The Polyglot's Dilemma: Conformance Testing a Dozen Specs in as Many Languages
为确保MongoDB在多种编程语言中的客户端库行为一致，开发了基于YAML的统一测试格式，减少了非一致性错误。
0 citationsRead paper
Selected work
Representative Papers
Plaintext Recovery Against Post-Filtering Access Control
While existing post-filtering–based fine-grained access control (FGAC) mechanisms prevent direct data leakage, their susceptibility to existence side channels poses significant risks under complex queries. This work presents the first systematic demonstration of how timing and scoring side channels, combined with rich query interfaces—such as range, prefix, and conjunctive predicates—can be exploited to efficiently reconstruct high-entropy plaintext content in PostgreSQL and Elasticsearch/OpenSearch. By leveraging binary search, SQL expressions, prefix expansion, and document scoring mechanisms, we devise novel reconstruction attacks tailored to relational databases and search engines, successfully recovering unknown attribute values, complete records, and corpus n-grams. Our findings expose fundamental security flaws in current post-filtering FGAC schemes when deployed in environments supporting expressive query predicates.
0 citationsRead paper
Beyond Text Editing: Algebraic Manipulation of Source Code
Traditional text-based code editing struggles to satisfy syntactic and semantic constraints, leading to inefficient performance by large language model (LLM) agents when performing cross-file or non-local modifications. This work proposes Source Code Algebra (SCA), a novel framework that introduces compositional, idempotent, and commutative algebraic operations into code editing, replacing character-level edits with semantically complete atomic operations. Built upon abstract syntax trees, SCA defines semantics-aware edit primitives and formally models their algebraic properties, integrating them into an LLM interface. Experimental evaluation of the prototype system SCAS demonstrates that this paradigm significantly improves modification success rates while reducing communication token overhead by one to two orders of magnitude, highlighting its potential as an efficient and accurate new approach to code editing.
0 citationsRead paper
Autoregressive Synthesis of Sparse and Semi-Structured Mixed-Type Data
This work addresses the limitations of existing synthetic data generation methods, which rely on dense tabular assumptions and struggle to effectively model sparse, semi-structured, and mixed-type data such as JSON, thereby limiting their scalability in modern data systems. To overcome this, the authors propose Origami, an end-to-end architecture based on autoregressive Transformers that employs a structure-aware tokenization strategy. This approach natively encodes nested objects, variable-length arrays, and heterogeneous data types into sequences of key, value, and structural tokens—without requiring flattening or imputation. Experimental results demonstrate that Origami significantly outperforms baseline methods—including GANs, VAEs, and diffusion models—in terms of fidelity, utility, and privacy preservation, maintaining high-quality synthesis even on semi-structured data with sparsity levels as high as 38%.
0 citationsRead paper
Trace Validation of Unmodified Concurrent Systems with OmniLink
Verifying concurrent systems is notoriously challenging due to rare thread interleavings, and existing approaches often require invasive instrumentation or rely on unrealistic execution models. This work proposes OmniLink, a novel method that models system events as black-box operations constrained by temporal windows and leverages TLA+ semantics to infer a logical total order of actions. By doing so, OmniLink enables high-fidelity verification without modifying the target system. It transcends the limitations of traditional linearizability checking by supporting non-linearizable behaviors and remains compatible with general-purpose model checkers. Experimental evaluation demonstrates that OmniLink successfully verifies industrial and research-grade systems—including WiredTiger, BAT, and ConcurrentQueue—not only reproducing known bugs but also uncovering two previously unknown vulnerabilities, significantly outperforming state-of-the-art tools.
0 citationsRead paper
Recent publications
Latest Papers
The Polyglot's Dilemma: Conformance Testing a Dozen Specs in as Many Languages
为确保MongoDB在多种编程语言中的客户端库行为一致，开发了基于YAML的统一测试格式，减少了非一致性错误。
0 citationsRead paper
Plaintext Recovery Against Post-Filtering Access Control
While existing post-filtering–based fine-grained access control (FGAC) mechanisms prevent direct data leakage, their susceptibility to existence side channels poses significant risks under complex queries. This work presents the first systematic demonstration of how timing and scoring side channels, combined with rich query interfaces—such as range, prefix, and conjunctive predicates—can be exploited to efficiently reconstruct high-entropy plaintext content in PostgreSQL and Elasticsearch/OpenSearch. By leveraging binary search, SQL expressions, prefix expansion, and document scoring mechanisms, we devise novel reconstruction attacks tailored to relational databases and search engines, successfully recovering unknown attribute values, complete records, and corpus n-grams. Our findings expose fundamental security flaws in current post-filtering FGAC schemes when deployed in environments supporting expressive query predicates.
0 citationsRead paper
Beyond Text Editing: Algebraic Manipulation of Source Code
Traditional text-based code editing struggles to satisfy syntactic and semantic constraints, leading to inefficient performance by large language model (LLM) agents when performing cross-file or non-local modifications. This work proposes Source Code Algebra (SCA), a novel framework that introduces compositional, idempotent, and commutative algebraic operations into code editing, replacing character-level edits with semantically complete atomic operations. Built upon abstract syntax trees, SCA defines semantics-aware edit primitives and formally models their algebraic properties, integrating them into an LLM interface. Experimental evaluation of the prototype system SCAS demonstrates that this paradigm significantly improves modification success rates while reducing communication token overhead by one to two orders of magnitude, highlighting its potential as an efficient and accurate new approach to code editing.
0 citationsRead paper
Autoregressive Synthesis of Sparse and Semi-Structured Mixed-Type Data
This work addresses the limitations of existing synthetic data generation methods, which rely on dense tabular assumptions and struggle to effectively model sparse, semi-structured, and mixed-type data such as JSON, thereby limiting their scalability in modern data systems. To overcome this, the authors propose Origami, an end-to-end architecture based on autoregressive Transformers that employs a structure-aware tokenization strategy. This approach natively encodes nested objects, variable-length arrays, and heterogeneous data types into sequences of key, value, and structural tokens—without requiring flattening or imputation. Experimental results demonstrate that Origami significantly outperforms baseline methods—including GANs, VAEs, and diffusion models—in terms of fidelity, utility, and privacy preservation, maintaining high-quality synthesis even on semi-structured data with sparsity levels as high as 38%.
0 citationsRead paper
Trace Validation of Unmodified Concurrent Systems with OmniLink
Verifying concurrent systems is notoriously challenging due to rare thread interleavings, and existing approaches often require invasive instrumentation or rely on unrealistic execution models. This work proposes OmniLink, a novel method that models system events as black-box operations constrained by temporal windows and leverages TLA+ semantics to infer a logical total order of actions. By doing so, OmniLink enables high-fidelity verification without modifying the target system. It transcends the limitations of traditional linearizability checking by supporting non-linearizable behaviors and remains compatible with general-purpose model checkers. Experimental evaluation demonstrates that OmniLink successfully verifies industrial and research-grade systems—including WiredTiger, BAT, and ConcurrentQueue—not only reproducing known bugs but also uncovering two previously unknown vulnerabilities, significantly outperforming state-of-the-art tools.
0 citationsRead paper