TodayNewsResearchFieldsStacksMarketAnalytics
⌘K

Research

New papers ranked by attention, with their code, models and discussion linked. Pick a field on the left.

Field

Papers

Open problems

Rising research topics

Coming with more sources: more tagged papers
  • Federated learning46+31.4%
  • Sensing communication16+14.3%
  • Agents536+4.7%
  • Frontier LLMs457−4.2%
  • Forecasting time81−10.0%
  • Character recognition OCR17−10.5%
  • Inference & serving271−12.0%
  • Learning verifiable rewards168−15.6%

Ask the research

Sample
ByteTrail · AI and developer-tools intelligence
NewsResearchStacksAPI
Fields · this week
All fields3555Multimodal546Agents536Frontier LLMs457Inference & serving271Image segmentation175Graph learning171Learning verifiable rewards1683D scene155Evals108Voice AI100Flow matching82Forecasting time81Classifier & causal discovery81Training & fine-tuning64Teacher policy distillation57Adversarial training44All 32 fields
WeekMonthQuarterAll
NewestMost relevant

Papers

Papers

  • arXiv cs.ROOct 20

    Enumeration-Guided Training of Neural Hamilton-Jacobi Safety Certificates

    Mihaela-Larisa Clement, Tosca Pierro, Ezio Bartocci, Luca Marzari

    Hamilton-Jacobi (HJ) reachability analysis offers formal safety guarantees for control systems, but training accurate neural certificates remains difficult, particularly when unsafe regions are hard to characterize. We propose a verification-guided training framework that addresses this by using probabilistic enumeration of safety constraints to detect forward-invariance violations, i.e., states where the learned certificate incorrectly classifies unsafe behavior. This produces a compact, targeted set of counterexamples that more precisely captures the failure boundary than inputs generated by standard adversarial attack methods. Crucially, using this representation to fine-tune a pretrained HJ value function yields larger certified regions and reduces certification time across all tested benchmarks. We further introduce a shielding mechanism based on the refined certificates to enforce safety constraints at deployment time. We evaluate the proposed safety filter in a realistic, physics-based Isaac Sim environment and through real-world autonomous racing experiments, achieving zero safety constraint violations compared to a nominal controller and a backup policy based on Linear…

    PDF
  • arXiv cs.CVOct 20

    Decoupled Representation Learning for Face Presentation Attack Detection under Smart Glass Capture

    Raghavendra Ramachandra, Narayan Vetrekar, Neha Naik, Rajendra Gad

    Face presentation attack detection is typically studied under fixed camera or handheld acquisition, whereas smart glass capture introduces a more challenging setting with ego motion, changing viewpoint, background clutter, distance variation, and less controlled illumination. To address this challenge, we present \emph{SmaGla-FPAD}, a smart glass based face presentation attack database acquired using Ray-Ban Meta Wayfarer Smart Glasses across indoor, outdoor, and in-car settings. The database contains 297,000 sample images with both bona fide and silicone mask based attacks. We further propose \emph{DeCoupPAD-FAS++}, a decoupled representation learning framework that separates spoof related evidence from nuisance sensitive capture variation through complementary attack and style branches, pseudo-domain supervision, adversarial suppression, and prompt guided semantic alignment. Experiments on SmaGla-FPAD show that the proposed method achieves the best balance between attack rejection and bona fide acceptance in both in domain and cross scenario evaluation. Ablation results further confirm the contribution of disentanglement, pseudo-domain supervision, and prompt based…

    PDF
  • arXiv cs.LGOct 20

    How Much Do $\ell_1$ Attacks Need Concentrated Perturbations?

    Melika Shirian, Kianoosh Vadaei, Arshia Hemmat

    A global $\ell_1$ budget limits how much an adversary may change an image, not how that change is distributed. We ask how much of an $\ell_1$ attack's observed success remains when large coordinate changes are restricted. We add a per-coordinate cap to the budget, enforce the joint constraint by exact in-loop projection, and sweep the cap for APGD-$\ell_1$, SLIDE, and FMN-$\ell_1$ without altering their objectives. Across 18 standard-model settings, caps of at most $32/255$ retain a median $97\%$ of attack success relative to each method's native uncapped baseline, while median peak magnitude falls by $80\%$ and median effective support nearly triples. At matched realized $\ell_1$, capped perturbations remain structurally distinct; separate ImageNet comparisons also show lower LPIPS and DISTS at selected caps. Direct in-loop constrained optimization preserves up to $88$ percentage points more attack success than post-hoc clipping, highlighting the importance of constraint enforcement. Suitable caps nevertheless vary across attacks and models, and adversarially trained classifiers exhibit more heterogeneous concentration sensitivity. These results establish perturbation…

    PDF
  • arXiv cs.CROct 20

    A Unified Attack Framework against Statistical Generative Watermarks for Large Language Models

    Romina Omidi, Nima Naderloui, Yuan Hong, Binghui Wang

    Watermarking has emerged as a key tool for identifying text generated by large language models (LLMs), with current schemes embedding statistical signals into the generation process to enable later detection. In this work, we identify a shared weakness across a broad class of popular LLM watermarking methods, including KGW (and its variants), GumbelSoft, DipMark, ITS, and SynthID. We show that these schemes exhibit a fundamental link between their detection scores and the token probability shifts they introduce during generation. This link, which we call score-ratio alignment, allows an attacker with only black-box query access to the model--and no knowledge of secret keys or model weights--to produce text that evades detection while remaining fluent and natural. We prove that the resulting attack is optimal across all covered watermark families, and show that the weakness is intrinsic: any watermark designed to maximize statistical detection power necessarily induces the very structure that attackers can exploit. We evaluate our attack on seven popular generative LLM watermarking schemes, three LLMs, and tasks, which reduce detection rates to at most 0.05 across all settings…

    PDF
  • arXiv cs.LGOct 20

    Bridging Digital Deception and Physical Fidelity: A Spatio-Temporal Attack on Cognitive Radars

    Tongrun Xing, Yongjun Dai, Xuan Liao, Zhiwen Zhang, Tong Zhou +2

    As cognitive radars evolve towards the end-to-end processing of one-dimensional complex baseband sequences, deep networks face severe adversarial threats. However, existing attacks encounter dual limitations in practical electronic warfare: low cross-architecture transferability and severe vulnerability to physical channel distortions, which degrades their tactical reliability. To overcome these bottlenecks, we propose a physical prior-driven Segmented Spatio-Temporal Attack (SSTA). First, a global-local feature decoupling segmentation mechanism interrupts the adversarial gradients' dependence on long-range sequence coherence, bridging the cross-architecture feature gap. Second, moving beyond static norm constraints devoid of physical semantics, we abstract channel distortions into differentiable spatio-temporal operators, integrating them into momentum iterations via an Expectation over Transformation (EoT) strategy. Comprehensive cross-evaluations across 9 heterogeneous models spanning CNNs, RNNs, and Transformers demonstrate that SSTA outperforms the state-of-the-art baseline by 10.36% in Average Black-Box Attack Success Rate. Furthermore, baseband equivalent simulations…

    PDF
  • arXiv cs.CVOct 20

    AnomalyJev: Towards Evaluating Image Anomaly Explanations via Claim-Level Verification

    Qizhou Wang, Jiawen Zhu, Guansong Pang, Christopher Leckie

    Recent multimodal LLM (MLLM)-based anomaly detection (AD) methods can generate textual explanations that help interpret their predictions. However, reliably and efficiently evaluating these explanations remains challenging. While LLM judges can assess explanations through structured rubrics, they often require substantial token generation, making evaluation costly and difficult to scale. We instead propose to anchor evaluation in the available ground truth by extracting verifiable claims from each explanation and verifying them against the corresponding annotations. We instantiate this idea as AnomalyJev, a lightweight framework that extracts verifiable claims from contextualised representations using ground-truth-defined queries and pointer based heads, without token generation. The claims are then verified against the ground truth to score faithfulness and completeness. For evaluation, we construct a human-annotated set of 640 explanations with over 1,600 expert ratings across in-domain and cross-dataset settings. Despite its compact design, AnomalyJev achieves stronger agreement with human annotators than most open MLLM judges and approaches that of flagship MLLM judges, at a…

    PDF
  • arXiv cs.LGOct 20

    Learning-Theoretic Foundation for General Coded Computing: The Adversarial Setting

    Parsa Moradi, Hanzaleh Akbarinodehi, Mohammad Ali Maddah-Ali

    Adversarial workers pose a severe challenge in distributed computing systems by returning corrupted outputs that can substantially distort the recovered computations. Coded computing addresses this threat by introducing redundancy across worker assignments. Existing exact and approximate coded-computing methods typically handle adversarial outputs by explicitly locating and correcting or removing erroneous evaluations, which adds significant computational overhead at the master node. Moreover, existing analyses do not characterize how the recovery error scales with the number of workers and the adversarial budget. In this paper, we develop an adversarially robust extension of general coded computing (GCC), a learning-theoretic approximate coded-computing framework that designs the encoder and decoder by minimizing an upper bound on the end-to-end recovery error. Rather than identifying corrupted workers, the proposed method uses smoothness regularization to limit the influence of their outputs. The resulting encoder and decoder can be implemented using smoothing splines with linear master-side complexity. We derive a non-asymptotic bound on the worst-case end-to-end approximation…

    PDF
  • arXiv cs.CROct 19

    Exposing Vulnerability Monoculture Through Systemic Adversarial Robustness

    Leo Elmecker-Plakolm, Lukasz Szpruch, Avishek Joey Bose, Matthew Wicker

    Beneath the apparent diversity of foundation models lies an increasingly homogeneous technical stack of common training pipelines, distillation methods, and data. These shared algorithmic choices can expose an otherwise distinct model ecosystem to concentrated risks leading to a vulnerability monoculture. Yet current practice in assessing adversarial robustness is restricted to individual robustness scores and attack transfer rates, leaving open the unexplored fundamental question: how many attacks suffice for catastrophic widespread compromise? In this paper, we investigate the empirical nature of shared vulnerabilities within a model pool and introduce Systemic Adversarial Robustness (SAR), a novel measure of shared vulnerability of a model pool through the attack diversity needed to exploit it. Specifically, SAR interpolates between single-attack transferability and independent per-model robustness: small values reveal a vulnerability monoculture, whereas large values indicate that failures are dispersed across models. We theoretically formulate SAR as a partial set-cover problem with provable approximation guarantees---enabling the development of scalable algorithms to…

    PDF
  • arXiv cs.LGOct 19

    ClockMark: Adaptive and Host-Dependent Watermarking for Large Language Models

    Yupeng Qiu, Han Fang, Ee-Chien Chang

    Large language model (LLM) watermarking operates on the next-token distribution that evolves during generation. In streaming generation, each sampled token becomes part of the text and affects subsequent distributions. Embedding therefore proceeds with a changing host, unlike classical watermarking, which adapts embedding to an existing host signal. To accommodate this difference, we formulate a novel embedding framework for LLM watermarking based on two principles. We first argue that embedding should be adaptive, retaining the state of previous sampling decisions to better guide subsequent choices. We further argue that embedding should be host-dependent, using the current LLM distribution to constrain both token selection and state updates. Guided by these principles and the two requirements of distribution preservation and robustness to text editing, we propose ClockMark. It combines adaptive and host-dependent embedding with message spreading, embedding the full payload in each watermarked token. Theoretically, we prove that ClockMark preserves the original LLM sequence distribution, thereby maintaining generation quality. Empirically, extensive experiments against 12…

    PDF
  • arXiv cs.CVOct 19

    BrushOff: Stroke-Based Re-rendering as a Watermark Removal Attack on Painting

    Hao Chen, Junnan Xu

    Invisible watermarks are used to mark who owns a painting. We show that a simple attack removes the most robust one we test. The attack redraws the watermarked painting with brush strokes, using a pretrained stroke-based renderer. We call this attack BrushOff. It needs no training, no knowledge of the watermark, and no generative model. We test four watermarks on 500 paintings from five styles. VINE, a recent watermark built to survive image editing, survives all 14 conventional distortions we test, with at least 97.8% detection. Repainting lowers its detection to 1.8%, while the output keeps a no-reference quality score close to that of the clean paintings. Diffusion regeneration can also remove VINE, but at the same removal level it moves the image twice as far from the painting in DreamSim distance, and it changes what the painting shows. Because the renderer draws a countable number of strokes, we can control the attack strength step by step. Finally, we test what kind of signal survives. A simple probe that stores bits in the relative brightness of neighboring regions survives repainting, while a probe that uses absolute brightness does not. The same probe fails under…

    PDF
  • arXiv cs.CVOct 19

    Interpretable Face Contrast Modeling for Smartphone Portrait Rendering

    Yujin Cho, Benoît Pochon, Jean-Michel Morel, Gabriele Facciolo

    The quality of smartphone portrait photography has become increasingly important to both manufacturers and users. Recent devices use complex computational pipelines to improve facial rendering under varied lighting. These pipelines vary widely across manufacturers, so the same portrait can look noticeably different across smartphones. These differences affect multiple aspects of facial appearance, making perceptual preference difficult to characterize with a single measure. To address this, we propose an interpretable framework that decomposes face contrast into three components: overall facial tonal separation, eye-region contrast, and micro-contrast of fine skin details. We formulate dedicated metrics for each component and validate them via pairwise human judgments, demonstrating that our approach correlates more closely with human contrast perception than traditional contrast measures. To support this analysis, we introduce a realistic mannequin-based dataset designed for systematic facial contrast evaluation, comprising 508 full-resolution captures from 29 smartphones under diverse lighting, with region-specific masks and extensive pairwise perceptual annotations. As a…

    PDF
  • arXiv cs.CVOct 19

    When Guidance Becomes a Guard: Early Interception of Unsafe Inputs in Text-to-Image Generation

    Yanchun Li, Yujin Wu, Gangkai Shen, Ming Yang, Li Zeng +3

    Text-to-image diffusion models can produce unsafe content, while output filtering intervenes only after synthesis. We investigate whether native generation signals enable early detection of unsafe and adversarial inputs. We find that classifier-free guidance exposes strong safety signals in conditional responses, accessible through compact statistics and linear readouts. Based on this finding, we propose Conditional Semantic Trajectory Interception (CSTI), which aggregates activation contrasts between conditional and unconditional responses at early checkpoints for calibrated risk detection. CSTI fits concept-specific detectors using canonical concept and safe examples, without attack samples, intermediate image decoding, or generator modification. Across five generators, four adversarial attack collections, and two general NSFW datasets, CSTI achieves the strongest overall performance among six baselines at a matched 5% FPR. Early interception reduces generation latency by over 60% on intercepted paths. These results demonstrate the effectiveness of native conditional responses for early safety interception.

    PDF
  • arXiv cs.CVOct 19

    TriScore: Post-Hoc Out-of-Distribution Detection with Energy, Boundary Probes, and Transform Consistency

    Ege Gursoy, Nicolas Mansard

    Post-hoc out-of-distribution detection usually relies on a single signal extracted from a frozen classifier, such as confidence, energy, features, or gradients. This dependence becomes fragile under classifier-level adversarial shift, where the shift can preserve the detector's chosen cue while changing the model's decision behavior. We investigate whether this failure mode can be mitigated by combining complementary detection criteria instead of selecting a single score. We introduce TriScore, a post-hoc OOD detector that combines three ID-calibrated signals from the same frozen backbone: an energy prior, a boundary-fragility score, and a transform-consistency score. These signals are standardized on ID validation data and fused by an input-dependent ID-residual gate, requiring no OOD labels, auxiliary model, training, or stored feature bank. Across four ImageNet-scale backbones, TriScore achieves the best mean AUROC among 15 post-hoc baselines under a non-adaptive adversarial-shift protocol, while remaining competitive on standard OOD benchmarks. Ablations show that the gains come from combining complementary cues rather than optimizing a single detector signal. These results…

    PDF
  • arXiv cs.LGOct 19

    Provable Adversarial Detection: Prime Quantization meets Gromov--Wasserstein

    Manohar Kaul, Sadbhavana Babar, Aditya Ramesh, Aditya Saibewar, Fumiyoshi Kasahara +2

    Adversarial vulnerability persists across modern vision architectures from CNNs to vision language models (VLMs), yet existing detection methods rely on heuristics without theoretical guarantees. We address the fundamental question of when adversarial perturbations can be provably detected from a geometric perspective. Our key insight is that adversarial perturbations cannot simultaneously preserve geometric structure across spaces with fundamentally different properties. Accordingly, we construct two such complementary metric spaces. First, we use a standard CNN embedding space $Z$, where adversarial samples exhibit significant displacement patterns. Second, we build a novel prime-quantized space $P$, that absorbs small perturbations through number-theoretic discretization, resulting in minimal displacement, while preserving discriminability. We then leverage the geometric discrepancies across spaces $Z$ and $P$ to detect adversarial samples. To the best of our knowledge, we establish the first rigorous separation theory for adversarial detection, proving that adversarial samples create unavoidable geometric inconsistencies across both spaces. Our framework provides theoretical…

    PDF
  • arXiv cs.CVOct 19

    Toolkit for Facial Deidentification

    Esteban Leiva-Montenegro, Matthieu Pillot, Manfred Gonzalez-Hernandez, Vitomir Struc, Peter Peer +1

    This work presents a novel open-source toolkit designed for the evaluation of face deidentification techniques with available evaluation models. The framework provides a complete evaluation pipeline, including preprocessing, deidentification, and performance assessment, based on data utility, image quality, and identity protection metrics. It supports a variety of datasets, enabling researchers to easily benchmark new deidentification techniques. Results show the effectiveness of some techniques on maintaining privacy while preserving image utility. The toolkit is aimed at unifying future research by providing a standard evaluation framework for privacy-enhancing technologies in facial biometrics. Implementation is available at github.com/blazm/deid-toolkit.

    PDF
  • arXiv cs.CVOct 19

    Not All Similarity Is Leakage: Distribution-Aware Identity Leakage Assessment in Synthetic Face Datasets

    Paweł Borsukiewicz, Daniele Lunghi, Wendkûuni C. Ouédraogo, Fadi Boutros, Jacques Klein +1

    Synthetic data provides the means for more ethical and less biased facial recognition. Nonetheless, the limitations of generative models and the conditioning process they rely on pose a risk of identity leakage, resulting in synthetic samples that are overly similar to those seen in a generator's training set, mitigating privacy benefits. In this work, we show that previously proposed approaches are affected by two key limitations: high classifier dependence and a tendency to identify leakage with respect to real datasets that were not used in training. To address these shortcomings, we propose a novel metric called Scaled Overlap (SO), which adapts a non-parametric data-copying test for facial recognition and extends it to the identity level. By leveraging a multi-model setup that compensates for errors in individual classifiers, it provides insights into the true strength of identity leakage. Our analysis identifies leaking datasets (CemiFace, SFace2, IDNet) with the most acute leakage introduced by generative model conditioning in CemiFace, demonstrates that real datasets do not contribute equally to generator training, and shows that the majority of synthetic images are drawn…

    PDF
  • arXiv cs.CROct 19

    Auditor-Assisted Summary-Channel Verification for Hosted LLM Identity Substitution

    Ziyi Zhang, Ziyao Wang, Guoheng Sun, Ang Li, Jian Li

    Hosted LLM services increasingly expose model identity as a product claim, but external users and auditors often cannot inspect which model configuration served a request. We study an auditor-assisted regime in which a trusted auditor enrolls claimed identities and prepares verification material before deployment, while audit-time verification uses only the claimed identity and released output, without runtime access to model internals, inference logs, routing decisions, or provider metadata. We propose SUMMARK, a summary-channel watermarking framework that uses user-visible reasoning summaries as a keyed audit surface. During setup, SUMMARK constructs identity-specific vocabulary carriers, trains lightweight summary adapters, and calibrates per-identity thresholds. At deployment time, a keyed statistical test assesses whether the released summary is consistent with the claimed identity and, when needed, attributes the most likely enrolled identity. Across model families, scales, and task domains, SUMMARK reliably detects cross-family and cross-scale substitutions at low false-positive rates while preserving task-facing answer quality. We further study FP16->INT8/INT4…

    PDF
  • arXiv cs.CVOct 19

    LEVI: Benchmarking Visual Identity Fidelity with Verifiable Low-Entropy Constructs

    Xiao Ma, Zhonghao Zhan, Hamed Haddadi, Qi Chen

    Modern generative models can produce visually plausible images while violating exact identity constraints. Evaluating such failures requires distinguishing violations of the requested identity from permissible variation in appearance. We introduce Low-Entropy Visual Identity (LEVI), which characterizes visual identities determined by compact facts and explicit rules. The low-entropy requirement concerns identity uncertainty, while appearance may remain diverse. We formulate identity fidelity in terms of the probability that a conditional image distribution assigns to the identities permitted by the prompt. Visual Identity Spaces (VIS) formalize this distinction by specifying admissible identity values and which different realizations express the same identity. Building on this formulation, we develop Verifiable Visual Grammar (VVG), a declarative language whose typed primitives and compositional constraints describe identity-bearing structures. Using this grammar, we build a benchmark for image generation. It assesses each output against the task's identity requirements, drawing evidence from the final pixels. The curated benchmark contains 1,375 tasks spanning 120 base identity…

    PDF
  • arXiv cs.CVOct 18

    Tricking Synthetic Image Detectors with Amortized Generative Attacks

    Mohamed Awad, Khaled Elhady, Yasser Rohaim, Samuele Poppi, Nils Lukas

    Rapid advances in image synthesis have increased the need for reliable synthetic-image detectors, yet their robustness to transferable attacks remains incomplete and understudied. Existing evaluations generally examine whether an attack constructed against one detector transfers to another, but rarely isolate how its effectiveness changes when the attacked images originate from different generators. We conduct a systematic evaluation of three representative attacks: two iterative perturbation-based methods, MIG and MuMoDIG, and the amortized generative attack Tricker. Across four detectors and five generators spanning diverse architectures, we introduce a two-axis evaluation protocol that independently varies the surrogate detector used to construct or train the attack and the generator supplying its input images. We assess attack effectiveness, cross-detector transferability, perceptual quality, runtime, and interaction with common post-processing operations. We revisit Tricker and show that its data and training requirements can be substantially reduced, enabling broader and more efficient evaluation. Our results demonstrate that transferability is not a detector-only property:…

    PDF
  • arXiv cs.CVOct 18

    A New Hope for PRNU on Modern Smartphones? Evidence That Device-Specific Fingerprints Survive Computational Photography

    Benjamin Loison, Quentin Bammey, Thibaud Ehret, Rafael Grompone von Gioi, Pablo Musé +1

    Photo Response Non-Uniformity (PRNU) is widely regarded as the most reliable marker for source camera identification. Recent studies, however, report high correlations between images and fingerprints from different modern smartphones, which calls into question the discriminative power of PRNU on these devices. Using 30 recent smartphones under controlled acquisition conditions (e.g., no digital zoom), we investigate whether the fingerprint itself is at fault or the way it is compared. We find that a component shared by all fingerprints of the same model inflates the standard signed peak-to-correlation energy (sPCE). To counter this, we propose $Δ$sPCE: the sPCE between a query image and a candidate camera's fingerprint, minus the mean sPCE between that image and the fingerprints of the remaining candidates, in the spirit of T-norm score normalization. $Δ$sPCE improves attribution accuracy, suggesting that the device-specific PRNU signal is still present. Although the limited dataset size and the dependence of $Δ$sPCE on the candidate camera set currently restrict operational applicability, these results suggest that PRNU-based attribution of modern smartphones remains feasible…

    PDF
Load more
Research · AI field

Adversarial training

Found by the topic model: adversarial training, deepfake detection, watermarking schemes.

Field page: people, tools, topics →
44papers this week−30.2% vs last week274 this month

Open problems in Adversarial training

  • Robust adversarial detection with theoretical guarantees3 papers raise it · 3 address it

    Current detectors rely on heuristics and fail under adaptive attacks, leaving models vulnerable to adversarial inputs.

    • Certification of Real Images through Calibrated Content Authenticationraises
    • TriScore: Post-Hoc Out-of-Distribution Detection with Energy, Boundary Probes, and Transform Consistencyraises · addresses
    • Provable Adversarial Detection: Prime Quantization meets Gromov--Wassersteinraises · addresses
    • When Guidance Becomes a Guard: Early Interception of Unsafe Inputs in Text-to-Image Generationaddresses
  • Emergent misalignment in multimodal models1 paper raises it · 1 addresses it

    Fine-tuning on narrow tasks can induce broadly harmful behaviors in vision-language models, but its mechanisms and mitigation are poorly understood.

    • Narrow Multimodal Fine-Tuning Can Induce Emergent Misalignmentraises · addresses
  • Safe and high-quality generation trade-off1 paper raises it · 1 addresses it

    Restricting training data for safety reduces model quality, while post-hoc unlearning risks catastrophic forgetting.

    • Pristine Modelsraises · addresses
  • Robustness of decision models under adversarial manipulation1 paper raises it · 1 addresses it

    Decision models are increasingly used for automated tasks, but their reliability under attacks is untested and unstandardized.

    • DecisionRobust: Benchmarking Robustness for JEV Style Decision Models Across Text and Visionraises · addresses
  • Watermark removal resilience1 paper raises it · 2 address it

    Invisible watermarks for ownership verification are vulnerable to simple, training-free attacks that preserve image quality.

    • BrushOff: Stroke-Based Re-rendering as a Watermark Removal Attack on Paintingraises · addresses
    • SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verificationaddresses

Named by an AI from these papers' abstracts.