PMU-Spill: A New Side Channel for Transient Execution Attacks. - Pengfei Qiu; Qiang Gao; Chang Liu 117; Dong-Sheng Wang 002; Yongqiang Lyu 001; Xiaoyong Li 003; Chunlu Wang; Gang Qu 001 (IEEE Trans. Circuits Syst. I Regul. Pap., 2023)

Whisper: Timing the Transient Execution to Leak Secrets and Break KASLR. - Yu Jin; Chunlu Wang; Pengfei Qiu; Chang Liu 117; Yihao Yang; Hongpei Zheng; Yongqiang Lyu 001; Xiaoyong Li 003; Gang Qu 001; Dongsheng Wang 002 (DAC, 2024)

MDPeek: Breaking Balanced Branches in SGX with Memory Disambiguation Unit Side Channels. - Chang Liu 117; Shuaihu Feng; Yuan Li 061; Dongsheng Wang 002; Wenjian He; Yongqiang Lyu 001; Trevor E. Carlson (ASPLOS (2), 2025)