Security, Privacy and Abuse Prevention
The Internet and the World Wide Web have brought many changes that provide huge benefits, in particular by giving people easy access to information that was previously unavailable, or simply hard to find. Unfortunately, these changes have raised many new challenges in the security of computer systems and the protection of information against unauthorized access and abusive usage. At Google, our primary focus is the user, and his/her safety. We have people working on nearly every aspect of security, privacy, and anti-abuse including access control and information security, networking, operating systems, language design, cryptography, fraud detection and prevention, spam and abuse detection, denial of service, anonymity, privacy-preserving systems, disclosure controls, as well as user interfaces and other human-centered aspects of security and privacy. Our security and privacy efforts cover a broad range of systems including mobile, cloud, distributed, sensors and embedded systems, and large-scale machine learning.
Recent Publications
Preview abstract
The Private Aggregation of Teacher Ensembles (PATE) framework enables privacy-preserving machine learning by aggregating responses from disjoint subsets of sensitive data. Adaptations of PATE to tasks with inherent output diversity such as text generation, where the desired output is a sample from a distribution, face a core tension: as diversity increases, samples from different teachers are less likely to agree, but lower agreement results in reduced utility for the same privacy requirements. Yet suppressing diversity to artificially increase agreement is undesirable, as it distorts the output of the underlying model, and thus reduces output quality.
We propose Hot PATE, a variant of PATE designed for diverse generative settings. We formalize the notion of a diversity-preserving ensemble sampler and introduce an efficient sampler that provably transfers diversity without incurring additional privacy cost. Hot PATE requires only API access to proprietary models and can be used as a drop-in replacement for existing Cold PATE samplers. Our empirical evaluations corroborate and quantify the benefits, showing significant improvements in the privacy–utility trade-off on evaluated in-context learning tasks, both in preserving diversity and in returning relevant responses.
View details
Mobile Telemetry-Centered Threat Modeling for Managed Enterprise Architectures
IEEE Computer, vol. 59 (2026)
Preview abstract
This work introduces Telemetry-Centered Threat Modeling (TCTM), a vendor- and operating system–agnostic framework designed to assess whether mobile security telemetry is sufficiently authoritative to guide enterprise security policies and automated decision-making. Recognizing that enterprise security workflows frequently falter when acting on intercepted, delayed, or manipulated signals even if endpoint enforcement remains functional, TCTM establishes telemetry as a first-class security surface rather than a passive byproduct. The framework systematically evaluates evidence paths across four essential properties (origin, time-bounded validity, lineage, and binding) to uncover structural pipeline weaknesses before higher-level threat modeling takes place. Ultimately, TCTM bridges the gap between theoretical modeling and operational defense by translating telemetry vulnerabilities into tangible engineering artifacts, including SIEM detection rules, SOAR playbook constraints, and practical mobile testing scenarios.
View details
Preview abstract
As AI agents increasingly operate with system-level privileges across cloud environments, they face significant security vulnerabilities—most notably prompt injection and unauthorized command execution. With 72% of agent deployments experiencing security incidents within 90 days, there is a critical need for robust, defense-in-depth strategies. This article introduces "Bottom-Up AI Agent Security," a comprehensive 14-layer framework designed to secure AI agents from the foundation up. The strategy covers five essential domains: code-level security, container hardening, cloud IAM, runtime monitoring, and human oversight. By providing actionable implementation templates (including Java, YAML, and GitHub Actions) and a structured 4-week deployment roadmap, this framework enables cloud architects to transform vulnerable AI deployments into hardened, production-ready systems with measurable reductions in risk and operational costs.
View details
Hybrid Reputation Routing for Decentralized Networks: A Blockchain-Enabled Secure and Scalable Protocol with On-Chain/Off-Chain Partitioning
Praveen Baskar
Om Narayan
Ramkinker Singh
2026
Preview abstract
Our suggestion is a hybrid reputation-based routing
protocol in the context of decentralized routing. networks which
partitions trust measurements to on-chain immutable logs and
off-chain dynamic computations to attain security and scalability.
The protocol incorporates a layer of sharded blockchain to store
critical. trust data and local reputation model to do real-time
updates, enabling routing choices that cannot be tampered with.
performance. The trust ledger which operated on-chain kept
the records of the impartiality of. Historical performance and
node identities, whereas the off-chain reputation engine uses
graph neural network to calculate dynamic. real-time scores like
packet delivery rate to be trusted. and latency. Additionally, it
uses rollup-based batches of synchronization off-chain. optimistic
updates to zero-knowledge proofs, making on-chain efficient.
checking with minimum overhead. The suggested approach
replaces conventional network discovery and forwarding modules
using trust-based adjacency lists and trust-based pathing, and
thus enhancing routing consistency over adversarial settings.
Moreover, the structure integrates Hyperledger Fabric with.
Graph Attention Network-based high-throughput sharded ledger
operations. to update reputation in a privacy-preserving manner,
proving to be linear. network size scalability. The experimental
findings indicate that the system supports 10,000 transactions per
shard and produces. Under 100 ms per ZK-Rollup proof, which
is appropriate to large-scale IoT. and DeFi deployments. This
publication fills the gap between pure on-chain. and off-chain
reputation systems, which provides a viable solution to scalable
and secure decentralized routing.
View details
Preview abstract
We introduce a new Bayesian perspective on the concept of data reconstruction, and leverage this viewpoint to propose a new security definition that, in certain settings, provably prevents reconstruction attacks. We use our paradigm to shed new light on one of the most notorious attacks in the privacy and memorization literature - fingerprinting code attacks (FPC). We argue that these attacks are really a form of membership inference attacks, rather than reconstruction attacks. Furthermore, we show that if the goal is solely to prevent reconstruction (but not membership inference), then in some cases the impossibility results derived from FPC no longer apply.
View details
OpenClaw in the Wild: Security Analysis of Autonomous Agents
Wanlun Ma
Qing-Long Han
Xiaogang Zhu
Wei Zhou
Junwu Xiong
Peter Ren
Sheng Wen
Yang Xiang
IEEE/CAA Journal of Automatica Sinica, 13 (2026), pp. 1257 - 1273
Preview abstract
Autonomous self-hosted AI agent platforms are rapidly evolving from prompt-response assistants into persistent systems that can maintain long-lived state, invoke tools, ingest external content, and execute environment-changing actions. While this transition enables practical automation, it also introduces lifecycle security risks that cannot be fully explained by prompt-level analysis alone. In this paper, we present a security analysis of OpenClaw as a representative autonomous agent operating environment. We further frame OpenClaw as a concrete case study for broader security challenges in emerging agent ecosystems. We adopt a trust-boundary-first perspective and analyze how attacks propagate across five boundary classes: Channel-Access, Session-and-State, Tool-Execution, External-Content, and Extension Supply-Chain. Our results show that threats such as indirect prompt injection, memory poisoning, unsafe tool invocation, data exfiltration, and malicious skill abuse are not isolated anomalies; they are stage-specific manifestations of a common systems problem in which untrusted influence progressively crosses into higher-privilege contexts. Building on this analysis, we discuss defense-in-depth implications for OpenClaw deployments, including boundary-aware isolation, capability-scoped tool mediation, memory integrity controls, extension governance, and evidence-oriented operational oversight. The study provides a practical framework for evaluating and hardening long-running, tool-capable, autonomous AI agents in realistic deployment settings.
View details
Some of our teams
×
![]()