| Towards Deep Learning Models Resistant to Adversarial Attacks | Madry, Aleksander et al. | Adversarial Robustness of Classification Models | 2018 |
| Jailbroken: How Does LLM Safety Training Fail? | Wei, Alexander et al. | Jailbreaking LLMs | 2023 |
| Not what you’ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection | Greshake, Kai et al. | Indirect Prompt Injection in AI Agents | 2023 |
| Safety Alignment Should Be Made More Than Just a Few Tokens Deep | Qi, Xiangyu et al. | Safety Alignment and Guardrails | 2024 |
| Membership Inference Attacks From First Principles | Carlini, Nicholas et al. | Membership Inference Attacks | 2022 |
| Extracting Training Data from Large Language Models | Carlini, Nicholas et al. | Training-data Extraction from LLMs | 2021 |
| Deep Learning with Differential Privacy | Abadi, Martín et al. | Differential Privacy in ML | 2016 |
| Knowledge Unlearning for Mitigating Privacy Risks in Language Models | Jang, Joel et al. | Unlearning for Generative AI | 2022 |
| Knockoff Nets: Stealing Functionality of Black-Box Models | Orekondy, Tribhuvanesh et al. | Model Extraction / Stealing | 2019 |
| DAWN: Dynamic Adversarial Watermarking of Neural Networks | Szyller, Sebastian et al. | Model Watermarking / Fingerprinting | 2019 |
| Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks | Wang, Bolun et al. | Training-data Poisoning | 2019 |
| PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models | Zou, Wei et al. | Preference Manipulation / RAG Poisoning | 2024 |
| What Makes and Breaks Safety Fine-tuning? A Mechanistic Study | Jain, Samyak et al. | Mechanistic Interpretability for AI safety | 2024 |
| SoK: Unintended Interactions among Machine Learning Defenses and Risks | Duddu, Vasisht et al. | Unintended Interactions among ML Defenses and Risks | 2024 |
| A Watermark for Large Language Models | Kirchenbauer, John et al. | Media Forensics and Proactive Provenance | 2023 |
| Examining Zero-Shot Vulnerability Repair with Large Language Models | Pearce, Hammond et al. | AI for Cybersecurity | 2023 |
| Secure Transformer Inference Made Non-interactive | Zhang, Jiawen et al. | Leakage Resistance (Client Data): Software | 2025 |
| BliMe: Verifiably Secure Outsourced Computation with Hardware-Enforced Taint Tracking | ElAtali, Hossam et al. | Leakage Resistance (Client Data): Hardware | 2024 |
| Unlocking the Power of Differentially Private Zeroth-order Optimization for Fine-tuning LLMs | Bao, Ergute et al. | Leakage Resistance (Training Data): Software | 2025 |
| No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device ML | Zhang, Ziqi et al. | Leakage Resistance (Training Data): Hardware | 2024 |
| ModelGuard: Information-Theoretic Defense Against Model Extraction Attacks | Tang, Minxue et al. | Model Theft Resistance (+ On-Device Private Inference): Software | 2024 |
| ASGARD: Protecting On-Device Deep Neural Networks with Virtualization-Based Trusted Execution Environments | Moon, Myungsuk et al. | Model Theft Resistance (+ On-Device Private Inference): Hardware | 2025 |
| zkGPT: An Efficient Non-interactive Zero-knowledge Proof Framework for LLM Inference | Qu, Wenjie et al. | Regulatory Compliance: Software | 2025 |
| PAL*M: Property Attestation for Large Generative Models | Chantasantitam, Prach et al. | Regulatory Compliance: Hardware | 2026 |