The SPRING lab offers project opportunities for BSc, MSc, and PhD students. We encourage interested students to have a look at the Thesis & Project Guidelines from the MLO lab, where you will gain an understanding about what can be expected of us and what we expect from students.
Last Update: 8th May 2025
Please, apply via Google form (login may be required). You will need to specify which project(s) you are interested in, why you are interested, and if you have any relevant experience in this area.
For all applicants, when filling the form, please use your institutional email so that we can get back to you.
For External students, i.e., students who are not from EPFL nor ETHZ, in addition to filling the application form, please also send an email to the supervisor(s) including (1) a self introduction within 5 sentences (2) how you are able to conduct this project as an external student (e.g., have you applied for an exchange/internship to EPFL or MPI-SP?) (3) apart from supervision, whether/how you need our support (e.g., internship salary, visa application, admin for exchange etc.)
We are gathering applications for projects during the Autumn Semester 2025 via the Google form.
Changes this year
Applications are processed in two rounds. For each round, we collect applications before the deadline. Then, we will get back to selected applicants during the corresponding “First Contact From Supervisors” period. If we do not get back to you during the indicated period, it means that we probably do not have space anymore.
We will make a mark on the project once it is taken. We strongly recommend that you apply as soon as possible for best consideration, since we expect most projects would be taken after the first round. However, we will leave the form open after the second round and consider all applications, if there are still available projects at that time.
For Master Projects (PDM)
For Research Projects
Important Notes:
Note that projects will be updated or added until 1st May 2025. We recommend that you check this page regularly for updates. You can modify your application at any point to select projects that you missed up until 4th May 2025.
If you encounter any technical issue, please get in touch with Saiid El Hajj Chehade.
Look at existing eID deployments (Aadhar, SingPass, Sweden’s BankID, BelPIC, Denmark’s MitID, Netherlands’ DigID, Nigeria’s digital ID, Louisiana, Estonia), and figure out:
Requirements
Applying to this project
This research project or master’s project (PDM) is aimed at one MSc student. The student will work with Christian Knabenhans and Boya Wang.
[1] https://eprint.iacr.org/2022/481.pdf for a cryptographic/systems overview of Aadhar
The Swiss e-ID [1] is planned to be deployed in 2026. However, the concrete use cases for the Swiss e-ID are not fleshed out yet, and it is still unclear (i) where and how it will be used, and (ii) what details need to be figured out for these use cases to make sense, and (iii) what privacy implications such use cases might have.
In this project, you will design and analyze use cases for an eID in the Swiss context. More concretely, you will explore:
Requirements
Applying to this project
This semester project or master’s project (PDM) is aimed at one MSc student. The student will work with Christian Knabenhans.
[1] https://www.eid.admin.ch/en
Perceptual hashing algorithms are widely used to detect edited copies of targeted content, such as child sexual abuse media (CSAM) or non-consensually shared intimate images, in social media platforms. A perceptual hashing algorithm maps an image to a fixed-size vector representation, which captures the main features of the image and is called a perceptual hash. Perceptual hashes are different from cryptographic hashes in that they are robust to small transformations applied to the image, such as grayscaling and resizing. Perceptual hashes are believed to be privacy-preserving because of the signal loss with respect to the original image, as they are typically very low-dimensional and consist of bits.
The goal of this project is to design and evaluate reconstruction attacks against perceptual hashes, whose goal is to recover a version of the original image given the hash, and to explore different adversary assumptions. The starting point will be to replicate existing works such as [1] or [2]. Then, the student will explore more advanced reconstruction techniques through the use of diffusion-based approaches.
Requirements
Applying to this project
This research project/master’s project (PDM) is aimed at one MSc student. The student will work with Ana-Maria Cretu.
[1] Hawkes, S. et al. Perceptual Hash Inversion Attacks on Image-Based Sexual Abuse Removal Tools. https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=10762793
[2] Madden, J. et al. Robustness of Practical Perceptual Hashing Algorithms to Hash-Evasion and Hash-Inversion Attacks. https://arxiv.org/pdf/2406.00918
[3] Zhang, S. Q., Li, Z., Guo, C., Mahloujifar, S., Dangwal, D., Suh, E., … & Liu, C. (2024). Unlocking Visual Secrets: Inverting Features with Diffusion Priors for Image Reconstruction. arXiv preprint arXiv:2412.10448. https://arxiv.org/abs/2412.10448
Being anonymous when browsing a website is essential to preserving freedom of speech and information. To achieve this, one can use VPNs or employ anonymous networks. However, the metadata of exchanged packets remains exposed. In website fingerprinting attacks [1], a passive attacker uses this metadata to predict, with machine learning techniques, which website a user has accessed. These attacks may allow governments or Internet Service Providers (ISPs) to monitor communications, threatening user privacy.
This project aims to explore DL models for website fingerprinting attacks on a new dataset that includes full browsing sessions, covering interactions with subpages. This research aims to evaluate the capabilities of DL techniques in identifying both websites and specific subpages, thereby uncovering potential privacy vulnerabilities and contributing to advancements in anonymous communication systems.
Requirements
Applying to this project
This research project is aimed at one MSc student. The student will work with Eric Jollès.
[1] S. Siby, L. Barman, C. Wood, M. Fayed, N. Sullivan, C. Troncoso “Evaluating practical QUIC website fingerprinting protections for the masses”
Code: https://github.com/spring-epfl/quic-wf-defenses/tree/main
This project is also listed in the COMPSEC lab; no need to apply to both labs, filling out either form is enough.
A well-known technique to convert an interactive proof to a non-interactive proof is the Fiat-Shamir transformation, which guarantees security in the random oracle model. An alternative transformation to achieve non-interactivity is the Fischlin transform [Fis05], which presents a number of advantages of the Fiat-Shamir transform (in particular, a straight-line, i.e. non-rewinding extractor) [DV24, ABGR12]. The concrete runtime and implementation costs of the Fischlin transform are however still not well-understood, although there has been some very recent progress in this direction [CL24].
The goal of this project is to (i) derive guidelines to securely instantiate the Fischlin transform for real-world use cases, (ii) implement and optimize the Fischlin transform on top of the arkworks and spongefish libraries, and (iii) compare this concrete instantiations with Fiat-Shamir implementations in terms of concrete efficiency, parameter sets, and theoretical security guarantees.
Requirements
Applying to this project
This semester project or master’s project (PDM) is aimed at one MSc student. The student will work with Christian Knabenhans.
[Fis05] M. Fischlin, Communication-Efficient Non-interactive Proofs of Knowledge with Online Extractors”, CRYPTO 2005 [DV14] Ö. Dagdelen and D. Venturi, “A Second Look at Fischlin’s Transformation”, AFRICACRYPT 2014 [ABGC12] P. Ananth, R. Bhaskar, V. Goyal, and V. Rao, “On the (In)security of Fischlin’s Paradigm”, Theory of Cryptography 2012 [CL24] Y.-H. Chen and Y. Lindell, “Optimizing and Implementing Fischlin’s Transform for UC-Secure Zero-Knowledge”, https://eprint.iacr.org/2024/526.
This project is also listed in the COMPSEC lab; no need to apply to both labs, filling out either form is enough.
Anonymous credentials allow users to anonymously authenticate themselves, and are a cornerstone of privacy-enhancing technologies (for electronic IDs, Privacypass, etc.). Since anonymous credentials are used in high-security contexts against strong adversaries, it is crucial to have high-assurance implementations available.
In this project, you will develop a high-level implementation of anonymous credentials schemes. The theoretical basis for this project is Orrù’s unified framework for anonymous credentials [1], along with IETF standards [2]. The implementation specification will be written in the hacspec specification language (a subset of Rust), and will be implemented in Jasmin, an assembly-like language with fine-grained control over constant-time guarantees. This project will also involve working with formal tools such as EasyCrypt. Pairings over elliptic curves have been implemented in Jasmin, as have Schnorr signatures (which are very similar to some anonymous credential schemes). [3]
Requirements
Applying to this project
This semester project or master’s project (PDM) is aimed at one MSc student. The student will work with Christian Knabenhans.
[1] https://eprint.iacr.org/2024/1552
[2] https://www.ietf.org/archive/id/draft-yun-cfrg-arc-00.html
[3] https://firsov.ee/schnorr-in-jasmin/
Through a close collaboration with the International Committee of the Red Cross (ICRC), the SPRING lab has proposed a new design of humanitarian aid distribution system with strong security, privacy, and auditability properties [1-3].
Now it is time to have an end-to-end implementation.
You will have the chance to work on a prototype which could directly inform the real-world deployment of such an aid distribution system. Starting by familiarizing yourself with the design, your task is to develop all parts of the system, their interactions, and comprehensive test cases. We will provide you the hardware, guide you through the system architecture, and support you on implementation choices e.g., crypto libraries.
Requirements
Applying to this project
This research project/master’s project (PDM) is aimed at one MSc student. The student will work with Boya Wang and Christian Knabenhans.
[1] https://arxiv.org/pdf/2303.17343
[2] https://arxiv.org/pdf/2410.15942
[3] https://ieeexplore.ieee.org/abstract/document/10646811
Since the very first paper in 1996, the research around censorship and its resistance is approaching the 30-year-old’s birthday [1]. Censorship (or, in a more western context, content moderation) is itself neutral, however, the censorship policy on what could be said, seen, done or disseminated is heavily bent towards the censor’s judgement, which makes it value-laden. Apart from the ethical examination often raised from philosophy, sociology, and culture studies, computer security research focuses on the techniques of censorship implementation and circumvention.
However, there is still a lack of reflection on what we actually achieved. We have a zoo of claims from previous research: There are characteristic properties of existing designs of circumvention systems, e.g., provable secure [2], cryptographically secure [3]; There are classic properties like anonymity, undetectability; There are broader concepts in system research like deployability, usability…
But have we really lived up to what we claimed?
In this project, we are going to take a critical look at some of the existing systems, focusing on whether the evaluation in the paper actually provides a fair examination of claimed properties in the design of circumvention systems. Some concrete questions to start with can be: What is the threat model? Does the threat model make sense in any specific censorship context? Are we evaluating in a limited manner which does not reflect how a rational censor would behave in reality? How are the cryptographic techniques helpful for formal, provable properties? To what extent they build up system properties? How to step towards a critical, fair, systematic evaluation?
This project is research-oriented, in the sense that we aim for a publication based on the thesis. Hence, it is particularly suitable for students who would be interested in figuring out whether academia is the way to go, or building up research skills to potentially pursue a research career in the future.
Requirements
Applying to this project
This master’s project (PDM) is aimed at one MSc student. The student will work with Boya Wang.
[1] https://censorbib.nymity.ch/
[2] https://dingjinyang.github.io/uploads/Discop_sp23_paper.pdf
[3] https://dl.acm.org/doi/pdf/10.1145/3460120.3484550
Measuring advertisement and tracking services (ATS) in the wild is an essential step in understanding challenges to web privacy and developing useful web privacy-preserving technologies (web-PETS). Automating web measurement is a necessary step to keep up with the expanding size of the web [1].
However, web trackers are getting smarter and more capable of detecting crawlers to block them or hide their privacy-invasive activity from them [2]. To make crawlers more human and measurements more representative of what real users observe, web privacy researchers have been studying various factors that reduce the distance between automated crawlers and normal users [3].
In this project, you will investigate the impact of equipping crawlers with human-like browser histories (through cookies), and measure the difference in ATS activity compared to traditional crawlers.
This project involves implementing a flexible framework to equip crawlers with configurable browsing histories, designing the experimental setup, and running a preliminary measurement experiment.
Requirements
Applying to this project
This project is aimed at one MSc student. Master’s Project (PDM) is highly preferred. The student will work with Saiid El Hajj Chehade.
[1] https://dl.acm.org/doi/abs/10.1145/2976749.2978313
[2] https://medium.com/@datajournal/avoid-detection-with-puppeteer-stealth-febc3d70f319
[3] https://dl.acm.org/doi/abs/10.1145/3366423.3380104