| 1 | Towards Deep Learning Models Resistant to Adversarial Attacks | Inference-Time Integrity of Model Behavior | Adversarial Robustness of Classification Models | Explaining and Harnessing Adversarial Examples; Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks |
| 2 | Jailbroken: How Does LLM Safety Training Fail? | Inference-Time Integrity of Model Behavior | Jailbreaking LLMs | Universal and Transferable Adversarial Attacks on Aligned Language Models; Jailbreaking Black Box Large Language Models in Twenty Queries |
| 3 | Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection | Inference-Time Integrity of Model Behavior | Indirect Prompt Injection in AI Agents | InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated LLM Agents; Formalizing and Benchmarking Prompt Injection Attacks and Defenses |
| 4 | Safety Alignment Should Be Made More Than Just a Few Tokens Deep | Inference-Time Integrity of Model Behavior | Safety Alignment and Guardrails | Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations; SecAlign: Defending Against Prompt Injection with Preference Optimization |
| 5 | Membership Inference Attacks From First Principles | Training-Data Memorization and Leakage | Membership Inference Attacks | Membership Inference Attacks Against Machine Learning Models; Detecting Pretraining Data from Large Language Models |
| 6 | Extracting Training Data from Large Language Models | Training-Data Memorization and Leakage | Training-data Extraction from LLMs | Scalable Extraction of Training Data from (Production) Language Models; Extracting Training Data from Diffusion Models |
| 7 | Deep Learning with Differential Privacy | Training-Data Memorization and Leakage | Differential Privacy in ML | Evaluating Differentially Private Machine Learning in Practice; Large Language Models Can Be Strong Differentially Private Learners |
| 8 | Knowledge Unlearning for Mitigating Privacy Risks in Language Models | Training-Data Memorization and Leakage | Unlearning for Generative AI | Erasing Concepts from Diffusion Models; TOFU: A Task of Fictitious Unlearning for LLMs |
| 9 | Knockoff Nets: Stealing Functionality of Black-Box Models | Model Extraction and Distillation | Model Extraction / Stealing | High Accuracy and High Fidelity Extraction of Neural Networks; Stealing Part of a Production Language Model |
| 10 | DAWN: Dynamic Adversarial Watermarking of Neural Networks | Model Extraction and Distillation | Model Watermarking / Fingerprinting | False Claims against Model Ownership Resolution; Can LLM Watermarks Robustly Prevent Unauthorized Knowledge Distillation? |
| 11 | Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks | Data Integrity and Supply-Chain Security | Training-data Poisoning | BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain; Poisoning Language Models During Instruction Tuning |
| 12 | PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models | Data Integrity and Supply-Chain Security | Preference Manipulation / RAG Poisoning | Adversarial Search Engine Optimization for Large Language Models; Certifiably Robust RAG against Retrieval Corruption |
| 13 | What Makes and Breaks Safety Fine-tuning? A Mechanistic Study | Cross-Cutting Topics | Mechanistic Interpretability for AI safety | Refusal in Language Models Is Mediated by a Single Direction; Improving Alignment and Robustness with Circuit Breakers |
| 14 | SoK: Unintended Interactions among Machine Learning Defenses and Risks | Cross-Cutting Topics | Unintended Interactions among ML Defenses and Risks | Conflicting Interactions Among Protection Mechanisms for Machine Learning Models; Combining Machine Learning Defenses without Conflicts |
| 15 | A Watermark for Large Language Models | Cross-Cutting Topics | Media Forensics and Proactive Provenance | Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust; Media Forensics and DeepFakes: An Overview |
| 16 | Examining Zero-Shot Vulnerability Repair with Large Language Models | Cross-Cutting Topics | AI for Cybersecurity | LLM Agents can Autonomously Exploit One-day Vulnerabilities; AI Agents Enable Adaptive Computer Worms |