Latest Adversarial Robustness Research Papers

The newest Adversarial Robustness papers from across the field — arXiv, NeurIPS, CVPR, Nature, and more — refreshed daily and ranked by relevance. Distill AI tracks Adversarial Robustness so you don’t have to: get the standout work delivered to your inbox every morning, with 2-sentence summaries and the option to chat with any paper.

Recent papers

• Difficulty Calibration Across Time for Membership Inference in Diffusion Models
  Michael Joseph, Yedid Hoshen · arXiv · Oct 29, 2026

  Modern diffusion models are trained on massive datasets that often include copyrighted or private images. Membership inference attacks (MIAs) address this by testing whether a given image was in a model's training set. The standard approach…

• Power Adjusting Games Under Block-Dependent Pool Payout Schemes
  Mustafa Doger, Sennur Ulukus · arXiv · Oct 29, 2026

  Advanced power adjusting block withholding attacks such as PAW and T-PAW have been analyzed so far under a global-reset version of the proportional scheme (GRP), which is rarely used in practice. In this paper, we analyze T-PAW, which conta…

• The Privacy and Security Risks of Edge LLM Optimization
  Mingchen Li, Ren-Yi Huang, Dumindu Samaraweera, Prashant Shekhar et al. · arXiv · Oct 29, 2026

  Edge deployment of Large Language Models requires optimization techniques that reduce memory, computation, and energy costs. However, preserving task performance does not necessarily preserve security. We argue that optimization is an infor…

• DYNAS: A Dynamic Network Penetration Testing Framework Using Deep Hierarchical Reinforcement Learning
  Md. Rakibul Hassan, Majedul Islam, Md. Ashraful Alam, Muhammad Iqbal Hossain et al. · arXiv · Oct 29, 2026

  As network scale and uncertainty complicate automated penetration testing, reinforcement learning (RL) environments must support controlled evaluation under defensive and non-stationary conditions. We present DYNAS (Dynamic Network Attack S…

• Attack-Resilient Multi-Bit Image Watermarking Framework via Latent Coordinate Sign Clamping
  Marjan Beheshti, Ronghua Xu · arXiv · Oct 29, 2026

  Watermarking is essential for image copyright protection and attribution, yet existing methods suffer from fundamental trade-offs among post-hoc applicability to pre-existing images, multi-bit capacity, training-free deployment, and adversa…

• From if to Oops: Turning a conditional into a key-recovery oracle
  Gustavo Banegas, Nia Dimitrova, Monika Trimoska · arXiv · Oct 29, 2026

  Deterministic variants of CSIDH remove randomness from the group action, either through implementation techniques or, as in Houben's deterministic CSIDH and OSIDH-LD, by design. Since earlier fault attacks on CSIDH mostly target random poin…

• Integrating Perception, Comprehension, and Projection for Alert Validation: A Unified Cyber Situational Awareness Framework
  Navodika Karunasingha, Mohan Baruwal Chhetri, Surya Nepal, Cecile Paris et al. · arXiv · Oct 29, 2026

  Security Operation Centres (SOCs) must validate large volumes of alerts with limited analyst resources, yet alerts often lack sufficient context to determine whether suspicious activity is attack related. While provenance-based intrusion de…

• SEAL: Sealed Queries for Local Sanitization against Indirect Prompt Injection
  Doohyun Kim, Donghwa Kang, Mingyu Jun, Brent ByungHoon Kang · arXiv · Oct 29, 2026

  Indirect prompt injection threatens local LLM agents through untrusted tool outputs, motivating defenses that suppress attacks while preserving task evidence under limited inference budgets. We introduce SEAL, which learns a soft prompt and…

• PairWatch: Pair-Aware Anomaly Transformer for Detecting Adversarial Rendezvous in Public Satellite Catalogs
  Young Eun Kwon, Ji Won Yoon · arXiv · Oct 29, 2026

  Documented adversarial rendezvous and proximity operations (RPO) appear in the public TLE catalog, yet existing TLE-based maneuver detectors treat each satellite in isolation - mistaking routine station-keeping for adversarial behavior and …

• Systematic Evaluation of Adversarial Jailbreaking Attacks and Defenses Across Seven Large Language Models
  Md. Robiul Islam Niloy, Abu Sayed Md. Mostafizur Rahaman · arXiv · Oct 29, 2026

  Large language models (LLMs) deployed in safety-critical settings must resist adversarial inputs designed to elicit harmful outputs. We present a systematic empirical evaluation of five adversarial jailbreaking attack families---direct requ…

• ARBITRA: Robust Document-Level ATT&CK Extraction via Multi-Expert Argumentation
  Youngjin Jin, Seungwon Shin · arXiv · Oct 29, 2026

  Cyber threat intelligence (CTI) reports describe adversary behavior in natural language, but converting them into structured MITRE ATT&CK mappings remains difficult: existing methods decompose reports to sentence-level granularity for e…

• Provably Secure Diffusion Watermarking Against Removal Adversaries with Batched Detector Access
  De Zhang Lee, Ee-Chien Chang · arXiv · Oct 29, 2026

  Recent latent-based watermarking methods can embed undetectable watermarks into AI-generated content. However, these approaches are vulnerable to removal attacks as their watermark detection boundaries are exposed, prompting the use of secr…

• Appreciation Teaches Unauthorized Execution: Self-Evolution Degrades the Robustness of Personal Agents to Indirect Prompt Injection
  Xinyan Wang, Xiaogeng Liu, Jun Shao, Chaowei Xiao · arXiv · Oct 29, 2026

  Self-evolving personal agents act for users and learn from user feedback. However, if an agent obeys an instruction that an untrusted third party hides in content, the third party gains control of the agent. Such indirect prompt injection (…

• FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models
  Xiaogeng Liu, Xinyan Wang, Chaowei Xiao · arXiv · Oct 28, 2026

  Typed decision models are an emerging class of language models that make decisions instead of generating free-text responses. They answer in a single fast and cheap query and are increasingly used, including in security-sensitive tasks. How…

• IDSForge: Self-Explaining Network Intrusion Detection Through Neural Behavioral Rule Learning
  Hao Fu, Jinxia Wei, Wan Wei, Chun Long et al. · arXiv · Oct 28, 2026

  Anomaly-based network intrusion detection systems (NIDS) can detect previously unseen attacks by identifying deviations from benign traffic. However, deep learning-based anomaly detectors typically rely on implicit decision boundaries, and …

• Where You Inject Matters: The Trust Region Effect in LLM Agents
  Chengquan Guo, Xiaodong Liu, Weiwei Yang, Mingqian Feng et al. · arXiv · Oct 28, 2026

  LLM agents are increasingly adopted in long-horizon tasks and interact with diverse external environments. Despite their growing capabilities, these agents remain vulnerable to real-world attacks such as indirect prompt injections, which ma…

• CARI: Cross-Boundary Adversarial Runtime Injection in Coding-Agent Workflows
  Jie Fu, Shuang Wu, Ashish Kundu, Wendy Hui Wang et al. · arXiv · Oct 28, 2026

  Coding agents increasingly develop, test, and integrate software whose components are owned by different developers, teams, or services. This exposes a distinct attack surface: a malicious or compromised peer development role can manipulate…

• Trustworthy Distributed Machine Learning in Cloud-Edge-IoT Systems: A Heterogeneity-Aware Survey of Security, Privacy, and Robustness
  Long Dang, Ali Alfatemi, Kaiqi Xiong, Mohammed Aledhari et al. · arXiv · Oct 28, 2026

  Distributed machine learning (DML), including conventional distributed training and federated learning (FL), enables collaborative model development across cloud-edge-IoT systems without fully centralizing raw data. However, distributing da…

• Adversarial Process Disturbances at a Deployable Alarm Budget: Detector Evaluation on a Simulator and a Real Plant
  Benjamin Blakely · arXiv · Oct 28, 2026

  Industrial anomaly detection is evaluated largely on simulators, and recent work reports large drops, with unstable rankings, on real plant data. We ask whether that extends to the security case. We evaluate eleven detectors across classica…

• How Deterministic SAST and AI Security Agents Divide the Work: Coverage, Harness Policy and Cost in Snyk VulnBench 2.0
  Liran Tal, Chris Liu, Charlotte Fereday, Sebastian Roth et al. · arXiv · Oct 28, 2026

  We ask what AI coding agents and AI security harnesses find that deterministic static application security testing (SAST) does not, and what they miss that SAST catches. VulnBench 2.0 is a benchmark of 108 hand-curated, attacker-reachable v…

• STAR: Scalable TEE-based Anonymous Rate-limiter
  Kosei Akama, Yoshimichi Nakatsuka, Koichi Moriyama, Keisuke Uehara · arXiv · Oct 28, 2026

  Protecting Internet services from attacks such as TLS/HTTP floods requires rate limiting, yet identifying users to enforce these limits can compromise their privacy. Anonymous rate limiting promises to reconcile these goals, but existing sc…

• A Minimally Informed Black-Box Fake-Report Attack on DRL Traffic-Signal Control
  Amro Saleh, Loukas Lazos, Mohammad J. Abdel-Rahman · arXiv · Oct 28, 2026

  Deep reinforcement learning (DRL) traffic-signal controllers may use vehicle-to-infrastructure (V2I) reports, exposing their perception layer to false-data injection. Existing demonstrations typically assume either white-box access to the c…

• Robust Auction Design with Support Information
  Jerry Anunrojwong, Santiago Balseiro, Omar Besbes · Management Science · Oct 28, 2026

  A seller wants to sell an item to n buyers. Buyer valuations are independent and identically distributed (i.i.d.) according to a distribution unknown to the seller; the seller only knows that the support is included in [a, b]. To be robust,…

• Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness
  Igor Shilov, Xiaoxue Yang, Alexander Panfilov, Evgenii Kortukov et al. · arXiv · Oct 27, 2026

  We introduce Heads of Security (HoS), a prompt injection defense that enforces instruction-data separation via a small set of learned per-head attention gates. HoS learns how each head should redistribute attention between trusted and untru…

• SecDMP: Provably Secure Data Memory-Dependent Prefetching (Extended Version)
  Jens Sprengers, Marton Bognar, Lesly-Ann Daniel, Frank Piessens · arXiv · Oct 27, 2026

  Data memory-dependent prefetchers (DMPs) are a microarchitectural optimization recently introduced in mainstream desktop and server CPUs. Although DMPs offer performance improvements, they have been shown to enable side-channel leakage of s…

• Asynchronous Verifiable and Complete Secret Sharing: From Design Patterns to System-Level Trade-offs
  Joachim Bruneau-Queyreix, Martin Zivojinovic, Leo Mendiboure, Tom Claudel et al. · arXiv · Oct 27, 2026

  Modern secret sharing protocols promise robust secret sharing in fully asynchronous Byzantine systems, but their practical costs remain difficult to compare across papers, assumptions, and workloads. The difficulty is not merely experimenta…

• Janus Vehicles: Entity-Centric Threat Modelling of Protocol-Conformant Vehicles under a Malicious-Manufacturer Assumption
  Jaeung Franciskus Yoo, Huy Kang Kim · arXiv · Oct 27, 2026

  Automotive cybersecurity commonly assumes benign end-product manufacturers and design authorities, focusing on supply-chain threats, external attacks, and compromised network participants observable through misbehaviour. This assumption ove…

• RePAIR: Inverting Backdoor Attacks in Semantic Segmentation
  Arnold Brosch, Kira Maag · arXiv · Oct 27, 2026

  Despite significant advances in computer vision, semantic segmentation models remain vulnerable to backdoor attacks, posing a security risk. These attacks redirect pixels of a chosen victim class to an attacker-specified target class when a…

• HqcLethe: Streaming HQC Encapsulation for Tiny Stateless Servers
  Wind Wong, Klaus v. Gleissenthall · arXiv · Oct 27, 2026

  Stateless post-quantum authenticated key exchanges such as post-quantum WireGuard hedge against unexpected cryptanalytic advances by combining a lattice KEM with code-based Classic McEliece. However, recent attacks have led Germany's BSI to…

• A Simple Presentation of Robust Membership Inference Attacks
  Renaud Gaucher, Ephraim Linder, Adam Smith, Jonathan Ullman et al. · arXiv · Oct 27, 2026

  In a membership inference attack, an attacker is given the data of a particular individual, and tries to determine if that individual was included in a particular dataset, given some kind of statistics derived from the dataset or a model tr…