Milad Nasr
I am a research scientist at Anthropic, where I work at the intersection of computer security and language models. Currently, my research focuses on understanding how language models affect the future of computer security.
I hold a PhD in computer science. I was a research scientist at Google Brain from 2022 to 2023, Google DeepMind from 2023 to 2025, and OpenAI from 2025 to 2026. In these roles, I spent most of my time on the security and privacy of AI.
My work has received best paper awards at NeurIPS, ICML, and USENIX Security, and has been covered in the press.
Selected Recent Works
-
Cryptanalysis of 7-Round AES via the Algebraic Structure of its
S-box
We show how the algebraic structure of the AES S-box can be used to improve attacks on 7-round AES in the single-key setting.
Anthropic technical report, 2026. -
The Attacker Moves Second: Stronger Adaptive Attacks Bypass
Defenses Against LLM Jailbreaks and Prompt Injections
We show that defenses against jailbreaks and prompt injection need to be evaluated against adaptive attackers, not only fixed attack sets.
USENIX Security 2026. -
Scalable Extraction of Training Data from Aligned, Production
Language Models
We showed in previous works models can memorize information about their training data and some of that training data can be extracted from open-source models. In this work, we showed that such extraction is also possible from the best commercial models available at the time of writing the paper. -
Privacy Auditing with One (1) Training Run
Outstanding Paper
Auditing privacy leakage usually requires training many models, which makes it expensive and hard to apply. In this work, we showed that privacy leakage can be estimated from a single training run by testing many examples in parallel, making empirical privacy audits much more practical. -
Tight Auditing of Differentially Private Machine Learning
Distinguished Paper
Previous auditing approaches mostly treated the algorithms as a blackbox. In this work, we instead take advantage of the exact mechanism used inside the system, auditing that mechanism directly and using its structure to get much tighter privacy tests for DP-SGD. -
Extracting Training Data from Diffusion Models
Diffusion models were often discussed as if they generalized rather than copied. In this work, we showed that by generating many samples and filtering for near-duplicates, it is possible to recover training images, including recognizable people and logos, from image generation models.