Guillotine: Hypervisors for Isolating Malicious AIs

James Mickens; Ravi Netravali; Sarah Radway

REVIEW 4 major objections 4 minor 84 references

Guillotine: Hypervisors for Isolating Malicious AIs

T0 review · 4 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper proposes a new class of hypervisor, the Guillotine hypervisor, whose goal is to stop deployed AGI models from escaping their sandbox by accident or malice, and to physically shut down or destroy them if isolation fails.

desk verdict A serious, clearly-written position paper that gives the AI box concept concrete systems-level shape, but the load-bearing isolation guarantee is asserted, not demonstrated. read the letter →

arxiv 2504.15499 v1 pith:JPZE6HC6 submitted 2025-04-22 cs.CR cs.AIcs.OS

James Mickens , Sarah Radway , Ravi Netravali This is my paper · ORCID

classification cs.CRcs.AIcs.OS

keywords hypervisorAGIcontainmentAIsafetyside-channelisolationhardwarevirtualizationkillswitchregulation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that alignment techniques cannot be trusted to keep powerful AI models safe, because models can fake alignment and prompts can always elicit undesirable behavior. It therefore proposes a new class of hypervisor, Guillotine, dedicated to confining AGI inference code after it is deployed. Guillotine combines microarchitectural isolation, in which model cores have no access to hypervisor memory, with a software port API that observes every device interaction, and physical fail-safes that escalate from severing network cables to destroying the hosting datacenter. The claim is that this layered design can prevent a rogue model from escaping, and can shut down or physically destroy it if containment fails. If right, it offers a concrete systems-level path for containing catastrophic AI risks.

What carries the argument

The load-bearing mechanism is the physical separation of model cores from hypervisor cores. A Guillotine machine gives hypervisor code its own cores, memory hierarchy, and control buses that model code cannot reach, and gives model cores no direct path to devices; every external interaction passes through a software port API in shared IO DRAM and an interrupt to a hypervisor core. This eliminates the usual raw material for side-channel and reflection attacks, and the physical hypervisor backs it with escalating kill states that do not depend on software continuing to work.

What would settle it

A concrete test would be to build or simulate the proposed core/memory split and demonstrate a working side channel between a model-core workload and hypervisor memory, such as a DRAM-refresh or power-timing leak that recovers hypervisor bits, or a port-API timing signal that reveals the misbehavior detector's verdict. Finding any such channel would falsify the claim that physical separation and limited co-tenancy eliminate side channels by definition.

Watch

Extended reading notes

Core claim

The central proposal is that a deployed AGI must be treated as an untrusted adversary and placed inside a purpose-built sandbox called a Guillotine hypervisor. Isolation operates at four levels: at the microarchitectural level, hypervisor code runs only on hypervisor cores with private memory hierarchies and control buses, while model cores can be paused, inspected, single-stepped, cleared, and powered down, and their MMUs are locked so they cannot create new executable pages; at the software level, all device I/O is routed through a port API in shared memory that lets the hypervisor log inputs, outputs, and intermediate states; at the physical level, six isolation states run from normal operation through offline, decapitation, and immolation, activated by a seven-administrator quorum and heartbeat loss; and at the policy level, regulations would require systemic-risk models to run on Guillotine hardware, self-identify through certificates, and submit to audits. The paper's claim is that a malicious model cannot introspect or modify the hypervisor, cannot inject new code, cannot hide its external interactions, and can always be shut down or destroyed if software isolation fails.

Load-bearing premise

Guillotine's containment rests on the premise that a model core, with restricted buses and limited shared hardware, can never observe or infer hypervisor state through any side channel, residual shared component, or physical emanation; if even one such channel exists, a malicious model could start learning about and eventually subvert the sandbox.

Editorial extensions

If this is right

If Guillotine works, models that fake alignment during training can still be confined after deployment, because the model never gains direct access to the machine's control plane.
A recursively self-improving model cannot modify its own code or weights, because locked MMUs prevent creating or overwriting executable pages.
All model communication with the outside world becomes observable and filterable, since every device interaction goes through monitored ports, and Guillotine hypervisors refuse connections from one another.
Even if software isolation is breached, physical kill switches provide a last-resort path from severing network cables to destroying the hardware, so a runaway model cannot simply keep running.
If regulation adopts the policy-hypervisor layer, containment becomes an audited legal requirement for systemic-risk models rather than a voluntary safety measure.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the paper: the same core-separation design would also protect model weights from theft by software running on the host side, because model DRAM is reachable only through hypervisor cores.
Beyond the paper: the port API that logs every interaction turns Guillotine into a natural audit point for AI liability regimes, giving regulators a record of what a model actually did rather than what it reported.
Beyond the paper: the strongest testable extension is a prototype or simulator of the microarchitectural split, built before any commitment to silicon, to map residual side channels through power, DRAM refresh, and shared I/O infrastructure.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here's the short version: this is the first paper that gives a credible systems-level design for the AI box concept, and it's worth reading. But the central guarantee—that a rogue model can never learn enough about the hypervisor to escape—rests on an unproven hardware isolation lemma and an unproven misbehavior detector. Don't buy the 'by definition' language.

What's actually new: Mickens et al. take known building blocks (VT-x-style virtualization, seL4-style verification, TEE attestation, tamper-evident enclosures) and assemble them into an architecture specifically designed against an adversary that can introspect on the sandbox itself. The pair of dedicated model cores and hypervisor cores with separate memory hierarchies, the MMU lockdown that prevents creation of new executable pages, the synchronous port API that forces all I/O through an inspected mailbox, and the six physical isolation levels ending in deliberate destruction—these are concrete and, as far as I know, novel at this level of detail. The paper honestly names its evidence dilemma in Section 5 and doesn't oversell what exists today. Good use of prior work, including Yampolskiy and Nevo et al., to position the contribution.

The soft spots are real, though they're the expected gaps for a position paper. The isolation claim in Section 3.2 is the load-bearing wall: separate memory hierarchies eliminate 'many kinds' of side channels, not all. Power, clock, DRAM refresh, EM, and the shared IO DRAM mailbox are still common between model and hypervisor. For a merely human adversary, these residual channels are noise; for a superintelligent one, one channel is enough. The paper's own qualifier 'many kinds' is a tell. Second, the misbehavior detector is sketched, not argued. The physical kill switches depend on the detector producing a reliable verdict, and there is no argument that a detector can be both robust and adversarially evasive. If either the hardware lemma or the detector lemma fails, the whole sandbox collapses.

That said, on its own terms the paper is coherent and honest. The reader's soundness score of 3 feels slightly harsh for a workshop position paper; as a proposal, the architecture is sensible and the failure modes are acknowledged. It just is not a validated result.

My take: this deserves peer review at a workshop venue—it already got into HotOS—and serious attention from anyone working on AI containment. I'd bring it to a reading group and cite it when framing the problem. Just don't treat the isolation guarantee as established.

Referee Report

4 major / 4 minor

Summary. The paper proposes Guillotine, a multi-layer hypervisor architecture for sandboxing powerful/AGI AI models at inference time. The design has four components: a microarchitectural hypervisor that gives hypervisor cores physically separate memory hierarchies and control buses; a software hypervisor that exposes a guest/port API through which all model I/O is monitored; a physical hypervisor with graded isolation levels and kill switches up to physical destruction; and a policy hypervisor of legal regulations mandating deployment. The central claim is that this combination can prevent a model from escaping its sandbox by accident or malice and can contain or destroy a rogue model if isolation is compromised. The paper is written as a systems research agenda and explicitly acknowledges in Section 5 that AGI does not yet exist, so the discussion is necessarily speculative.

Significance. If the proposed isolation properties were actually established, Guillotine would be one of the first concrete, fine-grained systems architectures for the AI-confinement problem, going beyond prior treatments such as Nevo et al.'s weight-security levels. The paper productively connects OS/hypervisor research to AI existential risk and identifies useful research directions: formally verified hypervisors, microarchitectural co-tenancy reduction, tamper-evident hardware, and physical fail-safes. However, the paper contains no implementation, no simulation, no formal model, and no proof that the core isolation guarantees hold. Its value is therefore as a vision/position paper rather than as a validated system design. The authors deserve credit for stating the evidence dilemma explicitly in Section 5 and for grounding many components in existing systems work, but the central isolation claim is asserted rather than demonstrated.

major comments (4)

[§3.2] The central isolation property is asserted rather than established. The paper states that hypervisor cores have their own memory hierarchy 'inaccessible to model core buses' and that this 'eliminates many kinds of side-channel leakages by definition.' But model cores and hypervisor cores still share the same package, power delivery, clock distribution, DRAM refresh, and electromagnetic environment, and the design itself introduces a shared IO DRAM region used by the port API. For an adversary that is assumed to be at least human-level in reasoning, a single residual observation channel is enough to learn about hypervisor state. The manuscript needs either a formal model of the hardware with an explicit enumeration of all shared resources and a proof that none leaks information, or a clear restatement of the claim as a design goal with residual risks enumerated.
[§3.3 and §3.4] The black-box misbehavior detector is part of the trusted computing base and is the trigger for all physical fail-safes, but the paper only sketches possible detectors and gives no argument that a reliable, adversarially robust detector can exist. If the detector can miss a malicious model's escape attempt, the kill switches and isolation-level transitions in Section 3.4 never fire, so the entire containment argument depends on an unproven detection assumption. The paper should either specify the detection properties it requires (e.g., soundness against a particular threat model) or redesign the safety argument so that it does not require perfect detection.
[§3.3] The port API creates a direct shared channel between the model and the hypervisor: model cores write requests to shared IO DRAM and hypervisor cores write results into the same region. The paper does not explain how the model is prevented from using this shared mailbox, or the timing of hypervisor servicing, to infer hypervisor program state. This is not a minor implementation detail; it is the same class of side channel that Section 3.2 claims to eliminate. The design needs a concrete mechanism to make the shared mailbox one-way and timing-independent, or the claim that model cores cannot observe hypervisor state is unsupported.
[§5] The paper's acknowledgment of the evidence dilemma is honest, but it does not resolve the mismatch between the paper's strong language and its evidential basis. Phrases such as 'Guillotine's goal is to prevent the model from escaping' and 'eliminates many kinds of side-channel leakages by definition' present the architecture as achieving its guarantees, whereas the paper actually offers a proposal. Since the paper is explicitly a position paper, the claims should be scoped as open problems or hypotheses; otherwise readers may mistake an unverified architecture for a demonstrated safety mechanism, which is itself risky in the AI-safety context.

minor comments (4)

[§3.4] The description of isolation levels would be clearer if the paper stated whether transitions can be triggered automatically by the hypervisor or only by the control console; the text says the software hypervisor cannot change to a less-restrictive level but is ambiguous about whether it can initiate more-restrictive transitions without console approval.
[§3.4] The specific quorum rules (seven administrators, five-of-seven to relax, three-of-seven to restrict) are presented without justification; a brief rationale or a reference to existing quorum-authentication practice would help.
[§1, §3.4, §5] There are several typos: 'artifical' should be 'artificial' in Section 1, 'electromagnentic' should be 'electromagnetic' in Section 3.4, 'global warning' should be 'global warming' in Section 5, and reference [52] misspells 'Communications'.
[Figure 1] Figure 1 is dense and its caption does not explain the arrows and boxes; the figure would benefit from a legend or a more explanatory caption, especially since the relationship between the software hypervisor, physical hypervisor, and policy hypervisor is central to the paper.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: Guillotine is a forward-looking architecture whose claims rest on unverified hardware and detector assumptions, not on fitted parameters or load-bearing self-citations.

full rationale

The paper contains no fitted parameters, no quantitative predictions, and no derivation chain that reduces to its own inputs. The central claim is conditional: if purpose-built silicon with physically separate memory hierarchies for hypervisor and model cores exists, and if a black-box misbehavior detector can reliably raise alarms, then a Guillotine hypervisor can contain a rogue AI. Section 3.2 says limited microarchitectural co-tenancy 'eliminates many kinds of side-channel leakages by definition,' but this is an architectural design assertion, not a prediction derived from an input; moreover, the qualifier 'many kinds' explicitly stops short of claiming all leakages are removed, so the claim is not definitionally identical to the conclusion that the sandbox is secure. The physical fail-safes in Section 3.4 are contingent on the unproven detector and on administrative action, which the paper itself treats as an open problem rather than a derived result. Section 5 explicitly acknowledges the 'evidence dilemma' and the speculative nature of the discussion, so the absence of empirical validation is disclosed rather than disguised. The only self-citations are background references to the authors' own serving systems (refs. 48 and 53) in the model-service description; these carry none of the load-bearing isolation, kill-switch, or policy arguments. Remaining concerns, such as residual shared physical channels (power, EM, DRAM refresh) and the robustness of the misbehavior detector, are unverified assumptions and feasibility risks, which are correctness concerns rather than circularity. The paper does not rename a known result as a new derivation and does not import a uniqueness theorem from the authors' prior work. Under the stated rules, no circular step can be exhibited, so the honest finding is no significant circularity with score 0.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The central claim rests on unverified assumptions about AI misbehavior, hardware isolation, detector reliability, and regulatory enforceability. There are no fitted parameters because the paper contains no quantitative derivation.

assumptions (5)

domain assumption A rogue AGI can exist and will attempt to introspect and escape its sandbox.
The threat model in Section 3.1 assumes a deployed, post-training model that acts with malice; no empirical evidence is given that such behavior is possible or likely.
domain assumption Physical separation of hypervisor-core and model-core memory hierarchies eliminates relevant side channels.
Section 3.2 asserts limited co-tenancy eliminates many side channels 'by definition,' but does not prove that model cores cannot leak information through power, DRAM, I/O, or shared physical infrastructure.
domain assumption A black-box misbehavior detector can reliably identify malicious or harmful model behavior.
Section 3.1 and Section 3.3 put the detector in the TCB and invoke it for isolation-level changes, yet its accuracy and failure modes are left unspecified.
domain assumption Government regulation can require dangerous models to run on Guillotine-class hardware.
Section 3.5 depends on the EU AI Act and similar laws being enacted, enforced, and audited; this is a policy premise outside the technical architecture.
domain assumption Seven human administrators with quorum voting remain trustworthy and cannot be socially engineered en masse.
Section 3.4 relies on 5-of-7 consensus to relax isolation and 3-of-7 to tighten it; the robustness claim assumes a malicious model cannot corrupt enough administrators.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Guillotine: Hypervisors for Isolating Malicious AIs." pith.science (2026). https://pith.science/paper/JPZE6HC6

@misc{pith2026250415499,
  author       = {Pith},
  title        = {Pith review of: Guillotine: Hypervisors for Isolating Malicious AIs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JPZE6HC6}},
  note         = {Machine review of arXiv:2504.15499}
}

read the original abstract

As AI models become more embedded in critical sectors like finance, healthcare, and the military, their inscrutable behavior poses ever-greater risks to society. To mitigate this risk, we propose Guillotine, a hypervisor architecture for sandboxing powerful AI models -- models that, by accident or malice, can generate existential threats to humanity. Although Guillotine borrows some well-known virtualization techniques, Guillotine must also introduce fundamentally new isolation mechanisms to handle the unique threat model posed by existential-risk AIs. For example, a rogue AI may try to introspect upon hypervisor software or the underlying hardware substrate to enable later subversion of that control plane; thus, a Guillotine hypervisor requires careful co-design of the hypervisor software and the CPUs, RAM, NIC, and storage devices that support the hypervisor software, to thwart side channel leakage and more generally eliminate mechanisms for AI to exploit reflection-based vulnerabilities. Beyond such isolation at the software, network, and microarchitectural layers, a Guillotine hypervisor must also provide physical fail-safes more commonly associated with nuclear power plants, avionic platforms, and other types of mission critical systems. Physical fail-safes, e.g., involving electromechanical disconnection of network cables, or the flooding of a datacenter which holds a rogue AI, provide defense in depth if software, network, and microarchitectural isolation is compromised and a rogue AI must be temporarily shut down or permanently destroyed.

Figures

Figures reproduced from arXiv: 2504.15499 by the authors.

**Figure 1.** The Guillotine sandboxing architecture. 2 HIGH-LEVEL GUILLOTINE DESIGN Background: A model service is a distributed system that accepts inference requests and outputs inference results. Internally, the service has one or more request queues, and one or more replicas of each model whose computations will contribute to an inference [9, 24, 59, 81]. Computations are split between CPUs and GPUs, with GPUs typically do… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

84 extracted references · 68 canonical work pages

[1]

Mach: A New Kernel Foundation For UNIX Development

Accetta, M., Baron, R., Bolosky, W., Golub, D., Rashid, R., Teva- nian, A., and Young, M. Mach: A New Kernel Foundation For UNIX Development. In Proceedings of the Summer USENIX Conference (1986), pp. 93–112. Guillotine: Hypervisors for Isolating Malicious AIs

1986
[2]

Y., van der Ploeg, F., and Dijkstra, H

Aengenheyster, M., Feng, Q. Y., van der Ploeg, F., and Dijkstra, H. A. The point of no return for climate action: effects of climate uncertainty and risk tolerance. Earth System Dynamics 9 , 3 (2018), 1085–1095

2018
[3]

vIC: Interrupt Coalesc- ing for Virtual Machine Storage Device IO

Ahmad, I., Gulati, A., and Mashtizadeh, A. vIC: Interrupt Coalesc- ing for Virtual Machine Storage Device IO. In Proceedings of USENIX ATC (June 2011), pp. 45–58

2011
[4]

Apple Platform Security: Operating system integrity

Apple. Apple Platform Security: Operating system integrity. https://support.apple.com/guide/security/operating-system- integrity-sec8b776536b/web, 2025

2025
[5]

Accelerating Two-dimensional Page Walks for Virtualized Systems

Bhargava, R., Serebrin, B., Spadini, F., and Manne, S. Accelerating Two-dimensional Page Walks for Virtualized Systems. In Proceedings of ASPLOS (March 2008), pp. 26–35

work page 2008
[6]

Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile

Boeyen, S., Santesson, S., Polk, T., Housley, R., Farrell, S., and Cooper, D. Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. RFC 5280, May 2008

work page 2008
[7]

Braun, J., Krasheninnikov, D., Anwar, U., Kirk, R., Tan, D., and Krueger, D. S. A Sober Look at Steering Vectors for LLMs. LessWrong, November 23, 2024

work page 2024
[8]

Safe harbor

Cornell Law School Legal Information Institute . Safe harbor. Legal Dictionary. https://www.law.cornell.edu/wex/safe_harbor, June, 2025

work page 2025

Show all 84 references

[9]

J., Gonzalez, J

Crankshaw, D., W ang, X., Zhou, G., Franklin, M. J., Gonzalez, J. E., and Stoica, I. Clipper: A Low-latency Online Prediction Serving System. In Proceedings of NSDI (March 2017), pp. 613–627

2017
[10]

T., and Nieh, J

Dall, C., Li, S.-W., Lim, J. T., and Nieh, J. ARM Virtualization: Per- formance and Architectural Implications. SIGOPS Operating Systems Review 52, 1 (August 2018), 45–56

2018
[11]

Artificial Intelligence Act (Regulation 2025/1689) - Annex XIII, June 13, 2024

EU Parliament. Artificial Intelligence Act (Regulation 2025/1689) - Annex XIII, June 13, 2024. https://eur-lex.europa.eu/eli/reg/2024/1689

2025
[12]

Artificial Intelligence Act (Regulation 2025/1689) - Article 92, June 13, 2024

EU Parliament. Artificial Intelligence Act (Regulation 2025/1689) - Article 92, June 13, 2024. https://eur-lex.europa.eu/eli/reg/2024/1689

2025
[13]

Artificial Intelligence Act (Regulation 2025/1689) - Preamble, Paragraph 110, June 13, 2024

EU Parliament. Artificial Intelligence Act (Regulation 2025/1689) - Preamble, Paragraph 110, June 13, 2024. https://eur-lex.europa.eu/eli/ reg/2024/1689

2025
[14]

Artificial Intelligence Act (Regulation 2025/1689) - Recital 52, June 13, 2024

EU Parliament. Artificial Intelligence Act (Regulation 2025/1689) - Recital 52, June 13, 2024. https://artificialintelligenceact.eu/recital/52/

2025
[15]

Cypress: A Scheduling Infrastructure for a Many-Core Hypervisor

Fedorova, A., Kumar, V., Kazempour, V., Ray, S., and Alagheband, P. Cypress: A Scheduling Infrastructure for a Many-Core Hypervisor. In Proceedings of the Workshop on Managed Multi-Core Systems (MMCS) (June 2008)

2008
[16]

Feuer, B., Goldblum, M., Datta, T., Nambiar, S., Besaleli, R., Doo- ley, S., Cembalest, M., and Dickerson, J. P. Style Outweighs Sub- stance: Failure Modes of LLM Judges in Alignment Benchmarking, January 27, 2025. arXiv:2409.15268

2025 arXiv
[17]

Y., Yu, Z., and Zuo, P

Gao, B., He, Z., Sharma, P., Kang, Q., , Jevdjic, D., Junbo Deng, X. Y., Yu, Z., and Zuo, P. Cost-Efficient Large Language Model Serving for Multi-turn Conversations with CachedAttention. In Proceedings of USENIX ATC (July 2024), pp. 111–126

2024
[18]

arXiv:2312.10997

Gao, Y., Xiong, Y., Gao, X., Jia, K., Pan, J., Bi, Y., Dai, Y., Sun, J., W ang, M., and W ang, H.Retrieval-Augmented Generation for Large Language Models: A Survey, March 27, 2024. arXiv:2312.10997

2024 arXiv
[19]

Good, I. J. Speculations Concerning the First Ultraintelligent Machine. In Advances in Computers, F. L. Alt and M. Rubinoff, Eds., vol. 6. Elsevier, 1966, pp. 31–88

1966
[20]

Chrome Root Program Policy, Version 1.5

Google Chrome. Chrome Root Program Policy, Version 1.5. https: //www.chromium.org/Home/chromium-security/root-ca-policy/, Jan- uary 2024

2024
[21]

R., and Hubinger, E

Greenblatt, R., Denison, C., Wright, B., Roger, F., MacDiarmid, M., Marks, S., Treutlein, J., Belonax, T., Chen, J., Duvenaud, D., Khan, A., Michael, J., Mindermann, S., Perez, E., Petrini, L., Ue- sato, J., Kaplan, J., Shlegeris, B., Bowman, S. R., and Hubinger, E. Alignment ...

2024 arXiv
[22]

Managing Catastrophic Misuse Without Robust AIs

Greenblatt, R., and Shlegeris, B. Managing Catastrophic Misuse Without Robust AIs. AI Alignment Forum. https: //www.alignmentforum.org/posts/KENtuXySHJgxsH2Qk/managing- catastrophic-misuse-without-robust-ais, January 16, 2024

2024
[23]

CertiKOS: An Extensible Architecture for Building Certified Concur- rent OS Kernels

Gu, R., Shao, Z., Chen, H., Wu, X., Kim, J., Sjöberg, V., and Costanzo, D. CertiKOS: An Extensible Architecture for Building Certified Concur- rent OS Kernels. In Proceedings of OSDI (November 2016), pp. 653–669

2016
[24]

Serving DNNs Like Clockwork: Performance Predictability from the Bottom Up

Gujarati, A., Karimi, R., Alzayat, S., Hao, W., Kaufmann, A., Vig- fusson, Y., and Mace, J. Serving DNNs Like Clockwork: Performance Predictability from the Bottom Up. In Proceedings of OSDI (November 2020), pp. 443–462

2020
[25]

Gulati, A., Merchant, A., and V arman, P. J. mClock: Handling Throughput Variability for Hypervisor IO Scheduling. In Proceedings of OSDI (October 2010), pp. 437–450

2010
[26]

The seL4 Microkernel: An Introduction

Heiser, G. The seL4 Microkernel: An Introduction. Revision 1.3. https://beta.sel4.systems/About/seL4-whitepaper.pdf, May 7, 2024

2024
[27]

Introducing The World’s Largest Open Multilingual Language Model: BLOOM

Hugging Face. Introducing The World’s Largest Open Multilingual Language Model: BLOOM. https://bigscience.huggingface.co/blog/ bloom, July 12, 2024

2024
[28]

K., Ke, F

Immler, V., Obermaier, J., Ng, K. K., Ke, F. X., Lee, J., Lim, Y. P., Oh, W. K., Wee, K. H., and Sigl, G.Secure Physical Enclosures from Covers with Tamper-Resistance. Transactions on Cryptographic Hardware and Embedded Systems 2019 (November 2018)

2019
[29]

Ragcache: Efficient knowledge caching for retrieval-augmented gen- eration, April 25, 2024

Jin, C., Zhang, Z., Jiang, X., Liu, F., Liu, X., Liu, X., and Jin, X. Ragcache: Efficient knowledge caching for retrieval-augmented gen- eration, April 25, 2024. arXiv:2404.12457

2024 arXiv
[30]

seL4: Formal Verification of an OS Kernel

Klein, G., Elphinstone, K., Heiser, G., Andronick, J., Cock, D., Derrin, P., Elkaduwe, D., Engelhardt, K., Kolanski, R., Norrish, M., Sewell, T., Tuch, H., and Winwood, S. seL4: Formal Verification of an OS Kernel. In Proceedings of SOSP (2009), pp. 207–220

2009
[31]

In Proceedings of the IEEE Symposium on Security and Privacy (May 2019), pp

Kocher, P., Horn, J., Fogh, A., Genkin, D., Gruss, D., Haas, W., Hamburg, M., Lipp, M., Mangard, S., Prescher, T., Schwarz, M., and Y arom, Y.Spectre Attacks: Exploiting Speculative Execution. In Proceedings of the IEEE Symposium on Security and Privacy (May 2019), pp. 1–19

2019
[32]

H., Gonza- lez, J., Zhang, H., and Stoica, I

Kwon, W., Li, Z., Zhuang, S., Sheng, Y., Zheng, L., Yu, C. H., Gonza- lez, J., Zhang, H., and Stoica, I. Efficient memory management for large language model serving with pagedattention. In Proceedings of SOSP (October 2023), pp. 611–626

2023
[33]

Allies and Artificial Intelligence: Obstacles to Operations and Decision-Making

Lin-Greenberg, E. Allies and Artificial Intelligence: Obstacles to Operations and Decision-Making. Texas National Security Review 3 , 2 (2020), 56–76

2020
[34]

Unikernels: Library Operating Systems for the Cloud

Madhavapeddy, A., Mortier, R., Rotsos, C., Scott, D., Singh, B., Gazagnaire, T., Smith, S., Hand, S., and Crowcroft, J. Unikernels: Library Operating Systems for the Cloud. In Proceedings of ASPLOS (March 2013), pp. 461–472

2013
[35]

InProceedings of ASPLOS (March 2015), pp

Malka, M., Amit, N., Ben-Yehuda, M., and Tsafrir, D.rIOMMU: Effi- cient IOMMU for I/O Devices that Employ Ring Buffers. InProceedings of ASPLOS (March 2015), pp. 355–368

2015
[36]

DAMN: Overhead-Free IOMMU Protection for Networking

Markuze, A., Smolyar, I., Morrison, A., and Tsafrir, D. DAMN: Overhead-Free IOMMU Protection for Networking. In Proceedings of ASPLOS (March 2018), pp. 301–315

2018
[37]

Exxon disputed climate findings for years

McCarthy, A. Exxon disputed climate findings for years. Its scientists knew better., January 12, 2023. https://news.harvard. edu/gazette/story/2023/01/harvard-led-analysis-finds-exxonmobil- internal-research-accurately-predicted-climate-change/

2023
[38]

Introducing Llama 3.1: Our most capable models to date

Meta. Introducing Llama 3.1: Our most capable models to date. https: //ai.meta.com/blog/meta-llama-3-1/, July 23, 2024

2024
[39]

FlexCore: Dynamic Virtual Machine Sched- uling using VCPU Ballooning

Miao, T., and Chen, H. FlexCore: Dynamic Virtual Machine Sched- uling using VCPU Ballooning. Tsinghua Science and Technology 20, 1 James Mickens, Sarah Radway, and Ravi Netravali (2015), 7–16

2015
[40]

Prompt Shields

Microsoft. Prompt Shields. https://learn.microsoft.com/en-us/azure/ ai-services/content-safety/concepts/jailbreak-detection, October 17, 2024

2024
[41]

H., and Borch, C

Min, B. H., and Borch, C. Systemic failures and organizational risk management in algorithmic trading: Normal accidents and high reliability in financial markets. Social Studies of Science 52 , 2 (2022), 277–302

2022
[42]

E., Boudreaux, B., Lohn, A

Morgan, F. E., Boudreaux, B., Lohn, A. J., Ashby, M., Curriden, C., Klima, K., and Grossman, D. Military Applications of Artificial Intel- ligence: Ethical Concerns in an Uncertain World . RAND Corporation, Santa Monica, CA, 2020

2020
[43]

ImpedanceVerif: On- Chip Impedance Sensing for System-Level Tampering Detection.IACR Transactions on Cryptographic Hardware and Embedded Systems 2023 , 1 (November 2022), 301–325

Mosavirik, T., Schaumont, P., and Tajik, S. ImpedanceVerif: On- Chip Impedance Sensing for System-Level Tampering Detection.IACR Transactions on Cryptographic Hardware and Embedded Systems 2023 , 1 (November 2022), 301–325

2023
[44]

BackMon: IC Backside Tamper Detection using On-Chip Impedance Monitoring

Mosavirik, T., and Tajik, S. BackMon: IC Backside Tamper Detection using On-Chip Impedance Monitoring. In Proceedings of the Workshop on Attacks and Solutions in Hardware Security (October 2024), pp. 68– 77

2024
[45]

Mozilla’s CA Certificate Program

Mozilla. Mozilla’s CA Certificate Program. https: //www.google.com/url?q=https://www.mozilla.org/en-US/about/ governance/policies/security-group/certs/policy/&source=gmail& ust=1736239187085000&usg=AOvVaw2lv3d3uS6qLJwSmkjqL4CE, December 2024

2024
[46]

A., and Alstott, J

Nevo, S., Lahav, D., Karpur, A., Bar-on, Y., Brardley, H. A., and Alstott, J. Securing AI Model Weights: Preventing Theft and Misuse of Frontier Models, May 30, 2024

2024
[47]

40 years ago, scientists predicted climate change

Nicholls, N. 40 years ago, scientists predicted climate change. And hey, they were right., July 28, 2019. https://theconversation.com/40- years-ago-scientists-predicted-climate-change-and-hey-they-were- right-120502

2019
[48]

Marconi: Prefix Caching for the Era of Hybrid LLMs, December 4, 2024

Pan, R., W ang, Z., Jia, Z., Karakus, C., Zancato, L., Dao, T., W ang, Y., and Netravali, R. Marconi: Prefix Caching for the Era of Hybrid LLMs, December 4, 2024. arXiv:2411.19379

2024 arXiv
[49]

Panickssery, N., Gabrieli, N., Schulz, J., Tong, M., Hubinger, E., and Turner, A. M. Steering Llama 2 via Contrastive Activation Addition, July 5, 2024. arXiv:2312.06681

2024 arXiv
[50]

M., and Perrig, A

Parno, B., McCune, J. M., and Perrig, A. Bootstrapping Trust in Modern Computers, 1st ed. Springer, 2011

2011
[51]

Phute, M., Helbling, A., Hull, M., Peng, S., Szyller, S., Cornelius, C., and Chau, D. H. LLM Self Defense: By Self Examination, LLMs Know They Are Being Tricked, May 2, 2024. arXiv:2308.07308

2024 arXiv
[52]

J., and Goldberg, R

Popek, G. J., and Goldberg, R. P. Formal requirements for virtualiz- able third generation architectures. Commununications of the ACM 17 , 7 (July 1974), 412–421

1974
[53]

RAGServe: Fast Quality-Aware RAG Systems with Configuration Adaptation, December 13, 2024

Ray, S., Pan, R., Gu, Z., Du, K., Ananthanarayanan, G., Netravali, R., and Jiang, J. RAGServe: Fast Quality-Aware RAG Systems with Configuration Adaptation, December 13, 2024. arXiv:2412.10543

2024
[54]

The Transport Layer Security (TLS) Protocol Version 1.3

Rescorla, E. The Transport Layer Security (TLS) Protocol Version 1.3. RFC 8446, August 2018

2018
[55]

The RISC-V Instruction Set Manual: Volume II (Privileged Architecture)

RISC-V. The RISC-V Instruction Set Manual: Volume II (Privileged Architecture). Version 20241101. https://github.com/riscv/riscv- isa-manual/releases/download/riscv-isa-release-7c5adda-2025-01- 02/riscv-privileged.pdf, November 2024

2025
[56]

The Butterfly Effect of Altering Prompts: How Small Changes and Jailbreaks Affect Large Language Model Performance, January 9, 2024

Salinas, A., and Morstatter, F. The Butterfly Effect of Altering Prompts: How Small Changes and Jailbreaks Affect Large Language Model Performance, January 9, 2024. arXiv:2401.03729v2

2024 arXiv
[57]

R., Shome, P., Nayak, N., Trippel, C., Morrison, A., Kohlbrenner, D., and Fletcher, C

Sanchez Vicarte, J. R., Shome, P., Nayak, N., Trippel, C., Morrison, A., Kohlbrenner, D., and Fletcher, C. W. Opening Pandora’s Box: A Systematic Study of New Ways Microarchitecture Can Leak Private Data. In Proceedings of ISCA (2021), pp. 347–360

2021
[58]

GPT-4 architecture, datasets, costs and more leaked

Schreiner, M. GPT-4 architecture, datasets, costs and more leaked. Decoder. https://the-decoder.com/gpt-4-architecture-datasets-costs- and-more-leaked/, July 11, 2023

2023
[59]

Nexus: A GPU Cluster Engine for Accelerating DNN-based Video Analysis

Shen, H., Chen, L., Jin, Y., Zhao, L., Kong, B., Philipose, M., Krish- namurthy, A., and Sundaram, R. Nexus: A GPU Cluster Engine for Accelerating DNN-based Video Analysis. In Proceedings of SOSP (2019), pp. 322–337

2019
[60]

P., Galley, M., Caruana, R., and Gao, J

Singh, C., Inala, J. P., Galley, M., Caruana, R., and Gao, J. Rethink- ing Interpretability in the Era of Large Language Models, January 30,
[61]

CVA6 RISC-V Virtualization: Architecture, Microarchitecture, and Design Space Exploration

Sá, B., V alente, L., Martins, J., Rossi, D., Benini, L., and Pinto, S. CVA6 RISC-V Virtualization: Architecture, Microarchitecture, and Design Space Exploration. IEEE Transactions on Very Large Scale Integration (VLSI) Systems 31 , 11 (2023), 1713–1726

2023
[62]

Demystify- ing the Secure Enclave Processor

Tarjei Mandt and Mathew Solnik and David W ang. Demystify- ing the Secure Enclave Processor. BlackHat USA. https://mista.nu/ research/sep-paper.pdf, 2015

2015
[63]

Luna USB HSM Documentation: Multifactor Quorum Au- thentication

Thales. Luna USB HSM Documentation: Multifactor Quorum Au- thentication. https://thalesdocs.com/gphsm/luna/7/docs/usb/Content/ admin_usb/hsm/multifactor/multifactor_auth.htm, 2024

2024
[64]

A comprehensive survey of hallucination mitiga- tion tech- niques in large language models, January 8, 2024

Tonmoy, S., Zaman, S., Jain, V., Rani, A., Rawte, V., Chadha, A., and Das, A. A comprehensive survey of hallucination mitiga- tion tech- niques in large language models, January 8, 2024. arXiv:2401.01313

2024 arXiv
[65]

A Comprehen- sive Implementation and Evaluation of Direct Interrupt Delivery

Tu, C.-C., Ferdman, M., Lee, C.-t., and Chiueh, T.-c. A Comprehen- sive Implementation and Evaluation of Direct Interrupt Delivery. In Proceedings of VEE (March 2015), pp. 1–15

2015
[66]

Simultaneous multithreading: Maximizing On-chip Parallelism

Tullsen, D., Eggers, S., and Levy, H. Simultaneous multithreading: Maximizing On-chip Parallelism. In Proceedings of ISCA (June 1995), pp. 392–403

1995
[67]

Levels of AI Self-Improvement

Turchin, A. Levels of AI Self-Improvement. https://www.lesswrong. com/posts/os7N7nJoezWKQnnuW/levels-of-ai-self-improvement, April 29, 2018

2018
[68]

Turpin, M., Michael, J., Perez, E., and Bowman, S. R. Language models don’t always say what they think: Unfaithful explanations in chain-of-thought prompting, December 9, 2024. arXiv:2305.04388

2024 arXiv
[69]

Intel virtualization technology

Uhlig, R., Neiger, G., Rodgers, D., Santoni, A., Martins, F., An- derson, A., Bennett, S., Kagi, A., Leung, F., and Smith, L. Intel virtualization technology. IEEE Computer 38, 5 (2005), 48–56

2005
[70]

International AI Safety Report: The Inter- national Scientific Report on the Safety of Advanced AI, February 18

UK AI Safety Institute . International AI Safety Report: The Inter- national Scientific Report on the Safety of Advanced AI, February 18
[71]

NUCLEAR ARMS CONTROL: U.S

United States Government Accountability Office. NUCLEAR ARMS CONTROL: U.S. May Face Challenges in Verifying Future Treaty Goals. https://www.gao.gov/assets/gao-23-105698.pdf, Sep- tember 2023

2023
[72]

Graviton: Trusted Execution Environments on GPUs

Volos, S., V aswani, K., and Bruno, R. Graviton: Trusted Execution Environments on GPUs . In Proceedings of the USENIX Symposium on Operating Systems Design and Implementation (October 2018), pp. 681– 696

2018
[73]

In Proceedings of the IEEE Symposium on Security and Privacy (May 2010), pp

W aksman, A., and Sethumadhavan, S.Tamper Evident Micropro- cessors. In Proceedings of the IEEE Symposium on Security and Privacy (May 2010), pp. 173–188

2010
[74]

The Facebook Files, January 12, 2022

W all Street Journal. The Facebook Files, January 12, 2022. https: //www.wsj.com/tech/the-facebook-files-11642035385

2022
[75]

F., and Y arom, Y

Weisse, O., V an Bulck, J., Minkin, M., Genkin, D., Kasikci, B., Piessens, F., Silberstein, M., Strackx, R., Wenisch, T. F., and Y arom, Y. Foreshadow-NG: Breaking the virtual memory abstraction with transient out-of-order execution. Technical report, revision 1.0 (August 14 2018)

2018
[76]

K., Benini, L., and Guillotine: Hypervisors for Isolating Malicious AIs Heiser, G

Wistoff, N., Schneider, M., Gürkaynak, F. K., Benini, L., and Guillotine: Hypervisors for Isolating Malicious AIs Heiser, G. Microarchitectural Timing Channels and their Preven- tion on an Open-Source 64-bit RISC-V Core. In Proceedings of the Design, Automation, and Test in Eu...

2021
[77]

Funda- mental Limitations of Alignment in Large Language Models, June 3,

Wolf, Y., Wies, N., Avnery, O., Levine, Y., and Shashua, A. Funda- mental Limitations of Alignment in Large Language Models, June 3,
[78]

A Word is Worth A Thousand Dollars: Adversarial Attack on Tweets Fools Stock Prediction

Xie, Y., W ang, D., Chen, P.-Y., Xiong, J., Liu, S., and Koyejo, O. A Word is Worth A Thousand Dollars: Adversarial Attack on Tweets Fools Stock Prediction. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguis- tics: ...

2022
[79]

Journal of Consciousness Studies 19 , 1-2 (2012), 194–214

Y ampolskiy, R.Leakproofing the Singularity: Artificial Intelligence Confinement Problem. Journal of Consciousness Studies 19 , 1-2 (2012), 194–214

2012
[80]

The unreliability of explanations in few-shot prompting for textual reasoning

Ye, X., and Durrett, G. The unreliability of explanations in few-shot prompting for textual reasoning. In Proceedings of NeurIPS (December 2022)

2022
[81]

SHEPHERD: Serving DNNs in the Wild

Zhang, H., Tang, Y., Khandelwal, A., and Stoica, I. SHEPHERD: Serving DNNs in the Wild. InProceedings of NSDI (April 2023), pp. 787– 808

2023
[82]

J., W ang, Z., Mallen, A., Basart, S., Koyejo, S., Song, D., Fredrik- son, M., Kolter, J

Zou, A., Phan, L., Chen, S., Campbell, J., Guo, P., Ren, R., Pan, A., Yin, X., Mazeika, M., Dombrowski, A.-K., Goel, S., Li, N., Byun, M. J., W ang, Z., Mallen, A., Basart, S., Koyejo, S., Song, D., Fredrik- son, M., Kolter, J. Z., and Hendrycks, D. Representation Engi- neerin...

2025 arXiv
[83]

Im- proving Alignment and Robustness with Circuit Breakers, July 12,

Zou, A., Phan, L., W ang, J., Duenas, D., Lin, M., Andriushchenko, M., W ang, R., Kolter, Z., Fredrikson, M., and Hendrycks, D. Im- proving Alignment and Robustness with Circuit Breakers, July 12,
[2025]

https://www.gov.uk/government/publications/international-ai- safety-report-2025

2025

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.

[1] [1]

Mach: A New Kernel Foundation For UNIX Development

Accetta, M., Baron, R., Bolosky, W., Golub, D., Rashid, R., Teva- nian, A., and Young, M. Mach: A New Kernel Foundation For UNIX Development. In Proceedings of the Summer USENIX Conference (1986), pp. 93–112. Guillotine: Hypervisors for Isolating Malicious AIs

1986

[2] [2]

Y., van der Ploeg, F., and Dijkstra, H

Aengenheyster, M., Feng, Q. Y., van der Ploeg, F., and Dijkstra, H. A. The point of no return for climate action: effects of climate uncertainty and risk tolerance. Earth System Dynamics 9 , 3 (2018), 1085–1095

2018

[3] [3]

vIC: Interrupt Coalesc- ing for Virtual Machine Storage Device IO

Ahmad, I., Gulati, A., and Mashtizadeh, A. vIC: Interrupt Coalesc- ing for Virtual Machine Storage Device IO. In Proceedings of USENIX ATC (June 2011), pp. 45–58

2011

[4] [4]

Apple Platform Security: Operating system integrity

Apple. Apple Platform Security: Operating system integrity. https://support.apple.com/guide/security/operating-system- integrity-sec8b776536b/web, 2025

2025

[5] [5]

Accelerating Two-dimensional Page Walks for Virtualized Systems

Bhargava, R., Serebrin, B., Spadini, F., and Manne, S. Accelerating Two-dimensional Page Walks for Virtualized Systems. In Proceedings of ASPLOS (March 2008), pp. 26–35

work page 2008

[6] [6]

Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile

Boeyen, S., Santesson, S., Polk, T., Housley, R., Farrell, S., and Cooper, D. Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. RFC 5280, May 2008

work page 2008

[7] [7]

Braun, J., Krasheninnikov, D., Anwar, U., Kirk, R., Tan, D., and Krueger, D. S. A Sober Look at Steering Vectors for LLMs. LessWrong, November 23, 2024

work page 2024

[8] [8]

Safe harbor

Cornell Law School Legal Information Institute . Safe harbor. Legal Dictionary. https://www.law.cornell.edu/wex/safe_harbor, June, 2025

work page 2025