🌅 7 AM, morning report

Every morning, Otter sends a text summary of what it worked on overnight, what still needs doing, and anything that requires my input. It also sends a TTS audio version, so I can listen on my commute.

📅 8 AM, calendar briefing

At 8 AM, a short Slack message lays out the day. Meetings, focus blocks, anything on the calendar. Focus block is marked with 🌲. I can overview what the day looks like from slack, without visiting calendar.google.com.

🔬 10 AM, research brainstorming

I open a Slack channel for research project and talk through whatever I am working on. Ideas, deadlines, and things I need to track down. As the conversation goes, Otter picks up todo items and research notes and writes them to the right Obsidian file.

💻 12 PM, lunch break and headless clawd

Waiting for coffee at a cafe. I pull out my phone, open Slack, and describe a task to Otter. Something like running an analysis, fixing a bug, or drafting a document. Otter hands it off to headless-clawd, Claude Code running in a Docker container on my desktop.

Being able to get work done without sitting at my computer was something I really wanted. This is exactly that.

📚 4 PM, paper recommendations

Google Scholar sends me email for paper recommendation. A script runs every 30 minutes to check Gmail for new Scholar alerts. When one arrives, it parses the email and wakes Otter via a POST to /hooks/wake. Otter then filters the papers by relevance to my research and posts a curated list to my #reading channel with a short description and tags for each paper.

🌙 10 PM, weather forecast

Every night around 10 PM, Otter sends the next day’s forecast for Seoul. Temperature range, conditions, and what to wear. Unlike a weather app, it pushes the information to me so I do not have to think to open it.

🦦 3 AM, nightly work

While I sleep, Otter works through the todo queue. Writing drafts, organizing notes, running code experiments, committing results to git. What it did overnight gets compiled into the morning report and delivered at 7 AM.

Otter working alone is not perfect. It makes mistakes, misses context, and sometimes does things I need to redo. But the biggest benefit I have noticed is, it starts things. On my own, I would have delayed those tasks for weeks or never gotten around to them at all. Getting started is the hardest part, and Otter does that.

Research

• Finalize the projects I’m currently working on and get them accepted.
• Possibly start a new project from the ideas I’ve been brainstorming.

Life

• Get up early and exercise regularly in the morning. This is the most efficient way to build strength and stay productive.

• Keep a journal regularly.

• Reduce snacks between meals. At the end of 2024, our lab had a visitor who spent the whole day with me. He only ate meals and almost never snacked. Spending time with him made me realize that I have snacks more than I thought and it’s possible to live without them!

Career

• Actively search for a job.
• Decide between Academia vs Industry vs Somewhere in between.

Submitting another paper in the first half of the year and focusing on job searching in the second half will be my main focus of 2025. Wish me luck!

First Black Hat experience

I’ve never been to Black Hat before, so I was very excited, especially since I was going to present for the first time in an international conference. There were lots of people, great talks, and free food and drinks :blue_heart:. Some gifts were also given: a Black Hat backpack, which I found very practical and useful, a tumblr with a straw, and a badge.

I also attended the speaker VIP party prior to the conference, where I had the chance to meet many researchers and security experts in person. It was so exciting to meet professionals I’ve only seen in papers.

For the sake of networking, I did try to connect with others, and I think it was quite successful. Since English is not my first language, it’s always challenging to communicate at such parties, but I was fairly able to communicate with others (shoutout to all my online English tutors!). However, I still feel like I need to expand my vocabulary to express my thoughts more clearly.

Regarding the venue, it was huge, so I had to walk a lot. I was exhausted every day because I only brought shoes with hard soles. I should have brought more comfortable shoes for walking. The business hall had many company booths where I could get free t-shirts and other company swags. I wanted to visit more booths but couldn’t being busy with my talk and other things.

Despite the venue’s size, the briefing sessions weren’t as crowded as I expected. I’ve heard that the briefings were usually packed (about 10 years ago), but the session halls had plenty of empty seats. I only saw people lining up once, for the “15 ways to Break your Copilot” talk (does everyone want to break Copilot?). But most talks weren’t even half full.

Among the 5-6 talks I attended, some were really interesting and tackled the specific subjects I’m working on at the moment. It assured me that I was doing relevant research, but it also made me think I need to push our projects harder to complete them before someone else does :face_with_spiral_eyes:.

I found LLM security talk by Richard Harang (Nvidia) very fascinating. Not only was the content excellent, but the way he presented was also very engaging.

My talk

As a first-time speaker, I was quite nervous about my talk, especially since Black Hat is a non-academic conference with a large and diverse audience. Before the conference, my advisor and I had many discussions about the content and visuals to make it easy to follow for the general audience. We also had multiple rounds of rehearsals.

At the conference, before my talk, I had a scheduled interview with Dark Reading. I expected it to be a simple, brief session that would be published as an article later. But it turned out to be a news desk-style live interview with a camera crew! I was so nervous because I didn’t expect it to be live, and I hadn’t prepared for that at all. It was the most overwhelming experience I had on this trip. Well, I think I did my best, staying calm and answering the questions somehow… :sweat_smile:

On the day of the presentation, I felt quite confident–maybe because I had practiced a lot and had already gone through the anxiety of the live interview. I was also kind of tired of being nervous since my talk was scheduled at the afternoon of the last day. So I thought, “I don’t care anymore. I just want to finish this.”

The talk went successful. I think I even enjoyed the feeling of being on stage and having the audience’s attention (?!). The audience seemed engaged in my talk (no one appeared to be dozing off or leaving the hall). Some gave me positive feedback afterward, which I greatly appreciated and made me feel all the effort was worth it. I received many questions as well and was genuinely happy to see that my research was interesting to many people.

Overall, I really enjoyed presenting at Black Hat USA and highly recommend it. I loved the feeling of being on stage and all the speaker privileges from BlackHat. I definitely want to present at Black Hat again!

Google 0x0g party

During this trip, I attended the Google 0x0g party (Google Vulnerability Reward Program party). It was my first time attending such an event, and there were so many security engineers from Google and various companies. The party featured programs with talks and events, but it was mainly about networking and socializing. I got to meet people around the industry, and overall, it was a great experience.

Since I had given my talk about bypassing MTE the day before, I had some conversations about it. Opinions on MTE were quite divided across the industry, even within Google. Some were very positive about MTE, while others are quite negative, with some suggesting that MTE could be deprecated (?). This was interesting to me because, in academia, particularly in systems security, MTE is generally considered as a promising direction for future security, as long as the cost is not too high. The cost is indeed a significant issue, but the Pixel 8 series has demonstrated that MTE’s performance overhead is negligible. I also have a paper under review that leverages MTE for attack mitigation. Unfortunately, it has gone through the review process at top-tier security conferences about 4-5 times, but no reviewer raised concerns about the feasibility of MTE as a defense so far.

Another interesting thing I picked up, not only from this party but also from other people I’ve met in the past, is that high-end IOT device manufacturers are generally more positive about MTE. I’ve heard that Amazon is considering MTE for their future devices, and I also learned at this event that Meta is considering MTE for future Oculus devices. I wonder if this is because they are less concerned about the performance or other costs? In any case, it seems our researches on MTE is still highly relevant to the industry, and I’m excited to see how it will be adopted in the future.

Defcon 2024

Defcon felt a lot less organized than BlackHat. As a non-CTF player, I didn’t find much to do at Defcon. I mostly wandered around some of the villages and attended a talk about bypassing Copilot (again, by a different speaker). Then I spent some time at the Car Hacking Village, where my advisor was participating in the CTF :smile:. I just watched him play and worked on my own stuff. By that point, I didn’t have much social energy left, so I tried to focus on getting back to my research.

I also attended the AIxCC closing ceremony, where the winners of the AIxCC competition were announced. I heard the competition was quite intense, with participants dedicating a lot of time and resources. I was happy to see few teams I know win the competition and move on to the final round. I really wanted to see AI beat previous techniques like fuzzing and symbolic execution, but I think we’re not there yet. Would love to see more progress in this area!

Hotels & Pools

I stayed at Mandalay Bay during Black Hat, and Fontainebleau during Defcon. Both hotels were great, close to each conference venue, and had nice pools.

Mandalay Bay was a classic hotel with a spacious room. It was a bit old-fashioned, but the room was clean and comfortable. The hotel was huge, and I had to walk a lot to get to the conference venue. I think I didn’t had enough time to explore the hotel during Black Hat, but I did enjoy their pool before checking out.

Mandalay’s pool was really nice. On Friday, before we checked out, we went to the pool, and surprisingly, there weren’t many people. With various pools–wave pool, lazy river, and regular pool–it was fun to hop around and enjoy the sun. Compared to wave pools in Korea, Mandalay’s had smaller waves, but they allowed people to swim in the deeper areas. While this seemed a bit dangerous for kids and non-swimmers, I actually had fun swimming in the pool where my feet couldn’t touch the ground.

We wanted to visit Mandalay Bay’s pool again after checking out, so we returned on Monday morning, paying $25 for per person for a pool pass :joy:. However, Monday was much more crowded, and I couldn’t enjoy the pool as much as I did on Friday. Maybe it was because the price was cheaper on Monday, or perhaps because Black Hat has ended and many people were staying at the hotel for vacation. Still, I enjoyed the pool and got a bit of tan :sunglasses:.

Fontainebleau was much more luxurious than Mandalay Bay. I had seen some reviews mentioning that the rooms weren’t always well-cleaned, but our room was okay–maybe not perfect, but acceptable. The room was a bit smaller than at Mandalay Bay, but the facilities were much newer and cleaner. They even had USB-C ports on the wall!

Fontainebleau’s pool was also nice. Although they didn’t have a variety of pools like Mandalay Bay, the pool was clean and not too crowded. They also offered free parasols for sunbeds! I had a great time swimming and relaxing at the pool.

Despite its expensive image, some restaurants at Fontainebleau were good and reasonably priced, considering the usual costs in Las Vegas. Our favorite was a Hong Kong-style restaurant called “Washing Potato”. We had lunch there twice to enjoy dim sum and noodles :yum:.

Casinos

I thought I wouldn’t be a fan of casinos, but I actually liked playing the games. I played blackjack and roulette, mostly at Fontainebleau, and ended up broke :joy:. I realized that I’m not good at gambling because I’m too optimistic, which is great for research but not for gambling. In games like these, it’s obvious that you’ll lose in the long run, but I kept thinking I could win. Perhaps I should learn how to play poker instead (?!). Maybe next time! :smile:

A new research topic - LLM security

The most significant technical surprise of 2023 might be the development of ChatGPT. I found ChatGPT and its use of plugins, along with its interaction with Non-ML programs, to be very interesting. I decided to investigate more on this topic and realized it was a new research area that I could work on. Delving into this topic, I somehow ended up understanding more about old-school security models and information flow control. This even led me to gain deeper understanding on the security papers I read previously. Currently working on other projects, but I am eager to continue on this topic as soon as I finish them!

New research collaboration.

This year, I was fortunate to have a new collaboration with excellent researchers to enhance the previously rejected paper. I am very proud of the work we did together and hope that it will be accepted. It was a great experience. Lesson learned: Reaching out brings new opportunities.

Another new research topic - ARM MTE side-channel

From the previous collaboration, I also got a chance to work on a new research topic: ARM MTE side-channel (officially disclosed this month!) I am very excited on this project, and I hope that we can complete it with a good result.

Morning routine

I have been trying to wake up early for a long time. Starting a day early is a common advice for productivity, and for me, it was about avoiding the morning traffic jam in Seoul. The only working solution was the morning exercise routine. I enjoyed morning swimming from March to November and switched to yoga from December. This habit allows me to arrive at the lab earlier than others and have my own time focusing on my work. I’m very pleased with this routine and hope to continue it next year. I believe no one who knows me would believe that I am now a morning person. Still, I ocassionally oversleep, so my goal for the next year is to establish a more consistent morning routine.

New blog

I launched this blog this summer. Although I haven’t written much yet, it is good to have a place to write. I admit that I am still shy about sharing my ideas publicly, and I haven’t managed to write regularly. However, I hope to write more in the next year.

Studying English

I re-joined the English speaking group I participated years ago and felt my English has quite improved. I consistently took italki lessons as well. One day, I accidentally joined a group class for C1 level students. The students really challenged me, letting me realize that I still have a long way to go.

Getting paper accepted

The paper I submitted this year faced rejection, despite I believed I had done everything I could. It was a puzzling result. My advisor reassured me that it was a good paper and if I keep working on it, it would be accepted one day.. Anyway, I quickly re-submitted to another venue. After that, I realized my previous rejection was due to failing to satisfy one reviewer’s seemingly trivial demands. It is painful to go through another round of review process, and it was a worthwhile lesson learned. With several other interesting projects in progress, I am optimistic that I’ll have more opportunities to achieve this goal in the coming year.

Others

• Reading books: Started multiple books but failed to finish any of them..;-)

• Consistent wake-up time: My sleep schedule is still inconsistent. Establishing a consistent sleep schedule is next year’s goal.

• Being nice to others: This one wasn’t actually planned, but I realized this year it would be beneficial to everyone if I am a bit nicer.

Vuln. Design 1: Unrestricted App Logics

First, Spaces allow users to upload and distribute any kind of apps. This unrestricted deployment introduces potential unsafe data-flows between the user and the app (or the execution environment). Specifically, arbitrary code execution and information leakage.

Issue 1: Arbitrary Code Execution

By its nature, Spaces allow arbitrary code execution from app developers to Hugging Face server. Developers can run any app on Hugging Face’s server just by uploading the app to Spaces. Moreover, if the app contains data-flows from user input to executable data (e.g., user-provided functions or shell commands), it would allow arbitrary code executions from app users to the server. If the app is publicly available, the arbitrary code execution functionality would be exposed to unspecified and anonymous users.

With proper containerization, the effect of arbitrary code execution is limited to the sandboxed environment. However, if a container escape vulnerability might allow the attacker to attempt container escape attack, which would further enable attacks on the host server.

Arbitrary code execution also allows attackers to change app’s behavior or hijack the goal. One example is bypassing any security measurement (e.g., safeguard prompts, throughput). With arbitrary execution, the attackers can delete or replace the safeguard prompts passed to the model, or they can nullify the restrictions on users such as throughput.

Another example is replacing the model used by the app with different model (e.g., backdoor-injected model, model for different tasks). Considering high-end GPU acceleration environment charge extra costs for the app developer, such attempts might also yield financial loss.

Issue 2: Information Leakage between App and User

Many apps in Spaces operate with numerous user-provided sensitive data. Apps require user credentials (e.g., API keys, ID, password) as a delegate for API uses. Apps require personal information (e.g., name, email, location) to provide customized services. When processing such data, apps should be safely designed to protect personal information. Recent privacy regulations (e.g., GDPR, CCPA) consider any user-provided input passed to web apps as sensitive data and enforces that appsq should not store nor track such data without user content.

Lacking restriction on app internal logics may allow dataflow from the users to untrusted channels. When user data is passed to an app, the app should carefully process the data for the intended operations only. However, as Spaces allow any apps with any logic to be deployed, we cannot assure whether the apps are properly handling user data.

Vuln. Design 2: Missing Isolation between Requests

Another vulnerable design in Spaces is the lack of sufficient isolation between user requests. Currently, Spaces uses a single container when running an app. Therefore, every request made to the app, regardless of the sender, is executed within the same container environment. This can lead to unsafe data-flows between users, such as information leakage.