ICML 2025 accepted papers on Adversarial robustness and security
89 of the 3,342 papers accepted at ICML 2025 (2.7%) are on Adversarial robustness and security, compared with 2.5% at ICML 2024. They fall into 4 topics.
See ICML 2025 in the interactive map
Working on something in this area? Describe your idea in scime atlas to see the closest accepted papers by meaning and how crowded the spot has become.
Topics and papers
Attacks on text and graphs · 37 papers
- AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs (4 citations)
- Optimizing Adaptive Attacks against Watermarks for Language Models (2 citations)
- AutoAdvExBench: Benchmarking Autonomous Exploitation of Adversarial Example Defenses (1 citation)
- ExpProof : Operationalizing Explanations for Confidential Models with ZKPs (1 citation)
- Adversarial Cooperative Rationalization: The Risk of Spurious Correlations in Even Clean Datasets
- An Interpretable N-gram Perplexity Threat Model for Large Language Model Jailbreaks
- CAT: Contrastive Adversarial Training for Evaluating the Robustness of Protective Perturbations in Latent Diffusion Models
- Defending LVLMs Against Vision Attacks Through Partial-Perception Supervision
- Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
- Fragments to Facts: Partial-Information Fragment Inference from LLMs
- Gandalf the Red: Adaptive Security for LLMs
- MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents
and 25 more in the interactive map.
Certified and empirical robustness · 33 papers
- Guardians of Image Quality: Benchmarking Defenses Against Adversarial Attacks on Image Quality Metrics (1 citation)
- Adapting to Evolving Adversaries with Regularized Continual Robust Training
- Adversarial Inputs for Linear Algebra Backends
- Adversarial Robustness in Two-Stage Learning-to-Defer: Algorithms and Guarantees
- Average Certified Radius is a Poor Metric for Randomized Smoothing
- Efficient Robust Conformal Prediction via Lipschitz-Bounded Networks
- Enhancing Adversarial Robustness with Conformal Prediction: A Framework for Guaranteed Model Reliability
- Explaining the role of Intrinsic Dimensionality in Adversarial Training
- Identifying and Understanding Cross-Class Features in Adversarial Training
- LEVIS: Large Exact Verifiable Input Spaces for Neural Networks
- No Soundness in the Real World: On the Challenges of the Verification of Deployed Neural Networks
- On the Clean Generalization and Robust Overfitting in Adversarial Training from Two Theoretical Views: Representation Complexity and Training Dynamics
and 21 more in the interactive map.
Backdoor and poisoning · 10 papers
- Adversarial Inception Backdoor Attacks against Reinforcement Learning
- Circumventing Backdoor Space via Weight Symmetry
- CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularization
- Does Low Rank Adaptation Lead to Lower Robustness against Training-Time Attacks?
- ICLShield: Exploring and Mitigating In-Context Learning Backdoor Attacks
- Test-Time Multimodal Backdoor Detection by Contrastive Prompting
- The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
- A Closer Look at Backdoor Attacks on CLIP
- Backdoor Attacks in Token Selection of Attention Mechanism
- Bi-perspective Splitting Defense: Achieving Clean-Seed-Free Backdoor Security
Black-box and transfer attacks · 9 papers
- AdvAgent: Controllable Blackbox Red-teaming on Web Agents (1 citation)
- Black-Box Adversarial Attacks on LLM-Based Code Completion (1 citation)
- Understanding Model Ensemble in Transferable Adversarial Attack
- X-Transfer Attacks: Towards Super Transferable Adversarial Attacks on CLIP
- Adversarial Perturbations Are Formed by Iteratively Learning Linear Combinations of the Right Singular Vectors of the Adversarial Jacobian
- Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition
- Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
- ROME is Forged in Adversity: Robust Distilled Datasets via Information Bottleneck
- TtBA: Two-third Bridge Approach for Decision-Based Adversarial Attack