I am an assistant professor of Computer Science at ETH Zürich where I lead the SPY Lab. I am a Schmidt Sciences AI2050 Early Career Fellow.
My research interests lie in Computer Security, Machine Learning and Cryptography. In my current work, I study the worst-case behavior of Large Language Models from an adversarial perspective, to understand and mitigate long-term threats to the safety and privacy of users.
To learn more about our lab's work, see here or take a look at our blog.
My work has been featured in The Economist, Nature, Science, Communications of the ACM, Wired and the Swiss news (in french).
I received my PhD from Stanford University under the supervision of Dan Boneh. After graduating, I spent one year at Google Brain.
Email:
Office: Universitätstrasse 6, CAB F72, CH-8092 Zürich
Current group
- Avital Shafran (Postdoc)
- Carol Long (Postdoc)
- Mohammad Yaghini (Postdoc)
- Javier Rando (PhD Student -> Anthropic)
- Michael Aerni (PhD Student)
- Jie Zhang (PhD Student)
- Kristina Nikolić (PhD Student)
- Lukas Fluri (PhD Student)
- Pura Peetathawatchai (PhD Student)
- Sophie Ostmeier (PhD Student)
- Lennart Finke (PhD Student)
Alumni
- Edoardo Debenedetti (PhD Student -> Meta)
- Daniel Paleka (PhD Student -> METR)
News
- Congrats to Dr. Daniel Paleka, the second graduate of the SPY Lab, for a great thesis on evaluating language model forecasters! Daniel is joining METR.
- Edoardo's thesis on the security of AI systems was awarded an ETH Medal. Congrats Edoardo!
- I was named a Schmidt Sciences AI2050 Early Career Fellow, to build benchmarks that track how AI advances the capabilities of cyberattackers.
- Can't believe my very first AI security paper on model stealing attacks won the 2026 USENIX Security Test Of Time Award. Congrats to all my co-authors!
- The first PhD student of the SPY Lab has graduated! Congrats Dr. Edoardo Debenedetti for a wonderful thesis on the security of AI systems.
- I gave an impromptu Keynote at the Real World AI Security conference on "The Security Turing Test". I also posted a written version on our blog.
- I am co-chairing SaTML 2027 with Fabio Pierazzi. Submit your best work on secure and trustworthy machine learning!
Some of my recorded talks
The Security Turing Test (Real World AI Security Keynote, Stanford)
Cybersecurity in the Age of LLMs (IRISA 50th anniversary)
The Weird ChatGPT Hack That Leaked Training Data (Machine Learning Street Talk with Yannic Kilcher)
Making Machine Learning FAIL (my inaugural lecture)
Un-aligning large language models (EPFL Applied Machine Learning Days)
Measuring and Enhancing the Security of Machine Learning (my "job talk")
Adversarial Examples (Machine Learning Street Talk with Yannic Kilcher and Tim Scarfe)
Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware (ICLR)