Thomas Steinke I am a Member of Technical Staff at Anthropic working on safeguards. Previously I was at IBM Research - Almaden (2016-2020) and Google Brain/DeepMind (2020-2026). I completed my PhD in Computer Science at Harvard University in 2016, where I was extremely fortunate to be advised by Salil Vadhan. Before that, I was at the University of Canterbury in my hometown of Christchurch, New Zealand. My research interests include principled approaches to data privacy (specifically, differential privacy), its connections to learning and generalization (particularly in the adaptive setting), and pseudorandomness. Email:     thomas@stein.ke

Research

• Adapting AlphaEvolve to Optimize Fully Homomorphic Encryption on TPUs
  with Shruthi Gorantala, Jianming Tong, Asra Ali, Baiyu Li, Jonathan Katz, Jeremy Kun, Abhradeep Thakurta, Julian Walker, and Amir Yazdanbakhsh, 2026.
• Privately Estimating Black-Box Statistics
  with Günter F. Steinke, COLT 2026.
• Correlated Noise Mechanisms for Differentially Private Learning
  with Krishna Pillutla, Jalaj Upadhyay, Christopher A. Choquette-Choo, Krishnamurthy Dvijotham, Arun Ganesh, Monika Henzinger, Jonathan Katz, Ryan McKenna, H. Brendan McMahan, Keith Rush, and Abhradeep Thakurta, 2025.
• Hash-Prune-Invert: Improved Differentially Private Heavy-Hitter Detection in the Two-Server Model
  with Borja Balle, James Bell-Clark, Albert Cheu, Adria Gascon, Jonathan Katz, Mariana Raykova, and Phillipp Schoppmann, IEEE S&P 2025.
• Privately Evaluating Untrusted Black-Box Functions
  with Ephraim Linder, Sofya Raskhodnikova, and Adam Smith, STOC 2025.
• The Last Iterate Advantage: Empirical Auditing and Principled Heuristic Analysis of Differentially Private SGD
  with Milad Nasr, Arun Ganesh, Borja Balle, Christopher A. Choquette-Choo, Matthew Jagielski, Jamie Hayes, Abhradeep Guha Thakurta, Adam Smith, and Andreas Terzis, ICLR 2025.
• Near Exact Privacy Amplification for Matrix Mechanisms
  with Christopher A. Choquette-Choo, Arun Ganesh, Saminul Haque, and Abhradeep Thakurta, ICLR 2025.
• Private Geometric Median
  with Mahdi Haghifam and Jonathan Ullman, NeurIPS 2024.
• Stealing Part of a Production Language Model
  with Nicholas Carlini, Daniel Paleka, Krishnamurthy Dj Dvijotham, Jonathan Hayase, A. Feder Cooper, Katherine Lee, Matthew Jagielski, Milad Nasr, Arthur Conmy, Itay Yona, Eric Wallace, David Rolnick, and Florian Tramèr, ICML 2024.
• Avoiding Pitfalls for Privacy Accounting of Subsampled Mechanisms under Composition
  with Christian Janos Lebeda, Matthew Regehr, and Gautam Kamath, SatML 2025.
• Efficient and Near-Optimal Noise Generation for Streaming Differential Privacy
  with Krishnamurthy (Dj) Dvijotham, H. Brendan McMahan, Krishna Pillutla, and Abhradeep Thakurta, FOCS 2024.
• Privacy Amplification for Matrix Mechanisms
  with Christopher A. Choquette-Choo, Arun Ganesh, and Abhradeep Thakurta, ICLR 2024.
• Correlated Noise Provably Beats Independent Noise for Differentially Private Learning
  with Christopher A. Choquette-Choo, Krishnamurthy Dvijotham, Krishna Pillutla, Arun Ganesh, and Abhradeep Thakurta, ICLR 2024.
• Counting Distinct Elements Under Person-Level Differential Privacy
  with Alexander Knop, NeurIPS 2023.
• Differentially Private Medians and Interior Points for Non-Pathological Data
  with Maryam Aliakbarpour, Rose Silver, and Jonathan Ullman, ITCS 2024.
• Faster Differentially Private Convex Optimization via Second-Order Methods
  with Arun Ganesh, Mahdi Haghifam, and Abhradeep Thakurta, NeurIPS 2023.
• Privacy Auditing with One (1) Training Run
  with Milad Nasr and Matthew Jagielski, NeurIPS 2023.
• Differentially Private Stream Processing at Scale
  with Bing Zhang, Vadym Doroshenko, Peter Kairouz, Abhradeep Thakurta, Ziyin Ma, Himani Apte, and Jodi Spacek, 2023.
• Why Is Public Pretraining Necessary for Private Model Training?
  with Arun Ganesh, Mahdi Haghifam, Milad Nasr, Sewoong Oh, Om Thakkar, Abhradeep Thakurta, and Lun Wang, ICML 2023.
• Tight Auditing of Differentially Private Machine Learning
  with Milad Nasr, Jamie Hayes, Borja Balle, Florian Tramèr, Matthew Jagielski, Nicholas Carlini, and Andreas Terzis, USENIX Security 2023.
• A Bias-Variance-Privacy Trilemma for Statistical Estimation
  with Gautam Kamath, Argyris Mouzakis, Matthew Regehr, Vikrant Singhal, and Jonathan Ullman, 2023.
• Differentially Private Linear Regression via Medians
  with Alexander Knop, 2022.
• Composition of Differential Privacy & Privacy Amplification by Subsampling
  book chapter, 2022.
• Algorithms with More Granular Differential Privacy Guarantees
  with Badih Ghazi, Ravi Kumar, and Pasin Manurangsi, ITCS 2023.
• Debugging Differential Privacy: A Case Study for Privacy Auditing
  with Florian Tramèr, Andreas Terzis, Shuang Song, Matthew Jagielski, and Nicholas Carlini, 2022.
• Public Data-Assisted Mirror Descent for Private Model Training
  with Ehsan Amid, Arun Ganesh, Rajiv Mathews, Swaroop Ramaswamy, Shuang Song, Vinith M. Suriyakumar, Om Thakkar, and Abhradeep Thakurta, ICML 2022.
• A Private and Computationally-Efficient Estimator for Unbounded Gaussians
  with Gautam Kamath, Argyris Mouzakis, Vikrant Singhal, and Jonathan Ullman, COLT 2022.
• Hyperparameter Tuning with Renyi Differential Privacy
  with Nicolas Papernot, ICLR 2022.
• PAC-Bayes, MAC-Bayes and Conditional Mutual Information: Fast rate bounds that handle general VC classes
  with Peter Grünwald and Lydia Zakynthinou, COLT 2021.
• Privately Learning Subspaces
  with Vikrant Singhal, NeurIPS 2021.
• The Permute-and-Flip Mechanism is Identical to Report-Noisy-Max with Exponential Noise
  with Zeyu Ding, Daniel Kifer, Sayed M. Saghaian N. E., Yuxin Wang, Yingtai Xiao, and Danfeng Zhang, 2021
• Leveraging Public Data for Practical Private Query Release
  with Terrance Liu, Giuseppe Vietri, Jonathan Ullman, and Zhiwei Steven Wu, ICML 2021.
• The Distributed Discrete Gaussian Mechanism for Federated Learning with Secure Aggregation
  with Peter Kairouz and Ziyu Liu, ICML 2021.
• Evading the Curse of Dimensionality in Unconstrained Private GLMs
  with Shuang Song, Om Thakkar, and Abhradeep Thakurta, AISTATS 2021.
• Multi-Central Differential Privacy
  2020.
• The Discrete Gaussian for Differential Privacy
  with Clément Canonne and Gautam Kamath, NeurIPS 2020.
• Reasoning About Generalization via Conditional Mutual Information
  with Lydia Zakynthinou, COLT 2020.
• New Oracle-Efficient Algorithms for Private Synthetic Data Release
  with Giuseppe Vietri, Grace Tian, Mark Bun, and Steven Wu, ICML 2020.
• Average-Case Averages: Private Algorithms for Smooth Sensitivity and Mean Estimation
  with Mark Bun, NeurIPS 2019.
• Private Hypothesis Selection
  with Mark Bun, Gautam Kamath, and Zhiwei Steven Wu, NeurIPS 2019.
• A Hybrid Approach to Privacy-Preserving Federated Learning
  with Stacey Truex, Nathalie Baracaldo, Ali Anwar, Heiko Ludwig, Rui Zhang, and Yi Zhou, AISec 2019.
• Towards Instance-Optimal Private Query Release
  with Jaroslaw Blasiok, Mark Bun, and Aleksandar Nikolov, SODA 2019.
• The Limits of Post-Selection Generalization
  with Kobbi Nissim, Adam Smith, Uri Stemmer, and Jonathan Ullman, NeurIPS 2018.
• Composable and Versatile Privacy via Truncated CDP
  with Mark Bun, Cynthia Dwork, and Guy N. Rothblum, STOC 2018.
• Calibrating Noise to Variance in Adaptive Data Analysis
  with Vitaly Feldman, COLT 2018.
• Tight Lower Bounds for Differentially Private Selection
  with Jonathan Ullman, FOCS 2017.
• Generalization for Adaptively-chosen Estimators via Stable Median
  with Vitaly Feldman, COLT 2017.
• Subgaussian Tail Bounds via Stability Arguments
  with Jonathan Ullman, 2017.
• Upper and Lower Bounds for Privacy and Adaptivity in Algorithmic Data Analysis
  PhD Thesis, Harvard University 2016.
• Exposed! A Survey of Attacks on Private Data
  with Cynthia Dwork, Adam Smith, and Jonathan Ullman, Annual Review of Statistics and Its Application 2017.
• Concentrated Differential Privacy: Simplifications, Extensions, and Lower Bounds
  with Mark Bun, TCC 2016-B.
• Make Up Your Mind: The Price of Online Queries in Differential Privacy
  with Mark Bun and Jonathan Ullman, SODA 2017.
• Robust Traceability from Trace Amounts
  with Cynthia Dwork, Adam Smith, Jonathan Ullman, and Salil Vadhan, FOCS 2015.
• Algorithmic Stability for Adaptive Data Analysis
  with Raef Bassily, Kobbi Nissim, Adam Smith, Uri Stemmer, and Jonathan Ullman, STOC 2016.
• Between Pure and Approximate Differential Privacy
  with Jonathan Ullman, TPDP 2015 & Journal of Privacy and Confidentiality 2017.
• Weighted Polynomial Approximations: Limits for Learning and Pseudorandomness
  with Mark Bun, RANDOM 2015.
• Interactive Fingerprinting Codes and the Hardness of Preventing False Discovery
  with Jonathan Ullman, COLT 2015.
• Pseudorandomness and Fourier Growth Bounds for Width 3 Branching Programs
  with Salil Vadhan and Andrew Wan, RANDOM 2014 & Theory of Computing 2017.
• Pseudorandomness for Regular Branching Programs via Fourier Analysis
  with Omer Reingold and Salil Vadhan, RANDOM 2013.
• Pseudorandomness for Permuatation Branching Programs Without the Group Theory
  ECCC 2012.
• Learning Hurdles for Sleeping Experts
  with Varun Kanade, ITCS 2012 & Transactions on Computing Theory 2014.
• Hierarchical Heavy Hitters with the Space Saving Algorithm
  with Michael Mitzenmacher and Justin Thaler, ALENEX 2012.
• Constructive Notions of Compactness in Apartness Spaces
  MSc Thesis, University of Canterbury 2011.
• A Rigorous Extension of the Schonhage-Strassen Integer Multiplication Algorithm Using Complex Interval Arithmetic
  with Raazesh Sainudiin, CCA 2010 & Reliable Computing 2013.

Olds and News

• I joined Anthropic!
• I received the 2024 Caspar Bowden Award for Outstanding Recearch in Privacy Enhancing Technologies for my paper The Discrete Gaussian for Differential Privacy with Clément Canonne and Gautam Kamath.
• My paper Stealing Part of a Production Language Model with Nicholas Carlini, Daniel Paleka, Krishnamurthy Dj Dvijotham, Jonathan Hayase, A. Feder Cooper, Katherine Lee, Matthew Jagielski, Milad Nasr, Arthur Conmy, Itay Yona, Eric Wallace, David Rolnick, and Florian Tramèr received an ICML 2024 Best paper award.
• I'm honoured to receive a NeurIPS 2023 Outstanding paper award for my paper Privacy Auditing with One (1) Training Run with Milad Nasr and Matthew Jagielski.
• Marco Gaboardi, Jun Sakuma, and I are organizing a workshop on Differential Privacy and its Applications in Japan in mid 2020 8-12 November 2021 October 31 to November 4, 2022 October 28 to November 1, 2024.
• I mentored Mahdi Haghifam as a 2022 summer intern.
• Gautam Kamath, Seša Slavković, Adam Smith, Jon Ullman, and I organized a Workshop on Differential Privacy and Statistical Data Analysis at The Fields Institute in Toronto 25-29 July 2022.
• ICLR 2022 Outstanding paper award for my paper Hyperparameter Tuning with Renyi Differential Privacy with Nicolas Papernot.
• Check out DifferentialPrivacy.org.
• I mentored Vikrant Singhal and Lydia Zakynthinou as 2020 IBM summer interns.
• I mentored Lydia Zakynthinou as a 2019 IBM summer intern.
• See here for some open problems in differential privacy, including two from me.
• For Spring 2019, I was visiting the Simons Institute for the Theory of Computing at UC Berkeley for the Data Privacy: Foundations and Applications program.
• Mark Bun, Cynthia Dwork, Toniann Pitassi, Guy Rothblum, Kunal Talwar, and I organized a workshop on the Mathematical Foundations of Data Privacy in April/May 2018 in Banff, Canada.
• Steinke is a german name meaning little stone. (Stein means stone or rock and -ke is a diminutive suffix.) The "correct" pronounciation is, approximately, Shteyn-keh, but I sometimes am lazy and use the anglicized pronounciation of Styne-key. I honestly don't care how it is pronounced, as long as it is vaguely recognizable and does not smell bad. My preferred name is Thomas and my preferred pronouns are he/him/his, but Dr. Steinke and they/them/their are also acceptable.

Last updated June 2026 by Thomas Steinke.