Areas of Research
Our research covers a wide range of topics which are essential to the development of technology that can be deployed while minimizing harms on individuals and society at large. These are our main lines of research (see our publications page for more details)
Engineering harm-preventing systems from the lens of privacy
Digitalization increases the surface of harms for users and collectives. The digital traces users leave can be used to create profiles, to find ways to manipulate them, or to cause them physical harm, among others.
At the SPRING Lab we work on improving our understanding on how privacy technologies can be used to build systems that minimize potential harm to users and societies. We work both on the development of building blocks that allow engineers to build privacy-systems, as well as on methodologies that enable them in a systematic way about how to combine these building blocks and evaluate their impact on harm prevention.
- End-to-End Encrypted Collaborative Documents. Christian Knabenhans, Zayd Maradni, and Carmela Troncoso. USENIX Security 2026.
- This project received the Internet Defense Prize at the USENIX Security conference
- Not Yet Another Digital ID: Privacy-preserving Humanitarian Aid Distribution. Boya Wang, Wouter Lueks, Justinas Sukaitis, Vincent Graf Narbel, and Carmela Troncoso . IEEE Symposium on Security and Privacy 2023.
- This project, realized in collaboration with the International Committee of the Red Cross, received a Distinguished paper award at the conference.
- Decentralized Privacy-Preserving Proximity Tracing. Carmela Troncoso, Mathias Payer, Jean-Pierre Hubaux, Marcel Salathé, James Larus, Edouard Bugnion, Wouter Lueks, Theresa Stadler, et al. IEEE Data Eng. Bull. 43(2): 36-66 (2020)8.
- This protocol inspired the Google and Apple Exposure Notification API, and was used as the basis of many contact tracing applications worldwide.
- Project Github
- Datashare Network: A Decentralized Privacy-Preserving Search Engine for Investigative Journalists. Kasra EdalatNejad, Wouter Lueks, Julien Pierre Martin, Soline Ledésert, Anne L’Hôte, Bruno Thomas, Laurent Girod, Carmela Troncoso. USENIX Security 2020.
Understanding the limits of protection in artificial intelligence and other emerging technologies
At the SPRING Lab we try to understand the impact that emerging technologies, and especially machine learning, has on society, and how it changes security and privacy problems. We research how and when machine learning can be used without creating new harm surfaces. We also study how machine learning could be used to help designers evaluate their systems design, and try to find principled ways to design defenses against attacks on privacy using machine-learning.
- Evaluating Concept Filtering Defenses against Child Sexual Abuse Material Generation by Text-to-Image Models Ana-Maria Cretu, Klim Kireev, Amro Abdalla, Wisdom Obinna, Raphael Meier, Sarah Adel Bargal, Elissa M. Redmiles, and Carmela Troncoso. IEEE Symposium on Security and Privacy 2026.
- On the Conflict Between Robustness and Learning in Collaborative Machine Learning Mathilde Raynal and Carmela Troncoso. IEEE Symposium on Security and Privacy 2025.
- On the (In) security of Peer-to-Peer Decentralized Machine Learning. Dario Pasquini, Mathilde Raynal, and Carmela Troncoso. IEEE Symposium on Security and Privacy 2023.
- Synthetic Data — Anonymisation Groundhog Day. Theresa Stadler, Bristena Oprisanu, Carmela Troncoso. USENIX Security 2022.
- Disparate Vulnerability: on the Unfairness of Privacy Attacks Against Machine Learning. Bogdan Kulynych, Mohammad Yaghini, Giovanni Cherubin, Carmela Troncoso. PoPETs 2022.
- Angel or Devil? A Privacy Study of Mobile Parental Control Apps. Álvaro Feal, Paolo Calciati, Narseo Vallina-Rodriguez, Carmela Troncoso, Alessandra Gorla. PoPETs 2020
- This work received the 2020 Emilio Aced Award for Research on Data Protection from the Spanish Data Protection Authority
Improving web and network privacy
A key part of our digital life happens on the web. At the SPRING lab, we develop technologies to improve the privacy of users when interacting with webpages, both at the applicaiton and network layers.
- Website fingerprinting on Nym: Attacks and Defenses Eric Jollès, Simon Wicky, Anja Piotrowska, Harry Halpin, and Carmela Troncoso. PoPETS 2026
- SINBAD: Saliency-informed detection of breakage caused by ad blocking Saiid El Hajj Chehade, Sandra Siby, and Carmela Troncoso. IEEE Symposium on Security and Privacy 2024.
- Online website fingerprinting: Evaluating website fingerprinting attacks on tor in the real world Giovanni Cherubin, Rob Jansen, Carmela Troncoso. USENIX Security 2022
- This work was Distinguished Paper Award Winner and Second Prize Winner (tie) of the 2022 Internet Defense Prize
- Encrypted DNS –> Privacy? A Traffic Analysis Perspective. Sandra Siby, Marc Juarez, Claudia Diaz, Narseo Vallina-Rodriguez, Carmela Troncoso. NDSS 2020.
- This work has been invited for a presentation at the IETF 105 Privacy Enhancements and Assessments Research Group session in July 2019