Computational analysis of valence and arousal in virtual reality gaming using lower arm electromyograms. - Ilia Shumailov; Hatice Gunes (ACII, 2017)

Tendrils of Crime: Visualizing the Diffusion of Stolen Bitcoins. - Mansoor Ahmed-Rengers; Ilia Shumailov; Ross Anderson 001 (GraMSec@FLoC, 2018)

Making Bitcoin Legal. - Ross Anderson 001; Ilia Shumailov; Mansoor Ahmed-Rengers (Security Protocols Workshop, 2018)

The Taboo Trap: Behavioural Detection of Adversarial Samples. - Ilia Shumailov; Yiren Zhao; Robert D. Mullins; Ross Anderson 001 (CoRR, 2018)

Towards Automatic Discovery of Cybercrime Supply Chains. - Rasika Bhalerao; Maxwell Aliapoulios; Ilia Shumailov; Sadia Afroz 001; Damon McCoy (CoRR, 2018)

Mapping the Underground: Supervised Discovery of Cybercrime Supply Chains. - Rasika Bhalerao; Maxwell Aliapoulios; Ilia Shumailov; Sadia Afroz 001; Damon McCoy (eCrime, 2019)

To Compress Or Not To Compress: Understanding The Interactions Between Adversarial Attacks And Neural Network Compression. - Yiren Zhao; Ilia Shumailov; Robert D. Mullins; Ross Anderson 001 (SysML, 2019)

Snitches Get Stitches: On the Difficulty of Whistleblowing. - Mansoor Ahmed-Rengers; Ross J. Anderson; Darija Halatova; Ilia Shumailov (Security Protocols Workshop, 2019)

Snitches Get Stitches: On the Difficulty of Whistleblowing (Transcript of Discussion). - Mansoor Ahmed-Rengers; Ross J. Anderson; Darija Halatova; Ilia Shumailov (Security Protocols Workshop, 2019)

Audio CAPTCHA with a Few Cocktails: It's so Noisy I Can't Hear You. - Benjamin Maximilian Reinheimer; Fairooz Islam; Ilia Shumailov (Security Protocols Workshop, 2019)

Audio CAPTCHA with a Few Cocktails: It's So Noisy I Can't Hear You (Transcript of Discussion). - Benjamin Maximilian Reinheimer; Fairooz Islam; Ilia Shumailov (Security Protocols Workshop, 2019)

Information Security Meets Adversarial Examples. - Matthias Kirchner; Cecilia Pasquini; Ilia Shumailov (WIFS, 2019)

Sitatapatra: Blocking the Transfer of Adversarial Samples. - Ilia Shumailov; Xitong Gao; Yiren Zhao; Robert D. Mullins; Ross Anderson 001; Cheng-Zhong Xu 001 (CoRR, 2019)

Hearing your touch: A new acoustic side channel on smartphones. - Ilia Shumailov; Laurent Simon; Jeff Yan; Ross Anderson 001 (CoRR, 2019)

Towards Certifiable Adversarial Sample Detection. - Ilia Shumailov; Yiren Zhao; Robert D. Mullins; Ross J. Anderson (AISec@CCS, 2020)

Blackbox Attacks on Reinforcement Learning Agents Using Approximated Temporal Information. - Yiren Zhao; Ilia Shumailov; Han Cui; Xitong Gao; Robert D. Mullins; Ross J. Anderson (DSN Workshops, 2020)

Turning Up the Dial: the Evolution of a Cybercrime Market Through Set-up, Stable, and Covid-19 Eras. - Anh V. Vu; Jack Hughes 001; Ildiko Pete; Ben Collier; Yi Ting Chua 001; Ilia Shumailov; Alice Hutchings (Internet Measurement Conference, 2020)

BatNet: Data transmission between smartphones over ultrasound. - Almos Zarandy; Ilia Shumailov; Ross J. Anderson (CoRR, 2020)

Not My Deepfake: Towards Plausible Deniability for Machine-Generated Media. - Baiwu Zhang; Jin Peng Zhou; Ilia Shumailov; Nicolas Papernot (CoRR, 2020)

Nudge Attacks on Point-Cloud DNNs. - Yiren Zhao; Ilia Shumailov; Robert D. Mullins; Ross J. Anderson (CoRR, 2020)

Hey Alexa what did I just type? Decoding smartphone sounds with a voice assistant. - Almos Zarandy; Ilia Shumailov; Ross J. Anderson (CoRR, 2020)

Sponge Examples: Energy-Latency Attacks on Neural Networks. - Ilia Shumailov; Yiren Zhao; Daniel Bates; Nicolas Papernot; Robert D. Mullins; Ross Anderson 001 (EuroS&P, 2021)

Markpainting: Adversarial Machine Learning meets Inpainting. - David Khachaturov; Ilia Shumailov; Yiren Zhao; Nicolas Papernot; Ross J. Anderson (ICML, 2021)

Manipulating SGD with Data Ordering Attacks. - Ilia Shumailov; Zakhar Shumaylov; Dmitry Kazhdan; Yiren Zhao; Nicolas Papernot; Murat A. Erdogdu; Ross J. Anderson (NeurIPS, 2021)

ExtremeBB: Enabling Large-Scale Research into Extremism, the Manosphere and Their Correlation by Online Forum Data. - Anh V. Vu; Lydia Wilson; Yi Ting Chua 001; Ilia Shumailov; Ross J. Anderson (CoRR, 2021)

Rethinking Image-Scaling Attacks: The Interplay Between Vulnerabilities in Machine Learning Systems. - Yue Gao 011; Ilia Shumailov; Kassem Fawaz (ICML, 2022)

On the Limitations of Stochastic Pre-processing Defenses. - Yue Gao 011; Ilia Shumailov; Kassem Fawaz; Nicolas Papernot (NeurIPS, 2022)

In Differential Privacy, There is Truth: on Vote-Histogram Leakage in Ensemble Private Learning. - Jiaqi Wang; Roei Schuster; Ilia Shumailov; David Lie; Nicolas Papernot (NeurIPS, 2022)

Rapid Model Architecture Adaption for Meta-Learning. - Yiren Zhao; Xitong Gao; Ilia Shumailov; Nicolò Fusi; Robert D. Mullins (NeurIPS, 2022)

Bad Characters: Imperceptible NLP Attacks. - Nicholas Boucher; Ilia Shumailov; Ross Anderson 001; Nicolas Papernot (SP, 2022)

Towards More Robust Keyword Spotting for Voice Assistants. - Shimaa Ahmed; Ilia Shumailov; Nicolas Papernot; Kassem Fawaz (USENIX Security Symposium, 2022)

On the Necessity of Auditable Algorithmic Definitions for Machine Unlearning. - Anvith Thudi; Hengrui Jia 001; Ilia Shumailov; Nicolas Papernot (USENIX Security Symposium, 2022)

Pipe Overflow: Smashing Voice Authentication for Fun and Profit. - Shimaa Ahmed; Yash Wani; Ali Shahin Shamsabadi; Mohammad Yaghini; Ilia Shumailov; Nicolas Papernot; Kassem Fawaz (CoRR, 2022)

Model Architecture Adaption for Bayesian Neural Networks. - Duo Wang; Yiren Zhao; Ilia Shumailov; Robert D. Mullins (CoRR, 2022)

Bounding Membership Inference. - Anvith Thudi; Ilia Shumailov; Franziska Boenisch; Nicolas Papernot (CoRR, 2022)

Efficient Adversarial Training With Data Pruning. - Maximilian Kaufmann; Yiren Zhao; Ilia Shumailov; Robert D. Mullins; Nicolas Papernot (CoRR, 2022)

In Differential Privacy, There is Truth: On Vote Leakage in Ensemble Private Learning. - Jiaqi Wang; Roei Schuster; Ilia Shumailov; David Lie; Nicolas Papernot (CoRR, 2022)

Augmentation Backdoors. - Joseph Rance; Yiren Zhao; Ilia Shumailov; Robert D. Mullins (CoRR, 2022)

ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networks. - Tim Clifford; Ilia Shumailov; Yiren Zhao; Ross J. Anderson; Robert D. Mullins (CoRR, 2022)

Wide Attention Is The Way Forward For Transformers. - Jason Ross Brown; Yiren Zhao; Ilia Shumailov; Robert D. Mullins (CoRR, 2022)

DARTFormer: Finding The Best Type Of Attention. - Jason Ross Brown; Yiren Zhao; Ilia Shumailov; Robert D. Mullins (CoRR, 2022)

Revisiting Automated Prompting: Are We Actually Doing Better? - Yulin Zhou; Yiren Zhao; Ilia Shumailov; Robert D. Mullins; Yarin Gal (ACL (2), 2023)

Architectural Backdoors in Neural Networks. - Mikel Bober-Irizar; Ilia Shumailov; Yiren Zhao; Robert D. Mullins; Nicolas Papernot (CVPR, 2023)

Revisiting Block-based Quantisation: What is Important for Sub-8-bit LLM Inference? - Cheng Zhang; Jianyi Cheng; Ilia Shumailov; George A. Constantinides; Yiren Zhao (EMNLP, 2023)

When the Curious Abandon Honesty: Federated Learning Is Not Private. - Franziska Boenisch; Adam Dziedzic; Roei Schuster; Ali Shahin Shamsabadi; Ilia Shumailov; Nicolas Papernot (EuroS&P, 2023)

Reconstructing Individual Data Points in Federated Learning Hardened with Differential Privacy and Secure Aggregation. - Franziska Boenisch; Adam Dziedzic; Roei Schuster; Ali Shahin Shamsabadi; Ilia Shumailov; Nicolas Papernot (EuroS&P, 2023)

Boosting Big Brother: Attacking Search Engines with Encodings. - Nicholas Boucher; Luca Pajola; Ilia Shumailov; Ross J. Anderson; Mauro Conti (RAID, 2023)

Tubes Among Us: Analog Attack on Automatic Speaker Identification. - Shimaa Ahmed; Yash Wani; Ali Shahin Shamsabadi; Mohammad Yaghini; Ilia Shumailov; Nicolas Papernot; Kassem Fawaz (USENIX Security Symposium, 2023)

Is Federated Learning a Practical PET Yet? - Franziska Boenisch; Adam Dziedzic; Roei Schuster; Ali Shahin Shamsabadi; Ilia Shumailov; Nicolas Papernot (CoRR, 2023)

The Curse of Recursion: Training on Generated Data Makes Models Forget. - Ilia Shumailov; Zakhar Shumaylov; Yiren Zhao; Yarin Gal; Nicolas Papernot; Ross J. Anderson (CoRR, 2023)

When Vision Fails: Text Attacks Against ViT and OCR. - Nicholas Boucher; Jenny Blessing; Ilia Shumailov; Ross Anderson 001; Nicolas Papernot (CoRR, 2023)

Machine Learning needs its own Randomness Standard: Randomised Smoothing and PRNG-based attacks. - Pranav Dahiya; Ilia Shumailov; Ross J. Anderson (CoRR, 2023)

LLM Censorship: A Machine Learning Challenge or a Computer Security Problem? - David Glukhov; Ilia Shumailov; Yarin Gal; Nicolas Papernot; Vardan Papyan (CoRR, 2023)

Human-Producible Adversarial Examples. - David Khachaturov; Yue Gao 011; Ilia Shumailov; Robert D. Mullins; Ross J. Anderson; Kassem Fawaz (CoRR, 2023)

Fairness Feedback Loops: Training on Synthetic Data Amplifies Bias. - Sierra Calanda Wyllie; Ilia Shumailov; Nicolas Papernot (FAccT, 2024)

Position: Fundamental Limitations of LLM Censorship Necessitate New Approaches. - David Glukhov; Ilia Shumailov; Yarin Gal; Nicolas Papernot; Vardan Papyan (ICML, 2024)

Beyond Slow Signs in High-fidelity Model Extraction. - Hanna Foerster; Robert D. Mullins; Ilia Shumailov; Jamie Hayes (NeurIPS, 2024)

ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networks. - Eleanor Clifford; Ilia Shumailov; Yiren Zhao; Ross J. Anderson; Robert D. Mullins (SaTML, 2024)

Machine Learning needs Better Randomness Standards: Randomised Smoothing and PRNG-based attacks. - Pranav Dahiya; Ilia Shumailov; Ross Anderson 001 (USENIX Security Symposium, 2024)

Gradients Look Alike: Sensitivity is Often Overestimated in DP-SGD. - Anvith Thudi; Hengrui Jia 001; Casey Meehan; Ilia Shumailov; Nicolas Papernot (USENIX Security Symposium, 2024)

Buffer Overflow in Mixture of Experts. - Jamie Hayes; Ilia Shumailov; Itay Yona (CoRR, 2024)

Measuring memorization in RLHF for code completion. - Aneesh Pappu; Billy Porter; Ilia Shumailov; Jamie Hayes (CoRR, 2024)

UnUnlearning: Unlearning is not sufficient for content regulation in advanced generative AI. - Ilia Shumailov; Jamie Hayes; Eleni Triantafillou; Guillermo Ortiz-Jiménez; Nicolas Papernot; Matthew Jagielski; Itay Yona; Heidi Howard; Eugene Bagdasaryan (CoRR, 2024)

A False Sense of Safety: Unsafe Information Leakage in 'Safe' AI Responses. - David Glukhov; Ziwen Han; Ilia Shumailov; Vardan Papyan; Nicolas Papernot (CoRR, 2024)

Operationalizing Contextual Integrity in Privacy-Conscious Assistants. - Sahra Ghalebikesabi; Eugene Bagdasaryan; Ren Yi; Itay Yona; Ilia Shumailov; Aneesh Pappu; Chongyang Shi 003; Laura Weidinger; Robert Stanforth; Leonard Berrada; Pushmeet Kohli; Po-Sen Huang; et al. (CoRR, 2024)

Measuring memorization through probabilistic discoverable extraction. - Jamie Hayes; Marika Swanberg; Harsh Chaudhari; Itay Yona; Ilia Shumailov (CoRR, 2024)

Stealing User Prompts from Mixture of Experts. - Itay Yona; Ilia Shumailov; Jamie Hayes; Nicholas Carlini (CoRR, 2024)

Hardware and Software Platform Inference. - Cheng Zhang; Hanna Foerster; Robert D. Mullins; Yiren Zhao; Ilia Shumailov (CoRR, 2024)

Machine Unlearning Doesn't Do What You Think: Lessons for Generative AI Policy, Research, and Practice. - A. Feder Cooper; Christopher A. Choquette-Choo; Miranda Bogen; Matthew Jagielski; Katja Filippova; Ken Ziyu Liu; Alexandra Chouldechova; Jamie Hayes; Yangsibo Huang; Niloofar Mireshghallah; Ilia Shumailov; Eleni Triantafillou; et al. (CoRR, 2024)

Beyond Labeling Oracles - What does it mean to steal ML models? - Avital Shafran; Ilia Shumailov; Murat A. Erdogdu; Nicolas Papernot (Trans. Mach. Learn. Res., 2024)

From Differential Privacy to Bounds on Membership Inference: Less can be More. - Anvith Thudi; Ilia Shumailov; Franziska Boenisch; Nicolas Papernot (Trans. Mach. Learn. Res., 2024)

AI models collapse when trained on recursively generated data. - Ilia Shumailov; Zakhar Shumaylov; Yiren Zhao; Nicolas Papernot; Ross J. Anderson; Yarin Gal (Nat., 2024)

Scalable watermarking for identifying large language model outputs. - Sumanth Dathathri; Abigail See; Sumedh Ghaisas; Po-Sen Huang; Rob McAdam; Johannes Welbl; Vandana Bachani; Alex Kaskasoli; Robert Stanforth; Tatiana Matejovicova; Jamie Hayes; Nidhi Vyas; et al. (Nat., 2024)

Cascading Adversarial Bias from Injection to Distillation in Language Models. - Harsh Chaudhari; Jamie Hayes; Matthew Jagielski; Ilia Shumailov; Milad Nasr; Alina Oprea (CCS, 2025)

Breach By A Thousand Leaks: Unsafe Information Leakage in 'Safe' AI Responses. - David Glukhov; Ziwen Han; Ilia Shumailov; Vardan Papyan; Nicolas Papernot (ICLR, 2025)

Measuring memorization in RLHF for code completion. - Jamie Hayes; Ilia Shumailov; William P. Porter; Aneesh Pappu (ICLR, 2025)

Measuring memorization in language models via probabilistic extraction. - Jamie Hayes; Marika Swanberg; Harsh Chaudhari; Itay Yona; Ilia Shumailov; Milad Nasr; Christopher A. Choquette-Choo; Katherine Lee; A. Feder Cooper (NAACL (Long Papers), 2025)

SEA: Shareable and Explainable Attribution for Query-Based Black-Box Attacks. - Yue Gao 011; Ilia Shumailov; Kassem Fawaz (SaTML, 2025)

Locking Machine Learning Models into Hardware. - Eleanor Clifford; Adhithya Saravanan; Harry Langford; Cheng Zhang; Yiren Zhao; Robert D. Mullins; Ilia Shumailov; Jamie Hayes (SaTML, 2025)

Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacy. - Jamie Hayes; Ilia Shumailov; Eleni Triantafillou; Amr Khalifa; Nicolas Papernot (SaTML, 2025)

Architectural Neural Backdoors from First Principles. - Harry Langford; Ilia Shumailov; Yiren Zhao; Robert D. Mullins; Nicolas Papernot (SP, 2025)

Privacy Awareness for Information-Sharing Assistants: A Case-study on Form-filling with Contextual Integrity. - Sahra Ghalebikesabi; Eugene Bagdasarian; Ren Yi; Itay Yona; Ilia Shumailov; Aneesh Pappu; Chongyang Shi 003; Laura Weidinger; Robert Stanforth; Leonard Berrada; Pushmeet Kohli; Po-Sen Huang; et al. (Trans. Mach. Learn. Res., 2025)

Trusted Machine Learning Models Unlock Private Inference for Problems Currently Infeasible with Cryptography. - Ilia Shumailov; Daniel Ramage; Sarah Meiklejohn; Peter Kairouz; Florian Hartmann; Borja Balle; Eugene Bagdasarian (CoRR, 2025)

Interpreting the Repeated Token Phenomenon in Large Language Models. - Itay Yona; Ilia Shumailov; Jamie Hayes; Federico Barbero; Yossi Gandelsman (CoRR, 2025)

Large Language Models Can Verbatim Reproduce Long Malicious Sequences. - Sharon Lin; Krishnamurthy Dvijotham; Jamie Hayes; Chongyang Shi 003; Ilia Shumailov; Shuang Song 001 (CoRR, 2025)

Defeating Prompt Injections by Design. - Edoardo Debenedetti; Ilia Shumailov; Tianqi Fan; Jamie Hayes; Nicholas Carlini; Daniel Fabian; Christoph Kern; Chongyang Shi 003; Andreas Terzis; Florian Tramèr (CoRR, 2025)

Watermarking Needs Input Repetition Masking. - David Khachaturov; Robert D. Mullins; Ilia Shumailov; Sumanth Dathathri (CoRR, 2025)

Fixing 7,400 Bugs for 1$: Cheap Crash-Site Program Repair. - Han Zheng 006; Ilia Shumailov; Tianqi Fan; Aiden Hall; Mathias Payer (CoRR, 2025)

Lessons from Defending Gemini Against Indirect Prompt Injections. - Chongyang Shi 003; Sharon Lin; Shuang Song 001; Jamie Hayes; Ilia Shumailov; Itay Yona; Juliette Pluto; Aneesh Pappu; Christopher A. Choquette-Choo; Milad Nasr; Chawin Sitawarin; Gena Gibson; et al. (CoRR, 2025)

Architectural Backdoors for Within-Batch Data Stealing and Model Inference Manipulation. - Nicolas Küchler; Ivan Petrov; Conrad Grobler; Ilia Shumailov (CoRR, 2025)

Strong Membership Inference Attacks on Massive Datasets and (Moderately) Large Language Models. - Jamie Hayes; Ilia Shumailov; Christopher A. Choquette-Choo; Matthew Jagielski; Georgios Kaissis; Katherine Lee; Milad Nasr; Sahra Ghalebikesabi; Niloofar Mireshghallah; Meenatchi Sundaram Mutu Selva Annamalai; Igor Shilov; Matthieu Meeus; et al. (CoRR, 2025)

Machine Learning Models Have a Supply Chain Problem. - Sarah Meiklejohn; Hayden Blauzvern; Mihai Maruseac; Spencer Schrock; Laurent Simon; Ilia Shumailov (CoRR, 2025)

Beyond Laplace and Gaussian: Exploring the Generalized Gaussian Mechanism for Private Machine Learning. - Roy Rinberg; Ilia Shumailov; Vikrant Singhal; Rachel Cummings; Nicolas Papernot (CoRR, 2025)

Reasoning Introduces New Poisoning Attacks Yet Makes Them More Complicated. - Hanna Foerster; Ilia Shumailov; Yiren Zhao; Harsh Chaudhari; Jamie Hayes; Robert D. Mullins; Yarin Gal (CoRR, 2025)

The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections. - Milad Nasr; Nicholas Carlini; Chawin Sitawarin; Sander V. Schulhoff; Jamie Hayes; Michael Ilie; Juliette Pluto; Shuang Song 001; Harsh Chaudhari; Ilia Shumailov; Abhradeep Thakurta; Kai Yuanqing Xiao; et al. (CoRR, 2025)

SynthID-Image: Image watermarking at internet scale. - Sven Gowal; Rudy Bunel; Florian Stimberg; David Stutz; Guillermo Ortiz-Jiménez; Christina Kouridi; Mel Vecerík; Jamie Hayes; Sylvestre-Alvise Rebuffi; Paul Bernard; Chris Gamble; Miklós Z. Horváth; et al. (CoRR, 2025)

Extracting alignment data in open models. - Federico Barbero; Xiangming Gu; Christopher A. Choquette-Choo; Chawin Sitawarin; Matthew Jagielski; Itay Yona; Petar Velickovic; Ilia Shumailov; Jamie Hayes (CoRR, 2025)

Soft Instruction De-escalation Defense. - Nils Philipp Walter; Chawin Sitawarin; Jamie Hayes; David Stutz; Ilia Shumailov (CoRR, 2025)