Florian Tramèr
Assistant Professor
Researches computer security and privacy of machine learning, including adversarial examples, training-data extraction and prompt injection attacks on language models.
Florian Tramèr's lab at ETH Zurich works on trustworthy & safe ML and large language models. 57 papers since 2023, 43 at top venues, mostly NeurIPS and ICLR. 9 PhD students. 1 alumnus.
At a glance
- papers, 2023–2026
- 15/ year
- at T1 venues
- 75%
- PhD students
- 9
- MS students
- 0
- alumni listed
- 1
Papers by yearfrom the lab homepage, 2023–2026
- 15 papers2026 · T1 11 · collecting
- 16 papers2025 · T1 12
- 14 papers2024 · T1 11
- 12 papers2023 · T1 9
T1 venuesOtherVenues: NeurIPS, ICLR, ICML, USENIX Security, S&P
Research focuspaper titles that use each topic's words
- Large language models27 papers
- attacks7 papers
- prompt4 papers
- Trustworthy & safe ML2 papers
- computer security0 papers
Paper list
From the lab homepage.
202615 papers
- ACL (T1)Apertus: Democratizing Open and Compliant LLMs for Global Language Environments (opens in a new tab)
- NeurIPS (T1)CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents (opens in a new tab)
- NeurIPS (T1)CryptanalysisBench: Can LLMs do Cryptanalysis? (opens in a new tab)
- IEEE SaTMLDefeating Prompt Injections by Design (opens in a new tab)
- USENIX Security (T1)Large-scale online deanonymization with LLMs (opens in a new tab)
- ICML Agents WorkshopLaundering AI Authority with Adversarial Examples (opens in a new tab)
- NeurIPS (T1)Learning to Inject: Automated Prompt Injection via Reinforcement Learning (opens in a new tab)
- ICLR (T1)Modal Aphasia: Can Unified Multimodal Models Describe Images From Memory? (opens in a new tab)
- ICML (T1)OptiFluence: Scalable and Principled Design of Privacy Canaries (opens in a new tab)
- ICLR (T1)Pitfalls in Evaluating Language Model Forecasters (opens in a new tab)
- ICML (T1)Position: Anthropomorphic Misalignment Research Needs Stronger Evidence (opens in a new tab)
- USENIX Security (T1)The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against LLM Jailbreaks and Prompt Injections (opens in a new tab)
202516 papers
- DLS WorkshopAdversarial ML Problems Are Getting Harder to Solve and to Evaluate (opens in a new tab)
- ICLR (T1)Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI (opens in a new tab)
- ICLR (T1)Adversarial Search Engine Optimization for Large Language Models (opens in a new tab)
- TMLR (T1)An adversarial perspective on machine unlearning for AI safety (opens in a new tab)
- ICML (T1)AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defenses (opens in a new tab)
- DLS WorkshopBlind Baselines Beat Membership Inference Attacks for Foundation Models (opens in a new tab)
- ICLR (T1)Consistency Checks for Language Model Forecasters (opens in a new tab)
- ICML (T1)Exploring and mitigating adversarial manipulation of voting-based leaderboards (opens in a new tab)
- ICLR (T1)Measuring Non-Adversarial Reproduction of Training Data in Large Language Models (opens in a new tab)
- IEEE SaTMLMembership Inference Attacks Cannot Prove that a Model Was Trained On Your Data (opens in a new tab)
- DLS WorkshopMembership Inference Attacks on Sequence Models (opens in a new tab)
- ICLR (T1)Persistent Pre-Training Poisoning of LLMs (opens in a new tab)
202414 papers
- NeurIPS (T1)AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents (opens in a new tab)
- NeurIPS (T1)Dataset and Lessons Learned from the 2024 SaTML LLM Capture-the-Flag Competition (opens in a new tab)
- IEEE SaTMLEvading Black-box Classifiers Without Breaking Eggs (opens in a new tab)
- IEEE SaTMLEvaluating Superhuman Models with Consistency Checks (opens in a new tab)
- CCS (T1)Evaluations of Machine Learning Privacy Defenses are Misleading (opens in a new tab)
- ICML (T1)Extracting Training Data From Document-Based VQA Models (opens in a new tab)
- NeurIPS (T1)JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models (opens in a new tab)
- S&P (T1)Poisoning Web-Scale Training Datasets is Practical (opens in a new tab)
- βα-orderPosition: Considerations for Differentially Private Learning with Large-Scale Public Pretraining (opens in a new tab)
- ICML (T1)Privacy Backdoors: Stealing Data with Corrupted Pretrained Models (opens in a new tab)
- USENIX Security (T1)Privacy Side Channels in Machine Learning Systems (opens in a new tab)
- NeurIPS (T1)Query-Based Adversarial Prompt Generation (opens in a new tab)
202312 papers
- ICLR (T1)(Certified!!) Adversarial Robustness for Free! (opens in a new tab)
- NeurIPS (T1)Are aligned neural networks adversarially aligned? (opens in a new tab)
- ICML AdvML WorkshopBackdoor Attacks for In-Context Learning with Language Models (opens in a new tab)
- NeurIPS (T1)Counterfactual Memorization in Neural Language Models (opens in a new tab)
- USENIX Security (T1)Extracting Training Data from Diffusion Models (opens in a new tab)
- ICLR (T1)Measuring Forgetting of Memorized Training Examples (opens in a new tab)
- ICML (T1)Preprocessors Matter! Realistic Decision-Based Attacks on Machine Learning Systems (opens in a new tab)
- INLGPreventing Verbatim Memorization in Language Models Gives a False Sense of Privacy (opens in a new tab)
- αβ-orderQuantifying Memorization Across Neural Language Models (opens in a new tab)
- S&P (T1)SNAP: Efficient Extraction of Private Properties with Poisoning (opens in a new tab)
- NeurIPS (T1)Students Parrot Their Teachers: Membership Inference on Model Distillation (opens in a new tab)
- USENIX Security (T1)Tight Auditing of Differentially Private Machine Learning (opens in a new tab)
Where alumni went1 listed
Apply to ETH ZurichRolling
Not announced yet
Computer Science Doctorate (D-INFK)
- Round
- Rolling (no deadline)
- Opens
- —
- GRE
- See program page
- English
- Proficiency in written and spoken English
- Fee
- See program page
Confirmed on the program page.
Similar labsnearest by research summary
- CNSJTU
Tao Huang
- Efficient training & inference
- CHEPFL
Nicolas Flammarion
- Learning theory & optimization
- USUCSD
Tianhao Wang
- Learning theory & optimization
- USStanford
Mert Pilanci
- Learning theory & optimization
- GBOxford
Bernardo Cuenca Grau
- Reasoning & neuro-symbolic AI
- CNTsinghua
Shao-Lun Huang
- Learning theory & optimization
Your notes
Save this lab to keep notes.
Data
Checked against the lab homepage.
- Collected
- Verified
- Papers
- The lab homepage
- Members
- Lab homepage
- Alumni
- Lab homepage
Tiers are venue classifications, not lab rankings.