I am a PhD student in the RootSec lab at CISPA Helmholtz Center for Information Security, advised by Dr. Michael Schwarz. In Fall 2024, I was a research intern at Google, where I continued exploring side-channel attacks targeting Confidential Virtual Machines (CVMs). Before starting my PhD, I worked as a security researcher at PeckShield from July 2018 to February 2021.

My research focuses on CPU and system security, including software-based architectural attacks, side channels, and the security of Trusted Execution Environments (TEEs). I am particularly interested in bridging hardware security research with real-world impact. I have disclosed critical vulnerabilities that necessitated microcode and firmware patches across major cloud providers, including Google Cloud, AWS, IBM, Microsoft Azure, and Alibaba Cloud, directly hardening the environments that handle the world’s most sensitive workloads.

Beyond immediate mitigation, my work ranges from side-channel analysis to exposing risks in RISC-V, and has contributed to reshaping threat models in both open and closed architectures. These contributions have been widely discussed in industry media, including like Tom’s Hardware, BleepingComputer, The Register, Dark Reading, The Hacker News, among many others.

I am on the academic job market for the 2025-2026 cycle. I am actively seeking opportunities and would be happy to discuss a potential fit.

Interests
  • Software-Induced CPU Faults
  • Side-channel and Microarchitectural Security
  • Confidential Computing
  • Program Analysis
Education
  • PhD Student, 2022-Present

    CISPA Helmholtz Center for Information Security

  • PhD Preparatory Phase, 2021

    CISPA Helmholtz Center for Information Security

  • BSc in Software Engineering (Cybersecurity), 2015

    University of Electronic Science and Technology of China, UESTC

Publications

(2025). Under embargo. In USENIX Security 2026.

Cite

(2025). SNPeek: Side-Channel Analysis for Privacy Applications on Confidential VMs. In NDSS 2026.

PDF Cite Code

(2025). Automatic Discovery of User-exploitable Architectural Security Vulnerabilities in Closed-Source RISC-V CPUs. In ACM CCS 2025.

PDF Cite Code Website

(2025). Taming the Linux Memory Allocator for Rapid Prototyping. In DIMVA 2025.

PDF Cite Code Slides

(2025). ShadowLoad: Injecting State into Hardware Prefetchers. In ASPLOS 2025.

PDF Cite Code

(2024). CacheWarp: Software-based Fault Injection using Selective State Reset. In USENIX Security 2024.

PDF Cite Code Slides Video Website Demo#1 Demo#2

(2023). (M)WAIT for It: Bridging the Gap between Microarchitectural and Architectural Side Channels. In USENIX Security 2023.

PDF Cite Code Slides Video

(2023). A Security RISC: Microarchitectural Attacks on Hardware RISC-V CPUs. In S&P 2023.

PDF Cite Code Video

(2023). Indirect Meltdown: Building Novel Side-Channel Attacks from Transient Execution Attacks. In ESORICS 2023.

PDF Cite Code

(2023). Reviving Meltdown 3a. In ESORICS 2023.

PDF Cite Code

(2021). EOSAFE: Security Analysis of EOSIO Smart Contracts. In USENIX Security 2021.

PDF Cite Slides Video

Recent News

[2025.06] Our paper “CacheWarp: Software-based Fault Injection using Selective State Reset” won the Best Hardware and Physics Paper in Cybersecurity Award 2025!

[2024.12] My internship in New York has come to an end. Huge thanks to everyone who made this journey unforgettable!

[2024.11] I proved to my colleagues that I can tell apart Cola Zero / Coca Cola / Diet Coke with just one sip! Sadly, we forgot to record it.

[2024.08] Happy to receive the distinguished artifact reviewers award at USENIX Security'24!

[2024.08] Due to a visa delay, I won’t be able to present our BH’USA talk as planned 😢.

[2024.05] Our briefing application got accepted in Black Hat USA 2024!

[2024.04] I will be a research intern at Google NYC this fall!

[2023.11] After a 7-month embargo, we are excited to publicly disclose CacheWarp (CVE-2023-20592).

Talks

Arbitrary Data Manipulation and Leakage with CPU Zero-Day Bugs on RISC-V
BlackHat USA'24

CVEs

Under embargo

Under embargo

CVE-2024-44067 - Fabian Thomas, Eric García Arribas, Lorenz Hetterich, Daniel Weber, Lukas Gerlach, Ruiyi Zhang, Michael Schwarz

CVE-2023-20592 - Ruiyi Zhang, Lukas Gerlach, Daniel Weber, Lorenz Hetterich, Youheng Lü, Andreas Kogler, Michael Schwarz