Publications (86)
Boosting Big Brother: Attacking Search Engines with Encodings
Nicholas Boucher, Luca Pajola, Ilia Shumailov +2
Augmentation Backdoors
Joseph Rance, Yiren Zhao, Ilia Shumailov +1
Architectural Backdoors in Neural Networks
Mikel Bober-Irizar, Ilia Shumailov, Yiren Zhao +2
Thought-Transfer: Indirect Targeted Poisoning Attacks on Chain-of-Thought Reasoning Models
Harsh Chaudhari, Ethan Rathbun, Hanna Foerster +5
Soft Instruction De-escalation Defense
Nils Philipp Walter, Chawin Sitawarin, Jamie Hayes +2
Bad Characters: Imperceptible NLP Attacks
Nicholas Boucher, Ilia Shumailov, Ross Anderson +1
Honeyval: A Comprehensive Evaluation Framework for LLM-powered HTTP Honeypots
Mark Vero, Fabian Kaczmarczyck, Ivan Petrov +6
Watermarking Needs Input Repetition Masking
David Khachaturov, Robert Mullins, Ilia Shumailov +1
UnUnlearning: Unlearning is not sufficient for content regulation in advanced generative AI
Ilia Shumailov, Jamie Hayes, Eleni Triantafillou +6
Architectural Neural Backdoors from First Principles
Harry Langford, Ilia Shumailov, Yiren Zhao +2
Kraken: Higher-order EM Side-Channel Attacks on DNNs in Near and Far Field
Peter Horvath, Ilia Shumailov, Lukasz Chmielewski +2
Wide Attention Is The Way Forward For Transformers?
Jason Ross Brown, Yiren Zhao, Ilia Shumailov +1
Beyond Laplace and Gaussian: Exploring the Generalized Gaussian Mechanism for Private Machine Learning
Roy Rinberg, Ilia Shumailov, Vikrant Singhal +2
Reconstructing Individual Data Points in Federated Learning Hardened with Differential Privacy and Secure Aggregation
Franziska Boenisch, Adam Dziedzic, Roei Schuster +3
ceLLMate: Sandboxing Browser AI Agents
Luoxi Meng, Henry Feng, Ilia Shumailov +1
Locking Machine Learning Models into Hardware
Eleanor Clifford, Adhithya Saravanan, Harry Langford +5
Trusted Machine Learning Models Unlock Private Inference for Problems Currently Infeasible with Cryptography
Ilia Shumailov, Daniel Ramage, Sarah Meiklejohn +4
Architectural Backdoors for Within-Batch Data Stealing and Model Inference Manipulation
Nicolas Küchler, Ivan Petrov, Conrad Grobler +1
DARTFormer: Finding The Best Type Of Attention
Jason Ross Brown, Yiren Zhao, Ilia Shumailov +1
Sponge Examples: Energy-Latency Attacks on Neural Networks
Ilia Shumailov, Yiren Zhao, Daniel Bates +3
On the Limitations of Stochastic Pre-processing Defenses
Yue Gao, Ilia Shumailov, Kassem Fawaz +1
Manipulating SGD with Data Ordering Attacks
Ilia Shumailov, Zakhar Shumaylov, Dmitry Kazhdan +4
Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context
Gemini Team, Petko Georgiev, Ving Ian Lei +1132
Hardware and Software Platform Inference
Cheng Zhang, Hanna Foerster, Robert D. Mullins +2
Revisiting Automated Prompting: Are We Actually Doing Better?
Yulin Zhou, Yiren Zhao, Ilia Shumailov +2
Hearing your touch: A new acoustic side channel on smartphones
Ilia Shumailov, Laurent Simon, Jeff Yan +1
Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacy
Jamie Hayes, Ilia Shumailov, Eleni Triantafillou +2
Lessons from Defending Gemini Against Indirect Prompt Injections
Chongyang Shi, Sharon Lin, Shuang Song +11
Revisiting Block-based Quantisation: What is Important for Sub-8-bit LLM Inference?
Cheng Zhang, Jianyi Cheng, Ilia Shumailov +2
Rapid Model Architecture Adaption for Meta-Learning
Yiren Zhao, Xitong Gao, Ilia Shumailov +2
Reasoning Introduces New Poisoning Attacks Yet Makes Them More Complicated
Hanna Foerster, Ilia Shumailov, Yiren Zhao +4
When the Curious Abandon Honesty: Federated Learning Is Not Private
Franziska Boenisch, Adam Dziedzic, Roei Schuster +3
On Attribution of Deepfakes
Baiwu Zhang, Jin Peng Zhou, Ilia Shumailov +1
The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections
Milad Nasr, Nicholas Carlini, Chawin Sitawarin +11
Efficient Adversarial Training With Data Pruning
Maximilian Kaufmann, Yiren Zhao, Ilia Shumailov +2
Quantamination: Dynamic Quantization Leaks Your Data Across the Batch
Hanna Foerster, Ilia Shumailov, Cheng Zhang +3
BatNet: Data transmission between smartphones over ultrasound
Almos Zarandy, Ilia Shumailov, Ross Anderson
Iterative Deployment Improves Planning Skills in LLMs
Augusto B. Corrêa, Yoav Gelberg, Luckeciano C. Melo +3
Sitatapatra: Blocking the Transfer of Adversarial Samples
Ilia Shumailov, Xitong Gao, Yiren Zhao +3
Nudge Attacks on Point-Cloud DNNs
Yiren Zhao, Ilia Shumailov, Robert Mullins +1
Machine Learning Models Have a Supply Chain Problem
Sarah Meiklejohn, Hayden Blauzvern, Mihai Maruseac +3
Tubes Among Us: Analog Attack on Automatic Speaker Identification
Shimaa Ahmed, Yash Wani, Ali Shahin Shamsabadi +4
Model Architecture Adaption for Bayesian Neural Networks
Duo Wang, Yiren Zhao, Ilia Shumailov +1
Markpainting: Adversarial Machine Learning meets Inpainting
David Khachaturov, Ilia Shumailov, Yiren Zhao +2
To compress or not to compress: Understanding the Interactions between Adversarial Attacks and Neural Network Compression
Yiren Zhao, Ilia Shumailov, Robert Mullins +1
LLM Censorship: A Machine Learning Challenge or a Computer Security Problem?
David Glukhov, Ilia Shumailov, Yarin Gal +2
Buffer Overflow in Mixture of Experts
Jamie Hayes, Ilia Shumailov, Itay Yona
ExtremeBB: A Database for Large-Scale Research into Online Hate, Harassment, the Manosphere and Extremism
Anh V. Vu, Lydia Wilson, Yi Ting Chua +2
Hey Alexa what did I just type? Decoding smartphone sounds with a voice assistant
Almos Zarandy, Ilia Shumailov, Ross Anderson
Machine Unlearning Doesn't Do What You Think: Lessons for Generative AI Policy and Research
A. Feder Cooper, Christopher A. Choquette-Choo, Miranda Bogen +34
Beyond Labeling Oracles: What does it mean to steal ML models?
Avital Shafran, Ilia Shumailov, Murat A. Erdogdu +1
The Taboo Trap: Behavioural Detection of Adversarial Samples
Ilia Shumailov, Yiren Zhao, Robert Mullins +1
Fairness Feedback Loops: Training on Synthetic Data Amplifies Bias
Sierra Wyllie, Ilia Shumailov, Nicolas Papernot
Breach By A Thousand Leaks: Unsafe Information Leakage in `Safe' AI Responses
David Glukhov, Ziwen Han, Ilia Shumailov +2
Rethinking Image-Scaling Attacks: The Interplay Between Vulnerabilities in Machine Learning Systems
Yue Gao, Ilia Shumailov, Kassem Fawaz
Machine Learning needs Better Randomness Standards: Randomised Smoothing and PRNG-based attacks
Pranav Dahiya, Ilia Shumailov, Ross Anderson
Stealing User Prompts from Mixture of Experts
Itay Yona, Ilia Shumailov, Jamie Hayes +1
Snitches Get Stitches: On The Difficulty of Whistleblowing
Mansoor Ahmed-Rengers, Ross Anderson, Darija Halatova +1
Measuring memorization in RLHF for code completion
Aneesh Pappu, Billy Porter, Ilia Shumailov +1
CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents
Hanna Foerster, Tom Blanchard, Kristina NikoliÄ +6
In Differential Privacy, There is Truth: On Vote Leakage in Ensemble Private Learning
Jiaqi Wang, Roei Schuster, Ilia Shumailov +2
Towards Automatic Discovery of Cybercrime Supply Chains
Rasika Bhalerao, Maxwell Aliapoulios, Ilia Shumailov +2
Interpreting the Repeated Token Phenomenon in Large Language Models
Itay Yona, Ilia Shumailov, Jamie Hayes +2
Gradients Look Alike: Sensitivity is Often Overestimated in DP-SGD
Anvith Thudi, Hengrui Jia, Casey Meehan +2
The Curse of Recursion: Training on Generated Data Makes Models Forget
Ilia Shumailov, Zakhar Shumaylov, Yiren Zhao +3
Beyond Slow Signs in High-fidelity Model Extraction
Hanna Foerster, Robert Mullins, Ilia Shumailov +1
On the Necessity of Auditable Algorithmic Definitions for Machine Unlearning
Anvith Thudi, Hengrui Jia, Ilia Shumailov +1
Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilities
Gheorghe Comanici, Eric Bieber, Mike Schaekermann +3431
Blackbox Attacks on Reinforcement Learning Agents Using Approximated Temporal Information
Yiren Zhao, Ilia Shumailov, Han Cui +3
ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networks
Eleanor Clifford, Ilia Shumailov, Yiren Zhao +2
SynthID-Image: Image watermarking at internet scale
Sven Gowal, Rudy Bunel, Florian Stimberg +23
SEA: Shareable and Explainable Attribution for Query-based Black-box Attacks
Yue Gao, Ilia Shumailov, Kassem Fawaz
Extracting alignment data in open models
Federico Barbero, Xiangming Gu, Christopher A. Choquette-Choo +6
Measuring memorization in language models via probabilistic extraction
Jamie Hayes, Marika Swanberg, Harsh Chaudhari +6
Cascading Adversarial Bias from Injection to Distillation in Language Models
Harsh Chaudhari, Jamie Hayes, Matthew Jagielski +3
When Vision Fails: Text Attacks Against ViT and OCR
Nicholas Boucher, Jenny Blessing, Ilia Shumailov +2
Exploring the limits of strong membership inference attacks on large language models
Jamie Hayes, Ilia Shumailov, Christopher A. Choquette-Choo +13
Bounding Membership Inference
Anvith Thudi, Ilia Shumailov, Franziska Boenisch +1
Towards Certifiable Adversarial Sample Detection
Ilia Shumailov, Yiren Zhao, Robert Mullins +1
Defeating Prompt Injections by Design
Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan +7
Large Language Models Can Verbatim Reproduce Long Malicious Sequences
Sharon Lin, Krishnamurthy, Dvijotham +4
Operationalizing Contextual Integrity in Privacy-Conscious Assistants
Sahra Ghalebikesabi, Eugene Bagdasaryan, Ren Yi +10
Tendrils of Crime: Visualizing the Diffusion of Stolen Bitcoins
Mansoor Ahmed-Rengers, Ilia Shumailov, Ross Anderson
Human-Producible Adversarial Examples
David Khachaturov, Yue Gao, Ilia Shumailov +3
Fixing 7,400 Bugs for 1$: Cheap Crash-Site Program Repair
Han Zheng, Ilia Shumailov, Tianqi Fan +2
GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines
Jafar Isbarov, Umid Suleymanov, Ilia Shumailov +1