Organisation

In this seminar, students will research one of the given topics (see below) to write a short seminar paper during the semester. At the end, they will present their paper to their peers and engage in discussions about the various topics.

The seminar aims to teach students in three aspects:

• Technical knowledge in various areas of security and privacy.
• Basic skills related to scientific research, paper writing and a scientific style.
• The basics of the scientific process, how conferences and peer reviews work.

Registration

Registration is done in ILIAS and will open soon. You can find the link on the top of this page. There will be a limited number of slots available, which will be distributed on a first-come-first-served basis.

Tentative Schedule

Topics

The following is a preliminary list of topics:

#1 The Tension Between Privacy and Fairness

Supervisor: Patricia Guerra Balboa

Differential Privacy (DP) has emerged as the mathematical gold standard for private data publishing and machine learning. By injecting controlled noise or clipping gradients (e.g., in DP-SGD), DP provides rigorous privacy guarantees against reconstruction and inference attacks. However, recent literature shows that "privacy is not free" when it comes to algorithmic fairness. The noise introduced by DP mechanisms often affects underrepresented groups or minority classes disproportionately, leading to a significant drop in accuracy for marginalized populations, unfair allocation of resources, or distorted statistical analyses.

In this seminar topic, the student will write a Systematization of Knowledge (SoK) paper examining the interactions between Differential Privacy and Fairness. Specifically, the student will investigate:

• The Core Conflicts: What are the fundamental trade-offs and mathematical impossibilities when simultaneously optimizing for privacy and fairness guarantees?
• Root Causes: Why does DP introduce disparate impact?.
• Proposed Solutions & Mitigations: What modern mechanisms or algorithmic adaptations exist to mitigate this disparity, and to what extent do they succeed?

Goal: Provide a structured taxonomy of the problem domain, map out current mitigation strategies, and identify open challenges in the field.

References:

• Fioretto, F., Tran, C., Van Hentenryck, P., & Zhu, T. (2022). Differential Privacy and Fairness in Decisions and Learning Tasks: A Survey. arXiv preprint arXiv:2202.08187.
• Bagdasaryan, E., Poursaeed, O., & Shmatikov, V. (2019). Differential Privacy Has Disparate Impact on Model Accuracy. NeurIPS 2019.
• Cummings, R., Ligett, K., Nissim, K., Roth, A., & Wu, Z. S. (2019). On the Compatibility of Differential Privacy and Fairness. FLAM 2019.

#2 Are MLLMs biometric recognition systems?

Supervisor: Simon Hanisch

Multimodal Large Language Models (MLLM) can generate realistic images as well as produce textual descriptions of the content of images, demonstrating that they have learned a certain "understanding" of scenes and their content. Due to these capabilities and recent research, it is reasonable to assume that MLLMs can also distinguish between persons based on biometric factors such as the face [0] or iris [1]. The question therefore arises: Are MLLMs also biometric recognition systems? If so, this would in turn imply that they have been trained using biometric data, a particularly sensitive category of data whose processing is generally prohibited under Article 9 [2] of the GDPR. This raises important legal questions regarding the lawfulness of such training practices, especially since biometric data is often collected at scale from publicly available sources such as the internet, typically without the explicit consent of the data subjects. Whether the providers of MLLMs are even aware of this issue, or whether biometric capabilities emerge merely as a byproduct of training on general image data, remains an open question. The goal of this seminar topic is to do a literature survey that seeks to answer the question if MLLMs are biometric recognition systems or not.

References:

0. How Good Is ChatGPT at Face Biometrics? A First Look Into Recognition, Soft Biometrics, and Explainability, https://ieeexplore.ieee.org/abstract/document/10445251
1. Benchmarking Foundation Models for Zero-Shot Biometric Tasks, https://arxiv.org/pdf/2505.24214
2. https://gdpr-info.eu/art-9-gdpr/

#3 Survey of XAI Techniques for Identifying Facial Identity Regions

Supervisor: Islam Amar

The project aims to survey, analyze, and compare existing Explainable Artificial Intelligence (XAI) techniques to identify facial regions that contribute most significantly to identity recognition. Understanding these identity-relevant regions is important for developing effective facial anonymization methods that hide, distort, or remove identifying information.

Goal: The goal of this project is to survey and analyze existing XAI methods to identify identity-relevant facial regions and draw conclusions about their effectiveness and applicability.

#4 Stick To Your Guards?

Supervisor: Daniel Schadt

Tor is a network which allows users to hide communication metadata by relaying traffic over multiple intermediate nodes. The first nodes (the guards) are generally kept fixed for as long as possible to avoid an adversary getting traffic samples from every user eventually [1]. However, work has also been done to "split" traffic across multiple circuits (and guards) in order to improve performance [2], which might also weaken correlation attacks [3]. This gives two oppositional approaches, "pick one guard and stick with it" and "split traffic across many guards".

In this seminar, you will dive deeper into this topic to answer the following questions:

• What are the arguments for/against guard hopping?
• What is currently practiced in the Tor implementation?
• What are the assumptions underlying the model in [1], and how can the model be generalized to other (more realistic?) scenarios?
• How does this relate to strategies in other networks, like Mixminion [4] or Nym [5]?

References:

1. https://spec.torproject.org/guard-spec/index.html
2. https://spec.torproject.org/proposals/329-traffic-splitting.html
3. https://deic.uab.cat/dpm/dpm2026/resources/dpm2026-slides/2.afternoon-1/5.Mitseva.pdf
4. https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=1199323
5. https://nym.com/nym-whitepaper.pdf

#5 Differentially Private Top-k Selection

Supervisor: Àlex Miranda Pascual

Often, it is necessary to determine the most popular option from a large pool of candidates. For instance, this enables us to determine a group's favorite films, the most popular restaurant menu item, and the areas with the highest disease prevalence. However, revealing such information could expose the users who selected these films or dishes, or reveal who suffers from the disease. Therefore, there is a need to select the top-k elements from a set of possibilities in a private manner.

Differential privacy (DP) has become the de facto mathematical standard for privacy-preserving data analysis. In particular, the problem of top-k selection has been extensively addressed in the context of differential privacy. In this seminar, you will survey different DP top-k selection proposals and answer questions such as how the proposals relate in terms of privacy and utility and which ones work best.

References: Some DP top-k selection mechanisms: Sparse vector technique [1,2], peeling [3,5], and one-shot [4,5]. Chapters 1-3 contain some introduction to data privacy and to differential privacy [6].

1. M. Lyu, D. Su, and N. Li, “Understanding the sparse vector technique for differential privacy,” Proc. VLDB Endow., vol. 10, no. 6, pp. 637–648, Feb. 2017, doi: 10.14778/3055330.3055331.
2. Y. Liu, S. Wang, Y. Liu, F. Li, and H. Chen, “Unleash the power of ellipsis: Accuracy-enhanced sparse vector technique with exponential noise,” Proc. VLDB Endow., vol. 18, no. 2, pp. 187–199, Oct. 2024, doi: 10.14778/3705829.3705838.
3. D. Durfee and R. Rogers, “Practical differentially private topk selection with pay-what-you-get composition,” Proc. Int. Conf. Neural Infor. Process. Syst., pp. 3532–3542, 2019.
4. G. Qiao, W. Su, and L. Zhang, “Oneshot differentially private top-k selection”, Proc. Int. Conf. Machine Learn., volume 139 of PMLR, pp. 8672–8681, 18–24 Jul 2021.
5. M. Shekelyan and G. Loukides, “Differentially private top-k selection via canonical Lipschitz mechanism,” Jan. 31, 2022, arXiv: arXiv:2201.13376. doi: 10.48550/arXiv.2201.13376.
6. C. Dwork and A. Roth, “The algorithmic foundations of differential privacy,” Found. Trends Theor. Comput. Sci., vol. 9, no. 3–4, pp. 211–407, Agosto 2014, doi: 10.1561/0400000042.

#6 Deep-Dive: Evolution of the SecureDrop Protocol

Supervisor: Christoph Coijanovic

SecureDrop [1] is a system that enables whistleblowers to contact news organisations securely and anonymously. Since its initial deployment in 2013, it has been widely adopted by major news organisations, including The New York Times, The Guardian, Al Jazeera and Der Spiegel. Guided by academic research and real-world feedback, the SecureDrop protocol has undergone significant updates since its inception (see, for example, [2, 3, 4]).

This seminar topic aims to identify and compare the major versions of the SecureDrop protocol. The comparison should cover changes in...

• adversary assumptions and threat model
• provided security and privacy guarantees
• deployment model and usability.

References:

1. https://securedrop.org/
2. https://academiccommons.columbia.edu/doi/10.7916/D84178B2
3. https://securedrop.org/news/introducing-securedrop-protocol/
4. https://eprint.iacr.org/2026/1484.pdf

#7 Privacy Threats of Location Data

Supervisor: Felix Morsbach

The widespread collection and processing of location traces—such as GPS trajectories—pose significant privacy risks, as they can reveal sensitive details about individuals' movements, behaviors, and lifestyles. While location data is often anonymized or aggregated, studies have shown that re-identification and tracking are still feasible. Existing research primarily focuses on specific use cases or datasets, leaving a broader understanding of the full spectrum of privacy threats and harms incomplete.

This project aims to:

a) Research and categorize the privacy threats and harms associated with processing location traces, including re-identification, tracking, and unintended inferences (e.g., health, habits, or home/work locations).

b) Research and categorize concrete attacks focused on these threats and identify gaps in the literature based upon the findings.

By systematically analyzing these threats, the project seeks to provide a clearer understanding of the privacy implications of location trace processing and guide the development of more robust protections.

References:

• Gambs, S., Killijian, M.-O., & del Prado Cortez, M. N. (2010). Show me how you move and I will tell you who you are. Proceedings of the 3rd ACM SIGSPATIAL International Workshop on Security and Privacy in GIS and LBS. https://doi.org/10.1145/1868470.1868479
• Sui, K., Zhao, Y., Liu, D., Ma, M., Xu, L., Zimu, L., & Pei, D. (2016). Your trajectory privacy can be breached even if you walk in groups. 2016 IEEE/ACM 24th International Symposium on Quality of Service (IWQoS). https://doi.org/10.1109/IWQoS.2016.7590444