PeopleofSuperintelligence

Researcher

Matthew Jagielski

Matthew Jagielski is a machine learning researcher who studies security, privacy and memorization in machine learning systems, from data poisoning to model stealing. During a computer science PhD at Northeastern University, advised by Alina Oprea and Cristina Nita-Rotaru, he studied poisoning attacks on regression models and coauthored a 2021 attack that extracted verbatim training data from GPT-2. He joined Google as a research scientist in September 2021 and moved to Google DeepMind in April 2023; his privacy auditing paper with Thomas Steinke and Milad Nasr won a NeurIPS 2023 outstanding paper award. Stealing part of a production language model, a paper he coauthored with Nicholas Carlini and others, recovered the embedding projection layer of black-box production models through API access and won an ICML 2024 Best Paper award. Since September 2025, he is a member of technical staff on Ethan Perez's team at Anthropic.

Now at
Anthropic
Works
91
Citations
3,822
h-index
22
Badges

Publication numbers from OpenAlex, as of 22 October 2026.

Timeline

  1. 2016–2021

    PhD at Northeastern

    A Portland, Oregon native with a BS from the University of Oregon, he is a computer science PhD student at Northeastern University's Khoury College of Computer Sciences from September 2016 to August 2021. Alina Oprea and Cristina Nita-Rotaru advise him in the Network and Distributed Systems Security Lab (NDS2), and he receives his PhD from Northeastern.

  2. 2018

    Poisoning attacks on regression

    In 2018, he is first author of Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning, accepted at the 39th IEEE Symposium on Security and Privacy. The paper, with Alina Oprea, Cristina Nita-Rotaru, Bo Li and others, studies poisoning attacks on linear regression models and proposes a defense with formal guarantees.

  3. 2019–2020

    Model extraction with Google Brain

    From April 2019 to August 2019, he is a research intern at Google in Mountain View, working on model extraction. At USENIX Security 2020, he is lead author of High Accuracy and High Fidelity Extraction of Neural Networks, listed at Northeastern University and Google Brain, with Nicholas Carlini, David Berthelot, Alex Kurakin and Nicolas Papernot. The paper studies attacks in which an adversary steals a copy of a deployed model through its prediction access.

  4. 2020–2021

    Extracting training data from GPT-2

    In 2020, with Jonathan Ullman and Alina Oprea, he uses data poisoning attacks to test whether differentially private SGD offers better privacy in practice than its analysis guarantees. In 2021, he coauthors Extracting Training Data from Large Language Models at USENIX Security, an attack that recovers hundreds of verbatim sequences from GPT-2's training data, including names, phone numbers and email addresses.

  5. 2021–2025

    Research scientist at Google

    He joins Google as a research scientist in September 2021 and moves to Google DeepMind in April 2023, where he works at the intersection of security, privacy and machine learning until August 2025.

  6. 2023

    Two privacy auditing awards

    In 2023, Tight Auditing of Differentially Private Machine Learning, written with Milad Nasr, Florian Tramèr, Nicholas Carlini and other Google DeepMind coauthors, wins a Distinguished Paper Award at USENIX Security. His paper Privacy Auditing with One (1) Training Run, with Thomas Steinke and Milad Nasr, receives an outstanding paper award at NeurIPS 2023; it audits differentially private machine learning systems with a single training run.

  7. 2024

    An ICML Best Paper

    With Nicholas Carlini, Florian Tramèr and ten other coauthors, he writes Stealing part of a production language model, which wins a Best Paper award at ICML 2024. The attack recovers the embedding projection layer of black-box production models, including OpenAI's Ada and Babbage, through typical API access. In 2024, he also gives the TPDP keynote talk "Data and Privacy in Data Privacy".

  8. Since September 2025

    Member of technical staff at Anthropic

    In September 2025, he joins Anthropic as a member of technical staff on Ethan Perez's team. His work covers security, privacy and memorization in machine learning systems, including privacy auditing, data poisoning and model stealing. In 2025, he co-organizes the 18th AISec workshop at CCS 2025 with Maura Pintor and Ruoxi Jia.

Career

  1. Since 2025AnthropicMember of technical staff
  2. 2023–2025Google DeepMindResearch scientist
  3. 2023–2025ETH Zurich
  4. 2019–2023GoogleResearch intern, Research scientist

Education

  1. 2021Northeastern UniversityPhD
  2. University of OregonBS

From the biography and OpenAlex affiliations (the years of papers that list the organization), so some years are approximate.

Most-cited works

  1. Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning2018 · IEEE Symposium on Security and Privacy · 861 citationsWith Battista Biggio
  2. Extracting Training Data from Large Language Models2020 · 727 citationsWith Dawn Song and Nicholas Carlini
  3. Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attacks2018 · 218 citationsWith Battista Biggio and Fabio Roli
  4. Extracting Training Data from Diffusion Models2023 · 206 citationsWith Milad Nasr and Nicholas Carlini
  5. Quantifying Memorization Across Neural Language Models2022 · 204 citationsWith Nicholas Carlini

From OpenAlex, as of 21 October 2026.

  1. The median h-index is 48 at universities and 14 at frontier AI labsIncludes Matthew Jagielski. The median h-index is 48 at universities and 14 at frontier AI labs. We compare publishing careers, recent citations, dual appointments and job moves across 2,420 university researchers and 308 frontier-lab researchers.
  2. Of 943 people shaping AI who worked at Google, 446 work there nowIncludes Matthew Jagielski. Our estimates of where the 943 people shaping AI who worked at Google and Google DeepMind work now: 446 at Google and 452 across 278 other organizations.
  3. 16% of AI career moves in the 2020s went from a university to a companyIncludes Matthew Jagielski. We estimate that 16% of AI career moves in the 2020s went from a university to a company; 29% of moves starting at a university went to a company, and 76% ended the university role.
  4. The Massachusetts Institute of Technology trained or employed 44 of the 187 AI major-prize winners, more than any other universityIncludes Matthew Jagielski. The Massachusetts Institute of Technology trained or employed 44 of the 187 AI major-prize winners, more than any other university. We compare doctorate and 5+ year employment links, career timing and current workplaces for 187 major-prize and 1,111 best-paper winners.

Colleagues

People named in this biography, and people with dated positions at the same organization in the same years.

Sources and credits

Photo: We have no published photo of Matthew Jagielski yet. Send us a free-licensed photo.

  1. Matthew Jagielski jagielski.github.io. Checked 20 October 2026.
  2. Matthew Jagielski - Khoury College of Computer Sciences khoury.northeastern.edu. Checked 20 October 2026.
  3. Matthew Jagielski | alphaXiv alphaxiv.org. Checked 20 October 2026.
  4. [1804.00308] Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning arxiv.org. Checked 20 October 2026.
  5. High Accuracy and High Fidelity Extraction of Neural Networks | USENIX usenix.org. Checked 20 October 2026.
  6. [2006.07709] Auditing Differentially Private Machine Learning: How Private is Private SGD? arxiv.org. Checked 20 October 2026.
  7. Extracting Training Data from Large Language Models | USENIX usenix.org. Checked 20 October 2026.
  8. Our CSIRO’s Cybersecurity seminars – Cybersecurity and Quantum Systems research.csiro.au. Checked 20 October 2026.
  9. Tight Auditing of Differentially Private Machine Learning | USENIX usenix.org. Checked 20 October 2026.
  10. NeurIPS 2023 Awards neurips.cc. Checked 20 October 2026.
  11. ICML 2024 Awards icml.cc. Checked 20 October 2026.