Florian Tramèr

Pitfalls in Evaluating Language Model Forecasters

The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against LLM Jailbreaks and Prompt Injections

Modal Aphasia: Can Unified Multimodal Models Describe Images From Memory?

OptiFluence: Scalable and Principled Design of Privacy Canaries

Black-box Optimization of LLM Outputs by Asking for Directions

Can Reasoning Models Obfuscate Reasoning? Stress-Testing Chain-of-Thought Monitorability

The Jailbreak Tax: How Useful are Your Jailbreak Outputs?

AutoAdvExBench: Benchmarking Autonomous Exploitation of Adversarial Example Defenses

Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI

Consistency Checks for Language Model Forecasters

Measuring Non-Adversarial Reproduction of Training Data in Large Language Models

Adversarial Search Engine Optimization for Large Language Models

Scalable Extraction of Training Data from Aligned, Production Language Models

Exploring and Mitigating Adversarial Manipulation of Voting-Based Leaderboards

AutoAdvExBench: Benchmarking Autonomous Exploitation of Adversarial Example Defenses

Persistent Pre-training Poisoning of LLMs

Gradient-based Jailbreak Images for Multimodal Fusion Models

Blind Baselines Beat Membership Inference Attacks for Foundation Models