Adversarial Robustness in Machine Learning

Neueste Paper

• Stop Testing Attacks, Start Diagnosing Defenses: The Four-Checkpoint Framework Reveals Where LLM Safety Breaks

  Hayfa Dhabhi, Kashyap Thimmaraju · 11. Februar 2026

  Large Language Models (LLMs) deploy safety mechanisms to prevent harmful outputs, yet these defenses remain vulnerable to adversarial prompts. While existing research demonstrates that jailbreak attacks succeed, it does not explain \textit{where} defenses fail or \textit{why}. To address this gap,…

• A Behavioral Fingerprint for Large Language Models: Provenance Tracking via Refusal Vectors

  Zhenyu Xu, Victor S. Sheng · 11. Februar 2026

  Protecting the intellectual property of large language models (LLMs) is a critical challenge due to the proliferation of unauthorized derivative models. We introduce a novel fingerprinting framework that leverages the behavioral patterns induced by safety alignment, applying the concept of refusal v…

• Statistical Roughness-Informed Machine Unlearning

  Mohammad Partohaghighi, Roummel Marcia, Bruce J. West, YangQuan Chen · 11. Februar 2026

  Machine unlearning aims to remove the influence of a designated forget set from a trained model while preserving utility on the retained data. In modern deep networks, approximate unlearning frequently fails under large or adversarial deletions due to pronounced layer-wise heterogeneity: some layers…

• Tracking Finite-Time Lyapunov Exponents to Robustify Neural ODEs

  Tobias W\"ohrer, Christian Kuehn · 11. Februar 2026

  We investigate finite-time Lyapunov exponents (FTLEs), a measure for exponential separation of input perturbations, of deep neural networks within the framework of continuous-depth neural ODEs. We demonstrate that FTLEs are powerful organizers for input-output dynamics, allowing for better interpret…

• Fake-HR1: Rethinking reasoning of vision language model for synthetic image detection

  Changjiang Jiang, Xinkuan Sha, Fengchang Yu, Jingjing Liu, Jian Liu, Mingqi Fang, Chenfeng Zhang, Wei Lu · 11. Februar 2026

  Recent studies have demonstrated that incorporating Chain-of-Thought (CoT) reasoning into the detection process can enhance a model's ability to detect synthetic images. However, excessively lengthy reasoning incurs substantial resource overhead, including token consumption and latency, which is par…

• X-Mark: Saliency-Guided Robust Dataset Ownership Verification for Medical Imaging

  Pranav Kulkarni, Junfeng Guo, Heng Huang · 11. Februar 2026

  High-quality medical imaging datasets are essential for training deep learning models, but their unauthorized use raises serious copyright and ethical concerns. Medical imaging presents a unique challenge for existing dataset ownership verification methods designed for natural images, as static wate…

• SHIELD: Suppressing Hallucinations In LVLM Encoders via Bias and Vulnerability Defense

  Yiyang Huang, Liang Shi, Yitian Zhang, Yi Xu, Yun Fu · 11. Februar 2026

  Large Vision-Language Models (LVLMs) excel in diverse cross-modal tasks. However, object hallucination, where models produce plausible but inaccurate object descriptions, remains a significant challenge. In contrast to previous work focusing on LLM components, this paper is the first to trace LVLM h…

• ConjNorm: Tractable Density Estimation for Out-of-Distribution Detection

  Bo Peng, Yadan Luo, Yonggang Zhang, Yixuan Li, Zhen Fang · 11. Februar 2026

  Post-hoc out-of-distribution (OOD) detection has garnered intensive attention in reliable machine learning. Many efforts have been dedicated to deriving score functions based on logits, distances, or rigorous data distribution assumptions to identify low-scoring OOD samples. Nevertheless, these esti…

• Mutual Information Collapse Explains Disentanglement Failure in $\beta$-VAEs

  Minh Vu, Xiaoliang Wan, Shuangqing Wei · 11. Februar 2026

  The $\beta$-VAE is a foundational framework for unsupervised disentanglement, using $\beta$ to regulate the trade-off between latent factorization and reconstruction fidelity. Empirically, however, disentanglement performance exhibits a pervasive non-monotonic trend: benchmarks such as MIG and SAP t…

• Linear Model Extraction via Factual and Counterfactual Queries

  Daan Otto, Jannis Kurtz, Dick den Hertog, Ilker Birbil · 11. Februar 2026

  In model extraction attacks, the goal is to reveal the parameters of a black-box machine learning model by querying the model for a selected set of data points. Due to an increasing demand for explanations, this may involve counterfactual queries besides the typically considered factual queries. In …

• One RNG to Rule Them All: How Randomness Becomes an Attack Vector in Machine Learning

  Kotekar Annapoorna Prabhu, Andrew Gan, Zahra Ghodsi · 11. Februar 2026

  Machine learning relies on randomness as a fundamental component in various steps such as data sampling, data augmentation, weight initialization, and optimization. Most machine learning frameworks use pseudorandom number generators as the source of randomness. However, variations in design choices …

• Towards Poisoning Robustness Certification for Natural Language Generation

  Mihnea Ghitu, Matthew Wicker · 11. Februar 2026

  Understanding the reliability of natural language generation is critical for deploying foundation models in security-sensitive domains. While certified poisoning defenses provide provable robustness bounds for classification tasks, they are fundamentally ill-equipped for autoregressive generation: t…

• AGMark: Attention-Guided Dynamic Watermarking for Large Vision-Language Models

  Yue Li, Xin Yi, Dongsheng Shi, Yongyi Cui, Gerard de Melo, Linlin Wang · 11. Februar 2026

  Watermarking has emerged as a pivotal solution for content traceability and intellectual property protection in Large Vision-Language Models (LVLMs). However, vision-agnostic watermarks may introduce visually irrelevant tokens and disrupt visual grounding by enforcing indiscriminate pseudo-random bi…

• BEAT: Visual Backdoor Attacks on VLM-based Embodied Agents via Contrastive Trigger Learning

  Qiusi Zhan, Hyeonjeong Ha, Rui Yang, Sirui Xu, Hanyang Chen, Liang-Yan Gui, Yu-Xiong Wang, Huan Zhang, Heng Ji, Daniel Kang · 10. Februar 2026

  Recent advances in Vision-Language Models (VLMs) have propelled embodied agents by enabling direct perception, reasoning, and planning task-oriented actions from visual inputs. However, such vision-driven embodied agents open a new attack surface: visual backdoor attacks, where the agent behaves nor…

• ArcMark: Multi-bit LLM Watermark via Optimal Transport

  Atefeh Gilani, Carol Xuan Long, Sajani Vithana, Oliver Kosut, Lalitha Sankar, Flavio P. Calmon · 10. Februar 2026

  Watermarking is an important tool for promoting the responsible use of language models (LMs). Existing watermarks insert a signal into generated tokens that either flags LM-generated text (zero-bit watermarking) or encodes more complex messages (multi-bit watermarking). Though a number of recent mul…

• The Double-Edged Sword of Data-Driven Super-Resolution: Adversarial Super-Resolution Models

  Haley Duba-Sullivan, Steven R. Young, Emma J. Reid · 10. Februar 2026

  Data-driven super-resolution (SR) methods are often integrated into imaging pipelines as preprocessing steps to improve downstream tasks such as classification and detection. However, these SR models introduce a previously unexplored attack surface into imaging pipelines. In this paper, we present A…

• Beyond Crash: Hijacking Your Autonomous Vehicle for Fun and Profit

  Qi Sun, Ahmed Abdo, Luis Burbano, Ziyang Li, Yaxing Yao, Alvaro Cardenas, Yinzhi Cao · 10. Februar 2026

  Autonomous Vehicles (AVs), especially vision-based AVs, are rapidly being deployed without human operators. As AVs operate in safety-critical environments, understanding their robustness in an adversarial environment is an important research problem. Prior physical adversarial attacks on vision-base…

• ShallowJail: Steering Jailbreaks against Large Language Models

  Shang Liu, Hanyu Pei, Zeyan Liu · 10. Februar 2026

  Large Language Models(LLMs) have been successful in numerous fields. Alignment has usually been applied to prevent them from harmful purposes. However, aligned LLMs remain vulnerable to jailbreak attacks that deliberately mislead them into producing harmful outputs. Existing jailbreaks are either bl…

• BadSNN: Backdoor Attacks on Spiking Neural Networks via Adversarial Spiking Neuron

  Abdullah Arafat Miah, Kevin Vu, Yu Bi · 10. Februar 2026

  Spiking Neural Networks (SNNs) are energy-efficient counterparts of Deep Neural Networks (DNNs) with high biological plausibility, as information is transmitted through temporal spiking patterns. The core element of an SNN is the spiking neuron, which converts input data into spikes following the Le…

• Agent-Fence: Mapping Security Vulnerabilities Across Deep Research Agents

  Sai Puppala, Ismail Hossain, Md Jahangir Alam, Yoonpyo Lee, Jay Yoo, Tanzim Ahad, Syed Bahauddin Alam, Sajedul Talukder · 10. Februar 2026

  Large language models are increasingly deployed as *deep agents* that plan, maintain persistent state, and invoke external tools, shifting safety failures from unsafe text to unsafe *trajectories*. We introduce **AgentFence**, an architecture-centric security evaluation that defines 14 trust-boundar…

• Safety Alignment as Continual Learning: Mitigating the Alignment Tax via Orthogonal Gradient Projection

  Guanglong Sun, Siyuan Zhang, Liyuan Wang, Jun Zhu, Hang Su, Yi Zhong · 10. Februar 2026

  Large Language Models (LLMs) often incur an alignment tax: safety post-training can reduce general utility (e.g., reasoning and coding). We argue that this tax primarily arises from continual-learning-style forgetting in sequential alignment, where distribution shift and conflicting objectives cause…

• When Evaluation Becomes a Side Channel: Regime Leakage and Structural Mitigations for Alignment Assessment

  Igor Santos-Grueiro · 10. Februar 2026

  Safety evaluation for advanced AI systems implicitly assumes that behavior observed under evaluation is predictive of behavior in deployment. This assumption becomes fragile for agents with situational awareness, which may exploitregime leakage-informational cues distinguishing evaluation from deplo…

• CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution

  Minbeom Kim, Mihir Parmar, Phillip Wallis, Lesly Miculicich, Kyomin Jung, Krishnamurthy Dj Dvijotham, Long T. Le, Tomas Pfister · 10. Februar 2026

  AI agents equipped with tool-calling capabilities are susceptible to Indirect Prompt Injection (IPI) attacks. In this attack scenario, malicious commands hidden within untrusted content trick the agent into performing unauthorized actions. Existing defenses can reduce attack success but often suffer…

• Sparse Models, Sparse Safety: Unsafe Routes in Mixture-of-Experts LLMs

  Yukun Jiang, Hai Huang, Mingjie Li, Yage Zhang, Michael Backes, Yang Zhang · 10. Februar 2026

  By introducing routers to selectively activate experts in Transformer layers, the mixture-of-experts (MoE) architecture significantly reduces computational costs in large language models (LLMs) while maintaining competitive performance, especially for models with massive parameters. However, prior w…

• TruthPrInt: Mitigating Large Vision-Language Models Object Hallucination Via Latent Truthful-Guided Pre-Intervention

  Jinhao Duan, Fei Kong, Hao Cheng, James Diffenderfer, Bhavya Kailkhura, Lichao Sun, Xiaofeng Zhu, Xiaoshuang Shi, Kaidi Xu · 10. Februar 2026

  Object Hallucination (OH) has been acknowledged as one of the major trustworthy challenges in Large Vision-Language Models (LVLMs). Recent advancements in Large Language Models (LLMs) indicate that internal states, such as hidden states, encode the "overall truthfulness" of generated responses. Howe…