Website fingerprinting (WF) enables a passive eavesdropper to infer which web page a client is visiting, even when communications are encrypted or anonymized. In this paper, we study the vulnerability to website fingerprinting of Nym, a mix network based on the Loopix design that enables users to browse the Web. We show that although Nym adds delays and cover traffic to change packet patterns compared to Tor, it still leaks features that website fingerprinting attacks can exploit in both closed‑ and open‑world settings. We carry out an in-depth analysis of the effectiveness of Nym's obfuscation mechanisms, originally designed to provide anonymity in messaging, in thwarting website fingerprinting. We show that mix delays, counterintuitively, not only fail to protect against website fingerprinting but actually make the attack more effective as the mix delays make it easier to distinguish incoming from outgoing packets. We also demonstrate that the current cover traffic strategy of Nym is not effective in thwarting website fingerprinting attacks unless it imposes a large overhead. To address these limitations, we design two new WF defenses based on Nym's existing obfuscation mechanisms that significantly reduce WF effectiveness. The first defense introduces cover traffic to match the bursty nature of real-world web traffic, reducing the F1 score to 0.39 (compared to 0.65 obtained by similar defenses applied on Tor) at moderate overhead increase. The second defense plummets the F1 score to 0.06 by channeling web traffic via Nym's constant traffic capabilities, at the cost of bandwidth.
Private information retrieval (PIR) allows a client to query a public database privately and serves as a key building block for privacy-enhancing applications. Minimizing query size is particularly important in many use cases, for example, when clients operate on bandwidth-constrained devices. However, existing PIR protocols exhibit large query sizes: to query 225 records, the smallest query size of 14.8 KB is reported in Respire [Burton et al., CCS24]. Respire is based on fully homomorphic encryption (FHE), where a common approach to lower the client-to-server communication cost is transciphering. When combining the state-of-the-art transciphering [Bon et al., CHES24] with Respire, the resulting protocol (which we refer to as T-Respire) has a 336 B query size, while incurring a 16.2x times higher server computation cost than Respire. Our work introduces a novel alternative to transciphering for reducing the client-to-server communication: the client transmits only one component of a high-precision LWE ciphertext, from which we design a modular procedure to extract the inputs for the subsequent homomorphic computation. The efficiency of this approach is demonstrated by our Pirouette protocol, which achieves a query size of just 36 B. This represents a 9.3x reduction compared to T-Respire and a 420x reduction to Respire. For queries over 225 records, the single-core server computation in Pirouette is only 2x slower than Respire and 8.1x faster than T-Respire, and the server computation is highly parallelizable. Furthermore, Pirouette requires no database-specific hint for clients, and its variant PirouetteH enables additional tradeoffs among query size, throughput, and offline communication, demonstrating the flexibility of our design
Coinjoin is a collaborative Bitcoin transaction designed to enhance users' privacy by joining coins of multiple parties. Coinjoin implementations with a centralized trust-minimized coordinator have mixed more than 391,000 bitcoins since 2018. In June 2024, law enforcement actions led to the shutdown of coordinators of all three leading coinjoin designs-Wasabi 1.x, Wasabi 2.x, and Whirlpool-prompting a proliferation of new independent coordinators. Prior studies of this ecosystem offer little information beyond coinjoin detection and aggregation of related statistics, primarily due to the unavailability of information (intentionally) obscured by coinjoins. To overcome this limitation, we combine on-chain transaction analysis, coordinator monitoring, and active coinjoin participation, complemented by tailored analysis and visualizations, to: 1) provide a model for estimation of the number of active users at a time, 2) detect previously unknown coordinators, 3) retrospectively observe activity patterns of prominent parties, and 4) deliver continuously updated insights into the ecosystem. We show that while Wasabi 1.x remains inactive and recently resumed Whirlpool exhibits little activity, the Wasabi 2.x mixing has exceeded pre-shutdown levels under the new coordinator kruw.io, which now accounts for 99% of mixed inputs (over 46,000 bitcoins in the past 18 months) with raising concurrently active users now estimated to 70+ in average coinjoin, providing the first data-based estimate of the participants’ anonymity set. We revealed a previously unknown but significant coordinator active from early May to November 2024, with a method capable of identifying emerging coordinators. Although WW2 conceals large-input wallet activity more effectively than WW1, it is still detected by the proposed transaction-centric liquidity analysis.
Lookup table (LUT) is an important cryptography primitive, widely used in secure applications such as private set intersection, boolean circuit evaluation, and privacy-preserving machine learning. However, existing LUT constructions suffer from either high overhead or limited functionality. In this paper, we propose ROTL, a secure two-party protocol for arithmetic LUT evaluation. Compared with SP-LUT (the state-of-the-art arithmetic LUT presented at NDSS '17), it achieves up to 3.3x speedup and 10.5x communication reduction in overall (preprocessing + online) and 21x speedup and 60x communication reduction in terms of the online phase. At the heart of ROTL is a novel protocol for secret-sharing rotation, which allows two parties to generate additive secret shares of the rotated table without revealing the rotation offset. We believe this protocol is of independent interest. Based on ROTL, we design a novel secure comparison protocol; compared with the state-of-the-art (USENIX '22), it achieves a 5x runtime speedup and 2.5x communication reduction in the online performance. To support boolean secret sharing, we further provide an optimization (named FLUTE+) for FLUTE (the state-of-the-art boolean LUT presented at Oakland '23). For a boolean LUT with table size n and elements bit-width l, we reduce FLUTE's computation complexity from O(n^2 l) to O(n log n + n l) and shift O(n log n) computation to the preprocessing phase without introducing communication overhead. As a result, FLUTE+ achieves up to 5x speedup in terms of overall (preprocessing and online) and over 600x speedup in terms of the online phase compared with FLUTE. The communication cost of FLUTE+ is exactly the same as FLUTE's in both the preprocessing phase and the online phase.
Graph Neural Networks (GNNs) are deep learning models designed to address the complexities of graph-structured, non-Euclidean data. Due to their complexity, knowledge distillation (KD) is often employed to transfer knowledge from a GNN to a simpler, more efficient student model, such as a Multi-Layer Perceptron (MLP), enabling deployment in large-scale industrial applications. However, KD can inadvertently leak sensitive information from the teacher to the student, posing significant privacy risks. We present the first membership inference attacks targeting GNNs in KD pipeline, showing that student MLPs can reveal whether a node appeared in the teacher’s training data. Our attacks operate in a black-box setting, requiring access only to the student outputs, and remain effective in cross-dataset scenarios. Experimental evaluations across four GNN models and eight datasets show the effectiveness of our approach, achieving up to 0.9014 precision under low FPR of 1% in cross-dataset settings. These results expose significant vulnerabilities in GNN-based KD frameworks, emphasizing the need for strong security measures during the KD process involving GNNs.
We address the challenge of constructing a proof system capable of handling multiple computations that involve diverse types of tasks, such as scalable zkRollup applications. A central dilemma in this design is the trade-off between generality and efficiency: while arithmetic circuit-based SNARKs offer fast proofs but limited flexibility, zkVMs provide general-purpose programmability at the cost of considerable overhead for circuit translation. We observe that typical workloads for such applications can be naturally divided into two parts: (1) diverse, task and data-dependent application logic, and (2) computationally intensive cryptographic operations, e.g., hashes, that are common and repetitive. To optimize for both efficiency and adaptability, we propose Gryphes, a hybrid framework that composes matrix lookup, a generalization of lookup arguments, together with SNARK solutions tailored for cryptographic operations. At the heart of ame is a novel and efficient linking protocol, enabling seamless, efficient composition of matrix lookup + Plonk with general commit-and-prove SNARKs. By integrating Gryphes with Groth16 for signatures and RSA accumulators for membership proofs, we build a zkRollup prototype that achieves efficient proving, constant-size proofs, and dynamic support for thousands of transaction types. This includes our matrix lookup implementation incorporated with Plonk, as well as practical optimizations, comprehensive benchmarks, and open-sourced code. Our results demonstrate that Gryphes strikes a very good balance between functionality and efficiency, offering highly expressive and practical zkRollup systems.
In times of crisis, humanitarian organizations bring aid to those affected (e.g., water, food, medical supplies, cash assistance). Prior works introduced privacy-preserving systems for digitizing the aid distribution process, increasing their efficiency and security. These solutions, by design, do not allow humanitarian organizations to collect metrics about the aid distribution process. Such assessments (e.g., the proportion of aid distributed to a minority) are crucial to enable the organizations to improve their operations, to perform their duty of care, and to enable transparency and accountability towards recipients, donors, and the public in general. In partnership with the International Committee of the Red Cross, we identify assessments relevant to humanitarian aid deployments and these assessments' security and privacy requirements. We introduce a generic framework that augments existing privacy-preserving humanitarian aid distributions with such assessments. This framework enables the collection of aggregate statistics about the aid distribution process without compromising the privacy of recipients, and without requiring any changes to the existing protocols. To realize our framework we introduce one-time functional encryption (1FE), for which we propose efficient realizations from standard cryptographic primitives. We design and implement two variants of our framework: a more efficient one, secure against semi-honest adversaries; and a more robust one, secure against malicious adversaries. We also introduce the novel notions of threat model agility and graceful degradation. These notions enable us to model the unstable environment of humanitarian aid distribution, where the capabilities of the adversary may change suddenly (e.g., when a militia takes over a region in conflict), invalidating the threat model under which the system was originally deployed. We believe these notions are of independent interest for other privacy-preserving applications deployed in unstable environments.
In rapidly digitizing countries, like India, many people are adopting the Internet for the first time through smartphones. Such new users, with little prior exposure to digital systems, face applications and services that access personal and private data, often leaving no agency with the users to exercise a choice. This creates an imbalance between the power of data-driven platforms and the limited digital literacy of users, raising urgent privacy and security concerns. While prior research has studied experienced Internet populations, far less is known about how first-time users in the emerging markets think about and act on privacy risks. We present findings from interviews with 50 new Internet users in India, spanning diverse social and economic backgrounds. Our study shows that privacy is often managed by family members and local intermediaries, with users depending on them for key decisions. Participants held incomplete or inaccurate understandings of data collection, while prioritizing visible threats like fraud and device theft. The findings reveal a mismatch between formal privacy controls and the realities of everyday practice. We outline design and policy directions to support consent and security in ways that reflect the experiences of new Internet users.
Grassroots organizing requires establishing trust in digital artifacts (like event announcements or calls to action) while navigating significant security threats including surveillance, infiltration, and state violence. Traditional trust infrastructures like PKI and Web of Trust fail to address these specific needs, as they create public records of trust relationships that can expose activist networks and require institutional involvement that may be inaccessible or dangerous for marginalized communities. To address this, we introduce tigro, a novel trust infrastructure and system designed specifically for grassroots organizing contexts. Unlike conventional trust infrastructures, tigro implements a two-tier trust model: ground trust, which cryptographically binds digital annotations to physically vetted individuals, and artifact trust, which enables private, need-to-know sharing of assessments about digital content via annotations. Our protocol begins with an in-person key exchange that establishes a shared cryptographic key, creating a secure bridge between activists' existing physical vetting practices and their digital trust needs. To realize this approach, we define a new cryptographic primitive called an encrypted annotation system (EAS) and construct tigro using structured encryption and anonymous channels. We present two implementations with different security-performance tradeoffs: an efficient version for practical deployment that handles annotations in under a second, and a subliminal version that reveals virtually no metadata. Through this design, tigro enables activists to securely verify digital content without compromising relationship privacy or creating surveillance vulnerabilities, addressing a critical gap in existing trust infrastructure.
Certificate Authorities (CAs) bootstrap HTTPS-based privacy and trust on the Internet by authenticating the identity of domain names via a process known as domain control validation (DV). Ironically, currently used DV mechanisms rely on unauthenticated web protocols, including plaintext DNS and HTTP, and have been shown vulnerable to a range of network attacks. To address this critical challenge, we propose a framework for cryptographic verification of domain control, which fundamentally mitigates network-layer attacks. Our framework rethinks live DV protocol mechanisms using a domain owner specified security policy which constrains CAs to use authenticated channels and provide cryptographic verification. Our approach minimizes deployment burden on CAs by leveraging existing pieces of the Web PKI and DNS ecosystems,such as Certificate Authority Authorization (CAA) policies and secure DNS. We demonstrate the security properties of our design formally using the Tamarin verification tool and empirically via ethically-conducted real-world attacks. We showcase the feasibility of our framework through collaboration with a major anonymous CA: we analyze DNS and certificate issuance practices of over 400M live domains to understand the current state of CAA policies and secure DNS. We also report on the CA’s experiences implementing parts of our design in production. Finally, to realize our framework in the live Web PKI, we led a successful standardization effort for mandatory use of secure DNS by CAs at the CA/Browser Forum.
We explore societal awareness and perceptions related to digital fingerprinting, a stateless tracking technology increasingly used for online security, advertising, and fraud prevention, as well as to countermeasures designed to mitigate its impact. Despite its widespread application, user awareness of fingerprinting remains significantly lower compared to other tracking mechanisms, such as third-party cookies. To deepen our understanding of user perceptions, we conducted a study surveying 734 participants to assess their knowledge of fingerprinting, acceptance of its use across different applications (cybersecurity, law enforcement, user experience), and their reactions to browsing inconveniences introduced by countermeasures. Countermeasures examined include privacy-focused browsers (e.g., Tor), browser extensions, and spoofing tools. While these solutions vary in effectiveness, they often compromise usability, resulting in issues such as website breakages and prolonged CAPTCHA challenges. Privacy-conscious users demonstrated greater tolerance for such disruptions, whereas others prioritized convenience over protection.
Face recognition is now widely used in authentication, surveillance, and social media, but it also raises serious privacy risks. Face recognition models enable unauthorized identification of individuals from publicly shared images, support mass surveillance and tracking without consent, and allow inference of sensitive personal attributes such as age, gender, or health conditions. Since biometric data cannot be revoked like a password, once facial embeddings are leaked, they can be exploited for identity theft and cross-platform re-identification. To address these challenges, many deep learning based methods have been proposed to alter facial images so that identity is concealed while the images remain useful for deep learning tasks such as age estimation, attribute recognition, expression analysis, and face recognition for an authorized system. These methods include pixel-level manipulation, generative adversarial makeup, feature disentanglement, and key-based reversible encryptions. However, most of them follow the idea of bounded distortion, where the image is slightly altered for privacy preservation while keeping the image quality and the corresponding deep learning task accuracy intact. In this paper, we perform a detailed security analysis of these deep learning based privacy-preserving methods and show that these defense mechanisms are fundamentally insecure. Using theoretical as well as extensive experimental analysis, we demonstrate that a conditional GAN model can be trained to reconstruct the original image from the privacy-preserving protected image. Our attack analysis on the ten best-known privacy-preserving methods recovers the original from the protected image with high accuracy. Our results expose the key limitations of existing deep learning based privacy preserving methods and stress the need for privacy-preserving solutions based on stronger principles, such as information theory or cryptography, while still ensuring functionality for deep learning tasks.
With the increasing prevalence of voice interfaces, such as smart home assistants, conversational AI, and AR/VR systems, the need for effective privacy and consent mechanisms is more critical than ever. We conducted a mixed-methods study to address the challenges of ensuring effective consent for voice-based data sharing. Through interviews with voice assistant users (n=21), we identify five key design and contextual factors for effective privacy notices: context, control flow, modality, timing, and the voice used for notice delivery. We then prototyped these notices and performed a within-subject user study (n=160) to identify preferred notice designs. We found that the voice used for delivery and timing of the notice are the most critical factors influencing user preferences, with participants favoring notices delivered in the default app voice before data is requested. To our knowledge, this is the first study to design privacy notices specifically for voice-based data sharing in voice interfaces. Our findings contribute valuable insights to the privacy design literature and provide actionable guidance for developers working on emerging voice-driven platforms.
Merging records from two databases by comparing quasi-identifiers such as names or addresses is a frequently occurring task in many academic and administrative domains. Privacy-Preserving Record Linkage (PPRL) techniques aim to provide a way of computing the similarities between quasi-identifiers without revealing the plaintext data. In practice, PPRL is usually performed by applying a similarity-preserving encoding to the data and comparing similarities on the encoded data only. However, recent research demonstrated that all standard PPRL encoding schemes, with the exception of Bloom filters with added diffusion (BAD), are vulnerable to Graph Matching Attacks and should no longer be considered secure. In this paper, we identify two properties of BAD that leak information about the plaintext to an attacker. We then proceed to show that these leaks make BAD vulnerable to an adapted variant of graph matching attacks. The newly proposed Homomorphism-based Graph Matching Attack is capable of re-identifying up to 91.6% of BAD-encoded records, thereby breaking the only remaining secure encoding scheme. As a remedy, we present a new Scheme for Anonymous, Utility-preserving Linkage (SAUL), which is not only robust against our new attack and all previous ones, but also outperforms the state of the art in terms of linkage quality.
Citizens rely on government websites for a wide array of essential services. However, these websites may embed third-party trackers, raising questions on privacy, security, and data sovereignty. We conduct a large-scale longitudinal study of tracker adoption and evolution on government websites worldwide. Our study spans 61 countries and nearly three decades (1996-2025), using historical snapshots from the Internet Archive. We find that tracking has shifted from rare to routine: by 2025, third-party trackers appear on 50% of studied government websites, with growth overwhelmingly driven by external (third-party) services. This tracking is dominated by a few large US-based organizations, with a long tail of lesser-known players. We also find great heterogeneity in tracker adoption and presence across regions, indicating that users around the world have differing exposure to privacy and security issues when accessing essential services. Our findings highlight the need for approaches to improve privacy and data sovereignty on public-service platforms.
We present HyperVerITAS, a new zero-knowledge proof (ZKP) system for image provenance that enables scalable, efficient, and privacy-preserving verification of image transformations. HyperVerITAS builds upon the same minimal trust model as VerITAS (IEEE S&P '25), requiring trust only in the image source device, while treating the editing software as untrusted. Unlike VerITAS, which relies on FFT-intensive SNARKs and suffers from high memory overhead (up to 120 GB), HyperVerITAS leverages multilinear polynomial encodings over the Boolean hypercube to dramatically reduce both proving time and memory usage. Our design cleanly separates signature verification from image transformation, supports modular integration of multiple polynomial commitment schemes (including post-quantum constructions) and naturally extends to a wide range of affine image transformations. We implement HyperVerITAS with two distinct commitment schemes (Brakedown and multilinear KZG) and evaluate it on full-system pipelines involving cropping and grayscaling. On commodity hardware (Apple M3, 36 GB RAM), HyperVerITAS generates proofs for 33 MP images using only 27 GB of RAM and 6.6 minutes of proving time, whereas VerITAS fails to scale beyond 4 MP. These results establish HyperVerITAS as a practical and scalable ZKP system for secure and efficient image provenance.
Many mobile apps' business model is based on sharing user data with ad networks to deliver personalized ads. The California Consumer Privacy Act (CCPA) gives California residents a right to opt out. In two experiments we evaluate to which extent popular Android apps enable California residents to exercise their right. In our first experiment—manually exercising the right via app-level UIs—we find that only 48 out of 100 apps implement a respective setting, which suggests that CCPA opt-out right compliance on the Android platform is generally low. In our second experiment—automatically exercising the opt-out right by sending Global Privacy Control (GPC) signals—we find for an app dataset of 1,811 apps that GPC is largely ineffective. While we estimate with 95% confidence that 62%-81% of apps in our app dataset must respect the CCPA opt-out right, many apps do not do so. Our evaluation of disabling apps' access to the AdID—which is technically not intended for exercising the CCPA opt-out right but could be practically effective—does not change our conclusion. For example, when sending GPC signals and disabling apps' access to the AdID, 338 apps still had the ccpa status of the ad network Vungle set to opted_in while only 26 had set it to opted_out. Overall, our results suggest a compliance gap as California residents have no effective way of exercising their CCPA opt-out right on the Android platform; neither at the app- nor at the platform-level. We think that re-purposing the Android AdID setting as an opt-out right setting with legal meaning under the CCPA and other laws could close this gap and improve users' privacy on the platform significantly.
Biometric fingerprint authentication and identification systems are increasingly deployed, yet widespread adoption in cloud and server-based platforms remains hindered by privacy and security concerns. Unlike passwords, compromised fingerprints are immutable, making their secure storage and computation paramount. Homomorphic Encryption (HE) offers strong privacy guarantees for fingerprint data processing by enabling computation directly on encrypted data. However, the high dimensionality of fingerprint images and the complexity of the neural networks needed for accurate recognition creates significant bottlenecks, which hinder the practical deployment of HE in this domain. We introduce SentinelTouch, an open-source framework for privacy-preserving fingerprint authentication and identification that delivers both efficiency and accuracy in HE environments. Our key insight is a twofold optimization: (1) a preprocessing pipeline that reduces fingerprint image dimensions to as low as 28x28 while preserving most of its discriminative details, and (2) the design of a lightweight, HE-friendly neural network that generalizes effectively on this compact data. We evaluate two deployment pipelines: (1) a full-privacy pipeline, where encrypted images are processed entirely under HE settings, achieving user identification in a one-to-many setting in just 16 seconds. (2) A hybrid pipeline, where only encrypted embeddings are processed under HE settings, achieving one-to-many user identification in 284 milliseconds. Our results show a 10x and 2.5x speedup over the current state-of-the-art results in both pipelines, respectively. Across the SOKOTO and PolyU datasets, SentinelTouch achieves Rank-1 accuracies within +-0.1% of the leading encrypted systems. This work demonstrates the practicality of end-to-end privacy-preserving fingerprint identification and authentication systems, offering HE security guarantees and utilizing neural networks, without compromising accuracy.
Federated graph neural networks (FedGNNs) have emerged as a promising solution for handling graph data distributed across multiple owners. They enable collaborative training while preserving data decentralisation and complying with privacy and regulatory constraints. However, the inherent structural dependencies in graph data and the message-passing mechanisms of GNNs introduce both cross-client and intra-client edges in FedGNNs. Cross-client edges, in combination with federated learning (FL) protocol designs, open additional channels for information propagation and heighten the risk of privacy leakage. In FedGNNs, once edge information is compromised, adversaries can infer local neighbourhood structures and reconstruct inter-client relationships, even without direct access to raw data. Existing research on privacy inference in FL has largely overlooked edge privacy threats specific to FedGNNs. To address this gap, we propose a poisoning link inference approach with two strategies: Label Flipping Link Inference Attack (LFLIA) and Gradient Ascent Link Inference Attack (GALIA). LFLIA flips the label of a candidate node so that its perturbation propagates along structural topology during training. GALIA perturbs the candidate node’s gradient to amplify its loss. The perturbations on the candidate node can propagate to its linked neighbours by message-passing mechanism, which induces representation shifts on these linked nodes. By monitoring FedGNN outputs of a target node set before and after poisoning, an adversary can distinguish linked nodes through observable output shifts, whereas unlinked nodes exhibit little to no change. Experimental results on multiple benchmark datasets show that our poisoning-based LIA can effectively infer link existence and structure with high accuracy across diverse federated settings.
YouTube is one of the largest video platforms on the web, with Google Ads deeply integrated into the viewing experience. While users may expect some level of tracking during ad delivery, the extent and mechanics of Google Ads tracking on YouTube, particularly the tracking behaviors triggered by user interactions with ads, remain underexplored. To address this gap, for the first time, we develop YT-AdTrack, a fully automated framework that measures tracking initiated by YouTube ads across 430 top-trending videos, three widely used browsers, and six geographic locations. In our baseline measurement campaign, YT-AdTrack strategically accepts cookie banners on YouTube, interacts with displayed ads, and subsequently accepts cookie banners on advertiser landing pages to capture downstream tracking behavior. Our findings show that every ad click consistently carries a unique Google Click Identifier, gclid, which is propagated through redirection chains and ultimately embedded in the advertiser’s landing page. We further observe that 64 (out of 76) advertisers persist this identifier as a first-party cookie, thereby transforming a short-lived click token into a durable user identifier. In addition, gclid values frequently leak across parties from advertisers, exposing them to both Google-controlled services and external third-party ad networks, which exacerbates the tracking nexus by extending well beyond standard conversion measurement. Strikingly, even when cookie banners are rejected, ad interactions remain consistently tagged: 55.4% of advertisers store gclidas a cookie, and 18.9% enable auto-tagging, which allows Googleto directly persist the identifier. This demonstrates that banner rejection does not safeguard users from gclid-based tracking. We find these behaviors to be consistent across browsers, with advertisers persisting the identifier in 76.4–84.2% of cases and Google directly storing it in over two-thirds of interactions. Similarly, across six geographic locations, gclid-based tracking persists, with advertisers storing it in 72.5–88.5% of cases and Google’s auto-tagging active in all locations. Overall, our analysis reveals that a single ad click can initiate durable cross-site tracking that persists across various banner choices, browser environments, and regional contexts.
