ICLR 2025 accepted papers on Adversarial robustness and security

Attacks on text and graphs · 43 papers

• Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks (9 citations)
• Targeted Attack Improves Protection against Unauthorized Diffusion Customization (4 citations)
• Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI (3 citations)
• Robust LLM safeguarding via refusal feature adversarial training (2 citations)
• Adversarial Machine Unlearning (1 citation)
• Adversarial Search Engine Optimization for Large Language Models (1 citation)
• Data Taggants: Dataset Ownership Verification Via Harmless Targeted Data Poisoning (1 citation)
• Dissecting Adversarial Robustness of Multimodal LM Agents (1 citation)
• Jailbreaking as a Reward Misspecification Problem (1 citation)
• RobustKV: Defending Large Language Models against Jailbreak Attacks via KV Eviction (1 citation)
• Robustness Inspired Graph Backdoor Defense (1 citation)
• Adversarial Mixup Unlearning

and 31 more in the interactive map.

Certified and empirical robustness · 30 papers

• Speech Robust Bench: A Robustness Benchmark For Speech Recognition (6 citations)
• I Can Hear You: Selective Robust Training for Deepfake Audio Detection (3 citations)
• Democratic Training Against Universal Adversarial Perturbations (1 citation)
• Towards Certification of Uncertainty Calibration under Adversarial Attacks (1 citation)
• Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data
• Adversaries With Incentives: A Strategic Alternative to Adversarial Robustness
• Certified Robustness Under Bounded Levenshtein Distance
• Enhancing Robust Fairness via Confusional Spectral Regularization
• GSE: Group-wise Sparse and Explainable Adversarial Attacks
• Indirect Gradient Matching for Adversarial Robust Distillation
• Learning Randomized Algorithms with Transformers
• On the Adversarial Vulnerability of Label-Free Test-Time Adaptation

and 18 more in the interactive map.

Backdoor and poisoning · 14 papers

• Activation Gradient based Poisoned Sample Detection Against Backdoor Attacks (1 citation)
• Can We Trust Embodied Agents? Exploring Backdoor Attacks against Embodied LLM-Based Decision-Making Systems (1 citation)
• Protecting against simultaneous data poisoning attacks (1 citation)
• Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (1 citation)
• BadJudge: Backdoor Vulnerabilities of LLM-As-A-Judge
• Certifying Language Model Robustness with Fuzzed Randomized Smoothing: An Efficient Defense Against Backdoor Attacks
• Concept-ROT: Poisoning Concepts in Large Language Models with Model Editing
• Detecting Backdoor Samples in Contrastive Language Image Pretraining
• Injecting Universal Jailbreak Backdoors into LLMs in Minutes
• Mitigating the Backdoor Effect for Multi-Task Model Merging via Safety-Aware Subspace
• Probe before You Talk: Towards Black-box Defense against Backdoor Unalignment for Large Language Models
• REFINE: Inversion-Free Backdoor Defense via Model Reprogramming

and 2 more in the interactive map.

Black-box and transfer attacks · 10 papers

• Adversarial Attacks on Data Attribution (1 citation)
• A Transfer Attack to Image Watermarks
• Boosting Ray Search Procedure of Hard-label Attacks with Transfer-based Priors
• Confidence Elicitation: A New Attack Vector for Large Language Models
• TASAR: Transfer-based Attack on Skeletal Action Recognition
• Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy
• Dynamic Neural Fortresses: An Adaptive Shield for Model Extraction Defense
• GSBA$^K$: $top$-$K$ Geometric Score-based Black-box Attack
• Stealthy Shield Defense: A Conditional Mutual Information-Based Approach against Black-Box Model Inversion Attacks
• Training Robust Ensembles Requires Rethinking Lipschitz Continuity