Return-Oriented Flush-Reload Side Channels on ARM and Their Implications for Android Devices. - Xiaokuan Zhang; Yuan Xiao 001; Yinqian Zhang (CCS, 2016)

One Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks and Privilege Escalation. - Yuan Xiao 001; Xiaokuan Zhang; Yinqian Zhang; Radu Teodorescu (USENIX Security Symposium, 2016)

STACCO: Differentially Analyzing Side-Channel Traces for Detecting SSL/TLS Vulnerabilities in Secure Enclaves. - Yuan Xiao 001; Mengyuan Li 004; Sanchuan Chen; Yinqian Zhang (CCS, 2017)

SgxPectre Attacks: Leaking Enclave Secrets via Speculative Execution. - Guoxing Chen; Sanchuan Chen; Yuan Xiao 001; Yinqian Zhang; Zhiqiang Lin 001; Ten-Hwang Lai (CoRR, 2018)

OBFUSCURO: A Commodity Obfuscation Engine on Intel SGX. - Adil Ahmad; Byunggill Joe; Yuan Xiao 001; Yinqian Zhang; Insik Shin; Byoungyoung Lee (NDSS, 2019)

SPEECHMINER: A Framework for Investigating and Measuring Speculative Execution Vulnerabilities. - Yuan Xiao 001; Yinqian Zhang; Radu Teodorescu (NDSS, 2020)

SgxPectre: Stealing Intel Secrets From SGX Enclaves via Speculative Execution. - Guoxing Chen; Sanchuan Chen; Yuan Xiao 001; Yinqian Zhang; Zhiqiang Lin 001; Ten-Hwang Lai (IEEE Secur. Priv., 2020)

ENCLYZER: Automated Analysis of Transient Data Leaks on Intel SGX. - Jiuqin Zhou; Yuan Xiao 001; Radu Teodorescu; Yinqian Zhang (SEED, 2022)

TEESec: Pre-Silicon Vulnerability Discovery for Trusted Execution Environments. - Moein Ghaniyoun; Kristin Barber; Yuan Xiao 001; Yinqian Zhang; Radu Teodorescu (ISCA, 2023)

AEX-Notify: Thwarting Precise Single-Stepping Attacks through Interrupt Awareness for Intel SGX Enclaves. - Scott Constable; Jo Van Bulck; Xiang Cheng; Yuan Xiao 001; Cedric Xing; Ilya Alexandrovich; Taesoo Kim; Frank Piessens; Mona Vij; Mark Silberstein (USENIX Security Symposium, 2023)

SENSE: Enhancing Microarchitectural Awareness for TEEs via Subscription-Based Notification. - Fan Sang; Jaehyuk Lee; Xiaokuan Zhang; Meng Xu; Scott Constable; Yuan Xiao 001; Michael Steiner 001; Mona Vij; Taesoo Kim (NDSS, 2024)

Erebor: A Drop-In Sandbox Solution for Private Data Processing in Untrusted Confidential Virtual Machines. - Chuqi Zhang; Rahul Priolkar; Yuancheng Jiang; Yuan Xiao 001; Mona Vij; Zhenkai Liang; Adil Ahmad (EuroSys, 2025)