About

Rachel Greenstadt is a Professor in the Department of Computer Science and Engineering at NYU Tandon School of Engineering and a faculty member of the NYU Center for Cybersecurity. She holds a bachelor’s degree in Computer Science from MIT (2001), as well as master’s degrees in Electrical Engineering and Computer Science from MIT (2002), and a Ph.D. in Computer Science from Harvard (2007). Her research focuses on designing trustworthy intelligent systems that act with integrity, especially systems that can be trusted with important data and decisions. She takes an interdisciplinary approach, incorporating ideas from artificial intelligence, psychology, economics, data privacy, and system security. Greenstadt has contributed to understanding the implications of privacy tools and ad blocking technologies, including their unintended effects on user privacy and online content quality. She has also evaluated the capabilities of large language models in detecting online propaganda, highlighting their limitations in identifying complex techniques. Throughout her career, she has been recognized with honors such as membership in the DARPA Computer Science Study Group, a U.S. Department of Homeland Security Fellowship, a PET Award for Outstanding Research in Privacy Enhancing Technologies, and a National Science Foundation CAREER Award. She has previously served as an Associate Professor at Drexel University, where she led the Privacy, Security, and Automation Laboratory (PSAL), and held positions at Harvard and other institutions. Greenstadt is actively involved in the academic community, editing volumes of the Proceedings on Privacy Enhancing Technologies and participating in numerous workshops and conferences related to security, AI, and usability.

Research topics

• Computer Science
• Political Science
• Computer Security
• Internet privacy
• Artificial Intelligence
• Machine Learning
• Psychology
• World Wide Web
• Law
• Social psychology

Selected publications

• Large-Scale Analysis of Political Propaganda on Moltbook

  ArXiv.org · 2026-03-18

  articleOpen accessSenior author

  We present an NLP-based study of political propaganda on Moltbook, a Reddit-style platform for AI agents. To enable large-scale analysis, we develop LLM-based classifiers to detect political propaganda, validated against expert annotation (Cohen's $κ$= 0.64-0.74). Using a dataset of 673,127 posts and 879,606 comments, we find that political propaganda accounts for 1% of all posts and 42% of all political content. These posts are concentrated in a small set of communities, with 70% of such posts falling into five of them. 4% of agents produced 51% of these posts. We further find that a minority of these agents repeatedly post highly similar content within and across communities. Despite this, we find limited evidence that comments amplify political propaganda.

  PublisherOA PDF

• Large-Scale Analysis of Persuasive Content on Moltbook

  arXiv (Cornell University) · 2026-03-18

  preprintOpen accessSenior author

  We present an NLP-based study of political propaganda on Moltbook, a Reddit-style platform for AI agents. To enable large-scale analysis, we develop LLM-based classifiers to detect political propaganda, validated against expert annotation (Cohen's $κ$= 0.64-0.74). Using a dataset of 673,127 posts and 879,606 comments, we find that political propaganda accounts for 1% of all posts and 42% of all political content. These posts are concentrated in a small set of communities, with 70% of such posts falling into five of them. 4% of agents produced 51% of these posts. We further find that a minority of these agents repeatedly post highly similar content within and across communities. Despite this, we find limited evidence that comments amplify political propaganda.

  PublisherDOI

• When Agents Persuade: Rhetoric Generation and Mitigation in LLMs

  Open MIND · 2026-03-04

  preprintSenior author

  Despite their wide-ranging benefits, LLM-based agents deployed in open environments can be exploited to produce manipulative material. In this study, we task LLMs with propaganda objectives and analyze their outputs using two domain-specific models: one that classifies text as propaganda or non-propaganda, and another that detects rhetorical techniques of propaganda (e.g., loaded language, appeals to fear, flag-waving, name-calling). Our findings show that, when prompted, LLMs exhibit propagandistic behaviors and use a variety of rhetorical techniques in doing so. We also explore mitigation via Supervised Fine-Tuning (SFT), Direct Preference Optimization (DPO), and ORPO (Odds Ratio Preference Optimization). We find that fine-tuning significantly reduces their tendency to generate such content, with ORPO proving most effective.

  DOI

• When Agents Persuade: Rhetoric Generation and Mitigation in LLMs

  ArXiv.org · 2026-03-04

  articleOpen accessSenior author

  Despite their wide-ranging benefits, LLM-based agents deployed in open environments can be exploited to produce manipulative material. In this study, we task LLMs with propaganda objectives and analyze their outputs using two domain-specific models: one that classifies text as propaganda or non-propaganda, and another that detects rhetorical techniques of propaganda (e.g., loaded language, appeals to fear, flag-waving, name-calling). Our findings show that, when prompted, LLMs exhibit propagandistic behaviors and use a variety of rhetorical techniques in doing so. We also explore mitigation via Supervised Fine-Tuning (SFT), Direct Preference Optimization (DPO), and ORPO (Odds Ratio Preference Optimization). We find that fine-tuning significantly reduces their tendency to generate such content, with ORPO proving most effective.

  PublisherOA PDF

• Be Sure to Use the Same Writing Style: Applying Authorship Verification on Large-Language-Model-Generated Texts

  Applied Sciences · 2025-02-25 · 2 citations

  articleOpen accessSenior author

  Recently, there have been significant advances and wide-scale use of generative AI in natural language generation. Models such as OpenAI’s GPT3 and Meta’s LLaMA are widely used in chatbots, to summarize documents, and to generate creative content. These advances raise concerns about abuses of these models, especially in social media settings, such as large-scale generation of disinformation, manipulation campaigns that use AI-generated content, and personalized scams. We used stylometry (the analysis of style in natural language text) to analyze the style of AI-generated text. Specifically, we applied an existing authorship verification (AV) model that can predict if two documents are written by the same author on texts generated by GPT2, GPT3, ChatGPT and LLaMA. Our AV model was trained only on human-written text and was effectively used in social media settings to analyze cases of abuse. We generated texts by providing the language models with fanfiction snippets and prompting them to complete the rest of it in the same writing style as the original snippet. We then applied the AV model across the texts generated by the language models and the human written texts to analyze the similarity of the writing styles between these texts. We found that texts generated with GPT2 had the highest similarity to the human texts. Texts generated by GPT3 and ChatGPT were very different from the human snippet, and were similar to each other. LLaMA-generated texts had some similarity to the original snippet but also has similarities with other LLaMA-generated texts and texts from other models. We then conducted a feature analysis to identify the features that drive these similarity scores. This analysis helped us answer questions like which features distinguish the language style of language models and humans, which features are different across different models, and how these linguistic features change over different language model versions. The dataset and the source code used in this analysis have been made public to allow for further analysis of new language models.

  PublisherOA PDFDOI

• An Analysis of Chinese Censorship Bias in LLMs

  Proceedings on Privacy Enhancing Technologies · 2025-07-13 · 2 citations

  articleOpen accessSenior author

  When a large language model (LLM) has been trained on text featuring social biases, those biases implicitly impact the outputs of the model. Training an LLM on sanitized content, i.e., those pieces of content which remain after being subjected to state censorship (including alterations, deletions, and self-imposed censorship), results in what we term censorship bias. A model impacted by censorship bias may be less likely to reflect views that are routinely prohibited and more likely to reflect views that are not. This may particularly be an issue when interfacing with a model in a language that is predominantly used in a region with strong censorship laws. In this work, we outline what censorship bias is, introduce a novel methodology for identifying and measuring it, and apply that methodology to evaluate the most popular current LLMs. As part of the contributions of this work we designed and evaluated CensorshipDetector, a Chinese language text classification model which we use as part of our experimental design. Our evaluation of CensorshipDetector found it to be 91% accurate at differentiating between sanitized content and non-sanitized content. Our testing revealed evidence of censorship bias across all of the models we evaluated. Finally, we outline the potential harms of censorship bias, namely the exportation of information manipulation that would have primarily harmed a domestic audience to diaspora, as well as recommendations to various stakeholders to limit the harms of censorship bias and prevent it in the future.

  PublisherDOI

• More and Scammier Ads: The Perils of YouTube's Ad Privacy Settings

  Proceedings on Privacy Enhancing Technologies · 2025-07-13 · 1 citations

  articleOpen access

  When users disable online ad personalization, they might be anticipating to see fewer ads that are "relevant" to them as a trade-off for more privacy. In this paper, we show that the tradeoff can go much further than this intuition. We conducted controlled experiments on YouTube in Australia, Canada, Ireland, the United Kingdom, and the United States to investigate the impact of disabling ad personalization on the quantity and quality of ads that users receive. Through experiments where emulated users with different ad privacy settings watched sequences of 400 videos, we show that disabling ad personalization can lead to the user being shown as much as 1.30 times more pre-roll ads than the default (least private) setting. More concerning is that in our experiments, the proportion of predatory ads increased 2.69 times compared to the default setting, from 2.5% to 8.7% of ads. This result highlights that certain user demographics (in this case, privacy-conscious users) can be exposed to significantly higher rates of predatory ads, and suggests that the platform's efforts to curb such ads are still falling short.

  PublisherDOI

• Are Large Language Models Good at Detecting Propaganda?

  ArXiv.org · 2025-05-19 · 1 citations

  articleOpen accessSenior author

  Propagandists use rhetorical devices that rely on logical fallacies and emotional appeals to advance their agendas. Recognizing these techniques is key to making informed decisions. Recent advances in Natural Language Processing (NLP) have enabled the development of systems capable of detecting manipulative content. In this study, we look at several Large Language Models and their performance in detecting propaganda techniques in news articles. We compare the performance of these LLMs with transformer-based models. We find that, while GPT-4 demonstrates superior F1 scores (F1=0.16) compared to GPT-3.5 and Claude 3 Opus, it does not outperform a RoBERTa-CRF baseline (F1=0.67). Additionally, we find that all three LLMs outperform a MultiGranularity Network (MGN) baseline in detecting instances of one out of six propaganda techniques (name-calling), with GPT-3.5 and GPT-4 also outperforming the MGN baseline in detecting instances of appeal to fear and flag-waving.

  PublisherOA PDFDOI

• LLMs for Detection and Classification of Persuasion Techniques in Slavic Parliamentary Debates and Social Media Texts

  2025-01-01 · 1 citations

  articleOpen accessSenior author

  We present an LLM-based method for the Slavic NLP 2025 shared task on detection and classification of persuasion techniques in parliamentary debates and social media.Our system uses OpenAI's GPT models (gpt-4o-mini) and reasoning models (o4-mini) with chain-ofthought prompting, enforcing a 0.99 confidence threshold for verbatim span extraction.For subtask 1, each paragraph in the text is labeled "true" if any of the 25 persuasion techniques is present.For subtask 2, the model returns the full set of techniques used per paragraph.Across Bulgarian, Croatian, Polish, Russian, and Slovenian, we achieve Subtask 1 micro-F1 of 81.7%, 83.3%, 81.6%, 73.5%, 62.0%, respectively, and Subtask 2 F1 of 41.0%, 44.4%, 41.9%, 29.3%, 29.9%, respectively.Our system ranked in the top 2 for Subtask 2 and top 7 for Subtask 1.

  PublisherOA PDFDOI

• What’s in a Label? Propaganda Labels and User Sharing Behavior on Social Media Platforms

  Proceedings of the International AAAI Conference on Web and Social Media · 2025-06-07

  articleOpen accessSenior author

  Authentic information is vital for a society's ability to make rational decisions. Fabricated and manipulative information can be harmful to society as seen in cases of threatening events that were consequences of foreign propaganda and radical ideologies. While past research has studied dis- and misinformation on social media platforms, the study of propaganda has received much less attention. This study explores the sharing intentions of propaganda on social media platforms and develops an intervention to help detect it. In a randomized controlled trial setting, we added indicators to social media posts that used propaganda techniques to advance an agenda, including techniques that rely on fallacious reasoning, emotional rather than logical reasoning, etc. We then asked our participants (n=1,187) about their intention to engage with these posts. We found that participants were significantly (2.4 times) less likely to share these posts with indicators. We also found that participants’ political affiliation moderated their sharing intentions. We believe our findings provide valuable insights for the study of propaganda on social media platforms.

  PublisherOA PDFDOI

Recent grants

• SaTC: CORE: Medium: Collaborative: Measuring the Value of Anonymous Online Participation

  NSF · $595k · 2019–2023

• SaTC: CORE: Medium: Collaborative: Measuring the Value of Anonymous Online Participation

  NSF · $836k · 2017–2020

• EAGER: Cybercrime Science

  NSF · $189k · 2013–2016

• Collaborative Research: SaTC: CORE: Medium: Threat Intelligence for Targets of Coordinated Harassment

  NSF · $824k · 2020–2024

• CAREER: Privacy Analytics for Users in a Big Data World

  NSF · $495k · 2013–2019

Frequent coauthors

• Edwin Dauber

  DEVCOM Army Research Laboratory

  31 shared

• Gregory C. Shearer

  Pennsylvania State University

  27 shared

• Michael J. Weisman

  United States Army Combat Capabilities Development Command

  27 shared

• Frederica F. Nelson

  26 shared

• Robert F. Erbacher

  K Lab (United States)

  25 shared

• Damon McCoy

  New York University

  23 shared

• Andrea Forte

  Drexel University

  20 shared

• Benjamin Mako Hill

  18 shared

Labs

• NYU Center for CybersecurityPI

Awards & honors

• DARPA Computer Science Study Group membership
• U.S. Department of Homeland Security Fellowship
• PET Award for Outstanding Research in Privacy Enhancing Tech…
• NSF CAREER Award