
Mohamed Moustafa Dawoud
PhD Student · UC Santa Cruz
I am a PhD student in Computer Science & Engineering at UC Santa Cruz, co-advised by Prof. Ram Sundara Raman and Prof. Leilani Gilpin. I am also a Research Technologist Intern in the Audits Division at the California Privacy Protection Agency. I study AI-enabled privacy risks and abuse as sociotechnical problems: how they affect people, and how the people affected keep up with them or fail to. On the harm side, that means new forms of abuse such as non-consensual deepfakes, synthetic media, and abuse sold as a service. On the human side, it means how everyday users form mental models of digital protections, how engineers and practitioners weigh privacy trade-offs under regulatory pressure, and how policymakers read ambiguous or conflicting frameworks. I use large-scale internet measurements, qualitative interviews, and controlled experiments to find where these groups are misaligned. I am also asking whether AI can be turned into a tool for defense: whether the same technology can help users recognize and resist threats, help practitioners build safer systems under regulatory uncertainty, and give policymakers the empirical grounding they need to act.
News
Work in Progress
Governing the Open-Weight Ecosystem Behind Explicit Image Generation
In PreparationMohamed Moustafa Dawoud (lead author)
We study the open-weight model ecosystem supporting explicit and identity-specific image generation, including risks of non-consensual intimate imagery (NCII). We examine model-level interventions, their effects on shared model use, and cross-platform persistence to inform platform governance.
The Impact of US Age Verification Laws on Adult Content Consumption
Under ReviewAlejandro Cuevas, Mohamed Moustafa Dawoud, Zhibin Shen, Ram Sundara Raman, Manoel Horta Ribeiro
We leverage individual-level panel data derived from mobile browsing activity to study the impact of age verification laws on adult content consumption, from both compliant and non-compliant sites, in the US.
Publications
View allPrivAudit: A Dual-Lens Auditing Framework for Website Privacy Practices under the CCPA
Mohamed Moustafa Dawoud, Riya Aggarwal, Likith Rahul Krishnamurthy, Ram Sundara Raman
ACM CCS 2026To appear
An automated framework that audits website privacy two ways at once: LLM scoring of privacy policies against CCPA provisions, and browser measurement of what cookies actually get written. Across 998 sites, CCPA-subject policies disclose more, but tracking barely moves: 6,392 targeting cookies, 49% of them third-party writes, largely unresponsive to privacy signals.
From Underground to Mainstream Marketplaces: Measuring AI-Enabled NSFW Deepfakes on Fiverr
Mohamed Moustafa Dawoud, Alejandro Cuevas, Ram Sundara Raman
USEC 2026, co-located with NDSS
We investigate whether AI-enabled NSFW services have moved into mainstream gig marketplaces. Through keyword searches, sitemap analysis, and snowball sampling, we identify 593 AI-enabled NSFW gigs on Fiverr: 82.8% expose deepfake-enabling features, 74.9% of sellers joined in 2025, and sellers disproportionately target platforms like OnlyFans and Instagram.
Vendor communication themes in darknet Ransomware-as-a-Service (RaaS) advertisements
Taylor Fisher, Zacharias Pieri, C. Jordan Howell, Roberta O'Malley, Lauren Tremblay, Mohamed Dawoud
Computers in Human Behavior
A thematic analysis of RaaS advertisements on darknet markets. The most common theme was victimization, appearing in 70% of the dataset. The themes show how vendors pitch pre-built ransomware to both novice and experienced cybercriminals.
DVa: Extracting Victims and Abuse Vectors from Android Accessibility Malware
Haichuan Xu, Mingxuan Yao, Runze Zhang, Mohamed Moustafa Dawoud, Jeman Park, Brendan Saltaformaggio
USENIX Security 2024
We developed DVa, a malware analysis pipeline using dynamic victim-guided execution and symbolic analysis, to uncover accessibility malware's targeted victims and abuse vectors. Deployed on 9,850 a11y malware samples, DVa uncovered 215 unique victims targeted with an average of 13.9 abuse routines.
Recent Posts
View allCommunity Notes Across Languages and Cultures: The World Cup as a Case Study
I spent a World Cup testing how well Community Notes catches fakes, in dozens of languages, using both machines and people.
The Geography of Nonconsensual Intimate Images
What counts as an intimate image is not fixed. It shifts by country, by law, and by faith, and it decides who the law protects and who it charges.
A World Cup of Deepfakes
Making a lie got cheap. Catching one didn't. I spent this tournament watching the gap widen.
Messi vs. Egypt vs. the Deepfakes: A World Cup Story in Arabic
Fake Messi videos flooded Egyptian timelines before Tuesday's match. I took them apart, frame by frame.
So, What Would You Do?
On nonconsensual intimate imagery, and how cultural context changes the answer.
Let's Collaborate
I welcome research collaborations and enjoy mentoring students finding their path. If something here resonated, I'd love to connect.
Get in touch


