NeurIPS 2025 accepted papers on Adversarial robustness and security
99 of the 5,812 papers accepted at NeurIPS 2025 (1.7%) are on Adversarial robustness and security, compared with 2.2% at NeurIPS 2024. They fall into 4 topics.
See NeurIPS 2025 in the interactive map
Working on something in this area? Describe your idea in scime atlas to see the closest accepted papers by meaning and how crowded the spot has become.
Topics and papers
Attacks on text and graphs · 56 papers
- Adversarial Paraphrasing: A Universal Attack for Humanizing AI-Generated Text (2 citations)
- Erasing Conceptual Knowledge from Language Models (1 citation)
- GASP: Efficient Black-Box Generation of Adversarial Suffixes for Jailbreaking LLMs (1 citation)
- LLM Unlearning via Neural Activation Redirection (1 citation)
- Mitigating Sexual Content Generation via Embedding Distortion in Text-conditioned Diffusion Models (1 citation)
- Provable Watermarking for Data Poisoning Attacks (1 citation)
- ReliabilityRAG: Effective and Provably Robust Defense for RAG-based Web-Search (1 citation)
- Robust SuperAlignment: Weak-to-Strong Robustness Generalization for Vision-Language Models (1 citation)
- The Fluorescent Veil: A Stealthy and Effective Physical Adversarial Patch Against Traffic Sign Recognition (1 citation)
- The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defense (1 citation)
- Unlearned but Not Forgotten: Data Extraction after Exact Unlearning in LLM (1 citation)
- What Really is a Member? Discrediting Membership Inference via Poisoning (1 citation)
and 44 more in the interactive map.
Certified and empirical robustness · 17 papers
- Breaking Latent Prior Bias in Detectors for Generalizable AIGC Image Detection (2 citations)
- LORE: Lagrangian-Optimized Robust Embeddings for Visual Encoders (1 citation)
- Vanish into Thin Air: Cross-prompt Universal Adversarial Attacks for SAM2 (1 citation)
- AdaptDel: Adaptable Deletion Rate Randomized Smoothing for Certified Robustness
- Adversarial generalization of unfolding (model-based) networks
- Adversarial Robustness of Nonparametric Regression
- Adversary Aware Optimization for Robust Defense
- Bridging Symmetry and Robustness: On the Role of Equivariance in Enhancing Adversarial Robustness
- Distributional Adversarial Attacks and Training in Deep Hedging
- Dynamical Low-Rank Compression of Neural Networks with Robustness under Adversarial Attacks
- Harnessing the Computation Redundancy in ViTs to Boost Adversarial Transferability
- Kernel Learning with Adversarial Features: Numerical Efficiency and Adaptive Regularization
and 5 more in the interactive map.
Backdoor and poisoning · 13 papers
- BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models (3 citations)
- BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization (3 citations)
- Temporal Logic-Based Multi-Vehicle Backdoor Attacks against Offline RL Agents in End-to-end Autonomous Driving (2 citations)
- A Set of Generalized Components to Achieve Effective Poison-only Clean-label Backdoor Attacks with Collaborative Sample Selection and Triggers (1 citation)
- Backdoor Mitigation via Invertible Pruning Masks (1 citation)
- BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model (1 citation)
- Defending Multimodal Backdoored Models by Repulsive Visual Prompt Tuning (1 citation)
- ICLScan: Detecting Backdoors in Black-Box Large Language Models via Targeted In-context Illumination
- LoSplit: Loss-Guided Dynamic Split for Training-Time Defense Against Graph Backdoor Attacks
- RepGuard: Adaptive Feature Decoupling for Robust Backdoor Defense in Large Language Models
- SNEAKDOOR: Stealthy Backdoor Attacks against Distribution Matching-based Dataset Condensation
- Taught Well Learned Ill: Towards Distillation-conditional Backdoor Attack
and 1 more in the interactive map.
Black-box and transfer attacks · 13 papers
- A Frustratingly Simple Yet Highly Effective Attack Baseline: Over 90% Success Rate Against the Strong Black-box Models of GPT-4.5/4o/o1 (2 citations)
- Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignment
- Black-Box Membership Inference Attack for LVLMs via Prior Knowledge-Calibrated Memory Probing
- Boosting Adversarial Transferability with Spatial Adversarial Alignment
- Boosting the Uniqueness of Neural Networks Fingerprints with Informative Triggers
- BridgePure: Limited Protection Leakage Can Break Black-Box Data Protection
- Consensus-Robust Transfer Attacks via Parameter and Representation Perturbations
- Dual-Flow: Transferable Multi-Target, Instance-Agnostic Attacks via $\textit{In-the-wild}$ Cascading Flow Optimization
- ErrorTrace: A Black-Box Traceability Mechanism Based on Model Family Error Space
- Interpreting Emergent Features in Deep Learning-based Side-channel Analysis
- The Cost of Compression: Tight Quadratic Black-Box Attacks on Sketches for $\ell_2$ Norm Estimation
- Towards Building Model/Prompt-Transferable Attackers against Large Vision-Language Models
and 1 more in the interactive map.