Research

We introduce full-stack machine learning (FSML) instruction, which teaches students to build large language models and diffusion models from scratch rather than relying on high-level frameworks. In a classroom randomized controlled trial at ETH Zürich (N=208), FSML students scored about 10% higher on assessments of transformers and stable diffusion (p=0.006) and reported greater curiosity and engagement. The paper received the CER Best Paper (Global) award at SIGCSE 2026.

Evaluating the robustness of machine-learning models under covariate shift usually relies on task metrics such as accuracy, which lack a clear theoretical grounding. We extend Posterior Agreement theory to the covariate-shift setting and derive a principled, supervision-free robustness measure. Across adversarial-learning and domain-generalization scenarios, it discriminates robustness more reliably than accuracy-based measures.

S-BDT is a differentially private distributed gradient-boosted decision-tree learner that improves the privacy and utility trade-off by using non-spherical multivariate Gaussian noise, with tight subsampling bounds folded into a Rényi filter for individual privacy accounting. It matches utility while saving roughly 30% to 50% in epsilon across the Abalone, Adult, and Spambase datasets, and improves further on non-IID data streams.

We present the first general, automated, large-scale analysis of cookie-notice compliance. Our crawler interacts with cookie notices, reads declared processing purposes with natural-language processing, and compares them against the cookies actually set, across 97k EU-popular websites. We find that 65.4% of sites offering a rejection option likely collect user data despite explicit negative consent.

Anomaly detection assumes that training and test data share a distribution, which breaks under distribution shift. Using causal inference, we identify a statistical property that ensures invariant representations and derive a regularizer that promotes partial distribution invariance across environments. Across six methods and both synthetic and real tasks, it markedly improves out-of-distribution robustness under covariate and domain shift.

We attack two privacy systems built on locality-sensitive hashing: Google's FLoC advertising proposal and the MinHash Hierarchy for mobile traffic. For FLoC we deanonymize users via Sybil attacks and reconstruct 10% or more of the browsing history for 30% of users using generative adversarial networks; for MinHash we confine a user's movement to about 10% of the geographic area. Our attacks refute the claimed pre-image resistance, anonymity, and differential-privacy guarantees.

Deep models for diagnosing pulmonary fibrosis from CT scans lose accuracy when the radiation dose differs from training. We make the learned representations invariant to dose through feature selection, without retraining the whole network. On unseen scans recorded at a different dose, this improves the F1 score by 6% to 15% over standard methods.

Medical-image segmentation needs both local detail and a holistic view that captures long-range spatial dependencies, which the state of the art does not provide. We introduce a deep architecture endowed with spatial recurrence, using gated recurrent units that traverse the feature map directionally to enlarge each layer's receptive field and model non-adjacent pixel relationships.

Marketing emails require freely given, specific, informed, and unambiguous consent under the ePrivacy Directive and the GDPR. We design a labeling of legal characteristics for websites and emails, yielding a simple decision procedure for potential violations. Evaluating 1000 websites and the 5000 resulting emails, we find potential violations on 21.9% of sites, in the registration process (17.3%) or in email communication (17.7%).

The GDPR requires websites to inform users about data collection and request cookie consent, yet most offer no real choice or use dark patterns. Analyzing cookie banners on nearly 30k websites, we identify six novel violation types and find at least one potential violation on 94.7% of them. We release CookieBlock, a browser extension that uses machine learning to enforce GDPR cookie consent on the client.

Die Digitalisierung hat die Medizin bereits verändert und wird die ärztliche Tätigkeit weiter stark beeinflussen. Die Arbeitsgruppe «Digitalisierung der Medizin» hat deshalb Lernziele erarbeitet, damit sich angehende Ärztinnen und Ärzte bereits im Studium mit den Methoden und Einsatzmöglichkeiten des maschinellen Lernens auseinandersetzen.

Designing a policy miner for each access-control language has required specialized algorithms. We present Unicorn, a universal method that streamlines building policy miners for many languages, including ABAC, RBAC, RBAC with user-attribute and spatio-temporal constraints, and an expressive fragment of XACML; for the last two, no policy miner existed before. It needs only a language specification and a fitness metric.

My doctoral dissertation addresses privilege abuse, where users hold more permissions than they need and systems become vulnerable to insider exploitation. It combines policy analysis and policy mining for role-based and attribute-based access control to detect and prevent overly permissive policies. Completed at the Information Security Group of ETH Zürich under the supervision of Prof. David Basin.

Access logs are sparse, recording only a fraction of possible requests, and existing ABAC mining methods then produce overly permissive rules. We define reliability, a measure of overpermissiveness, and show why confidence and entropy fail to capture it. Building on subgroup discovery and reliability, we design Rhapsody, the first ABAC mining algorithm with correctness guarantees.

We propose FORBAC, a first-order-logic extension of RBAC expressive enough to formalize a wide range of access-control policies, yet simple enough that relevant analysis queries stay in NP. We answer queries efficiently by reducing them to satisfiability modulo theories and using off-the-shelf SMT solvers, illustrated by a case study of a European bank.

We show that deciding whether a TPTL formula describes a safety property is EXPSPACE-complete, and that deciding whether it describes a liveness property is in 2-EXPSPACE. Our algorithms extend Sistla's for the corresponding LTL problems to the timed setting.

Primal infon logic is a propositional multimodal subintuitionistic logic decidable in linear time, but the replacement of equivalents fails. We introduce a version that treats conjunctions as sets and show that its derivation problem is decidable in linear expected time and quadratic worst-case time.

Primal infon logic was introduced in 2009 for policy and trust management. We standardize the syntax of basic PIL, prove a small-model theorem for its propositional fragment, give a simple proof of the locality theorem, and present a linear-time decision algorithm in a form convenient for generalizations.

Primal infon logic includes unary "said" connectives useful for access control, but implication is not transitive. We introduce and study equiexpressive transitive extensions of propositional primal infon logic and their quote-free fragments, with Kripke semantics, soundness and completeness, small-model results, and a quadratic-time derivation algorithm.