ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models. - Ahmed Salem 001; Yang Zhang 016; Mathias Humbert; Mario Fritz; Michael Backes 001 (CoRR, 2018)

MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examples. - Jinyuan Jia 001; Ahmed Salem 001; Michael Backes 001; Yang Zhang 016; Neil Zhenqiang Gong (CCS, 2019)

ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models. - Ahmed Salem 001; Yang Zhang 016; Mathias Humbert; Pascal Berrang; Mario Fritz; Michael Backes 001 (NDSS, 2019)

Privacy-Preserving Similar Patient Queries for Combined Biomedical Data. - Ahmed Salem 001; Pascal Berrang; Mathias Humbert; Michael Backes 001 (Proc. Priv. Enhancing Technol., 2019)

Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning. - Ahmed Salem 001; Apratim Bhattacharya; Michael Backes 001; Mario Fritz; Yang Zhang 016 (USENIX Security Symposium, 2020)

BadNL: Backdoor Attacks Against NLP Models. - Xiaoyi Chen; Ahmed Salem 001; Michael Backes 001; Shiqing Ma; Yang Zhang 016 (CoRR, 2020)

BAAAN: Backdoor Attacks Against Autoencoder and GAN-Based Machine Learning Models. - Ahmed Salem 001; Yannick Sautter; Michael Backes 001; Mathias Humbert; Yang Zhang 016 (CoRR, 2020)

Don't Trigger Me! A Triggerless Backdoor Attack Against Deep Neural Networks. - Ahmed Salem 001; Michael Backes 001; Yang Zhang 016 (CoRR, 2020)

BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvements. - Xiaoyi Chen; Ahmed Salem 001; Dingfan Chen; Michael Backes 001; Shiqing Ma; Qingni Shen; Zhonghai Wu; Yang Zhang 016 (ACSAC, 2021)

MLCapsule: Guarded Offline Deployment of Machine Learning as a Service. - Lucjan Hanzlik; Yang Zhang 016; Kathrin Grosse; Ahmed Salem 001; Maximilian Augustin; Michael Backes 001; Mario Fritz (CVPR Workshops, 2021)

Dynamic Backdoor Attacks Against Machine Learning Models. - Ahmed Salem 001; Rui Wen 002; Michael Backes 001; Shiqing Ma; Yang Zhang 016 (EuroS&P, 2022)

Get a Model! Model Hijacking Attack Against Machine Learning Models. - Ahmed Salem 001; Michael Backes 001; Yang Zhang 016 (NDSS, 2022)

ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models. - Yugeng Liu; Rui Wen 002; Xinlei He 001; Ahmed Salem 001; Zhikun Zhang 001; Michael Backes 001; Emiliano De Cristofaro; Mario Fritz; Yang Zhang 016 (USENIX Security Symposium, 2022)

Adversarial inference and manipulation of machine learning models. - Ahmed Salem 001 (2022)

Bayesian Estimation of Differential Privacy. - Santiago Zanella-Béguelin; Lukas Wutschitz; Shruti Tople; Ahmed Salem 001; Victor Rühle; Andrew Paverd; Mohammad Naseri; Boris Köpf; Daniel Jones (ICML, 2023)

Analyzing Leakage of Personally Identifiable Information in Language Models. - Nils Lukas; Ahmed Salem 001; Robert Sim; Shruti Tople; Lukas Wutschitz; Santiago Zanella-Béguelin (SP, 2023)

SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learning. - Ahmed Salem 001; Giovanni Cherubin; David Evans 001; Boris Köpf; Andrew Paverd; Anshuman Suri; Shruti Tople; Santiago Zanella-Béguelin (SP, 2023)

UnGANable: Defending Against GAN-based Face Manipulation. - Zheng Li 023; Ning Yu 006; Ahmed Salem 001; Michael Backes 001; Mario Fritz; Yang Zhang 016 (USENIX Security Symposium, 2023)

Two-in-One: A Model Hijacking Attack Against Text Generation Models. - Wai Man Si; Michael Backes 001; Yang Zhang 016; Ahmed Salem 001 (USENIX Security Symposium, 2023)

Last One Standing: A Comparative Analysis of Security and Privacy of Soft Prompt Tuning, LoRA, and In-Context Learning. - Rui Wen 002; Tianhao Wang 001; Michael Backes 001; Yang Zhang 016; Ahmed Salem 001 (CoRR, 2023)

Comprehensive Assessment of Toxicity in ChatGPT. - Boyang Zhang; Xinyue Shen 001; Wai Man Si; Zeyang Sha; Zeyuan Chen; Ahmed Salem 001; Yun Shen; Michael Backes 001; Yang Zhang 016 (CoRR, 2023)

Rethinking Privacy in Machine Learning Pipelines from an Information Flow Control Perspective. - Lukas Wutschitz; Boris Köpf; Andrew Paverd; Saravan Rajmohan; Ahmed Salem 001; Shruti Tople; Santiago Zanella-Béguelin; Menglin Xia; Victor Rühle (CoRR, 2023)

Maatphor: Automated Variant Analysis for Prompt Injection Attacks. - Ahmed Salem 001; Andrew Paverd; Boris Köpf (CoRR, 2023)

Detection and Attribution of Models Trained on Generated Data. - Ge Han; Ahmed Salem 001; Zheng Li 023; Shanqing Guo; Michael Backes 001; Yang Zhang 016 (ICASSP, 2024)

Dataset and Lessons Learned from the 2024 SaTML LLM Capture-the-Flag Competition. - Edoardo Debenedetti; Javier Rando; Daniel Paleka; Silaghi Fineas Florin; Dragos Albastroiu; Niv Cohen; Yuval Lemberg; Reshmi Ghosh; Rui Wen 002; Ahmed Salem 001; Giovanni Cherubin; Santiago Zanella-Béguelin; et al. (NeurIPS, 2024)

Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack. - Mark Russinovich; Ahmed Salem 001; Ronen Eldan (CoRR, 2024)

Are you still on track!? Catching LLM Task Drift with Activations. - Sahar Abdelnabi; Aideen Fay; Giovanni Cherubin; Ahmed Salem 001; Mario Fritz; Andrew Paverd (CoRR, 2024)

SOS! Soft Prompt Attack Against Open-Source Large Language Models. - Ziqing Yang 002; Michael Backes 001; Yang Zhang 016; Ahmed Salem 001 (CoRR, 2024)

Hey, That's My Model! Introducing Chain & Hash, An LLM Fingerprinting Technique. - Mark Russinovich; Ahmed Salem 001 (CoRR, 2024)

Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification. - Boyang Zhang; Yicong Tan; Yun Shen; Ahmed Salem 001; Michael Backes 001; Savvas Zannettou; Yang Zhang 016 (CoRR, 2024)

Vera Verto: Multimodal Hijacking Attack. - Minxing Zhang; Ahmed Salem 001; Michael Backes 001; Yang Zhang 016 (CoRR, 2024)

Permissive Information-Flow Analysis for Large Language Models. - Shoaib Ahmed Siddiqui; Radhika Gaonkar; Boris Köpf; David Krueger 001; Andrew Paverd; Ahmed Salem 001; Shruti Tople; Lukas Wutschitz; Menglin Xia; Santiago Zanella-Béguelin (CoRR, 2024)

The Price of Intelligence: Three risks inherent in LLMs. - Mark Russinovich; Ahmed Salem 001; Santiago Zanella-Béguelin; Yonatan Zunger (ACM Queue, 2024)

Get My Drift? Catching LLM Task Drift with Activation Deltas. - Sahar Abdelnabi; Aideen Fay; Giovanni Cherubin; Ahmed Salem 001; Mario Fritz; Andrew Paverd (SaTML, 2025)

Obliviate: Efficient Unmemorization for Protecting Intellectual Property in Large Language Models. - Mark Russinovich; Ahmed Salem 001 (CoRR, 2025)

Jailbreaking is (Mostly) Simpler Than You Think. - Mark Russinovich; Ahmed Salem 001 (CoRR, 2025)

Linear Control of Test Awareness Reveals Differential Compliance in Reasoning Models. - Sahar Abdelnabi; Ahmed Salem 001 (CoRR, 2025)

Securing AI Agents with Information-Flow Control. - Manuel Costa; Boris Köpf; Aashish Kolluri; Andrew Paverd; Mark Russinovich; Ahmed Salem 001; Shruti Tople; Lukas Wutschitz; Santiago Zanella-Béguelin (CoRR, 2025)

LLMail-Inject: A Dataset from a Realistic Adaptive Prompt Injection Challenge. - Sahar Abdelnabi; Aideen Fay; Ahmed Salem 001; Egor Zverev; Kai-Chieh Liao; Chi-Huang Liu; Chun-Chih Kuo; Jannis Weigend; Danyael Manlangit; Alex Apostolov; Haris Umair; João Donato; et al. (CoRR, 2025)

LogiPlan: A Structured Benchmark for Logical Planning and Relational Reasoning in LLMs. - Yanan Cai; Ahmed Salem 001; Besmira Nushi; Mark Russinovich (CoRR, 2025)

A Representation Engineering Perspective on the Effectiveness of Multi-Turn Jailbreaks. - Blake Bullwinkel; Mark Russinovich; Ahmed Salem 001; Santiago Zanella-Béguelin; Daniel Jones; Giorgio Severi; Eugenia Kim; Keegan Hines; Amanda J. Minnich; Yonatan Zunger; Ram Shankar Siva Kumar (CoRR, 2025)