Mariana Raykova
I work in the areas of cryptography and security. I am interested in both theoretical work that develops new cryptographic tools and applied cryptography projects that aim to use and implement cryptographic protocols in systems in order to enhance their security properties. My research includes work in the areas of secure computation, oblivious data structures, zero knowledge and verifiable computation, obfuscation.
I received my PhD from the Computer Science Department of Columbia University and I was co-advised by Tal Malkin and Steve Bellovin. After my PhD I spent a year as a postdoc at the Cryptography Group at IBM Research Watson. I was a Research Scientist at the Computer Science Laboratory at SRI International between 2013 and 2015. Following that I was an Assistant Professor at the Department of Computer Science at Yale University between 2016 and 2018. I joined Google as a Research Scientist in 2019.
I received my PhD from the Computer Science Department of Columbia University and I was co-advised by Tal Malkin and Steve Bellovin. After my PhD I spent a year as a postdoc at the Cryptography Group at IBM Research Watson. I was a Research Scientist at the Computer Science Laboratory at SRI International between 2013 and 2015. Following that I was an Assistant Professor at the Department of Computer Science at Yale University between 2016 and 2018. I joined Google as a Research Scientist in 2019.
Research Areas
Authored Publications
Sort By
Open and Emergent Problems in Agentic Privacy and Security: A Contextual Angle
Sahar Abdelnabi
Borja de Balle Pigem
Sebastian Benthall
Eleanor Birrell
Kamalika Chaudhuri
Madiha Zahrah Choksi
Rachel Cummings
Adam Davies
Dj Dvijotham
Seliem El-Sayed
Ferdinando Fioretto
Matt Franchi
Adria Gascon
Roxana Geambasu
Sahra Ghalebikesabi
Hamed Haddadi
Jamie Hayes
Ashish Hooda
Amir Houmansadr
Somesh Jha
Chloé Kiddon
Tadayoshi Kohno
Abdullatif Köksal
Haoran Li
Tianshi Li
Nathan Malkin
Sarah Meiklejohn
Niloofar Mireshghallah
Sewoong Oh
Katherine Ortiz
Francesco Pinto
Franziska Roesner
Edo Roth
Jacqueline Rowe
Khawaja Shams
Ilia Shumailov
Yan Shvartzshnaider
Dawn Song
Jose Such
Octavian Suciu
Pierre Tholoniat
Trishita Tiwari
Hal Triedman
Ren Yi
Wen Zhang
Xuhui Zhou
Kassem Fawaz
Stefan Mellem
Helen Nissenbaum
Google (2026)
Preview abstract
The vision of an ecosystem of general and highly capable autonomous agents challenges accepted principles of secure and privacy-preserving system engineering. Inspired by the theory of Contextual Integrity, we argue that in order for agents to act appropriately, their behaviors should comply with societal norms and expectations. This manuscript explores contextual approaches to engineering agentic systems that embody an understanding of societal norms and uphold the appropriateness of actions by design. It presents a list of key open research problems in this area to create awareness among the broader research community across academia, government, and industry.
View details
Hadal: Centralized Label DP Training without a Trusted Party
James Choncholas
Stanislav Peceny
Amit Agarwal
Baiyu Li
2026 IEEE Symposium on Security and Privacy (SP)
Preview abstract
In the Label Differential Privacy (Label DP) setting where machine learning training data is vertically partitioned between feature and label holders, centralized Differential Privacy approaches have shown superior utility compared to local approaches in high-privacy regimes. However, these centralized approaches typically require a trusted third party to compute the gradient. We introduce POSTSCALE, a novel training protocol based on Homomorphic Encryption with a ciphertext multiplicative depth of one, and no ciphertext rotations for models with affine gradient functions and few output classes. Furthermore, we present Hadal, a dataflow-based framework for encrypted computation, and Hadal-ml, a machine learning package tailored for Label DP, implementing our POSTSCALE protocol. Our approach leverages HE to enable centralized Differential Privacy without relying on a trusted third party. By integrating with TensorFlow, our framework Hadal supports both eager and deferred execution modes, while providing HE-specific optimizations and comprehensive performance profiling capabilities. Experimental results demonstrate that our approach achieves model utility comparable to existing centralized label DP techniques, surpasses local DP, and maintains privacy guarantees without relying on a trusted party.
View details
On the Differential Privacy and Interactivity of Privacy Sandbox Reports
Charlie Harrison
Pritish Kamath
Alexander Knop
Ethan Leeman
Vikas Sahu
PETS (2025)
Preview abstract
The Privacy Sandbox initiative from Google includes APIs for enabling privacy-preserving advertising functionalities as part of the effort to limit third-party cookies. In particular, the Private Aggregation API (PAA) and the Attribution Reporting API (ARA) can be used for ad measurement while providing different guardrails for safeguarding user privacy, including a framework for satisfying differential privacy (DP). In this work, we provide an abstract model for analyzing the privacy of these APIs and show that they satisfy a formal DP guarantee under certain assumptions. Our analysis handles the case where both the queries and database can change interactively based on previous responses from the API.
View details
Preview abstract
Local differential privacy (LDP) enables individuals to report sensitive data while preserving privacy.
Unfortunately, LDP mechanisms are vulnerable to poisoning attacks, where adversaries controlling a
fraction of the reporting users can significantly distort the aggregate output–much more so than in a
non-private solution where the inputs are reported directly. In this paper, we present two novel solutions
that prevent poisoning attacks under LDP while preserving its privacy guarantees. Our first solution,
Vϵrity-Auth, addresses scenarios where the users report inputs with a ground truth available to a third
party. The second solution, Vϵrity, tackles the more challenging case in which the users locally generate
their input and there is no ground truth which can be used to bootstrap verifiable randomness generation.
View details
Prior-Based Label Differential Privacy via Secure Two-Party Computation
Amit Agarwal
Stanislav Peceny
Proceedings of the 2025 ACM Asia Conference on Computer and Communications Security (AsiaCCS)
Preview abstract
Differential privacy (DP) is a fundamental technique used in machine learning (ML) training for protecting the privacy of sensitive individual user data. In the past few years, a new approach for combining prior-based Local Differential Privacy (LDP) mechanisms with a relaxed DP criteria, known as Label DP, has shown great promise in increasing the utility of the final trained model without compromising on the DP privacy budget. In this work, we identify a crucial privacy gap in the current implementations of these prior-based LDP mechanisms, and show how it can be addressed efficiently using two-party secure computation (2PC). To that end, we design simple and efficient 2PC protocols for addressing this gap, implement them, and perform end-to-end testing on standard datasets such as MNIST and CIFAR-10. Our empirical results indicate that the added security benefit essentially comes for free in the sense that the gap between the current insecure implementations and our proposed secure version, in terms of run-time overhead and accuracy degradation, is minimal.
View details
Communication-Efficient Secure Logistic Regression
Amit Agarwal
Stanislav Peceny
2024 IEEE 9th European Symposium on Security and Privacy (EuroS&P)
Preview abstract
We present a new two party construction for secure training of logistic regression which enables two parties to process private data to build logistic models without learning anything more about the data than the designated output. Our construction improves the communication cost of the online work stage which is executed once the inputs become available. As part of our construction we develop many building blocks which are of independent interest including a new approximation technique for the sigmoid functionality which results in a secure evaluation protocol with better communication. Further, we develop secure spline evaluation and secure powers computation protocol for values with fixed-point representation as well as a new comparison protocol that optimizes online communication. We present a new two party computation construction for DPF keys that evaluate arithmetic shares of the function evaluation output over large rings, while previous construction do this only for boolean outputs. We benchmark the costs of our constructions and compare with previous works.
View details
Preview abstract
In this paper we introduce a new primitive called anonymous counting tokens (ACTs) which effectively allow clients to obtain blind signatures on messages of their choice, and in addition allow enforcing rate limiting on the number of tokens that a client can obtain for each message. In particular, we enforce that each client will be able to obtain only one token per message. We enable this new property while maintaining the unforgeability and unlinkability properties required for anonymous token schemes. We present three ACT constructions which are based on different hardness assumptions including q-DHI in the RO model, SXDH in bilinear groups with or without RO, and finally the generic bilinear group model. We estimate the efficiency costs that each construction offers.
View details
Preview abstract
We introduce the first construction for secure two-party computation of Poisson regression,
which enables two parties who hold shares of the input samples to learn only the resulting
Poisson model while protecting the privacy of the inputs.
Our construction relies on new protocols for secure fixed-point exponentiation and correlated matrix multiplications. Our secure exponentiation construction avoids expensive bit
decomposition and achieves orders of magnitude improvement in both online and offline costs
over state of the art works. As a result, the dominant cost for our secure Poisson regression
are matrix multiplications with one fixed matrix. We introduce a new technique, called correlated Beaver triples, which enables many such multiplications at the cost of roughly one matrix
multiplication. This further brings down the cost of secure Poisson regression.
We implement our constructions and show their extreme efficiency. In a LAN setting, our
secure exponentiation for 20-bit fractional precision takes less than 0.07ms with a batch-size of
100,000. One iteration of secure Poisson regression on a dataset with 10, 000 samples with 1000
binary features needs about 65.82s in the offline phase, 55.14s in the online phase and 17MB
total communication. For several real datasets this translates into training that takes seconds
and only a couple of MB communication
View details
Distributed, Private, Sparse Histograms in the Two-Server Model
Adria Gascon
James Bell
CCS 2022
Preview abstract
We consider the computation of sparse, (ε, ϑ)-differentially private~(DP) histograms in the two-server model of secure multi-party computation~(MPC), which has recently gained traction in the context of privacy-preserving measurements of aggregate user data. We introduce protocols that enable two semi-honest non-colluding servers to compute histograms over the data held by multiple users, while only learning a private view of the data. Our solution achieves the same asymptotic l∞-error of O(log(1/ϑ)/ε) as in the central model of DP, but without relying on a trusted curator. The server communication and computation costs of our protocol are independent of the number of histogram buckets, and are linear in the number of users, while the client cost is independent of the number of users, ε, and ϑ. Its linear dependence on the number of users lets our protocol scale well, which we confirm using microbenchmarks: for a billion users, ε = 0.5, and ϑ = 10-11, the per-user cost of our protocol is only 1.08 ms of server computation and 339 bytes of communication. In contrast, a baseline protocol using garbled circuits only allows up to 106 users, where it requires 600 KB communication per user.
View details
Communication–Computation Trade-offs in PIR
Asra Ali
Tancrède Lepoint
Sarvar Patel
Kevin Yeo
30th USENIX Security Symposium (2021)
Preview abstract
We study the computation and communication costs and their possible trade-offs in various constructions for private information retrieval (PIR), including schemes based on homomorphic encryption and the Gentry–Ramzan PIR (ICALP'05).
We improve over the construction of SealPIR (S&P'18) using compression techniques and a new oblivious expansion, which reduce the communication bandwidth by 80% while preserving essentially the same computation cost. We then present MulPIR, a PIR protocol additionally leveraging multiplicative homomorphism to implement the recursion steps in PIR. While using the multiplicative homomorphism has been considered in prior work, we observe that in combination with our other techniques, it introduces a meaningful tradeoff by significantly reducing communication, at the cost of an increased computational cost for the server, when the databases have large entries. For some applications, we show that this could reduce the total monetary server cost by up to 35%.
On the other end of the communication–computation spectrum, we take a closer look at Gentry–Ramzan PIR, a scheme with asymptotically optimal communication rate. Here, the bottleneck is the server's computation, which we manage to reduce significantly. Our optimizations enable a tunable tradeoff between communication and computation, which allows us to reduce server computation by as much as 85%, at the cost of an increased query size.
Finally, we introduce new ways to handle PIR over sparse databases (keyword PIR), based on different hashing techniques. We implement all of our constructions, and compare their communication and computation overheads with respect to each other for several application scenarios.
View details
