Adversarial Robustness in Machine Learning

Neueste Paper

• Localized Conformal Prediction for Image Classification with Vision-Language Models

  Cl\'ement Fuchs, Tim Bary, Beno\^it Macq · 1. Juli 2026

  Conformal predictions have attracted significant attention in the field of uncertainty quantification, mainly because of their strong marginal coverage guarantees. Full conditional guarantee is not an attainable goal, a well known fact in conformal predictions literature. As a result, several approa…

• Review Residuals: Update-Conditioned Residual Gating for Transformers

  Kyle Kramer · 1. Juli 2026

  Residual connections add every sublayer's proposed update with a fixed coefficient of one; the network never evaluates whether an update is reliable before committing it. Drawing on the human-factors principle of independent verification, we introduce Review Residuals, which scale each update by a l…

• ShardNet: Training Neural Controllers with Hard, Non-Convex Constraints

  Long Kiu Chung, Shreyas Kousik · 1. Juli 2026

  While neural network control policies are powerful, their deployment on safety critical systems depends on ensuring that they obey strict constraints. Existing work often treats safety as a metric to optimize for, which competes with other performance objectives, if training converges at all. Instea…

• Harnessing Textual Refusal Directions for Multimodal Safety

  Moreno D'Inc\`a, Massimiliano Mancini, Nicu Sebe · 1. Juli 2026

  To improve safety in Large Language Models (LLMs) we can either perform post-training alignment or exploit refusal directions in the activation space. Both strategies are less feasible in Multimodal LLMs (MLLMs) as they require unsafe multimodal data, harder to collect than their unimodal counterpar…

• Addressing Over-Refusal in LLMs with Competing Rewards

  Taeyoun Kim, Aviral Kumar · 1. Juli 2026

  Safety training on language models often induces over-refusal: improved safety on harmful prompts at the cost of increased refusal on harmless ones. Though this trade-off can be mitigated by training models with reinforcement learning (RL) to reason before answering, it does not remove the underlyin…

• On Optimal Data Splitting for Split Conformal Prediction

  Sayan Das, Bahram Yaghooti, Todd A. Kuffner, Soumendra N. Lahiri · 1. Juli 2026

  Conformal prediction and its variants, including the split conformal prediction, provide a distribution-free framework for uncertainty quantification by constructing prediction intervals or sets with finite-sample coverage guarantees. The statistical efficiency of these intervals depends critically …

• Certified Speculative Execution for Untrusted AI Agents

  Chenyu Zhou, Qiliang Jiang, Shuning Wu, Xu Zhou · 1. Juli 2026

  Hard-constrained sequential decision systems have no certified way to spend the test-time compute of modern AI: executing the multi-step drafts of a learned policy or a frozen LLM forfeits the feasibility guarantee a trusted solver provides, while invoking the solver at every step forfeits the speed…

• Signed-Permutation Coordinate Transport for RMSNorm Transformers

  John Sweeney · 1. Juli 2026

  Modern LLM workflows move coordinate-indexed objects across checkpoints: steering vectors, sparse autoencoders, top-$k$ neuron sets, attribution lists, and merge alignments. This is only well posed after fixing the model's residual-stream gauge, which we show is architecture-dependent: LayerNorm res…

• CSO-LLM: Class Subspace Orthogonalization for Post-Training Backdoor Detection and Trigger Inversion in LLMs

  Zhengxing Li, David J. Miller, Guangmingmei Yang, George Kesidis · 1. Juli 2026

  While post-training backdoor detection and trigger inversion schemes have been developed for AIs used e.g. for images, there is a paucity of such methods for LLMs. First, the LLM input space is discrete, with up to 150,000^k k-tuples to consider with k the token-length of a putative trigger. Second,…

• Improving Certified Robustness via Adversarial Distillation

  Matteo Melis, Jesus Martinez Del Rincon, Vishal Sharma · 1. Juli 2026

  Certified training aims to produce models whose predictions can be formally verified against adversarial perturbations, typically by optimising upper bounds on the worst-case loss over an allowed perturbation set. For neural networks, certified training methods based purely on tight relaxation bound…

• Robustness of neural networks to random noise perturbations of their inputs

  Mark Levene, Martyn Harris · 1. Juli 2026

  We investigate the problem of the robustness of a trained neural network to the perturbation of its input values. More specifically, we examine the interplay between the accuracy of the network, as measured by the mean squared error, and robustness. Accordingly, we present a robustness measure, whic…

• Amplifying Membership Signal Through Chained Regeneration

  Wojciech {\L}apacz, Stanis{\l}aw Pawlak · 1. Juli 2026

  The tendency of large generative models to memorize training data makes sample verification critical for privacy auditing and copyright enforcement. Current membership (MIA) and dataset inference (DI) attacks often rely on one-shot generations, which yield weak signals and limited sensitivity across…

• Accelerating Conformal Prediction via Approximate Leave-One-Out

  Jiachen Cong, Jingbo Liu · 1. Juli 2026

  While conformal prediction provides a general framework for uncertainty quantification in predictive inference, its application is often limited by computational cost. Recent methods, including Jackknife+ and Jackknife-minmax, achieve faster computation by trading a slight loss of efficiency relativ…

• The Label Imitation Game: Turing Test Network for Zero-Shot Pseudo-Label Pruning

  Brent A. Griffin, Jason J. Corso · 1. Juli 2026

  Foundation model pseudo-labeling - labeling data strictly via zero-shot inference - enables massive scale, but performance is undermined by hallucinations that evade standard thresholds. To eliminate these errors, we introduce the Turing-inspired Label Imitation Game (LIG), a framework that formaliz…

• Curvature-Guided Module Localization for Low-Rank Detoxification of Backdoored Large Language Models

  Arash Raftari, Mehrdad Mahdavi, Nathan Blackthorn, Andrew Arash Mahyari · 1. Juli 2026

  Backdoor attacks pose a serious threat to large language models (LLMs) by causing otherwise benign systems to produce attacker-specified malicious behavior when a hidden trigger is present. In this work, we study post hoc detoxification of backdoored LLMs in a practical setting where the defender ha…

• Revealing Safety-Critical Scenarios for UTM via Transformer

  Huaze Tang, Bill Zeng, Chao Wang, Zhenpeng Shi, Qian Zhang, Wenbo Ding · 1. Juli 2026

  Unmanned Traffic Management (UTM) systems are cloud-based platforms designed to manage and coordinate multiple aerial vehicles remotely. UTM systems are safety-critical which cannot tolerate failures like crash or collision. To reveal latent vulnerabilities, there are neither optimal failure-exposin…

• A Novel Latent-Class Attack and its Detection by Class Subspace Orthogonalization

  Guangmingmei Yang, David J. Miller, George Kesidis · 30. Juni 2026

  Deep learning, which in general relies on voluminous amounts of training data, is vulnerable to data poisoning attacks, including error-generic attacks and backdoors (Trojans). In this work, we propose a new data poisoning attack we dub a latent class attack. Here, all poisoned examples are from a c…

• The Calibrated Deepfake Trust Score (CDTS): Competence-Coupled Trust Degradation Across Deepfake Detectors

  Md Anas Biswas · 30. Juni 2026

  Modern deepfake detectors are rarely consumed as bare classifiers. In moderation, provenance, and verification pipelines their output probability is read as a degree of trust, so its calibration matters as much as raw accuracy. We reframe deepfake detection as a calibrated, self-auditing trust instr…

• SEVA: Self-Evolving Verification Agent with Process Reward for Fact Attribution

  Aojie Yuan, Yi Nian, Haiyue Zhang, Zijian Su, Yue Zhao · 30. Juni 2026

  Hallucination is the reliability bottleneck for LLM-based agents, and fact attribution verifiers are the last line of defense -- yet today's verifiers emit only opaque binary labels, leaving agents unable to self-correct and operators unable to audit. We present SEVA, a structured verification agent…

• Attribution Graphs and Causal Probing for Mechanistic Discovery and Bias Repair in Multimodal Generative Learning

  Noor Islam S. Mohammad, Ulu\u{g} Bayaz{\i}t · 30. Juni 2026

  We treat the internals of generative models as mechanistic objects rather than black boxes. We introduce \textbf{Attribution Graphs} (AGs), which extend GradCAM++ to circuit-level representations, and \textbf{Causal Probing}, a do-calculus intervention method for identifying causal latent structures…

• Solver-Integrated Adversarial Attacking and Training of Neural Operators

  Yifei Sun · 30. Juni 2026

  Neural operators are commonly utilized as fast surrogates for numerical solvers in PDE problems, mapping input functions to solution functions. However, their generalizability and robustness are not yet clearly defined in the solver-surrogate setting, which differs from traditional adversarial robus…

• Proofs of Ownership for Machine Learning Models

  Ran Canetti, Shafi Goldwasser, Or Zamir · 30. Juni 2026

  With the increasing adoption of Machine Learning, protecting model ownership has become an essential challenge. We initiate a formal study of Proof of Ownership for machine learning models: under what conditions can one prove that a stolen model originated from a particular creator? We model proofs …

• FlipGuard: Defending Large Language Models Against Quantization-Conditioned Backdoor Attacks

  Aoying Zheng, Anqi Du, Zizhuang Deng, Yuxuan Chen · 30. Juni 2026

  Model quantization is essential for the efficient deployment of Large Language Models (LLMs), but introduces a critical vulnerability: Quantization-Conditioned Backdoor (QCB) attacks. In these attacks, malicious behaviors remain dormant in full-precision models and activate only after specific quant…

• LoRAShield: Data-Free Editing Alignment for Secure Personalized LoRA Sharing

  Jiahao Chen, Junhao Li, Yiming Wang, Yong Yang, Yi Jiang, Chunyi Zhou, Qingming Li, Tianyu Du, Shouling Ji · 30. Juni 2026

  The proliferation of Low-Rank Adaptation (LoRA) models has democratized personalized text-to-image generation, enabling users to share lightweight models (e.g., personal portraits) on platforms like Civitai and Liblib. However, this "share-and-play" ecosystem introduces critical risks: benign LoRAs …

• Theory of Continual Learning Against Data Poisoning Attacks

  Yiting Hu, Lingjie Duan · 30. Juni 2026

  Continual learning (CL), where a model is trained on a sequence of data tasks, is increasingly being adopted across key fields such as large language models and image recognition, yet it remains highly vulnerable to data poisoning that triggers learning divergence or severe excess risk. Despite thes…