简体中文
English
Website review
This review may include AI-generated content and is not individually verified. Domain, certificate and other facts come from the observed data on this page.
What is the SAND Lab?
The SAND Lab is a research group at the University of Chicago whose name stands for Security, Algorithms, Networking and Data. It is co-directed by Professors Ben Y. Zhao and Heather Zheng, and its work centers on security and machine learning, with occasional projects in human-computer interaction and data mining. The group is small by design — roughly 6 to 10 PhD, master's and undergraduate researchers, plus visiting scholars.
SAND Lab
What the lab actually works on
The page lists current research areas including adversarial machine learning and wireless and mobile systems. The news items give a clearer picture of the flavor of the work: adversarial mislabeling "poison" attacks, measuring generative-AI crawlers and defenses, generative-AI image detection, diffusion model research, and privacy attacks. Several of these projects have appeared at security and ML venues, and the lab's output has drawn outside recognition, including a CCS Distinguished Paper Award and coverage of lab members in Forbes, MIT Technology Review and TIME.
Who it suits
This is a good fit if you want security research with a strong machine-learning component, and you are comfortable in a lab small enough that you work closely with the two directors rather than disappearing into a large group. Because the group spans security, ML, networking and data, students often combine a systems or attack/defense angle with modeling work. The trade-off is scale: a lab of this size has fewer parallel projects to sample from, so your experience depends heavily on the specific project you join and on the two co-advisors' attention.
If you are considering applying
The page states the lab is recruiting 1–2 students in the 2025–2026 admission cycle, asks interested applicants to fill out a short Google form to stay on a candidate shortlist, and advises mentioning Heather and Ben when selecting faculty in the UChicago PhD application. A practical next step: read two or three recent papers from the publications list, then write a short note connecting your own interests to one specific line of work — for example adversarial ML or genAI measurement — rather than a generic expression of interest.
What PhD positions are available at the SAND Lab and how can I apply?
The SAND Lab at the University of Chicago is recruiting 1–2 PhD students for the 2025–2026 admission cycle. This is a specific, time-bound opening rather than a general call for applicants at all levels.
How to apply
- Fill out the lab's short Google form to be kept on a shortlist of candidates.
- Apply to the UChicago PhD program through the standard process.
- When selecting faculty in the UChicago PhD application, mention both Heather Zheng and Ben Y. Zhao, the lab's co-directors.
The form is a supplement to the official application, not a replacement. Treat the university application as the formal step and the form as a way to flag your interest to the lab directly.
What the lab works on
The lab's stated research spans security and machine learning, with occasional work in HCI and data mining. Named research areas include:
- Adversarial machine learning
- Wireless and mobile systems
- Security and privacy topics such as generative AI image detection and adversarial mislabeling attacks
Lab membership is small — roughly 6–10 PhD, MS and undergraduate researchers plus visiting scholars — so admitted students work closely with the co-directors.
Practical next step
Before submitting, read recent lab publications to see which threads match your interests, then email Ben Zhao or Heather Zheng with a short note about your background and the specific project area you'd want to work in. Mentioning them in the application checkboxes without a prior research fit is weaker than pairing the form with a targeted message.
For comparison, other security and ML groups with similar PhD recruiting include Carnegie Mellon School of Computer Science and UC Berkeley EECS.
What are the main research areas of the SAND Lab?
The SAND Lab at the University of Chicago focuses on security, algorithms, networks, and data, with machine learning as a central thread. Its listed research spans security and ML, with occasional work in HCI and data mining. Two named areas are Adversarial Machine Learning and Wireless and Mobile Systems.
That combination matters if you are deciding whether the lab fits your interests. It is not a single-topic group: projects can sit at the intersection of attacks and defenses, generative AI, privacy, networking, and mobile sensing. The lab is co-directed by Ben Y. Zhao and Heather Zheng and includes roughly 6–10 PhD, MS, and undergraduate researchers plus visiting scholars, so the day-to-day work is likely to be collaborative and cross-area rather than tied to one narrow agenda.
A concrete example from the page evidence is work on generative AI image detection, which received a CCS Distinguished Paper Award, and Nightshade, which appeared at IEEE S&P. Those sit closer to adversarial ML and generative-model security than to wireless systems, which shows how the lab's output can cluster around current security and ML problems even though the stated scope is broader.
If you are considering applying, the page says the lab is recruiting 1–2 students in the 2025–2026 admission cycle and asks interested applicants to fill out a short form and mention Heather and Ben when selecting faculty in the UChicago PhD application. A useful next step is to read the publications page and identify two or three papers closest to your own interests, then check whether they fall under adversarial ML, wireless/mobile systems, or another area listed on the site. For broader context on the department, see UChicago Computer Science.
What is the SAND Lab's work on adversarial machine learning?
The SAND Lab at the University of Chicago studies adversarial machine learning as one of its core research areas, alongside security, networking and data. In practice, that means building and breaking systems where machine-learning models can be manipulated—poisoning training data, mislabeling inputs, or otherwise causing a model to behave against its users' interests—and then designing defenses.
What the lab's adversarial ML work covers
From the lab's own announcements, several concrete threads stand out:
- Data poisoning and mislabeling attacks. The lab highlighted a CCS paper on "Hemlock" attacks, described as adversarial mislabeling poison. This is the classic adversarial-ML problem of corrupting a model's training signal so it learns the wrong association.
- Attacks on generative models. Work on "Nightshade" (IEEE S&P 2024) and a diffusion-model "implosion" paper (ACM CCS 2024) targets image-generation systems, aiming to disrupt or degrade models that may have been trained on data without consent.
- Detection and defense. A generative-AI image detection paper received a CCS Distinguished Paper Award, showing the lab also works on the defensive side—identifying synthetic or manipulated content.
- Measurement of real-world exposure. An IMC paper measured genAI crawlers and defenses, which connects adversarial concerns to how data actually gets collected across the web.
- Privacy attacks. A dissertation on AI-enhanced privacy attacks points to adversarial techniques being used to extract or infer private information.
Who this matters to
If you are a student considering a PhD, the lab explicitly says it is recruiting 1–2 students in the 2025–2026 admission cycle, and it asks interested applicants to fill out a short form and mention Heather and Ben when selecting faculty on the UChicago PhD application. If you are a researcher or practitioner, the work is relevant when you need to reason about whether a model can be trusted under deliberate manipulation—for example, when training on scraped data, deploying image generators, or building detection tools.
How to decide if it fits you
The lab is co-directed by Ben Y. Zhao and Heather Zheng and spans security and machine learning with occasional forays into HCI and data mining. That breadth means a good fit if you want adversarial ML grounded in systems and measurement rather than purely theoretical bounds. A useful next step is to read the specific papers named above, then check the lab's publications page for the fuller picture before reaching out. For comparison, other groups with related security-and-ML focuses include UC Berkeley Security and University of Maryland Cybersecurity.
What is Glaze and how does it protect artists from AI?
Glaze is a research project from the SAND Lab at the University of Chicago, a group co-directed by Ben Y. Zhao and Heather Zheng that works on security, machine learning, and related areas. It is a tool aimed at helping artists protect their work from being imitated by generative AI models.
Its approach is often described as a "style cloak." Rather than preventing copying through watermarking or licensing, Glaze works on the image itself: it makes small, human-imperceptible changes that steer an AI model toward learning a different visual style than the artist's actual one. A model trained on cloaked images would tend to produce outputs that miss the artist's distinctive look, while the image still looks normal to people.
The lab's page notes that Glaze won the Chicago Innovation Award and received special mention in TIME Magazine's Best Inventions of 2023. Related work from the lab includes Nightshade, which targets models trained on uncloaked images, and research on detecting AI-generated images.
If you're an artist considering it, the practical next step is to apply Glaze before posting work publicly, since protection depends on the version models see. Keep in mind that cloaking is an arms race: it can raise the cost of imitation but is not an absolute guarantee, and it does not stop a determined actor from training on uncloaked copies found elsewhere.
For related tools and context, see Glaze and SAND Lab.
What is Nightshade and how does it affect AI models?
Nightshade is a tool for "poisoning" the training data of generative AI models so that the models learn subtly wrong associations between prompts and images. It was developed by researchers in the SAND Lab at the University of Chicago, and the lab lists the Nightshade paper as appearing at IEEE S&P 2024 (with authors including Shawn Shan, Wenxin Ding, Josephine Passananti and Stanley Wu). It is best understood as a data-poisoning attack aimed at image-generation models, and it is closely related to the lab's Glaze project, which helps artists mask their style from being imitated.
H3 How it works, in plain terms
Nightshade exploits the fact that text-to-image models learn by pairing captions with images. A user applies a small, often imperceptible perturbation to images before publishing them. When a model later scrapes and trains on enough of these altered images, it absorbs the wrong pairing: for example, images of dogs may be labeled or associated with "cat," so a prompt for "dog" starts producing distorted or unexpected output. The effect is cumulative — a handful of poisoned images is unlikely to matter, but many can shift what the model has learned.
H3 What it means in practice
- For artists and rights holders: it is a defensive measure meant to make unauthorized scraping and training less attractive or less reliable, complementing style-masking tools.
- For model developers and dataset curators: it is a warning that web-scraped training data is untrusted input, and that provenance, filtering and detection of perturbed images matter.
- For researchers: it is a case study in how small, distributed changes to data can produce broad behavioral changes in a model.
H3 Trade-offs and limits
Poisoning is not a one-shot fix. Its impact depends on how many poisoned samples enter a training set relative to clean data, how the model is trained, and whether the data is filtered or curated. Perturbations can also degrade if images are resized, recompressed or processed. And the technique can be misused: the same mechanism that protects artists could be used to degrade a model deliberately, which is why the lab frames it alongside detection and defense work.
If you are deciding whether it is relevant to you: an artist concerned about style imitation should look at Glaze first, since it targets style protection, while Nightshade targets the model's learned concepts. A developer building a training pipeline should treat both as reasons to audit data sources and test for perturbed inputs before training.
Proofpoint
User reviews (0)