Mengyuan (Marvin) Li

Research direction

TEE and Confidential Computing

Mengyuan Li’s research on trusted execution environments (TEEs) and confidential computing spans four related areas: TEE-based systems and their performance, attacks on confidential computing platforms, defenses for secure cloud and AI infrastructure, and general cloud security.

Topics: AMD SEV and SEV-SNP · Intel SGX · confidential VMs · cloud GPU security · ciphertext side channels · virtualization · secure networking · serverless platforms

Systems

  1. ISCA 2026 MC-ORAM: A Mask-Assisted and Counter-Based Non-Deterministic ORAM Inside VM-Based TEEs Yongqin Wang, Rachit Rajat, Jonghyun Lee, Mengyuan Li, Murali Annavaram 53rd ACM/IEEE Annual International Symposium on Computer Architecture (ISCA 2026)

    Explores secure memory techniques for VM-based TEEs and efficient protected execution.

    DOI · BibTeX
  2. HPCA 2026 SCALE: Tackling Communication Bottlenecks in Confidential Distributed Machine Learning Joongun Park, Yongqin Wang, Huan Xu, Hanjiang Wu, Mengyuan Li, Tushar Krishna 2026 IEEE International Symposium on High-Performance Computer Architecture (HPCA 2026)

    Connects confidential computing with efficient multi-GPU machine learning and shows how to reduce system bottlenecks in trusted infrastructure.

    DOI · BibTeX
  3. SeQureDB 2026 Workshop Query Cost Model Calibration in Confidential Virtual Machines Qihan Zhang, Mengyuan Li, Ibrahim Sabek Workshop on Secure and Private Data Management (SeQureDB 2026)

    Narrows the slowdown of analytical queries in confidential VMs such as AMD SEV-SNP with a lightweight calibration of the query optimizer’s cost model for data movement and RMP-related translation.

    PDF · arXiv · BibTeX
  4. arXiv 2026 Preprint OTRO: Oblivious Tokenization Path with Square-Root ORAM Jonghyun Lee, Yongqin Wang, Rachit Rajat, Daniel Wong, Mengyuan Li, Murali Annavaram arXiv preprint arXiv:2606.17358

    Reduces access-pattern leakage from the CPU-side tokenizer in confidential LLM serving with replicated square-root ORAM, adding at most 4.5% to time-to-first-token in an Intel TDX confidential VM with an NVIDIA H100 GPU.

    PDF · arXiv · BibTeX
  5. arXiv 2026 Preprint Infrastructure for Valuable, Tradable, and Verifiable Agent Memory Mengyuan Li, Lei Gao, Haoxuan Xu, Jiate Li, Potung Yu, Lingke Cheng, Yue Zhao, Murali Annavaram arXiv preprint arXiv:2603.24564

    Proposes infrastructure that makes agent memory verifiable and tradable: ClawGang binds memory to verifiable computational provenance through TEE remote attestation, and MeowTrade is a market layer for listing, transferring, and governing certified memory artifacts.

    PDF · arXiv · Code · BibTeX
  6. arXiv 2024 Preprint Ditto: Elastic Confidential VMs with Secure and Dynamic CPU Scaling Shixuan Zhao*, Mengyuan Li*, Mengjia Yan, Zhiqiang Lin arXiv preprint arXiv:2409.15542

    Explores how to support elastic confidential VMs with secure and dynamic CPU scaling, improving the flexibility and efficiency of TEE-based systems.

    PDF · arXiv · BibTeX
  7. arXiv 2024 Preprint Bridge the Future: High-Performance Networks in Confidential VMs without Trusted I/O devices Mengyuan Li, Shashvat Srivastava, Mengjia Yan arXiv preprint arXiv:2403.03360

    Studies how to improve networking performance for confidential VMs without relying on trusted I/O devices, targeting practical system optimization in confidential cloud settings.

    PDF · arXiv · BibTeX
  8. IEEE S&P 2022 vSGX: Virtualizing SGX Enclaves on AMD SEV Shixuan Zhao, Mengyuan Li, Yinqian Zhang, Zhiqiang Lin 2022 IEEE Symposium on Security and Privacy (S&P 2022)

    Bridges virtualization and enclave protection across TEE platforms, highlighting system support for deployable trusted execution.

    DOI · PDF · Code · BibTeX

* Equal contribution.

Attacks

  1. HASP 2025 Workshop A Close Look at RMP Entry Caching and Its Security Implications in SEV-SNP Alexis Bagia, Vincent Quentin Ulitzsch, Daniël Trujillo, Mengyuan Li, Mengjia Yan, Jean-Pierre Seifert 14th International Workshop on Hardware and Architectural Support for Security and Privacy (HASP 2025)

    Examines the security implications of RMP entry caching in SEV-SNP and expands the attack surface analysis of confidential computing platforms.

    Disclosures: AMD-SB-3036 DOI · BibTeX
  2. DIMVA 2023 PWRLEAK: Exploiting Power Reporting Interface for Side-Channel Attacks on AMD SEV Wubing Wang, Mengyuan Li, Yinqian Zhang, Zhiqiang Lin 20th Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA 2023)

    Demonstrates a side-channel attack surface exposed by the power reporting interface in AMD SEV platforms.

    Disclosures: AMD-SB-3004 · CVE-2023-20575 DOI · PDF · BibTeX
  3. IEEE S&P 2022 A Systematic Look at Ciphertext Side Channels on AMD SEV-SNP Mengyuan Li*, Luca Wilke*, Jan Wichelmann, Thomas Eisenbarth, Radu Teodorescu, Yinqian Zhang 2022 IEEE Symposium on Security and Privacy (S&P 2022)

    Studies side-channel vulnerabilities that break confidentiality guarantees in encrypted and confidential execution settings.

    Disclosures: AMD-SB-1033 · CVE-2021-46744 AMD published an official white paper for TEE developers and users on writing code that resists ciphertext side channels. AMD white paper DOI · PDF · BibTeX
  4. ACSAC 2021 TLB Poisoning Attacks on AMD Secure Encrypted Virtualization Mengyuan Li, Yinqian Zhang, Huibo Wang, Kang Li, Yueqiang Cheng 37th Annual Computer Security Applications Conference (ACSAC 2021)

    Uncovers a microarchitectural attack that breaks isolation assumptions in AMD SEV through TLB manipulation.

    Disclosures: AMD-SB-1023 · CVE-2021-26340 · Lenovo LEN-75179 DOI · PDF · BibTeX
  5. ACM CCS 2021 CROSSLINE: Breaking “Security-by-Crash” based Memory Isolation in AMD SEV Mengyuan Li, Yinqian Zhang, Zhiqiang Lin 2021 ACM SIGSAC Conference on Computer and Communications Security (CCS 2021)

    Shows how crash-based isolation assumptions can fail in AMD SEV and lead to cross-boundary memory exposure.

    Best Paper Award Runner-Up DOI · PDF · arXiv · BibTeX
  6. USENIX Security 2021 CIPHERLEAKS: Breaking Constant-time Cryptography on AMD SEV via the Ciphertext Side Channel Mengyuan Li, Yinqian Zhang, Huibo Wang, Kang Li, Yueqiang Cheng 30th USENIX Security Symposium (USENIX Security 2021)

    Shows how ciphertext side channels can break constant-time cryptographic implementations running inside AMD SEV.

    Disclosures: AMD-SB-1013 · CVE-2020-12966 AMD filed an embargo for the ciphertext side channel identified in the paper and announced a security bulletin together with a hardware patch for SEV-SNP in August 2021. Paper · PDF · Website · BibTeX
  7. USENIX Security 2019 Exploiting Unprotected I/O Operations in AMD’s Secure Encrypted Virtualization Mengyuan Li, Yinqian Zhang, Zhiqiang Lin, Yan Solihin 28th USENIX Security Symposium (USENIX Security 2019)

    Studies attacks that exploit unprotected I/O operations in AMD SEV, highlighting early weaknesses in confidential VM designs.

    Paper · PDF · BibTeX

* Equal contribution.

Beyond TEEs

Vulnerability research outside TEEs, such as Chekhov’s Gun on macOS sandboxing (ACM CCS 2025) and VReaves on electromagnetic side channels (arXiv 2025), is in the full publication list.

Defenses

  1. ACM ASIACCS 2024 SoK: Understanding Design Choices and Pitfalls of Trusted Execution Environments Mengyuan Li, Yuheng Yang, Guoxing Chen, Mengjia Yan, Yinqian Zhang 19th ACM Asia Conference on Computer and Communications Security (ASIA CCS 2024)

    A systems-oriented overview of TEE design tradeoffs and common pitfalls, useful for understanding how to build more secure confidential computing systems.

    DOI · PDF · BibTeX
  2. USENIX Security 2023 CipherH: Automated Detection of Ciphertext Side-channel Vulnerabilities in Cryptographic Implementations Sen Deng, Mengyuan Li, Yining Tang, Shuai Wang, Shoumeng Yan, Yinqian Zhang 32nd USENIX Security Symposium (USENIX Security 2023)

    Automatically detects program points in cryptographic software that are vulnerable to ciphertext side channels, finding over 200 in the RSA and ECDSA/ECDH implementations of OpenSSL, MbedTLS, and wolfSSL.

    Paper · PDF · Code · BibTeX
  3. IEEE DSC 2019 Defeating Speculative-Execution Attacks on SGX with HyperRace Guoxing Chen, Mengyuan Li, Fengwei Zhang, Yinqian Zhang 2019 IEEE Conference on Dependable and Secure Computing (DSC 2019)

    Addresses speculative-execution threats in SGX and reflects broader work on attack surfaces and mitigation around TEE platforms.

    DOI · PDF · BibTeX

Cloud

  1. USENIX ATC 2018 Peeking Behind the Curtains of Serverless Platforms Liang Wang, Mengyuan Li, Yinqian Zhang, Thomas Ristenpart, Michael Swift 2018 USENIX Annual Technical Conference (USENIX ATC 2018)

    Studies security and isolation properties of serverless platforms, representing broader cloud security work beyond TEE-specific mechanisms.

    Paper · PDF · Code · BibTeX

This line of work also connects to cloud multi-tenancy, isolation failures, and shared-infrastructure threats that matter beyond confidential computing.