Ari Juels

Proof of work and denial-of-service defenses

In 1999, Juels and Markus Jakobsson coined and formalized the term "proof of work" in a paper that predated its use in the Bitcoin white paper and is cited among the academic precursors of Bitcoin's design. The same year, with John Brainard, he introduced client puzzles, a proof-of-work-based countermeasure against connection-depletion denial-of-service attacks. Similar proof-of-work challenges are used in modern bot-mitigation and anti-abuse systems, including those of Cloudflare and the Tor Project.

Fuzzy cryptography and authentication

Juels co-developed error-tolerant cryptographic primitives for securing noisy data such as biometric templates: the fuzzy commitment scheme with Martin Wattenberg in 1999, and the fuzzy vault scheme with Madhu Sudan in 2002. This line of work was later applied in RSA products to protect answers to personal security questions used in password recovery. With Ronald Rivest and others, he proposed "fourth-factor authentication" in 2006, a recovery mechanism in which a user who has lost access to a credential is vouched for by pre-designated trusted acquaintances. The paper is credited with first proposing the designated-trustee model of account recovery, which was later adopted in consumer services including Facebook's Trusted Contacts (2013–2022) and Apple's Account Recovery Contact (introduced 2021).

Privacy and electronic voting

In 2001, Juels proposed the first protocols for targeted advertising that preserve user privacy, using private information retrieval and mix networks to let advertisers select ads without learning users' profiles. In 2005, with Dario Catalano and Jakobsson, he introduced the notion of coercion resistance for electronic voting systems, a security property intended to defeat vote buying and voter coercion that has since become standard in the field.

From 2003 to 2009, Juels worked extensively on the security and privacy of RFID and NFC tags. With Rivest and Michael Szydlo he proposed the "blocker tag", a device that selectively prevents RFID readers from scanning consumer items, followed by a lower-cost "soft blocking" variant. His 2006 survey of RFID security and privacy is among his most cited works.

Cloud storage

In 2007, Juels and Burton Kaliski introduced and formalized proofs of retrievability (PoRs), the first cryptographic technique allowing a storage provider to prove to a client that a remotely stored file remains complete and intact without the client downloading it. The concept spawned a substantial line of follow-up work on verifiable cloud storage.

Machine learning security

In 2016, Juels co-authored work introducing model-extraction attacks, in which an adversary reconstructs a proprietary machine learning model by issuing queries to its prediction API; the paper helped establish model stealing as a research area within adversarial machine learning.

Blockchain

Much of Juels's recent research concerns blockchain oracles, which supply external data to smart contracts. His group developed Town Crier (2016), described in later literature as the first oracle to combine Intel SGX with Ethereum smart contracts; it runs inside an SGX trusted execution environment to fetch data from HTTPS websites and deliver it to smart contracts with hardware attestations of its authenticity, and DECO (2020), a cryptographic protocol that lets users prove facts about data retrieved over TLS without revealing the data itself. Both systems were subsequently deployed by Chainlink.

In 2020, Juels co-authored "Flash Boys 2.0", which coined the term "miner extractable value" (MEV), later generalized to maximal extractable value, to describe the profit that block producers can extract by reordering, inserting, or censoring transactions. The paper initiated the systematic study of MEV, which has since become a significant market and research area in blockchain systems.