GAME OF DECOYS: Optimal Decoy Routing Through Game Theory. - Milad Nasr; Amir Houmansadr (CCS, 2016)

Compressive Traffic Analysis: A New Paradigm for Scalable Traffic Analysis. - Milad Nasr; Amir Houmansadr; Arya Mazumdar (CCS, 2017)

The Waterfall of Liberty: Decoy Routing Circumvention that Resists Routing Attacks. - Milad Nasr; Hadi Zolfaghari; Amir Houmansadr (CCS, 2017)

Enemy At the Gateways: A Game Theoretic Approach to Proxy Distribution. - Milad Nasr; Sadegh Farhang; Amir Houmansadr; Jens Grossklags (CoRR, 2017)

DeepCorr: Strong Flow Correlation Attacks on Tor Using Deep Learning. - Milad Nasr; Alireza Bahramali; Amir Houmansadr (CCS, 2018)

Machine Learning with Membership Privacy using Adversarial Regularization. - Milad Nasr; Reza Shokri; Amir Houmansadr (CCS, 2018)

Comprehensive Privacy Analysis of Deep Learning: Stand-alone and Federated Learning under Passive and Active White-box Inference Attacks. - Milad Nasr; Reza Shokri; Amir Houmansadr (CoRR, 2018)

Enemy At the Gateways: Censorship-Resilient Proxy Distribution Using Game Theory. - Milad Nasr; Sadegh Farhang; Amir Houmansadr; Jens Grossklags (NDSS, 2019)

Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning. - Milad Nasr; Reza Shokri; Amir Houmansadr (IEEE Symposium on Security and Privacy, 2019)

Bidding strategies with gender nondiscrimination constraints for online ad auctions. - Milad Nasr; Michael Carl Tschantz (FAT*, 2020)

MassBrowser: Unblocking the Censored Web for the Masses, by the Masses. - Milad Nasr; Hadi Zolfaghari; Amir Houmansadr; Amirhossein Ghafari (NDSS, 2020)

Blind Adversarial Network Perturbations. - Milad Nasr; Alireza Bahramali; Amir Houmansadr (CoRR, 2020)

Improving Deep Learning with Differential Privacy using Gradient Encoding and Denoising. - Milad Nasr; Reza Shokri; Amir Houmansadr (CoRR, 2020)

Robust Adversarial Attacks Against DNN-Based Wireless Communication Systems. - Alireza Bahramali; Milad Nasr; Amir Houmansadr; Dennis Goeckel; Don Towsley (CCS, 2021)

Adversary Instantiation: Lower Bounds for Differentially Private Machine Learning. - Milad Nasr; Shuang Song 001; Abhradeep Thakurta; Nicolas Papernot; Nicholas Carlini (SP, 2021)

Defeating DNN-Based Traffic Analysis Systems in Real-Time With Blind Adversarial Perturbations. - Milad Nasr; Alireza Bahramali; Amir Houmansadr (USENIX Security Symposium, 2021)

Membership Inference Attacks From First Principles. - Nicholas Carlini; Steve Chien; Milad Nasr; Shuang Song 001; Andreas Terzis; Florian Tramèr (SP, 2022)

Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecture. - Xinyu Tang 003; Saeed Mahloujifar; Liwei Song; Virat Shejwalkar; Milad Nasr; Amir Houmansadr; Prateek Mittal (USENIX Security Symposium, 2022)

FEL: High Capacity Learning for Recommendation and Ranking via Federated Ensemble Learning. - Meisam Hejazinia; Dzmitry Huba; Ilias Leontiadis; Kiwan Maeng; Mani Malek 001; Luca Melis; Ilya Mironov; Milad Nasr; Kaikai Wang; Carole-Jean Wu (CoRR, 2022)

No Free Lunch in "Privacy for Free: How does Dataset Condensation Help Privacy". - Nicholas Carlini; Vitaly Feldman; Milad Nasr (CoRR, 2022)

Preventing Verbatim Memorization in Language Models Gives a False Sense of Privacy. - Daphne Ippolito; Florian Tramèr; Milad Nasr; Chiyuan Zhang; Matthew Jagielski; Katherine Lee; Christopher A. Choquette-Choo; Nicholas Carlini (CoRR, 2022)

Machine Learning with Differentially Private Labels: Mechanisms and Frameworks. - Xinyu Tang 003; Milad Nasr; Saeed Mahloujifar; Virat Shejwalkar; Liwei Song; Amir Houmansadr; Prateek Mittal (Proc. Priv. Enhancing Technol., 2022)

Why Is Public Pretraining Necessary for Private Model Training? - Arun Ganesh; Mahdi Haghifam; Milad Nasr; Sewoong Oh; Thomas Steinke 002; Om Thakkar 001; Abhradeep Guha Thakurta; Lun Wang 001 (ICML, 2023)

Effectively Using Public Data in Privacy Preserving Machine Learning. - Milad Nasr; Saeed Mahloujifar; Xinyu Tang 003; Prateek Mittal; Amir Houmansadr (ICML, 2023)

Reverse-Engineering Decoding Strategies Given Blackbox Access to a Language Generation System. - Daphne Ippolito; Nicholas Carlini; Katherine Lee; Milad Nasr; Yun William Yu (INLG, 2023)

Preventing Generation of Verbatim Memorization in Language Models Gives a False Sense of Privacy. - Daphne Ippolito; Florian Tramèr; Milad Nasr; Chiyuan Zhang; Matthew Jagielski; Katherine Lee; Christopher A. Choquette-Choo; Nicholas Carlini (INLG, 2023)

Privacy Auditing with One (1) Training Run. - Thomas Steinke 002; Milad Nasr; Matthew Jagielski (NeurIPS, 2023)

Are aligned neural networks adversarially aligned? - Nicholas Carlini; Milad Nasr; Christopher A. Choquette-Choo; Matthew Jagielski; Irena Gao; Pang Wei Koh; Daphne Ippolito; Florian Tramèr; Ludwig Schmidt (NeurIPS, 2023)

Students Parrot Their Teachers: Membership Inference on Model Distillation. - Matthew Jagielski; Milad Nasr; Katherine Lee; Christopher A. Choquette-Choo; Nicholas Carlini; Florian Tramèr (NeurIPS, 2023)

Extracting Training Data from Diffusion Models. - Nicholas Carlini; Jamie Hayes; Milad Nasr; Matthew Jagielski; Vikash Sehwag; Florian Tramèr; Borja Balle; Daphne Ippolito; Eric Wallace (USENIX Security Symposium, 2023)

Tight Auditing of Differentially Private Machine Learning. - Milad Nasr; Jamie Hayes; Thomas Steinke 002; Borja Balle; Florian Tramèr; Matthew Jagielski; Nicholas Carlini; Andreas Terzis (USENIX Security Symposium, 2023)

Students Parrot Their Teachers: Membership Inference on Model Distillation. - Matthew Jagielski; Milad Nasr; Christopher A. Choquette-Choo; Katherine Lee; Nicholas Carlini (CoRR, 2023)

Privacy-Preserving Recommender Systems with Synthetic Query Generation using Differentially Private Large Language Models. - Aldo Gael Carranza; Rezsa Farahani; Natalia Ponomareva 001; Alex Kurakin; Matthew Jagielski; Milad Nasr (CoRR, 2023)

Are aligned neural networks adversarially aligned? - Nicholas Carlini; Milad Nasr; Christopher A. Choquette-Choo; Matthew Jagielski; Irena Gao; Anas Awadalla; Pang Wei Koh; Daphne Ippolito; Katherine Lee; Florian Tramèr; Ludwig Schmidt (CoRR, 2023)

Report of the 1st Workshop on Generative AI and Law. - A. Feder Cooper; Katherine Lee; James Grimmelmann; Daphne Ippolito; Christopher Callison-Burch; Christopher A. Choquette-Choo; Niloofar Mireshghallah; Miles Brundage; David Mimno; Madiha Zahrah Choksi; Jack M. Balkin; Nicholas Carlini; et al. (CoRR, 2023)

Scalable Extraction of Training Data from (Production) Language Models. - Milad Nasr; Nicholas Carlini; Jonathan Hayase; Matthew Jagielski; A. Feder Cooper; Daphne Ippolito; Christopher A. Choquette-Choo; Eric Wallace; Florian Tramèr; Katherine Lee (CoRR, 2023)

Federated Ensemble Learning: Increasing the Capacity of Label Private Recommendation Systems. - Meisam Hejazinia; Dzmitry Huba; Ilias Leontiadis; Kiwan Maeng; Mani Malek 001; Luca Melis; Ilya Mironov; Milad Nasr; Kaikai Wang; Carole-Jean Wu (IEEE Data Eng. Bull., 2023)

Stealing part of a production language model. - Nicholas Carlini; Daniel Paleka; Krishnamurthy Dj Dvijotham; Thomas Steinke 002; Jonathan Hayase; A. Feder Cooper; Katherine Lee; Matthew Jagielski; Milad Nasr; Arthur Conmy; Eric Wallace; David Rolnick; et al. (ICML, 2024)

Auditing Private Prediction. - Karan Chadha; Matthew Jagielski; Nicolas Papernot; Christopher A. Choquette-Choo; Milad Nasr (ICML, 2024)

Synthetic Query Generation for Privacy-Preserving Deep Retrieval Systems using Differentially Private Language Models. - Aldo G. Carranza; Rezsa Farahani; Natalia Ponomareva 001; Alexey Kurakin; Matthew Jagielski; Milad Nasr (NAACL-HLT, 2024)

Query-Based Adversarial Prompt Generation. - Jonathan Hayase; Ema Borevkovic; Nicholas Carlini; Florian Tramèr; Milad Nasr (NeurIPS, 2024)

Privacy Side Channels in Machine Learning Systems. - Edoardo Debenedetti; Giorgio Severi; Milad Nasr; Christopher A. Choquette-Choo; Matthew Jagielski; Eric Wallace; Nicholas Carlini; Florian Tramèr (USENIX Security Symposium, 2024)

Phantom: General Trigger Attacks on Retrieval Augmented Language Generation. - Harsh Chaudhari; Giorgio Severi; John Abascal; Matthew Jagielski; Christopher A. Choquette-Choo; Milad Nasr; Cristina Nita-Rotaru; Alina Oprea (CoRR, 2024)

Avoiding Generative Model Writer's Block With Embedding Nudging. - Ali Zand; Milad Nasr (CoRR, 2024)

Remote Timing Attacks on Efficient Language Model Inference. - Nicholas Carlini; Milad Nasr (CoRR, 2024)

Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy. - Yangsibo Huang; Daogao Liu; Lynn Chua; Badih Ghazi; Pritish Kamath; Ravi Kumar 001; Pasin Manurangsi; Milad Nasr; Amer Sinha; Chiyuan Zhang (ICLR, 2025)

The Last Iterate Advantage: Empirical Auditing and Principled Heuristic Analysis of Differentially Private SGD. - Milad Nasr; Thomas Steinke 002; Borja Balle; Christopher A. Choquette-Choo; Arun Ganesh; Matthew Jagielski; Jamie Hayes; Abhradeep Guha Thakurta; Adam Smith 006; Andreas Terzis (ICLR, 2025)

Scalable Extraction of Training Data from Aligned, Production Language Models. - Milad Nasr; Javier Rando; Nicholas Carlini; Jonathan Hayase; Matthew Jagielski; A. Feder Cooper; Daphne Ippolito; Christopher A. Choquette-Choo; Florian Tramèr; Katherine Lee (ICLR, 2025)

Privacy Auditing of Large Language Models. - Ashwinee Panda; Xinyu Tang 003; Christopher A. Choquette-Choo; Milad Nasr; Prateek Mittal (ICLR, 2025)

On Evaluating the Durability of Safeguards for Open-Weight LLMs. - Xiangyu Qi; Boyi Wei; Nicholas Carlini; Yangsibo Huang; Tinghao Xie; Luxi He; Matthew Jagielski; Milad Nasr; Prateek Mittal; Peter Henderson 002 (ICLR, 2025)

Measuring memorization in language models via probabilistic extraction. - Jamie Hayes; Marika Swanberg; Harsh Chaudhari; Itay Yona; Ilia Shumailov; Milad Nasr; Christopher A. Choquette-Choo; Katherine Lee; A. Feder Cooper (NAACL (Long Papers), 2025)

SoK: Watermarking for AI-Generated Content. - Xuandong Zhao; Sam Gunn; Miranda Christ; Jaiden Fairoze; Andres Fabrega; Nicholas Carlini; Sanjam Garg; Sanghyun Hong 001; Milad Nasr; Florian Tramèr; Somesh Jha; Lei Li 005; et al. (SP, 2025)

Private Fine-tuning of Large Language Models with Zeroth-order Optimization. - Xinyu Tang 003; Ashwinee Panda; Milad Nasr; Saeed Mahloujifar; Prateek Mittal (Trans. Mach. Learn. Res., 2025)

Exploring and Mitigating Adversarial Manipulation of Voting-Based Leaderboards. - Yangsibo Huang; Milad Nasr; Anastasios Angelopoulos; Nicholas Carlini; Wei-Lin Chiang; Christopher A. Choquette-Choo; Daphne Ippolito; Matthew Jagielski; Katherine Lee; Ken Ziyu Liu; Ion Stoica; Florian Tramèr; et al. (CoRR, 2025)

AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defenses. - Nicholas Carlini; Javier Rando; Edoardo Debenedetti; Milad Nasr; Florian Tramèr (CoRR, 2025)

LLMs unlock new paths to monetizing exploits. - Nicholas Carlini; Milad Nasr; Edoardo Debenedetti; Barry Wang; Christopher A. Choquette-Choo; Daphne Ippolito; Florian Tramèr; Matthew Jagielski (CoRR, 2025)

Lessons from Defending Gemini Against Indirect Prompt Injections. - Chongyang Shi 003; Sharon Lin; Shuang Song 001; Jamie Hayes; Ilia Shumailov; Itay Yona; Juliette Pluto; Aneesh Pappu; Christopher A. Choquette-Choo; Milad Nasr; Chawin Sitawarin; Gena Gibson; et al. (CoRR, 2025)

Strong Membership Inference Attacks on Massive Datasets and (Moderately) Large Language Models. - Jamie Hayes; Ilia Shumailov; Christopher A. Choquette-Choo; Matthew Jagielski; Georgios Kaissis; Katherine Lee; Milad Nasr; Sahra Ghalebikesabi; Niloofar Mireshghallah; Meenatchi Sundaram Mutu Selva Annamalai; Igor Shilov; Matthieu Meeus; et al. (CoRR, 2025)

Cascading Adversarial Bias from Injection to Distillation in Language Models. - Harsh Chaudhari; Jamie Hayes; Matthew Jagielski; Ilia Shumailov; Milad Nasr; Alina Oprea (CoRR, 2025)

Hush! Protecting Secrets During Model Training: An Indistinguishability Approach. - Arun Ganesh; Brendan McMahan; Milad Nasr; Thomas Steinke 002; Abhradeep Thakurta (CoRR, 2025)