Image Spam Filtering by Content Obscuring Detection. - Battista Biggio; Giorgio Fumera; Ignazio Pillai; Fabio Roli (CEAS, 2007)

Image Spam Filtering Using Visual Information. - Battista Biggio; Giorgio Fumera; Ignazio Pillai; Fabio Roli (ICIAP, 2007)

Bayesian Analysis of Linear Combiners. - Battista Biggio; Giorgio Fumera; Fabio Roli (MCS, 2007)

Improving Image Spam Filtering Using Image Text Features. - Giorgio Fumera; Fabio Roli; Battista Biggio; Ignazio Pillai (CEAS, 2008)

Adversarial Pattern Classification Using Multiple Classifiers and Randomisation. - Battista Biggio; Giorgio Fumera; Fabio Roli (SSPR/SPR, 2008)

Multiple Classifier Systems for Adversarial Classification Tasks. - Battista Biggio; Giorgio Fumera; Fabio Roli (MCS, 2009)

Bayesian Linear Combination of Neural Networks. - Battista Biggio; Giorgio Fumera; Fabio Roli (Innovations in Neural Information Paradigms and Applications, 2009)

Evade Hard Multiple Classifier Systems. - Battista Biggio; Giorgio Fumera; Fabio Roli (Applications of Supervised and Unsupervised Ensemble Methods, 2009)

Multiple Classifier Systems under Attack. - Battista Biggio; Giorgio Fumera; Fabio Roli (MCS, 2010)

Multiple classifier systems for robust classifier design in adversarial environments. - Battista Biggio; Giorgio Fumera; Fabio Roli (Int. J. Mach. Learn. Cybern., 2010)

Robustness of multi-modal biometric systems under realistic spoof attacks against all traits. - Zahid Akhtar; Battista Biggio; Giorgio Fumera; Gian Luca Marcialis (BioMS, 2011)

Understanding the risk factors of learning in adversarial environments. - Blaine Nelson; Battista Biggio; Pavel Laskov (AISec, 2011)

Robustness of multi-modal biometric verification systems under realistic spoofing attacks. - Battista Biggio; Zahid Akhtar; Giorgio Fumera; Gian Luca Marcialis; Fabio Roli (IJCB, 2011)

Bagging Classifiers for Fighting Poisoning Attacks in Adversarial Classification Tasks. - Battista Biggio; Igino Corona; Giorgio Fumera; Giorgio Giacinto; Fabio Roli (MCS, 2011)

Design of robust classifiers for adversarial environments. - Battista Biggio; Giorgio Fumera; Fabio Roli (SMC, 2011)

Support Vector Machines Under Adversarial Label Noise. - Battista Biggio; Blaine Nelson; Pavel Laskov (ACML, 2011)

Microbagging Estimators: An Ensemble Approach to Distance-weighted Classifiers. - Blaine Nelson; Battista Biggio; Pavel Laskov (ACML, 2011)

A survey and experimental evaluation of image spam filtering techniques. - Battista Biggio; Giorgio Fumera; Ignazio Pillai; Fabio Roli (Pattern Recognit. Lett., 2011)

Learning sparse kernel machines with biometric similarity functions for identity recognition. - Battista Biggio; Giorgio Fumera; Fabio Roli (BTAS, 2012)

Poisoning Attacks against Support Vector Machines. - Battista Biggio; Blaine Nelson; Pavel Laskov (ICML, 2012)

Poisoning Adaptive Biometric Systems. - Battista Biggio; Giorgio Fumera; Fabio Roli; Luca Didaci (SSPR/SPR, 2012)

Security evaluation of biometric authentication systems under real spoofing attacks. - Battista Biggio; Zahid Akhtar; Giorgio Fumera; Gian Luca Marcialis; Fabio Roli (IET Biom., 2012)

Is data clustering in adversarial settings secure? - Battista Biggio; Ignazio Pillai; Samuel Rota Bulò; Davide Ariu; Marcello Pelillo; Fabio Roli (AISec, 2013)

Pattern Recognition Systems under Attack. - Fabio Roli; Battista Biggio; Giorgio Fumera (CIARP (1), 2013)

Poisoning attacks to compromise face templates. - Battista Biggio; Luca Didaci; Giorgio Fumera; Fabio Roli (ICB, 2013)

Evasion Attacks against Machine Learning at Test Time. - Battista Biggio; Igino Corona; Davide Maiorca; Blaine Nelson; Nedim Srndic; Pavel Laskov; Giorgio Giacinto; Fabio Roli (ECML/PKDD (3), 2013)

On learning and recognition of secure patterns. - Battista Biggio (AISec@CCS, 2014)

Poisoning behavioral malware clustering. - Battista Biggio; Konrad Rieck; Davide Ariu; Christian Wressnegger; Igino Corona; Giorgio Giacinto; Fabio Roli (AISec@CCS, 2014)

Poisoning Complete-Linkage Hierarchical Clustering. - Battista Biggio; Samuel Rota Bulò; Ignazio Pillai; Michele Mura; Eyasu Zemene Mequanint; Marcello Pelillo; Fabio Roli (S+SSPR, 2014)

Security Evaluation of Support Vector Machines in Adversarial Environments. - Battista Biggio; Igino Corona; Blaine Nelson; Benjamin I. P. Rubinstein; Davide Maiorca; Giorgio Fumera; Giorgio Giacinto; Fabio Roli (CoRR, 2014)

Pattern Recognition Systems under Attack: Design Issues and Research Challenges. - Battista Biggio; Giorgio Fumera; Fabio Roli (Int. J. Pattern Recognit. Artif. Intell., 2014)

Security Evaluation of PatternClassifiers under Attack. - Battista Biggio; Giorgio Fumera; Fabio Roli (IEEE Trans. Knowl. Data Eng., 2014)

Multimodal Anti-spoofing in Biometric Recognition Systems. - Giorgio Fumera; Gian Luca Marcialis; Battista Biggio; Fabio Roli; Stephanie A. C. Schuckers (Handbook of Biometric Anti-Spoofing, 2014)

Sparse support faces. - Battista Biggio; Marco Melis; Giorgio Fumera; Fabio Roli (ICB, 2015)

Super-Sparse Regression for Fast Age Estimation from Faces at Test Time. - Ambra Demontis; Battista Biggio; Giorgio Fumera; Fabio Roli (ICIAP (2), 2015)

Fast Image Classification with Reduced Multiclass Support Vector Machines. - Marco Melis; Luca Piras 001; Battista Biggio; Giorgio Giacinto; Giorgio Fumera; Fabio Roli (ICIAP (2), 2015)

Is Feature Selection Secure against Training Data Poisoning? - Huang Xiao; Battista Biggio; Gavin Brown 001; Giorgio Fumera; Claudia Eckert 001; Fabio Roli (ICML, 2015)

One-and-a-Half-Class Multiple Classifier Systems for Secure Learning Against Evasion Attacks at Test Time. - Battista Biggio; Igino Corona; Zhi-Min He; Patrick P. K. Chan; Giorgio Giacinto; Daniel S. Yeung; Fabio Roli (MCS, 2015)

Support vector machines under adversarial label contamination. - Huang Xiao; Battista Biggio; Blaine Nelson; Han Xiao 002; Claudia Eckert 001; Fabio Roli (Neurocomputing, 2015)

Data-driven journal meta-ranking in business and management. - Gianfranco Ennas; Battista Biggio; Maria Chiara Di Guardo (Scientometrics, 2015)

Adversarial Biometric Recognition : A review on biometric system security from the adversarial machine-learning perspective. - Battista Biggio; Giorgio Fumera; Paolo Russu; Luca Didaci; Fabio Roli (IEEE Signal Process. Mag., 2015)

Anti-spoofing, Multimodal. - Gian Luca Marcialis; Battista Biggio; Giorgio Fumera (Encyclopedia of Biometrics, 2015)

Detecting Misuse of Google Cloud Messaging in Android Badware. - Mansour Ahmadi; Battista Biggio; Steven Arzt; Davide Ariu; Giorgio Giacinto (SPSM@CCS, 2016)

Secure Kernel Machines against Evasion Attacks. - Paolo Russu; Ambra Demontis; Battista Biggio; Giorgio Fumera; Fabio Roli (AISec@CCS, 2016)

Machine Learning under Attack: Vulnerability Exploitation and Security Measures. - Battista Biggio (IH&MMSec, 2016)

Who Are You? A Statistical Approach to Measuring User Authenticity. - David Freeman 001; Sakshi Jain; Markus Dürmuth; Battista Biggio; Giorgio Giacinto (NDSS, 2016)

On Security and Sparsity of Linear Classifiers for Adversarial Settings. - Ambra Demontis; Paolo Russu; Battista Biggio; Giorgio Fumera; Fabio Roli (S+SSPR, 2016)

Super-Sparse Learning in Similarity Spaces. - Ambra Demontis; Marco Melis; Battista Biggio; Giorgio Fumera; Fabio Roli (IEEE Comput. Intell. Mag., 2016)

AdversariaLib: An Open-source Library for the Security Evaluation of Machine Learning Algorithms Under Attack. - Igino Corona; Battista Biggio; Davide Maiorca (CoRR, 2016)

Adversarial Feature Selection Against Evasion Attacks. - Fei Zhang 003; Patrick P. K. Chan; Battista Biggio; Daniel S. Yeung; Fabio Roli (IEEE Trans. Cybern., 2016)

Deepsquatting: Learning-Based Typosquatting Detection at Deeper Domain Levels. - Paolo Piredda; Davide Ariu; Battista Biggio; Igino Corona; Luca Piras 001; Giorgio Giacinto; Fabio Roli (AI*IA, 2017)

10th International Workshop on Artificial Intelligence and Security (AISec 2017). - Battista Biggio; David Freeman 001; Brad Miller 002; Arunesh Sinha (CCS, 2017)

Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization. - Luis Muñoz-González; Battista Biggio; Ambra Demontis; Andrea Paudice; Vasin Wongrassamee; Emil C. Lupu; Fabio Roli (AISec@CCS, 2017)

DeltaPhish: Detecting Phishing Webpages in Compromised Websites. - Igino Corona; Battista Biggio; Matteo Contini; Luca Piras 001; Roberto Corda; Mauro Mereu; Guido Mureddu; Davide Ariu; Fabio Roli (ESORICS (1), 2017)

Is Deep Learning Safe for Robot Vision? Adversarial Examples Against the iCub Humanoid. - Marco Melis; Ambra Demontis; Battista Biggio; Gavin Brown 001; Giorgio Fumera; Fabio Roli (ICCV Workshops, 2017)

Infinity-Norm Support Vector Machines Against Adversarial Label Contamination. - Ambra Demontis; Battista Biggio; Giorgio Fumera; Giorgio Giacinto; Fabio Roli (ITASEC, 2017)

Detection of Malicious Scripting Code Through Discriminant and Adversary-Aware API Analysis. - Davide Maiorca; Paolo Russu; Igino Corona; Battista Biggio; Giorgio Giacinto (ITASEC, 2017)

Security Evaluation of Pattern Classifiers under Attack. - Battista Biggio; Giorgio Fumera; Fabio Roli (CoRR, 2017)

Adversarial Detection of Flash Malware: Limitations and Open Issues. - Davide Maiorca; Battista Biggio; Maria Elena Chiappe; Giorgio Giacinto (CoRR, 2017)

Statistical Meta-Analysis of Presentation Attacks for Secure Multibiometric Systems. - Battista Biggio; Giorgio Fumera; Gian Luca Marcialis; Fabio Roli (IEEE Trans. Pattern Anal. Mach. Intell., 2017)

Randomized Prediction Games for Adversarial Machine Learning. - Samuel Rota Bulò; Battista Biggio; Ignazio Pillai; Marcello Pelillo; Fabio Roli (IEEE Trans. Neural Networks Learn. Syst., 2017)

11th International Workshop on Artificial Intelligence and Security (AISec 2018). - Sadia Afroz 001; Battista Biggio; Yuval Elovici; David Freeman 001; Asaf Shabtai (CCS, 2018)

Session details: AI Security / Adversarial Machine Learning. - Battista Biggio (AISec@CCS, 2018)

ALOHA: an architectural-aware framework for deep learning at the edge. - Paolo Meloni; Daniela Loi; Gianfranco Deriu; Andy D. Pimentel; Dolly Sapra; Bernhard Moser 001; Natalia Shepeleva; Francesco Conti 001; Luca Benini; Oscar Ripolles; David Solans; Maura Pintor; et al. (INTESA@ESWEEK, 2018)

Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables. - Bojan Kolosnjaji; Ambra Demontis; Battista Biggio; Davide Maiorca; Giorgio Giacinto; Claudia Eckert 001; Fabio Roli (EUSIPCO, 2018)

Explaining Black-box Android Malware Detection. - Marco Melis; Davide Maiorca; Battista Biggio; Giorgio Giacinto; Fabio Roli (EUSIPCO, 2018)

Architecture-aware design and implementation of CNN algorithms for embedded inference: the ALOHA project. - Paolo Meloni; Daniela Loi; Gianfranco Deriu; Andy D. Pimentel; Dolly Sapra; Maura Pintor; Battista Biggio; Oscar Ripolles; David Solans; Francesco Conti 001; Luca Benini; Todor P. Stefanov; et al. (ICM, 2018)

Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning. - Matthew Jagielski; Alina Oprea; Battista Biggio; Chang Liu 021; Cristina Nita-Rotaru; Bo Li 026 (IEEE Symposium on Security and Privacy, 2018)

Towards Adversarial Configurations for Software Product Lines. - Paul Temple; Mathieu Acher; Battista Biggio; Jean-Marc Jézéquel; Fabio Roli (CoRR, 2018)

On the Intriguing Connections of Regularization, Input Gradients and Transferability of Evasion and Poisoning Attacks. - Ambra Demontis; Marco Melis; Maura Pintor; Matthew Jagielski; Battista Biggio; Alina Oprea; Cristina Nita-Rotaru; Fabio Roli (CoRR, 2018)

Towards Robust Detection of Adversarial Infection Vectors: Lessons Learned in PDF Malware. - Davide Maiorca; Battista Biggio; Giorgio Giacinto (CoRR, 2018)

Wild patterns: Ten years after the rise of adversarial machine learning. - Battista Biggio; Fabio Roli (Pattern Recognit., 2018)

AISec'19: 12th ACM Workshop on Artificial Intelligence and Security. - Sadia Afroz 001; Battista Biggio; Nicholas Carlini; Yuval Elovici; Asaf Shabtai (CCS, 2019)

Poster: Attacking Malware Classifiers by Crafting Gradient-Attacks that Preserve Functionality. - Raphael Labaca Castro; Battista Biggio; Gabi Dreo Rodosek (CCS, 2019)

Optimization and deployment of CNNs at the edge: the ALOHA experience. - Paolo Meloni; Daniela Loi; Paola Busia; Gianfranco Deriu; Andy D. Pimentel; Dolly Sapra; Todor P. Stefanov; Svetlana Minakova; Francesco Conti 001; Luca Benini; Maura Pintor; Battista Biggio; et al. (CF, 2019)

Societal Issues in Machine Learning: When Learning from Data is Not Enough. - Davide Bacciu; Battista Biggio; Paulo Lisboa; José D. Martín; Luca Oneto; Alfredo Vellido (ESANN, 2019)

Detecting Black-box Adversarial Examples through Nonlinear Dimensionality Reduction. - Francesco Crecchi; Davide Bacciu; Battista Biggio (ESANN, 2019)

Explaining Vulnerabilities of Deep Learning to Adversarial Malware Binaries. - Luca Demetrio; Battista Biggio; Giovanni Lagorio; Fabio Roli; Alessandro Armando (ITASEC, 2019)

Towards quality assurance of software product lines with adversarial configurations. - Paul Temple; Mathieu Acher; Gilles Perrouin; Battista Biggio; Jean-Marc Jézéquel; Fabio Roli (SPLC (A), 2019)

Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attacks. - Ambra Demontis; Marco Melis; Maura Pintor; Matthew Jagielski; Battista Biggio; Alina Oprea; Cristina Nita-Rotaru; Fabio Roli (USENIX Security Symposium, 2019)

Detecting Adversarial Examples through Nonlinear Dimensionality Reduction. - Francesco Crecchi; Davide Bacciu; Battista Biggio (CoRR, 2019)

secml: A Python Library for Secure and Explainable Machine Learning. - Marco Melis; Ambra Demontis; Maura Pintor; Angelo Sotgiu; Battista Biggio (CoRR, 2019)

Towards Adversarial Malware Detection: Lessons Learned from PDF-based Attacks. - Davide Maiorca; Battista Biggio; Giorgio Giacinto (ACM Comput. Surv., 2019)

Digital Investigation of PDF Files: Unveiling Traces of Embedded Malware. - Davide Maiorca; Battista Biggio (IEEE Secur. Priv., 2019)

Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detection. - Ambra Demontis; Marco Melis; Battista Biggio; Davide Maiorca; Daniel Arp; Konrad Rieck; Igino Corona; Giorgio Giacinto; Fabio Roli (IEEE Trans. Dependable Secur. Comput., 2019)

Poisoning Attacks on Algorithmic Fairness. - David Solans; Battista Biggio; Carlos Castillo 001 (ECML/PKDD (1), 2020)

Adversarial Detection of Flash Malware: Limitations and Open Issues. - Davide Maiorca; Ambra Demontis; Battista Biggio; Fabio Roli; Giorgio Giacinto (Comput. Secur., 2020)

Efficient Black-box Optimization of Adversarial Windows Malware with Constrained Manipulations. - Luca Demetrio; Battista Biggio; Giovanni Lagorio; Fabio Roli; Alessandro Armando (CoRR, 2020)

Can Domain Knowledge Alleviate Adversarial Attacks in Multi-Label Classifiers? - Stefano Melacci; Gabriele Ciravegna; Angelo Sotgiu; Ambra Demontis; Battista Biggio; Marco Gori; Fabio Roli (CoRR, 2020)

Deep neural rejection against adversarial examples. - Angelo Sotgiu; Ambra Demontis; Marco Melis; Battista Biggio; Giorgio Fumera; Xiaoyi Feng; Fabio Roli (EURASIP J. Inf. Secur., 2020)

Task-Specific Automation in Deep Learning Processes. - Georg Buchgeher; Gerald Czech; Adriano Souza Ribeiro; Werner Kloihofer; Paolo Meloni; Paola Busia; Gianfranco Deriu; Maura Pintor; Battista Biggio; Cristina Chesta; Luca Rinelli; David Solans; et al. (DEXA Workshops, 2021)

Complex Data: Learning Trustworthily, Automatically, and with Guarantees. - Luca Oneto; Nicolò Navarin; Battista Biggio; Federico Errica; Alessio Micheli; Franco Scarselli; Monica Bianchini; Alessandro Sperduti (ESANN, 2021)

Slope: A First-order Approach for Measuring Gradient Obfuscation. - Maura Pintor; Luca Demetrio; Giovanni Manca; Battista Biggio; Fabio Roli (ESANN, 2021)

The Hammer and the Nut: Is Bilevel Optimization Really Needed to Poison Linear Classifiers? - Antonio Emanuele Cinà; Sebastiano Vascon; Ambra Demontis; Battista Biggio; Fabio Roli; Marcello Pelillo (IJCNN, 2021)

Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraints. - Maura Pintor; Fabio Roli; Wieland Brendel; Battista Biggio (NeurIPS, 2021)

Poisoning attacks on cyber attack detectors for industrial control systems. - Moshe Kravchik; Battista Biggio; Asaf Shabtai (SAC, 2021)

Adversarial Machine Learning: Attacks From Laboratories to the Real World. - Hsiao-Ying Lin; Battista Biggio (Computer, 2021)

secml-malware: A Python Library for Adversarial Robustness Evaluation of Windows Malware Classifiers. - Luca Demetrio; Battista Biggio (CoRR, 2021)

Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples. - Maura Pintor; Luca Demetrio; Angelo Sotgiu; Giovanni Manca; Ambra Demontis; Nicholas Carlini; Battista Biggio; Fabio Roli (CoRR, 2021)

The Threat of Offensive AI to Organizations. - Yisroel Mirsky; Ambra Demontis; Jaidip Kotak; Ram Shankar; Gelei Deng; Liu Yang 003; Xiangyu Zhang; Wenke Lee; Yuval Elovici; Battista Biggio (CoRR, 2021)

Empirical assessment of generating adversarial configurations for software product lines. - Paul Temple; Gilles Perrouin; Mathieu Acher; Battista Biggio; Jean-Marc Jézéquel; Fabio Roli (Empir. Softw. Eng., 2021)

Functionality-Preserving Black-Box Optimization of Adversarial Windows Malware. - Luca Demetrio; Battista Biggio; Giovanni Lagorio; Fabio Roli; Alessandro Armando (IEEE Trans. Inf. Forensics Secur., 2021)

Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection. - Luca Demetrio; Scott E. Coull; Battista Biggio; Giovanni Lagorio; Alessandro Armando; Fabio Roli (ACM Trans. Priv. Secur., 2021)

Explainability-based Debugging of Machine Learning for Vulnerability Discovery. - Angelo Sotgiu; Maura Pintor; Battista Biggio (ARES, 2022)

Tessellation-Filtering ReLU Neural Networks. - Bernhard Alois Moser; Michal Lewandowski; Somayeh Kargaran; Werner Zellinger; Battista Biggio; Christoph Koutschan (IJCAI, 2022)

Robust Machine Learning for Malware Detection over Time. - Daniele Angioni; Luca Demetrio; Maura Pintor; Battista Biggio (ITASEC, 2022)

Explaining Machine Learning DGA Detectors from DNS Traffic Data. - Giorgio Piras; Maura Pintor; Luca Demetrio; Battista Biggio (ITASEC, 2022)

Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples. - Maura Pintor; Luca Demetrio; Angelo Sotgiu; Ambra Demontis; Nicholas Carlini; Battista Biggio; Fabio Roli (NeurIPS, 2022)

Industrial practitioners' mental models of adversarial machine learning. - Lukas Bieringer; Kathrin Grosse; Michael Backes 001; Battista Biggio; Katharina Krombholz (SOUPS @ USENIX Security Symposium, 2022)

Backdoor smoothing: Demystifying backdoor attacks on deep neural networks. - Kathrin Grosse; Taesung Lee; Battista Biggio; Youngja Park; Michael Backes 001; Ian M. Molloy (Comput. Secur., 2022)

Practical Evaluation of Poisoning Attacks on Online Anomaly Detectors in Industrial Control Systems. - Moshe Kravchik; Luca Demetrio; Battista Biggio; Asaf Shabtai (Comput. Secur., 2022)

Denial-of-Service Attack on Object Detection Model Using Universal Adversarial Perturbation. - Avishag Shapira; Alon Zolfi; Luca Demetrio; Battista Biggio; Asaf Shabtai (CoRR, 2022)

"Why do so?" - A Practical Perspective on Machine Learning Security. - Kathrin Grosse; Lukas Bieringer; Tarek Richard Besold; Battista Biggio; Katharina Krombholz (CoRR, 2022)

A Survey on Reinforcement Learning Security with Application to Autonomous Driving. - Ambra Demontis; Maura Pintor; Luca Demetrio; Kathrin Grosse; Hsiao-Ying Lin; Chengfang Fang; Battista Biggio; Fabio Roli (CoRR, 2022)

Practical Attacks on Machine Learning: A Case Study on Adversarial Windows Malware. - Luca Demetrio; Battista Biggio; Fabio Roli (IEEE Secur. Priv., 2022)

FADER: Fast adversarial example rejection. - Francesco Crecchi; Marco Melis; Angelo Sotgiu; Davide Bacciu; Battista Biggio (Neurocomputing, 2022)

Towards learning trustworthily, automatically, and with guarantees on graphs: An overview. - Luca Oneto; Nicolò Navarin; Battista Biggio; Federico Errica; Alessio Micheli; Franco Scarselli; Monica Bianchini; Luca Demetrio; Pietro Bongini; Armando Tacchella; Alessandro Sperduti (Neurocomputing, 2022)

Do gradient-based explanations tell anything about adversarial robustness to android malware? - Marco Melis; Michele Scalas; Ambra Demontis; Davide Maiorca; Battista Biggio; Giorgio Giacinto; Fabio Roli (Int. J. Mach. Learn. Cybern., 2022)

Domain Knowledge Alleviates Adversarial Attacks in Multi-Label Classifiers. - Stefano Melacci; Gabriele Ciravegna; Angelo Sotgiu; Ambra Demontis; Battista Biggio; Marco Gori; Fabio Roli (IEEE Trans. Pattern Anal. Mach. Intell., 2022)

secml: Secure and explainable machine learning in Python. - Maura Pintor; Luca Demetrio; Angelo Sotgiu; Marco Melis; Ambra Demontis; Battista Biggio (SoftwareX, 2022)

Security of Machine Learning (Dagstuhl Seminar 22281). - Battista Biggio; Nicholas Carlini; Pavel Laskov; Konrad Rieck; Antonio Emanuele Cinà (Dagstuhl Reports, 2022)

Raze to the Ground: Query-Efficient Adversarial HTML Attacks on Machine-Learning Phishing Webpage Detectors. - Biagio Montaruli; Luca Demetrio; Maura Pintor; Luca Compagna; Davide Balzarotti; Battista Biggio (AISec@CCS, 2023)

Towards Machine Learning Models that We Can Trust: Testing, Improving, and Explaining Robustness. - Maura Pintor; Ambra Demontis; Battista Biggio (ESANN, 2023)

Improving Fast Minimum-Norm Attacks with Hyperparameter Optimization. - Giorgio Piras; Giuseppe Floris; Raffaele Mura; Luca Scionis; Maura Pintor; Battista Biggio; Ambra Demontis (ESANN, 2023)

Adversarial Attacks Against Uncertainty Quantification. - Emanuele Ledda; Daniele Angioni; Giorgio Piras; Giorgio Fumera; Battista Biggio; Fabio Roli (ICCV (Workshops), 2023)

Minimizing Energy Consumption of Deep Learning Models by Energy-Aware Training. - Dario Lazzaro; Antonio Emanuele Cinà; Maura Pintor; Ambra Demontis; Battista Biggio; Fabio Roli; Marcello Pelillo (ICIAP (2), 2023)

Detecting Attacks Against Deep Reinforcement Learning for Autonomous Driving. - Maura Pintor; Luca Demetrio; Angelo Sotgiu; Hsiao-Ying Lin; Chengfang Fang; Ambra Demontis; Battista Biggio (ICMLC, 2023)

Samples on Thin Ice: Re-Evaluating Adversarial Pruning of Neural Networks. - Giorgio Piras; Maura Pintor; Ambra Demontis; Battista Biggio (ICMLC, 2023)

AI Security and Safety: The PRALab Research Experience. - Ambra Demontis; Maura Pintor; Luca Demetrio; Angelo Sotgiu; Daniele Angioni; Giorgio Piras; Srishti Gupta; Battista Biggio; Fabio Roli (Ital-IA, 2023)

Cybersecurity and AI: The PRALab Research Experience. - Maura Pintor; Giulia Orrù; Davide Maiorca; Ambra Demontis; Luca Demetrio; Gian Luca Marcialis; Battista Biggio; Fabio Roli (Ital-IA, 2023)

Phantom Sponges: Exploiting Non-Maximum Suppression to Attack Deep Object Detectors. - Avishag Shapira; Alon Zolfi; Luca Demetrio; Battista Biggio; Asaf Shabtai (WACV, 2023)

The Threat of Offensive AI to Organizations. - Yisroel Mirsky; Ambra Demontis; Jaidip Kotak; Ram Shankar; Gelei Deng; Liu Yang 003; Xiangyu Zhang; Maura Pintor; Wenke Lee; Yuval Elovici; Battista Biggio (Comput. Secur., 2023)

Adversarial ModSecurity: Countering Adversarial SQL Injections with Robust Machine Learning. - Biagio Montaruli; Luca Demetrio; Andrea Valenza; Luca Compagna; Davide Ariu; Luca Piras 001; Davide Balzarotti; Battista Biggio (CoRR, 2023)

Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning. - Antonio Emanuele Cinà; Kathrin Grosse; Ambra Demontis; Sebastiano Vascon; Werner Zellinger; Bernhard Alois Moser; Alina Oprea; Battista Biggio; Marcello Pelillo; Fabio Roli (ACM Comput. Surv., 2023)

Why adversarial reprogramming works, when it fails, and how to tell the difference. - Yang Zheng; Xiaoyi Feng; Zhaoqiang Xia; Xiaoyue Jiang; Ambra Demontis; Maura Pintor; Battista Biggio; Fabio Roli (Inf. Sci., 2023)

Stateful detection of adversarial reprogramming. - Yang Zheng; Xiaoyi Feng; Zhaoqiang Xia; Xiaoyue Jiang; Maura Pintor; Ambra Demontis; Battista Biggio; Fabio Roli (Inf. Sci., 2023)

ImageNet-Patch: A dataset for benchmarking machine learning robustness against adversarial patches. - Maura Pintor; Daniele Angioni; Angelo Sotgiu; Luca Demetrio; Ambra Demontis; Battista Biggio; Fabio Roli (Pattern Recognit., 2023)

Machine Learning Security in Industry: A Quantitative Survey. - Kathrin Grosse; Lukas Bieringer; Tarek R. Besold; Battista Biggio; Katharina Krombholz (IEEE Trans. Inf. Forensics Secur., 2023)

Hardening RGB-D object recognition systems against adversarial patch attacks. - Yang Zheng; Luca Demetrio; Antonio Emanuele Cinà; Xiaoyi Feng; Zhaoqiang Xia; Xiaoyue Jiang; Ambra Demontis; Battista Biggio; Fabio Roli (Inf. Sci., 2023)

When Your AI Becomes a Target: AI Security Incidents and Best Practices. - Kathrin Grosse; Lukas Bieringer; Tarek R. Besold; Battista Biggio; Alexandre Alahi (AAAI, 2024)

LFPD: Local-Feature-Powered Defense Against Adaptive Backdoor Attacks. - Wei Guo; Ambra Demontis; Maura Pintor; Patrick P. K. Chan; Battista Biggio (ICMLC, 2024)

Data Drift in Android Malware Detection. - Luca Minnei; Hicham Eddoubi; Angelo Sotgiu; Maura Pintor; Ambra Demontis; Battista Biggio (ICMLC, 2024)

σ-zero: Gradient-based Optimization of 𝓁0-norm Adversarial Examples. - Antonio Emanuele Cinà; Francesco Villani; Maura Pintor; Lea Schönherr; Battista Biggio; Marcello Pelillo (CoRR, 2024)

Living-off-The-Land Reverse-Shell Detection by Informed Data Augmentation. - Dmitrijs Trizna; Luca Demetrio; Battista Biggio; Fabio Roli (CoRR, 2024)

Certified Adversarial Robustness of Machine Learning-based Malware Detectors via (De)Randomized Smoothing. - Daniel Gibert; Luca Demetrio; Giulio Zizzo; Quan Le; Jordi Planes; Battista Biggio (CoRR, 2024)

Over-parameterization and Adversarial Robustness in Neural Networks: An Overview and Empirical Analysis. - Zhang Chen; Luca Demetrio; Srishti Gupta; Xiaoyi Feng; Zhaoqiang Xia; Antonio Emanuele Cinà; Maura Pintor; Luca Oneto; Ambra Demontis; Battista Biggio; Fabio Roli (CoRR, 2024)

ModSec-Learn: Boosting ModSecurity with Machine Learning. - Christian Scano; Giuseppe Floris; Biagio Montaruli; Luca Demetrio; Andrea Valenza; Luca Compagna; Davide Ariu; Luca Piras 001; Davide Balzarotti; Battista Biggio (CoRR, 2024)

Sonic: Fast and Transferable Data Poisoning on Clustering Algorithms. - Francesco Villani; Dario Lazzaro; Antonio Emanuele Cinà; Matteo Dell'Amico; Battista Biggio; Fabio Roli (CoRR, 2024)

On the Robustness of Adversarial Training Against Uncertainty Attacks. - Emanuele Ledda; Giovanni Scodeller; Daniele Angioni; Giorgio Piras; Antonio Emanuele Cinà; Giorgio Fumera; Battista Biggio; Fabio Roli (CoRR, 2024)

Nebula: Self-Attention for Dynamic Malware Analysis. - Dmitrijs Trizna; Luca Demetrio; Battista Biggio; Fabio Roli (IEEE Trans. Inf. Forensics Secur., 2024)

Rethinking data augmentation for adversarial robustness. - Hamid Eghbal-zadeh; Werner Zellinger; Maura Pintor; Kathrin Grosse; Khaled Koutini; Bernhard Alois Moser; Battista Biggio; Gerhard Widmer (Inf. Sci., 2024)

Machine Learning Security Against Data Poisoning: Are We There Yet? - Antonio Emanuele Cinà; Kathrin Grosse; Ambra Demontis; Battista Biggio; Fabio Roli; Marcello Pelillo (Computer, 2024)

Toward Effective Traffic Sign Detection via Two-Stage Fusion Neural Networks. - Zhishan Li; Hongxu Chen; Battista Biggio; Yifan He 002; Haoran Cai; Fabio Roli; Lei Xie 007 (IEEE Trans. Intell. Transp. Syst., 2024)

Machine Learning in Computer Security is Difficult to Fix. - Battista Biggio (Commun. ACM, 2024)

AttackBench: Evaluating Gradient-based Attacks for Adversarial Examples. - Antonio Emanuele Cinà; Jérôme Rony; Maura Pintor; Luca Demetrio; Ambra Demontis; Battista Biggio; Ismail Ben Ayed; Fabio Roli (AAAI, 2025)

CoEvolution: A Comprehensive Trustworthy Framework For Connected Machine Learning And Secure Interconnected AI Solutions. - Antonios Makris; Apostolos P. Fournaris; Anita Aghaie; Ioannis Arakas; Anna Maria Anaxagorou; Ioannis Arapakis; Davide Bacciu; Battista Biggio; Georgios Bouloukakis; Stavros Bouras; Arne Bröring; Antonio Carta; et al. (CSR, 2025)

Demystifying the Role of Rule-Based Detection in AI Systems for Windows Malware Detection. - Andrea Ponte; Luca Demetrio; Luca Oneto; Ivan Tesfai Ogbu; Battista Biggio; Fabio Roli (EuroS&P (Workshops), 2025)

σ-zero: Gradient-based Optimization of ℓ0-norm Adversarial Examples. - Antonio Emanuele Cinà; Francesco Villani; Maura Pintor; Lea Schönherr; Battista Biggio; Marcello Pelillo (ICLR, 2025)

Understanding Regression in Continual Learning for Malware Detection. - Daniele Ghiani; Daniele Angioni; Angelo Sotgiu; Maura Pintor; Battista Biggio (ITASEC/SERICS, 2025)

An Experimental Analysis of Semi-supervised Learning for Malware Detection. - Luca Minnei; Giorgio Piras; Angelo Sotgiu; Maura Pintor; Ambra Demontis; Davide Maiorca; Battista Biggio (ITASEC/SERICS, 2025)

SLIFER: Investigating performance and robustness of malware detection pipelines. - Andrea Ponte; Dmitrijs Trizna; Luca Demetrio; Battista Biggio; Ivan Tesfai Ogbu; Fabio Roli (Comput. Secur., 2025)

HO-FMN: Hyperparameter optimization for fast minimum-norm attacks. - Raffaele Mura; Giuseppe Floris; Luca Scionis; Giorgio Piras; Maura Pintor; Ambra Demontis; Giorgio Giacinto; Battista Biggio; Fabio Roli (Neurocomputing, 2025)

Energy-latency attacks via sponge poisoning. - Antonio Emanuele Cinà; Ambra Demontis; Battista Biggio; Fabio Roli; Marcello Pelillo (Inf. Sci., 2025)

Adversarial pruning: A survey and benchmark of pruning methods for adversarial robustness. - Giorgio Piras; Maura Pintor; Ambra Demontis; Battista Biggio; Giorgio Giacinto; Fabio Roli (Pattern Recognit., 2025)

ModSec-AdvLearn: Countering Adversarial SQL Injections With Robust Machine Learning. - Giuseppe Floris; Christian Scano; Biagio Montaruli; Luca Demetrio; Andrea Valenza; Luca Compagna; Davide Ariu; Luca Piras 001; Davide Balzarotti; Battista Biggio (IEEE Trans. Inf. Forensics Secur., 2025)

Backdoor learning curves: explaining backdoor poisoning beyond influence functions. - Antonio Emanuele Cinà; Kathrin Grosse; Sebastiano Vascon; Ambra Demontis; Battista Biggio; Fabio Roli; Marcello Pelillo (Int. J. Mach. Learn. Cybern., 2025)

Buffer-free Class-Incremental Learning with Out-of-Distribution Detection. - Srishti Gupta; Daniele Angioni; Maura Pintor; Ambra Demontis; Lea Schönherr; Battista Biggio; Fabio Roli (CoRR, 2025)

RAID: A Dataset for Testing the Adversarial Robustness of AI-Generated Image Detectors. - Hicham Eddoubi; Jonas Ricker; Federico Cocchi; Lorenzo Baraldi 001; Angelo Sotgiu; Maura Pintor; Marcella Cornia; Lorenzo Baraldi 002; Asja Fischer; Rita Cucchiara; Battista Biggio (CoRR, 2025)

Evaluating the Evaluators: Trust in Adversarial Robustness Tests. - Antonio Emanuele Cinà; Maura Pintor; Luca Demetrio; Ambra Demontis; Battista Biggio; Fabio Roli (CoRR, 2025)

Exploiting Edge Features for Transferable Adversarial Attacks in Distributed Machine Learning. - Giulio Rossolini; Fabio Brau; Alessandro Biondi 001; Battista Biggio; Giorgio C. Buttazzo (CoRR, 2025)

Regression-aware Continual Learning for Android Malware Detection. - Daniele Ghiani; Daniele Angioni; Giorgio Piras; Angelo Sotgiu; Luca Minnei; Srishti Gupta; Maura Pintor; Fabio Roli; Battista Biggio (CoRR, 2025)

Robustness-Congruent Adversarial Training for Secure Machine Learning Model Updates. - Daniele Angioni; Luca Demetrio; Maura Pintor; Luca Oneto; Davide Anguita; Battista Biggio; Fabio Roli (IEEE Trans. Pattern Anal. Mach. Intell., 2025)