Adversarial Robustness in Machine Learning

Últimos artículos

• Fast approximation and learning of binary classification tasks in o-minimal structures using ReLU neural networks

  Clemens Kinn, Philipp Petersen · 3 de julio de 2026

  We study binary classification problems whose decision sets are given by definable sets in o-minimal expansions of the real field. Motivated by cell decomposition of definable sets, we introduce traceable sets as a classical proxy for definable decision regions and analyze their approximation by ReL…

• Spec-AUF: Accept-Until-Fail Training under Train-Inference Misalignment for Masked Block Drafters

  Tianjian Yang, Meng Li · 3 de julio de 2026

  Speculative decoding accelerates autoregressive generation by drafting a block of tokens that the target model verifies left-to-right, committing only the longest accepted prefix. Block (DLM-style) drafters predict the whole block in parallel, which is fast but trained with a full-block cross-entrop…

• The Eticas AI Risk Taxonomy: Open Infrastructure for Operationalizing AI Audits

  Gemma Galdon Clavell, Pablo Accuosto, Usman Gohar · 3 de julio de 2026

  The rapid deployment of AI systems across high-stakes domains has created urgent demand for standardized evaluation, yet the field remains fragmented across competing risk taxonomies that catalog risks without showing how an audit is executed. At least 74 AI risk taxonomies exist, and almost all sto…

• ContraFix: Skill-Enhanced Contrastive Runtime Analysis for Vulnerability Repair

  Simiao Liu, Fang Liu, Peiding Wang, Taichuan Li, Yinghao Zhu, Xiaoli Lian, Li Zhang · 3 de julio de 2026

  As software systems grow increasingly complex, automated vulnerability repair (AVR) remains difficult because the materials available to a repair system are usually failure artifacts rather than repair guidance. Traditional analysis techniques can provide suspicious locations, reduced triggers, or c…

• DRL-CLBA: A Clean Label Backdoor Attack for Speech Classification via DDPG Reinforcement Learning

  Yueming Huang, Wenhan Yao, Fen Xiao, Xiarun Chen, Weiping Wen · 3 de julio de 2026

  Deep learning models for speech classification are vulnerable to backdoor attacks, where malicious triggers cause misclassification at inference time. While sample-specific attacks can bypass many defenses, they often rely on poisoned label attack, making them detectable via manual data defense. In …

• Behind the Refusal: Determining Guardrail Activation via Behavioral Monitoring

  William Hackett, Peter Garraghan · 3 de julio de 2026

  As Large Language Models (LLMs) and agentic systems become integrated into real-world applications, ensuring their safety and security is critical. Guardrail systems that detect and block malicious instructions sent to and from an LLM are an essential component of AI security. However, researchers c…

• OpenSafeIntent: Evaluating Intent-Calibrated Safe Completion Across Dual-Use Prompt Sets

  Rheeya Uppaal, Seungwoo Lyu, Selina Sung, Junjie Hu · 3 de julio de 2026

  Safe completion requires models to provide useful assistance without enabling harm, but this behavior is difficult to evaluate with isolated prompts. We introduce OpenSafeIntent, a benchmark of controlled prompt-sets that vary intent while holding the underlying task fixed. Each datapoint contains b…

• LACUNA: A Testbed for Evaluating Localization Precision for LLM Unlearning

  Matteo Boglioni, Thibault Rousset, Siva Reddy, Marius Mosbach, Verna Dankers · 3 de julio de 2026

  LLMs memorize sensitive training data, including personally identifiable information (PII), creating a pressing need for reliable post hoc removal methods. Unlearning has emerged as a promising solution, with state-of-the-art(SOTA) methods often following a localize-first, unlearn-second paradigm th…

• CPG-PAD: Concept-Informed Prompts Guided Presentation Attack Detection

  Haoyuan Zhang, Xiangyu Zhu, Li Gao, Ajian Liu, Siran Peng, Zhen Lei · 3 de julio de 2026

  Presentation Attack Detection (PAD) serves as a crucial safeguard for face recognition systems against presentation attacks such as printed photos, replayed videos, and 3D masks. Despite significant progress, existing PAD models still struggle to generalize across unseen domains due to variations in…

• kNNGuard: Turning LLM Hidden Activations into a Training-Free Configurable Guardrail

  Mahmoud Abdelfattah, Hamid Nasiri, Peter Garraghan · 3 de julio de 2026

  Large language models (LLMs) are increasingly deployed in domains requiring guardrails to detect unsafe, off-topic, or adversarial prompts. Existing guardrails predominately rely on fine-tuning to build classifiers, which often suffer from low generalization and high inference latency. We present kN…

• HaloGuard 1.0: An Open Weights Constitutional Classifier for Multilingual AI Safety

  Navaneeth Sangameswaran, Preetham S, Ashmiya Lenin · 3 de julio de 2026

  We present HaloGuard 1.0, an open-weights implementation of the constitutional-classifier paradigm for input safety. It achieves state-of-the-art performance on English and multilingual prompt-safety benchmarks at roughly one-tenth the model size of current leading open guard models. The safety cons…

• Rethinking Post-Hoc Calibration in Semantic Segmentation

  Tristan Kirscher (ICube), Kim-Celine Kahl (DKFZ), Balint Kovacs (DKFZ), Maximilian R. Rokuss (DKFZ), Klaus Maier-Hein (DKFZ), Xavier Coubez (ICube), Philippe Meyer (ICube), Sylvain Faisan (ICube) · 3 de julio de 2026

  Reliable confidence estimates are essential in semantic segmentation, especially in safety-critical settings where overconfident errors can mislead downstream decisions. Yet modern segmentation models often remain miscalibrated. Post-hoc calibration offers a practical way to correct confidence estim…

• Controllable Sim Agents with Behavior Latents

  Juanwu Lu, Junyu Zhu, Ziran Wang · 3 de julio de 2026

  Realistic traffic simulation requires agents that imitate logged behavior and can also be steered along interpretable axes. Such controllability enables engineers to isolate variables, reproduce specific edge cases, and test autonomous systems without real-world risk. We introduce Controllable Neura…

• Safety Targeted Embedding Exploit via Refinement

  Joshua Adrian Cahyono · 3 de julio de 2026

  Safety training for large language models (LLMs) is conducted predominantly in English, leaving uncertain how well safety mechanisms generalize to low-resource languages and mixed-language code-switching. We show that this creates an epistemic gap in which models confidently generate harmful respons…

• Beyond Gradient-Based Attacks: Adversarial Robustness and Explainability Stability in Cybersecurity Classifiers

  Mona Rajhans, Vishal Khawarey · 3 de julio de 2026

  Adversarial attacks on cybersecurity classifiers pose a dual threat: degrading predictions and destabilising the SHAP-based explanations that security analysts rely on to understand and triage alerts. We extend our prior MLP conference study to Random Forest and XGBoost across four tabular security …

• Online Safety Monitoring for LLMs

  Mona Schirmer, Metod Jazbec, Alexander Timans, Christian Naesseth, Maja Waldron, Eric Nalisnick · 3 de julio de 2026

  Despite alignment training, LLMs remain prone to generating unsafe outputs at deployment time. Monitoring outputs online and raising an alarm when safety can no longer be assumed is therefore critical. We study a simple real-time monitor that turns a verifier signal from an external model into an al…

• Predicting Closed-Loop Performance of Latent World Models: Offline Checkpoint Selection for MPC and Model-Based RL Under Non-Markovian Rewards in LunarLander

  Nikolai Smolyanskiy · 3 de julio de 2026

  We study how to predict the downstream closed-loop performance of a learned latent world model from validation-time diagnostics alone. Choosing the right checkpoint from a world-model training run is difficult: validation loss and multi-step prediction RMSE keep improving long after closed-loop perf…

• Pmeta-TLA: Backdoor Attacks for Speech Classification Models via Meta-Learning with Timbre Leakage Attack

  Yueming Huang, Wenhan Yao, Fen Xiao, Xiarun Chen, Weiping Wen · 3 de julio de 2026

  Recently, speech classification methods have gained widespread adoption in intelligent gadgets. Current study indicates that backdoor attacks provide a substantial security concern to these models, underscoring the pressing necessity to investigate additional potential attack techniques to expose an…

• HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignment

  Shei Pern Chua, Fangzhao Wu · 2 de julio de 2026

  Understanding how aligned LLMs internally represent safety is critical for diagnosing alignment vulnerabilities, as it explains why jailbreaks succeed and informs the design of robust alignment strategies. Prior work shows that aligned LLMs encode harmfulness and refusal as separable directions in t…

• The Illusion of High Utility in Safety Alignment of Text-to-Image Diffusion Models

  Adeel Yousaf, Soumik Ghosh, James Beetham, Amrit Singh Bedi, Mubarak Shah · 2 de julio de 2026

  Safety alignment of text-to-image (T2I) diffusion models aims to suppress harmful generations while preserving utility on benign prompts. Recent methods often appear to deliver high safety with high utility, but this conclusion rests largely on coarse global utility metrics (e.g., FID, CLIPScore) th…

• Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces

  Junlong Liu, Haobo Wang, Weiqi Luo, Xiaojun Jia · 2 de julio de 2026

  Jailbreak attacks remain a critical threat to the safe deployment of large language models (LLMs). While prior work has primarily studied attacks and defenses at the prompt level, we show that this prompt-centric paradigm overlooks a structural vulnerability in stateful, function-calling environment…

• FLAT: Revealing Hidden Latent-Conditioned Backdoor Failures in Federated Learning

  Tuan Nguyen, Sze Jue Yang, Khoa D. Doan, Chee Seng Chan, Kok-Seng Wong · 2 de julio de 2026

  Horizontal federated learning (HFL) backdoor audits often summarize model behavior through clean accuracy (CA), mean attack success rate (ASR), or a single known-trigger test. Such summaries can hide a different failure mode, in which one target label is activated by many trigger realizations. We st…

• Enhancing Hardware Fault Tolerance in Machines with Reinforcement Learning Policy Gradient Algorithms

  Sheila Schoepp, Mehran Taghian, Shotaro Miwa, Yoshihiro Mitsuka, Shadan Golestan, Osmar Za\"iane · 2 de julio de 2026

  Industry is moving toward autonomous, network-connected machines that detect and adapt to changing conditions, including hardware faults. Conventional fault-tolerant design duplicates hardware and reroutes control logic; reinforcement learning (RL) offers a learning-based alternative. This paper pre…

• Watermarking for Proprietary Dataset Protection

  John Kirchenbauer, Brian R. Bartoldson, Bhavya Kailkhura, Tom Goldstein · 2 de julio de 2026

  A growing body of literature suggests that training data membership inference problems are fundamentally hard tasks in modern language modeling settings. We argue that output watermarking techniques are the right gadget to make training membership tests for generative models more tractable, based on…

• Adversarial Pragmatics for AI Safety Evaluation: A Benchmark for Instruction Conflict, Embedded Commands, and Policy Ambiguity

  Brett Reynolds · 2 de julio de 2026

  Safety evaluations for language models increasingly depend on judgments about ambiguous natural-language behaviour: whether a model has followed an instruction, refused appropriately, complied with a policy, resisted an embedded command, or misreported progress in an agentic task. Existing benchmark…