PageSourceSearch

https://igorshilov.com/

html igorshilov.com collected 2026-10-08 11:59:23 UTC 35,542 bytes, 1 lines download raw bytes

1<!DOCTYPE html> <html lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title> Igor Shilov </title> <meta name="author" content="Igor Shilov"> <meta name="description" content=""> <link rel="stylesheet" href="/assets/css/bootstrap.min.css?a4b3f509e79c54a512b890d73235ef04"> <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/css/mdb.min.css" integrity="sha256-jpjYvU3G3N6nrrBwXJoVEYI/0zw8htfFnhT9ljN3JJw=" crossorigin="anonymous"> <link defer rel="stylesheet" href="/assets/css/academicons.min.css?f0b7046b84e425c55f3463ac249818f5"> <link defer rel="stylesheet" type="text/css" href="https://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Roboto+Slab:100,300,400,500,700|Material+Icons&amp;display=swap"> <link defer rel="stylesheet" href="/assets/css/jekyll-pygments-themes-github.css?591dab5a4e56573bf4ef7fd332894c99" media="" id="highlight_theme_light"> <link rel="shortcut icon" href="data:image/svg+xml,&lt;svg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22&gt;&lt;text%20y=%22.9em%22%20font-size=%2290%22&gt;%F0%9F%91%BE&lt;/text&gt;&lt;/svg&gt;"> <link rel="stylesheet" href="/assets/css/main.css?d41d8cd98f00b204e9800998ecf8427e"> <link rel="canonical" href="https://igorshilov.com/"> 
1<script src="/assets/js/theme.js?9a0c749ec5240d9cda97bc72359a72c0"></script>
1 <link defer rel="stylesheet" href="/assets/css/jekyll-pygments-themes-native.css?5847e5ed4a4568527aa6cfab446049ca" media="none" id="highlight_theme_dark"> 
1<script>initTheme();</script>
1 </head> <body class="fixed-top-nav "> <header> <nav id="navbar" class="navbar navbar-light navbar-expand-sm fixed-top" role="navigation"> <div class="container"> <div class="navbar-brand social"> <a href="mailto:%68%65%6C%6C%6F@%69%67%6F%72%73%68%69%6C%6F%76.%63%6F%6D" title="email"><i class="fa-solid fa-envelope"></i></a> <a href="https://scholar.google.com/citations?user=wkAVIooAAAAJ" title="Google Scholar" rel="external nofollow noopener" target="_blank"><i class="ai ai-google-scholar"></i></a> <a href="https://github.com/igorshh" title="GitHub" rel="external nofollow noopener" target="_blank"><i class="fa-brands fa-github"></i></a> <a href="https://www.linkedin.com/in/igor-shilov-9988b0a0" title="LinkedIn" rel="external nofollow noopener" target="_blank"><i class="fa-brands fa-linkedin"></i></a> <a href="https://twitter.com/_igorshilov" title="X" rel="external nofollow noopener" target="_blank"><i class="fa-brands fa-x-twitter"></i></a> <a href="https://bsky.app/profile/igorshilov.bsky.social" title="Bluesky" rel="external nofollow noopener" target="_blank"><i class="fa-brands fa-bluesky"></i></a> </div> <button class="navbar-toggler collapsed ml-auto" type="button" data-toggle="collapse" data-target="#navbarNav" aria-controls="navbarNav" aria-expanded="false" aria-label="Toggle navigation"> <span class="sr-only">Toggle navigation</span> <span class="icon-bar top-bar"></span> <span class="icon-bar middle-bar"></span> <span class="icon-bar bottom-bar"></span> </button> <div class="collapse navbar-collapse text-right" id="navbarNav"> <ul class="navbar-nav ml-auto flex-nowrap"> <li class="nav-item active"> <a class="nav-link" href="/">home <span class="sr-only">(current)</span> </a> </li> <li class="nav-item "> <a class="nav-link" href="/publications/">publications </a> </li> <li class="nav-item "> <a class="nav-link" href="/cv/">cv </a> </li> <li class="toggle-container"> <button id="light-toggle" title="Change theme"> <i class="ti ti-sun-moon" id="light-toggle-system"></i> <i class="ti ti-moon-filled" id="light-toggle-dark"></i> <i class="ti ti-sun-filled" id="light-toggle-light"></i> </button> </li> </ul> </div> </div> </nav> <progress id="progress" value="0"> <div class="progress-container"> <span class="progress-bar"></span> </div> </progress> </header> <div class="container mt-5" role="main"> <div class="post"> <header class="post-header"> <h1 class="post-title"> <span class="font-weight-bold">Igor</span> Shilov </h1> <p class="desc">PhD student at Imperial College London working on <b>AI security &amp; privacy</b>. Big Tech dropout.</p> </header> <article> <div class="profile float-right"> <figure> <picture> <source class="responsive-img-srcset" srcset="/assets/img/prof_pic_new-480.webp 480w,/assets/img/prof_pic_new-800.webp 800w,/assets/img/prof_pic_new-1400.webp 1400w," type="image/webp" sizes="(min-width: 930px) 270.0px, (min-width: 576px) 30vw, 95vw"> <img src="/assets/img/prof_pic_new.jpg?318f00dd4a297fa55bce6b8e692336a3" class="img-fluid z-depth-1 rounded-circle" width="100%" height="auto" alt="prof_pic_new.jpg" loading="eager" onerror="this.onerror=null; $('.responsive-img-srcset').remove();"> </source></picture> </figure> </div> <div class="clearfix"> <h2 id="about">about</h2> <p>Hi, I’m Igor!</p> <p>I’m an AI security &amp; privacy researcher in the final year of my PhD at Imperial College London’s <a href="https://aisp.doc.ic.ac.uk/" rel="external nofollow noopener" target="_blank">AI Security &amp; Privacy Lab</a>, supervised by <a href="http://www.demontjoye.com/" rel="external nofollow noopener" target="_blank">Yves-Alexandre de Montjoye</a>.</p> <p>I was part of the inaugural <a href="https://alignment.anthropic.com/2024/anthropic-fellows-program/" rel="external nofollow noopener" target="_blank">Anthropic AI Safety Fellowship Program</a>, where I worked on capability removal, and a <a href="https://www.goodfire.com/blog/fellowship-fall-25" rel="external nofollow noopener" target="_blank">Research Fellow at Goodfire AI</a>, where I studied mechanistic interpretability.</p> <p>Before my PhD, I spent over a decade as a <a href="/cv">software engineer</a>. Most recently, I was at Meta AI as a Research Engineer in <strong>Privacy Preserving ML group</strong>, where I led the development of <a href="https://opacus.ai" rel="external nofollow noopener" target="_blank">Opacus</a>, an open-source PyTorch library for differentially private model training. I also worked on <a href="https://stopNCII.org" rel="external nofollow noopener" target="_blank">
1StopNCII.org</a>, a privacy-preserving platform that uses on-device perceptual hashing to combat non-consensual intimate image sharing.</p> <p>My research interests include:</p> <ul style="list-style: none; font-weight: bold"> <li>🏛️ Adversarial robustness in LLMs</li> <li>🏛️ Memorization in LLMs</li> <li>🏛️ Model internals</li> </ul> <h2 id="contact">contact</h2> <p>I echo the <a href="https://www.kalzumeus.com/standing-invitation/" rel="external nofollow noopener" target="_blank">standing invitation</a>: I like getting email and I like talking to people. Please do <a href="mailto:[email protected]">reach out</a> if you’re interested in discussing research, collaboration opportunities, or the future of privacy in AI!</p> <p>I can also be found in <a href="https://x.com/_igorshilov" rel="external nofollow noopener" target="_blank">Twitter</a>.</p> </div> <h2> <a href="/publications/" style="color: inherit">selected publications</a> </h2> <div class="publications"> <ol class="bibliography"> <li> <div class="row"> <div class="col col-sm-2 abbr"> <abbr class="badge rounded w-100">NeurIPS 2026</abbr> </div> <div id="panfilov2026claudini" class="col-sm-8"> <div class="title">Claudini: Autoresearch discovers state-of-the-art adversarial attack algorithms for LLMs</div> <div class="author"> Alexander Panfilov<sup>*</sup>, Peter Romov<sup>*</sup>, <em>Igor Shilov<sup>*</sup></em>, Yves-Alexandre Montjoye, Jonas Geiping, and Maksym Andriushchenko <i class="fa-solid fa-circle-info ml-1" data-toggle="popover" data-placement="top" data-html="true" data-content="*Equal contribution"> </i> </div> <div class="periodical"> <em>In Advances in Neural Information Processing Systems (NeurIPS)</em>, 2026 </div> <div class="periodical"> </div> <div class="press"> </div> <div class="press"> </div> <div class="links"> <a class="abstract btn btn-sm z-depth-0" role="button">Abs</a> <a href="https://arxiv.org/pdf/2603.24511" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Paper</a> <a href="https://github.com/romovpa/claudini" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Code</a> </div> <div class="abstract hidden"> <p>We show that AI agents are capable of discovering novel algorithms for adversarial attacks against LLMs, advancing the state of the art on white-box jailbreaking and prompt injection evaluations. We deploy frontier agents, such as Claude Code and Codex, in an autoresearch loop with access to a library of 30+ prior methods and an evaluation script with a fixed compute budget. We show this pipeline to be effective in jailbreaking OpenAI’s GPT-OSS-Safeguard-20B and in prompt injections against Meta-SecAlign-70B, an adversarially robust model. For GPT-OSS-Safeguard, the best agent-discovered method achieves up to 80% attack success rate on CBRN queries, compared to &lt;50% for existing methods. For SecAlign, it achieves 100% ASR, while the best prior automated methods only achieve 82%. Notably, in our setting, attack methods are developed on unrelated surrogate models for a pure random-target token-forcing task, yet generalize directly to prompt injection on the adversarially trained model. Finally, we trace the lineage of methods developed during autoresearch, characterizing the agents’ strategies and failure modes. Adversarial ML has long held that defenses must be evaluated against attacks tailored to them; autoresearch automates this principle, and we argue it should be the minimum bar for defense evaluation going forward. </p> </div> </div> </div> </li> <li> <div class="row"> <div class="col col-sm-2 abbr"> <abbr class="badge rounded w-100">Nature Comms</abbr> </div> <div id="shilov2025mosaicmemorylargelanguage" class="col-sm-8"> <div class="title">The Mosaic Memory of Large Language Models</div> <div class="author"> <em>Igor Shilov<sup>*</sup></em>, Matthieu Meeus<sup>*</sup>, and Yves-Alexandre Montjoye <i class="fa-solid fa-circle-info ml-1" data-toggle="popover" data-placement="top" data-html="true" data-content="*Equal contribution"> </i> </div> <div class="periodical"> <em>Nature Communications</em>, 2026 </div> <div class="periodical"> </div> <div class="press"> </div> <div class="press"> </div> <div class="links"> <a class="abstract btn btn-sm z-depth-0" role="button">Abs</a> <a href="https://www.nature.com/articles/s41467-026-68603-0" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Paper</a> <a href="https://github.com/imperial-aisp/mosaic_memory" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Code</a> </div> <div class="abstract hidden"> <p>As Large Language Models (LLMs) become widely adopted, understanding how they learn from, and memorize, training data becomes crucial. Memorization in LLMs is widely assumed to only occur as a result of sequences being repeated in the training data. Instead, we show that LLMs memorize by assembling information from similar sequences, a phenomena we call mosaic memory. We show major LLMs to exhibit mosaic memory, with fuzzy duplicates contributing to memorization as much as 0.8 of an exact duplicate and even heavily modified sequences contributing substantially to memorization. Despite models display reasoning capabilities, we somewhat surprisingly show memorization to be predominantly syntactic rather than semantic. We finally show fuzzy duplicates to be ubiquitous in real-world data, untouched by deduplication techniques. Taken together, our results challenge widely held beliefs and show memorization to be a more complex, mosaic process, with real-world implications for privacy, confidentiality, model utility and evaluation.</p> </div> </div> </div> </li> <li> <div class="row"> <div class="col col-sm-2 abbr"> <abbr class="badge rounded w-100" style="background-color:#EEEEEE"> <div style="color:black">arXiv</div> </abbr> </div>
1 <div id="shilov2025datafilteringknowledgelocalization" class="col-sm-8"> <div class="title">Beyond Data Filtering: Knowledge Localization for Capability Removal in LLMs</div> <div class="author"> <em>Igor Shilov</em>, Alex Cloud, Aryo Pradipta Gema, Jacob Goldman-Wetzler, Nina Panickssery, Henry Sleight, and <span class="more-authors" title="click to view 2 more authors" onclick=" var element=$(this); element.attr('title', ''); var more_authors_text=element.text() == '2 more authors' ? 'Erik Jones, Cem Anil' : '2 more authors'; var cursorPosition=0; var textAdder=setInterval(function(){ element.html(more_authors_text.substring(0, cursorPosition + 1)); if (++cursorPosition == more_authors_text.length){ clearInterval(textAdder); } }, '10'); ">2 more authors</span> </div> <div class="periodical"> <em>arXiv preprint 2512.05648</em>, 2025 </div> <div class="periodical"> </div> <div class="press"> </div> <div class="press"> </div> <div class="links"> <a class="abstract btn btn-sm z-depth-0" role="button">Abs</a> <a href="https://arxiv.org/abs/2512.05648" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Paper</a> </div> <div class="abstract hidden"> <p>Large Language Models increasingly possess capabilities that carry dual-use risks. While data filtering has emerged as a pretraining-time mitigation, it faces significant challenges: labeling whether data is harmful is expensive at scale, and given improving sample efficiency with larger models, even small amounts of mislabeled content could give rise to dangerous capabilities. To address risks associated with mislabeled harmful content, prior work proposed Gradient Routing (Cloud et al., 2024) – a technique that localizes target knowledge into a dedicated subset of model parameters so they can later be removed. We explore an improved variant of Gradient Routing, which we call Selective GradienT Masking (SGTM), with particular focus on evaluating its robustness to label noise. SGTM zero-masks selected gradients such that target domain examples only update their dedicated parameters. We test SGTM’s effectiveness in two applications: removing knowledge of one language from a model trained on a bilingual synthetic dataset, and removing biology knowledge from a model trained on English Wikipedia. In both cases SGTM provides better retain/forget trade-off in the presence of labeling errors compared to both data filtering and a previously proposed instantiation of Gradient Routing. Unlike shallow unlearning approaches that can be quickly undone through fine-tuning, SGTM exhibits strong robustness to adversarial fine-tuning, requiring seven times more fine-tuning steps to reach baseline performance on the forget set compared to a finetuning-based unlearning method (RMU). Our results suggest SGTM provides a promising pretraining-time complement to existing safety mitigations, particularly in settings where label noise is unavoidable.</p> </div> </div> </div> </li> <li> <div class="row"> <div class="col col-sm-2 abbr"> <abbr class="badge rounded w-100" style="background-color:#d97706"> <div style="color:white">USENIX 2025</div> </abbr> </div> <div id="pollock2024freerecordlevelprivacyrisk" class="col-sm-8"> <div class="title">Free Record-Level Privacy Risk Evaluation Through Artifact-Based Methods</div> <div class="author"> Joseph Pollock<sup>*</sup>, <em>Igor Shilov<sup>*</sup></em>, Euodia Dodd, and Yves-Alexandre Montjoye <i class="fa-solid fa-circle-info ml-1" data-toggle="popover" data-placement="top" data-html="true" data-content="*Equal contribution"> </i> </div> <div class="periodical"> <em>In 34th USENIX Security Symposium (USENIX Security 25)</em>, 2025 </div> <div class="periodical"> </div> <div class="press"> </div> <div class="press"> </div> <div class="links"> <a class="abstract btn btn-sm z-depth-0" role="button">Abs</a> <a href="https://arxiv.org/abs/2411.05743" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Paper</a> <a href="https://github.com/computationalprivacy/loss_traces" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Code</a> <a href="https://computationalprivacy.github.io/loss_traces/" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Website</a> </div> <div class="abstract hidden"> <p>Membership inference attacks (MIAs) are widely used to empirically assess the privacy risks of samples used to train a target machine learning model. State-of-the-art methods however require training hundreds of shadow models, with the same size and architecture of the target model, solely to evaluate the privacy risk. While one might be able to afford this for small models, the cost often becomes prohibitive for medium and large models. We here instead propose a novel approach to identify the at-risk samples using only artifacts available during training, with little to no additional computational overhead. Our method anal
1yzes individual per-sample loss traces and uses them to identify the vulnerable data samples. We demonstrate the effectiveness of our artifact-based approach through experiments on the CIFAR10 dataset, showing high precision in identifying vulnerable samples as determined by a SOTA shadow model-based MIA (LiRA). Impressively, our method reaches the same precision as another SOTA MIA when measured against LiRA, despite it being orders of magnitude cheaper. We then show LT-IQR to outperform alternative loss aggregation methods, perform ablation studies on hyperparameters, and validate the robustness of our method to the target metric. Finally, we study the evolution of the vulnerability score distribution throughout training as a metric for model-level risk assessment.</p> </div> </div> </div> </li> <li> <div class="row"> <div class="col col-sm-2 abbr"> <abbr class="badge rounded w-100" style="background-color:#d97706"> <div style="color:white">SaTML 2025</div> </abbr> </div> <div id="meeus2024sokmembershipinferenceattacks" class="col-sm-8"> <div class="title">SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)</div> <div class="author"> Matthieu Meeus, <em>Igor Shilov</em>, Shubham Jain, Manuel Faysse, Marek Rei, and Yves-Alexandre Montjoye </div> <div class="periodical"> <em>In 3rd IEEE Conference on Secure and Trustworthy Machine Learning</em>, 2025 </div> <div class="periodical"> </div> <div class="press"> </div> <div class="press"> </div> <div class="links"> <a class="abstract btn btn-sm z-depth-0" role="button">Abs</a> <a href="https://arxiv.org/abs/2406.17975" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Paper</a> <a href="https://github.com/computationalprivacy/mia_llms_benchmark" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Code</a> </div> <div class="abstract hidden"> <p>Whether LLMs memorize their training data and what this means, from privacy leakage to detecting copyright violations – has become a rapidly growing area of research over the last two years. In recent months, more than 10 new methods have been proposed to perform Membership Inference Attacks (MIAs) against LLMs. Contrary to traditional MIAs which rely on fixed – but randomized – records or models, these methods are mostly evaluated on datasets collected post-hoc. Sets of members and non-members, used to evaluate the MIA, are constructed using informed guesses after the release of a model. This lack of randomization raise
1s concerns of a distribution shift between members and non-members. In the first part, we review the literature on MIAs against LLMs. While most work focuses on sequence-level MIAs evaluated in post-hoc setups, we show that a range of target models, motivations and units of interest have been considered in the literature. We then quantify distribution shifts present in the 6 datasets used in the literature, ranging from books to papers, using a bag of word classifier. Our analysis reveals that all of them suffer from severe distribution shifts. This challenges the validity of using such setups to measure LLM memorization and may undermine the benchmarking of recently proposed methods. Yet, all hope might not be lost. In the second part, we introduce important considerations to properly evaluate MIAs against LLMs and discuss potential ways forward: randomized test splits, injections of randomized (unique) sequences, randomized finetuning, and post-hoc control methods. While each option comes with its advantages and limitations, we believe they collectively provide solid grounds to guide the development of MIA methods and study LLM memorization. We conclude by proposing comprehensive, easy-to-use benchmarks for sequence- and document-level MIAs against LLMs.</p> </div> </div> </div> </li> <li> <div class="row"> <div class="col col-sm-2 abbr"> <abbr class="badge rounded w-100" style="background-color:#d97706"> <div style="color:white">ICML 2024</div> </abbr> </div> <div id="meeus2024copyright" class="col-sm-8"> <div class="title">Copyright Traps for Large Language Models</div> <div class="author"> Matthieu Meeus<sup>*</sup>, <em>Igor Shilov<sup>*</sup></em>, Manuel Faysse, and Yves-Alexandre Montjoye <i class="fa-solid fa-circle-info ml-1" data-toggle="popover" data-placement="top" data-html="true" data-content="*Equal contribution"> </i> </div> <div class="periodical"> <em>In Forty-first International Conference on Machine Learning (ICML)</em>, 2024 </div> <div class="periodical"> </div> <div class="press"> </div> <div class="press"> <p> </p> <p>Press coverage in <a href="https://www.technologyreview.com/2024/07/25/1095347/a-new-tool-for-copyright-holders-can-show-if-their-work-is-in-ai-training-data/" rel="external nofollow noopener" target="_blank">MIT Technology Review</a> and <a href="https://www.nature.com/articles/d41586-024-02599-9" rel="external nofollow noopener" target="_blank">Nature News</a>.</p> </div> <div class="links"> <a class="abstract btn btn-sm z-depth-0" role="button">Abs</a> <a href="https://proceedings.mlr.press/v235/meeus24a.html" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Paper</a> <a href="https://github.com/computationalprivacy/copyright-traps" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Code</a> </div> <div class="abstract hidden"> <p>Questions of fair use of copyright-protected content to train Large Language Models (LLMs) are being very actively debated. Document-level inference has been proposed as a new task: inferring from black-box access to the trained model whether a piece of content has been seen during training. SOTA methods however rely on naturally occurring memorization of (part of) the content. While very effective against models that memorize a lot, we hypothesize–and later confirm–that they will not work against models that do not naturally memorize, e.g. medium-size 1B models. We here propose to use copyright traps, the inclusion of fictitious entries in original content, to detect the use of copyrighted materials in LLMs with a focus on models where memorization does not naturally occur. We carefully design an experimental setup, randomly inserting traps into original content (books) and train a 1.3B LLM. We first validate that the use of content in our target model would be undetectable using existing methods. We then show, contrary to intuition, that even medium-length trap sentences repeated a significant number of times (100) are not detectable using existing methods. However, we show that longer sequences repeated a large number of times can be reliably detected (AUC=0.75) and used as copyright traps. We further improve these results by studying how the number of times a sequence is seen improves detectability, how sequences with higher perplexity tend to be memorized more, and how taking context into account further improves detectability.</p> </div> </div> </div> </li> <li> <div class="row"> <div class="col col-sm-2 abbr"> <abbr class="badge rounded w-100" style="background-color:#949494"> <div style="color:white">NeurIPS Workshop</div> </abbr> </div> <div id="yousefpour2021opacus" class="col-sm-8"> <div class="title">Opacus: User-Friendly Differential Privacy Library in PyTorch</div> <div class="author"> Ashkan Yousefpour, <em>Igor Shilov</em>, Alexandre Sablayrolles, Davide Testuggine, Karthik Prasad, Mani Malek, and <span class="more-authors" title="click to view 6 more authors" onclick=" var element=$(this); element.attr('title', ''); var more_authors_text=element.text() == '6 more authors' ? 'John Nguyen, Sayan Ghosh, Akash Bharadwaj, Jessica Zhao, Graham Cormode, Ilya Mironov' : '6 more authors'; var cursorPosition=0; var textAdder=setInterval(function(){ element.html(more_authors_text.substring(0, cursorPosition + 1)); if (++cursorPosition == more_authors_text.length){ clearInterval(textAdder); } }, '10'); ">6 more authors</span> </div> <div class="periodical"> <em>In NeurIPS Workshop on Privacy in Machine Learning</em>, 2021 </div> <div class="periodical"> </div> <div class="press"> </div> <div class="press"> </div> <div class="links"> <a class="abstract btn btn-sm z-depth-0" role="button">Abs</a> <a href="https://arxiv.org/abs/2109.12298" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Paper</a> <a href="https://github.com/pytorch/opacus" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Code</a> </div> <div class="abstract hidden"> <p>We introduce Opacus, a free, open-source PyTorch library for training deep learning models with differential privacy (hosted at opacus.ai). Opacus is designed for simplicity, flexibility, and speed. It provides a simple and user-friendly API, and enables machine learning practitioners to make a training pipeline private by adding as little as two lines to their code. It supports a wide variety of layers, including multi-head attention, convolution, LSTM, GRU (and generic RNN), and embedding, right out of the box and provides the means for supporting other user-defined layers. Opacus computes batched per-sample gradients, providing higher efficiency compared to the traditional "micro batch" approach. In this paper we present Opacus, detail the principles that drove its implementation and unique features, and benchmark it against other frameworks for training models with differential privacy as well as standard PyTorch.</p> </div> </div> </div> </li> </ol> </div> <h2><a href="/cv/" style="color: inherit">selected projects</a></h2> <div class="publications"> <ol class="bibliography"> <li> <div class="row"> <div class="col col-sm-2 abbr"> <figure> <picture> <source class="responsive-img-srcset" srcset="/assets/img/publication_preview/opacus2-480.webp 480w,/assets/img/publication_preview/opacus2-800.webp 800w,/assets/img/publication_preview/opacus2-1400.webp 1400w," type="image/webp" sizes="200px"> <img src="/assets/img/publication_preview/opacus2.png" class="preview z-depth-1 rounded" width="100%" height="auto" alt="opacus2.png" data-zoomable loading="eager" onerror="this.onerror=null; $('.responsive-img-srcset').remove();"> </source></picture> </figure> </div> <div id="opacus" class="col-sm-8"> <div class="title">Opacus: User-Friendly Differential Privacy Library in PyTorch</div> <div class="author"> Tech Lead (Meta) </div> <div class="periodical"> <em></em> </div> <div class="periodical"> </div> <div class="press"> <p> </p> <p>I was the lead developer and maintainer of Opacus, a PyTorch library to train ML models with Differential Privacy. With 1k+ stars on github and 300+ citations, the tool is helping to advance the state-of-the-art in privacy preserving ML both internally and for the wider community of researchers.</p> </div> <div class="press"> <p> </p> <p>Talks: <a href="https://www.youtube.com/watch?v=U1mszp8lzUI" rel="external nofollow noopener" target="_blank">PyTorch Developer Day 2021</a>, <a href="https://www.youtube.com/watch?v=jfcRPRIwPW0&amp;t=1s" rel="external nofollow noopener" target="_blank">UCL Privacy and Security Seminar</a></p> </div> <div class="links"> <a href="https://ai.meta.com/blog/introducing-opacus-a-high-speed-library-for-training-pytorch-models-with-differential-privacy/" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Blog</a> <a href="https://github.com/pytorch/opacus" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Code</a> <a href="https://opacus.ai/" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Website</a> </div> </div> </div> </li> <li> <div class="row"> <div class="col col-sm-2 abbr"> <figure> <picture> <source class="responsive-img-srcset" srcset="/assets/img/publication_preview/stopncii-480.webp 480w,/assets/img/publication_preview/stopncii-800.webp 800w,/assets/img/publication_preview/stopncii-1400.webp 1400w," type="image/webp" sizes="200px"> <img src="/assets/img/publication_preview/stopncii.png" class="preview z-depth-1 rounded" width="100%" height="auto" alt="stopncii.png" data-zoomable loading="eager" onerror="this.onerror=null; $('.responsive-img-srcset').remove();"> </source></picture> </figure> </div> <div id="stopncii" class="col-sm-8"> <div class="title">StopNCII.org: Stop Non-Consensual Intimate Image Abuse</div> <div class="author"> Tech Lead (Meta) </div> <div class="periodical"> <em></em> </div> <div class="periodical"> </div> <div class="press"> <p> </p> <p>I have lead the team developing a privacy-preserving platform helping combat non-consensual intimate image sharing, a joint effort between Meta and a UK-based NGO running “Revenge Porn Helpline”. The platform takes advantage of on-device perceptual hashing to protect privacy. Since it’s launch, many major social media platforms has signed up as industry partners, inclusing Reddit, Snap, TilTok, OnlyFans and PornHub.</p> </div> <div class="press"> <p> </p> <p>Selected press: <a href="https://www.nbcnews.com/tech/social-media/meta-builds-tool-stop-spread-revenge-porn-rcna7231" rel="external nofollow noopener" target="_blank">NBC News</a>, <a href="https://www.bloomberg.com/news/newsletters/2022-12-01/tiktok-and-bumble-join-fight-to-stop-spread-of-revenge-porn" rel="external nofollow noopener" target="_blank">Bloomberg</a>, <a href="https://mashable.com/article/meta-uk-revenge-porn-detection" rel="external nofollow noopener" target="_blank">Mashable</a>, <a href="https://www.cosmopolitan.com/uk/reports/a35469761/revenge-porn-threats/" rel="external nofollow noopener" target="_blank">Cosmopolitan</a></p> </div> <div class="links"> <a href="https://about.fb.com/news/2021/12/strengthening-efforts-against-spread-of-non-consensual-intimate-images/" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Blog</a> <a href="https://stopncii.org/" class="btn btn-sm z-depth-0" role="button" rel="external nofollow noopener" target="_blank">Website</a> </div> </div> </div> </li> </ol> </div> </article> </div> </div> <footer class="fixed-bottom" role="contentinfo"> <div class="container mt-0" style="font-size: 0.95rem"> 🇺🇦 <a href="/ukraine/" style="color: inherit; text-decoration: underline; text-decoration-thickness: 1px;"> Support Ukraine </a> 🇺🇦 </div> </footer> <footer class="sticky-bottom mt-5" role="contentinfo"> <div class="container"> © Copyright 2026 Igor Shilov. Powered by <a href="https://jekyllrb.com/" target="_blank" rel="external nofollow noopener">Jekyll</a> with <a href="https://github.com/alshedivat/al-folio" rel="external nofollow noopener" target="_blank">al-folio</a> theme. Hosted by <a href="https://pages.github.com/" target="_blank" rel="external nofollow noopener">GitHub Pages</a>. </div> </footer> 
1<script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/jquery.min.js" integrity="sha256-/xUj+3OJU5yExlq6GSYGSHk7tPXikynS7ogEvDej/m4=" crossorigin="anonymous"></script>
1 
1<script src="/assets/js/bootstrap.bundle.min.js"></script>
1 
1<script src="https://cdn.jsdelivr.net/npm/[email protected]/js/mdb.min.js" integrity="sha256-NdbiivsvWt7VYCt6hYNT3h/th9vSTL4EDWeGs5SN3DA=" crossorigin="anonymous"></script>
1 
1<script defer src="https://cdn.jsdelivr.net/npm/[email protected]/dist/masonry.pkgd.min.js" integrity="sha256-Nn1q/fx0H7SNLZMQ5Hw5JLaTRZp0yILA/FRexe19VdI=" crossorigin="anonymous"></script>
1 
1<script defer src="https://cdn.jsdelivr.net/npm/[email protected]/imagesloaded.pkgd.min.js" integrity="sha256-htrLFfZJ6v5udOG+3kNLINIKh2gvoKqwEhHYfTTMICc=" crossorigin="anonymous"></script>
1 
1<script defer src="/assets/js/masonry.js" type="text/javascript"></script>
1 
1<script defer src="https://cdn.jsdelivr.net/npm/[email protected]/dist/medium-zoom.min.js" integrity="sha256-ZgMyDAIYDYGxbcpJcfUnYwNevG/xi9OHKaR/8GK+jWc=" crossorigin="anonymous"></script>
1 
1<script defer src="/assets/js/zoom.js?85ddb88934d28b74e78031fd54cf8308"></script>
1 
1<script src="/assets/js/no_defer.js?2781658a0a2b13ed609542042a859126"></script>
1 
1<script defer src="/assets/js/common.js?e0514a05c5c95ac1a93a8dfd5249b92e"></script>
1 
1<script defer src="/assets/js/copy_code.js?12775fdf7f95e901d7119054556e495f" type="text/javascript"></script>
1 
1<script defer src="/assets/js/jupyter_new_tab.js?d9f17b6adc2311cbabd747f4538bb15f"></script>
1 
1<script async src="https://d1bxh8uas1mnw7.cloudfront.net/assets/embed.js"></script>
1 
1<script async src="https://badge.dimensions.ai/badge.js"></script>
1 
1<script type="text/javascript">window.MathJax={tex:{tags:"ams"}};</script>
1 
1<script defer type="text/javascript" id="MathJax-script" src="https://cdn.jsdelivr.net/npm/[email protected]/es5/tex-mml-chtml.js" integrity="sha256-MASABpB4tYktI2Oitl4t+78w/lyA+D7b/s9GEP0JOGI=" crossorigin="anonymous"></script>
1 
1<script defer src="https://cdnjs.cloudflare.com/polyfill/v3/polyfill.min.js?features=es6" crossorigin="anonymous"></script>
1 
1<script data-goatcounter="https://igorshilov.goatcounter.com/count" async src="//gc.zgo.at/count.js"></script>
1 
1<script type="text/javascript">function progressBarSetup(){"max"in document.createElement("progress")?(initializeProgressElement(),$(document).on("scroll",function(){progressBar.attr({value:getCurrentScrollPosition()})}),$(window).on("resize",initializeProgressElement)):(resizeProgressBar(),$(document).on("scroll",resizeProgressBar),$(window).on("resize",resizeProgressBar))}function getCurrentScrollPosition(){return $(window).scrollTop()}function initializeProgressElement(){let e=$("#navbar").outerHeight(!0);$("body").css({"padding-top":e}),$("progress-container").css({"padding-top":e}),progressBar.css({top:e}),progressBar.attr({max:getDistanceToScroll(),value:getCurrentScrollPosition()})}function getDistanceToScroll(){return $(document).height()-$(window).height()}function resizeProgressBar(){progressBar.css({width:getWidthPercentage()+"%"})}function getWidthPercentage(){return getCurrentScrollPosition()/getDistanceToScroll()*100}const progressBar=$("#progress");window.onload=function(){setTimeout(progressBarSetup,50)};</script>
1 </body> </html>

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.