Security, Privacy and Abuse Prevention
The Internet and the World Wide Web have brought many changes that provide huge benefits, in particular by giving people easy access to information that was previously unavailable, or simply hard to find. Unfortunately, these changes have raised many new challenges in the security of computer systems and the protection of information against unauthorized access and abusive usage. At Google, our primary focus is the user, and his/her safety. We have people working on nearly every aspect of security, privacy, and anti-abuse including access control and information security, networking, operating systems, language design, cryptography, fraud detection and prevention, spam and abuse detection, denial of service, anonymity, privacy-preserving systems, disclosure controls, as well as user interfaces and other human-centered aspects of security and privacy. Our security and privacy efforts cover a broad range of systems including mobile, cloud, distributed, sensors and embedded systems, and large-scale machine learning.
Recent Publications
Preview abstract
Traditional privacy user studies are often hindered by high costs and limited scalability. We introduce PersonaSimulator, a framework that simulates these studies using LLMs. By grounding synthetic personas in real-world survey data, PersonaSimulator creates representative individuals that mirror target populations in terms of demographics and attitudes. The system employs theoretical templates—such as Privacy Calculus and Protection Motivation Theory—to standardize decision-making logic. Through an iterative optimization procedure, these personas are refined to be concise and predictive of unseen human responses. Evaluated across five datasets, PersonaSimulator accurately models individual and population-level privacy preferences, providing a cost-effective tool for pilot studies and survey iteration.
View details
OpenClaw in the Wild: Security Analysis of Autonomous Agents
Wanlun Ma
Qing-Long Han
Xiaogang Zhu
Wei Zhou
Junwu Xiong
Peter Ren
Sheng Wen
Yang Xiang
IEEE/CAA Journal of Automatica Sinica, 13 (2026), pp. 1257 - 1273
Preview abstract
Autonomous self-hosted AI agent platforms are rapidly evolving from prompt-response assistants into persistent systems that can maintain long-lived state, invoke tools, ingest external content, and execute environment-changing actions. While this transition enables practical automation, it also introduces lifecycle security risks that cannot be fully explained by prompt-level analysis alone. In this paper, we present a security analysis of OpenClaw as a representative autonomous agent operating environment. We further frame OpenClaw as a concrete case study for broader security challenges in emerging agent ecosystems. We adopt a trust-boundary-first perspective and analyze how attacks propagate across five boundary classes: Channel-Access, Session-and-State, Tool-Execution, External-Content, and Extension Supply-Chain. Our results show that threats such as indirect prompt injection, memory poisoning, unsafe tool invocation, data exfiltration, and malicious skill abuse are not isolated anomalies; they are stage-specific manifestations of a common systems problem in which untrusted influence progressively crosses into higher-privilege contexts. Building on this analysis, we discuss defense-in-depth implications for OpenClaw deployments, including boundary-aware isolation, capability-scoped tool mediation, memory integrity controls, extension governance, and evidence-oriented operational oversight. The study provides a practical framework for evaluating and hardening long-running, tool-capable, autonomous AI agents in realistic deployment settings.
View details
Preview abstract
We introduce a new Bayesian perspective on the concept of data reconstruction, and leverage this viewpoint to propose a new security definition that, in certain settings, provably prevents reconstruction attacks. We use our paradigm to shed new light on one of the most notorious attacks in the privacy and memorization literature - fingerprinting code attacks (FPC). We argue that these attacks are really a form of membership inference attacks, rather than reconstruction attacks. Furthermore, we show that if the goal is solely to prevent reconstruction (but not membership inference), then in some cases the impossibility results derived from FPC no longer apply.
View details
Hybrid Reputation Routing for Decentralized Networks: A Blockchain-Enabled Secure and Scalable Protocol with On-Chain/Off-Chain Partitioning
Praveen Baskar
Om Narayan
Ramkinker Singh
2026
Preview abstract
Our suggestion is a hybrid reputation-based routing
protocol in the context of decentralized routing. networks which
partitions trust measurements to on-chain immutable logs and
off-chain dynamic computations to attain security and scalability.
The protocol incorporates a layer of sharded blockchain to store
critical. trust data and local reputation model to do real-time
updates, enabling routing choices that cannot be tampered with.
performance. The trust ledger which operated on-chain kept
the records of the impartiality of. Historical performance and
node identities, whereas the off-chain reputation engine uses
graph neural network to calculate dynamic. real-time scores like
packet delivery rate to be trusted. and latency. Additionally, it
uses rollup-based batches of synchronization off-chain. optimistic
updates to zero-knowledge proofs, making on-chain efficient.
checking with minimum overhead. The suggested approach
replaces conventional network discovery and forwarding modules
using trust-based adjacency lists and trust-based pathing, and
thus enhancing routing consistency over adversarial settings.
Moreover, the structure integrates Hyperledger Fabric with.
Graph Attention Network-based high-throughput sharded ledger
operations. to update reputation in a privacy-preserving manner,
proving to be linear. network size scalability. The experimental
findings indicate that the system supports 10,000 transactions per
shard and produces. Under 100 ms per ZK-Rollup proof, which
is appropriate to large-scale IoT. and DeFi deployments. This
publication fills the gap between pure on-chain. and off-chain
reputation systems, which provides a viable solution to scalable
and secure decentralized routing.
View details
Preview abstract
The Private Aggregation of Teacher Ensembles (PATE) framework enables privacy-preserving machine learning by aggregating responses from disjoint subsets of sensitive data. Adaptations of PATE to tasks with inherent output diversity such as text generation, where the desired output is a sample from a distribution, face a core tension: as diversity increases, samples from different teachers are less likely to agree, but lower agreement results in reduced utility for the same privacy requirements. Yet suppressing diversity to artificially increase agreement is undesirable, as it distorts the output of the underlying model, and thus reduces output quality.
We propose Hot PATE, a variant of PATE designed for diverse generative settings. We formalize the notion of a diversity-preserving ensemble sampler and introduce an efficient sampler that provably transfers diversity without incurring additional privacy cost. Hot PATE requires only API access to proprietary models and can be used as a drop-in replacement for existing Cold PATE samplers. Our empirical evaluations corroborate and quantify the benefits, showing significant improvements in the privacy–utility trade-off on evaluated in-context learning tasks, both in preserving diversity and in returning relevant responses.
View details
Preview abstract
Modern user interfaces are complex composites, with elements originating from various sources, such as the operating system, apps, a web browser, or websites. Many security and privacy models implicitly depend on users correctly identifying an element's source, a concept we term ''surface attribution.'' Through two large-scale vignette-based surveys (N=4,400 and N=3,057), we present the first empirical measurement of this ability.
We find that users struggle, correctly attributing UI source only 55% of the time on desktop and 53% on mobile. Familiarity and strong brand cues significantly improve accuracy, whereas UI positioning, a long-held security design concept especially for browsers, has minimal impact. Furthermore, simply adding a ''Security & Privacy'' brand cue to Android permission prompts failed to improve attribution. These findings demonstrate a fundamental gap in users' mental models, indicating that relying on them to distinguish trusted UI is a fragile security paradigm.
View details
Some of our teams
×
![]()