Nicholas Carlini による敵対的サンプル論文リストの継続版です。2025-09-15 以降に arXiv に投稿された論文を対象としています。元のリスト（13,697 件）で学習した TF-IDF + ロジスティック回帰の分類器（ホールドアウト AUC 0.998）でスコアが 40% 以上の論文を掲載し、arXiv ID の年月ごとにまとめています。
総数: 3255 件
最終更新: 2026-10-16.

直近1か月

2026-10（179 件）

• [99%] Boosting Transferable Adversarial Attacks against Deep Reinforcement Learning
  Zexin Li; Ruili Yao; Yiming Zeng; Xiaoxue Gao
• [99%] ATLAS-AL: Adaptive Trust-Region for Latent Adversarial Searches via Active Learning
  Marsalis Gibson; Claire Tomlin; Shankar Sastry
• [99%] Adaptive Model Inversion Attacks Generalize a Privacy-Robustness Tradeoff
  Shailen Smith; Rasmus Torp; Adam Breuer
• [99%] Transferable Spatial Temporal Coherence Adversarial Attack on Black-Box Vision Language Models for Autonomous Driving
  Heyam Bin Jahlan Areej Alhothali Abeer Alhothali
• [99%] Detection-Guided Adaptive Purification with Diffusion Models for Robust Audio Deepfake Detection
  Muhammed Salih Kayhan; Qiben Yan
• [99%] Collaboratively Guided Adversarial Robust Distillation with Teacher-Favorable Examples
  Zhi Li; Haowei Liu; Hongchen Yang; Xiaoxuan Wang; Song Gao; Shaowen Yao; Wei Zhou
• [99%] Adversarial Detection for Pre-trained Classifiers via Lipschitz-Margin Analysis with Certification
  Rui Zhang; Xinle Cao; Huazhen Yu; Jian Liu; Youwen Zhu
• [99%] Mitigating Black-Box Score-Based Query Attacks via Gradient Confusion
  Ali Javeri; Javad Hezareh; Radin Shahdaei; AmirMahdi Sadeghzadeh
• [98%] Breaking Adversarial Transferability in Fine-Tuned Speech Recognition
  Mojtaba Nafez; Aref Mousavi; Mohammad Ebrahim Mahdavi; Mobina Poulaei; Kiarash Kiani Feriz; Mohammad Hossein Rohban
• [98%] Robust Detection of Directional Adversarial Attacks in Deep Neural Networks for Radiological Imaging
  Tristan Malatyński; Joanna Jaworek-Korjakowska
• [95%] CalCErt: Bin-wise Certification of Confidence Calibration in Medical Image Classification
  Leo Fillioux; Stergios Christodoulidis; Stergios Christodoulidis; Maria Vakalopoulou; Jose Dolz
• [95%] VCR-Bench: A Modular Open-Source Benchmark for Video Classification Robustness
  Maksim Plinskiy; Aleksandr Gushchin; Sergey Lavrushkin; Dmitriy S. Vatolin; Anastasia Antsiferova
• [95%] Explaining the Saliency Map Sparsity of Adversarially-Trained Neural Networks
  Yannick Lunk; Atell Yehor Krasnopolsky; Damien Garreau; Leon Bungert
• [94%] Target-free Latent Safety Alignment
  Luoyu Chen; Weiqi Wang; Chenhan Zhang; Zhiyi Tian; Yuxian Huang; Shui Yu
• [94%] Pareto-Improving Adversarial Attacks with Primal-Dual Regularization
  Yang Dai; Longfei Zhang; Wei Tao; Li Shen; Jincai Huang; Qing Tao
• [94%] Transferable Adversarial Robustness for Speech Foundation Models via Hierarchical Stabilization
  Aref Mousavi; Shahab Sherafat; Kiarash Kiani Feriz; Amirparsa Safari; Raoof Zare Moayedi; Mohammad Hossein Rohban; Mohammad Sabokrou
• [93%] Visual-Invariance-Augmented Feature Optimal Alignment for Transferable Adversarial Attacks against Closed-Source MLLMs
  Xiaojun Jia; Simeng Qin; Yiming Li; Jie Liao; Sensen Gao; Ke Ma; Yang Liu; Xiaochun Cao
• [93%] Black-Box Adversarial Patch Attacks on VLAs via Ancestor VLM Exploitation
  Xiaoyi Pang; Haoyue Feng; Quanxin Shou; Yikun Miao; Zhengyang Yan; Song Guo
• [92%] Detect and Suppress: A Mechanistic Defense against Adversarial Patches in VLA Models
  Yukiya Horiba; Koshiro Aoki; Shunsuke Yasuki; Bum Jun Kim; Taiki Miyanishi
• [92%] GraphRectify: Graph-Based Transfer of Adversarial Example Detectors Across Neural Networks
  Arash Vashagh; Roozbeh Razavi-Far
• [91%] Online AutoML: Evaluating Poisoning Attacks on Adversarial Training Defense Strategy in IoT Networks
  Chukwunonso Henry Nwokoye; Khalil El-Khatib; Li Yang
• [90%] QCLR: A Plug-in Robustification Module via Quantization for Contrastive Learning in Self-Supervised Skeleton-Based Human Action Recognition
  Nanzhu Chen; Feixiang He; Yunfeng Diao; Duygu Sarikaya; He Wang
• [89%] Adversarially Trained Linear Transformers Are Optimal Robust In-Context Learners for Gaussian Mixtures
  Soichiro Kumano
• [88%] MRCert: Towards Post-deployment Patch Robustness Certification for Adversarially Patched Samples via Type-specific Masking
  Qilin Zhou; Zhengyuan Wei; Haipeng Wang; Zhuo Wang; Shuo Liu; W. K. Chan
• [88%] DecisionRobust: Benchmarking Robustness for JEV Style Decision Models Across Text and Vision
  Yifan Lan; Zhongye Liu; Yurui Chang; Hanyu Wang; Yongkang Du; Lu Lin; Jinghui Chen
• [88%] Clean Data Can Still Carry Backdoors: Support-Persistent Backdoors for Model Reuse
  Junhoo Lee; Baekseung Kim; Seungyeon Kim; Nojun Kwak
• [88%] Trigger Value Selection in Clean-Label Malware Backdoors: An Effectiveness-Detectability Analysis
  Tri Budi Sabdo Utomo; Kazushi Okamoto; Koki Karube; Kei Harada; Atsushi Shibata
• [85%] When Normalization Selects the Sign: Auditing Robustness Ablations in Quantum Attention
  Owen Friedewald; Srikar Alla; Ali Shiri Sichani; Chi-Ren Shyu
• [84%] SAGE: Similarity-Based Cleaning of Poisoned Training Data from Verified Examples
  Chaeeun Han; Soodeh Atefi; Yevgeniy Vorobeychik; Aron Laszka
• [84%] Evaluating and Improving the Robustness of Large Language Models to Input Sequence Variations
  Narek Maloyan
• [84%] JASPER: Special Session on Joint Reliability And Security Assessment of SPlit Computing for Edge Robustness
  Enrico Magliano; Giuseppe Esposito; Amir Hossein Shahdadian; Rama Mounika Kodamanchili; Juan David Guerrero Balaguera; Juan Esteban Rodriguez Condia; Annachiara Ruospo; Roberta Siciliano; Stefano Di Carlo; Maksim Jenihhin; Marco Levorato; Alessandro Savino; Matteo Sonza Reorda; Christian Herglotz; Michael Hübner; Mahdi Taheri
• [83%] Space Over Statistic, Retraining Over Ranking: Auditing Training Labels Under Label-Only Backdoors
  Arnab Dey; Mohammad Mahfuzul Islam
• [83%] Quiet Triggers, Loud Footprints: A Tri-Space Measurement Study of Backdoor Stealthiness
  Behrad Tajalli; Henk Berendsen; Xiaoyun Xu; Stjepan Picek
• [82%] Reward Stealing Attack on Large Language Models
  Jiaming Qian; Pengyang Zhou; Jiahe Xu; Chaochao Chen
• [80%] Detecting Adversarial Images through Response Profiles of Vision-Language Models
  Arash Vashagh; Roozbeh Razavi-Far
• [80%] A Valid Watermark Is Not a Valid Identity: Spatial-Spectral Adversarial Face Evasion with Watermark Preservation
  Jefferson David Rodriguez Chivata; Davide Ghiani; Simone Maurizio La Cava; Marco Micheletto; Giulia Orrù; Gian Luca Marcialis
• [79%] Same Attack, Different Judge: A First Controlled Adversarial Comparison of Jev, LLM Judges, and Purpose-Built Safety Classifiers
  Xiang Li; Aichun Huang; Mingming Zhang; Zheli Liu
• [79%] Adversarial Reinforcement Learning for Robust Planetary Landing
  Miguel Leiva-Vélez; Nicolas Gaston-Rozado; Andrea Scorsoglio; Hodei Urrutxua; Víctor Rodríguez-Fernández
• [78%] TwinViT-DeepJSCC: Adversarially Robust Semantic Image Communication
  Maedeh Fallahreyhani; Paeiz Azmi; Nader Mokari; M. Reza Abedi; Melike Erol-Kantarci; Eduard A. Jorswieck
• [78%] Visual Memory Attacks Can Persist Through The KV Cache
  David Dobre; Leo Schwinn; Gauthier Gidel; Spandana Gella; Perouz Taslakian; Pierre-André Noël
• [77%] The Fragility of Trigger-Tag Mechanisms for Misuse Detection in Open-Weight LLMs
  Toluwani Aremu; Manit Baser; Mohan Gurusamy; Nils Lukas; Dinil Mon Divakaran
• [76%] The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models
  Yibo Zhang; Tianrong Guan; Liang Lin; Puze Wang; Jin Wang; Qingsong Wen
• [76%] CARD: Closing the Teacher-Student Loop for Adversarial Robustness Distillation
  Zhi Li; Haowei Liu; Hongchen Yang; Xiaoxuan Wang; Song Gao; Zhenli He; Wei Zhou; Shaowen Yao
• [75%] TARE: Weigh a Never-Poisoned Twin Before Reading Backdoor-Defense Costs
  Ruizhi Xu; Wei Xu; Sibo Zhu
• [75%] Adversarial RL for Port-Scan Evasion: Attacker Feature Visibility in Edge-Deployed IDS
  Logan Andrew North; Priya Sanjay Kaluskar; Shasi Kumar Ramachandran Prabhu; Peilong Li; Suman Saha
• [75%] Exploring Jailbreak Vulnerability Across Depth-Based Dynamic Inference in Large Language Models
  Lass Najmuldeen; Seyedhamidreza Mousavi
• [75%] Adversarial Robustness of Camera-Radar Sensor Fusion for Autonomous Driving
  Ce Zhou; Yubo Wu; Khang Nguyen; Liyang Xiao; Thomas Hou; Qiben Yan
• [75%] StableJudge: A Lightweight Adversarial Defense Framework for LLM-as-a-Judge
  Anning Hu; Yangyu Li; Yuqi Huang; Shengchao Hu; Junchi Yan
• [74%] HASTE: Evolving Agent Harnesses Against Emerging Attacks Using Sparse Evidence
  Xiqiao Xiong; Moxin Li; Zhixin Ma; Ouxiang Li; Wenjie Wang; Fuli Feng; Xiangnan He
• [74%] Beyond Reward Suppression: Near-Optimal Offline Attacks on Warm-Start Bandits with Bounded Rewards
  Qirun Zeng; Manhin Poon; Xiangxiang Dai; Qixin Zhang; Jinhang Zuo
• [74%] Visually Legible but Adversarial: Watermark-Constrained Attacks on End-to-End VLMs for Document Understanding
  Qingzhe Han; Fan Dang; Shengqi Chen; Xinyi Sun; Haoyu Xiong; Lingkun Li; Di Zhang
• [74%] Answer It or Not? Towards Prompt-Adapted Adversarial Images on Vision Language Models
  Shunyuan Bai; Yuchen Ren; Le Yang; Chenhao Lin; Chao Shen; Zhengyu Zhao
• [72%] Reactivating Alignment: Defending LLMs from Jailbreaks via Intention-Aware Input-Output Matching
  Luoyu Chen; Weiqi Wang; Chenhan Zhang; Zhiyi Tian; Shui Yu
• [72%] Reflections and Fragments: Securing LLMs Against Sequential Mosaic Attacks
  Emanuele La Malfa; Saar Cohen; Gabriele La Malfa; Mickel Liu; Christian Schroeder de Witt; Natasha Jaques; Michael J. Wooldridge
• [72%] Lipschitz Thinking: Ten Years of Certifiable-by-Design Robust Neural Networks
  Fabio Brau; Giorgio Piras; Maura Pintor; Battista Biggio
• [72%] TAPDreamer: Transferable Adversarial Patches for World Action Models
  Xuanyu Lu; Fengqing Jiang; Kaiyuan Zheng; Yichen Feng; Yaorui Ding; Yuetai Li; Zhen Xiang; Bhaskar Ramasubramanian; Basel Alomair; Luyao Niu; Radha Poovendran
• [71%] DPOison-VL: Clean Preference Poisoning in Vision-Language Direct Preference Optimization
  Chengtao Jian; Kai Yang
• [70%] MLCommons Jailbreak Benchmark v1.0
  Carsten Maple; Cagatay Yucel; Isaac Holeman; Chris Knotz; Peter Mattson; James Goel; Jonathan Petit; Sean McGregor; James Ezick; Abhishek Kumar; Alicia Parrish; Murali Emani; Kashyap Iyer; Faiza Khan Khattak; Washington Mbonu; Daniel Machlab; Eileen Long; Shaona Ghosh; Jibin Varghese; Roman Lutz; Andrew Gruen; Bennett Hillenbrand; Prabal Gupta; Mohammed Serrhini; Dhivya Nagasubramanian; Aakash Gupta; Jun; Lu; Kurt Bollacker; Chang Liu; Jonathan Petit; Cong Chen; Jean-Philippe Monteuuis; Brent Miller; Apurv Verma; Roman Eng; Armstrong Foundjem; Mohammed Serrhini
• [70%] The TellTail of Embeddings: Fingerprinting Retrievers in Black-Box Systems
  Abdullah Garra; Matan Ben-Tov; Mahmood Sharif
• [70%] Scenes as an Attack Surface: Uncovering Scene-Grounded Safety Failures in MLLMs
  Tongxi Wu; Yuyang Cheng; Jiacheng Xian; Hu Huang; Zhihao Wu; Menglin Yang; Jian Zhang; Yang Gao
• [69%] AI Models Can Provably Hide Arbitrary Capabilities
  Andis Draguns; Sumeet Ramesh Motwani; Raymond Douglas; Christian Schroeder de Witt
• [69%] TRACER: Trace-Regularized Training Against Indirect Prompt Injection
  Kshitij Mishra; Salem Lahlou; Nils Lukas
• [69%] Analyzing and Mitigating Poisoning Attacks on Flow-Based Intrusion Detection
  Florian Spelter; Johannes F. Loevenich; Tobias Hürten; Erik Adler; Maxime Schwarzer; Laurin Holz; Roberto Rigolin F. Lopes
• [68%] Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisation
  Minoo Kim; Vasileios Lampos; George Drayson
• [68%] Attacking Only Half the Data: Two-Sided Evaluation of AI-Text Detector Robustness
  Apu Chandraw Shill; Rabindra Nath Nandi
• [68%] AgentSafeEvo: Adversarial Co-Evolution for LLM Agent Safety
  Chenxu Wang; Xiaoyu Wen; Han Qi; Ziyuan Zhou; Cheng Jin; Chaochao Lu; Qiaosheng Zhang
• [68%] P2Patch: Exploit-Guided Vulnerability Repair
  Mohsen Iranmanesh; Sina Moradi Sabet; Sina Marefat; Ali Javidi Ghasr; Maxime Newman Nereyabagabo; Kousha Amouzesh; Jaivir Malhi; Vinci Velasco; Alex Chung; Mohammad A. Tayebi
• [67%] DeBERTa-ConPara: Attack-Aware and Deployment-Realistic Detection of AI-Generated Text
  Mohamed Mady; Yupei Li; Johannes Reschke; Björn W. Schuller
• [67%] Adversarial Gradient Forcing for Robust Few-Step Autoregressive Video Generation
  Chenxi Xia; Yixuan Xu; Shan Liu; Jiapeng Wang; Maohua Li; Hanlin Tang; Kan Liu; Tao Lan; Weiyi Lu; Xinggao Liu
• [67%] No Way To Steal My Face: Proactive Defense Against Identity-Preserving Personalized Generation
  Lizhi Xiong; Jun Li; Ziqiang Li; Weiwei Jiang; Zhangjie Fu
• [66%] Exploring Weaknesses of Generative Image Watermarks against Latent Frequency Masking
  Kirill Aistov; Khaled Abud; Irina Serzhenko; Egor Kovalev; Aleksey Yakushev; Aleksandr Akimenkov; Dmitry Obydenkov; Yury Markin; Sergey Lavrushkin; Dmitriy Vatolin; Anastasia Antsiferova
• [66%] Understanding and Mitigating Cross-Session Attacks via Persistent Artifacts in Agent Skill Composition
  Dianshu Liao; Shidong Pan; Guangdong Bai; Zhenchang Xing; Xiaoyu Sun
• [65%] Memetic Trojans: Social Contagions as Carriers of Adversarial Payloads in Agent Networks
  Birk Torpmann-Hagen; Finn Schwall; Leon Moonen
• [65%] Curvature Under Attack in hZACH-ViT: Gauge Symmetry, Boundary Saturation, and Adversarial Failure
  Athanasios Angelakis; Marta Gomez-Barrero
• [65%] COPEX: Benchmarking LLM Robustness to Adversarial Context Across Model Context Protocol Layers
  Nahom Birhan; Mehrdad Rostamzadeh; Sidhant Narula; Mahmoud Nazzal; Mohammad Ghasemigol; Daniel Takabi
• [65%] What Response Marginals Miss: Adaptive Query Complexity of Functional Backdoor Recovery
  Yunjae Hwang; Byoungjin Seok
• [65%] BRANCH: Bypassing Multi-Scanner AI Guardrails
  William Hackett; Peter Garraghan
• [65%] Does Target Alignment Mean Target Recovery? An Evidence-Ladder Study of Adversarial Claims on Contrastive Encoders
  Tao Yang; Jianying Zhou
• [65%] Neural Network Verification for Deep Joint Source-Channel Coding
  Thanh Le; Hai Duong; Takeshi Matsumura; ThanhVu Nguyen
• [65%] When Does Trust Help? A Leakage-Free Evaluation of Representation- and Aggregation-Based Defenses Against Backdoors in Federated Intrusion Detection
  Shiddarth Dey Tusar; Zawad Yalmie Sazid
• [64%] Corrupted but Correct: Why Vision-Language Models Lie to Themselves Internally
  Arun Josephraj Arokiaraj; Zekun Wu; Adriano Koshiyama
• [64%] Does On-Policy Distillation for Safety Pose Backdoor Risks?
  Jian Luo; Kehan Qi; Qingqiao Hu; Meilong Xu; Jiacheng Qiu; Weimin Lyu; Jiawei Zhou; Chao Chen
• [64%] Diagnose Before You Refine: Multi-Dimensional Judge Feedback for Query-Efficient Jailbreak Attacks
  Yixin Tan; Chia-Yi Hsu; Jiayang Liu; Chia-Mu Yu; Rui Wen
• [63%] Certification of Real Images through Calibrated Content Authentication
  Sarim Hashmi; Abdelrahman Elsayed; Mohammed Talha Alam; Samuele Poppi; Nils Lukas
• [62%] Adversarial Training for Deep Hedging in Nonstationary Markets
  Philipp J. Schneider; Lukas Looser; Antoine Garin; Shuhan Liu; Daniel Kuhn
• [62%] ML-Assisted Power Side-Channel Attacks on ML Accelerators in Shared FPGAs
  Anthony Etim; Kenan Erol; Jakub Szefer
• [61%] Safe Image Generation via Reinforcement Learning
  Eungyeol Han; Jong-Seok Lee
• [60%] From A2A Attacks to Envelope-Layer Defense: Red-Teaming Evaluation of LLM Agents and a Three-Layer Isomorphic Attack-Defense Model
  Yuelin Han
• [60%] Towards Robust Numerical Claim Verification
  Peter Røysland Aarnes; Vinay Setty
• [60%] RAISED: Self-Distillation for Robustness to Prompt Injection in LLM Agents
  Mohamed Dhouib; Clement Elliker; Alexi Canesse; Maël Jenny; Lucas-Andrei Thil; Mahammed El-Sharkawy; Sonia Vanier; Elie Bursztein
• [60%] AdvSim2Real : Training Web Agents Against Adaptive Prompt Injection in a Web World Model
  Sarim Hashmi; Mukul Ranjan; Kshitij Mishra; Mikhail Kuznetsov; Praneeth Vepakomma; Nils Lukas
• [59%] SoK: Rethinking Membership Inference in Tabular Machine Learning
  Cristina Pêra; Tânia Carvalho; Maxime Cordy; Luís Antunes
• [58%] Self-Reflection Fine-Tuning: Enhancing Agent Security against Prompt Injection Attacks from Failure Experience
  Zixuan Wang; Hao Li; Fengyu Gao; G. Edward Suh; Yi Zeng; Yevgeniy Vorobeychik; Ning Zhang; Chaowei Xiao
• [58%] APEX: Active Protection at Execution Boundaries for LLM Agents
  Xinran Zheng; Xin Fan Guo; Zhiqiang Hao; Fan Yang; Xingzhi Qian; Jiawei Du; Jinfeng Xu; Zheng Xing; Shuo Yang; Xingjun Wang
• [57%] Do Defenses Against LLM Extraction Work Across Attacks? A Lifecycle Benchmark of Black-Box Model Extraction
  Shuze Liu; Kaixiang Zhao; Runyang Xu; Jingzhi Chen; Nathan Wu; Yu Wang; Yushun Dong
• [57%] FoSeRL: Formal Sequential Robustness Certification for Reinforcement Learning Policies
  Sara Taheri; Deep Kumar Ganguly; Jan Křetínský; Majid Zamani
• [57%] Where Rules End and Judges Begin: Measuring the Judgment Boundary in Multi-Agent Systems Security
  Shaswata Mitra; Raj Patel; Subash Neupane; Sudip Mittal; Md Rayhanur Rahman; Shahram Rahimi
• [57%] Welcome to the Age of Agent Ads: Using On-Policy Attacks to Steer Agentic Decisions
  Tim R. Davidson; Marija Å akota; Joshua Joseph; Robert West
• [56%] Don't Waste the Noise: Importance-Guided Perturbation Allocation under Joint Global and Local Constraints
  Melika Shirian; Kianoosh Vadaei
• [56%] Jailbreaking Open-Weight LLMs via Random Embedding Perturbations
  Abhinav Sudhakar Dubey; Scott Sirri; Vaggos Chatziafratis; C. Seshadhri
• [56%] Speedbumps: Rejection Attacks on Speculative Decoding
  Adam Y. J. Jones; Yu Yuan; Sergio Maffeis
• [56%] Across Viewpoints and Time: Trajectory-Generalizable Physical Attacks on World Models and Video Understanding Models
  Song Xia; Meiwen Ding; Chenqi Kong; Wenhan Yang; Xudong Jiang
• [56%] MMA-SafetyBench: A Benchmark for Multimodal Agent Safety Evaluation
  Yuke Wang; Benlei Cui; Shen Pang; Xuemei Dong; Longtao Huang; Hui Xue; Yuwen Zhai; Junjie Li; Jingqun Tang; Haiwen Hong
• [56%] INFUSE: A Unified Surface Benchmark for Indirect Prompt Injection in Agentic Systems
  Thuy Dung Nguyen; Jingyi Guo; Rana Seda Dubauskas; Sreepriya Damuluru; Taylor T. Johnson; Kevin Leach
• [55%] Localisation-Aware Uncertainty for Pretrained Object Detection
  Charmaine Barker; Daniel Bethell; Simos Gerasimou
• [55%] SkillPoison: Progressive Skill Poisoning via Successful Experiences
  Lizhi Zhang; Xin He; Dianxuan Fu; Yuyuan Feng; Jiatong Li; Qi Wang; Xin Wang; Qinggang Zhang
• [55%] Embedding Asymmetry as Attack Signal: Detecting and Defending Active Label Inference in Vertical Federated Learning
  Soumya Swagata Biswas; Muhammad Abdullah Adnan
• [55%] MetaCascade: End-to-End Attacks on Agent Skills via Metadata-Only Poisoning
  Junhao Wen; Ping Deng; Qizhi Chen; Junchen Li; Shuang Liang
• [55%] Poisoning the corpora of protein design systems during pre-training and retrieval
  Charalampos Koilakos; Kimon-Antonios Provatas; Michail Patsakis; Candace SY Chan; Georgios A. Pavlopoulos; Ilias Georgakopoulos-Soares
• [54%] Robust Evidential Learning Through Latent Consistency
  Charmaine Barker; Daniel Bethell; Simos Gerasimou
• [54%] EvolvAttack: Backdooring self Evolving VLM Agents
  Chuan Zou; Yang Xiang; Zexin Li; Xiaonan Luo; Simin Chen
• [54%] Memorization in image classification: test set behavior and scaling laws
  Jeevesh Attri; Florentin Guth
• [54%] SSM-Attack: Learning Where to Perturb for Black-Box Face Privacy
  Tunahan Parlayıcı; Erchan Aptoula; Yücel Saygın
• [54%] Poisoning the Neighborhood: A Topology-Aware Topic-Level Attack on Large-Scale HNSW-based RAG Systems
  Yufei Chen; Yao Wang; Haibin Zhang
• [53%] AnchorPrompt: Self-Distilled Soft Prompts for Robust Audio-Language Models
  Pooneh Mousavi; Amir Ivry; Mirco Ravanelli; Cem Subakan
• [53%] Adversarial Images Hijack Web Agents from Visual Grounding to Browser Execution
  Wanjing Han; Levi Taiji Li; Mu Zhang; Yue Jiang; Guanhong Tao
• [53%] Cancerous Backdoor Attack: Gradual Activation via Invisible Tokens and A Stage Controller
  Tahmid Imtiaz Imu; Emama Nahid; Prodipta Sen Amartya; Ahsanul Jobayer; Yutong Song; Jiang Wu; Pengfei Zhang; Honghui Xu
• [53%] An Empirical Case Study of Prompt Engineering Strategies for Bypassing Multi-Layer Agent Security Defenses
  Chengwei Chu
• [53%] Phantomware: a Data Augmentation Framework for the Detection of Emerging Malware Campaigns
  Antonino Rullo
• [53%] Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks
  Harsh Aaryan; Ce Zhou
• [53%] Believed but Not Said: Measuring Hidden Belief Collapse in Multi-Agent LLM Discussions
  Liangjie Huang; Henry Peng Zou; Wei-Chieh Huang; Wooseong Yang; Yuwei Han; Philip S. Yu
• [52%] Surviving the Router: Optimizing Skill Injections for Retrieval and Execution
  Haneen Najjar; Luca Scionis; Haritz Puerto; Sahar Abdelnabi
• [52%] BARE-AI: Bit-Flip Attack Resilience in AI Hardware through Built-in Performance Monitors
  Habibur Rahaman; Swastik Bhattacharya; Sanjay Das; Kanad Basu; Swarup Bhunia
• [52%] LTBD: Learnable Trust-Boundary Delimiters for Prompt Injection Defense
  Luman Zhao; Minghui Xu; Yue Zhang; Yijun Yang
• [52%] RobustLDS: Learning linear dynamical systems under adversarial corruptions
  Aravinda Kanchana Ruwanpathirana; Hemant Tyagi
• [52%] ATTCK-R: Knowledge-Aware Long-Horizon Jailbreaking for Protected LLMs
  Md Mushfiqur Rahman; Tobias Rohde; Rahul Tripathi; Khalil Elkhalil; Kevin Lybarger
• [52%] AIRRI: Towards a Human-Readable, Machine-Resistant Reading Interface
  Emory Salaun; Syed Ayon; Kaleel Mahmood; Shaun Wallace
• [51%] Package Hallucination Attacks on Coding Agents through Prompt Injection in Rule Files
  Yupu Wang; Zhengyuan Jiang; Reachal Wang; Neil Zhenqiang Gong
• [50%] Refusal Localizes, the Damage Relocates: Safety Layers Under Few-Sample Fine-Tuning
  Jungseob Lee; Dongyub Jude Lee; Sugyeong Eo; Seongtae Hong; Seungyoon Lee; Heuiseok Lim
• [50%] Out of Sync, Out of Sight: Phantom State Attacks against IIoT Intrusion Detection
  Sabrine Ennaji; Elhadj Benkhelifa; Nadia Kabachi
• [50%] Purifying Backdoored Large Vision-Language Models by Removing Hijacked Directions
  Bojun Yang; Haochen Zhou; Zhifang Zhang; Haobo Wang; Songze Li; Lei Feng
• [50%] Safe at One Loop, Risky at Another: Aligning Safety Across Recurrent Depths in Looped Language Models
  Yi Wang; Xiuyuan Qi; Dongqi Han; Dongsheng Li; Wenjie Wang
• [50%] [Re] Boosting the Visual Interpretability of CLIP via Adversarial Fine-Tuning
  Anton Nuzhdin; Andrei Gruzitski; Balázs Egyed; Aleksandr Raudvee
• [50%] WisdomNet: trustable machine learning toward error-free classification
  Truong X. Tran; Ramazan S. Aygun
• [50%] Federated Art Chase: Privacy Leakage and Data Poisoning in Federated Fine-Tuning
  Vasileios Perifanis; Nikolaos Pavlidis
• [49%] WaSA: Wavelet Scattering Autoencoders for Unsupervised Offline Detection of Malicious Clients in Federated Learning
  Alessandro Licciardi
• [49%] AlignPoison: Conditional Targeted Poisoning of Generative Recommenders via Decoding-Aligned Prefixes
  Zhuoxuan Zhang; Jinhao Duan; Xinyu Zhao; Jinduo Guo; Shuai Shao; Rui Li; Luke Simon; Zhun Deng; Tianlong Chen; Bo Sun
• [49%] On the Effectiveness of NetFlow-Based Deanonymization of Tor Onion Services (Extended Version)
  Jinseo Lee; Jongkook Han; Yixin Sun; Min Suk Kang
• [49%] Hidden in Plain Sight: Advancing Harmful Content Understanding via Perception-Aware Adversarial Self-Play
  Yisong Xiao; Benlei Cui; Shiji Zhao; Zonghao Ying; Yaoyuan Zhang; Longtao Huang; Aishan Liu; Hui Xue; Ting Ma; Haiwen Hong; Xianglong Liu
• [49%] Certified Robustness via Sparse Second-Order Cone Relaxations
  Mohammadreza Maleki; Daniel Sadig; Rushendra Sidibomma; Mahyar Fazlyab; Arman Adibi; Reza Samavi
• [49%] FedGraph: Defending Federated Large Language Model Fine-Tuning Against Backdoor Attacks via Graph-Based Aggregation
  Xi Chen; Chunyi Zhou; Rui Zeng; Xiaogang Xu; Zhe Liu; Shouling Ji
• [48%] Certified Mechanistic Edits: Behavioral Guarantees for Skill Removal and Preservation
  Md Sazid Uddin; Md. Khairul Alam Mazumder; M. F. Mridha
• [48%] Localize-and-Detect: Auditing Task-Level Poisoning in Instruction-Tuned Models
  Luze Sun; Cristina Nita-Rotaru; Alina Oprea
• [48%] Hidden Risks of Jev: An Empirical Study of Security, Privacy, and Dual Use
  Shang Wang; Tianqing Zhu; Huajie Chen; Jiayang Li; Meng Yang; Bo Liu
• [48%] Quantization-Tolerant Gradient Auditing for Active Inference-Attack Detection in Federated Learning
  Michael Kuehne-Schlinkert
• [48%] Beyond Static Cues: Unified Dynamic Detection of MLLM Backdoors via Dual-Flow Trajectory Analysis
  Yinzhen Huang; Jiahe Xie; Yitong Sun; Ruochen Zhang; Xingxing Wei
• [47%] Threat-Preserving Representation Sensitivity in Agent-Security Benchmarks
  Neeraj Karamchandani; Piyush Nagasubramaniam; Xinhong Xie; Sencun Zhu; Dinghao Wu
• [47%] FusionAudit: Pathway-Conditioned Robustness Auditing for Native Multimodal Models
  Jiaming Zhang; Zherui Li; Siqi Guo; Junhao Dong; Kun Wang; Wei Yang Bryan Lim
• [46%] PhaseAT: Fourier Phase Adversarial Training for Medical Image Domain Generalization
  Ahmed Sharshar; Asif Hanif; Naveen Kumar Kummari; Mohammad Yaqub; Mohsen Guizan
• [46%] Walking the Embedding Space: Datastore Extraction from Multimodal RAG
  Maria Carmen Jica; Ali Satvaty; Suzan Verberne; Fatih Turkmen
• [46%] Forgetting is Not Always Bad: A Neuro-Inspired Memory Repair Mechanism for Poisoned LLM Agents
  Lei Liu; Yunji Liang; Xiaowen Zhang; Jingqi Liu; Qi Li; Bin Guo; Zhiwen Yu
• [46%] When Non-Adversarial Noise Hurts Learning: Benchmarking Skill Self-Evolution in Agents
  Tao Yu; Zhongtian Luo; Yuchen Long; Yiheng Lu; Yuxuan Zhou; Yanpei Gong; Siyi Cao; Yuqing Wu; Haopeng Jin; Zhenghao Zhang; Yujia Yang; Jingmin Zhu; Yunyun Hou; Xinming Wang; Hongzhu Yi; Jiachen Liu; Sirui Wang; Nan Duan; Yan Huang; Liang Wang; Tianjin Huang; Yanyan Zou
• [45%] Bounded Reachability & Jailbreak Detection via Contraction-Constrained State Space Models
  Omanshu Thapliyal
• [45%] Understanding and Enhancing Backdoor Persistency in LLM Agent Post-Training
  Qiusi Zhan; Nian Lyu; Stephanie Ding; Arnav Mehta; Xander Davies; Daniel Kang
• [45%] Don't Let One Lie Survive A Hundred Truths: A Selective Bayesian Trust Estimator for Collaborative Perception
  Yutong Liu; Chenyi Wang; Ming F. Li; Qingzhao Zhang
• [45%] Dynamical low-rank equilibrium computation for stochastic games between advanced persistent threats and moving target defense
  Tian Zijian; Zhang He; Chen Xinjie; Wang Wenhai; Liu Xinggao
• [44%] Persona Guardrail: A Production-Grade Defense Framework for Agentic Systems
  Bijeeta Pal; Sridhar Reddy Maddireddy; Muhaimin Bin Munir; Zoltan Puha; Max Zhurovich; Adi Raghavendra; Sean Tout
• [44%] Backdooring Acoustic Foundation Models for Physically Realizable Triggers
  Zebin Yun; Eyal Ronen; Mahmood Sharif
• [43%] PerSpectron: Detecting Invariant Footprints of Microarchitectural Attacks with Perceptron
  Samira Mirbagher-Ajorpaz; Gilles Pokam; Esmaeil Mohammadian-Koruyeh; Elba Garza; Nael Abu-Ghazaleh; Daniel A. Jiménez
• [43%] Feature-Context Consistency: Unsupervised Adversarial Detection with Drift Stability on Attributed Graphs
  Firas Bayram; Maxime Cordy
• [42%] Representation Transitions Reveal Emerging Safety Risks in Multi-Turn LLM Agents
  Haoyu Wang; Wei Zhao; Yedi Zhang; Christopher M. Poskitt; Jun Sun
• [42%] Safeguarding LLMs via Model-Agnostic Latent Safety Signals from Dark Knowledge
  Wonjun Lee; Kyungsik Yang; Gaeun Ji; Vaidehi Patil; Haon Park; Bumsub Ham; Mohit Bansal; Suhyun Kim
• [42%] MARCO: The Radioactive Watermark for Protein Generative Models
  Huajie Chen; Xin Guo; Yuchen Shi; Yuchen Zhong; Minhui Xue; Chi Liu; Congcong Zhu; Kun Gao; Minfeng Qi; Tianqing Zhu
• [42%] Automotive Hardware Attacks: An Architect's Guide to TARA
  Jakub Breier; Xiaolu Hou
• [42%] How Hackable Is Your Speech Quality Metric? A Corrected Protocol, a Benchmark, and What Patching Buys
  Ali Alavi; Donald S. Williamson
• [42%] Natural Code Transformation Confuses Agents in Vulnerability Analysis
  Jie Zhu; Ronik Bhaskar; Heather Zheng; Ben Y. Zhao; Kexin Pei
• [42%] Are You Reading the Right Thing? Rethinking Internal Signals for Prompt-Injection Detection
  Sarthak Gupta; Priyanka Tembey
• [41%] Backdoor Containment via Expert Quarantine and Shutdown in LLMs
  Jianwei Li; Min-Seon Kim; Jung-Eun Kim
• [41%] Detecting LLM-Assisted Vietnamese Writing via Keystrokes under Behavioral Manipulation
  Thanh Dong; An Ngo; Minh Dau; Rajesh Kumar
• [41%] When to Intervene? State-Aware Sparse Manipulation in Federated Reinforcement Learning
  Shutong Zheng; Sijia Chen
• [41%] Pin It on Anyone: Certified Targeted Displacement of Multi-Bit LLM Watermarks Without the Key
  Paweł Batorski; Przemysław Spurek; Paul Swoboda
• [41%] TrackShield: An Efficient Runtime Defense Against Availability Attacks on High-Performance Real-Time Multi-Object Tracking
  Zonghua Gu; Julian Singh-Smith; Junlin Liao; Di Liu
• [41%] One Size Does Not Fit All: Curvature-Aware Adaptive Perturbation for SAM
  Alessia Rossi; Felipe Campelo; Gabriel L. Oliveira
• [40%] Transferable Graph Metanetworks
  Yuxin Ma; Adir Dayan; Yam Eitan; Haggai Maron; Soledad Villar
• [40%] High-quality Data Do not Mean Safe! Poisoning LLMs after Data Selection
  Kaiyang Li; Jiahao Chen; Yuwen Pu; Chunyi Zhou; Tong Zhang; Bin Cai; Chunqiang Hu; Haibo Hu
• [40%] Mitigating Private Data Leakage in LLMs with Whiteout
  Anna Yoo Jeong Ha; Ronik Bhaskar; Haitao Zheng; Ben Y. Zhao
• [40%] SwarmReconGuard: Black-Box Detection of Distributed Collective Reconnaissance by Individually Benign-Looking Agent Populations
  Vahid Tavakkoli; Kabeh Mohsenzadegan; Kyandoghere Kyamakya
• [40%] Nudge the Judge: Uncovering Program Decision Hijacking in Real-World Jev Applications
  Yang Luo; Tiantian Ji; Zifeng Kang; Yucheng Wang; Yong Liu; Zhiyi Yin; Xinran Liu
• [40%] Personalized Projected Ascent for Federated Stackelberg Optimization
  M Yashwanth; Sharannya Ghosh; Saikiran Bulusu; Anirban Chakraborty

→ 全リストを見る