https://www.cl.cam.ac.uk/techreports/ Recent research reports published by the Computer Laboratory at the University of Cambridge. https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-1009.pdf Blackwell, Alan F. Good, David A. University of Cambridge, Computer Laboratory 2026-08 Crucible is a research network that originated in the University of Cambridge in 2001, eventually becoming one of the largest research organisations dedicated to promoting rigorous research collaboration between technologists, and researchers in the Arts, Humanities and Social Sciences (AH&SS). The main focus of this collaboration was on design as a meeting point for widely differing research disciplines. Crucible activities included the establishment of new research programmes, training of researchers, input to policy bodies, and identification of suitable funding sources for research in interdisciplinary design. Crucible provided both a scientific and organisational framework for this research. Why the name? The crucible has always been a melting pot for valuable materials, the origin of new alloys, materials of innovation. The Crucible founders believed that the post-industrial crucible must be a place where knowledge and ideas are blended and tempered. This document has been created as an archive of the wiki that documented the activities of the Crucible network, previously maintained at https://wiki.cam.ac.uk/crucible The live wiki, which had been maintained on a MediaWiki server hosted by the University of Cambridge Information Systems division, became unavailable after the managed wiki service was closed in September 2025. https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-1008.pdf Findeis, Arduin University of Cambridge, Computer Laboratory 2026-08 Evaluation methods play a critical role in artificial intelligence (AI) development. A common evaluation method are benchmarks: software that takes an AI model as input and returns one or more metrics summarizing model properties (e.g. “ability to code”). Benchmark results assist decision-making across the ecosystem: helping model developers identify better models, guiding downstream users in their model choice, highlighting breakthroughs to the public, among many more use cases. As the frontier of AI capabilities evolves, evaluation methods need to adapt accordingly. Conventional benchmarks rely on programmatic comparison to reference solutions. Such benchmarks have struggled to remain useful, eventually becoming too easy for frontier models, losing generality due to overfitting, and being unable to evaluate on popular but unverifiable domains (e.g. writing assistance). Feedback-based benchmarks have become a popular alternative: human or AI annotators repeatedly interact with two models simultaneously, in a blind test, and select the better one. Such benchmarks need no reference solutions and can partially mitigate overfitting, as test-cases are often dynamically generated by the annotators. Despite their advantages, feedback-based benchmarks have their own issues. In Part I of this thesis, we address two critical issues with feedback-based benchmarks by introducing new evaluation methods. Firstly, due to the feedback’s implicit nature, such benchmarks fail to explain why a model performs better. Various hidden biases have been observed in such benchmarks, such as length, position, or style bias, but limited tools exist to automatically detect such biases. In Chapter 3, we formulate interpreting feedback data as the Inverse Constitutional AI (ICAI) problem and introduce a corresponding method. We experimentally demonstrate the effectiveness of our method for automatic detection of novel biases in feedback data, and for understanding preference differences between individual users and groups of users. Secondly, we consider the issue of feedback-based benchmarks struggling with poor annotation quality on certain challenging domains (e.g. tasks requiring long-form factual, math or coding responses). In Chapter 4, we investigate augmenting AI annotators with external validation tools, such as code execution or web-search. We introduce an extensible framework for augmenting AI annotators with tools and demonstrate our framework’s effectiveness on newly created datasets and established benchmarks, finding that tools are often, but not always, able to improve performance. Across conventional and feedback-based benchmarks, some important model traits remain insufficiently evaluated. In Part II, we introduce new evaluation infrastructure to evaluate two types of model traits inadequately considered by prior benchmarks. Firstly, in addition to response correctness, users of AI systems often care about how the responses are presented to them. Users pay attention to the personality of responses, i.e. the style, tone, and character. In Chapter 5, we introduce our Feedback Forensics toolkit building on ICAI to detect personality traits encouraged by human feedback and exhibited by models. We release the toolkit alongside a web platform tracking personality in popular models and feedback datasets. We experimentally demonstrate the utility of the toolkit to highlight encouraged and discouraged traits in feedback datasets, differences in encouraged traits across use cases and annotator types (expert human, non-expert human, LLM), and differences between models from the closed- and open-source AI ecosystems. Finally, in Chapter 6, we focus on evaluating generalisation in AI models. In many use cases, solving a single problem is insufficient for an AI model to be useful. To be practical, methods need to be able to automatically adjust to different scenarios. Yet, many benchmarks test very specific capabilities, failing to test generalisation properties of models. Building energy optimisation (BEO) is one such use case, where generalisation is important but not well-evaluated by existing benchmarks. To address this evaluation gap, we introduce Beobench: a toolkit providing access to a diverse set of building simulations and, thereby, enabling users to evaluate the generalisation of AI models in this context. At the time of original publication, Beobench provided the largest unified collection of building environments for single-agent RL methods. Due to the importance of building energy use for greenhouse gas emissions, BEO is a potentially impactful environmental application of AI. Whilst the other methods introduced in this thesis are more generally applicable across domains, we especially highlight the use of Feedback Forensics together with ICAI to evaluate AI models addressing environmental risks. An important insight from this thesis is that the evaluation of frontier AI is never “solved”. There is no evaluation panacea. Rather, continuous effort and updating is required: new models introduce new evaluation blind spots, new evaluation techniques introduce new biases. As frontier AI progresses, continuously creating matching evaluation techniques will be critical to reap potential benefits whilst appropriately mitigating risks. https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-1007.pdf Carroll, Max University of Cambridge, Computer Laboratory 2026-07 This dissertation formalises and mechanises type slicing – a technique that incrementally explains program types by highlighting minimal program fragments. Using this, a programmer can select any sub-term of a program and incrementally explore complex types and concisely explain type errors. Crucially, this includes highlighting context surrounding the term, differing from typical type error highlighting, which simply states that a term has the wrong type, but not what about the surrounding context explains why it has this type. This is formalised in a bidirectional, gradually typed core calculus with explicit System F style polymorphism, products, and sum types. A novel context classification judgement formalises the notion of splitting type information into that derived from a selected sub-term and that coming from the surrounding context, and can be applied to arbitrary bidirectional type systems. Further, the theory extends formally to ill-typed programs with error marks, building upon the marked lambda calculus of Zhao et al. Essentially the whole construction is mechanised in Agda. https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-1006.pdf Carroll, Max University of Cambridge, Computer Laboratory 2026-07 This report seeks to improve the debugging of type errors in Hazel, a gradually typed functional language supporting incomplete programs, by explaining static type errors more completely and by combining the benefits of static and dynamic type errors. Three methods are developed. Type slicing highlights the code that determines an expression’s synthesised or analysed type, explaining not just where a static error occurred but why; it generalises beyond errors, applying to all expressions. Cast slicing propagates type slices through evaluation, attaching to each runtime cast a slice of the source code that gave rise to it, recovering the source context of dynamic type errors. A type error witness search procedure, built on indeterminate evaluation, automatically finds inputs witnessing a dynamic counterpart to a static error, linking the two classes of errors. All three methods are given mathematical foundations over a core bidirectionally and gradually typed calculus of functions, holes, and casts; the implementation in the Hazel programming environment extends considerably beyond this formalised fragment, covering nearly the full language. The methods are evaluated on a corpus of ill-typed Hazel programs, with the best search strategy failing to find existing dynamic witnesses for only 2% of the corpus. https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-1005.pdf Hu, Zheyuan University of Cambridge, Computer Laboratory 2026-03 Despite the advent of neural rendering, specifically supervised models trained on Bidirectional Reflectance Distribution Function (BRDF) for appearance modelling, there is limited understanding of their effectiveness, efficiency, and utility for downstream research. In this work, I designed implicit neural representations of BRDFs and evaluated their real-world performance relative to classical models, with extensions to sparse-sample reconstruction and multi-modal material synthesis. I further investigated importance sampling strategies in the rendering pipeline, alongside both supervised and generative methods. Building upon these contributions, I implemented a novel multi-modal generative pipeline and proposed new quantitative metrics for material synthesis, addressing a long-standing gap in the evaluation of neural materials. https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-1004.pdf Isstaif, Al Amjad Tawfiq University of Cambridge, Computer Laboratory 2026-02 Serverless computing, or Function-as-a-Service (FaaS), simplifies application deployment by allowing developers to focus on functionality while the service provider manages the underlying resources. This model charges users based on actual resource usage, making it ideal for intermittent workloads, unlike Infrastructure-as-a-Service (IaaS), where users pay for idle virtual machines. Thus, serverless computing shifts the cost of idle resources to the service provider, who must manage the underlying server capacity. In container-based serverless platforms, idle functions are often kept active to avoid the costs associated with initialising containers, or “cold starts”, which exacerbates resource under-utilisation. Overcommitting resources is a strategy to enhance resource utilisation by leveraging statistical multiplexing, where multiple workloads are unlikely to reach peak usage simultaneously. This approach allows for greater workload colocation and reduces server costs by pooling resources rather than over-allocating resources per function. However, service providers often adopt conservative overcommitment policies to avoid performance degradation and workload disruption, as higher levels of colocation increase the risk of contention. In container-based serverless systems, the high density of function containers—due to their small resource footprint—limits the benefits of overcommitment because it increases kernel scheduling overhead when managing large number of colocated containers. This dissertation proposes a host-focused approach to addressing the workload colocation problem in the context of serverless-style Linux container workloads and CPU resources. CPUs can be the bottleneck for many workloads and the efficiency of CPU multiplexing can limit the degree of workload colocation that can be achieved. The central thesis of this dissertation is that mitigating the CPU scheduling overhead associated with workload colocation allows to unlock additional capacity in a serverless cluster. The primary contribution is an enhanced Linux CPU scheduler that enables larger number of containers to share the CPU resources of a single server while robustly managing the increased risk of contention. This contribution is evaluated within a cluster resource allocation framework, demonstrating that higher levels of workload colocation are achievable thanks to the proposed scheduler. https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-1003.pdf Pankow, Hannah Hutchings, Alice Clayton, Richard University of Cambridge, Computer Laboratory 2025-11 This report presents a comprehensive ten-year review of the Cambridge Cybercrime Centre (CCC), evaluating its impact on the academic research landscape. Employing a mixed-methods approach, we combine a scoping review of 203 publications with a survey of 44 dataset users and 10 in-depth interview sessions with 12 individuals, including the Centre’s leadership. The findings reveal a consistent and accelerating uptake of the Centre’s datasets, with 131 of the reviewed papers making explicit use of the data. This growth is driven by a broad, international, and interdisciplinary community. We find the Centre’s primary contribution is the enablement of new research, particularly for postgraduate students and early-career researchers who gain access to large-scale data that would otherwise be infeasible to collect. While technical setup difficulties present a barrier for some users, the development of the PostCog analysis tool has been a critical success, serving as both an accessibility and efficiency tool for the community. However, its impact is currently limited by an awareness gap. We conclude that the Centre’s success lies in its evolution from a data provider to a holistic research ecosystem. Its future relevance will depend on its ability to adapt its data collection to evolving online harms and to ensure the long-term viability of its critical infrastructure. https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-1002.pdf Hugenroth, Daniel Lins, Mario Mayrhofer, René Beresford, Alastair R. University of Cambridge, Computer Laboratory 2025-10 In this paper we present attestable builds, a new paradigm to provide strong source-to-binary correspondence in software artifacts. We tackle the challenge of opaque build pipelines that disconnect the trust between source code, which can be understood and audited, and the final binary artifact which is difficult to inspect. Our system uses modern trusted execution environments (TEEs) and sandboxed build containers to provide strong guarantees that a given artifact was correctly built from a specific source code snapshot. As such it complements existing approaches like reproducible builds which typically require time-intensive modifications to existing build configurations and dependencies, and require independent parties to continuously build and verify artifacts. In comparison, an attestable build requires only minimal changes to an existing project, and offers nearly instantaneous verification of the correspondence between a given binary and the source code and build pipeline used to construct it. We evaluate it by building open-source software libraries—focusing on projects which are important to the trust chain and have proven difficult to be built deterministically. The overhead (42 seconds start-up latency and 14% increase in build duration) is small in comparison to the overall build time. Importantly, our prototype can build complex projects such as LLVM Clang without requiring any modifications to their source code and build scripts. Finally, we formally model and verify the attestable build design to demonstrate its security against well-resourced adversaries. https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-1001.pdf Fuchs, Franz A. University of Cambridge, Computer Laboratory 2025-08 This thesis explores how to protect Capability Hardware Enhanced RISC Instructions (CHERI) systems from transient-execution attacks. Transient-execution attacks shocked the computing world as they allow security mechanisms to be circumvented via seemingly safe performance-enhancing mechanisms. These attacks use misguided speculation to access secrets and transmit them via a side channel. Since the initial discovery of this attack class, every year saw fresh attacks being discovered with a lack of mitigation mechanisms. CHERI defines architectural capabilities that help to tackle spatial and temporal memory safety issues. However, the CHERI ISA has not been designed with transient-execution vulnerabilities in mind. In order to satisfy performance requirements, CHERI implementations employ out-of-order and speculative execution mechanisms. The lack of ISA-level guarantees leads to multiple attack scenarios on conventional and CHERI systems. This thesis demonstrates a full-scale attack on CHERI-Toooba that manages to break CHERI’s security guarantees in speculation and reliably leaks a secret value. Motivated by these findings, I developed ISA-level contracts that restrict speculative execution for both conventional and CHERI systems. As a major contribution, these contracts close a gap in architectures by giving guarantees about speculation mechanisms, which allows secure software to be built atop these contracts. I evaluated my contracts on CHERI-Toooba, which is an out-of-order, superscalar implementation of CHERI-RISC-V. My contracts offer substantial security guarantees and can surprisingly lead to improvements in both cycle performance as well as area usage on FPGAs. Making fine-grained compartmentalisation robust against transient-execution attacks is critical for the overall security of CHERI systems. In this work, I compare multiple different solutions and introduce Thread ID Capability (TIDC) registers as a fast and compact solution to compartmentalisation on CHERI-RISC-V. In order to facilitate fast and secure transitions between compartments, this work finds that microarchitectures must not allow microarchitectural state to leak. This thesis suggests multiple approaches to separating microarchitectural state and evaluates their performance on multiple compartmentalisation models. Last, this thesis introduces the notion of Compartment ID (CID) sealing. In this work, I implement a necessary subset of this approach that allows out-of-order microarchitectures to keep track of current software-defined CIDs. I find this approach to have significant performance advantages over conventional speculation fences. https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-1000.pdf Popeanga, Mihnea-Stefan University of Cambridge, Computer Laboratory 2025-08 Modern data centre (DC) operators cannot tune and secure what they cannot see. However, application identification from network traces is held back by two obstacles: public packet captures are scarce because commercial workloads and user data are confidential; the few datasets that exist do not focus on DC specific workloads, and do not allow others to reproduce the experiments. This dissertation tackles both these issues. I designed and implemented an end-to-end framework that can systematically capture traffic with nanosecond timestamps, demultiplex flows, and compute a set of 203 features. Each flow is coupled with extensive metadata detailing the exact setup that generated the traffic, allowing any researcher to reproduce the experiments under identical conditions. Using this workflow, I created the first public DC-focused dataset, unencumbered with personal or confidential information, that spans three representative workloads. Machine learning classification techniques demonstrate the utility of the data: traditional feature-based models achieve perfect accuracy when identifying the three workloads. A core novelty is that besides strict identification, the collected data includes significant metadata. To demonstrate this, I tackled performance estimation as well for one of the workloads. A 1D CNN can distinguish between flows corresponding to different performance metrics with an accuracy of 95%. https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-999.pdf Hugenroth, Daniel Cutler, Sam Kendrick, Dominic Savarese, Mario Hunter-Green, Zeke McMahon, Philip Kalanaki, Marjan Vasile, Diana A. Bejasa-Dimmock, Sabina Hoyland, Luke Beresford, Alastair R. University of Cambridge, Computer Laboratory 2025-06 The free press fulfills an important function in a democracy. It can provide individuals with a mechanism through which they can hold powerful people and organizations to account. In previous work, the University of Cambridge developed CoverDrop: a set of extensions to a typical news app which provided a secure and usable method of establishing initial contact between journalists and sources. Since publication, The Guardian and the University of Cambridge have undertaken further work on the design, highlighting additional challenges and shortcomings which needed to be addressed before deployment. This white paper presents an updated design of the CoverDrop system which addresses these issues, and describes the version that The Guardian first deployed in April 2025. https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-998.pdf Jeffery, Andrew University of Cambridge, Computer Laboratory 2025-05 Modern cloud services operate at significant and increasing scale. The growth of these services has led to the need for automated management to keep them operational across many thousands of nodes and multiple geo-distributed sites. Orchestrators are the platforms designed to automate this management and standardise the workflows involved. The significant uptake of modern orchestrators means that they have expanded their scope out of private datacenters, into the public cloud, and now even towards the edge of the network. These are environments for which they are not designed, and while they share some characteristics with private datacenters, the differences are sufficiently significant to require rethinking the design of the orchestrators. In this dissertation, I examine orchestrator design, focusing on the global state they maintain in their central datastores. To do this I propose a definition of the orchestration problem and provide a lightweight formalisation using model checking. I use this model to explore the properties of an existing orchestrator, explaining observed failures arising from changes in the consistency model. I then explore the impact of variations to the consistency model of the global state on properties and performance of the model checking. Using insights from this model and its consistency analysis I then propose two new datastores to support the control-plane of orchestration platforms, for the public cloud and the near-edge. In the public cloud data confidentiality is paramount, trying to minimise the actors within the trust boundary to enable secure, trusted deployments. For the near-edge I focus on availability of a single cluster, enabling individual locations to process requests without reliance on persistent non-local communication. Together, these components, the model and the two datastores, enable orchestration platforms to be optimised for their environments, enabling more widespread use. https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-997.pdf Naylor, Matthew Joannou, Alexandre Markettos, A. Theodore Metzger, Paul Moore, Simon W. Jones, Timothy M. University of Cambridge, Computer Laboratory 2025-03 Governments are increasingly advising software manufacturers to employ memory-safe languages and technologies to combat adversarial attacks on modern computing infrastructure. This introduces pressures across the entire computing industry, including GPGPU vendors who provide implementations of unsafe C/C++-based languages, such as CUDA and OpenCL, for programming the devices they produce. One of the memory-safety technologies being recommended is Capability Hardware Enhanced RISC Instructions (CHERI). CHERI builds strong and efficient memory safety into underlying instruction-set architectures allowing continued, but memory-safe, use of C/C++-based languages on top. Another option being recommended is Rust, a memory-safe systems programming language that can viably replace C/C++ in some cases. In this report, we evaluate the feasibility of incorporating CHERI into GPGPU architectures by extending a prototype, open-source, synthesisable, SIMT core and CUDA-like programming environment with support for CHERI. We present techniques to considerably ameliorate the costs of CHERI in SIMT designs, reducing register-file storage overheads from 103% to 7%, logic-area overheads by 44% to a cost comparable to one additional multiplier per vector lane, and execution-time overheads to 1.6%. By comparison, an experimental Rust port of the same GPGPU benchmark suite shows a 34% increase in execution time due to software bounds checking. With the proposed techniques, CHERI offers a viable path to strong and efficient GPGPU memory safety, while avoiding the need to replace established programming practices. https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-996.pdf Watson, Robert N. M. Baldwin, John Chen, Tony Chisnall, David Clarke, Jessica Davis, Brooks Filardo, Nathaniel Wesley Gutstein, Brett Jenkinson, Graeme Kern, Christoph Laurie, Ben Mazzinghi, Alfredo Moore, Simon W. Neumann, Peter G. Okhravi, Hamed Rebert, Alex Richardson, Alex Sewell, Peter Tratt, Laurence Vijayaraghavan, Murali Vincent, Hugo Witaszczyk, Konrad University of Cambridge, Computer Laboratory 2025-02 This is the extended version of the paper, “It is time to standardize principles and practices for software memory safety”, which appeared in the February 2025 issue of Communications of the ACM. In this report, we explore memory-safety standardization, which we argue is an essential step to promoting universal strong memory safety in government and industry, and, in turn, to ensure access to more secure software for all. Over the last two decades, a set of four research technologies for strong memory safety – memory-safe systems languages, hardware and software memory protection, formal approaches, and software compartmentalization – have reached sufficient maturity to see early deployment in security-critical use cases. However, there remains no shared, technology-neutral terminology or framework with which to specify memory-safety requirements. This is needed to enable reliable specification, design, implementation, auditing, and procurement of strongly memory-safe systems. Failure to speak in a common language makes it difficult to understand the possibilities or communicate accurately with one another, limiting perceived benefits and hence actual demand. The lack of such a framework also acts as an impediment to potential future policy interventions, and, in turn, as an impediment to stating requirements to address observed market failures preventing adoption of these technologies. Standardization would also play a critical role in improving industrial best practice, another key aspect of adoption. We begin with an overview of the many techniques – from hardware to software to formal theories – that have been developed and redefined over several decades, and how each plays a part in moving us towards strong memory safety. We explore how these technologies can be differentiated, considering both differences in functional protection and strength. We discuss how adoption barriers and potential market failures have limited adoption, and how the standardization gap limits potential interventions. We propose potential approaches to standardization – likely a task not limited to any one institution or standards body – and conclude with an illustrative universal memory-safety adoption timeline proposing a realistic path to universal adoption given suitable incentivization. https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-995.pdf Batchelor, Henry University of Cambridge, Computer Laboratory 2024-07 ChaCha is a widely adopted stream cipher, used for both random number generation and encryption. I propose a factor graph of ChaCha to improve the success rate of side-channel attacks that provide leakages throughout the entire execution of the algorithm. I also assess (fragment) template attacks against several implementations of ChaCha to demonstrate that the factor graph is helpful when working with actual side-channel attacks. These attacks could fully recover the correct key from an 8-bit implementation. In contrast, a 32-bit implementation, with most of the state held in registers, was significantly more challenging to attack. An adversary with access to 10 power traces and an incremented counter could achieve a success rate of 14.6%. For a 32-bit implementation, with lots of SRAM activity, an attacker could successfully recover the key in 2.6% of cases from a single trace.