Organisation

In this seminar, students will research one of the given topics (see below) to write a short seminar paper during the semester. At the end, they will present their paper to their peers and engage in discussions about the various topics.

The seminar aims to teach students in three aspects:

• Technical knowledge in various areas of security and privacy.
• Basic skills related to scientific research, paper writing and a scientific style.
• The basics of the scientific process, how conferences and peer reviews work.

Registration

Registration is done in ILIAS and will open soon. You can find the link on the top of this page. There will be a limited number of slots available, which will be distributed on a first-come-first-served basis.

Tentative Schedule

Topics

The following is a preliminary list of topics:

#1 The Tension Between Privacy and Fairness

Supervisor: Patricia Guerra Balboa

Differential Privacy (DP) has emerged as the mathematical gold standard for private data publishing and machine learning. By injecting controlled noise or clipping gradients (e.g., in DP-SGD), DP provides rigorous privacy guarantees against reconstruction and inference attacks. However, recent literature shows that "privacy is not free" when it comes to algorithmic fairness. The noise introduced by DP mechanisms often affects underrepresented groups or minority classes disproportionately, leading to a significant drop in accuracy for marginalized populations, unfair allocation of resources, or distorted statistical analyses.

In this seminar topic, the student will write a Systematization of Knowledge (SoK) paper examining the interactions between Differential Privacy and Fairness. Specifically, the student will investigate:

• The Core Conflicts: What are the fundamental trade-offs and mathematical impossibilities when simultaneously optimizing for privacy and fairness guarantees?
• Root Causes: Why does DP introduce disparate impact?.
• Proposed Solutions & Mitigations: What modern mechanisms or algorithmic adaptations exist to mitigate this disparity, and to what extent do they succeed?

Goal: Provide a structured taxonomy of the problem domain, map out current mitigation strategies, and identify open challenges in the field.

References:

• Fioretto, F., Tran, C., Van Hentenryck, P., & Zhu, T. (2022). Differential Privacy and Fairness in Decisions and Learning Tasks: A Survey. arXiv preprint arXiv:2202.08187.
• Bagdasaryan, E., Poursaeed, O., & Shmatikov, V. (2019). Differential Privacy Has Disparate Impact on Model Accuracy. NeurIPS 2019.
• Cummings, R., Ligett, K., Nissim, K., Roth, A., & Wu, Z. S. (2019). On the Compatibility of Differential Privacy and Fairness. FLAM 2019.

#2 Are MLLMs biometric recognition systems?

Supervisor: Simon Hanisch

Multimodal Large Language Models (MLLM) can generate realistic images as well as produce textual descriptions of the content of images, demonstrating that they have learned a certain "understanding" of scenes and their content. Due to these capabilities and recent research, it is reasonable to assume that MLLMs can also distinguish between persons based on biometric factors such as the face [0] or iris [1]. The question therefore arises: Are MLLMs also biometric recognition systems? If so, this would in turn imply that they have been trained using biometric data, a particularly sensitive category of data whose processing is generally prohibited under Article 9 [2] of the GDPR. This raises important legal questions regarding the lawfulness of such training practices, especially since biometric data is often collected at scale from publicly available sources such as the internet, typically without the explicit consent of the data subjects. Whether the providers of MLLMs are even aware of this issue, or whether biometric capabilities emerge merely as a byproduct of training on general image data, remains an open question. The goal of this seminar topic is to do a literature survey that seeks to answer the question if MLLMs are biometric recognition systems or not.

References:

0. How Good Is ChatGPT at Face Biometrics? A First Look Into Recognition, Soft Biometrics, and Explainability, https://ieeexplore.ieee.org/abstract/document/10445251
1. Benchmarking Foundation Models for Zero-Shot Biometric Tasks, https://arxiv.org/pdf/2505.24214
2. https://gdpr-info.eu/art-9-gdpr/

#3 Survey of XAI Techniques for Identifying Facial Identity Regions

Supervisor: Islam Amar

The project aims to survey, analyze, and compare existing Explainable Artificial Intelligence (XAI) techniques to identify facial regions that contribute most significantly to identity recognition. Understanding these identity-relevant regions is important for developing effective facial anonymization methods that hide, distort, or remove identifying information.

Goal: The goal of this project is to survey and analyze existing XAI methods to identify identity-relevant facial regions and draw conclusions about their effectiveness and applicability.

#4 Stick To Your Guards?

Supervisor: Daniel Schadt

Tor is a network which allows users to hide communication metadata by relaying traffic over multiple intermediate nodes. The first nodes (the guards) are generally kept fixed for as long as possible to avoid an adversary getting traffic samples from every user eventually [1]. However, work has also been done to "split" traffic across multiple circuits (and guards) in order to improve performance [2], which might also weaken correlation attacks [3]. This gives two oppositional approaches, "pick one guard and stick with it" and "split traffic across many guards".

In this seminar, you will dive deeper into this topic to answer the following questions:

• What are the arguments for/against guard hopping?
• What is currently practiced in the Tor implementation?
• What are the assumptions underlying the model in [1], and how can the model be generalized to other (more realistic?) scenarios?
• How does this relate to strategies in other networks, like Mixminion [4] or Nym [5]?

References:

1. https://spec.torproject.org/guard-spec/index.html
2. https://spec.torproject.org/proposals/329-traffic-splitting.html
3. https://deic.uab.cat/dpm/dpm2026/resources/dpm2026-slides/2.afternoon-1/5.Mitseva.pdf
4. https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=1199323
5. https://nym.com/nym-whitepaper.pdf

#5 Differentially Private Top-k Selection

Supervisor: Àlex Miranda Pascual

Often, it is necessary to determine the most popular option from a large pool of candidates. For instance, this enables us to determine a group's favorite films, the most popular restaurant menu item, and the areas with the highest disease prevalence. However, revealing such information could expose the users who selected these films or dishes, or reveal who suffers from the disease. Therefore, there is a need to select the top-k elements from a set of possibilities in a private manner.

Differential privacy (DP) has become the de facto mathematical standard for privacy-preserving data analysis. In particular, the problem of top-k selection has been extensively addressed in the context of differential privacy. In this seminar, you will survey different DP top-k selection proposals and answer questions such as how the proposals relate in terms of privacy and utility and which ones work best.

References: Some DP top-k selection mechanisms: Sparse vector technique [1,2], peeling [3,5], and one-shot [4,5]. Chapters 1-3 contain some introduction to data privacy and to differential privacy [6].

1. M. Lyu, D. Su, and N. Li, “Understanding the sparse vector technique for differential privacy,” Proc. VLDB Endow., vol. 10, no. 6, pp. 637–648, Feb. 2017, doi: 10.14778/3055330.3055331.
2. Y. Liu, S. Wang, Y. Liu, F. Li, and H. Chen, “Unleash the power of ellipsis: Accuracy-enhanced sparse vector technique with exponential noise,” Proc. VLDB Endow., vol. 18, no. 2, pp. 187–199, Oct. 2024, doi: 10.14778/3705829.3705838.
3. D. Durfee and R. Rogers, “Practical differentially private topk selection with pay-what-you-get composition,” Proc. Int. Conf. Neural Infor. Process. Syst., pp. 3532–3542, 2019.
4. G. Qiao, W. Su, and L. Zhang, “Oneshot differentially private top-k selection”, Proc. Int. Conf. Machine Learn., volume 139 of PMLR, pp. 8672–8681, 18–24 Jul 2021.
5. M. Shekelyan and G. Loukides, “Differentially private top-k selection via canonical Lipschitz mechanism,” Jan. 31, 2022, arXiv: arXiv:2201.13376. doi: 10.48550/arXiv.2201.13376.
6. C. Dwork and A. Roth, “The algorithmic foundations of differential privacy,” Found. Trends Theor. Comput. Sci., vol. 9, no. 3–4, pp. 211–407, Agosto 2014, doi: 10.1561/0400000042.

#6 Deep-Dive: Evolution of the SecureDrop Protocol

Supervisor: Christoph Coijanovic

SecureDrop [1] is a system that enables whistleblowers to contact news organisations securely and anonymously. Since its initial deployment in 2013, it has been widely adopted by major news organisations, including The New York Times, The Guardian, Al Jazeera and Der Spiegel. Guided by academic research and real-world feedback, the SecureDrop protocol has undergone significant updates since its inception (see, for example, [2, 3, 4]).

This seminar topic aims to identify and compare the major versions of the SecureDrop protocol. The comparison should cover changes in...

• adversary assumptions and threat model
• provided security and privacy guarantees
• deployment model and usability.

References:

1. https://securedrop.org/
2. https://academiccommons.columbia.edu/doi/10.7916/D84178B2
3. https://securedrop.org/news/introducing-securedrop-protocol/
4. https://eprint.iacr.org/2026/1484.pdf

#7 Privacy Threats of Location Data

Supervisor: Felix Morsbach

The widespread collection and processing of location traces—such as GPS trajectories—pose significant privacy risks, as they can reveal sensitive details about individuals' movements, behaviors, and lifestyles. While location data is often anonymized or aggregated, studies have shown that re-identification and tracking are still feasible. Existing research primarily focuses on specific use cases or datasets, leaving a broader understanding of the full spectrum of privacy threats and harms incomplete.

This project aims to:

a) Research and categorize the privacy threats and harms associated with processing location traces, including re-identification, tracking, and unintended inferences (e.g., health, habits, or home/work locations).

b) Research and categorize concrete attacks focused on these threats and identify gaps in the literature based upon the findings.

By systematically analyzing these threats, the project seeks to provide a clearer understanding of the privacy implications of location trace processing and guide the development of more robust protections.

References:

• Gambs, S., Killijian, M.-O., & del Prado Cortez, M. N. (2010). Show me how you move and I will tell you who you are. Proceedings of the 3rd ACM SIGSPATIAL International Workshop on Security and Privacy in GIS and LBS. https://doi.org/10.1145/1868470.1868479
• Sui, K., Zhao, Y., Liu, D., Ma, M., Xu, L., Zimu, L., & Pei, D. (2016). Your trajectory privacy can be breached even if you walk in groups. 2016 IEEE/ACM 24th International Symposium on Quality of Service (IWQoS). https://doi.org/10.1109/IWQoS.2016.7590444

#8 Technical Expert Opinion

Supervisor: Schlomi Hod

From policy changes to technical evidence: developing an independent expert opinion on privacy and security.

Social media platforms and AI providers regularly change their terms of service, privacy policies, and usage rules. These changes often make claims about what happens to users’ data, how AI systems are trained, what information can be inferred, or how generated content can be identified. But what do these statements actually mean from a technical perspective? What would a system need to do for them to hold, and what can research tell us about whether they are effective?

In this track, you investigate real policy changes documented by Terms Watch and connect them to the technical literature on privacy, security, and AI. Starting from a set of related changes, you identify an overarching research question, critically examine the state of the art, and develop your own evidence-based expert opinion.

The goal is not simply to describe what companies have changed or summarise existing research. It is to evaluate what the technical evidence allows us to conclude about the implications, effectiveness, and limitations of these changes. Your final report should take a clear position, explain the reasoning behind it, and distinguish established findings from open questions and claims that cannot be independently verified.

The track combines real-world developments with academic research. You begin with policies that have actually changed, use the literature to understand the underlying technical mechanisms, and bring both together in a reasoned assessment. The result is a technical expert opinion that goes beyond description to answer a specific research question.

Subtopics

The track offers several starting points for exploring current privacy and security questions. You may choose one of the themes below or propose another topic grounded in the policy changes you discover. In every case, the objective is to connect real-world developments to technical research and use that research to answer a concrete question.

1. Privacy of AI Training Data

When does removing identifying information actually protect users?

AI providers may use conversations and other user interactions to improve their models, while offering privacy protections such as de-identification and options to opt out. But what do these protections achieve in practice? How effectively can identifying information be removed, and what happens when data is retained for feedback or safety review?

Explore research on de-identification, re-identification, memorisation, and privacy-preserving machine learning to assess what these policies can—and cannot—guarantee.

2. Inferred Attributes and Profiling

What can platforms learn about us without us telling them?

Platforms can infer characteristics such as age, gender, interests, or behaviour from seemingly ordinary data. These inferences may shape advertising, recommendations, and other decisions, even when users never explicitly disclose the relevant information.

Investigate how accurately sensitive or personal attributes can be inferred, which signals enable these inferences, and how reliably they can be prevented. Examine the technical distinction between information users provide and information systems derive about them.

3. Scraping: Who Gets to Collect Platform Data?

If information is publicly accessible, how easy is it to collect—and what can be done with it?

Social media platforms and other online services increasingly restrict automated data collection, while AI developers rely on large datasets to build and improve their systems. The resulting policies raise technical questions about how scraping works, how restrictions are enforced, and how effective those restrictions are against determined collectors.

Explore web crawling, automated access detection, anti-scraping mechanisms, and the technical limits of controlling data collection. Consider what happens when access restrictions are introduced on platforms whose content has already been copied or archived.

4. Model Extraction and Distillation

Can a model's capabilities be copied simply by interacting with it?

AI providers may restrict the use of their models to train competing systems, yet a sufficiently large collection of model outputs can sometimes help reproduce aspects of a model's behaviour. Distillation can also be a legitimate technique for creating smaller, more efficient models, making the distinction between permitted and prohibited uses technically challenging.

Investigate model extraction, knowledge distillation, and black-box attacks. How much can an external party learn through queries? Which defences are effective, and what can providers realistically distinguish between ordinary use and attempts to reproduce a model?

5. Watermarking, Provenance, and AI-Generated Content

Can we reliably tell whether digital content was generated by AI?

As AI-generated text, images, audio, and video become increasingly common, providers are exploring ways to mark generated content and establish its provenance. Such mechanisms face practical challenges: content can be edited, compressed, transformed, or redistributed, potentially weakening or removing identifying signals.

Explore watermarking techniques, provenance metadata, and AI-generated content detection. Assess their robustness, limitations, and suitability for different media and distribution settings. What can these techniques establish reliably, and where does uncertainty remain?

Seed papers:

• Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea & Colin Raffel (2021). Extracting Training Data from Large Language Models. USENIX Security 21, pp. 2633–2650. arXiv:2012.07805
• Katherine Lee, Daphne Ippolito, Andrew Nystrom, Chiyuan Zhang, Douglas Eck, Chris Callison-Burch & Nicholas Carlini (2022). Deduplicating Training Data Makes Language Models Better. ACL 2022, pp. 8424–8445. arXiv:2107.06499
• Florian Tramèr, Gautam Kamath & Nicholas Carlini (2024). Position: Considerations for Differentially Private Learning with Large-Scale Public Pretraining. ICML 2024, PMLR 235:48453–48467. arXiv:2212.06470
• Lucas Rosenblatt, Bin Han, Robert Wolfe & Bill Howe (2025). Fragments to Facts: Partial-Information Fragment Inference from LLMs. ICML 2025, PMLR 267:52041–52064. arXiv:2505.13819

#9—11 Security and privacy issues in 5G Radio Access Networks

Supervisor: Fritz Windisch

Currently used by billions of users [0], 5G is serving numerous different use-cases such as healthcare, robotics or industry. Therefore 5G was designed with more security and privacy in mind, especially on the higher layers, claiming stronger protection goals.

However, there are remaining security and privacy issues in the radio access network, as has been indicated by recent studies [1-4]. This topic is available with three different focus topics:

• #9: 5G-AKA: Survey on security and privacy attacks against the authentication and key agreement protocol in 5G [2].
• #10: Unencrypted layers: Deep dive into unencrypted, obtainable channels using passive sniffing (like resource scheduling or beamforming feedback), investigating potential risks associated with leaking these channels to attackers [3].
• #11: Traffic fingerprinting in mobile networks: Deep dive or survey into traffic fingerprinting in the context of LTE and 5G networks [4].

References:

0. Ericsson Mobility Report (June 2026)
1. M Chlosta et al.: 5G SUCI-catchers: still catching them all? - https://doi.org/10.1145/3448300.3467826
2. D Basin et al.: A Formal Analysis of 5G Authentication - https://dl.acm.org/doi/abs/10.1145/3243734.3243846
3. F Windisch et al.: 5GDescrambler: Locating, Descrambling, and Decoding 5G Scheduling Information - https://arxiv.org/abs/2609.07367
4. S Bae et al.: Watching the Watchers: Practical Video Identification Attack in LTE Networks - https://www.usenix.org/conference/usenixsecurity22/presentation/bae