Yaxuan(Alice) Wen New York University 370 Jay Street, Brooklyn, NY 11201 Email: yaxuan.w[at]nyu.edu

CV GitHub

Bio

Research

My research lies at the intersection of operating systems security and software supply-chain security. Across these areas, a common theme is minimizing the trust assumptions across the software stack. Rather than assuming that ambient host environments or untrusted intermediaries behave correctly, these systems derive their security properties from explicit trust boundaries, enforceable mechanisms, and independently verifiable evidence.

I am also a maintainer of the open-source Lind Project.

My current work spans two directions:

Trustworthy compilation. TriSeal is a prototype for attestable, closed-world compilation. It treats a build as a declared transformation over declared inputs, performed under a declared execution policy inside a hardware-measured boundary. Rather than trusting the build host, verifiers can check that an artifact is bound to a specific compiler, set of inputs, execution policy, and measured environment. This approach addresses the build-environment risks highlighted by supply-chain compromises such as SolarWinds and XZ.

Composable OS policies. My work Grate in the Lind Project focuses on designing and implementing a userspace architecture for composing independently developed system-call policies. Each policy component runs in isolated compartments inside a single unprivileged host process and can inspect, filter, transform, forward, or service system calls before they reach the host operating system. These components can be combined differently for each workload, bringing the Unix pipeline philosophy to OS policy enforcement without kernel modifications or elevated privilege.

Talks