This is the reading behind the work on this site, grouped by theme. It has two uses: a roadmap if you are new to systems and security, or the intellectual basis of the research if you already work in the field. Everything listed is a primary or authoritative source, and every link goes to the original.
It is deliberately short. A handful of papers that change how you reason about a problem are worth more than a long bibliography you never finish.
Suggested path
where to beginA rough order if you are starting out. Each step links to the section below; take the first item there and follow whatever interests you.
- Isolation and the confinement problem — why running a program safely is hard before any tool enters the picture.
- Kernels and the trusted computing base — microkernels, formal verification, and hardware roots of trust.
- Trusting trust — the chain from compiler to binary, and why review is not enough.
- Reproducible builds and the supply chain — provenance, attestation, and update security.
- AI security — threat models for models, agents, and the data behind them.
- Security architecture — principles, threat modelling, and zero trust.
- Cryptography and privacy — the primitives, and the responsibility of deploying them.
Operating Systems & Kernel Isolation
confinement · microkernels · namespaces · trusted computingA Note on the Confinement Problem
Defines confinement as the core isolation problem: how to run a program so it cannot leak what it knows to anything but its caller. The mental model underneath sandboxes, capability systems, and covert-channel analysis.
A useful foundation for understanding why isolation is an architectural property rather than a container feature.
On µ-Kernel Construction
Shows how to make the minimal privileged core small and fast enough to be practical. The argument that shrinking the trusted computing base is a design choice, not a performance compromise.
A particularly useful lens for deciding what must live in the kernel and what can move to userspace.
seL4: Formal Verification of an OS Kernel
The first machine-checked proof of functional correctness for a general-purpose microkernel. Shows what "verified" actually costs and what it guarantees, from the abstract specification down to the C implementation.
A foundational reference for the limit of what testing can claim and what proof can.
Intel SGX Explained
A rigorous walk through enclave design and its threat model. Useful less as an endorsement of SGX than as a case study in what hardware-rooted isolation does and does not protect against.
Relevant to judging "trusted execution" claims against their actual attacker model.
Application Container Security Guide (NIST SP 800-190)
Lays out the container threat surface — images, registries, orchestrators, runtime and host — with the countermeasures for each. Treats containers as an isolation boundary that inherits the kernel's failure modes.
Worth studying for why container isolation is only as strong as the kernel under it.
namespaces(7)
The primary reference for the Linux primitives that underpin containers: mount, PID, network, user, IPC and the rest. Precise about what each namespace separates and what it leaves shared.
The ground truth behind a lot of "container" claims.
TPM 2.0 Library Specification
The specification for the hardware root of trust on most modern platforms: measured boot, sealing, and attestation primitives. Defines what a platform can prove about its own state.
A foundational reference for attestation and the boot chain.
Reproducible Builds & Supply Chain
trust · provenance · verificationReflections on Trusting Trust
The Turing Award lecture that made the trust chain explicit: a compiler can plant a backdoor that survives recompilation of the compiler itself. The reason "I reviewed the source" is not enough.
The canonical motivation for reproducible builds and build provenance.
Reproducible Builds documentation
The reference documentation for making builds bit-for-bit reproducible: the common sources of nondeterminism and how to remove them. Turns "trust me" into "verify me".
A useful foundation for treating builds as verifiable artifacts.
Reproducible Builds: Increasing the Integrity of Software Supply Chains
Surveys the field: what reproducibility gives you, how to achieve it, and how independent rebuilders can detect a compromised build infrastructure.
A good synthesis if you want the research landscape rather than the how-to.
Build Systems à la Carte
A taxonomy of build systems by their dependency model, scheduling, and rebuild strategy. The mental model for why hermetic, content-addressed builds behave the way they do.
A particularly useful lens for hermetic and deterministic builds.
SLSA: Supply-chain Levels for Software Artifacts (v1.0)
A levels-based framework for build provenance: what an artifact's build should guarantee, and how that is attested. Converges supply-chain assurance into statements a consumer can check.
A practical reference for provenance and attestation.
in-toto: Providing Farm-to-Table Guarantees for Bits and Bytes
A framework for cryptographically verifying each step of the supply chain — who did what, in what order — so a compromise at any single step is detectable by the consumer.
Foundational for linking source to artifact.
The Update Framework specification
A specification for securing software updates against key compromise, rollback, and freeze attacks. Defines roles and thresholds so that no single stolen key is catastrophic.
Relevant to update integrity and survivable key compromise.
Secure Software Development Framework (NIST SP 800-218)
A concise set of practices for producing secure software, aligned with what auditors and customers increasingly ask for. Useful as the standard against which build and release processes are judged.
A practical reference for organizational process rather than a single artifact.
AI Security
threat models · agents · training dataOWASP Top 10 for LLM Applications
The de facto taxonomy of large-language-model application risks: prompt injection, insecure output handling, supply chain, and more. A shared vocabulary for triaging LLM features.
A useful foundation for threat modelling LLM features.
MITRE ATLAS
An ATT&CK-style knowledge base of adversarial tactics and techniques against AI systems, grounded in real-world case studies. Maps attacker behaviour onto machine-learning pipelines.
Relevant to treating models as part of an attack surface.
Artificial Intelligence Risk Management Framework (NIST AI 100-1)
A governance and risk framework for AI systems organised as map, measure, manage, govern. Bridges technical controls and organizational accountability.
Useful for structuring AI-risk work beyond a single model.
Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
Shows that content an LLM reads — a web page, a document, an issue comment — becomes instructions it may follow. Establishes indirect prompt injection as an architectural trust problem, not a prompt-filter problem.
A particularly useful lens for tool-using and multi-agent systems.
Extracting Training Data from Large Language Models
Demonstrates that models can memorise and regurgitate training data, including personally identifiable information. Makes training-set privacy a security concern, not only a policy one.
Relevant to model and data provenance.
Universal and Transferable Adversarial Attacks on Aligned Language Models
Introduces a method for eliciting harmful behaviour that transfers across models. Shows that alignment is not a reliable security boundary against a determined attacker.
Worth studying for the limits of guardrails.
Concrete Problems in AI Safety
An early, clear taxonomy of practical safety failures — side effects, reward hacking, scalable oversight, safe exploration. Useful framing from before the field narrowed to "alignment".
A foundational reference for AI-safety reasoning.
Security Architecture & Systems
principle · threat modelling · least privilegeThe Protection of Information in Computer Systems
The paper that gave security architecture its vocabulary: least privilege, fail-safe defaults, complete mediation, separation of privilege. Still the checklist behind most design reviews.
A foundational reference for secure-by-design.
Security Engineering (3rd edition)
A comprehensive account of security as an engineering discipline across systems, people, economics, and policy. Free to read online, and the closest single reference to how this site approaches systems.
The most useful overview of the whole field.
Zero Trust Architecture (NIST SP 800-207)
Defines zero trust as concrete architectural choices — policy engines, per-request decisions, no implicit trust from network location. Cuts through the marketing.
A useful lens for putting authorization as close to the resource as possible.
Threat Modeling: Designing for Security
A practical method for finding design flaws before code: what you are building, what can go wrong, and what to do about it. Teaches threat modelling as a repeatable habit.
Relevant to how each finding here is structured.
Capability Myths Demolished
Clears up the confusion around capability and access-control systems, separating authority, designation, and naming. A precise mental model for object-capability security.
A useful foundation for least-privilege design.
Cryptography & Privacy
primitives · protocols · responsibilityCommunication Theory of Secrecy Systems
The founding paper of information-theoretic cryptography: perfect secrecy, entropy as uncertainty, and the work function of a cipher. Everything after builds on these definitions.
A foundational reference for what encryption can and cannot guarantee.
New Directions in Cryptography
Introduced public-key cryptography and the key-exchange idea, removing the need to share a secret in advance. The origin of an enormous fraction of deployed cryptography.
Foundational for understanding trust without prior shared secrets.
A Method for Obtaining Digital Signatures and Public-Key Cryptosystems
The RSA construction, and with it practical encryption and digital signatures over public channels. The paper that made public-key cryptography usable.
Relevant to signatures as the basis of provenance.
Tor: The Second-Generation Onion Router
The design of a low-latency anonymity network: onion routing, forward secrecy, directory services, and the trade-offs between anonymity and performance. Privacy engineering under a real threat model.
A useful case study in designing for an adversary.
The Double Ratchet Algorithm
Specifies how modern messengers achieve forward secrecy and post-compromise security on a per-message basis. Concrete, auditable privacy engineering rather than a promise.
A foundational reference for end-to-end encryption in practice.
The Moral Character of Cryptographic Work
Argues that cryptography is political, and that technical choices carry ethical consequences. A counterweight to treating security as purely mechanical.
Relevant to why privacy engineering matters.
Module-Lattice-Based Key-Encapsulation Mechanism Standard (FIPS 203)
The standardized post-quantum key-encapsulation mechanism (ML-KEM). Signals the migration away from RSA and elliptic-curve key exchange that systems now need to plan for.
Worth studying for long-lived data and crypto agility.
Further Exploration
organisations · primary sources to watchGoogle Project Zero
High-quality, primary vulnerability research with reproducible write-ups. A model for documenting a finding so a third party can verify it rather than take it on faith.
A useful standard for how to write up a finding.
NIST Computer Security Resource Center
The primary index of NIST security publications: the SP 800 series, FIPS, and frameworks. Where most of the standards listed above actually live.
Linux Kernel Documentation
Official documentation for the kernel's security interfaces and subsystems. The ground truth beneath a great deal of systems-security writing.