CyLab

Secure Software by Design 2025 brings experts together to shape the future of cybersecurity engineering CyLab is collaborating with Carnegie Mellon University’s Software Engineering Institute (SEI) to convene leaders and practitioners in secure software development for the Third Annual Secure Software b...

CyLab is collaborating with Carnegie Mellon University’s Software Engineering Institute (SEI) to convene leaders and practitioners in secure software development for the Third Annual Secure Software by Design event, to be held in Arlington, Virginia on August 19th and 20th.

CyLab researchers present their work at SOUPS 2025 Carnegie Mellon faculty and students will share their research at the 2025 Symposium on Usable Privacy and Security (SOUPS), which takes place August 10-12 in Seattle.

. @cmu.edu faculty members and students will share their research at next week’s 2025 Symposium On Usable Privacy and Security (SOUPS) in Seattle. Learn more about the @cylab.bsky.social co-authored technical papers that will be presented at #soups2025:

Photo of Carnegie Mellon REUSE student presenting their research during the REUSE poster session

Photo of Carnegie Mellon REUSE student presenting their research during the REUSE poster session

Photo of Carnegie Mellon REUSE students presenting their research during the REUSE poster session

Group photo of Carnegie Mellon REUSE students

The @cmus3d.bsky.social Research Experience for Undergraduates in Software Engineering (REUSE) concluded today. Thirty-four students spent the summer doing engaging research projects in areas spanning all of computer science, which they presented during today’s final poster session. Congrats to all!

“A lot of cybersecurity defenses rely on human operators and I am not sure how well that will scale up to machine-timescale defenses.”

Brian Singer, Ph.D. candidate in @cmu-ece.bsky.social, chats w/ David Jones of @cybersecuritydive.bsky.social about his recent research on autonomous #LLM attacks:

Photo of Ingo Lütkebohle speaking at the CyLab Robotics Security and Privacy Workshop

Photo of attendees talking during a breakout session at the CyLab Robotics Security and Privacy Workshop

Photo of Andrea Bajcsy speaking at the CyLab Robotics Security and Privacy Workshop

Photo of attendees talking during a breakout session at the CyLab Robotics Security and Privacy Workshop

Day 2 of the @cylab.bsky.social Robotics Security and Privacy Workshop featured dynamic talks by @iluetkeb.bsky.social, Andrea Bajcsy, and Vivan Amin and breakout sessions on strategic approaches to building trusted middleware and toolchains to foster a secure, privacy-preserving robotics ecosystem.

Photo of Christopher Timperley speaking at the CyLab Robotics Security and Privacy Workshop

Photo of Phillip Koopman speaking at the CyLab Robotics Security and Privacy Workshop

Photo of Lujo Bauer speaking at the CyLab Robotics Security and Privacy Workshop

Photo of Kassem Fawaz speaking at the CyLab Robotics Security and Privacy Workshop

Day 1 of the @cylab.bsky.social Robotics Security and Privacy Workshop is underway with introductions and technical talks! Attendees will collaborate in breakout sessions this afternoon to tackle research challenges on topics ranging from policy considerations to threat models and human factors.

In a groundbreaking development, a team of @cmu.edu researchers f/ Brian Singer, @lujobauer.bsky.social, and Vyas Sekar demonstrated that large language models (LLMs) are capable of autonomously planning and executing complex network attacks. Read more about their research: bit.ly/when-llms-au...

Blockchain Address Poisoning In many blockchains, e.g., Ethereum, Binance Smart Chain (BSC), the primary representation used for wallet addresses is a hardly memorable 40-digit hexadecimal string. As a result, users often select ...

New research alert 🚨 from my group, “Blockchain Address Poisoning” (Tsuchiya et al.), to appear at USENIX Security 2025 (arxiv.org/abs/2501.16681)! As a follow-up, we also developed a real-time detection system: cryptotrade.cylab.cmu.edu/poisoning/ and x.com/toxin_tagger (1/7)

Investing in energy to secure America's AI future Energy is central to winning the AI race and we need to ensure that America has the necessary infrastructure to maintain its lead. The importance of building this infrastructure goes beyond just power...

. @anthropic.com has announced a $1 million contribution to support picoCTF, which provides students a free #cybersecurity education platform to learn skills through an annual capture-the-flag (CTF) competition, yearlong learning guides, and regular tutorials. See full details below:

Energy and Innovation Advances in AI mean increasingly sophisticated cybersecurity threats. CMU is well positioned to meet these challenges with innovative solutions spun out of the CyLab Security and Privacy Institute, wh...

CMU has released faculty-authored position statements aimed at informing the national dialogue on #energy and #innovation, including work that @cylab.bsky.social researchers are doing to mitigate increasingly sophisticated, #AI driven #cybersecurity threats. www.cylab.cmu.edu/news/2025/07...

CyLab researchers set to present their work at PETS 2025 Carnegie Mellon University faculty members and students will share their research at the 2025 Privacy Enhancing Technologies Symposium (PETS). Held annually, the 25th PETS will be a hybrid event takin...

.@cmu.edu faculty members are set to share their research at this week’s 2025 Privacy Enhancing Technologies Symposium (@pet-symposium.bsky.social) in Washington, D.C. Learn more about the @cylab.bsky.social co-authored papers to be presented at #PETS2025: www.cylab.cmu.edu/news/2025/07...

Photo of Lorrie Cranor introducing Paul Ohm during his lecture at Carnegie Mellon University

Photo of Paul Ohm lecturing at Carnegie Mellon University

Many thanks to @paulohm.bsky.social, Professor of Law at @georgetownlaw.bsky.social, for visiting @cylab.bsky.social today to discuss his work connecting recent landmark papers in machine learning to important, interesting, and emerging questions in the law.

#ML

Analysis | 6 tips to avoid using AI chatbots all wrong Chatbots are an embarrassing mistake waiting to happen. Here’s what not to do.

Niloofar Mireshghallah, incoming @cylab.bsky.social ky.social‬, @cmu-epp.bsky.social, and @ltiatcmu.bsky.social professor, shares tips with @shiraovide.bsky.social and @heatherkelly.bsky.social of @washingtonpost.com for protecting #privacy while using #chatbots.

CyLab to host Robotics Security and Privacy Workshop July 28-29 On July 28-29, CyLab will host a Robotics Security and Privacy Workshop on the Carnegie Mellon University campus, convening leading researchers and experts from across academia and industry to discuss...

On July 28-29, @cylab.bsky.social will host a Robotics Security and Privacy Workshop on the @cmu.edu campus, convening leading researchers and experts from across academia and industry. See full details and request to attend below:

#privacy #security #robotics

CyLab researchers to present at PLDI 2025 Carnegie Mellon University researchers are set to present five papers and chair one program session at the 46th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI 2025).

. @cmu.edu researchers are set to present five papers and chair one program session at the 46th @acm.org SIGPLAN Conference on Programming Language Design and Implementation (PLDI). Learn more about their @sigplan-pldi.bsky.social research: #PLDI2025

Cybersecurity Training in Africa Aims to Bolster Pros' Ranks The United Nations, Carnegie Mellon University, and private organizations are all aiming to train the next generation of cybersecurity experts, boost economies, and disrupt pipelines to armed groups.

African organizations are partnering with educational institutions like picoCTF-Africa to teach students and young adults #cybersecurity skills in response to significant increases in cybercrime. Learn how via @robertlemos.bsky.social of @darkreading.bsky.social‬:

CyLab researchers to present at USENIX PEPR 2025 CyLab Security and Privacy Institute researchers are set to lead three presentations at the 2025 USENIX Conference on Privacy Engineering Practice and Respect (PEPR '25).

CyLab faculty members and students will lead three presentations at next week’s USENIX Conference on Privacy Engineering Practice and Respect (#PEPR25). Learn more about the research they will be presenting:

CyLab researchers win Test of Time Award at USEC 2025 A team featuring CyLab researchers was honored with the Test of Time Award at the 2025 Symposium on Usable Security and Privacy (USEC 2025).

A team featuring CyLab researchers was honored with the Test of Time Award at the 2025 Symposium on Usable Security and Privacy (USEC 2025).

Visit this store for a free iris scan to ‘prove’ you’re human, not AI Stores promoting a biometric identity system called World opened stores where people can scan their irises to obtain “proof of personhood.”

“I have trouble believing if this system will actually solve this problem.”

Professor Lorrie Cranor (@lorriecranor.bsky.social), @cylab.bsky.social Director, speaks to Lisa Bonos (@lisabonos.bsky.social) of @washingtonpost.com about the “World” biometric “proof of human” credential network.

Photo of Lorrie Cranor giving the keynote presentation at Cyburgh 2025

Photo of Lorrie Cranor giving the keynote presentation at Cyburgh 2025

Photo of Lorrie Cranor giving the keynote presentation at Cyburgh 2025

Photo of Lorrie Cranor giving the keynote presentation at Cyburgh 2025

Professor Lorrie Cranor (@lorriecranor.bsky.social), CyLab Director, gives the keynote presentation at Cyburgh 2025, presented by @pghtechcouncil.bsky.social. In her keynote, Prof. Cranor shared examples of usable #privacy and #security research.

#PTCCyburgh #Cyburgh2025 #PittsburghTech #InfoSec

Photo of Anna Gerchanovsky presenting research at CHI 2025

Photo of Eric Zeng presenting research at CHI 2025

Electrical and Computer Engineering (@cmu-ece.bsky.social) alum Anna Gerchanovsky (MS ‘24) and CyLab postdoctoral research alum Eric Zeng (@ericzeng.bsky.social) present #security and #privacy research at this week’s @chi.acm.org #CHI2025 in Yokohama, Japan.

Purpose Mode helps social media users stay focused on their desired tasks A CMU research team has developed Purpose Mode — a browser extension that allows users to “toggle off” Attention Capture Damaging Patterns (ACDPs) while using social media platforms.

@cylab.bsky.social wrote a great article on @hankhplee.bsky.social's #chi2025 paper on Purpose Mode.

He presented it today and did a great job!

PurposeMode reduces distraction on social media from 28% -> 7%. You can use it, too! It's open source :)

cylab.cmu.edu/news/2025/04...

Photo of a Carnegie Mellon University Privacy Engineering student sharing their research at a poster session

Photo of a Carnegie Mellon University Privacy Engineering student sharing their research at a poster session

Photo of a Carnegie Mellon University Privacy Engineering student sharing their research at a poster session

Photo of a Carnegie Mellon University Privacy Engineering student sharing their research at a poster session

Students from @cmu.edu's Privacy Engineering Program shared their research during today’s Privacy in Software poster session. The students highlighted their implementations of different privacy-enhancing technologies, including differential #privacy, homomorphic encryption, and federated learning.

Thieves took their iPhones. Apple won’t give their digital lives back. Some iPhone theft victims are taking their cases to court to get their digital lives back.

In a @washingtonpost.com article, Professor Lorrie Cranor (@lorriecranor.bsky.social), CyLab Director, tells Chris Velazco (@velazco.bsky.social) that restoring Apple accounts for users whose iPhones have been stolen is a solvable problem:

Photo of Seth Neel lecturing at Carnegie Mellon University

Photo of Seth Neel lecturing at Carnegie Mellon University

Many thanks to Seth Neel, Senior Research Scientist at Google Research, for visiting campus today to discuss his research on machine unlearning as part of the @cylab.bsky.social Seminar Series.

Gmail Is Not a Secure Way to Send Sensitive Comms New end-to-end Gmail encryption alone isn't secure enough for an enterprise's most sensitive and prized data, experts say.

In a @darkreading.bsky.social article, Professor Lorrie Cranor (@lorriecranor.bsky.social), CyLab Director, explains to Becky Bracken (@beckybracken.bsky.social) why, regardless of #encryption protections, #Gmail user devices and accounts still need to be secured.