Publications

2027

Zepade Attacks: Exploiting Zero-Page Deduplication for Side-Channel Attacks
Simon Einzinger, Tristan Hornetz, Michael Schwarz · IEEE S&P

2026

StackWarp: Breaking AMD SEV-SNP Integrity via Deterministic Stack-Pointer Manipulation through the CPU's Stack Engine
Ruiyi Zhang, Tristan Hornetz, Daniel Weber, Fabian Thomas, Michael Schwarz · USENIX Security
GitHub Website CVE-2025-29943 AMD Security Bulletin
LoongLeak: Architectural Cross-Privilege-Boundary Data Leakage on LoongArch CPUs
Lorenz Hetterich, Tristan Hornetz, Fabian Thomas, Michael Schwarz · USENIX Security
Website Artifact
InstrSem: Automatically and Generically Inferring Semantics of (Undocumented) CPU Instructions
Lorenz Hetterich, Fabian Thomas, Tristan Hornetz, Michael Schwarz · USENIX Security
GitHub
TDXRay: Microarchitectural Side-Channel Analysis of Intel TDX for Real-World Workloads
Tristan Hornetz*, Hosein Yavarzadeh*, Albert Cheu, Adria Gascon, Lukas Gerlach, Daniel Moghimi, Phillipp Schoppmann, Michael Schwarz, Ruiyi Zhang · IEEE S&P
*equal contribution joint first authors
GitHub Website Intel Advisory AMD Security Bulletin
Crucible: Retrofitting Commodity CPUs with Vulnerabilities via Transparent Software Emulation
Tristan Hornetz, Lukas Gerlach, Michael Schwarz · IEEE S&P
GitHub

2025

Rapid Reversing of Non-Linear CPU Cache Slice Functions: Unlocking Physical Address Leakage
Mikka Rainer, Lorenz Hetterich, Fabian Thomas, Tristan Hornetz, Leon Trampert, Lukas Gerlach, Michael Schwarz · IEEE S&P
GitHub
Taming the Linux Memory Allocator for Rapid Prototyping
Ruiyi Zhang, Tristan Hornetz, Lukas Gerlach, Michael Schwarz · DIMVA
GitHub
Lixom: Protecting Encryption Keys with Execute-Only Memory
Tristan Hornetz, Lukas Gerlach, Michael Schwarz · FC
GitHub
PortPrint: Identifying Inaccessible Code with Port Contention
Tristan Hornetz, Michael Schwarz · uASC
GitHub

Talks

2026

TDXRay: Side-Channel Analysis of Intel TDX for Private LLM Inference
Tristan Hornetz, Hosein Yavarzadeh · Qualcomm Product Security Summit · San Diego, CA, USA · May 14 2026
Recording
Crucible: Retrofitting Commodity CPUs with Vulnerabilities via Transparent Software Emulation
Tristan Hornetz · DVClub Zurich · Zurich, Switzerland · June 17 2026