Sitemap
A list of all the posts and pages found on the site. For you robots out there, there is an XML version available for digesting as well.
Pages
Posts
portfolio
ARMored CoreSight: Binary-only Fuzzing for ARM
High-performance fuzzing framework for ARM binaries using hardware tracing features, developed during MITOU Project and productized at Ricerca Security
publications
Shepherd - High-Precision Coverage Inference for Response-guided Blackbox Fuzzing (Registered Report)
Published in ISSTA Companion 2025 - 34th ACM SIGSOFT International Symposium on Software Testing and Analysis, 2025
In recent years, fuzzing has gained attention as a primary means for the early detection of vulnerabilities. Although coverage-based greybox fuzzing utilizes internal coverage information to achieve high exploration efficiency, it remains difficult to employ the fuzzing framework in some restricted environments where we cannot instrument the program, such as firmware or smartphone applications. In contrast, blackbox fuzzing does not require runtime information and is thus more widely applicable, but suffers from lower efficiency because coverage cannot be measured. To address this issue, there is a growing demand for methods that can approximate coverage in blackbox environments to optimize fuzzing. One existing study proposes estimating coverage based on the relationship between program responses and strings embedded in its binary. However, this approach faces challenges with ambiguous matching algorithms and the non-uniqueness that occurs when a single string is shared by multiple basic blocks, leading to frequent misestimations. In this research, we propose a new coverage inference method, Shepherd, which combines high-precision string matching with context analysis to resolve these problems. Experimental results show that Shepherd significantly improves estimation accuracy compared to the existing approach.
Delayed Momentum Aggregation: Communication-efficient Byzantine-robust Federated Learning with Partial Participation
Published in Appeared at ICML 2026, 2026
Partial participation is essential for communication-efficient federated learning at scale, yet existing Byzantine-robust methods typically assume full client participation. In the partial participation setting, a majority of the sampled clients may be Byzantine, once Byzantine clients dominate, existing methods break down immediately. We introduce delayed momentum aggregation, a principle where the central server aggregates cached momentum from non-sampled clients along with fresh momentum from sampled clients. This principle ensures Byzantine clients remain a minority from the server’s perspective even when they dominate the sampled set. We instantiate this principle in our optimizer DeMoA. We analyze the convergence rate of DeMoA, showing that DeMoA is Byzantine-robust under partial participation. Experiments show that, with 20% Byzantine ratio and only 10% partial participation rate, DeMoA achieves the best accuracy even when existing methods fail empirically.
talks
iOS Kernel Jailbreaking Attack Methods
Published:
Presented at CODE BLUE 2017, one of Japan’s premier security conferences.
teaching
Teaching Assistant - IPA Security Camp
Security Training Camp, IPA Security Camp, 2019
Served as a Teaching Assistant at the prestigious IPA Security Camp, a government-sponsored intensive cybersecurity training program for talented young students in Japan.