Differential Privacy with Bounded Priors: Reconciling Utility and Privacy in Genome-Wide Association Studies. - Florian Tramèr; Zhicong Huang; Jean-Pierre Hubaux; Erman Ayday (CCS, 2015)

Discovering Unwarranted Associations in Data-Driven Applications with the FairTest Testing Toolkit. - Florian Tramèr; Vaggelis Atlidakis; Roxana Geambasu; Daniel J. Hsu; Jean-Pierre Hubaux; Mathias Humbert; Ari Juels; Huang Lin (CoRR, 2015)

On Solving Lpn using BKW and Variants. - Sonia Bogos; Florian Tramèr; Serge Vaudenay (IACR Cryptol. ePrint Arch., 2015)

Better Algorithms for LWE and LWR. - Alexandre Duc; Florian Tramèr; Serge Vaudenay (IACR Cryptol. ePrint Arch., 2015)

Stealing Machine Learning Models via Prediction APIs. - Florian Tramèr; Fan Zhang 022; Ari Juels; Michael K. Reiter; Thomas Ristenpart (USENIX Security Symposium, 2016)

On solving L P N using B K W and variants - Implementation and analysis. - Sonia Bogos; Florian Tramèr; Serge Vaudenay (Cryptogr. Commun., 2016)

Formal Abstractions for Attested Execution Secure Processors. - Rafael Pass; Elaine Shi; Florian Tramèr (IACR Cryptol. ePrint Arch., 2016)

Sealed-Glass Proofs: Using Transparent Enclaves to Prove and Sell Knowledge. - Florian Tramèr; Fan Zhang 022; Huang Lin; Jean-Pierre Hubaux; Ari Juels; Elaine Shi (IACR Cryptol. ePrint Arch., 2016)

FairTest: Discovering Unwarranted Associations in Data-Driven Applications. - Florian Tramèr; Vaggelis Atlidakis; Roxana Geambasu; Daniel J. Hsu; Jean-Pierre Hubaux; Mathias Humbert; Ari Juels; Huang Lin (EuroS&P, 2017)

Ensemble Adversarial Training: Attacks and Defenses. - Florian Tramèr; Alexey Kurakin; Nicolas Papernot; Dan Boneh; Patrick D. McDaniel (CoRR, 2017)

The Space of Transferable Adversarial Examples. - Florian Tramèr; Nicolas Papernot; Ian J. Goodfellow; Dan Boneh; Patrick D. McDaniel (CoRR, 2017)

Note on Attacking Object Detectors with Adversarial Stickers. - Kevin Eykholt; Ivan Evtimov; Earlence Fernandes; Bo Li 026; Dawn Song; Tadayoshi Kohno; Amir Rahmati; Atul Prakash 001; Florian Tramèr (CoRR, 2017)

Enter the Hydra: Towards Principled Bug Bounties and Exploit-Resistant Smart Contracts. - Lorenz Breidenbach; Philip Daian; Florian Tramèr; Ari Juels (IACR Cryptol. ePrint Arch., 2017)

Addressing Beacon re-identification attacks: quantification and mitigation of privacy risks. - Jean Louis Raisaro; Florian Tramèr; Zhanglong Ji; Diyue Bu; Yongan Zhao; W. Knox Carey; David D. Lloyd; Heidi Sofia; Dixie Baker; Paul Flicek; Suyash S. Shringarpure; Carlos D. Bustamante; et al. (J. Am. Medical Informatics Assoc., 2017)

PrivateRide: A Privacy-Enhanced Ride-Hailing Service. - Anh Pham; Italo Dacosta; Bastien Jacot-Guillarmod; Kévin Huguenin; Taha Hajar; Florian Tramèr; Virgil D. Gligor; Jean-Pierre Hubaux (Proc. Priv. Enhancing Technol., 2017)

Ensemble Adversarial Training: Attacks and Defenses. - Florian Tramèr; Alexey Kurakin; Nicolas Papernot; Ian J. Goodfellow; Dan Boneh; Patrick D. McDaniel (ICLR (Poster), 2018)

Physical Adversarial Examples for Object Detectors. - Dawn Song; Kevin Eykholt; Ivan Evtimov; Earlence Fernandes; Bo Li 026; Amir Rahmati; Florian Tramèr; Atul Prakash 001; Tadayoshi Kohno (WOOT @ USENIX Security Symposium, 2018)

Ad-versarial: Defeating Perceptual Ad-Blocking. - Florian Tramèr; Pascal Dupré; Gili Rusak; Giancarlo Pellegrino; Dan Boneh (CoRR, 2018)

SentiNet: Detecting Physical Attacks Against Deep Learning Systems. - Edward Chou; Florian Tramèr; Giancarlo Pellegrino; Dan Boneh (CoRR, 2018)

AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning. - Florian Tramèr; Pascal Dupré; Gili Rusak; Giancarlo Pellegrino; Dan Boneh (CCS, 2019)

Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware. - Florian Tramèr; Dan Boneh (ICLR, 2019)

Adversarial Training and Robustness for Multiple Perturbations. - Florian Tramèr; Dan Boneh (NeurIPS, 2019)

Exploiting Excessive Invariance caused by Norm-Bounded Adversarial Robustness. - Jörn-Henrik Jacobsen; Jens Behrmann; Nicholas Carlini; Florian Tramèr; Nicolas Papernot (CoRR, 2019)

SquirRL: Automating Attack Discovery on Blockchain Incentive Mechanisms with Deep Reinforcement Learning. - Charlie Hou; Mingxun Zhou; Yan Ji 001; Phil Daian; Florian Tramèr; Giulia Fanti; Ari Juels (CoRR, 2019)

Advances and Open Problems in Federated Learning. - Peter Kairouz; H. Brendan McMahan; Brendan Avent; Aurélien Bellet; Mehdi Bennis; Arjun Nitin Bhagoji; Kallista A. Bonawitz; Zachary Charles; Graham Cormode; Rachel Cummings; Rafael G. L. D'Oliveira; Salim El Rouayheb; et al. (CoRR, 2019)

The Hydra Framework for Principled, Automated Bug Bounties. - Lorenz Breidenbach; Philip Daian; Florian Tramèr; Ari Juels (IEEE Secur. Priv., 2019)

Third International Workshop on Dependable and Secure Machine Learning - DSML 2020. - Homa Alemzadeh; Rakesh Bobba; Varun Chandrasekaran; David E. Evans 001; Nicolas Papernot; Karthik Pattabiraman; Florian Tramèr (DSN Workshops, 2020)

Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations. - Florian Tramèr; Jens Behrmann; Nicholas Carlini; Nicolas Papernot; Jörn-Henrik Jacobsen (ICML, 2020)

On Adaptive Attacks to Adversarial Example Defenses. - Florian Tramèr; Nicholas Carlini; Wieland Brendel; Aleksander Madry (NeurIPS, 2020)

SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems. - Edward Chou; Florian Tramèr; Giancarlo Pellegrino (SP (Workshops), 2020)

An Attack on InstaHide: Is Private Learning Possible with Instance Encoding? - Nicholas Carlini; Samuel Deng; Sanjam Garg; Somesh Jha; Saeed Mahloujifar; Mohammad Mahmoody; Shuang Song 001; Abhradeep Thakurta; Florian Tramèr (CoRR, 2020)

Remote Side-Channel Attacks on Anonymous Transactions. - Florian Tramèr; Dan Boneh; Kenneth G. Paterson (IACR Cryptol. ePrint Arch., 2020)

Fourth International Workshop on Dependable and Secure Machine Learning - DSML 2021. - Hui Xu 009; Guanpeng Li; Homa Alemzadeh; Rakesh Bobba; Varun Chandrasekaran; David E. Evans 001; Nicolas Papernot; Karthik Pattabiraman; Florian Tramèr (DSN Workshops, 2021)

Differentially Private Learning Needs Better Features (or Much More Data). - Florian Tramèr; Dan Boneh (ICLR, 2021)

Label-Only Membership Inference Attacks. - Christopher A. Choquette-Choo; Florian Tramèr; Nicholas Carlini; Nicolas Papernot (ICML, 2021)

SquirRL: Automating Attack Analysis on Blockchain Incentive Mechanisms with Deep Reinforcement Learning. - Charlie Hou; Mingxun Zhou; Yan Ji 001; Phil Daian; Florian Tramèr; Giulia Fanti; Ari Juels (NDSS, 2021)

Antipodes of Label Differential Privacy: PATE and ALIBI. - Mani Malek Esmaeili; Ilya Mironov; Karthik Prasad; Igor Shilov; Florian Tramèr (NeurIPS, 2021)

Is Private Learning Possible with Instance Encoding? - Nicholas Carlini; Samuel Deng; Sanjam Garg; Somesh Jha; Saeed Mahloujifar; Mohammad Mahmoody; Abhradeep Thakurta; Florian Tramèr (SP, 2021)

Extracting Training Data from Large Language Models. - Nicholas Carlini; Florian Tramèr; Eric Wallace; Matthew Jagielski; Ariel Herbert-Voss; Katherine Lee; Adam Roberts; Tom B. Brown; Dawn Song; Úlfar Erlingsson; Alina Oprea; Colin Raffel (USENIX Security Symposium, 2021)

Data Poisoning Won't Save You From Facial Recognition. - Evani Radiya-Dixit; Florian Tramèr (CoRR, 2021)

NeuraCrypt is not private. - Nicholas Carlini; Sanjam Garg; Somesh Jha; Saeed Mahloujifar; Mohammad Mahmoody; Florian Tramèr (CoRR, 2021)

Advances and Open Problems in Federated Learning. - Peter Kairouz; H. Brendan McMahan; Brendan Avent; Aurélien Bellet; Mehdi Bennis; Arjun Nitin Bhagoji; Kallista A. Bonawitz; Zachary Charles; Graham Cormode; Rachel Cummings; Rafael G. L. D'Oliveira; Hubert Eichner; et al. (Found. Trends Mach. Learn., 2021)

Measuring and enhancing the security of machine learning. - Florian Tramèr (2021)

AISec '22: 15th ACM Workshop on Artificial Intelligence and Security. - Ambra Demontis; Xinyun Chen; Florian Tramèr (CCS, 2022)

Truth Serum: Poisoning Machine Learning Models to Reveal Their Secrets. - Florian Tramèr; Reza Shokri; Ayrton San Joaquin; Hoang Le; Matthew Jagielski; Sanghyun Hong 001; Nicholas Carlini (CCS, 2022)

What Does it Mean for a Language Model to Preserve Privacy? - Hannah Brown; Katherine Lee; Fatemehsadat Mireshghallah; Reza Shokri; Florian Tramèr (FAccT, 2022)

Large Language Models Can Be Strong Differentially Private Learners. - Xuechen Li 005; Florian Tramèr; Percy Liang; Tatsunori Hashimoto (ICLR, 2022)

Data Poisoning Won't Save You From Facial Recognition. - Evani Radiya-Dixit; Sanghyun Hong 001; Nicholas Carlini; Florian Tramèr (ICLR, 2022)

Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them. - Florian Tramèr (ICML, 2022)

The Privacy Onion Effect: Memorization is Relative. - Nicholas Carlini; Matthew Jagielski; Chiyuan Zhang; Nicolas Papernot; Andreas Terzis; Florian Tramèr (NeurIPS, 2022)

Increasing Confidence in Adversarial Robustness Evaluations. - Roland S. Zimmermann; Wieland Brendel; Florian Tramèr; Nicholas Carlini (NeurIPS, 2022)

Membership Inference Attacks From First Principles. - Nicholas Carlini; Steve Chien; Milad Nasr; Shuang Song 001; Andreas Terzis; Florian Tramèr (SP, 2022)

Debugging Differential Privacy: A Case Study for Privacy Auditing. - Florian Tramèr; Andreas Terzis; Thomas Steinke 002; Shuang Song 001; Matthew Jagielski; Nicholas Carlini (CoRR, 2022)

(Certified!!) Adversarial Robustness for Free! - Nicholas Carlini; Florian Tramèr; Krishnamurthy Dvijotham; J. Zico Kolter (CoRR, 2022)

Red-Teaming the Stable Diffusion Safety Filter. - Javier Rando; Daniel Paleka; David Lindner; Lennart Heim; Florian Tramèr (CoRR, 2022)

Preventing Verbatim Memorization in Language Models Gives a False Sense of Privacy. - Daphne Ippolito; Florian Tramèr; Milad Nasr; Chiyuan Zhang; Matthew Jagielski; Katherine Lee; Christopher A. Choquette-Choo; Nicholas Carlini (CoRR, 2022)

Considerations for Differentially Private Learning with Large-Scale Public Pretraining. - Florian Tramèr; Gautam Kamath 001; Nicholas Carlini (CoRR, 2022)

AISec '23: 16th ACM Workshop on Artificial Intelligence and Security. - Maura Pintor; Florian Simon Tramèr; Xinyun Chen (CCS, 2023)

Quantifying Memorization Across Neural Language Models. - Nicholas Carlini; Daphne Ippolito; Matthew Jagielski; Katherine Lee; Florian Tramèr; Chiyuan Zhang (ICLR, 2023)

(Certified!!) Adversarial Robustness for Free! - Nicholas Carlini; Florian Tramèr; Krishnamurthy (Dj) Dvijotham; Leslie Rice; Mingjie Sun; J. Zico Kolter (ICLR, 2023)

Measuring Forgetting of Memorized Training Examples. - Matthew Jagielski; Om Thakkar 001; Florian Tramèr; Daphne Ippolito; Katherine Lee; Nicholas Carlini; Eric Wallace; Shuang Song 001; Abhradeep Guha Thakurta; Nicolas Papernot; Chiyuan Zhang (ICLR, 2023)

Preprocessors Matter! Realistic Decision-Based Attacks on Machine Learning Systems. - Chawin Sitawarin; Florian Tramèr; Nicholas Carlini (ICML, 2023)

Preventing Generation of Verbatim Memorization in Language Models Gives a False Sense of Privacy. - Daphne Ippolito; Florian Tramèr; Milad Nasr; Chiyuan Zhang; Matthew Jagielski; Katherine Lee; Christopher A. Choquette-Choo; Nicholas Carlini (INLG, 2023)

Are aligned neural networks adversarially aligned? - Nicholas Carlini; Milad Nasr; Christopher A. Choquette-Choo; Matthew Jagielski; Irena Gao; Pang Wei Koh; Daphne Ippolito; Florian Tramèr; Ludwig Schmidt (NeurIPS, 2023)

Students Parrot Their Teachers: Membership Inference on Model Distillation. - Matthew Jagielski; Milad Nasr; Katherine Lee; Christopher A. Choquette-Choo; Nicholas Carlini; Florian Tramèr (NeurIPS, 2023)

Counterfactual Memorization in Neural Language Models. - Chiyuan Zhang; Daphne Ippolito; Katherine Lee; Matthew Jagielski; Florian Tramèr; Nicholas Carlini (NeurIPS, 2023)

SNAP: Efficient Extraction of Private Properties with Poisoning. - Harsh Chaudhari; John Abascal; Alina Oprea; Matthew Jagielski; Florian Tramèr; Jonathan R. Ullman (SP, 2023)

Extracting Training Data from Diffusion Models. - Nicholas Carlini; Jamie Hayes; Milad Nasr; Matthew Jagielski; Vikash Sehwag; Florian Tramèr; Borja Balle; Daphne Ippolito; Eric Wallace (USENIX Security Symposium, 2023)

Tight Auditing of Differentially Private Machine Learning. - Milad Nasr; Jamie Hayes; Thomas Steinke 002; Borja Balle; Florian Tramèr; Matthew Jagielski; Nicholas Carlini; Andreas Terzis (USENIX Security Symposium, 2023)

Randomness in ML Defenses Helps Persistent Attackers and Hinders Evaluators. - Keane Lucas; Matthew Jagielski; Florian Tramèr; Lujo Bauer; Nicholas Carlini (CoRR, 2023)

Are aligned neural networks adversarially aligned? - Nicholas Carlini; Milad Nasr; Christopher A. Choquette-Choo; Matthew Jagielski; Irena Gao; Anas Awadalla; Pang Wei Koh; Daphne Ippolito; Katherine Lee; Florian Tramèr; Ludwig Schmidt (CoRR, 2023)

Backdoor Attacks for In-Context Learning with Language Models. - Nikhil Kandpal; Matthew Jagielski; Florian Tramèr; Nicholas Carlini (CoRR, 2023)

Scalable Extraction of Training Data from (Production) Language Models. - Milad Nasr; Nicholas Carlini; Jonathan Hayase; Matthew Jagielski; A. Feder Cooper; Daphne Ippolito; Christopher A. Choquette-Choo; Eric Wallace; Florian Tramèr; Katherine Lee (CoRR, 2023)

Evaluations of Machine Learning Privacy Defenses are Misleading. - Michael Aerni; Jie Zhang 107; Florian Tramèr (CCS, 2024)

Universal Jailbreak Backdoors from Poisoned Human Feedback. - Javier Rando; Florian Tramèr (ICLR, 2024)

Stealing part of a production language model. - Nicholas Carlini; Daniel Paleka; Krishnamurthy Dj Dvijotham; Thomas Steinke 002; Jonathan Hayase; A. Feder Cooper; Katherine Lee; Matthew Jagielski; Milad Nasr; Arthur Conmy; Eric Wallace; David Rolnick; et al. (ICML, 2024)

Privacy Backdoors: Stealing Data with Corrupted Pretrained Models. - Shanglun Feng; Florian Tramèr (ICML, 2024)

Extracting Training Data From Document-Based VQA Models. - Francesco Pinto; Nathalie Rauschmayr; Florian Tramèr; Philip Torr 001; Federico Tombari (ICML, 2024)

Position: Considerations for Differentially Private Learning with Large-Scale Public Pretraining. - Florian Tramèr; Gautam Kamath 001; Nicholas Carlini (ICML, 2024)

JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models. - Patrick Chao; Edoardo Debenedetti; Alexander Robey; Maksym Andriushchenko; Francesco Croce; Vikash Sehwag; Edgar Dobriban; Nicolas Flammarion; George J. Pappas; Florian Tramèr; Hamed Hassani; Eric Wong 001 (NeurIPS, 2024)

Dataset and Lessons Learned from the 2024 SaTML LLM Capture-the-Flag Competition. - Edoardo Debenedetti; Javier Rando; Daniel Paleka; Silaghi Fineas Florin; Dragos Albastroiu; Niv Cohen; Yuval Lemberg; Reshmi Ghosh; Rui Wen 002; Ahmed Salem 001; Giovanni Cherubin; Santiago Zanella-Béguelin; et al. (NeurIPS, 2024)

AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. - Edoardo Debenedetti; Jie Zhang 107; Mislav Balunovic; Luca Beurer-Kellner; Marc Fischer 002; Florian Tramèr (NeurIPS, 2024)

Query-Based Adversarial Prompt Generation. - Jonathan Hayase; Ema Borevkovic; Nicholas Carlini; Florian Tramèr; Milad Nasr (NeurIPS, 2024)

Evading Black-box Classifiers Without Breaking Eggs. - Edoardo Debenedetti; Nicholas Carlini; Florian Tramèr (SaTML, 2024)

Evaluating Superhuman Models with Consistency Checks. - Lukas Fluri; Daniel Paleka; Florian Tramèr (SaTML, 2024)

Poisoning Web-Scale Training Datasets is Practical. - Nicholas Carlini; Matthew Jagielski; Christopher A. Choquette-Choo; Daniel Paleka; Will Pearce; Hyrum S. Anderson; Andreas Terzis; Kurt Thomas; Florian Tramèr (SP, 2024)

Privacy Side Channels in Machine Learning Systems. - Edoardo Debenedetti; Giorgio Severi; Milad Nasr; Christopher A. Choquette-Choo; Matthew Jagielski; Eric Wallace; Nicholas Carlini; Florian Tramèr (USENIX Security Symposium, 2024)

Foundational Challenges in Assuring Alignment and Safety of Large Language Models. - Usman Anwar; Abulhair Saparov; Javier Rando; Daniel Paleka; Miles Turpin; Peter Hase; Ekdeep Singh Lubana; Erik Jenner; Stephen Casper; Oliver Sourbut; Benjamin L. Edelman; Zhaowei Zhang; et al. (CoRR, 2024)

Competition Report: Finding Universal Jailbreak Backdoors in Aligned LLMs. - Javier Rando; Francesco Croce; Krystof Mitka; Stepan Shabalin; Maksym Andriushchenko; Nicolas Flammarion; Florian Tramèr (CoRR, 2024)

AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents. - Edoardo Debenedetti; Jie Zhang 107; Mislav Balunovic; Luca Beurer-Kellner; Marc Fischer 002; Florian Tramèr (CoRR, 2024)

Blind Baselines Beat Membership Inference Attacks for Foundation Models. - Debeshee Das; Jie Zhang 107; Florian Tramèr (CoRR, 2024)

Membership Inference Attacks Cannot Prove that a Model Was Trained On Your Data. - Jie Zhang 107; Debeshee Das; Gautam Kamath 001; Florian Tramèr (CoRR, 2024)

Gradient-based Jailbreak Images for Multimodal Fusion Models. - Javier Rando; Hannah Korevaar; Erik Brinkman; Ivan Evtimov; Florian Tramèr (CoRR, 2024)

Gradient Masking All-at-Once: Ensemble Everything Everywhere Is Not Robust. - Jie Zhang 107; Kristina Nikolic; Nicholas Carlini; Florian Tramèr (CoRR, 2024)

International Scientific Report on the Safety of Advanced AI (Interim Report). - Yoshua Bengio; Sören Mindermann; Daniel Privitera; Tamay Besiroglu; Rishi Bommasani; Stephen Casper; Yejin Choi 001; Danielle Goldfarb; Hoda Heidari; Leila Khalatbari; Shayne Longpre; Vasilios Mavroudis; et al. (CoRR, 2024)

Foundational Challenges in Assuring Alignment and Safety of Large Language Models. - Usman Anwar; Abulhair Saparov; Javier Rando; Daniel Paleka; Miles Turpin; Peter Hase; Ekdeep Singh Lubana; Erik Jenner; Stephen Casper; Oliver Sourbut; Benjamin L. Edelman; Zhaowei Zhang; et al. (Trans. Mach. Learn. Res., 2024)

Measuring Non-Adversarial Reproduction of Training Data in Large Language Models. - Michael Aerni; Javier Rando; Edoardo Debenedetti; Nicholas Carlini; Daphne Ippolito; Florian Tramèr (ICLR, 2025)

Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI. - Robert Hönig; Javier Rando; Nicholas Carlini; Florian Tramèr (ICLR, 2025)

Scalable Extraction of Training Data from Aligned, Production Language Models. - Milad Nasr; Javier Rando; Nicholas Carlini; Jonathan Hayase; Matthew Jagielski; A. Feder Cooper; Daphne Ippolito; Christopher A. Choquette-Choo; Florian Tramèr; Katherine Lee (ICLR, 2025)

Adversarial Search Engine Optimization for Large Language Models. - Fredrik Nestaas; Edoardo Debenedetti; Florian Tramèr (ICLR, 2025)

Consistency Checks for Language Model Forecasters. - Daniel Paleka; Abhimanyu Pallavi Sudhir; Alejandro Alvarez; Vineeth Bhat; Adam Shen; Evan Wang; Florian Tramèr (ICLR, 2025)

Persistent Pre-training Poisoning of LLMs. - Yiming Zhang; Javier Rando; Ivan Evtimov; Jianfeng Chi; Eric Michael Smith; Nicholas Carlini; Florian Tramèr; Daphne Ippolito (ICLR, 2025)

Position: Membership Inference Attacks Cannot Prove That a Model was Trained on Your Data. - Jie Zhang 107; Debeshee Das; Gautam Kamath 001; Florian Tramèr (SaTML, 2025)

Membership Inference Attacks on Sequence Models. - Lorenzo Rossi; Michael Aerni; Jie Zhang 107; Florian Tramèr (SP (Workshops), 2025)

SoK: Watermarking for AI-Generated Content. - Xuandong Zhao; Sam Gunn; Miranda Christ; Jaiden Fairoze; Andres Fabrega; Nicholas Carlini; Sanjam Garg; Sanghyun Hong 001; Milad Nasr; Florian Tramèr; Somesh Jha; Lei Li 005; et al. (SP, 2025)

An Adversarial Perspective on Machine Unlearning for AI Safety. - Jakub Lucki; Boyi Wei; Yangsibo Huang; Peter Henderson 002; Florian Tramèr; Javier Rando (Trans. Mach. Learn. Res., 2025)

Exploring and Mitigating Adversarial Manipulation of Voting-Based Leaderboards. - Yangsibo Huang; Milad Nasr; Anastasios Angelopoulos; Nicholas Carlini; Wei-Lin Chiang; Christopher A. Choquette-Choo; Daphne Ippolito; Matthew Jagielski; Katherine Lee; Ken Ziyu Liu; Ion Stoica; Florian Tramèr; et al. (CoRR, 2025)

International AI Safety Report. - Yoshua Bengio; Sören Mindermann; Daniel Privitera; Tamay Besiroglu; Rishi Bommasani; Stephen Casper; Yejin Choi 001; Philip Fox; Ben Garfinkel; Danielle Goldfarb; Hoda Heidari; Anson Ho; et al. (CoRR, 2025)

Adversarial ML Problems Are Getting Harder to Solve and to Evaluate. - Javier Rando; Jie Zhang 107; Nicholas Carlini; Florian Tramèr (CoRR, 2025)

AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defenses. - Nicholas Carlini; Javier Rando; Edoardo Debenedetti; Milad Nasr; Florian Tramèr (CoRR, 2025)

Defeating Prompt Injections by Design. - Edoardo Debenedetti; Ilia Shumailov; Tianqi Fan; Jamie Hayes; Nicholas Carlini; Daniel Fabian; Christoph Kern; Chongyang Shi 003; Andreas Terzis; Florian Tramèr (CoRR, 2025)

The Jailbreak Tax: How Useful are Your Jailbreak Outputs? - Kristina Nikolic; Luze Sun; Jie Zhang 107; Florian Tramèr (CoRR, 2025)

LLMs unlock new paths to monetizing exploits. - Nicholas Carlini; Milad Nasr; Edoardo Debenedetti; Barry Wang; Christopher A. Choquette-Choo; Daphne Ippolito; Florian Tramèr; Matthew Jagielski (CoRR, 2025)

RealMath: A Continuous Benchmark for Evaluating Language Models on Research-Level Mathematics. - Jie Zhang 107; Cezara Petrui; Kristina Nikolic; Florian Tramèr (CoRR, 2025)

Pitfalls in Evaluating Language Model Forecasters. - Daniel Paleka; Shashwat Goel; Jonas Geiping; Florian Tramèr (CoRR, 2025)

Design Patterns for Securing LLM Agents against Prompt Injections. - Luca Beurer-Kellner; Beat Buesser; Ana-Maria Cretu 001; Edoardo Debenedetti; Daniel Dobos; Daniel Fabian; Marc Fischer 002; David Froelicher; Kathrin Grosse; Daniel Naeff; Ezinwanne Ozoani; Andrew Paverd; et al. (CoRR, 2025)