Engineering ManagerUser ProtectionGoogle
I lead engineers building security for the moments that are hardest to undo.
As an engineering manager at Google, I lead a large team that stops account takeover, fraud and abuse at scale, protects frontier AI models, and keeps autonomous agents accountable to the people they act for.
01Focus
The engineers on my team design, build, and ship this work. It sits where a security failure costs the most: money moving, accounts changing hands, AI models being copied, and agents acting on someone’s behalf.
A stolen session or a compromised device shouldn’t be enough to drain an account or lock out its owner. My team builds risk-based step-up re-authentication built on phishing-resistant passkeys, so the riskiest actions get a real check while everyday use stays frictionless.
When abuse is automated and coordinated, per-request checks fall short. The trust signals and access controls we build separate real people from abuse at scale—fake accounts, scraping, and manipulation of reputation or money—without taxing everyone else.
Frontier models take years and enormous investment to build, which makes them worth copying or misusing. We detect and limit large-scale extraction and abuse of model access, so those capabilities stay with the people who built them.
Once agents act on people’s behalf, authorization has to answer new questions: what was this agent allowed to do, and did a human actually mean it? We’re building delegated-trust primitives that contain hijacked agents and confirm real human intent before high-stakes commitments.
02About
“My job is to sit beside the driver, stay calm, and make sure every turn in the road is visible before one is taken.”
I'm an Engineering Manager in User Protection at Google, where I've worked for over a decade on user authentication, abuse prevention, applied cryptography, and privacy-enhancing technologies.
I hire strong engineers and give them ownership of hard problems, but I don't make them learn expensive lessons by crashing. When an engineer faces a decision that's hard to undo, I first listen until I can say their reasoning back to them more clearly than they first put it. Then I ask the questions that open up the map: What else could this look like? What happens if the attacker adapts? What would have to be true for the other option to win? The call stays theirs, made with every branch in view.
Before managing, I spent several years as a software engineer and researcher at Google, taking applied cryptography and PETs from papers into production. I created Capillary, an open-source library for end-to-end encrypted mobile push messaging; co-authored KHyperLogLog to measure joinability risk across large datasets; worked on differential privacy at scale, including the anonymization of Google's public COVID-19 datasets; and contributed to Google's Fully Homomorphic Encryption library.
I received my Ph.D. in Computer Science from the Graduate Center, CUNY in 2015, advised by Nelly Fazio. My thesis work covered outsider-anonymous broadcast encryption, cryptographic steganography, and hard-core predicates for Diffie-Hellman problems.
03Research
Applied privacy and cryptography work at Google, and the foundational research on anonymity and broadcast encryption behind it.
Google Research Whitepaper
Shruthi Gorantala, … Irippuge Milinda Perera, et al. (25 authors)
This whitepaper presents an open-source transpiler that converts high-level programs (e.g., C++) written for unencrypted data into programs that operate on encrypted data using fully homomorphic encryption. It builds on Google’s XLS SDK and the TFHE library, and its modular design lets the FHE library and the input and output languages vary.
Google Research Technical Report
Shailesh Bavadekar, … Irippuge Milinda Perera, et al. (25 authors)
This report describes how the public COVID-19 Vaccination Search Insights dataset is aggregated and anonymized. The process bounds each user’s daily contributions, adds Gaussian noise, and drops unreliable data points, protecting each user’s daily vaccination-related search activity with (ε, δ)-differential privacy (ε = 2.19, δ = 10⁻⁵).
Google Research Technical Report
Shailesh Bavadekar, … Irippuge Milinda Perera, et al. (30 authors)
This report describes how the public COVID-19 Search Trends symptoms dataset, covering roughly 400 symptoms, is aggregated and anonymized. The process bounds each user’s daily contributions, adds Laplace noise, and drops unreliable data points, protecting each user’s daily symptom search activity with ε-differential privacy (ε = 1.68).
IEEE Symposium on Security and Privacy (S&P)
Pern Hui Chia, Damien Desfontaines, Irippuge Milinda Perera, et al. (8 authors)
This paper presents KHyperLogLog (KHLL), an algorithm based on approximate counting that estimates the reidentifiability and joinability risks of very large databases using linear runtime and minimal memory. It supports quantitative measurement of reidentifiability, separation of pseudonymous and identified data sets, and periodic analyses that serve as regression tests for privacy.
Annual Conference of the International Technology Alliance (ACITA)
Nelly Fazio, Antonio R. Nicolosi, and Irippuge Milinda Perera
This paper proposes Oblivious Group Storage (OGS), an extension of oblivious storage to group data sharing, in which arbitrary subsets of clients share read/write access to cloud-stored data while data secrecy and access-pattern obliviousness hold against the server and unauthorized clients. It gives a provably secure generic construction based on outsider-anonymous broadcast encryption and multi-user oblivious RAM.
IEEE Int. Conf. on Advanced Information Networking and Applications (AINA)
Joseph Soryal, Irippuge Milinda Perera, et al. (6 authors)
This paper addresses insider denial-of-service attacks on the IEEE 802.11 MAC layer, in which a compromised node alters its DCF firmware to capture the channel. It proposes a distributed defense in which honest nodes detect the attacker by comparing observed traffic against patterns derived from a two-dimensional Markov chain, then evade it with channel hopping coordinated by identity-based or broadcast encryption; simulations show the broadcast encryption variant recovers faster.
Topics in Cryptology – CT-RSA
Nelly Fazio, Antonio R. Nicolosi, and Irippuge Milinda Perera
This paper initiates the study of broadcast steganography, which lets a sender covertly communicate with a dynamically chosen set of receivers while outsiders and unauthorized users remain unaware. It introduces outsider-anonymous broadcast encryption with pseudorandom ciphertexts (oABE$) and uses it to build a scheme secure in the standard model against adaptive adversaries with sublinear communication complexity.
Advances in Cryptology – CRYPTO
Nelly Fazio, Rosario Gennaro, Irippuge Milinda Perera, and William E. Skeith III
This paper makes progress on the long-standing open problem of deterministic hard-core predicates for Diffie-Hellman over finite fields. It defines a natural variant of the problem over 𝔽_p² and proves that every bit of one coordinate of the secret value is unpredictable, with the result also covering segment predicates and elliptic-curve Diffie-Hellman.
Annual Conference of the International Technology Alliance (ACITA)
Nelly Fazio and Irippuge Milinda Perera
This paper formalizes outsider-anonymous broadcast encryption (oABE), which hides the identities of authorized receivers from outsiders, and gives the first such scheme with ciphertexts sublinear in the number of authorized users. It presents generic constructions secure under adaptive corruptions in the standard model, two constructions with enhanced decryption, and a symmetric-key optimization with constant key storage at the broadcast center.
Public Key Cryptography – PKC
Nelly Fazio and Irippuge Milinda Perera
This paper formalizes outsider-anonymous broadcast encryption (oABE), which hides the identities of authorized receivers from outsiders, and gives the first such scheme with sublinear ciphertexts. It presents generic constructions secure under adaptive corruptions in the chosen-plaintext and chosen-ciphertext settings, plus two constructions with enhanced decryption under the gap and decisional Diffie-Hellman assumptions.
04Talks
From RSA and CRYPTO to university seminars: differential privacy at scale, broadcast steganography, and anonymous broadcast encryption.
GC Cryptography Student Seminar, The Graduate Center of CUNY, New York, NY, USA, February 21
IBM Research Cryptography Seminar, Thomas J. Watson Research Center, Yorktown Heights, NY, USA, April 10
GC Cryptography Student Seminar, The Graduate Center of CUNY, New York, NY, USA, June 22
NYU Cryptography Seminar, New York University, New York, NY, USA, April 25
05Archive
Theses and technical reports, kept online so old citations still resolve.
Graduate Center, CUNY
Kenneth Ezirim, … Irippuge Milinda Perera, et al. (5 authors)
Graduate Center, CUNY
Kenneth Ezirim, … Irippuge Milinda Perera, et al. (5 authors)
Graduate Center, CUNY
Irippuge Milinda Perera