PeopleofSuperintelligence

Researcher

Milad Nasr

Milad Nasr is a security and privacy researcher whose attacks and audits show what machine-learning models reveal about their training data. He began an MS/PhD program at the University of Massachusetts Amherst in 2015 and was a research scientist at Google Brain from 2022 to 2023, at Google DeepMind from 2023 to 2025, and at OpenAI from 2025 to 2026. In 2023, his privacy-auditing papers won a USENIX Security Distinguished Paper Award and a NeurIPS Outstanding Paper award, and he was first author of a paper that extracted training data from ChatGPT. Stealing Part of a Production Language Model, a paper he coauthored, won an ICML 2024 Best Paper award. He is a research scientist at Anthropic, where he works at the intersection of computer security and language models.

Now at
Anthropic
Works
73
Citations
5,484
h-index
21
Badges

Publication numbers from OpenAlex, as of 22 October 2026.

Timeline

  1. 2015–2017

    Graduate study at UMass Amherst

    He starts an MS/PhD program at the University of Massachusetts Amherst in 2015 and finishes the master's degree in 2017. He is a member of the Secure, Private INternet (SPIN) group under Amir Houmansadr.

  2. 2018–2019

    White-box membership inference attacks

    In December 2018, he posts a paper with Reza Shokri and Amir Houmansadr that designs white-box inference attacks against centralized and federated deep learning. It appears at the 2019 IEEE Symposium on Security and Privacy.

  3. 2022–2023

    Research scientist at Google Brain

    With a PhD in computer science, he works as a research scientist at Google Brain from 2022 to 2023, mostly on the security and privacy of AI.

  4. 2023

    USENIX and NeurIPS paper awards

    Tight Auditing of Differentially Private Machine Learning, written with Jamie Hayes, Thomas Steinke, Borja Balle, Florian Tramèr, Matthew Jagielski, Nicholas Carlini and Andreas Terzis, wins a Distinguished Paper Award at USENIX Security 2023. Privacy Auditing with One (1) Training Run, written with Thomas Steinke and Matthew Jagielski, receives a NeurIPS 2023 Outstanding Paper award.

  5. 2023–2025

    Training data pulled from ChatGPT

    He is a research scientist at Google DeepMind from 2023 to 2025. In November 2023, he is first author of Scalable Extraction of Training Data from (Production) Language Models, which extracts gigabytes of training data from open-source, semi-open and closed models such as ChatGPT, using a new divergence attack on the aligned chatbot.

  6. 2024

    An ICML 2024 Best Paper

    Stealing Part of a Production Language Model, written with Nicholas Carlini, Florian Tramèr and other coauthors, wins a Best Paper award at ICML 2024. Its attack recovers the embedding projection layer of a transformer model through typical API access and extracts the full projection matrix of OpenAI's Ada and Babbage models.

  7. 2025–2026

    Research scientist at OpenAI

    He is a research scientist at OpenAI from 2025 to 2026, where he researches AI security and privacy.

  8. As of October 2026

    Computer security at Anthropic

    He is a research scientist at Anthropic, where he works at the intersection of computer security and language models. His research there focuses on how language models affect the future of computer security.

Career

  1. Since 2026AnthropicResearch scientist
  2. 2025–2026OpenAIResearch scientist
  3. 2023–2025Google DeepMindResearch scientist
  4. 2022–2023Google BrainResearch scientist
  5. 2022–2025Google

Education

  1. From 2015University of Massachusetts AmherstMS/PhD student

From the biography and OpenAlex affiliations (the years of papers that list the organization), so some years are approximate.

Most-cited works

  1. Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning2019 · IEEE Symposium on Security and Privacy · 1,727 citations
  2. Gemini: A Family of Highly Capable Multimodal Models2023 · 988 citationsWith Angeliki Lazaridou, Anja Hauth, Clemens Meyer, David Silver, Emily Pitler and Fabio Viola
  3. Membership Inference Attacks From First Principles2022 · IEEE Symposium on Security and Privacy · 528 citationsWith Nicholas Carlini
  4. Machine Learning with Membership Privacy using Adversarial Regularization2018 · ACM SIGSAC Conference on Computer and Communications Security (CCS) · 457 citations
  5. Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context2024 · 302 citationsWith George van den Driessche, Paul Barham and Roy Frostig

From OpenAlex, as of 21 October 2026.

  1. 22 of 133 people shaping AI with a former OpenAI role now work at AnthropicIncludes Milad Nasr. Our estimates of where OpenAI recruits came from and where 133 people with former OpenAI roles work now, including the companies and labs they founded.
  2. The median h-index is 48 at universities and 14 at frontier AI labsIncludes Milad Nasr. The median h-index is 48 at universities and 14 at frontier AI labs. We compare publishing careers, recent citations, dual appointments and job moves across 2,420 university researchers and 308 frontier-lab researchers.
  3. Of 943 people shaping AI who worked at Google, 446 work there nowIncludes Milad Nasr. Our estimates of where the 943 people shaping AI who worked at Google and Google DeepMind work now: 446 at Google and 452 across 278 other organizations.
  4. Google alumni have founded or led 133 other organizations, more than any other AI labIncludes Milad Nasr. We estimate that alumni of 17 major AI labs went on to found or lead 350 other organizations, including 226 they founded, and we trace 472 career moves directly between 23 labs since 2010.

Colleagues

People named in this biography, and people with dated positions at the same organization in the same years.

Sources and credits

Photo: We have no published photo of Milad Nasr yet. Send us a free-licensed photo.

  1. Milad Nasr web.archive.org. Checked 20 October 2026.
  2. [1812.00910] Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning arxiv.org. Checked 20 October 2026.
  3. Milad Nasr srxzr.com. Checked 20 October 2026.
  4. Tight Auditing of Differentially Private Machine Learning | USENIX usenix.org. Checked 20 October 2026.
  5. NeurIPS 2023 Awards neurips.cc. Checked 20 October 2026.
  6. [2311.17035] Scalable Extraction of Training Data from (Production) Language Models arxiv.org. Checked 20 October 2026.
  7. ICML 2024 Awards icml.cc. Checked 20 October 2026.
  8. [2403.06634] Stealing Part of a Production Language Model arxiv.org. Checked 20 October 2026.
  9. Milad Nasr - MATS Mentor matsprogram.org. Checked 20 October 2026.