SPUR Scholars tackle security and privacy challenges in inaugural summer program

Can artificial intelligence fool the systems that websites use to verify someone's identity? How can researchers make privacy and security technologies easier for everyday people to use? And what does it take to turn a promising idea into meaningful scientific research?

These were among the questions undergraduate students explored this summer at Carnegie Mellon University as part of the inaugural Security and Privacy Undergraduate Research (SPUR) Scholars program, which gave students from universities across the country an opportunity to work alongside leading researchers on some of today's most pressing cybersecurity challenges.

The 10-week program ran from May 26 through August 1 and offered students hands-on experience conducting research under the guidance of CMU faculty and graduate student mentors.

Run in conjunction with Carnegie Mellon's long-running Research Experiences for Undergraduates in Software Engineering (REUSE) program, SPUR focuses specifically on cybersecurity and privacy, preparing students to tackle complex research problems while exploring potential careers in academia and industry.

This summer's research opportunities spanned a wide range of topics, including artificial intelligence, hardware security, cryptography, software testing, and usable privacy and security.

Projects explored topics ranging from protecting sensitive information collected by smart devices and identifying vulnerabilities in computer processors, to improving cybersecurity education and developing tools that help software engineers write more secure code.

For Khalid Alamri, a computer science major concentrating in cybersecurity and digital forensics at Arizona State University, the program offered an opportunity to investigate a rapidly emerging security threat: the potential misuse of generative AI to fabricate digital evidence used for online identity verification.

“It was honestly transformative in terms of how I think about research,” said Alarmi.

Working with researchers Joseph Calandrino and Sarah Scheffler, Alamri examined whether publicly available AI tools could convincingly alter photographs and other digital evidence, whether those tools would refuse potentially deceptive requests, and whether existing AI detection technologies could identify the resulting images.

The preliminary findings highlighted potential weaknesses in both AI safeguards and detection capabilities.

“Across 48 tests, only two were ever refused,” said Alamri. “The takeaway is not just that AI can fake things. It’s that safety behavior is inconsistent.”

Alamri also found that AI detection tools varied considerably in their ability to identify manipulated images. While some tools successfully detected alterations, others failed to recognize them in certain categories, illustrating potential gaps in technologies designed to distinguish authentic images from AI-generated or manipulated content.

Although the limited number of tests means further research is needed before drawing broader conclusions, the project reinforced the importance of investigating how emerging technologies could undermine the security of systems people already rely on.

Beyond the technical findings, Alamri particularly valued the mentorship he received, including guidance on research ethics, data collection, and developing a rigorous testing methodology.

“My mentors Joe, Alex, and Sarah treated me like a real contributor from day one,” he said. “I also really valued how much they pushed back constructively when my results looked shaky. They asked the hard questions, and that made my final work stronger.”

The experience has even prompted Alamri to reconsider his plans after graduation. Having previously expected to enter the cybersecurity industry immediately after completing his undergraduate degree, he is now considering graduate school and additional research opportunities.

Jennifer Forsyth, an undergraduate student at the University of California San Diego, experienced a similar shift in perspective during her summer working with Lorrie Cranor, director of CyLab and its Usable Privacy and Security Laboratory (CUPS).

Forsythe worked with Cranor’s PhD students on two research projects. In one project, the researchers showed short anti-scam videos to participants and then observed whether they made better decisions about clicking on suspicious email links after watching the videos. In the other project, the researchers compared the responses of in-person and online survey takers in an effort to inform the design of a system to ensure that survey responses come from actual humans rather than AI agents.

Having previously participated in undergraduate research, Forsyth arrived at CMU hoping to take a more active role in the scientific process. Earlier experiences had sometimes left her feeling disconnected from the larger goals of her work, with research assignments that did not always provide opportunities to explore the questions behind them.

SPUR offered something different.

“I felt like it was a great opportunity to really dive deeper and take control of what I was doing,” said Forsyth. “I definitely felt my input really did matter in everything I was doing.”

Forsyth credited her mentors and fellow researchers with creating a welcoming environment where she felt comfortable asking questions, proposing ideas, and contributing to the direction of her work.

"It was just a really inclusive learning environment for me, and I really liked that," she said.

Just as importantly, the experience strengthened Forsyth's interest in using research to address problems that directly affect people's lives. By helping make privacy and security technologies more understandable and accessible, she sees an opportunity to make a meaningful contribution to her community.

Before participating in SPUR, Forsyth was uncertain whether pursuing research or attending graduate school would be the right path for her. By the end of the summer, that uncertainty had given way to a clearer sense of direction.

"This SPUR program really kind of pushed me and motivated me further to pursue research," she said.

Forsyth is now exploring graduate programs, and she hopes to eventually earn a Ph.D. and continue studying usable privacy and security.

As Forsyth looks toward that future, she is enthusiastic about continuing the work she began at Carnegie Mellon.

“There's just so many opportunities for me to go into privacy and security, and I'm excited for that,” she said.

Applications for the 2027 SPUR program will open in December 2026 and will be available on the REUSE website at https://www.cmu.edu/scs/s3d/reuse/.