Adversarial Robustness in Machine Learning

Neueste Paper

• Multi-Channel Spread-Spectrum Code Watermarking

  Soohyeon Choi, Debin Gao, Yue Duan · 8. Juli 2026

  Attributing code to the large language model that produced it is essential for provenance, licensing, and misuse accountability, yet no deployed watermark meets this need. Generation-time schemes require access to the producing model and cannot be applied to third-party code, while post-hoc schemes …

• Full-range Binary Classifier Calibration for Stable Model Updates in Production

  Konstantin Berlin · 8. Juli 2026

  Detection models running in adversarial environments face a malicious distribution that drifts rapidly while the benign distribution stays comparatively stable, so teams retrain and redeploy constantly to stay ahead of new threats. Retraining tends to change the output prediction scores, which break…

• Higher-Order Certified Robustness for Regression

  Jie Zhang, Natalie Frank · 8. Juli 2026

  Randomized smoothing has emerged as a scalable technique for certifying the adversarial robustness of classifiers. However, its application to regression remains under-explored and faces unique challenges. Existing regression certificates rely on probabilistic acceptance regions and fail to exploit …

• Evaluating calibrated refusal and safe usefulness in dual-use biology settings

  Edwin H. Wintermute, Harmon Bhasin, Christina M. Agapakis, Dianzhuo Wang, Evan Seeyave, Arjun Banerjee, Daniel Fulop, Matthew C. Watson, Adam J. Meyer, Sandrine Boissel, Jens H. Kuhn, Rishi Jain, Noah D. Taylor, Helena Shomar, Patrick M. Boyle, Kenny Workman · 8. Juli 2026

  As AI agents are incorporated into life science workflows, the capabilities that speed discovery might also enable misuse. We present BioSecBench-Refusal, a benchmark for risk identification and refusal behavior for biological research tasks. The benchmark pairs 61 Routine tasks, legitimate analyses…

• Empirical Minimal-Realisation Compression of Deep Neural Networks via Controllability-Observability Tests

  Anis Hamadouche, Amir Hussain · 8. Juli 2026

  Deep neural networks often contain substantial hidden-state redundancy, but most compression methods operate directly on weights, neurons, or quantised representations without explicitly characterising the dynamical role of internal states. This paper proposes a controllability-observability framewo…

• RoME: Robust Mixture of Low-Rank Experts against Multiple Adversarial Perturbations

  Woo Jae Kim, Kyle Min, Suhyeon Ha, Joonsung Jeon, Sung-eui Yoon · 8. Juli 2026

  Multi-perturbation adversarial training (MAT) aims to achieve robustness against multiple $\ell_p$ perturbations but suffers from robustness trade-offs between different threats. To address this, we employ a mixture of experts (MoE) to route different threats through distinct model pathways. However…

• PolicyShiftGuard: Benchmarking and Improving Policy-Adaptive Image Guardrails

  Mingyang Song, Luxin Xu, Haoyu Sun, Minzhou Pan, Yu Cheng, Bo Li · 8. Juli 2026

  Image guardrails are typically trained and evaluated under a fixed safety policy, implicitly treating safety as an intrinsic property of an image. Real deployments are different: the same image may be allowed in one product, restricted in another, and newly disallowed when a policy boundary changes.…

• AirflowAttack: Thermal-Airflow Adversarial Perturbations against Infrared Remote-Sensing Vision-Language Models

  Cong Su, Jiaju Han, Xuemeng Sun, Chengyin Hu, Qike Zhang, Jiujiang Guo, Yiwei Wei, Jiahuan Long · 8. Juli 2026

  Vision-language models (VLMs) are increasingly deployed on infrared (IR) remote sensing imagery in security-critical settings, yet their adversarial robustness remains unexamined. We present AirflowAttack, to our knowledge the first adversarial attack for IR remote-sensing VLMs and the first to weap…

• Statistical Adversaries: Natural Backdoor-like Features in Vision Datasets

  Paul K. Mandal, Pavan Reddy, Tristan Malatynski · 8. Juli 2026

  Model-specific adversarial attacks have been extensively studied. We study a different failure mode: naturally occurring statistical signals in vision data that can behave like backdoor-like triggers without being maliciously inserted. We call these signals statistical adversaries. We analyse Imagen…

• Assessing the Operational Impact of Poisoning Attacks over Augmented 3D Point Cloud Public Datasets for Connected and Autonomous Vehicles

  Marwan Lazrag, Badis Hammi, Lorena Gonzalez-Manzano, Joaquin Garcia-Alfaro · 8. Juli 2026

  Poisoning attacks against public datasets lead to major concerns, such as (i) misclassification of perceived objects when the poisoned data is used for training and (ii) embedding of backdoors that may eventually be triggered later on, when specific conditions in the system apply over the learned mo…

• Auditing of Unlearning Algorithms

  Sahasrajit Sarmasarkar, Anastasia Koloskova, Sanmi Koyejo · 8. Juli 2026

  Evaluating whether unlearning algorithms truly remove training data influence remains an open challenge. We propose a practical auditor that computes data-dependent lower bounds on the unlearning parameter $\varepsilon$ using membership inference attacks. Evaluating multiple unlearning algorithms, w…

• AdaStop: Cost-Aware Early Stopping for DNN Test Selection

  Bonan Shen, Wei-Jung Huang, Xin Liu, Jiazhou Gao, Tao Ning · 8. Juli 2026

  Existing methods for testing deep neural networks (DNNs) primarily prioritize test inputs likely to reveal model faults under a fixed labeling budget. In practice, choosing that budget is difficult: too little testing misses failures, while too much incurs unnecessary labeling costs. This work studi…

• DT-Guard: Intent-Driven Reasoning-Active Training for Reasoning-Free LLM Safety Guardrail

  He Liu, Changtao Miao, Xinjie Yang, Tianle Song, Yin Wu, Junchi Chen, Bintao He, Xinyuan Zhang, Bo Zhang, Shi Yan, Wei Lu, Wei Wang, Danyang Xu, Jiansheng Cai, Zhe Li · 8. Juli 2026

  Large language models deployed in open-world applications require safety guardrails that are both robust to complex risks and efficient enough for low-latency runtime moderation. Existing guardrails face a practical trade-off between lightweight classification-based models, which are efficient but o…

• LLM-Guided Measurement Credibility Correction for Trustworthy Industrial Process Inference

  Youcheng Zong, Runda Jia, Dakuo He · 8. Juli 2026

  Industrial prediction and soft sensing depend on credible input measurements. In field deployment, a predictor may receive biased, delayed, stale, or derived measurements that still look plausible. Prediction can then fail before the forecasting backbone becomes the main limitation, because the inpu…

• Two Sides of the Same Coin: Learning the Backdoor to Remove the Backdoor

  Qi Zhao, Christian Wressnegger · 8. Juli 2026

  The community has recently developed various training-time defenses to counter neural backdoors introduced through data poisoning. In light of the observation that a model learns poisonous samples responsible for the backdoor easier than benign samples, these approaches either use a fixed threshold …

• SeeMe: Mitigating Hallucinations in Large Vision-Language Models through Effective Visual Token Engineering

  Kai Tang, Jinhao You, Bohua Zhang, Yichen Guo, Yiding Sun, Dongxu Zhang, Chenxi Li, Xiande Huang, Shanghang Zhang · 7. Juli 2026

  Large Vision-Language Models (LVLMs) have achieved remarkable progress in visual understanding tasks such as image captioning and visual question answering. However, they remain susceptible to hallucinations, generating content that is inconsistent with the actual visual input. Existing methods prim…

• One Framework for All: Cross-Modal Membership Inference for Generative Models

  Dayong Ye, Tainqing Zhu, Kun Gao, Junhao Liu, Yichuan Chen, Shuai Zhou, Hengzhu Liu, Bo Liu, Wanlei Zhou · 7. Juli 2026

  Large generative models across text-to-text, text-to-image, and image-to-text modalities have been shown to pose significant privacy risks. One fundamental threat is membership inference attacks (MIA), which aim to determine whether a given data point was used in a model's training set. Although pri…

• Learning Only What Valid Adapters Can Express: Subspace-Constrained Adaptation Against Fine-Tuning Poisoning

  Fabien Polly · 7. Juli 2026

  Parameter-efficient fine-tuning still leaves a broad space of behavior-changing updates reachable, so a poisoned objective can be represented and optimized. We study an alternative: adaptation constrained to the subspace estimated from a trusted pool of existing task adapters. On flan-t5-large with …

• Open Problems in AI Incident Governance

  Harleen Kaur Sidhu, Rebecca Scholefield, Nour Annan, Kevin Hernandez, Isabel Nieh Hou, Abdulrahman Alshaikhi, Ze Shen Chin, Rokas Gipi\v{s}kis · 7. Juli 2026

  AI systems may produce failures after deployment that pre-deployment safety assessments do not anticipate. Managing these failures requires what we refer to as adequate \textit{AI incident governance}, where having good definitions, taxonomies, monitoring practices, reporting mechanisms, and inciden…

• Qantara: Bridge-Flow Training for Multi-Paradigm JEPA Control

  Ruslan Rakhimov, George Bredis, Yuriy Maksyuta, Daniil Gavrilov · 7. Juli 2026

  Joint-Embedding Predictive Architectures (JEPAs) underpin a growing family of latent world models for control from raw pixels, but every existing JEPA world model commits at training time to a single inference paradigm: either trajectory optimisation in a learned dynamics model, or direct behaviour …

• An Axiomatic Assessment of Entropy- and Variance-based Uncertainty Quantification in Regression

  Christopher B\"ulte, Yusuf Sale, Timo L\"ohr, Paul Hofman, Gitta Kutyniok, Eyke H\"ullermeier · 7. Juli 2026

  Uncertainty quantification is crucial in machine learning, yet most (axiomatic) studies of uncertainty measures focus on classification, leaving a gap in regression settings with limited formal justification and evaluations. In this work, we provide a formal way of representing uncertainty in contin…

• Robustness Meets Uncertainty: Evidential Adversarial Training for Robust Selective Classification

  Nicolas Sournac, Ahmed Baha Ben Jmaa, Bertrand Braeckeveldt · 7. Juli 2026

  Safety-critical applications require classifiers that are both robust and reliable. Adversarial training is a widely adopted defense for improving robustness in deep neural networks; however, its effect on the reliability of predictive uncertainty remains underexplored. We investigate this gap throu…

• Don't Make Models Guess Security and Safety: Symbolic Guardrails for Domain-Specific AI Agents

  Yining Hong, Yining She, Eunsuk Kang, Christopher S. Timperley, Christian K\"astner · 7. Juli 2026

  There is increasing interest in integrating AI agents that invoke tools into domain-specific commercial software, where unintended tool calls can cause serious security and safety incidents. This has drawn growing research attention, and many agent security and safety benchmarks have emerged. They i…

• Covert Trait Propagation Is Representation Alignment: Mechanistic Evidence from Hidden-Channel Distillation

  Kargi Chauhan, Aditya Shah · 7. Juli 2026

  A student model trained on pure uniform noise can still inherit its teacher's digit-classification ability, provided the two share initialization. Previous work proves this transfer is guaranteed when the teacher's learning rate is small enough, but does not explain where in the network the channel …

• Integrating Physics-Informed Neural Networks for Safe Reinforcement Learning in a 1-DoF Helicopter System

  Georg Sch\"afer, Jakob Rehrl, Stefan Huber · 7. Juli 2026

  Deep reinforcement learning (DRL) offers powerful control for industrial cyber-physical systems (ICPSs), but its "black-box" exploration risks violating strict hardware safety limits. Typically, these constraints are managed through complex reward shaping. In this work-in-progress paper, we embed a …