About me

This is Dr Ali Shahin Shamsabadi (ashahinshamsabadi@brave.com)! I am a Senior Research Scientist (now expanding into product strategy and cross-functional leadership too) at Brave Software. I collaborate across disciplines and organizations to turn scientific insights into innovative, impactful products. Before joining Brave Software, I was a Research Scientist at The Alan Turing Institute (Safe and Ethical AI) under the supervision of Adrian Weller, and a Postdoctoral Fellow at Vector Institute under the supervision of Nicolas Papernot. During my PhD, I was very fortunate to work under Aurélien Bellet, Andrea Cavallaro, Adria Gascon, Hamed Haddadi, Matt Kusner and Emmanuel Vincent.

Highlights

Contributed to shaping frontier AI governance. Co-author, Frontier AI Auditing: Toward Rigorous Third-Party Assessment of Safety and Security Practices at Leading AI Companies, a cross-institutional effort proposing AI Assurance Levels for independent verification of frontier AI developers’ safety and security claims, alongside co-authors including Yoshua Bengio, Miles Brundage and Adrian Weller.
Shipped verifiable privacy in Brave’s AI assistant, Leo. Confidential LLM inference in NVIDIA-backed Trusted Execution Environments (2025), followed by end-to-end encryption with Oblivious HTTP (2026), covered by The Register and Privacy Guides.
Shipped differentially private product analytics. Nebula brings formal differential privacy guarantees to Brave’s product usage analytics [CCS'2025].
Building secure agents in public. SafeHouse, our research proof of concept for structurally secure web agents, drives Brave Bot, an open-source coding agent with structural resistance to indirect prompt injection.
Recognition. ICLR'2024 spotlight, ICLR'2023 notable top 5%, Turing top 10 project of 2022-2023, NeurIPS'2025 Top Reviewer, and one of 200 young researchers selected for the 8th Heidelberg Laureate Forum.

Research

My research initiates a fundamental question: How can we reliably verify the trustworthiness of AI-based services, given that: i) AI-based services are provided as "black-boxes" to protect intellectual property; ii) Institutions are materially disincentivized from trustworthy behavior.

Secure, private and efficient AI agents

Agent privacy: SPILLage: Agentic Oversharing on the Web [arXiv'2026], Privacy Practices of Browser Agents [arXiv'2025]
Agent security: SafeHouse, structurally secure web agents and the research driver behind Brave Bot [open source]
Agent efficiency: AgentStop [CAIS'2026]

Verifiable Trustworthiness of AI in Practice

Verifiable governance: Frontier AI Auditing [arXiv'2026]
Verifiable alignment: SURE: SecUrely REpairs failures flagged by users [NeurIPS'2025]
Verifiable Uncertainty: Confidential Guardian [ICML'2025]
Verifiable Privacy: Confidential-DPproof [ICLR'2024]
Verifiable Fairness: Confidential-PROFITT [ICLR'2023], OATH [NeurIPS'2025]
Architecture-Independent Model Distances [ICLR'2022]

Identifying failure modes for AI systems

Privacy Attacks: Context-Aware MIAs against Pre-trained LLMs [EMNLP'2025], Membership and Memorization in LLM Knowledge Distillation [EMNLP'2025], Locating Model Parameters that Memorize Training Examples [UAI'2023], Trap weights [Euro S&P'2023]
Fairness Attacks: Fairwashing [NeurIPS'2022]
Robustness Attacks: ColorFool [CVPR'2020], Mystique [USENIX'2022], EdgeFool [ICASSP'2020], FilterFool [TIP'2022], and FoolHD [ICASSP'2021]

Secure and privacy-preserving (by design) AI

Privacy-preserving: Distributed and Private Textual Data Synthesis from Embeddings [PETS'2027], A Loss for Differentially Private Deep Learning [PETS'2023], Differentially Private Speaker Anonymization [PETS'2023], Differentially Private Graph Neural Networks [USENIX'2022], Deep Private-Feature Extraction
Secure: Two-Party Secure Neural Network Training and Prediction [CCS'2019], Model Privacy at the Edge using Trusted Execution Environments [MobiSys'2020], From Local to Distributed Private Training and Prediction [TIFS'2020]

Product

Verifiable Privacy and Transparency in AI assistants

Verifiable Privacy and Transparency: A new frontier for Brave AI privacy: Confidential LLM Computing on NEAR AI NVIDIA-backed Trusted Execution Environments to offer cryptographically-verifiable privacy and transparency. Users must be able to verify that Chatbot’s privacy guarantees match public privacy promises. Users must be able to verify that Chatbot’s responses are, in fact, coming from a machine learning model the user expects (or pays for). These user-first features are available in Brave browser’s integrated AI assistant, Leo.
Leo adds End-to-end Encryption, Oblivious HTTP, and Verifiable Confidential Computing: Leo chats with the open-weight GLM 5.3 Flash model are now end-to-end encrypted. The Brave browser encrypts each prompt on the user’s device with Oblivious HTTP (OHTTP), so only an attested, Nvidia-backed Trusted Execution Environment can decrypt it and run confidential LLM inference. Prompts are routed through Brave’s open-source AI Gateway, which hides the user’s IP address from the AI provider, and hardware-enforced isolation protects prompts and responses even from Brave and NEAR AI.
Coverage: The Register, CyberInsider, Thurrott, StartupHub.ai, Windows Forum, Goodtech, Quest Review Center, TechnoBezz, CryptoNews and TokenPost.

Privacy Preserving Product Analytics

Nebula: a novel, practical and best-in-class system for product usage analytics with differential privacy guarantees! Nebula puts users first in product analytics: i) Formal Differential Privacy Protection; ii) Auditability, Verifiability, and Transparency; and iii) Efficiency with Minimal Impact.

Privacy risks of Agents on the Web

SPILLage: Agentic Oversharing on the Web. How effectively do web agents preserve and respect user privacy expectations when acting on users’ behalf across live websites? Agents naturally overshare, making them much more public about what users expect to be private.
Privacy Practices of Browser Agents: presents a systematic evaluation of the privacy behaviors and attributes of web agents: i) vulnerabilities in the browser agent’s components, ii) how the browser agent protects against website behaviors; iii) whether the browser agent prevents cross-site tracking; iv) how the agent responds to privacy-affecting prompts; and v) whether the tool leaks personal information to sites.

Secure Agents

BraveGuard: provides the best possible protection against indirect prompt injections via a hybrid approach combining an alignment checker with a security-aware system prompt.
Brave Bot: a general-purpose coding agent with structural resistance to indirect prompt injection, designed and built in public as open source. Before data is processed, it is labelled as trusted or untrusted and as public or private; untrusted content is only ever handled by tool-less processors and never enters the planner’s context, so a web page cannot redirect an agent working on the user’s behalf. Its research driver and proof of concept is SafeHouse, our open-source work on structurally secure web agents.

Efficient Agents

AgentStop: a lightweight efficiency supervisor that predicts and preemptively terminates local AI agent trajectories unlikely to succeed, reducing wasted energy on consumer devices by 15-20% with minimal impact on task performance.

Blog Posts and Press

My work has been cited in the press including Thurrott, TuringTop10, The Register, Privacy Guides, StartupHub.ai and Cyber Insider.

Recent Students

Hyejun Jeong: Brave PhD Intern (Summer 2026), Project: Securing the web environment for agents
Jaechul Roh: Brave PhD Intern (Summer 2025), Project: SPILLAGE: Agentic Oversharing on the Web
Dzung V. Pham: Brave PhD Intern (Summer 2025), Project: AgentStop: Terminating Local AI Agents Early to Save Energy in Consumer Devices
Alisha Ukani: Brave PhD Intern (Summer 2025), Project: Privacy Practices of Browser Agents
Saiid El Hajj Chehade: Brave PhD Visitor (Summer 2025), Project: Optimizing web presentation for agents
Hongyan Chang: Brave PhD Intern (Summer 2024), Project: Context-Aware Membership Inference Attacks against Pre-trained Large Language Models
Olive Franzese: Brave PhD Intern (Summer 2024), Project: OATH: Efficient and Flexible Zero-Knowledge Proofs of End-to-End ML Fairness
Victoria Smith: Alan Turing Institute PhD Enrichment Student (Fall 2022 - Fall 2023), Project: Identifying and Mitigating Privacy Risks Stemming from Language Models: A Survey

News

[October 2026] Designing and building in public: Brave Bot, an open-source coding agent with structural resistance to indirect prompt injection.
[October 2026] Launched Another Brave User-First AI Win: Leo adds End-to-end Encryption, Oblivious HTTP, and Verifiable Confidential Computing.
[August 2026] Paper accepted at the 27th Privacy Enhancing Technologies Symposium PETS2027, called Distributed and Private Textual Data Synthesis from Embeddings.
[May 2026] Paper accepted at the ACM Conference on AI and Agentic Systems CAIS2026, called AgentStop: Terminating Local AI Agents Early to Save Energy in Consumer Devices.
[December 2025] A new preprint in the intersection of web agents and privacy: Privacy Practices of Browser Agents.
[November 2025] Launched Verifiable Privacy and Transparency: A new frontier for Brave AI privacy.
[September 2025] Two papers accepted at The Thirty-Ninth Annual Conference on Neural Information Processing Systems NeurIPS 2025, called Pin the Tail on the Model: Blindfolded Repair of User-Flagged Failures in Text-to-Image Services and Secure and Confidential Certificates of Online Fairness.
[August 2025] Two papers accepted at the conference on Empirical Methods in Natural Language Processing EMNLP 2025, called Membership and Memorization in LLM Knowledge Distillation and Context-Aware Membership Inference Attacks against Pre-trained Large Language Models.
[May 2025] Paper accepted at the 32nd ACM Conference on Computer and Communications Security CCS2025, called Nebula: Efficient, Private and Accurate Histogram Estimation.
[April 2025] Paper accepted at the 42nd International Conference on Machine Learning ICML2025, called Confidential Guardian: Cryptographically Prohibiting the Abuse of Model Abstention.
[November 2024] Gave a guest lecture at Imperial College London: Collecting Speech and Telemetry Data Privately.
[October 2024] Gave a research talk at Google TechTalk: Beyond Trust: Proving Fairness and Privacy in Machine Learning.
[September 2024] A new preprint on LLMs and privacy, called Context-Aware Membership Inference Attacks against Pre-trained Large Language Models.
[September 2024] My first-ever privacy-preserving product, Differentially private data collection.
[September 2024] A new preprint on differential privacy and telemetry data, called Nebula: Efficient, Private and Accurate Histogram Estimation.
[January 2024] Paper accepted at the 12th International Conference on Learning Representations ICLR2024, called Confidential-DPproof: Confidential Proof of Differentially Private Training. spotlight

Older news

[September 2023] A new preprint on LLMs and privacy, called Identifying and Mitigating Privacy Risks Stemming from Language Models: A Survey.
[July 2023] Received Best Reviewers Free Registration award from FL@ICML!
[July 2023] Our project Confidential-PROFITT: Confidential PROof of FaIr Training of Trees is selected as Turing's top 10 projects of 2022-2023, see Pioneering New Approaches to Verifying the Fairness of AI Models!
[July 2023] Presented 2 papers at PETS2023: Differentially Private Speaker Anonymization and Losing Less: A Loss for Differentially Private Deep Learning!
[July 2023] Started as a Privacy Researcher at Brave Software!
[May 2023] Paper accepted at the 39th Conference on Uncertainty in Artificial Intelligence UAI, called Mnemonist: Locating Model Parameters that Memorize Training Examples.
[March 2023] Paper accepted at the 23rd Privacy Enhancing Technologies symposium PETs, called Losing Less: A Loss for Differentially Private Deep Learning.
[March 2023] Organising AI UK 2023 workshop, Privacy and Fairness in AI for Health.
[January 2023] Paper accepted at the 11th International Conference on Learning Representations ICLR, called Confidential-PROFITT: Confidential PROof of FaIr Training of Trees. notable top 5% of accepted papers
[November 2022] 2 papers accepted at the 32nd USENIX Security Symposium, called GAP: Differentially Private Graph Neural Networks with Aggregation Perturbation and Tubes Among US: Analog Attack on Automatic Speaker Identification.
[November 2022] Co-organizing the Privacy Preserving Machine Learning PPML'2022 workshop co-located with FOCS'2022.
[September 2022] Paper accepted at the 36th Conference on Neural Information Processing Systems NeurIPS, called Washing The Unwashable: On The (Im)possibility of Fairwashing Detection, Code.
[September 2022] 2 papers accepted at the 23rd Privacy Enhancing Technologies symposium PETs, called Differentially Private Speaker Anonymization and Private Multi-Winner Voting for Machine Learning.
[August 2022] Chair and organise Olya Ohrimenko in-person talk at Turing AI Programme.
[July 2022] Chair and organise Nicolas Papernot in-person talk at Turing AI Programme.
[January 2022] Paper accepted at the 10th International Conference on Learning Representations ICLR, called A Zest of LIME: Towards Architecture-Independent Model Distances, Code.
[December 2021] A new preprint on federated learning privacy attack, called When the Curious Abandon Honesty: Federated Learning Is Not Private.
[November 2021] Started as a Research Associate at The Alan Turing Institute under supervision of Adrian Weller.
[August 2021] Paper accepted at IEEE Transactions on Image Processing TIP, called Semantically Adversarial Learnable Filters, Code!
[March 2021] Successfully passed PhD viva!
[February 2021] Started as a Postdoctoral Fellow at Vector Institute under supervision of Nicolas Papernot.
[January 2021] Paper accepted at 46th International Conference on Acoustics, Speech, and Signal Processing, ICASSP2021, called FoolHD: Fooling speaker identification by Highly imperceptible adversarial Disturbances, Code! (acceptance rate 19%)
[October 2020] Giving a tutorial at ACM Multimedia 2020 conference, Part2: adversarial images.
[September 2020] Offered an internship at Inria, under supervision of Aurelien Bellet.
[April 2020] Selected as 200 young researchers from all over the world for 8th HEIDELBERG LAUREATE FORUM by international experts appointed by award-granting institutions: The Association for Computing Machinery (ACM), the Norwegian Academy of Science and Letters (DNVA) and the International Mathematical Union (IMU)!
[March 2020] Paper accepted at IEEE Transactions on Information Forensics and Security TIFS, called PrivEdge: From Local to Distributed Private Training and Prediction, Code! (impact factor 6.2)
[March 2020] Paper accepted at IEEE Transactions on Multimedia TMM, called Exploiting Vulnerabilities of Deep Neural Networks for Privacy Protection, Code! (impact factor 5.5)
[March 2020] Paper accepted at ACM International Conference on Mobile Systems, Applications, and Services MobiSys, called DarkneTZ: Towards Model Privacy on the Edge using Trusted Execution Environments, Code! (acceptance rate 19%)
[Feb 2020] Paper accepted at Conference on Computer Vision and Pattern Recognition, CVPR2020, called ColorFool: Semantic Adversarial Colorization, Video, Code! (acceptance rate 22%)
[Jan 2020] Paper accepted at 45th International Conference on Acoustics, Speech, and Signal Processing, ICASSP2020, called EdgeFool: An Adversarial Image Enhancement Filter, Video, Code! (acceptance rate 19%)
[Jan 2020] Paper accepted at IEEE Internet of Things Journal called A Hybrid Deep Learning Architecture for Privacy-Preserving Mobile Analytics! (impact factor 9.5)
[April 2019] Paper accepted at 26th ACM Conference on Computer and Communications Security, CCS2019, called QUOTIENT: Two-Party Secure Neural Network Training and Prediction! (acceptance rate 16%)
[Jan 2019] Paper accepted at 44th International Conference on Acoustics, Speech, and Signal Processing, ICASSP2019, called Scene privacy protection, Code! (acceptance rate 49%)
[June 2018] Offered a PhD Enrichment scheme, a 9-month placement at The Alan Turing Institute!
[March 2018] Offered an internship for summer 2018 at The Alan Turing Institute, working on project Privacy-aware neural network classification & training under supervision of Adria Gascon, Matt Kusner, Varun Kanade!

PC services

2025: ICLR'2025, NeurIPS'2025 (Top Reviewer)
2024: PETs'2024, ICLR'2024, ICLR Private ML workshop
2023: NeurIPS'2023, CCS'2023, AISTATS'2023, ICML 2023 workshop federated learning
2022: ICML'2022, TIFS'2022, TOPS'2022, Explainable AI in Finance
2021: ICLR'2021 Security and Safety in Machine Learning Systems, ICCV'2021 Adversarial Robustness In the Real World
2020: ECCV'2020 Adversarial Robustness in the Real World, 42nd IEEE Symposium on Security and Privacy

Selected Research Talks

Differentially Private Speaker Anonymization (PETS 2023)	Mnemonist: Locating Model Parameters (UAI 2023)	Losing Less: A Loss for DP Deep Learning (PETS 2023)
ColorFool: Semantic Adversarial Colorization (CVPR 2020)	EdgeFool: Adversarial Image Enhancement (ICASSP 2020)	Beyond Trust: Proving Fairness and Privacy in Machine Learning

Talks

05/2024 - ICLR 2024 conference -- Confidential-DPproof: Confidential Proof of Differentially Private Training Video
07/2023 - UAI 2023 conference -- Mnemonist: Locating Model Parameters that Memorize Training Examples Video
06/2023 - PETS 2023 conference -- Losing Less: A Loss for Differentially Private Deep Learning Slides Video
06/2023 - PETS 2023 conference -- Differentially Private Speaker Anonymization Slides Video
05/2023 - ICLR 2023 conference -- Confidential-PROFITT: Confidential PROof of FaIr Training of Trees Video
05/2023 - Workshop on Algorithmic Audits of Algorithms
05/2023 - Intel
04/2023 - Northwestern University -- How can we audit Fairness of AI-driven services provided by companies?
03/2023 - AIUK 2023 -- Confidential-PROFITT: Confidential PROof of FaIr Training of Trees Video
03/2023 - University of Cambridge -- An Overview of Differential Privacy, Membership Inference Attacks, and Federated Learning
11/2022 - NeurIPS 2022 conference -- Washing The Unwashable : On The (Im)possibility of Fairwashing Detection Video
11/2022 - University of Cambridge and Samsung
10/2022 - Queen's University of Belfast
09/2022 - Information Commissioner's Office
09/2022 - Brave
06/2020 - CVPR 2020 conference -- ColorFool: Semantic Adversarial Colorization Video
05/2020 - ACM Multimedia 2020 -- A tutorial on Deep Learning for Privacy in Multimedia Slides
05/2020 - ICASSP 2020 conference -- EdgeFool: An Adversarial Image Enhancement Filter Video
06/2018 - The Alan Turing Institute -- Privacy-Aware Neural Network Classification & Training -- Video
06/2018 - QMUL summer school -- Distribute One-Class Learning Video

Ali Shahin Shamsabadi