Karn Seth
I'm a Staff Software Engineer in Private Computing (Privacy, Safety, and Security), where I serve as Tech Lead for Confidential Match and work on Private Join and Compute, including maintaining the associated open source repository. More broadly, I'm very interested in the use of Secure Multiparty Computation, Private Set Intersection, Homomorphic Encryption, and Differential Privacy for privacy-preserving measurement, analytics, and machine learning, with a special focus on practical deployment. I'm also increasingly interested in the intersection of AI and cryptography: using AI to help design, analyze, and verify cryptographic protocols, and using cryptography to make machine learning more private.
In the past, I've worked with folks on Federated Machine Learning and Analytics, including the development of the Secure Aggregation protocol, which was featured in the Federated Learning Comic.
I've had the pleasure of hosting/co-hosting an incredible group of interns and student researchers:
- 2025, 2026: Kanav Gupta (University of Maryland, intern in 2025 and student researcher in 2026)
- 2023, 2024: Jim Choncholas (Georgia Tech, intern in 2023 and student researcher in 2024; now at Google)
- 2021, 2022: Stan Peceny (Georgia Tech, now at Google), Amit Agarwal (University of Illinois Urbana-Champaign, now at Google)
- 2020: Mahimna Kelkar (Cornell Tech, starting as Assistant Professor at Purdue University), Le Phi Hung (Now at Google)
- 2019: Ni Trieu (Now at Arizona State University), Marshall Ball (Now at NYU)
- 2018: Peihan Miao (Brown University)
- 2017: Jonathan Frankle (MIT, now at Databricks)
- 2016: Antonio Marcedone (Now at Zoom)
I completed my PhD in 2016 under the supervision of Dr. Rafael Pass. Here's a link to my External Google Scholar Profile.
Research Areas
Authored Publications
Sort By
Hadal: Centralized Label DP Training without a Trusted Party
James Choncholas
Stanislav Peceny
Amit Agarwal
Baiyu Li
2026 IEEE Symposium on Security and Privacy (SP)
Preview abstract
In the Label Differential Privacy (Label DP) setting where machine learning training data is vertically partitioned between feature and label holders, centralized Differential Privacy approaches have shown superior utility compared to local approaches in high-privacy regimes. However, these centralized approaches typically require a trusted third party to compute the gradient. We introduce POSTSCALE, a novel training protocol based on Homomorphic Encryption with a ciphertext multiplicative depth of one, and no ciphertext rotations for models with affine gradient functions and few output classes. Furthermore, we present Hadal, a dataflow-based framework for encrypted computation, and Hadal-ml, a machine learning package tailored for Label DP, implementing our POSTSCALE protocol. Our approach leverages HE to enable centralized Differential Privacy without relying on a trusted third party. By integrating with TensorFlow, our framework Hadal supports both eager and deferred execution modes, while providing HE-specific optimizations and comprehensive performance profiling capabilities. Experimental results demonstrate that our approach achieves model utility comparable to existing centralized label DP techniques, surpasses local DP, and maintains privacy guarantees without relying on a trusted party.
View details
Prior-Based Label Differential Privacy via Secure Two-Party Computation
Amit Agarwal
Stanislav Peceny
Proceedings of the 2025 ACM Asia Conference on Computer and Communications Security (AsiaCCS)
Preview abstract
Differential privacy (DP) is a fundamental technique used in machine learning (ML) training for protecting the privacy of sensitive individual user data. In the past few years, a new approach for combining prior-based Local Differential Privacy (LDP) mechanisms with a relaxed DP criteria, known as Label DP, has shown great promise in increasing the utility of the final trained model without compromising on the DP privacy budget. In this work, we identify a crucial privacy gap in the current implementations of these prior-based LDP mechanisms, and show how it can be addressed efficiently using two-party secure computation (2PC). To that end, we design simple and efficient 2PC protocols for addressing this gap, implement them, and perform end-to-end testing on standard datasets such as MNIST and CIFAR-10. Our empirical results indicate that the added security benefit essentially comes for free in the sense that the gap between the current insecure implementations and our proposed secure version, in terms of run-time overhead and accuracy degradation, is minimal.
View details
Communication-Efficient Secure Logistic Regression
Amit Agarwal
Stanislav Peceny
2024 IEEE 9th European Symposium on Security and Privacy (EuroS&P)
Preview abstract
We present a new two party construction for secure training of logistic regression which enables two parties to process private data to build logistic models without learning anything more about the data than the designated output. Our construction improves the communication cost of the online work stage which is executed once the inputs become available. As part of our construction we develop many building blocks which are of independent interest including a new approximation technique for the sigmoid functionality which results in a secure evaluation protocol with better communication. Further, we develop secure spline evaluation and secure powers computation protocol for values with fixed-point representation as well as a new comparison protocol that optimizes online communication. We present a new two party computation construction for DPF keys that evaluate arithmetic shares of the function evaluation output over large rings, while previous construction do this only for boolean outputs. We benchmark the costs of our constructions and compare with previous works.
View details
Preview abstract
In this paper we introduce a new primitive called anonymous counting tokens (ACTs) which effectively allow clients to obtain blind signatures on messages of their choice, and in addition allow enforcing rate limiting on the number of tokens that a client can obtain for each message. In particular, we enforce that each client will be able to obtain only one token per message. We enable this new property while maintaining the unforgeability and unlinkability properties required for anonymous token schemes. We present three ACT constructions which are based on different hardness assumptions including q-DHI in the RO model, SXDH in bilinear groups with or without RO, and finally the generic bilinear group model. We estimate the efficiency costs that each construction offers.
View details
Preview abstract
We introduce the first construction for secure two-party computation of Poisson regression,
which enables two parties who hold shares of the input samples to learn only the resulting
Poisson model while protecting the privacy of the inputs.
Our construction relies on new protocols for secure fixed-point exponentiation and correlated matrix multiplications. Our secure exponentiation construction avoids expensive bit
decomposition and achieves orders of magnitude improvement in both online and offline costs
over state of the art works. As a result, the dominant cost for our secure Poisson regression
are matrix multiplications with one fixed matrix. We introduce a new technique, called correlated Beaver triples, which enables many such multiplications at the cost of roughly one matrix
multiplication. This further brings down the cost of secure Poisson regression.
We implement our constructions and show their extreme efficiency. In a LAN setting, our
secure exponentiation for 20-bit fractional precision takes less than 0.07ms with a batch-size of
100,000. One iteration of secure Poisson regression on a dataset with 10, 000 samples with 1000
binary features needs about 65.82s in the offline phase, 55.14s in the online phase and 17MB
total communication. For several real datasets this translates into training that takes seconds
and only a couple of MB communication
View details
Preview abstract
This document describes a secure mechanism to join sets of heterogeneous ids from multiple data providers (e.g. broadcasters, publishers, data enrichment providers) and create a set of encrypted common identifiers, which we refer to as SUMIDs. These identifiers can be used for computing multi-party reach, frequency, sales lift, MTA, and other ads metrics. We also introduce the concept of “match rules”, which dictate when two heterogeneous IDs should be assigned the same SUMID within the secure mechanism. We avoid prescribing specific match rules as these could vary depending upon a number of considerations, such as the specific media market or whether the SUMID is intended to represent a household or an individual. Optimal choice of match rules are also an open area of research.
View details
Communication–Computation Trade-offs in PIR
Asra Ali
Tancrède Lepoint
Sarvar Patel
Kevin Yeo
30th USENIX Security Symposium (2021)
Preview abstract
We study the computation and communication costs and their possible trade-offs in various constructions for private information retrieval (PIR), including schemes based on homomorphic encryption and the Gentry–Ramzan PIR (ICALP'05).
We improve over the construction of SealPIR (S&P'18) using compression techniques and a new oblivious expansion, which reduce the communication bandwidth by 80% while preserving essentially the same computation cost. We then present MulPIR, a PIR protocol additionally leveraging multiplicative homomorphism to implement the recursion steps in PIR. While using the multiplicative homomorphism has been considered in prior work, we observe that in combination with our other techniques, it introduces a meaningful tradeoff by significantly reducing communication, at the cost of an increased computational cost for the server, when the databases have large entries. For some applications, we show that this could reduce the total monetary server cost by up to 35%.
On the other end of the communication–computation spectrum, we take a closer look at Gentry–Ramzan PIR, a scheme with asymptotically optimal communication rate. Here, the bottleneck is the server's computation, which we manage to reduce significantly. Our optimizations enable a tunable tradeoff between communication and computation, which allows us to reduce server computation by as much as 85%, at the cost of an increased query size.
Finally, we introduce new ways to handle PIR over sparse databases (keyword PIR), based on different hashing techniques. We implement all of our constructions, and compare their communication and computation overheads with respect to each other for several application scenarios.
View details
Preview abstract
The private join and compute (PJC) functionality enables secure computation over data distributed across different databases, and is applicable to a wide range of applications, many of which address settings where the input databases are of significantly different sizes.
We introduce the notion of private information retrieval (PIR) with default, which enables two-party PJC functionalities in a way that hides the size of the intersection of the two databases and incurs sublinear communication cost in the size of the bigger database. We provide two constructions for this functionality, one of which requires offline linear communication, which can be amortized across queries, and one that provides sublinear cost for each query but relies on more computationally expensive tools. We construct inner-product PJC, which has applications to ads conversion measurement and contact tracing, relying on an extension of PIR with default. We evaluate the efficiency of our constructions, which can enable 28 PIR with default lookups on a database of size 2^25 (or inner-product PJC on databases with such sizes) with the communication of 44 MB, which costs less than 0.17 c. for the client and 26.48 c. for the server.
View details
Private Intersection-Sum Protocols with Applications to Attributing Aggregate Ad Conversions
Mihaela Ion
Benjamin Kreuter
Erhan Nergiz
Sarvar Patel
Shobhit Saxena
David Shanahan
2020 IEEE European Symposium on Security and Privacy (EuroS&P), pp. 370-389
Preview abstract
In this work, we discuss our successful efforts for
industry deployment of a cryptographic secure computation
protocol. The problem we consider is privately computing aggregate conversion rate of advertising campaigns.
This underlying functionality can be abstracted as Private
Intersection-Sum (PI-Sum) with Cardinality. In this setting
two parties hold datasets containing user identifiers, and one
of the parties additionally has an integer value associated
with each of its user identifiers. The parties want to learn
the number of identifiers they have in common and the sum
of the integer values associated with these users without
revealing any more information about their private inputs.
We identify the major properties and enabling factors
which make the deployment of a cryptographic protocol
possible, practical, and uniquely positioned as a solution for
the task at hand. We describe our deployment setting and
the most relevant efficiency measure, which in our setting is
communication overhead rather than computation. We also
present a monetary cost model that can be used as a unifying
cost measure and the computation model which reflect out
use-case: a low-priority batch computing.
We present three PI-Sum with cardinality protocols: our
currently deployed protocol, which relies on a Diffie-Hellman
style double masking, and two new protocols which leverage
more recent techniques for private set intersection (PSI) that
use Random Oblivious Transfer and encrypted Bloom filters.
We compare the later two protocol with our original solution
when instantiated with different additively homomorphic
encryption schemes. We implement our constructions and
compare their costs. We also compare with recent generic
approaches for computing on the intersection of two datasets
and show that our best protocol has monetary cost that is
20× less than the best known generic approach.
View details
Two-Sided Malicious Security for Private Intersection-Sum with Cardinality
Peihan Miao
Sarvar Patel
Advances in Cryptology – CRYPTO 2020 (2020), pp. 3-33
Preview abstract
Private intersection-sum with cardinality allows two parties, where each party holds a private set and one of the parties additionally holds a private integer value associated with each element in her set, to jointly compute the cardinality of the intersection of the two sets as well as the sum of the associated integer values for all the elements in the intersection, and nothing beyond that.
We present a new construction for private intersection sum with cardinality that provides malicious security with abort and guarantees that both parties receive the output upon successful completion of the protocol. A central building block for our constructions is a primitive called shuffled distributed oblivious PRF (DOPRF), which is a PRF that offers oblivious evaluation using a secret key shared between two parties, and in addition to this allows obliviously permuting the PRF outputs of several parallel oblivious evaluations. We present the first construction for shuffled DOPRF with malicious security. We further present several new sigma proof protocols for relations across Pedersen commitments, ElGamal encryptions, and Camenisch-Shoup encryptions that we use in our main construction, for which we develop new batching techniques to reduce communication.
We implement and evaluate the efficiency of our protocol and show that we can achieve communication cost that is only 4-5 times greater than the most efficient semi-honest protocol. When measuring monetary cost of executing the protocol in the cloud, our protocol is 25 times more expensive than the semi-honest protocol. Our construction also allows for different parameter regimes that enable trade-offs between communication and computation.
View details
