PEPR '25 Conference Program

The regulatory landscape surrounding sharing personal health information is complex and constantly evolving. Given that a host of regulations could be relevant to mobile health applications, it is not surprising that many developers and organizations are confused about or unaware of the applicability of such regulations and how to comply. This misunderstanding may cost consumers privacy protection for highly sensitive health data. We examined the data handling practices of 408 Android telehealth apps from 36 countries. We found that a significant portion deployed event reporting, which exposes highly sensitive health data to domains not equipped to handle health data. Such practices demonstrate a clear gap between the operational, technical, and regulatory realms. In our pool of US-based telehealth apps, 48.09% potentially violate at least one applicable regulation. We also uncover three main patterns of violations among the U.S.-based apps, including the potential culpability of the Android Platform.

Liam Webster have contributed significantly in the course of the analysis to analyze apps and understand the legal context of this telehealth apps. This work was supported by the U.S. National Science Foundation NSF (under grant CNS-2055772 & ​CNS-2217771 ).​

With the rise of AI-powered deception, identity verification systems are increasingly important to distinguish between AI and humans. Building on related concepts, like, decentralized identifiers (DIDs), proof-of-personhood, anonymous credentials, personhood credentials (PHCs) emerged as an alternative approach, enabling individuals to verify that they are a unique person without disclosing additional information. However, new technologies might introduce some friction due to users' misunderstandings and mismatched expectations. This talk will discuss how people reason about unknown privacy and security guarantees of PHCs compared to current methods; and factors that influence how people would like to manage PHCs. Specifically, it will address critical design considerations, including the role of trusted issuers (e.g., government, private entities), the reliability of data attributes used for credential issuance (e.g., biometrics, physical IDs, selfies), and the trade-offs between centralized and decentralized issuance systems.

We are in the second decade of privacy engineers being hired in industry and the process has professionalized at all levels. From the backgrounds that applicants come from to the way that candidates are screened to job descriptions to how interviews are conducted. This talk aims to: demystify the privacy engineering job market as it currently exists; to empower privacy engineers (current and prospective) in their career growth; and educate privacy engineers on hiring processes and practices.

Purpose limitation is a foundational principle in data privacy, ensuring that the use of data is strictly confined to the explicitly stated purpose(s) disclosed at the time of collection. This presentation is a retrospective analysis on early iterations of Policy Zones, one of Meta's technical solutions designed to enforce purpose limitation.

By examining the evolution of Policy Zones, including lessons learned and key insights into why certain approaches were effective or ineffective, we aim to provide a deeper understanding of the complexities and opportunities in implementing purpose limitation at scale.

In particular, we'll focus on three common purpose limitation paradigms:

• Set it and forget it: Dynamically propagating policies from service to service, throughout the stack
• One size fits all: Leveraging a single policy for all purpose-limitation-based privacy requirements
• Run checks everywhere: Running privacy checks server-side for every data store, in a single chokepoint that covers all callers

These three paradigms were initially adopted by Meta. Although they appeared sound and facilitated a faster system build-out, we later identified several gaps that necessitated a redesign of our systems to enhance operational maturity and make them more viable at scale.

Privacy engineers often work on complex AI systems, and as such, many now find themselves playing a AI governance roles alongside their privacy engineering responsibilities. However, PEs are not only seeing their roles shaped by AI Governance; they also have an opportunity to shape it. Furthermore, PEs are at the forefront of regulatory compliance and as AI governance evolves and regulations take shape, PEs are uniquely positioned to lead in this domain. This panel explores the intersection of privacy engineering practice and the new wave of AI governance. As the EU AI Act ushers in a new era of AI regulation, reminiscent of GDPR's impact on privacy, we examine how privacy engineering practices and skills can inform and enhance AI governance strategies.

As organizations explore AI automation for privacy assessments, ensuring reliable and trustworthy output is critical. This talk examines practical challenges in building AI systems that can consistently interpret privacy requirements, process engineering documentation, and produce reliable assessments. We'll set context by discussing which components of privacy assessments are ripe for automation, and which require more human oversight. We'll then explore technical approaches to prevent hallucinations, handle conflicting documentation, normalize AI outputs, and validate assessments against established policies. Drawing from real-world implementation experience, we'll share key patterns for building robust privacy automation systems that maintain high accuracy while scaling across organizations.

Machine learning models, in particular classification models, are used across a wide spectrum of products and applications. These models may be susceptible to attacks like model inversion and attribute inference attacks that could allow for reconstruction of the training data and re-indentification of the data subjects. However, not all models are attackable: well generalized ones specifically are less prone to memorize their training data, and privacy preserving techniques can be used to help ensure training is generalized rather than memorized. However, a key challenge at an industrial scale lies in identifying the attackability of a model as well as calibrating the need for privacy mitigations. Academic literature has established an order relationship between attacks, demonstrating that membership inference attacks are a precursor to the reconstruction and re-identification of training data. In this talk we'll discuss a mechanism to repurpose those attacks into a practical quantifiable metric for ML model attackability measurement. This could be critical in ensuring model privacy and ongoing monitoring of the model in the model deployment lifecycle.

The adoption of Large Language Models (LLMs) has revolutionized AI applications but has introduced complex challenges in enforcing scalable and adaptive privacy safeguards. This talk presents OneShield Privacy Guard, a framework engineered to mitigate privacy risks through context-aware guardrails across the LLM lifecycle—input preprocessing, inference, and output sanitization—while leveraging automated risk assessment for continuous refinement.

The talk explores two key deployments of OneShield Privacy Guard. The first deployment focuses on an enterprise-scale multilingual system for data governance, demonstrating enhanced PII detection accuracy and optimized privacy-utility tradeoffs compared to existing solutions. OneShield's integration provided real-time privacy enforcement, improving compliance adherence in high-volume enterprise environments.

The second deployment highlights an open-source implementation for automated privacy risk triaging, where OneShield reduced manual intervention in privacy-sensitive pull requests by 30% while maintaining compliance precision. This deployment demonstrates its adaptability in privacy-first software development workflows, enabling efficient and automated risk mitigation.

These deployments illustrate OneShield's scalability and deployment flexibility in enterprise and open-source ecosystems. Attendees will gain insights into its technical architecture, tradeoff considerations, and deployment challenges, equipping them with strategies for building automated, high-fidelity privacy safeguards for real-world AI applications.

Meta has developed several streamlined workflows to enable developers to deploy purpose-limitation technology. Adoption of this technology can, however, often become challenging, both because of the scale at which Meta operates and the deep privacy domain knowledge and platform expertise required for efficiently implementing solutions.

This presentation will walk through how Meta leverages Generative AI and automation for scalable deployment of purpose limitation technology and guiding developers into building durable privacy solutions. We will discuss the architecture of the tooling behind key Privacy Workflows at Meta, such as annotating assets, reviewing data flows, and preventing regressions, and how we use Generative AI to accelerate decision-making for developers at every step of the way.