Evaluations of Machine Learning Privacy Defenses are Misleading. - Michael Aerni; Jie Zhang 107; Florian Tramèr (CCS, 2024)

Sampling to Distill: Knowledge Transfer from Open-World Data. - Yuzheng Wang; Zhaoyu Chen 001; Jie Zhang 107; Dingkang Yang; Zuhao Ge; Yang Liu 246; Siao Liu; Yunquan Sun; Wenqiang Zhang; Lizhe Qi (ACM Multimedia, 2024)

AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. - Edoardo Debenedetti; Jie Zhang 107; Mislav Balunovic; Luca Beurer-Kellner; Marc Fischer 002; Florian Tramèr (NeurIPS, 2024)

AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents. - Edoardo Debenedetti; Jie Zhang 107; Mislav Balunovic; Luca Beurer-Kellner; Marc Fischer 002; Florian Tramèr (CoRR, 2024)

Blind Baselines Beat Membership Inference Attacks for Foundation Models. - Debeshee Das; Jie Zhang 107; Florian Tramèr (CoRR, 2024)

Membership Inference Attacks Cannot Prove that a Model Was Trained On Your Data. - Jie Zhang 107; Debeshee Das; Gautam Kamath 001; Florian Tramèr (CoRR, 2024)

Gradient Masking All-at-Once: Ensemble Everything Everywhere Is Not Robust. - Jie Zhang 107; Kristina Nikolic; Nicholas Carlini; Florian Tramèr (CoRR, 2024)

Position: Membership Inference Attacks Cannot Prove That a Model was Trained on Your Data. - Jie Zhang 107; Debeshee Das; Gautam Kamath 001; Florian Tramèr (SaTML, 2025)

Membership Inference Attacks on Sequence Models. - Lorenzo Rossi; Michael Aerni; Jie Zhang 107; Florian Tramèr (SP (Workshops), 2025)

Adversarial ML Problems Are Getting Harder to Solve and to Evaluate. - Javier Rando; Jie Zhang 107; Nicholas Carlini; Florian Tramèr (CoRR, 2025)

The Jailbreak Tax: How Useful are Your Jailbreak Outputs? - Kristina Nikolic; Luze Sun; Jie Zhang 107; Florian Tramèr (CoRR, 2025)

RealMath: A Continuous Benchmark for Evaluating Language Models on Research-Level Mathematics. - Jie Zhang 107; Cezara Petrui; Kristina Nikolic; Florian Tramèr (CoRR, 2025)