# Nicholas Carlini

Research and product · Security research at Anthropic · joined 2025

Known for breaking machine learning defenses. He won an obfuscated C contest with tic-tac-toe in a single printf call.

Full profile: https://www.autumn.ai/resources/anthropic/people/nicholas-carlini

**At Anthropic:**
- Mar 2025 – present: Research Scientist, safety and security
Sources: [1](https://nicholas.carlini.com/) [2](https://nicholas.carlini.com/writing/2025/career-update.html)

**Career before Anthropic:**
- 2023–2025: Google DeepMind, research scientist
- 2018–2023: Google Brain, research scientist
Sources: [1](https://nicholas.carlini.com/)

**Education:**
- B.A., computer science and mathematics, UC Berkeley, 2013
- Ph.D., Computer Science, UC Berkeley, 2018
Sources: [1](https://en.wikipedia.org/wiki/Nicholas_Carlini)

**Lesser-known facts:**
- Built a working CPU inside Conway's Game of Life. [1](https://nicholas.carlini.com/)
- Spent seven years at Google Brain and DeepMind before joining in 2025. [1](https://nicholas.carlini.com/)
- Left Google DeepMind in March 2025 over disagreements about openly publishing security and privacy research, joining Anthropic "for a year." [1](https://nicholas.carlini.com/writing/2025/career-update.html)
- Weighed founding a security nonprofit or taking a faculty job, and spent over 20 hours talking to Anthropic staff before deciding. [1](https://nicholas.carlini.com/writing/2025/career-update.html)
- Used Claude Code to find remotely exploitable Linux kernel vulnerabilities, including one hidden for about 23 years. [1](https://mtlynch.io/claude-code-found-linux-vulnerability/)
- Co-authored a poisoning attack that bought expired domains behind LAION-400M links, controlling about 0.01% of popular datasets. [1](https://nicholas.carlini.com/)
- Showed hidden voice commands could be embedded in audio to fool Mozilla's DeepSpeech, work covered by the New York Times in 2018. [1](https://en.wikipedia.org/wiki/Nicholas_Carlini)
- Built a Doom clone in 13kB of JavaScript and a chess engine written in regular expressions. [1](https://nicholas.carlini.com/)

**Interviews and talks:**
- [[un]prompted 2026 talk: Black-hat LLMs (2026)](https://www.youtube.com/watch?v=1sd26pWhfmg)
- [Security Cryptography Whatever podcast on AI bug finding (2026)](https://securitycryptographywhatever.com/2026/03/25/ai-bug-finding/)

**Known for:**
- Carlini & Wagner attack (2016)
- "Towards Evaluating the Robustness of Neural Networks" (2017)
- "Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples" (2018)
- "Poisoning the Unlabeled Dataset of Semi-Supervised Learning" (2021)
- "Tight Auditing of Differentially Private Machine Learning" (2023)
- "Stealing Part of a Production Language Model" (2024)
Sources: [1](https://en.wikipedia.org/wiki/Nicholas_Carlini)

Researched with Autumn (https://www.autumn.ai) from public sources. Updated 2026-10-18. Everyone at Anthropic: https://www.autumn.ai/resources/anthropic/people