An Evaluation of the Google Chrome Extension Security Architecture. - Nicholas Carlini; Adrienne Porter Felt; David A. Wagner 001 (USENIX Security Symposium, 2012)

Operator-Assisted Tabulation of Optical Scan Ballots. - Kai Wang 059; Nicholas Carlini; Eric Kim; Ivan Motyashov; Daniel Nguyen; David A. Wagner 001 (EVT/WOTE, 2012)

Improved Support for Machine-assisted Ballot-level Audits. - Eric Kim; Nicholas Carlini; Andrew Chang; George Yiu; Kai Wang 059; David A. Wagner 001 (EVT/WOTE, 2013)

ROP is Still Dangerous: Breaking Modern Defenses. - Nicholas Carlini; David A. Wagner 001 (USENIX Security Symposium, 2014)

Control-Flow Bending: On the Effectiveness of Control-Flow Integrity. - Nicholas Carlini; Antonio Barresi; Mathias Payer; David A. Wagner 001; Thomas R. Gross (USENIX Security Symposium, 2015)

Hidden Voice Commands. - Nicholas Carlini; Pratyush Mishra; Tavish Vaidya; Yuankai Zhang 001; Micah Sherr; Clay Shields; David A. Wagner 001; Wenchao Zhou (USENIX Security Symposium, 2016)

Defensive Distillation is Not Robust to Adversarial Examples. - Nicholas Carlini; David A. Wagner 001 (CoRR, 2016)

Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods. - Nicholas Carlini; David A. Wagner 001 (AISec@CCS, 2017)

Towards Evaluating the Robustness of Neural Networks. - Nicholas Carlini; David A. Wagner 001 (IEEE Symposium on Security and Privacy, 2017)

Adversarial Example Defense: Ensembles of Weak Defenses are not Strong. - Warren He; James Wei; Xinyun Chen; Nicholas Carlini; Dawn Song (WOOT, 2017)

Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong. - Warren He; James Wei; Xinyun Chen; Nicholas Carlini; Dawn Song (CoRR, 2017)

Ground-Truth Adversarial Examples. - Nicholas Carlini; Guy Katz; Clark W. Barrett; David L. Dill (CoRR, 2017)

MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples. - Nicholas Carlini; David A. Wagner 001 (CoRR, 2017)

Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples. - Anish Athalye; Nicholas Carlini; David A. Wagner 001 (ICML, 2018)

Audio Adversarial Examples: Targeted Attacks on Speech-to-Text. - Nicholas Carlini; David A. Wagner 001 (IEEE Symposium on Security and Privacy Workshops, 2018)

The Secret Sharer: Measuring Unintended Neural Network Memorization & Extracting Secrets. - Nicholas Carlini; Chang Liu 021; Jernej Kos; Úlfar Erlingsson; Dawn Song (CoRR, 2018)

On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses. - Anish Athalye; Nicholas Carlini (CoRR, 2018)

Unrestricted Adversarial Examples. - Tom B. Brown; Nicholas Carlini; Chiyuan Zhang; Catherine Olsson; Paul F. Christiano; Ian J. Goodfellow (CoRR, 2018)

Evaluation and Design of Robust Neural Network Defenses. - Nicholas Carlini (2018)

AISec'19: 12th ACM Workshop on Artificial Intelligence and Security. - Sadia Afroz 001; Battista Biggio; Nicholas Carlini; Yuval Elovici; Asaf Shabtai (CCS, 2019)

Adversarial Examples Are a Natural Consequence of Test Error in Noise. - Justin Gilmer; Nicolas Ford; Nicholas Carlini; Ekin D. Cubuk (ICML, 2019)

Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition. - Yao Qin 001; Nicholas Carlini; Garrison W. Cottrell; Ian J. Goodfellow; Colin Raffel (ICML, 2019)

MixMatch: A Holistic Approach to Semi-Supervised Learning. - David Berthelot; Nicholas Carlini; Ian J. Goodfellow; Nicolas Papernot; Avital Oliver; Colin Raffel (NeurIPS, 2019)

The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks. - Nicholas Carlini; Chang Liu 021; Úlfar Erlingsson; Jernej Kos; Dawn Song (USENIX Security Symposium, 2019)

Is AmI (Attacks Meet Interpretability) Robust to Adversarial Examples? - Nicholas Carlini (CoRR, 2019)

On Evaluating Adversarial Robustness. - Nicholas Carlini; Anish Athalye; Nicolas Papernot; Wieland Brendel; Jonas Rauber; Dimitris Tsipras; Ian J. Goodfellow; Aleksander Madry; Alexey Kurakin (CoRR, 2019)

Exploiting Excessive Invariance caused by Norm-Bounded Adversarial Robustness. - Jörn-Henrik Jacobsen; Jens Behrmann; Nicholas Carlini; Florian Tramèr; Nicolas Papernot (CoRR, 2019)

SysML: The New Frontier of Machine Learning Systems. - Alexander Ratner; Dan Alistarh; Gustavo Alonso; David G. Andersen; Peter Bailis; Sarah Bird; Nicholas Carlini; Bryan Catanzaro; Eric S. Chung; Bill Dally; Jeff Dean; Inderjit S. Dhillon; et al. (CoRR, 2019)

A critique of the DeepSec Platform for Security Analysis of Deep Learning Models. - Nicholas Carlini (CoRR, 2019)

Stateful Detection of Black-Box Adversarial Attacks. - Steven Chen; Nicholas Carlini; David A. Wagner 001 (CoRR, 2019)

High-Fidelity Extraction of Neural Network Models. - Matthew Jagielski; Nicholas Carlini; David Berthelot; Alex Kurakin; Nicolas Papernot (CoRR, 2019)

Distribution Density, Tails, and Outliers in Machine Learning: Metrics and Applications. - Nicholas Carlini; Úlfar Erlingsson; Nicolas Papernot (CoRR, 2019)

ReMixMatch: Semi-Supervised Learning with Distribution Alignment and Augmentation Anchoring. - David Berthelot; Nicholas Carlini; Ekin D. Cubuk; Alex Kurakin; Kihyuk Sohn; Han Zhang 010; Colin Raffel (CoRR, 2019)

AISec'20: 13th Workshop on Artificial Intelligence and Security. - Sadia Afroz 001; Nicholas Carlini; Ambra Demontis (CCS, 2020)

Cryptanalytic Extraction of Neural Network Models. - Nicholas Carlini; Matthew Jagielski; Ilya Mironov (CRYPTO (3), 2020)

Evading Deepfake-Image Detectors with White- and Black-Box Attacks. - Nicholas Carlini; Hany Farid (CVPR Workshops, 2020)

ReMixMatch: Semi-Supervised Learning with Distribution Matching and Augmentation Anchoring. - David Berthelot; Nicholas Carlini; Ekin D. Cubuk; Alex Kurakin; Kihyuk Sohn; Han Zhang 010; Colin Raffel (ICLR, 2020)

Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations. - Florian Tramèr; Jens Behrmann; Nicholas Carlini; Nicolas Papernot; Jörn-Henrik Jacobsen (ICML, 2020)

FixMatch: Simplifying Semi-Supervised Learning with Consistency and Confidence. - Kihyuk Sohn; David Berthelot; Nicholas Carlini; Zizhao Zhang; Han Zhang 010; Colin Raffel; Ekin Dogus Cubuk; Alexey Kurakin; Chun-Liang Li (NeurIPS, 2020)

Measuring Robustness to Natural Distribution Shifts in Image Classification. - Rohan Taori; Achal Dave; Vaishaal Shankar; Nicholas Carlini; Benjamin Recht; Ludwig Schmidt (NeurIPS, 2020)

On Adaptive Attacks to Adversarial Example Defenses. - Florian Tramèr; Nicholas Carlini; Wieland Brendel; Aleksander Madry (NeurIPS, 2020)

High Accuracy and High Fidelity Extraction of Neural Networks. - Matthew Jagielski; Nicholas Carlini; David Berthelot; Alex Kurakin; Nicolas Papernot (USENIX Security Symposium, 2020)

A Partial Break of the Honeypots Defense to Catch Adversarial Attacks. - Nicholas Carlini (CoRR, 2020)

Erratum Concerning the Obfuscated Gradients Attack on Stochastic Activation Pruning. - Guneet S. Dhillon; Nicholas Carlini (CoRR, 2020)

An Attack on InstaHide: Is Private Learning Possible with Instance Encoding? - Nicholas Carlini; Samuel Deng; Sanjam Garg; Somesh Jha; Saeed Mahloujifar; Mohammad Mahmoody; Shuang Song 001; Abhradeep Thakurta; Florian Tramèr (CoRR, 2020)

Session details: Session 1: Adversarial Machine Learning. - Nicholas Carlini (AISec@CCS, 2021)

Session details: Session 2A: Machine Learning for Cybersecurity. - Nicholas Carlini (AISec@CCS, 2021)

Label-Only Membership Inference Attacks. - Christopher A. Choquette-Choo; Florian Tramèr; Nicholas Carlini; Nicolas Papernot (ICML, 2021)

How Private is Machine Learning? - Nicholas Carlini (IH&MMSec, 2021)

Is Private Learning Possible with Instance Encoding? - Nicholas Carlini; Samuel Deng; Sanjam Garg; Somesh Jha; Saeed Mahloujifar; Mohammad Mahmoody; Abhradeep Thakurta; Florian Tramèr (SP, 2021)

Adversary Instantiation: Lower Bounds for Differentially Private Machine Learning. - Milad Nasr; Shuang Song 001; Abhradeep Thakurta; Nicolas Papernot; Nicholas Carlini (SP, 2021)

Poisoning the Unlabeled Dataset of Semi-Supervised Learning. - Nicholas Carlini (USENIX Security Symposium, 2021)

Extracting Training Data from Large Language Models. - Nicholas Carlini; Florian Tramèr; Eric Wallace; Matthew Jagielski; Ariel Herbert-Voss; Katherine Lee; Adam Roberts; Tom B. Brown; Dawn Song; Úlfar Erlingsson; Alina Oprea; Colin Raffel (USENIX Security Symposium, 2021)

Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples. - Maura Pintor; Luca Demetrio; Angelo Sotgiu; Giovanni Manca; Ambra Demontis; Nicholas Carlini; Battista Biggio; Fabio Roli (CoRR, 2021)

NeuraCrypt is not private. - Nicholas Carlini; Sanjam Garg; Somesh Jha; Saeed Mahloujifar; Mohammad Mahmoody; Florian Tramèr (CoRR, 2021)

Unsolved Problems in ML Safety. - Dan Hendrycks; Nicholas Carlini; John Schulman; Jacob Steinhardt (CoRR, 2021)

Deduplicating Training Data Makes Language Models Better. - Katherine Lee; Daphne Ippolito; Andrew Nystrom; Chiyuan Zhang; Douglas Eck; Chris Callison-Burch; Nicholas Carlini (ACL (1), 2022)

Truth Serum: Poisoning Machine Learning Models to Reveal Their Secrets. - Florian Tramèr; Reza Shokri; Ayrton San Joaquin; Hoang Le; Matthew Jagielski; Sanghyun Hong 001; Nicholas Carlini (CCS, 2022)

AdaMatch: A Unified Approach to Semi-Supervised Learning and Domain Adaptation. - David Berthelot; Rebecca Roelofs; Kihyuk Sohn; Nicholas Carlini; Alexey Kurakin (ICLR, 2022)

Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent. - Oliver Bryniarski; Nabeel Hingun; Pedro Pachuca; Vincent Wang 002; Nicholas Carlini (ICLR, 2022)

Poisoning and Backdooring Contrastive Learning. - Nicholas Carlini; Andreas Terzis (ICLR, 2022)

Data Poisoning Won't Save You From Facial Recognition. - Evani Radiya-Dixit; Sanghyun Hong 001; Nicholas Carlini; Florian Tramèr (ICLR, 2022)

Handcrafted Backdoors in Deep Neural Networks. - Sanghyun Hong 001; Nicholas Carlini; Alexey Kurakin (NeurIPS, 2022)

The Privacy Onion Effect: Memorization is Relative. - Nicholas Carlini; Matthew Jagielski; Chiyuan Zhang; Nicolas Papernot; Andreas Terzis; Florian Tramèr (NeurIPS, 2022)

Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples. - Maura Pintor; Luca Demetrio; Angelo Sotgiu; Ambra Demontis; Nicholas Carlini; Battista Biggio; Fabio Roli (NeurIPS, 2022)

Increasing Confidence in Adversarial Robustness Evaluations. - Roland S. Zimmermann; Wieland Brendel; Florian Tramèr; Nicholas Carlini (NeurIPS, 2022)

Membership Inference Attacks From First Principles. - Nicholas Carlini; Steve Chien; Milad Nasr; Shuang Song 001; Andreas Terzis; Florian Tramèr (SP, 2022)

Debugging Differential Privacy: A Case Study for Privacy Auditing. - Florian Tramèr; Andreas Terzis; Thomas Steinke 002; Shuang Song 001; Matthew Jagielski; Nicholas Carlini (CoRR, 2022)

(Certified!!) Adversarial Robustness for Free! - Nicholas Carlini; Florian Tramèr; Krishnamurthy Dvijotham; J. Zico Kolter (CoRR, 2022)

No Free Lunch in "Privacy for Free: How does Dataset Condensation Help Privacy". - Nicholas Carlini; Vitaly Feldman; Milad Nasr (CoRR, 2022)

Preventing Verbatim Memorization in Language Models Gives a False Sense of Privacy. - Daphne Ippolito; Florian Tramèr; Milad Nasr; Chiyuan Zhang; Matthew Jagielski; Katherine Lee; Christopher A. Choquette-Choo; Nicholas Carlini (CoRR, 2022)

Considerations for Differentially Private Learning with Large-Scale Public Pretraining. - Florian Tramèr; Gautam Kamath 001; Nicholas Carlini (CoRR, 2022)

Security of Machine Learning (Dagstuhl Seminar 22281). - Battista Biggio; Nicholas Carlini; Pavel Laskov; Konrad Rieck; Antonio Emanuele Cinà (Dagstuhl Reports, 2022)

Quantifying Memorization Across Neural Language Models. - Nicholas Carlini; Daphne Ippolito; Matthew Jagielski; Katherine Lee; Florian Tramèr; Chiyuan Zhang (ICLR, 2023)

(Certified!!) Adversarial Robustness for Free! - Nicholas Carlini; Florian Tramèr; Krishnamurthy (Dj) Dvijotham; Leslie Rice; Mingjie Sun; J. Zico Kolter (ICLR, 2023)

Measuring Forgetting of Memorized Training Examples. - Matthew Jagielski; Om Thakkar 001; Florian Tramèr; Daphne Ippolito; Katherine Lee; Nicholas Carlini; Eric Wallace; Shuang Song 001; Abhradeep Guha Thakurta; Nicolas Papernot; Chiyuan Zhang (ICLR, 2023)

Part-Based Models Improve Adversarial Robustness. - Chawin Sitawarin; Kornrapat Pongmala; Yizheng Chen 001; Nicholas Carlini; David A. Wagner 001 (ICLR, 2023)

Preprocessors Matter! Realistic Decision-Based Attacks on Machine Learning Systems. - Chawin Sitawarin; Florian Tramèr; Nicholas Carlini (ICML, 2023)

Reverse-Engineering Decoding Strategies Given Blackbox Access to a Language Generation System. - Daphne Ippolito; Nicholas Carlini; Katherine Lee; Milad Nasr; Yun William Yu (INLG, 2023)

Preventing Generation of Verbatim Memorization in Language Models Gives a False Sense of Privacy. - Daphne Ippolito; Florian Tramèr; Milad Nasr; Chiyuan Zhang; Matthew Jagielski; Katherine Lee; Christopher A. Choquette-Choo; Nicholas Carlini (INLG, 2023)

Are aligned neural networks adversarially aligned? - Nicholas Carlini; Milad Nasr; Christopher A. Choquette-Choo; Matthew Jagielski; Irena Gao; Pang Wei Koh; Daphne Ippolito; Florian Tramèr; Ludwig Schmidt (NeurIPS, 2023)

Students Parrot Their Teachers: Membership Inference on Model Distillation. - Matthew Jagielski; Milad Nasr; Katherine Lee; Christopher A. Choquette-Choo; Nicholas Carlini; Florian Tramèr (NeurIPS, 2023)

Effective Robustness against Natural Distribution Shifts for Models with Different Training Data. - Zhouxing Shi; Nicholas Carlini; Ananth Balashankar; Ludwig Schmidt; Cho-Jui Hsieh; Alex Beutel; Yao Qin 001 (NeurIPS, 2023)

Counterfactual Memorization in Neural Language Models. - Chiyuan Zhang; Daphne Ippolito; Katherine Lee; Matthew Jagielski; Florian Tramèr; Nicholas Carlini (NeurIPS, 2023)

Publishing Efficient On-device Models Increases Adversarial Vulnerability. - Sanghyun Hong 001; Nicholas Carlini; Alexey Kurakin (SaTML, 2023)

Extracting Training Data from Diffusion Models. - Nicholas Carlini; Jamie Hayes; Milad Nasr; Matthew Jagielski; Vikash Sehwag; Florian Tramèr; Borja Balle; Daphne Ippolito; Eric Wallace (USENIX Security Symposium, 2023)

Tight Auditing of Differentially Private Machine Learning. - Milad Nasr; Jamie Hayes; Thomas Steinke 002; Borja Balle; Florian Tramèr; Matthew Jagielski; Nicholas Carlini; Andreas Terzis (USENIX Security Symposium, 2023)

Randomness in ML Defenses Helps Persistent Attackers and Hinders Evaluators. - Keane Lucas; Matthew Jagielski; Florian Tramèr; Lujo Bauer; Nicholas Carlini (CoRR, 2023)

Students Parrot Their Teachers: Membership Inference on Model Distillation. - Matthew Jagielski; Milad Nasr; Christopher A. Choquette-Choo; Katherine Lee; Nicholas Carlini (CoRR, 2023)

Are aligned neural networks adversarially aligned? - Nicholas Carlini; Milad Nasr; Christopher A. Choquette-Choo; Matthew Jagielski; Irena Gao; Anas Awadalla; Pang Wei Koh; Daphne Ippolito; Katherine Lee; Florian Tramèr; Ludwig Schmidt (CoRR, 2023)

Backdoor Attacks for In-Context Learning with Language Models. - Nikhil Kandpal; Matthew Jagielski; Florian Tramèr; Nicholas Carlini (CoRR, 2023)

A LLM Assisted Exploitation of AI-Guardian. - Nicholas Carlini (CoRR, 2023)

Identifying and Mitigating the Security Risks of Generative AI. - Clark W. Barrett; Brad Boyd; Ellie Burzstein; Nicholas Carlini; Brad Chen; Jihye Choi; Amrita Roy Chowdhury 001; Mihai Christodorescu; Anupam Datta; Soheil Feizi; Kathleen Fisher; Tatsunori Hashimoto; et al. (CoRR, 2023)

Report of the 1st Workshop on Generative AI and Law. - A. Feder Cooper; Katherine Lee; James Grimmelmann; Daphne Ippolito; Christopher Callison-Burch; Christopher A. Choquette-Choo; Niloofar Mireshghallah; Miles Brundage; David Mimno; Madiha Zahrah Choksi; Jack M. Balkin; Nicholas Carlini; et al. (CoRR, 2023)

Scalable Extraction of Training Data from (Production) Language Models. - Milad Nasr; Nicholas Carlini; Jonathan Hayase; Matthew Jagielski; A. Feder Cooper; Daphne Ippolito; Christopher A. Choquette-Choo; Eric Wallace; Florian Tramèr; Katherine Lee (CoRR, 2023)

Identifying and Mitigating the Security Risks of Generative AI. - Clark W. Barrett; Brad Boyd; Elie Bursztein; Nicholas Carlini; Brad Chen; Jihye Choi; Amrita Roy Chowdhury 001; Mihai Christodorescu; Anupam Datta; Soheil Feizi; Kathleen Fisher; Tatsunori Hashimoto; et al. (Found. Trends Priv. Secur., 2023)

Initialization Matters for Adversarial Transfer Learning. - Andong Hua; Jindong Gu; Zhiyu Xue; Nicholas Carlini; Eric Wong 001; Yao Qin 001 (CVPR, 2024)

Stealing part of a production language model. - Nicholas Carlini; Daniel Paleka; Krishnamurthy Dj Dvijotham; Thomas Steinke 002; Jonathan Hayase; A. Feder Cooper; Katherine Lee; Matthew Jagielski; Milad Nasr; Arthur Conmy; Eric Wallace; David Rolnick; et al. (ICML, 2024)

Position: Considerations for Differentially Private Learning with Large-Scale Public Pretraining. - Florian Tramèr; Gautam Kamath 001; Nicholas Carlini (ICML, 2024)

Query-Based Adversarial Prompt Generation. - Jonathan Hayase; Ema Borevkovic; Nicholas Carlini; Florian Tramèr; Milad Nasr (NeurIPS, 2024)

Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models. - Yuxin Wen; Leo Marchyok; Sanghyun Hong 001; Jonas Geiping; Tom Goldstein; Nicholas Carlini (NeurIPS, 2024)

Evading Black-box Classifiers Without Breaking Eggs. - Edoardo Debenedetti; Nicholas Carlini; Florian Tramèr (SaTML, 2024)

Poisoning Web-Scale Training Datasets is Practical. - Nicholas Carlini; Matthew Jagielski; Christopher A. Choquette-Choo; Daniel Paleka; Will Pearce; Hyrum S. Anderson; Andreas Terzis; Kurt Thomas; Florian Tramèr (SP, 2024)

Privacy Side Channels in Machine Learning Systems. - Edoardo Debenedetti; Giorgio Severi; Milad Nasr; Christopher A. Choquette-Choo; Matthew Jagielski; Eric Wallace; Nicholas Carlini; Florian Tramèr (USENIX Security Symposium, 2024)

Diffusion Denoising as a Certified Defense against Clean-label Poisoning. - Sanghyun Hong 001; Nicholas Carlini; Alexey Kurakin (CoRR, 2024)

Forcing Diffuse Distributions out of Language Models. - Yiming Zhang; Avi Schwarzschild; Nicholas Carlini; Zico Kolter; Daphne Ippolito (CoRR, 2024)

Cutting through buggy adversarial example defenses: fixing 1 line of code breaks Sabre. - Nicholas Carlini (CoRR, 2024)

Remote Timing Attacks on Efficient Language Model Inference. - Nicholas Carlini; Milad Nasr (CoRR, 2024)

Stealing User Prompts from Mixture of Experts. - Itay Yona; Ilia Shumailov; Jamie Hayes; Nicholas Carlini (CoRR, 2024)

Gradient Masking All-at-Once: Ensemble Everything Everywhere Is Not Robust. - Jie Zhang 107; Kristina Nikolic; Nicholas Carlini; Florian Tramèr (CoRR, 2024)

Polynomial Time Cryptanalytic Extraction of Deep Neural Networks in the Hard-Label Setting. - Nicholas Carlini; Jorge Chávez-Saab; Anna Hambitzer; Francisco Rodríguez-Henríquez; Adi Shamir (IACR Cryptol. ePrint Arch., 2024)

Measuring Non-Adversarial Reproduction of Training Data in Large Language Models. - Michael Aerni; Javier Rando; Edoardo Debenedetti; Nicholas Carlini; Daphne Ippolito; Florian Tramèr (ICLR, 2025)

Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI. - Robert Hönig; Javier Rando; Nicholas Carlini; Florian Tramèr (ICLR, 2025)

Scalable Extraction of Training Data from Aligned, Production Language Models. - Milad Nasr; Javier Rando; Nicholas Carlini; Jonathan Hayase; Matthew Jagielski; A. Feder Cooper; Daphne Ippolito; Christopher A. Choquette-Choo; Florian Tramèr; Katherine Lee (ICLR, 2025)

On Evaluating the Durability of Safeguards for Open-Weight LLMs. - Xiangyu Qi; Boyi Wei; Nicholas Carlini; Yangsibo Huang; Tinghao Xie; Luxi He; Matthew Jagielski; Milad Nasr; Prateek Mittal; Peter Henderson 002 (ICLR, 2025)

Persistent Pre-training Poisoning of LLMs. - Yiming Zhang; Javier Rando; Ivan Evtimov; Jianfeng Chi; Eric Michael Smith; Nicholas Carlini; Florian Tramèr; Daphne Ippolito (ICLR, 2025)

SoK: Watermarking for AI-Generated Content. - Xuandong Zhao; Sam Gunn; Miranda Christ; Jaiden Fairoze; Andres Fabrega; Nicholas Carlini; Sanjam Garg; Sanghyun Hong 001; Milad Nasr; Florian Tramèr; Somesh Jha; Lei Li 005; et al. (SP, 2025)

Exploring and Mitigating Adversarial Manipulation of Voting-Based Leaderboards. - Yangsibo Huang; Milad Nasr; Anastasios Angelopoulos; Nicholas Carlini; Wei-Lin Chiang; Christopher A. Choquette-Choo; Daphne Ippolito; Matthew Jagielski; Katherine Lee; Ken Ziyu Liu; Ion Stoica; Florian Tramèr; et al. (CoRR, 2025)

Adversarial ML Problems Are Getting Harder to Solve and to Evaluate. - Javier Rando; Jie Zhang 107; Nicholas Carlini; Florian Tramèr (CoRR, 2025)

AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defenses. - Nicholas Carlini; Javier Rando; Edoardo Debenedetti; Milad Nasr; Florian Tramèr (CoRR, 2025)

In-House Evaluation Is Not Enough: Towards Robust Third-Party Flaw Disclosure for General-Purpose AI. - Shayne Longpre; Kevin Klyman; Ruth E. Appel; Sayash Kapoor; Rishi Bommasani; Michelle Sahar; Sean McGregor; Avijit Ghosh; Borhane Blili-Hamelin; Nathan Butters; Alondra Nelson; Amit Elazari; et al. (CoRR, 2025)

Defeating Prompt Injections by Design. - Edoardo Debenedetti; Ilia Shumailov; Tianqi Fan; Jamie Hayes; Nicholas Carlini; Daniel Fabian; Christoph Kern; Chongyang Shi 003; Andreas Terzis; Florian Tramèr (CoRR, 2025)

LLMs unlock new paths to monetizing exploits. - Nicholas Carlini; Milad Nasr; Edoardo Debenedetti; Barry Wang; Christopher A. Choquette-Choo; Daphne Ippolito; Florian Tramèr; Matthew Jagielski (CoRR, 2025)

IF-GUIDE: Influence Function-Guided Detoxification of LLMs. - Zachary Coalson; Juhan Bae; Nicholas Carlini; Sanghyun Hong 001 (CoRR, 2025)

Defending Against Prompt Injection With a Few DefensiveTokens. - Sizhe Chen; Yizhu Wang; Nicholas Carlini; Chawin Sitawarin; David A. Wagner 001 (CoRR, 2025)