Saeed Mahloujifar

I am a research scientist at Google DeepMind. I am interested in security and privacy of machine learning and their interplay with foundations of cryptography.

Previously I was a research scientist at FAIR (Meta), and before that a postdoctoral researcher at Princeton University working with Prateek Mittal. I received my Ph.D. from the department of Computer Science at University of Virginia in the summer of 2020.

Publications

* indicates equal contribution. [αβ] indicates alphabetical order.

Papers on which I am a first or last author, or a second author during my time at Princeton.

  • Learning to Reason in 13 Parameters
           John X. Morris, Niloofar Mireshghallah, Mark Ibrahim, Saeed Mahloujifar
            arXiv preprint, 2026
  • Inadvertent Context Leakage in Language Models
           Jaiden Fairoze, Neal Mangaokar, Kamalika Chaudhuri, Sanjam Garg, Saeed Mahloujifar
            NeurIPS, 2026
  • Z0-Inf: Zeroth Order Approximation for Data Influence
           Narine Kokhlikyan, Kamalika Chaudhuri, Saeed Mahloujifar
            NeurIPS, 2026
  • How much can language models memorize?
           John X. Morris, Chawin Sitawarin, Chuan Guo, Narine Kokhlikyan, G. Edward Suh, Alexander M. Rush, Kamalika Chaudhuri, Saeed Mahloujifar
            ICML, 2026. Outstanding Paper Honorable Mention.
  • Auditing f-Differential Privacy in One Run
           Saeed Mahloujifar, Luca Melis, Kamalika Chaudhuri
            ICML, 2025 (oral)
  • Machine Learning with Privacy for Protected Attributes
           Saeed Mahloujifar, Chuan Guo, G. Edward Suh, Kamalika Chaudhuri
            IEEE S&P, 2025
  • Bounding Training Data Reconstruction in DP-SGD
           Jamie Hayes*, Saeed Mahloujifar*, Borja Balle
            NeurIPS, 2023.
  • A Randomized Approach for Tight Privacy Accounting
           Jiachen T. Wang, Saeed Mahloujifar, Tong Wu, Ruoxi Jia, Prateek Mittal
            NeurIPS, 2023.
  • Effectively Using Public Data in Privacy-Preserving Machine Learning
            Milad Nasr, Saeed Mahloujifar, Xinyu Tang, Prateek Mittal, Amir Houmansadr
            ICML, 2023
  • Property Inference from Poisoning
           Saeed Mahloujifar, Esha Ghosh, Melissa Chase.
            IEEE Symposium on Security and Privacy (S&P) 2022
  • PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier
           Chong Xiang, Saeed Mahloujifar, Prateek Mittal.
            USENIX Security Symposium 2022
  • Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecture
           Xinyu Tang, Saeed Mahloujifar, Liwei Song, Virat Shejwalkar, Milad Nasr, Amir Houmansadr, Prateek Mittal.
           USENIX Security Symposium 2022
  • SparseFed: Mitigating Model Poisoning Attacks in Federated Learning with Sparsification
            Ashwinee Panda, Saeed Mahloujifar, Arjun N. Bhagoji, Supriyo Chakraborty, Prateek Mittal.
           International Conference on Artificial Intelligence and Statistics (AISTATS) 2022
  • Improving Adversarial Robustness Using Proxy Distributions.
            Vikash Sehwag, Saeed Mahloujifar, Tinashe Handina, Sihui Dai, Chong Xiang, Mung Chiang, Prateek Mittal.
           International Conference on Learning Representations (ICLR) 2022
  • Polynomial-time targeted attacks on coin tossing for any number of corruptions
            [αβ] Omid Etesami, Ji Gao, Saeed Mahloujifar, and Mohammad Mahmoody.
           Theory of Cryptography Conference (TCC) 2021
  • A Separation result between data-oblivious and data-aware poisoning attacks
            [αβ] Samuel Deng, Sanjam Garg, Somesh Jha, Saeed Mahloujifar, Mohammad Mahmoody, and Abhradeep Thakurta.
            Conference on Neural Information Processing Systems (NeurIPS), 2021.
            A preliminary version presented at the Uncertainty & Robustness in Deep Learning workshop at ICML 2020.
  • Model-targeted Poisoning Attacks with Provable Convergence
            Fnu Suya, Saeed Mahloujifar, Anshuman Suri, David Evans, and Yuan Tian.
            International Conference on Machine Learning (ICML) 2021.
  • Is Private Learning Possible with Instance Encoding?
            [αβ] Nicholas Carlini, Samuel Deng, Sanjam Garg, Somesh Jha, Saeed Mahloujifar, Mohammad Mahmoody, Shuang Song, Abhradeep Thakurta, and Florian Tramér .
            IEEE Symposium on Security and Privacy (S&P) 2021.
            Also presented at the Privacy Preserving Machine Learning workshop at NeurIPS 2020.
  • Adversarially Robust Learning Could Leverage Computational Hardness
            [αβ] Somesh Jha, Sanjam Garg, Saeed Mahloujifar, and Mohammad Mahmoody.
            Algorithmic Learning Theory (ALT), 2020.
  • Computational Concentration of Measure: Optimal Bounds, Reductions, and More.
            [αβ] Omid Etesami, Saeed Mahloujifar, and Mohammad Mahmoody.
            ACM-SIAM Symposium on Discrete Algorithms (SODA), 2020.
  • Emprically Measuring Concentration: Fundamental Limits on Intrinsic Robustness
            Saeed Mahloujifar*, Xiao Zhang*, Mohammad Mahmoody, and David Evans.
            Conference on Neural Information Processing Systems (NeurIPS), 2019 (spotlight).
  • Universal Multi-party Poisoning Attacks
            [αβ] Saeed Mahloujifar, Mohammad Mahmoody, and Ameer Mohammed.
            International Conference on Machine Learning (ICML) 2019.
  • Can Adversarially Robust Learning Leverage Computational Hardness?
            [αβ] Saeed Mahloujifar and Mohammad Mahmoody.
            Algorithmic Learning Theory (ALT), 2019.
  • The Curse of Concentration in Robust Learning: Evasion and Poisoning Attacks from Concentration of Measure
            Saeed Mahloujifar, Dimitrios I. Diochnos, and Mohammad Mahmoody.
            AAAI Conference on Artificial Intelligence, 2019.
  • Adversarial Risk and Robustness: General Definitions and Implications for the Uniform Distribution
            Dimitrios I. Diochnos*, Saeed Mahloujifar*, and Mohammad Mahmoody.
            Conference on Neural Information Processing Systems (NeurIPS), 2018.
  • Learning under p-Tampering Attacks
            Saeed Mahloujifar, Dimitrios I. Diochnos, and Mohammad Mahmoody.
            Algorithmic Learning Theory (ALT), 2018.
            Selected to be presented at ISAIM, 2018.
  • Blockwise p-Tampering Attacks on Cryptographic Primitives, Extractors, and Learners
            [αβ] Saeed Mahloujifar and Mohammad Mahmoody.
            Theory of Cryptography Conference (TCC) 2017.

    • Contact