Publications

Metronome: I/O-Efficient Logging for State Machine Replication

Under revision · In adoption talks with Neon

In state machine replicated systems, every replica writes to a persistent write-ahead log before committing, so that it can recover from a crash. Logging at every replica is both inefficient and unnecessary: tolerating f crash-stop failures requires only a majority (f + 1) of replicas to log persistently. With Metronome, we log only at a majority of replicas, improving both commit throughput and I/O efficiency.

Delta Fair Sharing: Performance Isolation for Multi-Tenant Storage Systems

Under submission

Traditional fair sharing does not work for storage systems, because storage resources have high preemption delays: a tenant’s tail latency keeps degrading until resources are preempted and the outstanding I/O flushes and fetches complete. With Delta Fair Sharing, we introduce a family of algorithms that guarantee δ-fairness, a new isolation property that bounds the tail-latency spike of well-behaved clients to δ time units.

Time is Here for Just-in-Time Systems: Challenges and Opportunities

There has always been a trade-off between general-purpose and specialized systems: in the past, the engineering effort to build a specialized system outweighed its benefits. We argue that LLMs and coding agents bring us to an inflection point, and that we can now synthesize a single-node key-value store just in time, for a specific workload and cost budget.

Rollbaccine: Herd Immunity against Storage Rollback Attacks in TEEs

In TEE-based systems, rollback attacks revert persisted state, causing execution over stale data. Existing rollback-resistant solutions are narrowly tailored, often requiring changes to the application or the system. We redefine rollback attacks as a crash-consistency problem: with Rollbaccine, we transparently enforce disk consistency, giving any application rollback resistance across multiple Linux file systems.

Supporting Our AI Overlords: Redesigning Data Systems to be Agent-First

With LLMs and coding agents, data systems will be unable to handle the volume of agentic speculation: the automated, high-speed exploration of candidate solutions across many tasks. We argue that data systems should be designed to be agent-first, to natively support these speculative workloads. We outline new research opportunities, from agentic memory stores to full agent-first data store architectures.

SkyStore: Cost-Optimized Object Storage Across Regions and Clouds

Best of VLDB’25 nomination

Object stores that are designed for a single cloud leave managing data transfers across clouds and regions, guided by their applications’ access patterns, to users themselves. We redefine this as a caching problem, though a unique one: capacity is effectively unlimited, and the cost budget must account for moving data across regions and clouds. With SkyStore, we show that a TTL-based policy can replicate and evict data while minimizing cost and latency.

Real Life Is Uncertain. Consensus Should Be Too!

Consensus protocols adopt a specific fault model, where up to f machines can fail. We argue that this f-threshold fault model oversimplifies the real world and limits potential opportunities to optimize for cost or performance. We argue instead for a probabilistic fault model that captures the nature of faults in practice. We outline the opportunities it unlocks, such as probability-native consensus protocols that provide realistic 9s of availability and durability guarantees.

Lost in Translation: The Search for Meaning in Network-Attached AI Accelerator Disaggregation

Datacenters leave expensive accelerators idle, and disaggregating them over the network is the obvious fix. What gets in the way is a semantic translation gap: as computation descends the software stack, the application knowledge that would make remote execution efficient, such as model structure and execution phases, is lost. We argue that the machine learning framework layer is the natural narrow waist, and present Genie, which defers execution to build a semantically rich graph and uses it to optimize the workload and move data without copies.

DINOMO: An Elastic, Scalable, High-Performance Key-Value Store for Disaggregated Persistent Memory

Disaggregated persistent memory lets compute and memory scale independently. However, caching at the compute nodes, to hide network latency, brings back the coherence overheads from sharing data. DINOMO partitions the ownership of keys across compute nodes and leaves the data itself shared in the memory pool: each node caches only what it owns, so there is no coherence traffic.

RainBlock: Faster Transaction Processing in Public Blockchains

Miners in Ethereum spend most of their time performing disk I/O: validating a transaction requires reading and updating the authenticated state on disk. With RainBlock, we decouple transaction execution from storage and move disk I/O out of the critical path. We use dedicated storage nodes that store the system state and send transactions along with their proofs, and we cache recently accessed state at the miners.

WineFS: Hugepage-Aware File System for PM that Ages Gracefully

Persistent memory file systems enable low-latency access from hugepages. However, as the file system ages, free space fragments and performance drops. WineFS keeps hugepages intact by segregating the allocations that fragment from those that do not, so that throughput does not visibly degrade over time.

Software-Defined Data Protection: Low Overhead Policy Compliance at the Storage Layer is Within Reach!

Regulations, such as GDPR, require systems to control who may read each record and when it must be erased, but that policy lives in application code today, far from the data and duplicated in every service that touches it. We argue that data protection belongs at the storage layer, and show that expressing policies declaratively and offloading their enforcement to programmable storage protects every client at almost no cost to throughput.

Finding Crash-Consistency Bugs with Bounded Black-Box Crash Testing

A file system must recover correctly from a crash at any point, and the space of possible crash states is far too large to test exhaustively. We bound the search instead: most crash-consistency bugs surface in short sequences of file-system operations, and only at the points where an application has explicitly persisted with fsync. Testing every sequence up to a few operations, and crashing after each persistence point, finds those bugs without exploring the whole space.

mLSM: Making Authenticated Storage Faster in Ethereum

Ethereum stores its authenticated state as a Merkle tree on top of a key-value store, storing each Merkle node as a value and its hash as the key. As a result, a single update rewrites a path of nodes and incurs significant write amplification. With mLSM, we argue for a data structure that merges the two layers, keeping the authentication a Merkle tree provides while writing like a log-structured merge tree.

Holographic Storage for the Cloud: Advances and Challenges

Holographic storage has long promised high density and fast random access, so in Project HSD we asked whether it finally makes sense for cloud storage. Using commodity optics, with machine learning correcting the noise they introduce, we reached 1.8 times the density of the previous state of the art and improved energy efficiency 14 times by optimizing media physics and background maintenance together. We conclude that it is still far from competing with hard drives and flash on density, capacity scaling, and energy efficiency.

CrashMonkey and ACE: Systematically Testing File-System Crash Consistency

This extends bounded black-box crash testing into a toolkit: ACE generates workloads exhaustively within a bound, and CrashMonkey replays them against a real file system and checks what survives a crash. Applied to widely used Linux file systems, it reproduces known crash-consistency bugs and uncovers new ones.

Token Latency Fairness: Performance Isolation for Multi-Tenant LLM Serving

Multi-tenant LLM serving equalizes throughput across clients over the long run, which still lets one high-demand client delay individual requests and stretch a well-behaved client’s token latencies by an order of magnitude. With FairInference, we define δ-token fairness instead: a token that takes d time units in isolation is produced within d + δ under multi-tenant execution. The scheduler enforces per-token deadlines while bounding the delays from GPU compute sharing and the shared KV cache.

SKYE: Write-Optimized Key-Value Store with Fine-Grained Control over Persistent Memory Accesses

Key-value stores on persistent memory let applications write to the device directly, which keeps latency low but gives up control: throughput collapses once too many threads write concurrently, and the best existing store reaches under half of a single NVDIMM’s write bandwidth. With SKYE, we make access indirect instead, so dedicated threads write on the application’s behalf and the store decides how data is placed across NVDIMMs and NUMA nodes, reaching about 86% of PM write bandwidth.