Dan Boneh — accepted AI-conference papers

2026

Comparing AI Agents to Cybersecurity Professionals in Real-World Penetration Testing

Justin W Lin, Eliot Krzysztof Jones, Donovan Julian Jasper, Ethan Jun-shen Ho, Anna Wu, Arnold Tianyi Yang +7

ICLR 2026poster

We present the first comprehensive evaluation of AI agents against human cybersecurity professionals in a live enterprise environment. We evaluate ten cybersecurity professionals alongside six existing AI agents and ARTEMIS, our new agent scaffold, on a large university network consisting of $\sim$8…

Cited by 0 Source ↗code ↗Scholar ↗

2025

BountyBench: Dollar Impact of AI Agent Attackers and Defenders on Real-World Cybersecurity Systems

Andy K Zhang, Joey Ji, Celeste Menders, Riya Dulepet, Thomas Qin, Ron Yifeng Wang +28

NeurIPS 2025poster

AI agents have the potential to significantly alter the cybersecurity landscape. Here, we introduce the first framework to capture offensive and defensive cyber-capabilities in evolving real-world systems. Instantiating this framework with BountyBench, we set up 25 systems with complex, real-world c…

Cited by 0 Source ↗Scholar ↗

2025

Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models

Andy K Zhang, Neil Perry, Riya Dulepet, Joey Ji, Celeste Menders, Justin W Lin +19

ICLR 2025oral

Language Model (LM) agents for cybersecurity that are capable of autonomously identifying vulnerabilities and executing exploits have potential to cause real-world impact. Policymakers, model providers, and researchers in the AI and cybersecurity communities are interested in quantifying the capabil…

Cited by 33 Source ↗PDF ↗Scholar ↗

2025

ExpProof : Operationalizing Explanations for Confidential Models with ZKPs

Chhavi Yadav, Evan Laufer, Dan Boneh, Kamalika Chaudhuri

ICML 2025poster

In principle, explanations are intended as a way to increase trust in machine learning models and are often obligated by regulations. However, many circumstances where these are demanded are adversarial in nature, meaning the involved parties have misaligned interests and are incentivized to manipul…

Cited by 0 Source ↗PDF ↗code ↗Scholar ↗

2024

FairProof : Confidential and Certifiable Fairness for Neural Networks

Chhavi Yadav, Amrita Roy Chowdhury, Dan Boneh, Kamalika Chaudhuri

ICML 2024poster

Machine learning models are increasingly used in societal applications, yet legal and privacy concerns demand that they very often be kept confidential. Consequently, there is a growing distrust about the fairness properties of these models in the minds of consumers, who are often at the receiving e…

Cited by 8 Source ↗PDF ↗code ↗Scholar ↗

2024

Optimistic Verifiable Training by Controlling Hardware Nondeterminism

Megha Srivastava, Simran Arora, Dan Boneh

NeurIPS 2024poster

The increasing compute demands of AI systems has led to the emergence of services that train models on behalf of clients lacking necessary resources. However, ensuring correctness of training and guarding against potential training-time attacks, such as data poisoning and backdoors, poses challenges…

Cited by 6 Source ↗PDF ↗code ↗Scholar ↗

2021

Differentially Private Learning Needs Better Features (or Much More Data)

Florian Tramer, Dan Boneh

ICLR 2021spotlight

We demonstrate that differentially private machine learning has not yet reached its ''AlexNet moment'' on many canonical vision tasks: linear models trained on handcrafted features significantly outperform end-to-end deep neural networks for moderate privacy budgets. To exceed the performance of han…

Cited by 310 Source ↗PDF ↗code ↗Scholar ↗

2019

Adversarial Training and Robustness for Multiple Perturbations

Florian Tramer, Dan Boneh

NeurIPS 2019spotlight

Defenses against adversarial examples, such as adversarial training, are typically tailored to a single perturbation type (e.g., small $\ell_\infty$-noise). For other perturbations, these defenses offer no guarantees and, at times, even increase the model's vulnerability. Our aim is to understand th…

Cited by 464 Source ↗PDF ↗code ↗Scholar ↗

2019

Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware

Florian Tramer, Dan Boneh

ICLR 2019oral

As Machine Learning (ML) gets applied to security-critical or sensitive domains, there is a growing need for integrity and privacy for outsourced ML computations. A pragmatic solution comes from Trusted Execution Environments (TEEs), which use hardware and software protections to isolate sensitive c…

Cited by 507 Source ↗PDF ↗code ↗Scholar ↗

2018

Ensemble Adversarial Training: Attacks and Defenses

Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, Patrick McDaniel

ICLR 2018poster

Adversarial examples are perturbed inputs designed to fool machine learning models. Adversarial training injects such examples into training data to increase robustness. To scale this technique to large datasets, perturbations are crafted using fast single-step methods that maximize a linear approxi…

Cited by 3557 Source ↗PDF ↗Scholar ↗