Nicholas Carlini

191 papers A* 60B 2C 1Journal 110Unranked 15

Year	Rank	Type	Title / Venue / Authors
2026	J	`jnl`	Large-scale online deanonymization with LLMs. CoRR Simon Lermen, Daniel Paleka, Joshua Swanson, Michael Aerni, Nicholas Carlini, Florian Tramèr
2026	J	`jnl`	Terminal-Bench: Benchmarking Agents on Hard, Realistic Tasks in Command Line Interfaces. CoRR Mike A. Merrill, Alexander Glenn Shaw, Nicholas Carlini, Boxuan Li, Harsh Raj, Ivan Bercovich, Lin Shi, Jeong Yeon Shin, Thomas Walshe, Estefany Kelly Buchanan, Junhong Shen, Guanghao Ye, Haowei Lin, Jason Poulos, Maoyu Wang, Marianna Nezhurina, Jenia Jitsev, Di Lu, Orfeas Menis-Mastromichalakis, Zhiwei Xu, Zizhao Chen, Yue Liu, Robert Zhang, Leon Liangyu Chen, Anurag Kashyap, Jan-Lucas Uslu, Jeffrey Li, Jianbo Wu, Minghao Yan, Song Bian, Vedang Sharma, Ke Sun, Steven Dillmann, Akshay Anand, Andrew Lanpouthakoun, Bardia Koopah, Changran Hu, Etash Kumar Guha, Gabriel H. S. Dreiman, Jiacheng Zhu, Karl Krauth, Li Zhong, Niklas Muennighoff, Robert Amanfu, Shangyin Tan, Shreyas Pimpalgaonkar, Tushar Aggarwal, Xiangning Lin, Xin Lan, Xuandong Zhao, Yiqing Liang, Yuanli Wang, Zilong Wang, Changzhi Zhou, David Heineman, Hange Liu, Harsh Trivedi, John Yang, Junhong Lin, Manish Shetty, Michael Yang, Nabil Omi, Negin Raoof, Shanda Li, Terry Yue Zhuo, Wuwei Lin, Yiwei Dai, Yuxin Wang, Wenhao Chai, Shang Zhou, Dariush Wahdany, Ziyu She, Jiaming Hu, Zhikang Dong, Yuxuan Zhu, Sasha Cui, Ahson Saiyed, Arinbjörn Kolbeinsson, Jesse Hu, Christopher Michael Rytting, Ryan Marten, Yixin Wang, Alex Dimakis, Andy Konwinski, Ludwig Schmidt
2025	J	`jnl`	Adversarial ML Problems Are Getting Harder to Solve and to Evaluate. CoRR Javier Rando, Jie Zhang, Nicholas Carlini, Florian Tramèr
2025	A*	`conf`	Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI. ICLR Robert Hönig, Javier Rando, Nicholas Carlini, Florian Tramèr
2025	J	`jnl`	Agentic Property-Based Testing: Finding Bugs Across the Python Ecosystem. CoRR Muhammad Maaz, Liam DeVoe, Zac Hatfield-Dodds, Nicholas Carlini
2025	A*	`conf`	AutoAdvExBench: Benchmarking Autonomous Exploitation of Adversarial Example Defenses. ICML Nicholas Carlini, Edoardo Debenedetti, Javier Rando, Milad Nasr, Florian Tramèr
2025	J	`jnl`	AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defenses. CoRR Nicholas Carlini, Javier Rando, Edoardo Debenedetti, Milad Nasr, Florian Tramèr
2025	J	`jnl`	Defeating Prompt Injections by Design. CoRR Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, Florian Tramèr
2025	—	`conf`	Defending Against Prompt Injection With a Few DefensiveTokens. AISec@CCS Sizhe Chen, Yizhu Wang, Nicholas Carlini, Chawin Sitawarin, David A. Wagner
2025	J	`jnl`	Defending Against Prompt Injection With a Few DefensiveTokens. CoRR Sizhe Chen, Yizhu Wang, Nicholas Carlini, Chawin Sitawarin, David A. Wagner
2025	J	`jnl`	Detecting Adversarial Fine-tuning with Auditing Agents. CoRR Sarah Egler, John Schulman, Nicholas Carlini
2025	A*	`conf`	Evaluating the Robustness of a Production Malware Detection System to Transferable Adversarial Attacks. CCS Milad Nasr, Yanick Fratantonio, Luca Invernizzi, Ange Albertini, Loua Farah, Alex Petit-Bianco, Andreas Terzis, Kurt Thomas, Elie Bursztein, Nicholas Carlini
2025	J	`jnl`	Evaluating the Robustness of a Production Malware Detection System to Transferable Adversarial Attacks. CoRR Milad Nasr, Yanick Fratantonio, Luca Invernizzi, Ange Albertini, Loua Farah, Alex Petit-Bianco, Andreas Terzis, Kurt Thomas, Elie Bursztein, Nicholas Carlini
2025	A*	`conf`	Exploring and Mitigating Adversarial Manipulation of Voting-Based Leaderboards. ICML Yangsibo Huang, Milad Nasr, Anastasios Nikolas Angelopoulos, Nicholas Carlini, Wei-Lin Chiang, Christopher A. Choquette-Choo, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Ken Liu, Ion Stoica, Florian Tramèr, Chiyuan Zhang
2025	J	`jnl`	Exploring and Mitigating Adversarial Manipulation of Voting-Based Leaderboards. CoRR Yangsibo Huang, Milad Nasr, Anastasios Angelopoulos, Nicholas Carlini, Wei-Lin Chiang, Christopher A. Choquette-Choo, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Ken Ziyu Liu, Ion Stoica, Florian Tramèr, Chiyuan Zhang
2025	J	`jnl`	IF-GUIDE: Influence Function-Guided Detoxification of LLMs. CoRR Zachary Coalson, Juhan Bae, Nicholas Carlini, Sanghyun Hong
2025	J	`jnl`	ImpossibleBench: Measuring LLMs' Propensity of Exploiting Test Cases. CoRR Ziqian Zhong, Aditi Raghunathan, Nicholas Carlini
2025	J	`jnl`	In-House Evaluation Is Not Enough: Towards Robust Third-Party Flaw Disclosure for General-Purpose AI. CoRR Shayne Longpre, Kevin Klyman, Ruth E. Appel, Sayash Kapoor, Rishi Bommasani, Michelle Sahar, Sean McGregor, Avijit Ghosh, Borhane Blili-Hamelin, Nathan Butters, Alondra Nelson, Amit Elazari, Andrew Sellars, Casey John Ellis, Dane Sherrets, Dawn Song, Harley Geiger, Ilona Cohen, Lauren McIlvenny, Madhulika Srikumar, Mark M. Jaycox, Markus Anderljung, Nadine Farid Johnson, Nicholas Carlini, Nicolas Miailhe, Nik Marda, Peter Henderson, Rebecca S. Portnoff, Rebecca Weiss, Victoria Westerhoff, Yacine Jernite, Rumman Chowdhury, Percy Liang, Arvind Narayanan
2025	J	`jnl`	LLMs unlock new paths to monetizing exploits. CoRR Nicholas Carlini, Milad Nasr, Edoardo Debenedetti, Barry Wang, Christopher A. Choquette-Choo, Daphne Ippolito, Florian Tramèr, Matthew Jagielski
2025	A*	`conf`	Measuring Non-Adversarial Reproduction of Training Data in Large Language Models. ICLR Michael Aerni, Javier Rando, Edoardo Debenedetti, Nicholas Carlini, Daphne Ippolito, Florian Tramèr
2025	A*	`conf`	On Evaluating the Durability of Safeguards for Open-Weight LLMs. ICLR Xiangyu Qi, Boyi Wei, Nicholas Carlini, Yangsibo Huang, Tinghao Xie, Luxi He, Matthew Jagielski, Milad Nasr, Prateek Mittal, Peter Henderson
2025	A*	`conf`	Persistent Pre-training Poisoning of LLMs. ICLR Yiming Zhang, Javier Rando, Ivan Evtimov, Jianfeng Chi, Eric Michael Smith, Nicholas Carlini, Florian Tramèr, Daphne Ippolito
2025	J	`jnl`	Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples. CoRR Alexandra Souly, Javier Rando, Ed Chapman, Xander Davies, Burak Hasircioglu, Ezzeldin Shereen, Carlos Mougan, Vasilios Mavroudis, Erik Jones, Chris Hicks, Nicholas Carlini, Yarin Gal, Robert Kirk
2025	—	`conf`	Polynomial Time Cryptanalytic Extraction of Deep Neural Networks in the Hard-Label Setting. EUROCRYPT (1) Nicholas Carlini, Jorge Chávez-Saab, Anna Hambitzer, Francisco Rodríguez-Henríquez, Adi Shamir
2025	—	`conf`	Position: In-House Evaluation Is Not Enough. Towards Robust Third-Party Evaluation and Flaw Disclosure for General-Purpose AI. ICML (Position Papers) Shayne Longpre, Kevin Klyman, Ruth Elisabeth Appel, Sayash Kapoor, Rishi Bommasani, Michelle Sahar, Sean McGregor, Avijit Ghosh, Borhane Blili-Hamelin, Nathan Butters, Alondra Nelson, Amit Elazari, Andrew Sellars, Casey John Ellis, Dane Sherrets, Dawn Song, Harley Geiger, Ilona Cohen, Lauren McIlvenny, Madhulika Srikumar, Mark M. Jaycox, Markus Anderljung, Nadine Farid Johnson, Nicholas Carlini, Nicolas Miailhe, Nik Marda, Peter Henderson, Rebecca S. Portnoff, Rebecca Weiss, Victoria Westerhoff, Yacine Jernite, Rumman Chowdhury, Percy Liang, Arvind Narayanan
2025	A*	`conf`	Scalable Extraction of Training Data from Aligned, Production Language Models. ICLR Milad Nasr, Javier Rando, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A. Feder Cooper, Daphne Ippolito, Christopher A. Choquette-Choo, Florian Tramèr, Katherine Lee
2025	A*	`conf`	SoK: Watermarking for AI-Generated Content. SP Xuandong Zhao, Sam Gunn, Miranda Christ, Jaiden Fairoze, Andrés Fábrega, Nicholas Carlini, Sanjam Garg, Sanghyun Hong, Milad Nasr, Florian Tramèr, Somesh Jha, Lei Li, Yu-Xiang Wang, Dawn Song
2025	J	`jnl`	The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections. CoRR Milad Nasr, Nicholas Carlini, Chawin Sitawarin, Sander V. Schulhoff, Jamie Hayes, Michael Ilie, Juliette Pluto, Shuang Song, Harsh Chaudhari, Ilia Shumailov, Abhradeep Thakurta, Kai Yuanqing Xiao, Andreas Terzis, Florian Tramèr
2025	J	`jnl`	The Equational Theories Project: Advancing Collaborative Mathematical Research at Scale. CoRR Matthew Bolan, Joachim Breitner, Jose Brox, Nicholas Carlini, Mario Carneiro, Floris van Doorn, Martin Dvorak, Andrés Goens, Aaron Hill, Harald Husum, Hernán Ibarra Mejia, Zoltan A. Kocsis, Bruno Le Floch, Amir Livne Bar-on, Lorenzo Luccioli, Douglas McNeil, Alex Meiburg, Pietro Monticone, Pace P. Nielsen, Emmanuel Osalotioman Osazuwa, Giovanni Paolini, Marco Petracci, Bernhard Reinke, David Renshaw, Marcus Rossel, Cody Roux, Jérémy Scanvic, Shreyas Srinivas, Anand Rao Tadipatri, Terence Tao, Vlad Tsyrklevich, Fernando Vaquerizo-Villar, Daniel Weber, Fan Zheng
2024	J	`jnl`	Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI. CoRR Robert Hönig, Javier Rando, Nicholas Carlini, Florian Tramèr
2024	J	`jnl`	Cutting through buggy adversarial example defenses: fixing 1 line of code breaks Sabre. CoRR Nicholas Carlini
2024	J	`jnl`	Diffusion Denoising as a Certified Defense against Clean-label Poisoning. CoRR Sanghyun Hong, Nicholas Carlini, Alexey Kurakin
2024	—	`conf`	Evading Black-box Classifiers Without Breaking Eggs. SaTML Edoardo Debenedetti, Nicholas Carlini, Florian Tramèr
2024	J	`jnl`	Forcing Diffuse Distributions out of Language Models. CoRR Yiming Zhang, Avi Schwarzschild, Nicholas Carlini, Zico Kolter, Daphne Ippolito
2024	J	`jnl`	Gradient Masking All-at-Once: Ensemble Everything Everywhere Is Not Robust. CoRR Jie Zhang, Kristina Nikolic, Nicholas Carlini, Florian Tramèr
2024	A*	`conf`	Initialization Matters for Adversarial Transfer Learning. CVPR Andong Hua, Jindong Gu, Zhiyu Xue, Nicholas Carlini, Eric Wong, Yao Qin
2024	J	`jnl`	Measuring Non-Adversarial Reproduction of Training Data in Large Language Models. CoRR Michael Aerni, Javier Rando, Edoardo Debenedetti, Nicholas Carlini, Daphne Ippolito, Florian Tramèr
2024	J	`jnl`	On Evaluating the Durability of Safeguards for Open-Weight LLMs. CoRR Xiangyu Qi, Boyi Wei, Nicholas Carlini, Yangsibo Huang, Tinghao Xie, Luxi He, Matthew Jagielski, Milad Nasr, Prateek Mittal, Peter Henderson
2024	J	`jnl`	Persistent Pre-Training Poisoning of LLMs. CoRR Yiming Zhang, Javier Rando, Ivan Evtimov, Jianfeng Chi, Eric Michael Smith, Nicholas Carlini, Florian Tramèr, Daphne Ippolito
2024	A*	`conf`	Poisoning Web-Scale Training Datasets is Practical. SP Nicholas Carlini, Matthew Jagielski, Christopher A. Choquette-Choo, Daniel Paleka, Will Pearce, Hyrum S. Anderson, Andreas Terzis, Kurt Thomas, Florian Tramèr
2024	J	`jnl`	Polynomial Time Cryptanalytic Extraction of Deep Neural Networks in the Hard-Label Setting. CoRR Nicholas Carlini, Jorge Chávez-Saab, Anna Hambitzer, Francisco Rodríguez-Henríquez, Adi Shamir
2024	J	`jnl`	Polynomial Time Cryptanalytic Extraction of Deep Neural Networks in the Hard-Label Setting. IACR Cryptol. ePrint Arch. Nicholas Carlini, Jorge Chávez-Saab, Anna Hambitzer, Francisco Rodríguez-Henríquez, Adi Shamir
2024	A*	`conf`	Position: Considerations for Differentially Private Learning with Large-Scale Public Pretraining. ICML Florian Tramèr, Gautam Kamath, Nicholas Carlini
2024	A*	`conf`	Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models. NeurIPS Yuxin Wen, Leo Marchyok, Sanghyun Hong, Jonas Geiping, Tom Goldstein, Nicholas Carlini
2024	J	`jnl`	Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models. CoRR Yuxin Wen, Leo Marchyok, Sanghyun Hong, Jonas Geiping, Tom Goldstein, Nicholas Carlini
2024	A*	`conf`	Privacy Side Channels in Machine Learning Systems. USENIX Security Symposium Edoardo Debenedetti, Giorgio Severi, Milad Nasr, Christopher A. Choquette-Choo, Matthew Jagielski, Eric Wallace, Nicholas Carlini, Florian Tramèr
2024	A*	`conf`	Query-Based Adversarial Prompt Generation. NeurIPS Jonathan Hayase, Ema Borevkovic, Nicholas Carlini, Florian Tramèr, Milad Nasr
2024	J	`jnl`	Query-Based Adversarial Prompt Generation. CoRR Jonathan Hayase, Ema Borevkovic, Nicholas Carlini, Florian Tramèr, Milad Nasr
2024	J	`jnl`	Remote Timing Attacks on Efficient Language Model Inference. CoRR Nicholas Carlini, Milad Nasr
2024	J	`jnl`	SoK: Watermarking for AI-Generated Content. CoRR Xuandong Zhao, Sam Gunn, Miranda Christ, Jaiden Fairoze, Andrés Fábrega, Nicholas Carlini, Sanjam Garg, Sanghyun Hong, Milad Nasr, Florian Tramèr, Somesh Jha, Lei Li, Yu-Xiang Wang, Dawn Song
2024	J	`jnl`	Stealing Part of a Production Language Model. CoRR Nicholas Carlini, Daniel Paleka, Krishnamurthy (Dj) Dvijotham, Thomas Steinke, Jonathan Hayase, A. Feder Cooper, Katherine Lee, Matthew Jagielski, Milad Nasr, Arthur Conmy, Eric Wallace, David Rolnick, Florian Tramèr
2024	J	`jnl`	Stealing User Prompts from Mixture of Experts. CoRR Itay Yona, Ilia Shumailov, Jamie Hayes, Nicholas Carlini
2024	A*	`conf`	Stealing part of a production language model. ICML Nicholas Carlini, Daniel Paleka, Krishnamurthy Dj Dvijotham, Thomas Steinke, Jonathan Hayase, A. Feder Cooper, Katherine Lee, Matthew Jagielski, Milad Nasr, Arthur Conmy, Eric Wallace, David Rolnick, Florian Tramèr
2023	A*	`conf`	(Certified!!) Adversarial Robustness for Free! ICLR Nicholas Carlini, Florian Tramèr, Krishnamurthy (Dj) Dvijotham, Leslie Rice, Mingjie Sun, J. Zico Kolter
2023	J	`jnl`	A LLM Assisted Exploitation of AI-Guardian. CoRR Nicholas Carlini
2023	A*	`conf`	Are aligned neural networks adversarially aligned? NeurIPS Nicholas Carlini, Milad Nasr, Christopher A. Choquette-Choo, Matthew Jagielski, Irena Gao, Pang Wei Koh, Daphne Ippolito, Florian Tramèr, Ludwig Schmidt
2023	J	`jnl`	Are aligned neural networks adversarially aligned? CoRR Nicholas Carlini, Milad Nasr, Christopher A. Choquette-Choo, Matthew Jagielski, Irena Gao, Anas Awadalla, Pang Wei Koh, Daphne Ippolito, Katherine Lee, Florian Tramèr, Ludwig Schmidt
2023	J	`jnl`	Backdoor Attacks for In-Context Learning with Language Models. CoRR Nikhil Kandpal, Matthew Jagielski, Florian Tramèr, Nicholas Carlini
2023	A*	`conf`	Counterfactual Memorization in Neural Language Models. NeurIPS Chiyuan Zhang, Daphne Ippolito, Katherine Lee, Matthew Jagielski, Florian Tramèr, Nicholas Carlini
2023	A*	`conf`	Effective Robustness against Natural Distribution Shifts for Models with Different Training Data. NeurIPS Zhouxing Shi, Nicholas Carlini, Ananth Balashankar, Ludwig Schmidt, Cho-Jui Hsieh, Alex Beutel, Yao Qin
2023	J	`jnl`	Effective Robustness against Natural Distribution Shifts for Models with Different Training Data. CoRR Zhouxing Shi, Nicholas Carlini, Ananth Balashankar, Ludwig Schmidt, Cho-Jui Hsieh, Alex Beutel, Yao Qin
2023	J	`jnl`	Evading Black-box Classifiers Without Breaking Eggs. CoRR Edoardo Debenedetti, Nicholas Carlini, Florian Tramèr
2023	A*	`conf`	Extracting Training Data from Diffusion Models. USENIX Security Symposium Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramèr, Borja Balle, Daphne Ippolito, Eric Wallace
2023	J	`jnl`	Extracting Training Data from Diffusion Models. CoRR Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramèr, Borja Balle, Daphne Ippolito, Eric Wallace
2023	J	`jnl`	Identifying and Mitigating the Security Risks of Generative AI. CoRR Clark W. Barrett, Brad Boyd, Ellie Burzstein, Nicholas Carlini, Brad Chen, Jihye Choi, Amrita Roy Chowdhury, Mihai Christodorescu, Anupam Datta, Soheil Feizi, Kathleen Fisher, Tatsunori Hashimoto, Dan Hendrycks, Somesh Jha, Daniel Kang, Florian Kerschbaum, Eric Mitchell, John C. Mitchell, Zulfikar Ramzan, Khawaja Shams, Dawn Song, Ankur Taly, Diyi Yang
2023	J	`jnl`	Identifying and Mitigating the Security Risks of Generative AI. Found. Trends Priv. Secur. Clark W. Barrett, Brad Boyd, Elie Bursztein, Nicholas Carlini, Brad Chen, Jihye Choi, Amrita Roy Chowdhury, Mihai Christodorescu, Anupam Datta, Soheil Feizi, Kathleen Fisher, Tatsunori Hashimoto, Dan Hendrycks, Somesh Jha, Daniel Kang, Florian Kerschbaum, Eric Mitchell, John C. Mitchell, Zulfikar Ramzan, Khawaja Shams, Dawn Song, Ankur Taly, Diyi Yang
2023	J	`jnl`	Initialization Matters for Adversarial Transfer Learning. CoRR Andong Hua, Jindong Gu, Zhiyu Xue, Nicholas Carlini, Eric Wong, Yao Qin
2023	A*	`conf`	Measuring Forgetting of Memorized Training Examples. ICLR Matthew Jagielski, Om Thakkar, Florian Tramèr, Daphne Ippolito, Katherine Lee, Nicholas Carlini, Eric Wallace, Shuang Song, Abhradeep Guha Thakurta, Nicolas Papernot, Chiyuan Zhang
2023	A*	`conf`	Part-Based Models Improve Adversarial Robustness. ICLR Chawin Sitawarin, Kornrapat Pongmala, Yizheng Chen, Nicholas Carlini, David A. Wagner
2023	J	`jnl`	Poisoning Web-Scale Training Datasets is Practical. CoRR Nicholas Carlini, Matthew Jagielski, Christopher A. Choquette-Choo, Daniel Paleka, Will Pearce, Hyrum S. Anderson, Andreas Terzis, Kurt Thomas, Florian Tramèr
2023	A*	`conf`	Preprocessors Matter! Realistic Decision-Based Attacks on Machine Learning Systems. ICML Chawin Sitawarin, Florian Tramèr, Nicholas Carlini
2023	B	`conf`	Preventing Generation of Verbatim Memorization in Language Models Gives a False Sense of Privacy. INLG Daphne Ippolito, Florian Tramèr, Milad Nasr, Chiyuan Zhang, Matthew Jagielski, Katherine Lee, Christopher A. Choquette-Choo, Nicholas Carlini
2023	J	`jnl`	Privacy Side Channels in Machine Learning Systems. CoRR Edoardo Debenedetti, Giorgio Severi, Nicholas Carlini, Christopher A. Choquette-Choo, Matthew Jagielski, Milad Nasr, Eric Wallace, Florian Tramèr
2023	—	`conf`	Publishing Efficient On-device Models Increases Adversarial Vulnerability. SaTML Sanghyun Hong, Nicholas Carlini, Alexey Kurakin
2023	A*	`conf`	Quantifying Memorization Across Neural Language Models. ICLR Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramèr, Chiyuan Zhang
2023	J	`jnl`	Randomness in ML Defenses Helps Persistent Attackers and Hinders Evaluators. CoRR Keane Lucas, Matthew Jagielski, Florian Tramèr, Lujo Bauer, Nicholas Carlini
2023	J	`jnl`	Report of the 1st Workshop on Generative AI and Law. CoRR A. Feder Cooper, Katherine Lee, James Grimmelmann, Daphne Ippolito, Christopher Callison-Burch, Christopher A. Choquette-Choo, Niloofar Mireshghallah, Miles Brundage, David Mimno, Madiha Zahrah Choksi, Jack M. Balkin, Nicholas Carlini, Christopher De Sa, Jonathan Frankle, Deep Ganguli, Bryant Gipson, Andres Guadamuz, Swee Leng Harris, Abigail Z. Jacobs, Elizabeth Joh, Gautam Kamath, Mark A. Lemley, Cass Matthews, Christine McLeavey, Corynne McSherry, Milad Nasr, Paul Ohm, Adam Roberts, Tom Rubin, Pamela Samuelson, Ludwig Schubert, Kristen Vaccaro, Luis Villa, Felix Wu, Elana Zeide
2023	B	`conf`	Reverse-Engineering Decoding Strategies Given Blackbox Access to a Language Generation System. INLG Daphne Ippolito, Nicholas Carlini, Katherine Lee, Milad Nasr, Yun William Yu
2023	J	`jnl`	Reverse-Engineering Decoding Strategies Given Blackbox Access to a Language Generation System. CoRR Daphne Ippolito, Nicholas Carlini, Katherine Lee, Milad Nasr, Yun William Yu
2023	J	`jnl`	Scalable Extraction of Training Data from (Production) Language Models. CoRR Milad Nasr, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A. Feder Cooper, Daphne Ippolito, Christopher A. Choquette-Choo, Eric Wallace, Florian Tramèr, Katherine Lee
2023	A*	`conf`	Students Parrot Their Teachers: Membership Inference on Model Distillation. NeurIPS Matthew Jagielski, Milad Nasr, Katherine Lee, Christopher A. Choquette-Choo, Nicholas Carlini, Florian Tramèr
2023	J	`jnl`	Students Parrot Their Teachers: Membership Inference on Model Distillation. CoRR Matthew Jagielski, Milad Nasr, Christopher A. Choquette-Choo, Katherine Lee, Nicholas Carlini
2023	A*	`conf`	Tight Auditing of Differentially Private Machine Learning. USENIX Security Symposium Milad Nasr, Jamie Hayes, Thomas Steinke, Borja Balle, Florian Tramèr, Matthew Jagielski, Nicholas Carlini, Andreas Terzis
2023	J	`jnl`	Tight Auditing of Differentially Private Machine Learning. CoRR Milad Nasr, Jamie Hayes, Thomas Steinke, Borja Balle, Florian Tramèr, Matthew Jagielski, Nicholas Carlini, Andreas Terzis
2022	J	`jnl`	(Certified!!) Adversarial Robustness for Free! CoRR Nicholas Carlini, Florian Tramèr, Krishnamurthy Dvijotham, J. Zico Kolter
2022	A*	`conf`	AdaMatch: A Unified Approach to Semi-Supervised Learning and Domain Adaptation. ICLR David Berthelot, Rebecca Roelofs, Kihyuk Sohn, Nicholas Carlini, Alexey Kurakin
2022	J	`jnl`	Considerations for Differentially Private Learning with Large-Scale Public Pretraining. CoRR Florian Tramèr, Gautam Kamath, Nicholas Carlini
2022	A*	`conf`	Data Poisoning Won't Save You From Facial Recognition. ICLR Evani Radiya-Dixit, Sanghyun Hong, Nicholas Carlini, Florian Tramèr
2022	J	`jnl`	Debugging Differential Privacy: A Case Study for Privacy Auditing. CoRR Florian Tramèr, Andreas Terzis, Thomas Steinke, Shuang Song, Matthew Jagielski, Nicholas Carlini
2022	—	`conf`	Deduplicating Training Data Makes Language Models Better. ACL (1) Katherine Lee, Daphne Ippolito, Andrew Nystrom, Chiyuan Zhang, Douglas Eck, Chris Callison-Burch, Nicholas Carlini
2022	A*	`conf`	Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent. ICLR Oliver Bryniarski, Nabeel Hingun, Pedro Pachuca, Vincent Wang, Nicholas Carlini
2022	A*	`conf`	Handcrafted Backdoors in Deep Neural Networks. NeurIPS Sanghyun Hong, Nicholas Carlini, Alexey Kurakin
2022	A*	`conf`	Increasing Confidence in Adversarial Robustness Evaluations. NeurIPS Roland S. Zimmermann, Wieland Brendel, Florian Tramèr, Nicholas Carlini
2022	J	`jnl`	Increasing Confidence in Adversarial Robustness Evaluations. CoRR Roland S. Zimmermann, Wieland Brendel, Florian Tramèr, Nicholas Carlini
2022	A*	`conf`	Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples. NeurIPS Maura Pintor, Luca Demetrio, Angelo Sotgiu, Ambra Demontis, Nicholas Carlini, Battista Biggio, Fabio Roli
2022	J	`jnl`	Measuring Forgetting of Memorized Training Examples. CoRR Matthew Jagielski, Om Thakkar, Florian Tramèr, Daphne Ippolito, Katherine Lee, Nicholas Carlini, Eric Wallace, Shuang Song, Abhradeep Thakurta, Nicolas Papernot, Chiyuan Zhang
2022	A*	`conf`	Membership Inference Attacks From First Principles. SP Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, Florian Tramèr
2022	J	`jnl`	No Free Lunch in "Privacy for Free: How does Dataset Condensation Help Privacy". CoRR Nicholas Carlini, Vitaly Feldman, Milad Nasr
2022	J	`jnl`	Part-Based Models Improve Adversarial Robustness. CoRR Chawin Sitawarin, Kornrapat Pongmala, Yizheng Chen, Nicholas Carlini, David A. Wagner
2022	A*	`conf`	Poisoning and Backdooring Contrastive Learning. ICLR Nicholas Carlini, Andreas Terzis
2022	J	`jnl`	Preprocessors Matter! Realistic Decision-Based Attacks on Machine Learning Systems. CoRR Chawin Sitawarin, Florian Tramèr, Nicholas Carlini
2022	J	`jnl`	Preventing Verbatim Memorization in Language Models Gives a False Sense of Privacy. CoRR Daphne Ippolito, Florian Tramèr, Milad Nasr, Chiyuan Zhang, Matthew Jagielski, Katherine Lee, Christopher A. Choquette-Choo, Nicholas Carlini
2022	J	`jnl`	Publishing Efficient On-device Models Increases Adversarial Vulnerability. CoRR Sanghyun Hong, Nicholas Carlini, Alexey Kurakin
2022	J	`jnl`	Quantifying Memorization Across Neural Language Models. CoRR Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramèr, Chiyuan Zhang
2022	J	`jnl`	Security of Machine Learning (Dagstuhl Seminar 22281). Dagstuhl Reports Battista Biggio, Nicholas Carlini, Pavel Laskov, Konrad Rieck, Antonio Emanuele Cinà
2022	A*	`conf`	The Privacy Onion Effect: Memorization is Relative. NeurIPS Nicholas Carlini, Matthew Jagielski, Chiyuan Zhang, Nicolas Papernot, Andreas Terzis, Florian Tramèr
2022	J	`jnl`	The Privacy Onion Effect: Memorization is Relative. CoRR Nicholas Carlini, Matthew Jagielski, Chiyuan Zhang, Nicolas Papernot, Andreas Terzis, Florian Tramèr
2022	A*	`conf`	Truth Serum: Poisoning Machine Learning Models to Reveal Their Secrets. CCS Florian Tramèr, Reza Shokri, Ayrton San Joaquin, Hoang Le, Matthew Jagielski, Sanghyun Hong, Nicholas Carlini
2022	J	`jnl`	Truth Serum: Poisoning Machine Learning Models to Reveal Their Secrets. CoRR Florian Tramèr, Reza Shokri, Ayrton San Joaquin, Hoang Le, Matthew Jagielski, Sanghyun Hong, Nicholas Carlini
2021	—	`ed.`	AISec@CCS 2021: Proceedings of the 14th ACM Workshop on Artificial Intelligence and Security, Virtual Event, Republic of Korea, 15 November 2021 AISec@CCS Nicholas Carlini, Ambra Demontis, Yizheng Chen
2021	J	`jnl`	AdaMatch: A Unified Approach to Semi-Supervised Learning and Domain Adaptation. CoRR David Berthelot, Rebecca Roelofs, Kihyuk Sohn, Nicholas Carlini, Alex Kurakin
2021	A*	`conf`	Adversary Instantiation: Lower Bounds for Differentially Private Machine Learning. SP Milad Nasr, Shuang Song, Abhradeep Thakurta, Nicolas Papernot, Nicholas Carlini
2021	J	`jnl`	Adversary Instantiation: Lower Bounds for Differentially Private Machine Learning. CoRR Milad Nasr, Shuang Song, Abhradeep Thakurta, Nicolas Papernot, Nicholas Carlini
2021	J	`jnl`	Counterfactual Memorization in Neural Language Models. CoRR Chiyuan Zhang, Daphne Ippolito, Katherine Lee, Matthew Jagielski, Florian Tramèr, Nicholas Carlini
2021	J	`jnl`	Deduplicating Training Data Makes Language Models Better. CoRR Katherine Lee, Daphne Ippolito, Andrew Nystrom, Chiyuan Zhang, Douglas Eck, Chris Callison-Burch, Nicholas Carlini
2021	J	`jnl`	Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent. CoRR Oliver Bryniarski, Nabeel Hingun, Pedro Pachuca, Vincent Wang, Nicholas Carlini
2021	A*	`conf`	Extracting Training Data from Large Language Models. USENIX Security Symposium Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom B. Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea, Colin Raffel
2021	J	`jnl`	Handcrafted Backdoors in Deep Neural Networks. CoRR Sanghyun Hong, Nicholas Carlini, Alexey Kurakin
2021	C	`conf`	How Private is Machine Learning? IH&MMSec Nicholas Carlini
2021	J	`jnl`	Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples. CoRR Maura Pintor, Luca Demetrio, Angelo Sotgiu, Giovanni Manca, Ambra Demontis, Nicholas Carlini, Battista Biggio, Fabio Roli
2021	A*	`conf`	Is Private Learning Possible with Instance Encoding? SP Nicholas Carlini, Samuel Deng, Sanjam Garg, Somesh Jha, Saeed Mahloujifar, Mohammad Mahmoody, Abhradeep Thakurta, Florian Tramèr
2021	A*	`conf`	Label-Only Membership Inference Attacks. ICML Christopher A. Choquette-Choo, Florian Tramèr, Nicholas Carlini, Nicolas Papernot
2021	J	`jnl`	Membership Inference Attacks From First Principles. CoRR Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, Florian Tramèr
2021	J	`jnl`	NeuraCrypt is not private. CoRR Nicholas Carlini, Sanjam Garg, Somesh Jha, Saeed Mahloujifar, Mohammad Mahmoody, Florian Tramèr
2021	J	`jnl`	Poisoning and Backdooring Contrastive Learning. CoRR Nicholas Carlini, Andreas Terzis
2021	A*	`conf`	Poisoning the Unlabeled Dataset of Semi-Supervised Learning. USENIX Security Symposium Nicholas Carlini
2021	J	`jnl`	Poisoning the Unlabeled Dataset of Semi-Supervised Learning. CoRR Nicholas Carlini
2021	—	`conf`	Session details: Session 1: Adversarial Machine Learning. AISec@CCS Nicholas Carlini
2021	—	`conf`	Session details: Session 2A: Machine Learning for Cybersecurity. AISec@CCS Nicholas Carlini
2021	J	`jnl`	Unsolved Problems in ML Safety. CoRR Dan Hendrycks, Nicholas Carlini, John Schulman, Jacob Steinhardt
2020	J	`jnl`	A Partial Break of the Honeypots Defense to Catch Adversarial Attacks. CoRR Nicholas Carlini
2020	A*	`conf`	AISec'20: 13th Workshop on Artificial Intelligence and Security. CCS Sadia Afroz, Nicholas Carlini, Ambra Demontis
2020	J	`jnl`	An Attack on InstaHide: Is Private Learning Possible with Instance Encoding? CoRR Nicholas Carlini, Samuel Deng, Sanjam Garg, Somesh Jha, Saeed Mahloujifar, Mohammad Mahmoody, Shuang Song, Abhradeep Thakurta, Florian Tramèr
2020	—	`conf`	Cryptanalytic Extraction of Neural Network Models. CRYPTO (3) Nicholas Carlini, Matthew Jagielski, Ilya Mironov
2020	J	`jnl`	Cryptanalytic Extraction of Neural Network Models. CoRR Nicholas Carlini, Matthew Jagielski, Ilya Mironov
2020	J	`jnl`	Erratum Concerning the Obfuscated Gradients Attack on Stochastic Activation Pruning. CoRR Guneet S. Dhillon, Nicholas Carlini
2020	—	`conf`	Evading Deepfake-Image Detectors with White- and Black-Box Attacks. CVPR Workshops Nicholas Carlini, Hany Farid
2020	J	`jnl`	Evading Deepfake-Image Detectors with White- and Black-Box Attacks. CoRR Nicholas Carlini, Hany Farid
2020	J	`jnl`	Extracting Training Data from Large Language Models. CoRR Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom B. Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea, Colin Raffel
2020	A*	`conf`	FixMatch: Simplifying Semi-Supervised Learning with Consistency and Confidence. NeurIPS Kihyuk Sohn, David Berthelot, Nicholas Carlini, Zizhao Zhang, Han Zhang, Colin Raffel, Ekin Dogus Cubuk, Alexey Kurakin, Chun-Liang Li
2020	J	`jnl`	FixMatch: Simplifying Semi-Supervised Learning with Consistency and Confidence. CoRR Kihyuk Sohn, David Berthelot, Chun-Liang Li, Zizhao Zhang, Nicholas Carlini, Ekin D. Cubuk, Alex Kurakin, Han Zhang, Colin Raffel
2020	A*	`conf`	Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations. ICML Florian Tramèr, Jens Behrmann, Nicholas Carlini, Nicolas Papernot, Jörn-Henrik Jacobsen
2020	J	`jnl`	Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations. CoRR Florian Tramèr, Jens Behrmann, Nicholas Carlini, Nicolas Papernot, Jörn-Henrik Jacobsen
2020	A*	`conf`	High Accuracy and High Fidelity Extraction of Neural Networks. USENIX Security Symposium Matthew Jagielski, Nicholas Carlini, David Berthelot, Alex Kurakin, Nicolas Papernot
2020	J	`jnl`	Label-Only Membership Inference Attacks. CoRR Christopher A. Choquette-Choo, Florian Tramèr, Nicholas Carlini, Nicolas Papernot
2020	A*	`conf`	Measuring Robustness to Natural Distribution Shifts in Image Classification. NeurIPS Rohan Taori, Achal Dave, Vaishaal Shankar, Nicholas Carlini, Benjamin Recht, Ludwig Schmidt
2020	J	`jnl`	Measuring Robustness to Natural Distribution Shifts in Image Classification. CoRR Rohan Taori, Achal Dave, Vaishaal Shankar, Nicholas Carlini, Benjamin Recht, Ludwig Schmidt
2020	A*	`conf`	On Adaptive Attacks to Adversarial Example Defenses. NeurIPS Florian Tramèr, Nicholas Carlini, Wieland Brendel, Aleksander Madry
2020	J	`jnl`	On Adaptive Attacks to Adversarial Example Defenses. CoRR Florian Tramèr, Nicholas Carlini, Wieland Brendel, Aleksander Madry
2020	A*	`conf`	ReMixMatch: Semi-Supervised Learning with Distribution Matching and Augmentation Anchoring. ICLR David Berthelot, Nicholas Carlini, Ekin D. Cubuk, Alex Kurakin, Kihyuk Sohn, Han Zhang, Colin Raffel
2019	J	`jnl`	A critique of the DeepSec Platform for Security Analysis of Deep Learning Models. CoRR Nicholas Carlini
2019	A*	`conf`	AISec'19: 12th ACM Workshop on Artificial Intelligence and Security. CCS Sadia Afroz, Battista Biggio, Nicholas Carlini, Yuval Elovici, Asaf Shabtai
2019	A*	`conf`	Adversarial Examples Are a Natural Consequence of Test Error in Noise. ICML Justin Gilmer, Nicolas Ford, Nicholas Carlini, Ekin D. Cubuk
2019	J	`jnl`	Adversarial Examples Are a Natural Consequence of Test Error in Noise. CoRR Nic Ford, Justin Gilmer, Nicholas Carlini, Ekin Dogus Cubuk
2019	J	`jnl`	Distribution Density, Tails, and Outliers in Machine Learning: Metrics and Applications. CoRR Nicholas Carlini, Úlfar Erlingsson, Nicolas Papernot
2019	J	`jnl`	Exploiting Excessive Invariance caused by Norm-Bounded Adversarial Robustness. CoRR Jörn-Henrik Jacobsen, Jens Behrmann, Nicholas Carlini, Florian Tramèr, Nicolas Papernot
2019	J	`jnl`	High-Fidelity Extraction of Neural Network Models. CoRR Matthew Jagielski, Nicholas Carlini, David Berthelot, Alex Kurakin, Nicolas Papernot
2019	A*	`conf`	Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition. ICML Yao Qin, Nicholas Carlini, Garrison W. Cottrell, Ian J. Goodfellow, Colin Raffel
2019	J	`jnl`	Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition. CoRR Yao Qin, Nicholas Carlini, Ian J. Goodfellow, Garrison W. Cottrell, Colin Raffel
2019	J	`jnl`	Is AmI (Attacks Meet Interpretability) Robust to Adversarial Examples? CoRR Nicholas Carlini
2019	A*	`conf`	MixMatch: A Holistic Approach to Semi-Supervised Learning. NeurIPS David Berthelot, Nicholas Carlini, Ian J. Goodfellow, Nicolas Papernot, Avital Oliver, Colin Raffel
2019	J	`jnl`	MixMatch: A Holistic Approach to Semi-Supervised Learning. CoRR David Berthelot, Nicholas Carlini, Ian J. Goodfellow, Nicolas Papernot, Avital Oliver, Colin Raffel
2019	J	`jnl`	On Evaluating Adversarial Robustness. CoRR Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian J. Goodfellow, Aleksander Madry, Alexey Kurakin
2019	—	`ed.`	Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security, AISec@CCS 2019, London, UK, November 15, 2019. AISec@CCS Lorenzo Cavallaro, Johannes Kinder, Sadia Afroz, Battista Biggio, Nicholas Carlini, Yuval Elovici, Asaf Shabtai
2019	J	`jnl`	ReMixMatch: Semi-Supervised Learning with Distribution Alignment and Augmentation Anchoring. CoRR David Berthelot, Nicholas Carlini, Ekin D. Cubuk, Alex Kurakin, Kihyuk Sohn, Han Zhang, Colin Raffel
2019	J	`jnl`	Stateful Detection of Black-Box Adversarial Attacks. CoRR Steven Chen, Nicholas Carlini, David A. Wagner
2019	J	`jnl`	SysML: The New Frontier of Machine Learning Systems. CoRR Alexander Ratner, Dan Alistarh, Gustavo Alonso, David G. Andersen, Peter Bailis, Sarah Bird, Nicholas Carlini, Bryan Catanzaro, Eric S. Chung, Bill Dally, Jeff Dean, Inderjit S. Dhillon, Alexandros G. Dimakis, Pradeep Dubey, Charles Elkan, Grigori Fursin, Gregory R. Ganger, Lise Getoor, Phillip B. Gibbons, Garth A. Gibson, Joseph E. Gonzalez, Justin Gottschlich, Song Han, Kim M. Hazelwood, Furong Huang, Martin Jaggi, Kevin Jamieson, Michael I. Jordan, Gauri Joshi, Rania Khalaf, Jason Knight, Jakub Konecný, Tim Kraska, Arun Kumar, Anastasios Kyrillidis, Jing Li, Samuel Madden, H. Brendan McMahan, Erik Meijer, Ioannis Mitliagkas, Rajat Monga, Derek Gordon Murray, Dimitris S. Papailiopoulos, Gennady Pekhimenko, Theodoros Rekatsinas, Afshin Rostamizadeh, Christopher Ré, Christopher De Sa, Hanie Sedghi, Siddhartha Sen, Virginia Smith, Alex Smola, Dawn Song, Evan Randall Sparks, Ion Stoica, Vivienne Sze, Madeleine Udell, Joaquin Vanschoren, Shivaram Venkataraman, Rashmi Vinayak, Markus Weimer, Andrew Gordon Wilson, Eric P. Xing, Matei Zaharia, Ce Zhang, Ameet Talwalkar
2019	A*	`conf`	The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks. USENIX Security Symposium Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, Dawn Song
2018	—	`conf`	Audio Adversarial Examples: Targeted Attacks on Speech-to-Text. IEEE Symposium on Security and Privacy Workshops Nicholas Carlini, David A. Wagner
2018	J	`jnl`	Audio Adversarial Examples: Targeted Attacks on Speech-to-Text. CoRR Nicholas Carlini, David A. Wagner
2018	—	`—`	Evaluation and Design of Robust Neural Network Defenses. Nicholas Carlini
2018	A*	`conf`	Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples. ICML Anish Athalye, Nicholas Carlini, David A. Wagner
2018	J	`jnl`	Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples. CoRR Anish Athalye, Nicholas Carlini, David A. Wagner
2018	J	`jnl`	On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses. CoRR Anish Athalye, Nicholas Carlini
2018	J	`jnl`	The Secret Sharer: Measuring Unintended Neural Network Memorization & Extracting Secrets. CoRR Nicholas Carlini, Chang Liu, Jernej Kos, Úlfar Erlingsson, Dawn Song
2018	J	`jnl`	Unrestricted Adversarial Examples. CoRR Tom B. Brown, Nicholas Carlini, Chiyuan Zhang, Catherine Olsson, Paul F. Christiano, Ian J. Goodfellow
2017	—	`conf`	Adversarial Example Defense: Ensembles of Weak Defenses are not Strong. WOOT Warren He, James Wei, Xinyun Chen, Nicholas Carlini, Dawn Song
2017	J	`jnl`	Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong. CoRR Warren He, James Wei, Xinyun Chen, Nicholas Carlini, Dawn Song
2017	—	`conf`	Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods. AISec@CCS Nicholas Carlini, David A. Wagner
2017	J	`jnl`	Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods. CoRR Nicholas Carlini, David A. Wagner
2017	J	`jnl`	Ground-Truth Adversarial Examples. CoRR Nicholas Carlini, Guy Katz, Clark W. Barrett, David L. Dill
2017	J	`jnl`	MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples. CoRR Nicholas Carlini, David A. Wagner
2017	A*	`conf`	Towards Evaluating the Robustness of Neural Networks. IEEE Symposium on Security and Privacy Nicholas Carlini, David A. Wagner
2016	J	`jnl`	Defensive Distillation is Not Robust to Adversarial Examples. CoRR Nicholas Carlini, David A. Wagner
2016	A*	`conf`	Hidden Voice Commands. USENIX Security Symposium Nicholas Carlini, Pratyush Mishra, Tavish Vaidya, Yuankai Zhang, Micah Sherr, Clay Shields, David A. Wagner, Wenchao Zhou
2016	J	`jnl`	Towards Evaluating the Robustness of Neural Networks. CoRR Nicholas Carlini, David A. Wagner
2015	A*	`conf`	Control-Flow Bending: On the Effectiveness of Control-Flow Integrity. USENIX Security Symposium Nicholas Carlini, Antonio Barresi, Mathias Payer, David A. Wagner, Thomas R. Gross
2014	A*	`conf`	ROP is Still Dangerous: Breaking Modern Defenses. USENIX Security Symposium Nicholas Carlini, David A. Wagner
2013	—	`conf`	Improved Support for Machine-assisted Ballot-level Audits. EVT/WOTE Eric Kim, Nicholas Carlini, Andrew Chang, George Yiu, Kai Wang, David A. Wagner
2012	A*	`conf`	An Evaluation of the Google Chrome Extension Security Architecture. USENIX Security Symposium Nicholas Carlini, Adrienne Porter Felt, David A. Wagner
2012	—	`conf`	Operator-Assisted Tabulation of Optical Scan Ballots. EVT/WOTE Kai Wang, Nicholas Carlini, Eric Kim, Ivan Motyashov, Daniel Nguyen, David A. Wagner