Ben Y. Zhao

I am a Neubauer Professor of Computer Science at University of Chicago. Together with Prof. Heather Zheng, I co-direct the SAND Lab (Security, Algorithms, Networking and Data) at University of Chicago. I have a PhD in Computer Science (UC Berkeley 2004, advisors John Kubiatowicz and Anthony Joseph), MS (UC Berkeley 2000), BS in Computer Science (Yale 1997). During my PhD, I created the Tapestry distributed hash table (dissertation). Years ago, I used to work in networking, social networks, wireless, data mining, and some HCI. For the last 10+ years, I have focused on security and privacy in machine learning systems. Since 2022, I have focused on adversarial machine learning and tools to mitigate harms of generative AI models against human creatives. Today, I generally publish at CCS/Oakland/USENIX Security, with some NeurIPS, CVPR, IMC, CHI sprinkled in. Here's a wordle of paper abstracts around 2024-2026. Back when my kids were small and I had "free time," I wrote about research and PhD life on Quora. Awards: ACM Fellow (2021), Concept Art Association Community Impact Award (2024), TIME Magazine AI/100 (100 Most influential people in AI) (2024), USENIX Internet Defense Prize (2023), Chicago Innovation Award (2023), TIME Magazine Best Inventions Special Mention (2023), NSF CAREER award (2005), MIT Tech Review TR-35 (Young Innovators Under 35) (2006), IEEE Internet Technical Committee Early Career Award (2014), ComputerWorld's Top 40 Technology Innovators under 40.
Distinguished/Best/Test of Time Award papers at CCS, USENIX Security, CHI, SIGMETRICS, ASPLOS.

Teaching, Spring 2026
CMSC 25800-1 (Adversarial Machine Learning), Tu/Th 9:30-10:50AM, Ryerson 276
CMSC 25800-2 (Adversarial Machine Learning), Tu/Th 11:00-12:20PM, Ryerson 276
NOTE: class will move to Rosenwald 015 on March 26 and for the remainder of the quarter.

This is a new course (one of the first for undergraduates in the country) that covers the security and privacy issues inherent in machine learning and AI. We will cover fundamental vulnerabilities for deep neural networks and generative AI architectures, optimization based attacks, (black-box/white-box) evasion attacks, (dirty-label/clean-label) poison attacks, detection/filtering/removal defenses, privacy attacks (membership inference and model extraction). Homework assignments will involve attack generation/defenses, model training/fine-tuning, and experiments on latest generation DNNs and genAI models. (Class limited to undergrads satisfying prerequisites and by instructor permission).

Press/Media: Recent media coverage of our research, including New York Times articles (by the amazing Kashmir Hill) on our art anti-mimicry tool Glaze, our image cloaking tool Fawkes, and our Bracelets of Silence, an ultrasonic, wearable microphone jammer for personal privacy.

Project Links

• Nightshade: proactive content copyrights, Website/paper/downloads
• Glaze: protecting artists against style mimicry, Website/paper/downloads
• Forensics for Poison Attacks on DNNs, Website/code/slides
• Blacklight: scalable defense for DNNs against black-box attacks, Website/code
• Fawkes: image cloaking against facial recognition, Code/Paper/Video/Media and News
• Neural Cleanse: detecting/mitigating backdoors in DNNs, Code/Paper
• Bracelets of Silence: wearable ultrasonic jammers, Project/papers/code/video.

I read all my emails. But due to the volume of emails, I am often unable to reply to individual emails. If you are looking for a summer undergraduate internship, please do not email me directly. UChicago CS has organized a summer undergraduate internship program with more info here. If you are a high school student or undergraduate looking for a summer internship related to data, you might be interested in the DSI Data and Computing Summer Lab. SAND Lab is involved in both programs, although the number of interns we take each summer can vary depending on the applicant pool.

UChicago Undergraduates interested in research?
We generally advise 3-5 undergraduates in my lab in active research. If you're experienced in ML and interested in working in my lab as an undergrad, drop me an email. Generally speaking, the best way to join my lab as an undergrad is to take and do well in my course in adversarial ML.