What New Tests Reveal About Online Privacy and Safety

Three studies test different parts of online safety

Online safety includes efforts to reduce harm linked to how information is shared and used online ⁴. The three recent studies here examine different safeguards: checks that try to confirm a person is live during remote identity verification, privacy risks in recommendation systems, and automated tools that judge whether online content is unsafe ¹²³.

Their methods and evidence differ. One is a small test using live sessions and face-swap tools; one examines recommender data and is described as peer reviewed; and one is an adversarial computer evaluation published as a preprint ¹²³. A preprint has not yet been checked by other scientists through peer review ¹³.

The key caution is simple: one study rarely settles a question. Results can depend on who or what was tested, which attack was used, and how success was measured. These findings can point to weaknesses worth examining, but they do not give a complete score for online safety in everyday use.

Active gestures improved face-swap detection in a small test

Remote identity checks often rely on a camera feed showing the person being verified. The researchers wanted to know whether asking someone to make gestures could help expose a real-time face swap, in which a tool changes the face shown in the video before it reaches the verifier ¹.

They tested 108 live sessions involving six subjects and 24 impersonated identities. Two face-swap tools were inserted into the camera stream. The researchers compared a static calibration segment with windows in which participants carried out randomized gestures ¹. This is a small experimental test of particular tools and configurations, not a survey of identity checks used across the internet.

The static segment had a session-level AUC of 0.878, while the average score across active-gesture windows was 0.988 ¹. AUC is a measure of how well a detector distinguishes between two groups; a higher score indicates better separation in the tested data. Pose and combined gestures had the highest estimates, while expressions did not clearly improve results. Hand occlusion against one face-swap setup performed worse than the static baseline ¹. The time needed to satisfy the check also separated attacks from genuine sessions, but less strongly: its AUC was 0.732 ¹.

These scores do not show how the checks would perform against every face-swap tool, attack setting or real user. The study tested only a few people and two tools, and the authors note that response time can include delays from the software and data transport, not just signs of an attack ¹. The paper is a preprint, so other scientists have not yet checked it ¹.

For readers, the result suggests that the design of an identity check may matter: asking for an action could help in some tested situations, but no single gesture or timing signal should be treated as a guarantee that a video is genuine.

Recommender embeddings can expose item identities

Recommendation systems can use language embeddings: numerical representations of text that help a computer compare meaning. The researchers asked whether these representations could reveal which items a system held, even when someone trying to identify them had only outside descriptions of those items ².

They tested a simple method based on cosine similarity, which compares how closely two representations point in the same direction. Across two real-world datasets, the method recovered item identities with high mean reciprocal rank across language models and candidate sets ². The abstract does not give a single percentage that would describe the risk for all systems.

The researchers found that leakage was strongest when the outside information partly overlapped with the information represented in the system. It also persisted when descriptions came from separate sources but had similar meanings. They further found that item leakage could extend to identifying users from sparse ratings. Obscuring descriptions reduced leakage, but involved a trade-off with usefulness ².

This study does not show that every recommender system exposes private information, or that every user's identity can be recovered. Its results concern two datasets and a particular kind of attack using available text; the reported findings do not establish how often the same method would work in a live service ².

The practical significance is that data need not be stored as plain text to carry clues. A computer-readable representation can still preserve enough meaning to help link it to outside information. The study gives reason to treat privacy and recommendation quality as connected design questions, rather than assuming that changing the format of text makes it private ².

AI safety judges performed differently on moderation and phishing

Automated safety tools can classify requests or assess risks such as phishing, fraudulent messages designed to trick people. The researchers compared a tool called Jev with five large-language-model judges and two locally run classifiers. They wanted to see how the systems responded to the same attacks under the same policy ³.

The computer evaluation covered four public-data tasks, including input moderation, injection detection, routing and phishing detection. The researchers used 50 attack variations from 13 groups ³. This was a controlled adversarial comparison, not a test of every safety tool or a measure of the harm people experience in everyday use.

For input moderation, Jev was the most robust system in the reported tests: eight attempts to forge its structured input bypassed none of its decisions. A sentence asking why someone might make a harmful request bypassed 9% of Jev's blocks, compared with 56% for GPT-6 Astra ³. The pattern differed for phishing. Jev detected 62% of the phishing emails, compared with 77–81% for the GLM judges; attacks bypassed 19–29% of the emails Jev flagged. Jev also flagged the most benign requests, at 27% ³.

These results do not show that one system is best for all purposes. They show performance on particular tasks and attack variants. The study is a preprint, meaning other scientists have not yet checked it ³. The authors also report that the local classifiers failed in different ways, including one attack that made Llama Guard 3 miss 62% of the phishing it had flagged ³.

For ordinary users, the main point is that an AI safety label is not a guarantee. A tool may do relatively well at checking a clear rule and less well at making a broader judgment, while also mistakenly flagging harmless material ³.

The studies point to safeguards with specific limits

Together, these studies show why a single headline score can be misleading. A face check may perform differently depending on the gesture and attack setup; information encoded for recommendations may still reveal clues; and an AI judge may be stronger on one task than another ¹²³. Each paper tests a defined problem, not online safety as a whole.

The evidence also varies in maturity. The recommender study is described as peer reviewed, while the face-swap and AI-judge papers are preprints ¹²³. Peer review is one form of scientific scrutiny, but it does not remove the need to consider a study's methods and limits. Preprints can be informative, but their claims may change after review or further testing.

What remains unclear is how consistently these findings will hold with more people, newer attack tools, different services and real-world conditions. The studies provide reasons to test safeguards against changing threats and to examine privacy risks in data representations, but they do not establish that any one approach reliably protects everyone ¹²³.