Better open-world website fingerprinting. - Jamie Hayes; George Danezis (CoRR, 2015)

Guard Sets for Onion Routing. - Jamie Hayes; George Danezis (Proc. Priv. Enhancing Technol., 2015)

k-fingerprinting: A Robust Scalable Website Fingerprinting Technique. - Jamie Hayes; George Danezis (USENIX Security Symposium, 2016)

TASP: Towards Anonymity Sets that Persist. - Jamie Hayes; Carmela Troncoso; George Danezis (WPES@CCS, 2016)

Traffic Confirmation Attacks Despite Noise. - Jamie Hayes (CoRR, 2016)

AnoNotify: A Private Notification Service. - Ania M. Piotrowska; Jamie Hayes; Nethanel Gelernter; George Danezis; Amir Herzberg (IACR Cryptol. ePrint Arch., 2016)

Generating steganographic images via adversarial training. - Jamie Hayes; George Danezis (NIPS, 2017)

The Loopix Anonymity System. - Ania M. Piotrowska; Jamie Hayes; Tariq Elahi; Sebastian Meiser 001; George Danezis (USENIX Security Symposium, 2017)

AnNotify: A Private Notification Service. - Ania M. Piotrowska; Jamie Hayes; Nethanel Gelernter; George Danezis; Amir Herzberg (WPES@CCS, 2017)

ste-GAN-ography: Generating Steganographic Images via Adversarial Training. - Jamie Hayes; George Danezis (CoRR, 2017)

LOGAN: Evaluating Privacy Leakage of Generative Models Using Generative Adversarial Networks. - Jamie Hayes; Luca Melis; George Danezis; Emiliano De Cristofaro (CoRR, 2017)

Machine Learning as an Adversarial Service: Learning Black-Box Adversarial Examples. - Jamie Hayes; George Danezis (CoRR, 2017)

Website Fingerprinting Defenses at the Application Layer. - Giovanni Cherubin; Jamie Hayes; Marc Juarez (Proc. Priv. Enhancing Technol., 2017)

On Visible Adversarial Perturbations & Digital Watermarking. - Jamie Hayes (CVPR Workshops, 2018)

Contamination Attacks and Mitigation in Multi-Party Machine Learning. - Jamie Hayes; Olga Ohrimenko (NeurIPS, 2018)

Learning Universal Adversarial Perturbations with Generative Models. - Jamie Hayes; George Danezis (IEEE Symposium on Security and Privacy Workshops, 2018)

Evading classifiers in discrete domains with provable optimality guarantees. - Bogdan Kulynych; Jamie Hayes; Nikita Samarin; Carmela Troncoso (CoRR, 2018)

A note on hyperparameters in black-box adversarial examples. - Jamie Hayes (CoRR, 2018)

LOGAN: Membership Inference Attacks Against Generative Models. - Jamie Hayes; Luca Melis; George Danezis; Emiliano De Cristofaro (Proc. Priv. Enhancing Technol., 2019)

Extensions and limitations of randomized smoothing for robustness guarantees. - Jamie Hayes (CVPR Workshops, 2020)

A Framework for robustness Certification of Smoothed Classifiers using F-Divergences. - Krishnamurthy (Dj) Dvijotham; Jamie Hayes; Borja Balle; J. Zico Kolter; Chongli Qin; András György 001; Kai Xiao; Sven Gowal; Pushmeet Kohli (ICLR, 2020)

Unique properties of adversarially trained linear classifiers on Gaussian data. - Jamie Hayes (CoRR, 2020)

Provable trade-offs between private & robust machine learning. - Jamie Hayes (CoRR, 2020)

Toward Robustness and Privacy in Federated Learning: Experimenting with Local and Central Differential Privacy. - Mohammad Naseri; Jamie Hayes; Emiliano De Cristofaro (CoRR, 2020)

Adaptive Traffic Fingerprinting: Large-scale Inference under Realistic Assumptions. - Vasilios Mavroudis; Jamie Hayes (CoRR, 2020)

Towards transformation-resilient provenance detection of digital media. - Jamie Hayes; Krishnamurthy Dvijotham; Yutian Chen; Sander Dieleman; Pushmeet Kohli; Norman Casagrande (CoRR, 2020)

Local and Central Differential Privacy for Robustness and Privacy in Federated Learning. - Mohammad Naseri; Jamie Hayes; Emiliano De Cristofaro (NDSS, 2022)

Reconstructing Training Data with Informed Adversaries. - Borja Balle; Giovanni Cherubin; Jamie Hayes (SP, 2022)

Learning to be adversarially robust and differentially private. - Jamie Hayes; Borja Balle; M. Pawan Kumar (CoRR, 2022)

Unlocking High-Accuracy Differentially Private Image Classification through Scale. - Soham De; Leonard Berrada; Jamie Hayes; Samuel L. Smith; Borja Balle (CoRR, 2022)

Adaptive Webpage Fingerprinting from TLS Traces. - Vasilios Mavroudis; Jamie Hayes (DSN, 2023)

Bounding training data reconstruction in DP-SGD. - Jamie Hayes; Borja Balle; Saeed Mahloujifar (NeurIPS, 2023)

Towards Unbounded Machine Unlearning. - Meghdad Kurmanji; Peter Triantafillou; Jamie Hayes; Eleni Triantafillou (NeurIPS, 2023)

Mnemonist: Locating Model Parameters that Memorize Training Examples. - Ali Shahin Shamsabadi; Jamie Hayes; Borja Balle; Adrian Weller (UAI, 2023)

Extracting Training Data from Diffusion Models. - Nicholas Carlini; Jamie Hayes; Milad Nasr; Matthew Jagielski; Vikash Sehwag; Florian Tramèr; Borja Balle; Daphne Ippolito; Eric Wallace (USENIX Security Symposium, 2023)

Tight Auditing of Differentially Private Machine Learning. - Milad Nasr; Jamie Hayes; Thomas Steinke 002; Borja Balle; Florian Tramèr; Matthew Jagielski; Nicholas Carlini; Andreas Terzis (USENIX Security Symposium, 2023)

Differentially Private Diffusion Models Generate Useful Synthetic Images. - Sahra Ghalebikesabi; Leonard Berrada; Sven Gowal; Ira Ktena; Robert Stanforth; Jamie Hayes; Soham De; Samuel L. Smith; Olivia Wiles; Borja Balle (CoRR, 2023)

Bounding data reconstruction attacks with the hypothesis testing interpretation of differential privacy. - Georgios Kaissis; Jamie Hayes; Alexander Ziller; Daniel Rueckert (CoRR, 2023)

Unlocking Accuracy and Fairness in Differentially Private Image Classification. - Leonard Berrada; Soham De; Judy Hanwen Shen; Jamie Hayes; Robert Stanforth; David Stutz; Pushmeet Kohli; Samuel L. Smith; Borja Balle (CoRR, 2023)

Beyond the Calibration Point: Mechanism Comparison in Differential Privacy. - Georgios Kaissis; Stefan Kolek; Borja Balle; Jamie Hayes; Daniel Rueckert (ICML, 2024)

Beyond Slow Signs in High-fidelity Model Extraction. - Hanna Foerster; Robert D. Mullins; Ilia Shumailov; Jamie Hayes (NeurIPS, 2024)

Buffer Overflow in Mixture of Experts. - Jamie Hayes; Ilia Shumailov; Itay Yona (CoRR, 2024)

Are we making progress in unlearning? Findings from the first NeurIPS unlearning competition. - Eleni Triantafillou; Peter Kairouz; Fabian Pedregosa; Jamie Hayes; Meghdad Kurmanji; Kairan Zhao; Vincent Dumoulin; Júlio C. S. Jacques Júnior; Ioannis Mitliagkas; Jun Wan 001; Lisheng Sun-Hosoya; Sergio Escalera; et al. (CoRR, 2024)

Measuring memorization in RLHF for code completion. - Aneesh Pappu; Billy Porter; Ilia Shumailov; Jamie Hayes (CoRR, 2024)

UnUnlearning: Unlearning is not sufficient for content regulation in advanced generative AI. - Ilia Shumailov; Jamie Hayes; Eleni Triantafillou; Guillermo Ortiz-Jiménez; Nicolas Papernot; Matthew Jagielski; Itay Yona; Heidi Howard; Eugene Bagdasaryan (CoRR, 2024)

Measuring memorization through probabilistic discoverable extraction. - Jamie Hayes; Marika Swanberg; Harsh Chaudhari; Itay Yona; Ilia Shumailov (CoRR, 2024)

Stealing User Prompts from Mixture of Experts. - Itay Yona; Ilia Shumailov; Jamie Hayes; Nicholas Carlini (CoRR, 2024)

To Shuffle or not to Shuffle: Auditing DP-SGD with Shuffling. - Meenatchi Sundaram Muthu Selva Annamalai; Borja Balle; Emiliano De Cristofaro; Jamie Hayes (CoRR, 2024)

Machine Unlearning Doesn't Do What You Think: Lessons for Generative AI Policy, Research, and Practice. - A. Feder Cooper; Christopher A. Choquette-Choo; Miranda Bogen; Matthew Jagielski; Katja Filippova; Ken Ziyu Liu; Alexandra Chouldechova; Jamie Hayes; Yangsibo Huang; Niloofar Mireshghallah; Ilia Shumailov; Eleni Triantafillou; et al. (CoRR, 2024)

Scalable watermarking for identifying large language model outputs. - Sumanth Dathathri; Abigail See; Sumedh Ghaisas; Po-Sen Huang; Rob McAdam; Johannes Welbl; Vandana Bachani; Alex Kaskasoli; Robert Stanforth; Tatiana Matejovicova; Jamie Hayes; Nidhi Vyas; et al. (Nat., 2024)

Measuring memorization in RLHF for code completion. - Jamie Hayes; Ilia Shumailov; William P. Porter; Aneesh Pappu (ICLR, 2025)

The Last Iterate Advantage: Empirical Auditing and Principled Heuristic Analysis of Differentially Private SGD. - Milad Nasr; Thomas Steinke 002; Borja Balle; Christopher A. Choquette-Choo; Arun Ganesh; Matthew Jagielski; Jamie Hayes; Abhradeep Guha Thakurta; Adam Smith 006; Andreas Terzis (ICLR, 2025)

Measuring memorization in language models via probabilistic extraction. - Jamie Hayes; Marika Swanberg; Harsh Chaudhari; Itay Yona; Ilia Shumailov; Milad Nasr; Christopher A. Choquette-Choo; Katherine Lee; A. Feder Cooper (NAACL (Long Papers), 2025)

Locking Machine Learning Models into Hardware. - Eleanor Clifford; Adhithya Saravanan; Harry Langford; Cheng Zhang; Yiren Zhao; Robert D. Mullins; Ilia Shumailov; Jamie Hayes (SaTML, 2025)

Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacy. - Jamie Hayes; Ilia Shumailov; Eleni Triantafillou; Amr Khalifa; Nicolas Papernot (SaTML, 2025)

Interpreting the Repeated Token Phenomenon in Large Language Models. - Itay Yona; Ilia Shumailov; Jamie Hayes; Federico Barbero; Yossi Gandelsman (CoRR, 2025)

(ϵ, δ) Considered Harmful: Best Practices for Reporting Differential Privacy Guarantees. - Juan Felipe Gómez; Bogdan Kulynych; Georgios Kaissis; Jamie Hayes; Borja Balle; Antti Honkela (CoRR, 2025)

Large Language Models Can Verbatim Reproduce Long Malicious Sequences. - Sharon Lin; Krishnamurthy Dvijotham; Jamie Hayes; Chongyang Shi 003; Ilia Shumailov; Shuang Song 001 (CoRR, 2025)

Defeating Prompt Injections by Design. - Edoardo Debenedetti; Ilia Shumailov; Tianqi Fan; Jamie Hayes; Nicholas Carlini; Daniel Fabian; Christoph Kern; Chongyang Shi 003; Andreas Terzis; Florian Tramèr (CoRR, 2025)

Lessons from Defending Gemini Against Indirect Prompt Injections. - Chongyang Shi 003; Sharon Lin; Shuang Song 001; Jamie Hayes; Ilia Shumailov; Itay Yona; Juliette Pluto; Aneesh Pappu; Christopher A. Choquette-Choo; Milad Nasr; Chawin Sitawarin; Gena Gibson; et al. (CoRR, 2025)

Strong Membership Inference Attacks on Massive Datasets and (Moderately) Large Language Models. - Jamie Hayes; Ilia Shumailov; Christopher A. Choquette-Choo; Matthew Jagielski; Georgios Kaissis; Katherine Lee; Milad Nasr; Sahra Ghalebikesabi; Niloofar Mireshghallah; Meenatchi Sundaram Mutu Selva Annamalai; Igor Shilov; Matthieu Meeus; et al. (CoRR, 2025)

Cascading Adversarial Bias from Injection to Distillation in Language Models. - Harsh Chaudhari; Jamie Hayes; Matthew Jagielski; Ilia Shumailov; Milad Nasr; Alina Oprea (CoRR, 2025)

The Hitchhiker's Guide to Efficient, End-to-End, and Tight DP Auditing. - Meenatchi Sundaram Muthu Selva Annamalai; Borja Balle; Jamie Hayes; Georgios Kaissis; Emiliano De Cristofaro (CoRR, 2025)

Unifying Re-Identification, Attribute Inference, and Data Reconstruction Risks in Differential Privacy. - Bogdan Kulynych; Juan Felipe Gómez; Georgios Kaissis; Jamie Hayes; Borja Balle; Flávio P. Calmon; Jean Louis Raisaro (CoRR, 2025)

Beyond the Worst Case: Extending Differential Privacy Guarantees to Realistic Adversaries. - Marika Swanberg; Meenatchi Sundaram Muthu Selva Annamalai; Jamie Hayes; Borja Balle; Adam D. Smith 001 (CoRR, 2025)