RobustBench: a standardized adversarial robustness benchmark. - Francesco Croce; Maksym Andriushchenko; Vikash Sehwag; Edoardo Debenedetti; Nicolas Flammarion; Mung Chiang; Prateek Mittal; Matthias Hein 001 (NeurIPS Datasets and Benchmarks, 2021)

A Light Recipe to Train Robust Vision Transformers. - Edoardo Debenedetti; Vikash Sehwag; Prateek Mittal (SaTML, 2023)

Scaling Compute Is Not All You Need for Adversarial Robustness. - Edoardo Debenedetti; Zishen Wan; Maksym Andriushchenko; Vikash Sehwag; Kshitij Bhardwaj; Bhavya Kailkhura (CoRR, 2023)

JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models. - Patrick Chao; Edoardo Debenedetti; Alexander Robey; Maksym Andriushchenko; Francesco Croce; Vikash Sehwag; Edgar Dobriban; Nicolas Flammarion; George J. Pappas; Florian Tramèr; Hamed Hassani; Eric Wong 001 (NeurIPS, 2024)

Dataset and Lessons Learned from the 2024 SaTML LLM Capture-the-Flag Competition. - Edoardo Debenedetti; Javier Rando; Daniel Paleka; Silaghi Fineas Florin; Dragos Albastroiu; Niv Cohen; Yuval Lemberg; Reshmi Ghosh; Rui Wen 002; Ahmed Salem 001; Giovanni Cherubin; Santiago Zanella-Béguelin; et al. (NeurIPS, 2024)

AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. - Edoardo Debenedetti; Jie Zhang 107; Mislav Balunovic; Luca Beurer-Kellner; Marc Fischer 002; Florian Tramèr (NeurIPS, 2024)

Evading Black-box Classifiers Without Breaking Eggs. - Edoardo Debenedetti; Nicholas Carlini; Florian Tramèr (SaTML, 2024)

Privacy Side Channels in Machine Learning Systems. - Edoardo Debenedetti; Giorgio Severi; Milad Nasr; Christopher A. Choquette-Choo; Matthew Jagielski; Eric Wallace; Nicholas Carlini; Florian Tramèr (USENIX Security Symposium, 2024)

AI Risk Management Should Incorporate Both Safety and Security. - Xiangyu Qi; Yangsibo Huang; Yi Zeng 005; Edoardo Debenedetti; Jonas Geiping; Luxi He; Kaixuan Huang; Udari Madhushani; Vikash Sehwag; Weijia Shi; Boyi Wei; Tinghao Xie; et al. (CoRR, 2024)

AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents. - Edoardo Debenedetti; Jie Zhang 107; Mislav Balunovic; Luca Beurer-Kellner; Marc Fischer 002; Florian Tramèr (CoRR, 2024)

Exploring Memorization and Copyright Violation in Frontier LLMs: A Study of the New York Times v. OpenAI 2023 Lawsuit. - Joshua Freeman; Chloe Rippe; Edoardo Debenedetti; Maksym Andriushchenko (CoRR, 2024)

Measuring Non-Adversarial Reproduction of Training Data in Large Language Models. - Michael Aerni; Javier Rando; Edoardo Debenedetti; Nicholas Carlini; Daphne Ippolito; Florian Tramèr (ICLR, 2025)

Adversarial Search Engine Optimization for Large Language Models. - Fredrik Nestaas; Edoardo Debenedetti; Florian Tramèr (ICLR, 2025)

AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defenses. - Nicholas Carlini; Javier Rando; Edoardo Debenedetti; Milad Nasr; Florian Tramèr (CoRR, 2025)

Defeating Prompt Injections by Design. - Edoardo Debenedetti; Ilia Shumailov; Tianqi Fan; Jamie Hayes; Nicholas Carlini; Daniel Fabian; Christoph Kern; Chongyang Shi 003; Andreas Terzis; Florian Tramèr (CoRR, 2025)

LLMs unlock new paths to monetizing exploits. - Nicholas Carlini; Milad Nasr; Edoardo Debenedetti; Barry Wang; Christopher A. Choquette-Choo; Daphne Ippolito; Florian Tramèr; Matthew Jagielski (CoRR, 2025)

Design Patterns for Securing LLM Agents against Prompt Injections. - Luca Beurer-Kellner; Beat Buesser; Ana-Maria Cretu 001; Edoardo Debenedetti; Daniel Dobos; Daniel Fabian; Marc Fischer 002; David Froelicher; Kathrin Grosse; Daniel Naeff; Ezinwanne Ozoani; Andrew Paverd; et al. (CoRR, 2025)