Linke Song
PhD Student in Computer Systems Organization
Institute of Information Engineering, University of Chinese Academy of Sciences
Now writing · Blog
Between Layers / 层间札记
从指令集到智能体，记录系统安全、机密计算、AI 基础设施，以及研究与构建过程中的思考。
PhD student in computer systems at UCAS / IIE, working under Prof. Wei Song and Prof. Wenhao Wang. My work spans hardware ISA, firmware, Linux kernel internals, and userspace — independently built. Past projects: NestedSGX (built nested enclaves within confidential VMs; NDSS'25), a solo-built confidential container system (custom ISA + kernel critical-path patching + firmware enforcement; now being ported to the BOOM RISC-V core and FPGA platforms), and an LLM KV-cache side-channel attack (led GPU noise mitigation, attack design, and implementation; 99% TPR, TIFS'25). Research interests: OS-level isolation, virtualization, sandboxing, TEEs, scalable confidential computing, and LLM agent infrastructure (container-based sandboxing, KV cache security, privacy-preserving inference). CS self-study.
Seeking internship opportunities in agent systems, agent container/sandboxing, and KV cache infrastructure.
I am currently seeking relevant internship opportunities. If any of this resonates, I would be glad to connect — thank you! 🙏
Education
PhD, Computer Systems Organization
University of Chinese Academy of Sciences, Institute of Information Engineering
Transferred from master's track · Advisor: Prof. Wei Song, Prof. Wenhao Wang
2024 – now
M.Eng, Cyberspace Security
University of Chinese Academy of Sciences, Institute of Information Engineering
Advisor: Prof. Wenhao Wang · GPA 3.83 / 4.00
2022 – 2024
B.Eng, Cyberspace Security
University of Chinese Academy of Sciences
Advisor: Prof. Wenhao Wang, Prof. Dongdai Lin · GPA 3.70 / 4.00 (Top 30%)
2018 – 2022
Teaching
Teaching Assistant, Digital Circuits
Fall 2025
Undergraduate course, School of Cyber Science and Technology, University of Chinese Academy of Sciences
Research Projects
NaCRE: Native Confidential Containers on RISC-V
2025.5 – present
- Problem: Existing confidential containers repurpose hardware mechanisms not designed for containers, sacrificing native-ness. Arm CCA treats containers as TEE workloads with large contiguous memory — no primitives purpose-built for native confidential containers.
- Approach: Reused RISC-V PMP with bitmap + MMU modifications to protect page-table pages and data pages without fragmenting Linux's native memory allocation — containers stay ordinary processes.
- vs. Existing: No virtualization/confidential-computing hardware dependency (unlike Kata/gVisor). Introduces a new hardware abstraction layer for containers; native Linux allocation with targeted hardening, no invasive kernel patches.
- Security: Container lifecycle protection integrated into the full address-allocation pipeline.
- Performance: Near-zero overhead vs. native Docker on compute-intensive tasks; under 2× slowdown on memory-intensive tasks — significantly better than microVM approaches.
- Hardware porting (in progress): Porting NaCRE beyond its QEMU model onto real hardware platforms — the BOOM out-of-order RISC-V core (via Chipyard) and FPGA prototyping (FireSim flow), parameterizing the physical layout (OpenSBI/Linux/Agent/metadata/PTP regions) for FPGA DRAM configurations.
- Porting work: Authored the QEMU↔RTL semantic-alignment design that freezes the hardware contract for the port: custom CSRs (
nacc_state,nacc_sagent/nacc_eagent,twin_entry,trampoline),acall/aretcustom instructions, PTW-time page-table checks, the per-PFN 2-bit metadata bitmap, and TLB revocation on tag change; specified the (access source × privilege × state × PFN tag) → allow/fault access matrix and a T0–T8 bare-metal smoke suite that co-validates QEMU against Verilator, explicitly separating architecture from emulator conveniences (e.g., A/D write-back,cpu_abort()). - My role: Sole developer spanning the entire stack — custom hardware ISA primitives, Linux kernel critical-path modifications (page allocation, RSS accounting, page-fault handling — preserving existing metadata correctness), OpenSBI firmware integration, eCall interface and protocol design.
LLM Side-Channel Attack on KV Cache
2024.6 – 2025.4
- Problem: KV cache reuse in LLM serving systems creates a timing side channel — TTFT reductions reveal victim prompt overlap. Found exploitable in SGLang (prefix sharing) and GPT-Cache (semantic similarity).
- Approach: In SGLang, a single shared token with Llama 3.1 8B/70B yields measurable latency drop. Designed token-by-token prompt recovery; overcame GPU voltage/frequency noise with a countermeasure, achieving 99% TPR.
- GPT-Cache Attack: Discovered a distinct vector — semantically similar queries with identical sensitive info trigger TTFT speedups via similarity-based cache matching.
- Defense: Proposed coarse-grained token-sharing defense that expands the attacker's guessing space.
- Impact: One of the earliest two teams to report KV-cache privacy risks to SGLang (the other: ByteDance Security Research, same week). Presented at SGLang biweekly meeting (Oct. 19, 2024).
- Publication: Submitted to USENIX Security'25, ACM CCS'25; accepted at TIFS'25 (CCF-A journal).
NestedSGX: Nested Enclaves in Confidential VMs
2023.7 – 2024.5
- Problem: Confidential VMs face a large TCB in the guest OS. No existing mechanism to establish trusted enclaves inside a CVM while keeping the guest OS out of the TCB.
- Approach: Leveraged AMD SEV-SNP VMPL to introduce a lightweight hypervisor within the CVM, de-privileging the guest OS — even a compromised kernel cannot access enclave memory.
- Compatibility: Built trusted enclave runtime atop Occlum and Intel SGX SDK, compatible with existing SGX ecosystem — unmodified SGX apps run inside the nested enclave.
- Engineering: Modified Linux kernel drivers; wrote in-VM hypervisor in Rust (7,000+ LoC — page faults, error paths, custom trampoline for cross-privilege transitions).
- Recognition: 2 AE badges; invited by Asterinas community for online seminar. Submitted to ASPLOS'24, ACM CCS'24; accepted at NDSS'25 (CCF-A conference).
Publications
The Early Bird Catches the Leak: Unveiling Timing Side Channels in LLM Serving Systems
Skills
Languages
C, Rust, Python
Tools
Git, Docker, Qemu, OpenSBI, Linux Kernel, Chipyard, FireSim
Areas
Trusted Execution Environments, Operating Systems, Virtualization, Container
Architectures
x86, RISC-V