CyLab researchers present their work at SOUPS 2026

Carnegie Mellon faculty and students will share their research at next week’s 2026 Symposium on Usable Privacy and Security (SOUPS), which takes place August 23-26 in Hannover, Germany.

Founded by CyLab Director Lorrie Cranor and first hosted by CMU in 2005, the event continues to bring together interdisciplinary groups of researchers who are focused on solving challenges in areas of security, privacy, and human-computer interaction.

Here, we’ve compiled a list of technical papers co-authored by CyLab Security and Privacy Institute members and posters that will be presented at the event.

Technical Paper

Quantifying Risk Perception and Scam Response Among International and Domestic US University Students

Authors: Alexandra Xinran Li, Elijah Bouma-Sims, Lily Klucinec, and Ray Liu, Carnegie Mellon University; Ayesha Binte Mostofa, University of Massachusetts, Amherst; Arjun Arunasalam, Florida International University; Lorrie Faith Cranor, Carnegie Mellon University; Pubali Datta, University of Massachusetts, Amherst; Lucy Simko, Barnard College, Columbia University; Karen Sowon, Indiana University

Abstract: We conducted an online survey of 1,074 students from five U.S. universities to examine and quantify the differences between domestic and international students' scam encounters, engagement behaviors, reporting tendencies, and exposure to anti-scam training. International students were significantly more likely than domestic students to say they would engage with scammers when presented with suspicious phone-call and text-message scenarios, but also more likely to disengage in our suspicious-rental email scenario. We found no difference in their ability to detect suspicious cues, but international students may require more evidence before disengaging in certain scenarios. While domestic students are more likely to encounter generic scams, international students reported more loss from authority-based, rental, and “unknown language'” scams. International students reported a greater reliance on social media and peer support to avoid scams. They were significantly more likely to report incidents to law enforcement than domestic students, but less likely to report overall, use call filters, or online platform tools. We provide recommendations for improving both scam training offered by universities and digital scam reporting platforms.

Posters

Does the Take9 Cybersecurity Awareness Campaign Work?

Researchers: Ginger Smith, Michael Stoneman, Risa Shishido, and Lorrie Faith Cranor, Carnegie Mellon University

From “Be Careful” to “Here’s Why”: Investigating User Reasoning with Context-Specific SMS Scam Warnings

Researchers: Elijah Bouma-Sims, Enze Liu, Alexandra Xinran Li, and Lorrie Faith Cranor, Carnegie Mellon University

Unveiling ML Developers’ Perceived and Actual Barriers of Privacy-Preserving Machine Learning Techniques

Researchers: Odunayo Akinlade, Nouba-Asra Goursam Tresor, Yacoba Oduro-Yeboah, Hana Habib, Yuvraj Agarwal, and Lorrie Faith Cranor, Carnegie Mellon University

Verified, But Not Yours? Risks in the Email Verification Process

Researchers: Ayushi Mishra and Miuyin Yong Wong, University of Maryland; Joseph A. Calandrino, Carnegie Mellon University; Michelle L. Mazurek, University of Maryland

Too Good to Ignore: How Directional Goals Shape Scam Perception

Researchers: Diya Krishnan, Yun Chieh Yang, and Zoie Sloneker, Carnegie Mellon University 

Developer Perspectives on Information-Flow Security Threats and Tooling

Researchers: Twain Byrnes, Pragya Chaubey, Ana Fontan, and Nisarga Gondi, Carnegie Mellon University; McKenna McCall, Colorado State University; Limin Jia, Carnegie Mellon University

Sneaky Links: Evaluating the Usability of Private Data Sharing Guidances

Researchers: Sydney Earp, Lynn Zhang, Abhinaya Nagalla, Raghav Trivedi, and Sarah Scheffler, Carnegie Mellon University; Christine Task, Knexus Research Group