Florian Tramer

Apertus: Democratizing Open and Compliant LLMs for Global Language Environments ACL 2026 Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI ICLR 2025 Adversarial Search Engine Optimization for Large Language Models ICLR 2025 AutoAdvExBench: Benchmarking Autonomous Exploitation of Adversarial Example Defenses ICML 2025 Consistency Checks for Language Model Forecasters ICLR 2025 Exploring and Mitigating Adversarial Manipulation of Voting-Based Leaderboards ICML 2025 Measuring Non-Adversarial Reproduction of Training Data in Large Language Models ICLR 2025 Persistent Pre-training Poisoning of LLMs ICLR 2025 Scalable Extraction of Training Data from Aligned, Production Language Models ICLR 2025 The Jailbreak Tax: How Useful are Your Jailbreak Outputs? ICML 2025 AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents NeurIPS 2024 Dataset and Lessons Learned from the 2024 SaTML LLM Capture-the-Flag Competition NeurIPS 2024 Extracting Training Data From Document-Based VQA Models ICML 2024 JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models NeurIPS 2024 Position: Considerations for Differentially Private Learning with Large-Scale Public Pretraining ICML 2024 Privacy Backdoors: Stealing Data with Corrupted Pretrained Models ICML 2024 Query-Based Adversarial Prompt Generation NeurIPS 2024 Stealing part of a production language model ICML 2024 Universal Jailbreak Backdoors from Poisoned Human Feedback ICLR 2024 Are aligned neural networks adversarially aligned? NeurIPS 2023 (Certified!!) Adversarial Robustness for Free! ICLR 2023 Counterfactual Memorization in Neural Language Models NeurIPS 2023 Measuring Forgetting of Memorized Training Examples ICLR 2023 Preprocessors Matter! Realistic Decision-Based Attacks on Machine Learning Systems ICML 2023 Quantifying Memorization Across Neural Language Models ICLR 2023 Students Parrot Their Teachers: Membership Inference on Model Distillation NeurIPS 2023 Data Poisoning Won’t Save You From Facial Recognition ICLR 2022 Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them ICML 2022 Increasing Confidence in Adversarial Robustness Evaluations NeurIPS 2022 Large Language Models Can Be Strong Differentially Private Learners ICLR 2022 The Privacy Onion Effect: Memorization is Relative NeurIPS 2022 Antipodes of Label Differential Privacy: PATE and ALIBI NeurIPS 2021 Differentially Private Learning Needs Better Features (or Much More Data) ICLR 2021 Label-Only Membership Inference Attacks ICML 2021 Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations ICML 2020 On Adaptive Attacks to Adversarial Example Defenses NeurIPS 2020 Adversarial Training and Robustness for Multiple Perturbations NeurIPS 2019 Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware ICLR 2019 Ensemble Adversarial Training: Attacks and Defenses ICLR 2018