An ML Security Research Scientist carries out formal research into the security and privacy of machine learning models. The work asks precise questions. How much can an attacker learn about training data from model outputs? Which defences provide guarantees rather than just raising the cost of attack? How do these properties change as models scale? The answers usually take the form of new methods, rigorous evaluations and peer-reviewed papers.
Companies hire research scientists in this area when they want security built on evidence rather than assumption. Labs training large models need to understand memorisation and data extraction before release. Organisations handling sensitive data need privacy guarantees they can defend to regulators. Teams building defences want someone who can tell them, with proof or careful experiment, whether a defence works.
What does an ML Security Research Scientist do?
The role is centred on research but connected to production. An ML Security Research Scientist defines research problems, develops attacks and defences, publishes where appropriate, and works with engineers to bring results into training and deployment practice.
- Researching privacy attacks such as membership inference, attribute inference and training data extraction from language and vision models
- Studying memorisation in large models and how data deduplication, filtering and training choices affect it
- Developing and analysing defences with formal guarantees, including differential privacy in training and certified robustness methods
- Researching poisoning and backdoor attacks, including attacks on web-scale pretraining data and fine-tuning datasets
- Designing evaluation protocols that test defences against adaptive attackers
- Publishing at major machine learning and security conferences and reviewing others' work
- Advising product, privacy and legal teams on the practical meaning of research results, including under GDPR
Key skills and backgrounds
Almost all candidates hold a PhD in machine learning, computer security, cryptography, statistics or theoretical computer science. Senior candidates usually have a strong publication record and may have led their own research agenda. Hiring managers should look for depth in at least one area, such as privacy, robustness or poisoning, together with enough engineering skill to run experiments on large models.
Ask candidates to explain the threat model in one of their papers and how a stronger attacker would change the result. Good research scientists answer that question directly.
- Strong mathematical foundations in probability, statistics, optimisation and learning theory
- Differential privacy, including privacy accounting and private training methods
- Attack research across inference, extraction, poisoning and evasion
- Large-scale experimentation in PyTorch or JAX on modern model architectures
- Familiarity with federated learning and its specific security and privacy issues
- Rigorous experiment design, honest baselines and reproducible code
- Clear academic writing and the ability to explain results to non-specialists
Where ML Security Research Scientists work
Foundation model labs and the research divisions of large technology companies employ ML security research scientists in privacy, security and safety groups. Healthcare, financial services and telecoms organisations with large sensitive datasets hire them into applied research teams. Privacy technology start-ups need them to build their core methods. Government research bodies, AI safety institutes and universities also hire for the role, and many scientists move between academia and industry during their careers.
ML Security Research Scientist vs related roles
Several research roles share this territory. These are the main differences.
- An Adversarial Robustness Researcher focuses specifically on model behaviour under adversarial and shifted inputs, while an ML Security Research Scientist often covers privacy and data-centric attacks as well.
- An AI Safety Researcher studies risks that come from model behaviour and capability, rather than from an attacker exploiting the model or its data.
- An Alignment Researcher works on making models pursue intended goals and values, using methods such as RLHF and scalable oversight, which is separate from defending against external attacks.
Salary and market data
Packages for ML security research scientists depend on publication record, seniority and whether the role is in a lab, an enterprise research group or a public body. Current ranges are in our GenAI and agentic systems salary guide, with wider research benchmarks in the AI and deep tech salary guides. Use the deep tech salary calculator to check a specific offer.
Hiring ML Security Research Scientists with DeepRec
DeepRec recruits for AI research teams across Europe and the US, from London, Berlin, Zurich, Dublin and Boston. We screen research scientists on the substance of their work, discussing threat models, methods and evaluation choices, and we understand the questions candidates ask about publication freedom, compute access and research direction. We recruit on a permanent, contract, retained and executive search basis, from individual scientists to research leads building a new group. To discuss a hire, go to Looking to Hire.