Readings

Agent Security

Core Attack Surfaces

Type	Conference	Paper
Prompt Injection & Indirect Instruction
	2026-ICLR	ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents
	2026-ICLR	Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?
	2026-ICLR	PromptArmor: An Essential Baseline for Prompt Injection Defenses
	2026-NDSS	Attention is All You Need to Defend Against Indirect Prompt Injection Attacks in LLMs
	2026-NDSS	ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data
	2025-ACM CCS	Here Comes the AI Worm: Preventing the Propagation of Adversarial Self-Replicating Prompts Within GenAI Ecosystems
	2025-ACM CCS	SecAlign: Defending Against Prompt Injection with Preference Optimization
	2025-ICML	MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents
	2025-IEEE S&P	DataSentinel: A Game-Theoretic Detection of Prompt Injection Attacks
	2025-IEEE S&P	Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-Based Prompt Injection Attacks via the Fine-Tuning Interface
	2025-NeurIPS	DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents
	2025-USENIX Security	Make Agent Defeat Agent: Automatic Detection of Taint-Style Vulnerabilities in LLM-based Agents
	2025-USENIX Security	SelfDefend: LLMs Can Defend Themselves against Jailbreaking in a Practical Manner
	2025-USENIX Security	StruQ: Defending Against Prompt Injection with Structured Queries
	2024-ACM CCS	A Causal Explainable Guardrails for Large Language Models
	2024-ACM CCS	Optimization-based Prompt Injection Attack to LLM-as-a-Judge
Tool Hijacking & Tool Selection
	2026-ICLR	ToolTweak: An Attack on Tool Selection in LLM-based Agents
	2026-ICLR	TrojanTools: Adaptive Indirect Prompt Injection on LLM Agents via Malicious Tool-Calling
	2026-NDSS	Les Dissonances: Cross-Tool Harvesting and Polluting in Pool-of-Tools Empowered LLM Agents
	2026-NDSS	Prompt Injection Attack to Tool Selection in LLM Agents
	2025-EMNLP	IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agents
	2025-NeurIPS	Attractive Metadata Attack: Inducing LLM Agents to Invoke Malicious Tools
Memory / Context Poisoning
	2026-ICLR	A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory
	2026-ICLR	InjecMEM: Memory Injection Attack on LLM Agent Memory Systems
	2026-ICLR Workshop MemAgents	Memory Injection Attacks on LLM Agents via Query-Only Interaction
	2025-WCUA	Context Manipulation Attacks: Web Agents Are Susceptible to Corrupted Memory
Prompt / Configuration Leakage
	2026-IEEE S&P	LLMThief: Evaluating Configuration Leaking Risks in Commercial LLM App Stores
	2025-ACM CCS	Prompt Inference Attack on Distributed Large Language Model Inference Frameworks
	2025-ACM CCS	You Can't Steal Nothing: Mitigating Prompt Leakages in LLMs via System Vectors
	2025-IEEE S&P	On the Effectiveness of Prompt Stealing Attacks on In-the-Wild Prompts
	2025-USENIX Security	PRSA: Prompt Stealing Attacks against Real-World Prompt Services

System Boundaries & Ecosystem Security

Type	Conference	Paper
Execution Isolation & Permission Control
	2026-IEEE S&P	Towards Automating Data Access Permissions in AI Agents
	2026-NDSS	ACE: A Security Architecture for LLM-Integrated App Systems
	2026-NDSS	Beyond Jailbreak: Unveiling Risks in LLM Applications Arising from Blurred Capability Boundaries
	2025-NDSS	IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems
	2024-ACM CCS	Demystifying RCE Vulnerabilities in LLM-Integrated Apps
MCP / Plugin / App Ecosystem Security
	2026-ICLR	Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via Model Context Protocol
	2026-IEEE S&P	When AI Meets the Web: Prompt Injection Risks in Third-Party AI Chatbot Plugins
	2025-IEEE S&P	On the (In)Security of LLM App Stores
Multi-Agent Trust / Governance
	2026-ICLR	Exposing Weak Links in Multi-Agent Systems under Adversarial Prompting
	2026-NDSS	SAGA: A Security Architecture for Governing AI Agentic Systems
	2025-AAAI	Multi-Agent Security Tax: Trading Off Security and Collaboration Capabilities in Multi-Agent Systems
	2025-ACL	G-Safeguard: A Topology-Guided Security Lens and Treatment on LLM-based Multi-agent Systems
	2025-ACL	Red-Teaming LLM Multi-Agent Systems via Communication Attacks
	2024-AAAI	Robust Communicative Multi-Agent Reinforcement Learning with Active Defense
	2024-ICML	Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast

Agent Settings & Real Environments

Type	Conference	Paper
Web / Browser Agent Security
	2026-IEEE S&P	Investigating the Impact of Dark Patterns on LLM-Based Web Agents
	2026-IEEE S&P	WebCloak: Characterizing and Mitigating Threats from LLM-Driven Web Agents as Intelligent Scrapers
	2025-ICML	AdvAgent: Controllable Blackbox Red-teaming on Web Agents
	2025-USENIX Security	When LLMs Go Online: The Emerging Threat of Web-Enabled LLMs
Computer-Use / Coding Agent Security
	2026-ICLR	Deep-Cover Agents: Long-Horizon Prompt Injections on Production LLM Systems
	2025-IEEE S&P	Make a Feint to the East While Attacking in the West: Blinding LLM-Based Code Auditors with Flashboom Attacks
	2025-NeurIPS	MIP against Agent: Malicious Image Patches Hijacking Multimodal OS Agents
	2024-ACM CCS	PromSec: Prompt Optimization for Secure Generation of Functional Source Code with Large Language Models (LLMs)

Security Infrastructure

Type	Conference	Paper
Monitoring / Oversight
	2026-ICLR	How Does Information Access Affect LLM Monitors' Ability to Detect Sabotage?
	2026-ICLR	Reliable Weak-to-Strong Monitoring of LLM Agents
	2025-BuildingTrust	Monitoring LLM Agents for Sequentially Contextual Harm
	2025-USENIX Security	Cloak, Honey, Trap: Proactive Defenses Against LLM Agents
Benchmark / Evaluation Platform
	2026-ICLR	A2ASecBench: A Protocol-Aware Security Benchmark for Agent-to-Agent Multi-Agent Systems
	2026-ICLR	Breaking Agent Backbones: Evaluating the Security of Backbone LLMs in AI Agents
	2026-ICLR	RedTeamCUA: Realistic Adversarial Testing of Computer-Use Agents in Hybrid Web-OS Environments
	2026-ICLR	VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents
	2025-ICLR	Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents
	2025-ICLR	AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents
	2025-ICML	SafeArena: Evaluating the Safety of Autonomous Web Agents
	2025-NeurIPS	OS-Harm: A Benchmark for Measuring Safety of Computer Use Agents
	2025-NeurIPS	SEC-bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks
	2025-NeurIPS	Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition
	2025-NeurIPS	WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks
	2024-ACL Findings	InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents
	2024-NeurIPS	AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents

Software Supply Chain

Type	Conference	Paper
Security
	2022-S&P	“They’re not that hard to mitigate”: What Cryptographic Library Developers Think About Timing Attacks
	2022-NDSS	Building Embedded Systems Like It’s 1996
	2022-NDSS	Probe the Proto: Measuring Client-Side Prototype Pollution Vulnerabilities of One Million Real-world Websites
	2022-NDSS	Cross-Language Attacks
	2022-S&P	Asleep at the Keyboard? Assessing the Security of GitHub Copilot’s Code Contributions
	2022-S&P	Committed to Trust: A Qualitative Study on Security & Trust in Open Source Software Projects
	2022-USENIX	How Long Do Vulnerabilities Live in the Code? A Large-Scale Empirical Measurement Study on FOSS Vulnerability Lifetimes
	2021-CCS	Supply-chain vulnerability elimination via active learning and regeneration
	2021-CCS	Preventing Dynamic Library Compromise on Node.js via RWX-Based Privilege Reduction
	2021-CCS	The Effect of Google Search on Software Security: Unobtrusive Security Interventions via Content Re-ranking
	2021-NDSS	Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages
	2021-USENIX	Abusing Hidden Properties to Attack the Node.js Ecosystem
	2021-USENIX	An Investigation of the Android Kernel Patch Ecosystem
	2021-ACM-SIGSAC	Supply-Chain Vulnerability Elimination via Active Learning and Regeneration
	2020-ACM-SIGSAC	Towards Using Source Code Repositories to Identify Software Supply Chain Attacks
	2020-CCS	A Qualitative Study of Dependency Management and Its Security Implications
	2020-S&P	An Analysis of Pre-installed Android Software
	2020-RAID	Mininode: Reducing the Attack Surface of Node.js Applications
	2019-USENIX	Small World with High Risks: A Study of Security Threats in the npm Ecosystem
	2019-ASIACCS	ScriptProtect: Mitigating Unsafe Third-Party JavaScript Practices
	2019-NDSS	How Bad Can It Git? Characterizing Secret Leakage in Public GitHub Repositories
	2019-USENIX	Less is More: Quantifying the Security Benefits of Debloating Web Applications
	2018-CCS	Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost
	2018-NDSS	BreakApp: Automated, Flexible Application Compartmentalization
	2017-NDSS	Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Libraries on the Web
	2017-CCS	Keep me Updated: An Empirical Study of Third-Party Library Updatability on Android
	2016-USENIX	On Omitting Commits and Committing Omissions: Preventing Git Metadata Tampering That (Re)introduces Software Vulnerabilities
	2012-CCS	You Are What You Include: Large-scale Evaluation of Remote JavaScript Inclusions
	2008-CCS	A look in the mirror: attacks on package managers
	2003-S&P	Poisoning the software supply chain
Software Engineering
	2022-ISSTA	A Large-Scale Empirical Analysis of the Vulnerabilities Introduced by Third-Party Components in IoT Firmware
	2022-WWW	Understanding the Practice of Security Patch Management across Multiple Branches in OSS Projects
	2022-ICSE	Demystifying the Vulnerability Propagation and Its Evolution via Dependency Trees in the NPM Ecosystem
	2022-ICSE	Practical Automated Detection of Malicious npm Packages
	2022-TSE	Open or Sneaky? Fast or Slow? Light or Heavy?: Investigating Security Releases of Open Source Packages
	2021-TSE	Identifying Challenges for OSS Vulnerability Scanners - A Study & Test Suite
	2021-ICSE	Containing Malicious Package Updates in npm with a Lightweight Permission System
	2021-ICSE	HERO: On the Chaos When PATH Meets Modules
	2021-SANER	Empirical Analysis of Security Vulnerabilities in Python Packages
	2021-ESEC/FSE	Detecting Node.js prototype pollution vulnerabilities via object lookup analysis
	2021-ASE	REPFINDER: Finding Replacements for Missing APIs in Library Update
	2021-ESEC/FSE	A Longitudinal Analysis of Bloated Java Dependencies
	2021-ESEC/FSE	LastPyMile: identifying the discrepancy between sources and packages
	2021-ESEC/FSE	A large-scale empirical study on Java library migrations: prevalence, trends, and rationales
	2021-TSE	Dependency Smells in JavaScript Projects
	2021-TSE	Back to the Past -- Analysing Backporting Practices in Package Dependency Networks
	2020-ICSME	Investigating the reproducibility of npm packages
	2020-ICSE	Extracting taint specifications for JavaScript libraries
	2020-ICSE	Watchman: monitoring dependency conflicts for Python library ecosystem
	2020-ESEC/FSE	Interactive, effort-aware library version harmonization
	2019-ICSE	Detecting Suspicious Package Updates
	2018-ESEC/FSE	Do the dependency conflicts in my project matter?
	2018-ESEC/FSE	The impact of regular expression denial of service (redos) in practice: an empirical study at the ecosystem scale
	2017-ICSE	How do developers fix cross-project correlated bugs? A case study on the GitHub scientific Python ecosystem
	2017-ASE-Workshop	Can automated pull requests encourage software developers to upgrade out-of-date dependencies?
	2017-ESEC/FSE	Why do developers use trivial packages? an empirical case study on npm.
	2016-ESEC/FSE	How to break an API: cost negotiation and community values in three software ecosystems.
	2015-ICSME	Impact assessment for vulnerabilities in open-source software libraries
	2015-SANER	Tracking known security vulnerabilities in proprietary software systems
	2015-ASE-Workshop	When It Breaks, It Breaks: How Ecosystem Developers Reason about the Stability of Dependencies
	2015-ICSW	Measuring Dependency Freshness in Software Systems

Kernel Static Analysis

Latest Static Analysis Technique

• 2001-OSR: Bugs as Deviant Behavior: A General Approach to Inferring Errors in Systems Code
• 2019-FSE：Detecting Concurrency Memory Corruption Vulnerabilities — 【tool-CONVUL】

Detecting UB Bugs in Kernel

• 2021-NDSS: KUBO: Precise and Scalable Detection of User-triggerable Undefined Behavior Bugs in OS Kernel
• 2019-USENIX-ATC：Effective Static Analysis of Concurrency Use-After-Free Bugs in Linux Device Drivers — 【note】

Detecting Logical Bugs in Kernel

• 2020-CCS: Exaggerated Error Handling Hurts! An In-Depth Study and Context-Aware Detection
• 2019-USENIX：PeX: A Permission Check Analysis Framework for Linux Kernel
• 2018-S&P：DEADLINE-Precise and Scalable Detection of Double-Fetch Bugs in OS Kernels — 【note】【note2】【note3】【tool-DEADLINE】

Research Trends of Kernel Static Analysis

• 2020-TOCS：Effective Detection of Sleep-in-atomic-context Bugs in the Linux Kernel

• 2019-ASPLOS: DCNS: Automated Detection Of Conservative Non-Sleep Defects in the Linux Kernel

• 2019-USENIX：Detecting Missing-Check Bugs via Semantic- and Context-Aware Criticalness and Constraints Inferences — 【tool-CRIX】

• 2018-USENIX-ATC：DSAC: Effective Static Analysis of Sleep-in-Atomic-Context Bugs in Kernel Modules

• 2018-NDSS：K-Miner: Uncovering Memory Corruption in Linux — 【note】【note2】【tool-K-Miner】

• 2018-CCS：Check It Again- Detecting Lacking-Recheck Bugs in OS Kernels — 【note】【note2】【tool-LRSan】

• 2017-USENIX：How Double-Fetch Situations turn into DoubleFetch — 【note】【tool】

• 2017-USENIX：DR. CHECKER- A Soundy Analysis for Linux Kernel Drivers — 【tool-dr_checker】

• 2017-USENIX：Digtool- A Virtualization-Based Framework for Detecting Kernel Vulnerabilities-usenix — 【note】【note2】【note3】【note4】

• 2017-EUROSYS：DangSan - Scalable Use-after-free Detection — 【tool-dangsan】

• 2016-USENIX：APISan: Sanitizing API Usages through Semantic Cross-Checking — 【tool-apisan】

• 2016-USENIX：UniSan-Proactive Kernel Memory Initialization to Eliminate Data Leakages — 【note】【tool-unisan】

• 2015-SOSP：Cross-checking semantic correctness: The case of finding file system bugs — 【tool-JUXTA】

• 2014-USENIX：Static Analysis of Variability in System Software - The 90, 000 #ifdefs Issue

• 2013-DSN: Hector: Detecting resource-release omission faults in error-handling code for systems software

• 2013-WCRE: Who Allocated My Memory? Detecting Custom Memory Allocators in C Binaries

• 2012-OSDI：Improving integer security for systems with KINT

• 2008-EUROSYS: Documenting and automating collateral evolutions in linux device drivers

• 2007-ICSE: Pathsensitive inference of function precedence protocols

• 2005-ESEC/FSE: Context- and Path-sensitive Memory Leak Detection

Kernel Code and Page Table Protection

x86

• 2020-SP: xMP: Selective Memory Protection for Kernel and User Space
• 2017-EUROSP: On the Effectiveness of Virtualization Based Memory Isolation on Multicore Platforms
• 2017-NDSS: PT-Rand: Practical Mitigation of Data-only Attacks against Page Tables
• 2017-EuroSys: kR^X: Comprehensive Kernel Protection against Just-In-Time Code Reuse
• 2016-CCS: Prefetch Side-Channel Attacks: Bypassing SMAP and Kernel ASLR
• 2016-CNS: Preventing Kernel Code-Reuse Attacks Through Disclosure Resistant Code Diversification
• 2015-ASPLOS: Nested Kernel: An Operating System Architecture for Intra-Kernel Privilege Separation
• 2015-ATC: SecPod: A Framework for Virtualization-based Security Systems
• 2012-ACSEC: Efficient protection of kernel data structures via object partitioning
• 2011-ASPLOS: Ensuring Operating System Kernel Integrity with OSck
• 2011-NDSS: Practical Protection of Kernel Integrity for Commodity OS from Untrusted Extensions
• 2010-CCS: Hypersentry: enabling stealthy in-context measurement of hypervisor integrity
• 2010-SP: Hypersafe: A lightweight approach to provide lifetime hypervisor control-flow integrity
• 2010-SP: TrustVisor: Efficient TCB Reduction and Attestation
• 2010-ACSEC: Analyzing and improving Linux kernel memory protection: a model checking approach
• 2009-CCS: Countering kernel rootkits with lightweight hook protection
• 2009-USENIX: Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms
• 2009-ACSEC: Protecting Kernel Code and Data with a Virtualization-Aware Collaborative Operating System
• 2007-SOSP: SecVisor : A Tiny Hypervisor to Provide Lifetime Kernel Code Integrity for Commodity OSes

ARM

• 2017-NDSS：Dynamic Virtual Address Range Adjustment for Intra-Level Privilege Separation on ARM
• 2016-HPCC-SmartCity-DSS: TZ-KPM:Kernel Protection Mechanism on Embedded Devices on Hardware-Assisted Isolated Environment
• 2016-NDSS: SKEE: A lightweight Secure Kernel-level Execution Environment for ARM
• 2014-MST: SPROBES: Enforcing Kernel Code Integrity on the TrustZone Architecture
• 2014-CCS: Hypervision Across Worlds: Real-time Kernel Protection from the ARM TrustZone Secure World

RISCV

• 2019-DATE: RiskiM: Toward Complete Kernel Protection with Hardware Support

MISC

• 2018-DAC: Hypernel: a hardware-assisted framework for kernel protection without nested paging
• 2016-CNS: Preventing kernel code-reuse attacks through disclosure resistant code diversification
• 2016-HASP：Architectural supports to protect OS kernels from code-injection attacks
• 2008-RAID: Guest-Transparent Prevention of Kernel Rootkits with VMM-Based Memory Shadowing
• 1999-ICDCS: Efficient Kernel Support of Fine-Grained Protection Domains for Mobile Code

Kernel Code/PageTable Protect Summary

Type	Date	Paper
KLAT - PageTable
	2017-NDSS	PT-Rand: Practical Mitigation of Data-only Attacks against Page TablesPT-Rand
	2010-ACSEC	Analyzing and Improving Linux Kernel Memory Protection: A Model Checking Approach
KLAT - Code
	2017-EuroSys	kR^X: Comprehensive Kernel Protection against Just-In-Time Code Reuse
	2016-CNS	Preventing Kernel Code-Reuse Attacks Through Disclosure Resistant Code Diversification
	2015-SP	Readactor: Practical Code Randomization Resilient to Memory Disclosure
	2015-ASPLOS	Nested Kernel: An Operating System Architecture for Intra-Kernel Privilege Separation
	2014-SIGSAC	You Can Run but You Can’t Read: Preventing Disclosure Exploits in Executable Code
	1999-ICDCS	Efficient Kernel Support of Fine-Grained Protection Domains for Mobile Code
SLAT - PageTable
	2020-SP	xMP: Selective Memory Protection for Kernel and User Space
	2017-EUROP	On the Effectiveness of Virtualization Based Memory Isolation on Multicore Platforms
	2016-ATC	SecPod: SecPod: a Framework for Virtualization-based Security Systems
	2007-SOSP	SecVisor : A Tiny Hypervisor to Provide Lifetime Kernel Code Integrity for Commodity OSes
	USENIX-2018	EPTI: Efficient Defence against Meltdown Attack for Unpatched VMs
	VEE-2020	Lightweight Kernel Isolation with Virtualization and VM Functions
SLAT - Code
	2011-NDSS	Practical Protection of Kernel Integrity for Commodity OS from Untrusted Extensions
	2010-SP	TrustVisor: Efficient TCB Reduction and Attestation
	2009-CCS	Countering kernel rootkits with lightweight hook protection
	2009-ACSEC	Protecting Kernel Code and Data with a Virtualization-Aware Collaborative Operating System
	2008-RAID	Guest-Transparent Prevention of Kernel Rootkits with VMM-Based Memory Shadowing
Other Hardwares - PageTable
	2014-CCS	Hypervision Across Worlds: Real-time Kernel Protection from the ARM TrustZone Secure World
Other Hardwares - Code
	2019-DATE	RiskiM: Toward Complete Kernel Protection with Hardware Support
	2016-HPCC	TZ-KPM Kernel Protection Mechanism on Embedded Devices on Hardware-assisted Isolated Environment
	2016-NDSS	SKEE: A lightweight Secure Kernel-level Execution Environment for ARM
	2016-HASP	Architectural Supports to Protect OS Kernels from Code-Injection Attacks

Kernel Fuzzing

Type	Date	Paper
SYSCALL
	SOSP 2021	HEALER: Relation Learning Guided Kernel Fuzzing
	CCS 2021	SyzGen: Automated Generation of Syscall Specification of Closed-Source macOS Drivers
	NDSS 2020	HFL: Hybrid Fuzzing on the Linux Kernel
	EuroSec 2020	X-AFL: A Kernel fuzzer combining passive and active fuzzing
	USENIX 2018	MoonShine: Optimizing OS fuzzer seed selection with trace distillation
INPUT
	NDSS 2022	EMS : History-Driven Mutation for Coverage-based Fuzzing
	USENIX 2021	SYZVEGAS : Beating Kernel Fuzzing Odds with Reinforcement Learning
DRIVER & FILESYSTEM
	NDSS 2022	Semantic-Informed Driver Fuzzing Without Both the Hardware Devices and the Emulators
	USENIX 2020	USBFuzz: A framework for fuzzing USB drivers by device emulation
	SP 2020	Ex-vivo dynamic analysis framework for android device drivers
	ACM Transactions on Storage 2020	Finding Bugs in File Systems with an Extensible Fuzzing Framework
	SP 2020	KRACE : Data Race Fuzzing for Kernel File Systems
	SP 2019	Fuzzing File Systems via Two-Dimensional Input Space Exploration
	SOSP 2019	Finding semantic bugs in file systems with an extensible fuzzing framework
	CCS 17	Difuze: Interface aware fuzzing for kernel drivers
PERFORMANCE
	CCS 2021	Hardware Support to Improve Fuzzing Performance and Precision
	USENIX 2021	Undo Workarounds for Kernel Bugs
	USENIX 2020	Agamotto : Accelerating Kernel Driver Fuzzing with Lightweight Virtual Machine Checkpoints
	USENIX 2017	KAFL: Hardware-assisted feedback fuzzing for OS kernels
STATE
	CCS 2021	HyperFuzzer: An Efficient Hybrid Fuzzer for Virtual CPUs
	SP 2019	Razzer: Finding kernel race bugs through fuzzing
	WOOT 2019	Unicorefuzz: On the viability of emulation for kernelspace fuzzing
OTHER
	USENIX 2022	SyzScope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux kernel