ICLR 2026 accepted papers on Adversarial robustness and security
104 of the 5,358 papers accepted at ICLR 2026 (1.9%) are on Adversarial robustness and security, compared with 2.6% at ICLR 2025. They fall into 4 topics.
See ICLR 2026 in the interactive map
Working on something in this area? Describe your idea in scime atlas to see the closest accepted papers by meaning and how crowded the spot has become.
Topics and papers
Attacks on text and graphs · 54 papers
- Watermark-based Attribution of AI-Generated Content (6 citations)
- A2D: Any-Order, Any-Step Safety Alignment for Diffusion Language Models
- Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols
- Adversarial Attacks Already Tell the Answer: Directional Bias-Guided Test-time Defense for Vision-Language Models
- Any-Depth Alignment: Unlocking Innate Safety Alignment of LLMs to Any-Depth
- ARMs: Adaptive Red-Teaming Agent against Multimodal Models with Plug-and-Play Attacks
- ATEX-CF: Attack-Informed Counterfactual Explanations for Graph Neural Networks
- Concept-based Adversarial Attack: a Probabilistic Perspective
- Discrete Latent Features Ablate Adversarial Attack: A Robust Prompt Tuning Framework for VLMs
- Dyslexify: A Mechanistic Defense Against Typographic Attacks in CLIP
- Fine-Grained Iterative Adversarial Attacks with Limited Computation Budget
- Harnessing Hyperbolic Geometry for Harmful Prompt Detection and Sanitization
and 42 more in the interactive map.
Certified and empirical robustness · 30 papers
- Adversarially Pretrained Transformers may be Universally Robust In-Context Learners
- AEGIS: Adversarial Target–Guided Retention-Data-Free Robust Concept Erasure from Diffusion Models
- Counterfactual Explanations on Robust Perceptual Geodesics
- DRIFT: Divergent Response in Filtered Transformations for Robust Adversarial Defense
- Dual Randomized Smoothing: Beyond Global Noise Variance
- Exposing and Defending the Achilles' Heel of Video Mixture-of-Experts
- Fingerprinting Deep Neural Networks for Ownership Protection: An Analytical Approach
- LipNeXt: Scaling up Lipschitz-based Certified Robustness to Billion-parameter Models
- Noise Tolerance of Distributionally Robust Learning
- On the Interaction of Compressibility and Adversarial Robustness
- On the Tension Between Optimality and Adversarial Robustness in Policy Optimization
- Perturbation-Induced Linearization: Constructing Unlearnable Data with Solely Linear Classifiers
and 18 more in the interactive map.
Backdoor and poisoning · 14 papers
- Reliable Poisoned Sample Detection against Backdoor Attacks Enhanced by Sharpness Aware Minimization (1 citation)
- BEAT: Visual Backdoor Attacks on VLM-based Embodied Agents via Contrastive Trigger Learning
- Beware Untrusted Simulators -- Reward-Free Backdoor Attacks in Reinforcement Learning
- Defending against Backdoor Attacks via Module Switching
- Ghost in the Cloud: Your Geo-Distributed Large Language Models Training is Easily Manipulated
- Obfuscated Activations Bypass LLM Latent-Space Defenses
- Purifying Generative LLMs from Backdoors without Prior Knowledge or Clean Reference
- TrojanTO: Action-Level Backdoor Attacks Against Trajectory Optimization Models
- Unmasking Backdoors: An Explainable Defense via Gradient-Attention Anomaly Scoring for Pre-trained Language Models
- DiffuGuard: How Intrinsic Safety is Lost and Found in Diffusion Large Language Models
- Don't Shift the Trigger: Robust Gradient Ascent for Backdoor Unlearning
- Mitigating Safety Fallback in Editing-based Backdoor Injection on LLMs
and 2 more in the interactive map.
Black-box and transfer attacks · 6 papers
- Black-Box Privacy Attacks on Shared Representations in Multitask Learning
- Improving Black-Box Generative Attacks via Generator Semantic Consistency
- Jailbreak Transferability Emerges from Shared Representations
- A General Framework for Black-Box Attacks Under Cost Asymmetry
- SeRI: Gradient-Free Sensitive Region Identification in Decision-Based Black-Box Attacks
- Untraceable DeepFakes via Traceable Fingerprint Elimination