Super-Sparse Regression for Fast Age Estimation from Faces at Test Time. - Ambra Demontis; Battista Biggio; Giorgio Fumera; Fabio Roli (ICIAP (2), 2015)

Secure Kernel Machines against Evasion Attacks. - Paolo Russu; Ambra Demontis; Battista Biggio; Giorgio Fumera; Fabio Roli (AISec@CCS, 2016)

On Security and Sparsity of Linear Classifiers for Adversarial Settings. - Ambra Demontis; Paolo Russu; Battista Biggio; Giorgio Fumera; Fabio Roli (S+SSPR, 2016)

Super-Sparse Learning in Similarity Spaces. - Ambra Demontis; Marco Melis; Battista Biggio; Giorgio Fumera; Fabio Roli (IEEE Comput. Intell. Mag., 2016)

Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization. - Luis Muñoz-González; Battista Biggio; Ambra Demontis; Andrea Paudice; Vasin Wongrassamee; Emil C. Lupu; Fabio Roli (AISec@CCS, 2017)

Is Deep Learning Safe for Robot Vision? Adversarial Examples Against the iCub Humanoid. - Marco Melis; Ambra Demontis; Battista Biggio; Gavin Brown 001; Giorgio Fumera; Fabio Roli (ICCV Workshops, 2017)

Infinity-Norm Support Vector Machines Against Adversarial Label Contamination. - Ambra Demontis; Battista Biggio; Giorgio Fumera; Giorgio Giacinto; Fabio Roli (ITASEC, 2017)

Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables. - Bojan Kolosnjaji; Ambra Demontis; Battista Biggio; Davide Maiorca; Giorgio Giacinto; Claudia Eckert 001; Fabio Roli (EUSIPCO, 2018)

On the Intriguing Connections of Regularization, Input Gradients and Transferability of Evasion and Poisoning Attacks. - Ambra Demontis; Marco Melis; Maura Pintor; Matthew Jagielski; Battista Biggio; Alina Oprea; Cristina Nita-Rotaru; Fabio Roli (CoRR, 2018)

Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attacks. - Ambra Demontis; Marco Melis; Maura Pintor; Matthew Jagielski; Battista Biggio; Alina Oprea; Cristina Nita-Rotaru; Fabio Roli (USENIX Security Symposium, 2019)

secml: A Python Library for Secure and Explainable Machine Learning. - Marco Melis; Ambra Demontis; Maura Pintor; Angelo Sotgiu; Battista Biggio (CoRR, 2019)

Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detection. - Ambra Demontis; Marco Melis; Battista Biggio; Davide Maiorca; Daniel Arp; Konrad Rieck; Igino Corona; Giorgio Giacinto; Fabio Roli (IEEE Trans. Dependable Secur. Comput., 2019)

AISec'20: 13th Workshop on Artificial Intelligence and Security. - Sadia Afroz 001; Nicholas Carlini; Ambra Demontis (CCS, 2020)

Adversarial Detection of Flash Malware: Limitations and Open Issues. - Davide Maiorca; Ambra Demontis; Battista Biggio; Fabio Roli; Giorgio Giacinto (Comput. Secur., 2020)

Can Domain Knowledge Alleviate Adversarial Attacks in Multi-Label Classifiers? - Stefano Melacci; Gabriele Ciravegna; Angelo Sotgiu; Ambra Demontis; Battista Biggio; Marco Gori; Fabio Roli (CoRR, 2020)

Deep neural rejection against adversarial examples. - Angelo Sotgiu; Ambra Demontis; Marco Melis; Battista Biggio; Giorgio Fumera; Xiaoyi Feng; Fabio Roli (EURASIP J. Inf. Secur., 2020)

Session details: Session 2B: Machine Learning for Cybersecurity. - Ambra Demontis (AISec@CCS, 2021)

The Hammer and the Nut: Is Bilevel Optimization Really Needed to Poison Linear Classifiers? - Antonio Emanuele Cinà; Sebastiano Vascon; Ambra Demontis; Battista Biggio; Fabio Roli; Marcello Pelillo (IJCNN, 2021)

Intriguing Usage of Applicability Domain: Lessons from Cheminformatics Applied to Adversarial Learning. - Luke Chang; Katharina Dost; Kaiqi Zhao 001; Ambra Demontis; Fabio Roli; Gill Dobbie; Jörg Wicker (CoRR, 2021)

Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples. - Maura Pintor; Luca Demetrio; Angelo Sotgiu; Giovanni Manca; Ambra Demontis; Nicholas Carlini; Battista Biggio; Fabio Roli (CoRR, 2021)

The Threat of Offensive AI to Organizations. - Yisroel Mirsky; Ambra Demontis; Jaidip Kotak; Ram Shankar; Gelei Deng; Liu Yang 003; Xiangyu Zhang; Wenke Lee; Yuval Elovici; Battista Biggio (CoRR, 2021)

AISec '22: 15th ACM Workshop on Artificial Intelligence and Security. - Ambra Demontis; Xinyun Chen; Florian Tramèr (CCS, 2022)

Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples. - Maura Pintor; Luca Demetrio; Angelo Sotgiu; Ambra Demontis; Nicholas Carlini; Battista Biggio; Fabio Roli (NeurIPS, 2022)

A Survey on Reinforcement Learning Security with Application to Autonomous Driving. - Ambra Demontis; Maura Pintor; Luca Demetrio; Kathrin Grosse; Hsiao-Ying Lin; Chengfang Fang; Battista Biggio; Fabio Roli (CoRR, 2022)

Do gradient-based explanations tell anything about adversarial robustness to android malware? - Marco Melis; Michele Scalas; Ambra Demontis; Davide Maiorca; Battista Biggio; Giorgio Giacinto; Fabio Roli (Int. J. Mach. Learn. Cybern., 2022)

Domain Knowledge Alleviates Adversarial Attacks in Multi-Label Classifiers. - Stefano Melacci; Gabriele Ciravegna; Angelo Sotgiu; Ambra Demontis; Battista Biggio; Marco Gori; Fabio Roli (IEEE Trans. Pattern Anal. Mach. Intell., 2022)

secml: Secure and explainable machine learning in Python. - Maura Pintor; Luca Demetrio; Angelo Sotgiu; Marco Melis; Ambra Demontis; Battista Biggio (SoftwareX, 2022)

A Hybrid Training-Time and Run-Time Defense Against Adversarial Attacks in Modulation Classification. - Lu Zhang; Sangarapillai Lambotharan; Gan Zheng; Guisheng Liao; Ambra Demontis; Fabio Roli (IEEE Wirel. Commun. Lett., 2022)

Towards Machine Learning Models that We Can Trust: Testing, Improving, and Explaining Robustness. - Maura Pintor; Ambra Demontis; Battista Biggio (ESANN, 2023)

Improving Fast Minimum-Norm Attacks with Hyperparameter Optimization. - Giorgio Piras; Giuseppe Floris; Raffaele Mura; Luca Scionis; Maura Pintor; Battista Biggio; Ambra Demontis (ESANN, 2023)

Minimizing Energy Consumption of Deep Learning Models by Energy-Aware Training. - Dario Lazzaro; Antonio Emanuele Cinà; Maura Pintor; Ambra Demontis; Battista Biggio; Fabio Roli; Marcello Pelillo (ICIAP (2), 2023)

Detecting Attacks Against Deep Reinforcement Learning for Autonomous Driving. - Maura Pintor; Luca Demetrio; Angelo Sotgiu; Hsiao-Ying Lin; Chengfang Fang; Ambra Demontis; Battista Biggio (ICMLC, 2023)

Samples on Thin Ice: Re-Evaluating Adversarial Pruning of Neural Networks. - Giorgio Piras; Maura Pintor; Ambra Demontis; Battista Biggio (ICMLC, 2023)

AI Security and Safety: The PRALab Research Experience. - Ambra Demontis; Maura Pintor; Luca Demetrio; Angelo Sotgiu; Daniele Angioni; Giorgio Piras; Srishti Gupta; Battista Biggio; Fabio Roli (Ital-IA, 2023)

Cybersecurity and AI: The PRALab Research Experience. - Maura Pintor; Giulia Orrù; Davide Maiorca; Ambra Demontis; Luca Demetrio; Gian Luca Marcialis; Battista Biggio; Fabio Roli (Ital-IA, 2023)

BAARD: Blocking Adversarial Examples by Testing for Applicability, Reliability and Decidability. - Xinglong Chang; Katharina Dost; Kaiqi Zhao 001; Ambra Demontis; Fabio Roli; Gillian Dobbie; Jörg Wicker (PAKDD (1), 2023)

The Threat of Offensive AI to Organizations. - Yisroel Mirsky; Ambra Demontis; Jaidip Kotak; Ram Shankar; Gelei Deng; Liu Yang 003; Xiangyu Zhang; Maura Pintor; Wenke Lee; Yuval Elovici; Battista Biggio (Comput. Secur., 2023)

Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning. - Antonio Emanuele Cinà; Kathrin Grosse; Ambra Demontis; Sebastiano Vascon; Werner Zellinger; Bernhard Alois Moser; Alina Oprea; Battista Biggio; Marcello Pelillo; Fabio Roli (ACM Comput. Surv., 2023)

Why adversarial reprogramming works, when it fails, and how to tell the difference. - Yang Zheng; Xiaoyi Feng; Zhaoqiang Xia; Xiaoyue Jiang; Ambra Demontis; Maura Pintor; Battista Biggio; Fabio Roli (Inf. Sci., 2023)

Stateful detection of adversarial reprogramming. - Yang Zheng; Xiaoyi Feng; Zhaoqiang Xia; Xiaoyue Jiang; Maura Pintor; Ambra Demontis; Battista Biggio; Fabio Roli (Inf. Sci., 2023)

ImageNet-Patch: A dataset for benchmarking machine learning robustness against adversarial patches. - Maura Pintor; Daniele Angioni; Angelo Sotgiu; Luca Demetrio; Ambra Demontis; Battista Biggio; Fabio Roli (Pattern Recognit., 2023)

Hardening RGB-D object recognition systems against adversarial patch attacks. - Yang Zheng; Luca Demetrio; Antonio Emanuele Cinà; Xiaoyi Feng; Zhaoqiang Xia; Xiaoyue Jiang; Ambra Demontis; Battista Biggio; Fabio Roli (Inf. Sci., 2023)

LFPD: Local-Feature-Powered Defense Against Adaptive Backdoor Attacks. - Wei Guo; Ambra Demontis; Maura Pintor; Patrick P. K. Chan; Battista Biggio (ICMLC, 2024)

Data Drift in Android Malware Detection. - Luca Minnei; Hicham Eddoubi; Angelo Sotgiu; Maura Pintor; Ambra Demontis; Battista Biggio (ICMLC, 2024)

Over-parameterization and Adversarial Robustness in Neural Networks: An Overview and Empirical Analysis. - Zhang Chen; Luca Demetrio; Srishti Gupta; Xiaoyi Feng; Zhaoqiang Xia; Antonio Emanuele Cinà; Maura Pintor; Luca Oneto; Ambra Demontis; Battista Biggio; Fabio Roli (CoRR, 2024)

Machine Learning Security Against Data Poisoning: Are We There Yet? - Antonio Emanuele Cinà; Kathrin Grosse; Ambra Demontis; Battista Biggio; Fabio Roli; Marcello Pelillo (Computer, 2024)

AttackBench: Evaluating Gradient-based Attacks for Adversarial Examples. - Antonio Emanuele Cinà; Jérôme Rony; Maura Pintor; Luca Demetrio; Ambra Demontis; Battista Biggio; Ismail Ben Ayed; Fabio Roli (AAAI, 2025)

An Experimental Analysis of Semi-supervised Learning for Malware Detection. - Luca Minnei; Giorgio Piras; Angelo Sotgiu; Maura Pintor; Ambra Demontis; Davide Maiorca; Battista Biggio (ITASEC/SERICS, 2025)

HO-FMN: Hyperparameter optimization for fast minimum-norm attacks. - Raffaele Mura; Giuseppe Floris; Luca Scionis; Giorgio Piras; Maura Pintor; Ambra Demontis; Giorgio Giacinto; Battista Biggio; Fabio Roli (Neurocomputing, 2025)

Energy-latency attacks via sponge poisoning. - Antonio Emanuele Cinà; Ambra Demontis; Battista Biggio; Fabio Roli; Marcello Pelillo (Inf. Sci., 2025)

Adversarial pruning: A survey and benchmark of pruning methods for adversarial robustness. - Giorgio Piras; Maura Pintor; Ambra Demontis; Battista Biggio; Giorgio Giacinto; Fabio Roli (Pattern Recognit., 2025)

Backdoor learning curves: explaining backdoor poisoning beyond influence functions. - Antonio Emanuele Cinà; Kathrin Grosse; Sebastiano Vascon; Ambra Demontis; Battista Biggio; Fabio Roli; Marcello Pelillo (Int. J. Mach. Learn. Cybern., 2025)

Buffer-free Class-Incremental Learning with Out-of-Distribution Detection. - Srishti Gupta; Daniele Angioni; Maura Pintor; Ambra Demontis; Lea Schönherr; Battista Biggio; Fabio Roli (CoRR, 2025)

Evaluating the Evaluators: Trust in Adversarial Robustness Tests. - Antonio Emanuele Cinà; Maura Pintor; Luca Demetrio; Ambra Demontis; Battista Biggio; Fabio Roli (CoRR, 2025)