Network and system level security in connected vehicle applications. - Hengyi Liang; Matthew Jagielski; Bowen Zheng 001; Chung-Wei Lin; Eunsuk Kang; Shinichi Shiraishi; Cristina Nita-Rotaru; Qi Zhu 002 (ICCAD, 2018)

Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning. - Matthew Jagielski; Alina Oprea; Battista Biggio; Chang Liu 021; Cristina Nita-Rotaru; Bo Li 026 (IEEE Symposium on Security and Privacy, 2018)

Threat Detection for Collaborative Adaptive Cruise Control in Connected Cars. - Matthew Jagielski; Nicholas Jones; Chung-Wei Lin; Cristina Nita-Rotaru; Shinichi Shiraishi (WISEC, 2018)

On the Intriguing Connections of Regularization, Input Gradients and Transferability of Evasion and Poisoning Attacks. - Ambra Demontis; Marco Melis; Maura Pintor; Matthew Jagielski; Battista Biggio; Alina Oprea; Cristina Nita-Rotaru; Fabio Roli (CoRR, 2018)

Differentially Private Fair Learning. - Matthew Jagielski; Michael J. Kearns; Jieming Mao; Alina Oprea; Aaron Roth 001; Saeed Sharifi-Malvajerdi; Jonathan R. Ullman (ICML, 2019)

Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attacks. - Ambra Demontis; Marco Melis; Maura Pintor; Matthew Jagielski; Battista Biggio; Alina Oprea; Cristina Nita-Rotaru; Fabio Roli (USENIX Security Symposium, 2019)

High-Fidelity Extraction of Neural Network Models. - Matthew Jagielski; Nicholas Carlini; David Berthelot; Alex Kurakin; Nicolas Papernot (CoRR, 2019)

Secure Communication Channel Establishment: TLS 1.3 (over TCP Fast Open) vs. QUIC. - Shan Chen; Samuel Jero; Matthew Jagielski; Alexandra Boldyreva; Cristina Nita-Rotaru (IACR Cryptol. ePrint Arch., 2019)

Cryptanalytic Extraction of Neural Network Models. - Nicholas Carlini; Matthew Jagielski; Ilya Mironov (CRYPTO (3), 2020)

Auditing Differentially Private Machine Learning: How Private is Private SGD? - Matthew Jagielski; Jonathan R. Ullman; Alina Oprea (NeurIPS, 2020)

High Accuracy and High Fidelity Extraction of Neural Networks. - Matthew Jagielski; Nicholas Carlini; David Berthelot; Alex Kurakin; Nicolas Papernot (USENIX Security Symposium, 2020)

Subpopulation Data Poisoning Attacks. - Matthew Jagielski; Giorgio Severi; Niklas Pousette Harger; Alina Oprea (CCS, 2021)

Extracting Training Data from Large Language Models. - Nicholas Carlini; Florian Tramèr; Eric Wallace; Matthew Jagielski; Ariel Herbert-Voss; Katherine Lee; Adam Roberts; Tom B. Brown; Dawn Song; Úlfar Erlingsson; Alina Oprea; Colin Raffel (USENIX Security Symposium, 2021)

Secure Communication Channel Establishment: TLS 1.3 (over TCP Fast Open) versus QUIC. - Shan Chen; Samuel Jero; Matthew Jagielski; Alexandra Boldyreva; Cristina Nita-Rotaru (J. Cryptol., 2021)

Truth Serum: Poisoning Machine Learning Models to Reveal Their Secrets. - Florian Tramèr; Reza Shokri; Ayrton San Joaquin; Hoang Le; Matthew Jagielski; Sanghyun Hong 001; Nicholas Carlini (CCS, 2022)

Network-Level Adversaries in Federated Learning. - Giorgio Severi; Matthew Jagielski; Gökberk Yar; Yuxuan Wang; Alina Oprea; Cristina Nita-Rotaru (CNS, 2022)

Subverting Fair Image Search with Generative Adversarial Perturbations. - Avijit Ghosh; Matthew Jagielski; Christo Wilson (FAccT, 2022)

The Privacy Onion Effect: Memorization is Relative. - Nicholas Carlini; Matthew Jagielski; Chiyuan Zhang; Nicolas Papernot; Andreas Terzis; Florian Tramèr (NeurIPS, 2022)

Debugging Differential Privacy: A Case Study for Privacy Auditing. - Florian Tramèr; Andreas Terzis; Thomas Steinke 002; Shuang Song 001; Matthew Jagielski; Nicholas Carlini (CoRR, 2022)

How to Combine Membership-Inference Attacks on Multiple Updated Models. - Matthew Jagielski; Stanley Wu; Alina Oprea; Jonathan R. Ullman; Roxana Geambasu (CoRR, 2022)

Preventing Verbatim Memorization in Language Models Gives a False Sense of Privacy. - Daphne Ippolito; Florian Tramèr; Milad Nasr; Chiyuan Zhang; Matthew Jagielski; Katherine Lee; Christopher A. Choquette-Choo; Nicholas Carlini (CoRR, 2022)

SafeNet: Mitigating Data Poisoning Attacks on Private Machine Learning. - Harsh Chaudhari; Matthew Jagielski; Alina Oprea (IACR Cryptol. ePrint Arch., 2022)

Quantifying Memorization Across Neural Language Models. - Nicholas Carlini; Daphne Ippolito; Matthew Jagielski; Katherine Lee; Florian Tramèr; Chiyuan Zhang (ICLR, 2023)

Measuring Forgetting of Memorized Training Examples. - Matthew Jagielski; Om Thakkar 001; Florian Tramèr; Daphne Ippolito; Katherine Lee; Nicholas Carlini; Eric Wallace; Shuang Song 001; Abhradeep Guha Thakurta; Nicolas Papernot; Chiyuan Zhang (ICLR, 2023)

Preventing Generation of Verbatim Memorization in Language Models Gives a False Sense of Privacy. - Daphne Ippolito; Florian Tramèr; Milad Nasr; Chiyuan Zhang; Matthew Jagielski; Katherine Lee; Christopher A. Choquette-Choo; Nicholas Carlini (INLG, 2023)

Privacy Auditing with One (1) Training Run. - Thomas Steinke 002; Milad Nasr; Matthew Jagielski (NeurIPS, 2023)

Are aligned neural networks adversarially aligned? - Nicholas Carlini; Milad Nasr; Christopher A. Choquette-Choo; Matthew Jagielski; Irena Gao; Pang Wei Koh; Daphne Ippolito; Florian Tramèr; Ludwig Schmidt (NeurIPS, 2023)

Students Parrot Their Teachers: Membership Inference on Model Distillation. - Matthew Jagielski; Milad Nasr; Katherine Lee; Christopher A. Choquette-Choo; Nicholas Carlini; Florian Tramèr (NeurIPS, 2023)

Counterfactual Memorization in Neural Language Models. - Chiyuan Zhang; Daphne Ippolito; Katherine Lee; Matthew Jagielski; Florian Tramèr; Nicholas Carlini (NeurIPS, 2023)

SafeNet: The Unreasonable Effectiveness of Ensembles in Private Collaborative Learning. - Harsh Chaudhari; Matthew Jagielski; Alina Oprea (SaTML, 2023)

SNAP: Efficient Extraction of Private Properties with Poisoning. - Harsh Chaudhari; John Abascal; Alina Oprea; Matthew Jagielski; Florian Tramèr; Jonathan R. Ullman (SP, 2023)

Extracting Training Data from Diffusion Models. - Nicholas Carlini; Jamie Hayes; Milad Nasr; Matthew Jagielski; Vikash Sehwag; Florian Tramèr; Borja Balle; Daphne Ippolito; Eric Wallace (USENIX Security Symposium, 2023)

Tight Auditing of Differentially Private Machine Learning. - Milad Nasr; Jamie Hayes; Thomas Steinke 002; Borja Balle; Florian Tramèr; Matthew Jagielski; Nicholas Carlini; Andreas Terzis (USENIX Security Symposium, 2023)

Randomness in ML Defenses Helps Persistent Attackers and Hinders Evaluators. - Keane Lucas; Matthew Jagielski; Florian Tramèr; Lujo Bauer; Nicholas Carlini (CoRR, 2023)

Students Parrot Their Teachers: Membership Inference on Model Distillation. - Matthew Jagielski; Milad Nasr; Christopher A. Choquette-Choo; Katherine Lee; Nicholas Carlini (CoRR, 2023)

Challenges towards the Next Frontier in Privacy. - Rachel Cummings; Damien Desfontaines; David Evans 001; Roxana Geambasu; Matthew Jagielski; Yangsibo Huang; Peter Kairouz; Gautam Kamath 001; Sewoong Oh; Olga Ohrimenko; Nicolas Papernot; Ryan Rogers 002; et al. (CoRR, 2023)

Privacy-Preserving Recommender Systems with Synthetic Query Generation using Differentially Private Large Language Models. - Aldo Gael Carranza; Rezsa Farahani; Natalia Ponomareva 001; Alex Kurakin; Matthew Jagielski; Milad Nasr (CoRR, 2023)

A Note On Interpreting Canary Exposure. - Matthew Jagielski (CoRR, 2023)

Are aligned neural networks adversarially aligned? - Nicholas Carlini; Milad Nasr; Christopher A. Choquette-Choo; Matthew Jagielski; Irena Gao; Anas Awadalla; Pang Wei Koh; Daphne Ippolito; Katherine Lee; Florian Tramèr; Ludwig Schmidt (CoRR, 2023)

Backdoor Attacks for In-Context Learning with Language Models. - Nikhil Kandpal; Matthew Jagielski; Florian Tramèr; Nicholas Carlini (CoRR, 2023)

Scalable Extraction of Training Data from (Production) Language Models. - Milad Nasr; Nicholas Carlini; Jonathan Hayase; Matthew Jagielski; A. Feder Cooper; Daphne Ippolito; Christopher A. Choquette-Choo; Eric Wallace; Florian Tramèr; Katherine Lee (CoRR, 2023)

How to Combine Membership-Inference Attacks on Multiple Updated Machine Learning Models. - Matthew Jagielski; Stanley Wu; Alina Oprea; Jonathan R. Ullman; Roxana Geambasu (Proc. Priv. Enhancing Technol., 2023)

AISec '24: 17th ACM Workshop on Artificial Intelligence and Security. - Maura Pintor; Matthew Jagielski; Xinyun Chen (CCS, 2024)

Noise Masking Attacks and Defenses for Pretrained Speech Models. - Matthew Jagielski; Om Thakkar 001; Lun Wang 001 (ICASSP, 2024)

Stealing part of a production language model. - Nicholas Carlini; Daniel Paleka; Krishnamurthy Dj Dvijotham; Thomas Steinke 002; Jonathan Hayase; A. Feder Cooper; Katherine Lee; Matthew Jagielski; Milad Nasr; Arthur Conmy; Eric Wallace; David Rolnick; et al. (ICML, 2024)

Auditing Private Prediction. - Karan Chadha; Matthew Jagielski; Nicolas Papernot; Christopher A. Choquette-Choo; Milad Nasr (ICML, 2024)

Synthetic Query Generation for Privacy-Preserving Deep Retrieval Systems using Differentially Private Language Models. - Aldo G. Carranza; Rezsa Farahani; Natalia Ponomareva 001; Alexey Kurakin; Matthew Jagielski; Milad Nasr (NAACL-HLT, 2024)

Poisoning Web-Scale Training Datasets is Practical. - Nicholas Carlini; Matthew Jagielski; Christopher A. Choquette-Choo; Daniel Paleka; Will Pearce; Hyrum S. Anderson; Andreas Terzis; Kurt Thomas; Florian Tramèr (SP, 2024)

Privacy Side Channels in Machine Learning Systems. - Edoardo Debenedetti; Giorgio Severi; Milad Nasr; Christopher A. Choquette-Choo; Matthew Jagielski; Eric Wallace; Nicholas Carlini; Florian Tramèr (USENIX Security Symposium, 2024)

Phantom: General Trigger Attacks on Retrieval Augmented Language Generation. - Harsh Chaudhari; Giorgio Severi; John Abascal; Matthew Jagielski; Christopher A. Choquette-Choo; Milad Nasr; Cristina Nita-Rotaru; Alina Oprea (CoRR, 2024)

Beyond the Mean: Differentially Private Prototypes for Private Transfer Learning. - Dariush Wahdany; Matthew Jagielski; Adam Dziedzic; Franziska Boenisch (CoRR, 2024)

UnUnlearning: Unlearning is not sufficient for content regulation in advanced generative AI. - Ilia Shumailov; Jamie Hayes; Eleni Triantafillou; Guillermo Ortiz-Jiménez; Nicolas Papernot; Matthew Jagielski; Itay Yona; Heidi Howard; Eugene Bagdasaryan (CoRR, 2024)

Machine Unlearning Doesn't Do What You Think: Lessons for Generative AI Policy, Research, and Practice. - A. Feder Cooper; Christopher A. Choquette-Choo; Miranda Bogen; Matthew Jagielski; Katja Filippova; Ken Ziyu Liu; Alexandra Chouldechova; Jamie Hayes; Yangsibo Huang; Niloofar Mireshghallah; Ilia Shumailov; Eleni Triantafillou; et al. (CoRR, 2024)

Differentially Private Prototypes for Imbalanced Transfer Learning. - Dariush Wahdany; Matthew Jagielski; Adam Dziedzic; Franziska Boenisch (AAAI, 2025)

Privacy Ripple Effects from Adding or Removing Personal Information in Language Model Training. - Jaydeep Borkar; Matthew Jagielski; Katherine Lee; Niloofar Mireshghallah; David A. Smith; Christopher A. Choquette-Choo (ACL (Findings), 2025)

The Last Iterate Advantage: Empirical Auditing and Principled Heuristic Analysis of Differentially Private SGD. - Milad Nasr; Thomas Steinke 002; Borja Balle; Christopher A. Choquette-Choo; Arun Ganesh; Matthew Jagielski; Jamie Hayes; Abhradeep Guha Thakurta; Adam Smith 006; Andreas Terzis (ICLR, 2025)

Scalable Extraction of Training Data from Aligned, Production Language Models. - Milad Nasr; Javier Rando; Nicholas Carlini; Jonathan Hayase; Matthew Jagielski; A. Feder Cooper; Daphne Ippolito; Christopher A. Choquette-Choo; Florian Tramèr; Katherine Lee (ICLR, 2025)

On Evaluating the Durability of Safeguards for Open-Weight LLMs. - Xiangyu Qi; Boyi Wei; Nicholas Carlini; Yangsibo Huang; Tinghao Xie; Luxi He; Matthew Jagielski; Milad Nasr; Prateek Mittal; Peter Henderson 002 (ICLR, 2025)

Covert Attacks on Machine Learning Training in Passively Secure MPC. - Matthew Jagielski; Rahul Rachuri; Daniel Escudero 001; Peter Scholl (IACR Cryptol. ePrint Arch., 2025)

Exploring and Mitigating Adversarial Manipulation of Voting-Based Leaderboards. - Yangsibo Huang; Milad Nasr; Anastasios Angelopoulos; Nicholas Carlini; Wei-Lin Chiang; Christopher A. Choquette-Choo; Daphne Ippolito; Matthew Jagielski; Katherine Lee; Ken Ziyu Liu; Ion Stoica; Florian Tramèr; et al. (CoRR, 2025)

Language Models May Verbatim Complete Text They Were Not Explicitly Trained On. - Ken Ziyu Liu; Christopher A. Choquette-Choo; Matthew Jagielski; Peter Kairouz; Sanmi Koyejo; Percy Liang; Nicolas Papernot (CoRR, 2025)

LLMs unlock new paths to monetizing exploits. - Nicholas Carlini; Milad Nasr; Edoardo Debenedetti; Barry Wang; Christopher A. Choquette-Choo; Daphne Ippolito; Florian Tramèr; Matthew Jagielski (CoRR, 2025)

Strong Membership Inference Attacks on Massive Datasets and (Moderately) Large Language Models. - Jamie Hayes; Ilia Shumailov; Christopher A. Choquette-Choo; Matthew Jagielski; Georgios Kaissis; Katherine Lee; Milad Nasr; Sahra Ghalebikesabi; Niloofar Mireshghallah; Meenatchi Sundaram Mutu Selva Annamalai; Igor Shilov; Matthieu Meeus; et al. (CoRR, 2025)

Cascading Adversarial Bias from Injection to Distillation in Language Models. - Harsh Chaudhari; Jamie Hayes; Matthew Jagielski; Ilia Shumailov; Milad Nasr; Alina Oprea (CoRR, 2025)

Black-Box Privacy Attacks on Shared Representations in Multitask Learning. - John Abascal; Nicolás Berrios; Alina Oprea; Jonathan R. Ullman; Adam Smith 006; Matthew Jagielski (CoRR, 2025)

SoK: Data Minimization in Machine Learning. - Robin Staab; Nikola Jovanovic 001; Kimberly Mai; Prakhar Ganesh; Martin T. Vechev; Ferdinando Fioretto; Matthew Jagielski (CoRR, 2025)