8 papers
MCP-SandboxScan: WASM-based Secure Execution and Runtime Analysis for MCP Tools
Zhuoran Tan, Run Hao, Jeremy Singer +2
Tool-augmented Large Language Model (LLM) agents create a new supply-chain surface: Model Context Protocol (MCP) tools are installed like third-party packages, yet their outputs ca…
FuseChain: Runtime Evidence Reconstruction for Software Supply-Chain Attacks
Zhuoran Tan, Yutian Tang, Jeremy Singer +2
Software supply-chain (SSC) attacks are increasingly multi-stage, cross-source, and temporally distributed. A single attack campaign may leave weak and fragmented traces across mul…
Operational Runtime Behavior Mining for Open-Source Supply Chain Security
Zhuoran Tan, Ke Xiao, Jeremy Singer +1
Open-source software (OSS) is a critical component of modern software systems, yet supply chain security remains challenging in practice due to unavailable or obfuscated source cod…
Attesting LLM Pipelines: Enforcing Verifiable Training and Release Claims
Zhuoran Tan, Jeremy Singer, Christos Anagnostopoulos
Modern Large Language Model (LLM) systems are assembled from third-party artifacts such as pre-trained weights, fine-tuning adapters, datasets, dependency packages, and container i…
SynthChain: A Synthetic Benchmark and Forensic Analysis of Advanced and Stealthy Software Supply Chain Attacks
Zhuoran Tan, Wenbo Guo, Taylor Brierley +3
Advanced software supply chain (SSC) attacks are increasingly runtime-only and leave fragmented evidence across hosts, services, and build/dependency layers, so any single telemetr…
FuzzRDUCC: Fuzzing with Reconstructed Def-Use Chain Coverage
Kai Feng, Jeremy Singer, Angelos K Marnerides
Binary-only fuzzing often struggles with achieving thorough code coverage and uncovering hidden vulnerabilities due to limited insight into a program's internal dataflows. Traditio…