arXiv subjects

Ananta Soneji

Publications and source records attributed to Ananta Soneji.

5 recordsLinked to original sources

arXiv2026

Do Hackers Dream of Electric Teachers?: A Large-Scale, In-Situ Evaluation of Cybersecurity Student Behaviors and Performance with AI Tutors

To meet the ever-increasing demands of the cybersecurity workforce, AI tutors have been proposed for personalized, scalable education. But, while AI tutors have shown promise in introductory programming courses, no work has evaluated their use in hands-on exploration and exploitation of systems (e.g., ``capture-the-flag'') commonly used to teach cybersecurity. Thus, despite growing interest and need, no work has evaluated how students use AI tutors or whether they benefit from their presence in real, large-scale cybersecurity courses. To answer this, we conducted a semester-long observational study on the use of an embedded AI tutor with 309 students in an upper-division introductory cybersecurity course. By analyzing 142,526 student queries sent to the AI tutor across 396 cybersecurity challenges spanning 9 core cybersecurity topics and an accompanying set of post-semester surveys, we find (1) what queries and conversational strategies students use with AI tutors, (2) how these strategies correlate with challenge completion, and (3) students' perceptions of AI tutors in cybersecurity education. In particular, we identify three broad AI tutor conversational styles among users: Short (bounded, few-turn exchanges), Reactive (repeatedly submitting code and errors), and Proactive (driving problem-solving through targeted inquiry). We also find that the use of these styles significantly predicts challenge completion, and that this effect increases as materials become more advanced. Furthermore, students valued the tutor's availability but reported that it became less useful for harder material. Based on this, we provide suggestions for security educators and developers on practical AI tutor use.

cs.HC↗

arXiv2025

"It's not approved, but many, like myself, ignore the rule": Investigating the Landscape and Consequences of Unsanctioned Technology Use in Educational Institutes

Educators regularly use unsanctioned technologies (apps not formally approved by their institutions) for teaching, grading, and other academic tasks. While these tools often support instructional needs, they raise significant privacy, security, and regulatory compliance concerns. Despite its importance, understanding the adoptions and risks from the perspective of educators, who serve as de facto decision makers behind unsanctioned technology use, is largely understudied in existing literature.To address this gap, we conducted two surveys: one with 375 educators who listed 1,373 unsanctioned apps, and another with 21 administrators who either often help educators to set up educational technologies (EdTechs) or observe their security or privacy incidents. Our study identified 494 unique applications used by educators, primarily for pedagogical utility (n=213) and functional convenience (n=155), and the associated risks were often ignored. In fact, despite security and privacy concerns, many educators continued using the same apps (n = 62), citing a lack of alternatives or heavy dependence as barriers to discontinuation. We also found that fewer than a third of educators were aware of any institutional policy on unsanctioned technology use (K12: 30.3%, HEI: 24.8%), and 22 knowingly violated such policies. While 107 received formal warnings, only 33 adjusted their behavior. Finally, we conclude by discussing the implications of our findings and future recommendations to minimize the risks.

cs.CY↗

arXiv2025

Investigating the Security & Privacy Risks from Unsanctioned Technology Use by Educators

Educational technologies are revolutionizing how educational institutions operate. Consequently, it makes them a lucrative target for breach and abuse as they often serve as centralized hubs for diverse types of sensitive data, from academic records to health information. Existing studies looked into how existing stakeholders perceive the security and privacy risks of educational technologies and how those risks are affecting institutional policies for acquiring new technologies. However, outside of institutional vetting and approval, there is a pervasive practice of using applications and devices acquired personally. It is unclear how these applications and devices affect the dynamics of the overall institutional ecosystem. This study aims to address this gap by understanding why instructors use unsanctioned applications, how instructors perceive the associated risks, and how it affects institutional security and privacy postures. We designed and conducted an online survey-based study targeting instructors and administrators from K-12 and higher education institutions.

cs.CY↗

arXiv2024

Trust, Because You Can't Verify:Privacy and Security Hurdles in Education Technology Acquisition Practices

The education technology (EdTech) landscape is expanding rapidly in higher education institutes (HEIs). This growth brings enormous complexity. Protecting the extensive data collected by these tools is crucial for HEIs as data breaches and misuses can have dire security and privacy consequences on the data subjects, particularly students, who are often compelled to use these tools. This urges an in-depth understanding of HEI and EdTech vendor dynamics, which is largely understudied. To address this gap, we conducted a semi-structured interview study with 13 participants who are in EdTech leadership roles at seven HEIs. Our study uncovers the EdTech acquisition process in the HEI context, the consideration of security and privacy issues throughout that process, the pain points of HEI personnel in establishing adequate protection mechanisms in service contracts, and their struggle in holding vendors accountable due to a lack of visibility into their system and power-asymmetry, among other reasons. We discuss certain observations about the status quo and conclude with recommendations for HEIs, researchers, and regulatory bodies to improve the situation.

cs.CY↗

arXiv2022

"Nudes? Shouldn't I charge for these?" : Motivations of New Sexual Content Creators on OnlyFans

With over 1.5 million content creators, OnlyFans is one of the fastest growing subscription-based social media platforms. The platform is primarily associated with sexual content. Thus, OnlyFans creators are uniquely positioned at the intersection of professional social media content creation and sex work. While the experiences and motivations of experienced sex workers to adopt OnlyFans have been studied, in this work we seek to understand the motivations of creators who had not previously done sex work. Through a qualitative interview study of 22 U.S.-based OnlyFans creators, we find that beyond the typical motivations for pursuing gig work (e.g., flexibility, autonomy), our participants were motivated by three key factors: (1) societal visibility and mainstream acceptance of OnlyFans; (2) platform design and affordances such as boundary setting with clients, privacy from the public, and content archives; and (3) the pandemic, as OnlyFans provided an enormous opportunity to overcome lockdown-related issues.

cs.HC↗