which elaborates the role of the key parameters, e.g., pump, detuning and temperature.

cond-mat.mes-hall↗

arXiv2020

Observation of spin-momentum-layer locking in centrosymmetric BiOI

Spin polarization effects in nonmagnetic materials are generally believed as an outcome of spin-orbit coupling provided that the global inversion symmetry is lacking, also known as 'spin-momentum locking'. The recently discovered hidden spin polarization indicates that specific atomic site asymmetry could also induce measurable spin polarization, leading to a paradigm shift to centrosymmetric crystals for potential spintronic applications. Here, combining spin- and angle-resolved photoemission spectroscopy and theoretical calculations, we report distinct spin-layer locking phenomena surrounding different high-symmetry momenta in a centrosymmetric, layered material BiOI. The measured spin is highly polarized along the Brillouin zone boundary, while is almost vanishing around the zone center due to its nonsymmorphic crystal structure. Our work not only demonstrates the existence of hidden spin polarization, but also uncovers the microscopic mechanism of the way spin, momentum and layer locking to each other, shedding lights on the design metrics for future spintronic devices.

cond-mat.mtrl-sci↗

arXiv2019

Magnetic order induced polarization anomaly of Raman scattering in 2D magnet CrI$_3$

The recent discovery of 2D magnets has revealed various intriguing phenomena due to the coupling between spin and other degree of freedoms (such as helical photoluminescence, nonreciprocal SHG). Previous research on the spin-phonon coupling effect mainly focuses on the renormalization of phonon frequency. Here we demonstrate that the Raman polarization selection rules of optical phonons can be greatly modified by the magnetic ordering in 2D magnet CrI$_3$. For monolayer samples, the dominant A$\rm_{1g}$ peak shows abnormally high intensity in the cross polarization channel at low temperature, which is forbidden by the selection rule based on the lattice symmetry. While for bilayer, this peak is absent in the cross polarization channel for the layered antiferromagnetic (AFM) state and reappears when it is tuned to the ferromagnetic (FM) state by an external magnetic field. Our findings shed light on exploring the emergent magneto-optical effects in 2D magnets.

cond-mat.mes-hall↗