NeurIPS 2026 accepted papers on Adversarial robustness and security
98 of the 6,080 papers accepted at NeurIPS 2026 (1.6%) are on Adversarial robustness and security, compared with 1.7% at NeurIPS 2025. They fall into 4 topics.
See NeurIPS 2026 in the interactive map
Working on something in this area? Describe your idea in scime atlas to see the closest accepted papers by meaning and how crowded the spot has become.
Topics and papers
Attacks on text and graphs · 47 papers
- Assessing Per-Sample Membership Inference Vulnerability without Retraining
- Asymmetric Invertible Threat: Learning Reversible Privacy Defense for Face Recognition
- Asymmetric Phase Coding Audio Watermarking
- Attack Selection In Agentic AI Control Evaluations Meaningfully Decreases Safety
- Claudini: Autoresearch Discovers State-of-the-Art Adversarial Attack Algorithms for LLMs
- Conceal, Reconstruct, Jailbreak: Exploiting the Reconstruction--Concealment Tradeoff in MLLMs
- DECEIVE-AFC: Adversarial Claim Attacks against Search-Enabled LLM-based Fact-Checking Systems
- Forced Deferral: Manipulating Routing Decisions in Multimodal LLM Cascades
- GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines
- Guaranteed Jailbreaking Defense via Disrupt-and-Rectify Smoothing
- Inadvertent Context Leakage in Language Models
- Jailbreak susceptibility prediction and mitigation via the behavioral geometry of models
and 35 more in the interactive map.
Certified and empirical robustness · 22 papers
- Benchmarking Sensor-Fault Robustness in Forecasting
- Clustered Randomized Smoothing for Stochastic Prediction Functions
- Halt Fast! Early Stopping for Certified Robustness
- Interpretable but Fragile? Robustness of Concept Bottlenecks under Geometric-Semantic Perturbations
- Learning Better Certified Models from Empirically-Robust Teachers
- RustMizan: A Compilable, Contamination-Aware Benchmarking Framework for Rust Vulnerabilities
- What Was That Again? Certified Robustness for Automatic Speech Recognition
- A Simple Class-Agnostic Approach to Enhance Fair Adversarial Training
- Adversarial Risk in the Generative AI Era Necessitates Dropping the Small Epsilon Ball
- Are Well-Trained Surrogates Optimal? Rethinking the Surrogate Role with Instability for Unlearnable Examples
- Certified Single-Level Reformulation for Tri-Level Cyber-Physical Grid Security
- Exploiting Fine-Tuning Structures to Improve Adversarial Transferability on Downstream SAM
and 10 more in the interactive map.
Backdoor and poisoning · 18 papers
- Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples (7 citations)
- FloatDoor: Platform triggered Backdoors in LLMs
- HPE: Hallucinated Positive Entanglement for Backdoor Attacks in Federated Self-Supervised Learning
- Latent-space Attacks for Refusal Evasion in Language Models
- Phantom Transfer: Data Poisoning can Survive Data-Level Defences
- RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance
- Token by Token, Compromised: Backdoor Vulnerabilities in Unified Autoregressive Models
- Trapping Attacker in Dilemma: Examining Internal Correlations and External Influences of Trigger for Defending GNN Backdoors
- Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis
- AI Models Can Provably Hide Arbitrary Capabilities
- Backdoor Attacks Rerouted: BatchNorm as a Sink for Adversarial Signals
- Backdoor Attacks under Lossy Compression: From Failure to Reactivation and Adaptation
and 6 more in the interactive map.
Black-box and transfer attacks · 11 papers
- Anchoring Adversarial Trajectories to Data Manifolds: A Bilevel Transfer Optimization Framework
- AnchorRep: Defending LLMs Against Cross-Model Adversarial Transfer via Representation Repulsion
- MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models
- Adversarial Attack and Defense for Machine Learning in Statistical Physics
- BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition
- Dual Feature-Relational Alignment for Transferable Targeted Attacks on MLLMs
- FILOsofer: A TEE-Shielded Model Partitioning Framework based on Fisher Information-Guided LoRA Obfuscation
- Learning Data-free Universal Adversarial Perturbation with Hybrid Priors and Gradient-Guided Sharpness Regularization
- PP-Mark: Provable and Publicly Verifiable Watermarking for Generative AI
- Seeing but Not Detecting: Privacy-Preserving Scene Text Attack via Hybrid Adversarial Policy Learning
- What to Perturb, How to Propagate: A Graph-Guided Transferable Attack on VLP Models