AIConfPaper
← Search

Nicolas Flammarion

44 accepted papers

2026

Chain-of-Frames: Advancing Video Understanding in Multimodal LLMs via Frame-Aware Reasoning

Sara Ghazanfari, Francesco Croce, Nicolas Flammarion, Prashanth Krishnamurthy, Farshad Khorrami, Siddharth Garg
CVPR 2026

Recent work has shown that eliciting Large Language Models (LLMs) to generate reasoning traces in natural language before answering the user's request can significantly improve their performance across tasks. This approach has been extended to multimodal LLMs, where the models can produce chains-of-

Cited by 0Source ↗code ↗Scholar ↗
2025

Is In-Context Learning Sufficient for Instruction Following in LLMs?

Hao Zhao, Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion
ICLR 2025poster

In-context learning (ICL) allows LLMs to learn from examples without changing their weights: this is a particularly promising capability for long-context LLMs that can potentially learn from many examples. Recently, Lin et al. (2024) proposed URIAL, a method using only three in-context examples to a…

Cited by 14Source ↗PDF ↗code ↗Scholar ↗
2025

Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks

Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion
ICLR 2025poster

We show that even the most recent safety-aligned LLMs are not robust to simple *adaptive* jailbreaking attacks. First, we demonstrate how to successfully leverage access to *logprobs* for jailbreaking: we initially design an adversarial prompt template (sometimes adapted to the target LLM), and then…

Cited by 161Source ↗PDF ↗code ↗Scholar ↗
2025

Learning In-context $n$-grams with Transformers: Sub-$n$-grams Are Near-Stationary Points

Aditya Varre, Gizem Yüce, Nicolas Flammarion
ICML 2025poster

In this article, we explore the loss landscape of next-token prediction with transformers. Specifically, we focus on learning in-context n-gram language models with cross-entropy loss using a simplified two-layer transformer. We design a series of transformers that represent $k$-grams (for $k \leq n…

Cited by 0Source ↗PDF ↗Scholar ↗
2025

Learning Parametric Distributions from Samples and Preferences

Marc Jourdan, Gizem Yüce, Nicolas Flammarion
ICML 2025spotlight

Recent advances in language modeling have underscored the role of preference feedback in enhancing model performance. This paper investigates the conditions under which preference feedback improves parameter estimation in classes of continuous parametric distributions. In our framework, the learner…

Cited by 0Source ↗PDF ↗code ↗Scholar ↗
2025

OS-Harm: A Benchmark for Measuring Safety of Computer Use Agents

Thomas Kuntz, Agatha Duzan, Hao Zhao, Francesco Croce, J Zico Kolter, Nicolas Flammarion +1
NeurIPS 2025spotlight

Computer use agents are LLM-based agents that can directly interact with a graphical user interface, by processing screenshots or accessibility trees. While these systems are gaining popularity, their safety has been largely overlooked, despite the fact that evaluating and understanding their potent…

Cited by 0Source ↗code ↗Scholar ↗
2025

Selective Induction Heads: How Transformers Select Causal Structures in Context

Francesco D'Angelo, Francesco Croce, Nicolas Flammarion
ICLR 2025poster

Transformers have exhibited exceptional capabilities in sequence modelling tasks, leveraging self-attention and in-context learning. Critical to this success are induction heads, attention circuits that enable copying tokens based on their previous occurrences. In this work, we introduce a novel syn…

Cited by 0Source ↗PDF ↗Scholar ↗
2024

First-order ANIL provably learns representations despite overparametrisation

Oğuz Kaan Yüksel, Etienne Boursier, Nicolas Flammarion
ICLR 2024poster

Due to its empirical success in few-shot classification and reinforcement learning, meta-learning has recently received significant interest. Meta-learning methods leverage data from previous tasks to learn a new task in a sample-efficient manner. In particular, model-agnostic methods look for initi…

Cited by 6Source ↗PDF ↗Scholar ↗
2024

JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models

Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag +6
NeurIPS 2024poster

Jailbreak attacks cause large language models (LLMs) to generate harmful, unethical, or otherwise objectionable content. Evaluating these attacks presents a number of challenges, which the current collection of benchmarks and evaluation techniques do not adequately address. First, there is no clear…

Cited by 149Source ↗PDF ↗code ↗Scholar ↗
2024

Leveraging Continuous Time to Understand Momentum When Training Diagonal Linear Networks

Hristo Papazov, Scott Pesme, Nicolas Flammarion
AISTATS 2024poster

In this work, we investigate the effect of momentum on the optimisation trajectory of gradient descent. We leverage a continuous-time approach in the analysis of momentum gradient descent with step size $\gamma$ and momentum parameter $\beta$ that allows us to identify an intrinsic quantity $\lambda…

Cited by 9Source ↗PDF ↗Scholar ↗
2024

Long Is More for Alignment: A Simple but Tough-to-Beat Baseline for Instruction Fine-Tuning

Hao Zhao, Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion
ICML 2024poster

There is a consensus that instruction fine-tuning of LLMs requires high-quality data, but what are they? LIMA (NeurIPS 2023) and AlpaGasus (ICLR 2024) are state-of-the-art methods for selecting such high-quality examples, either via manual curation or using GPT-3.5-Turbo as a quality scorer. We show…

Cited by 39Source ↗PDF ↗code ↗Scholar ↗
2024

Why Do We Need Weight Decay in Modern Deep Learning?

Francesco D'Angelo, Maksym Andriushchenko, Aditya Varre, Nicolas Flammarion
NeurIPS 2024poster

Weight decay is a broadly used technique for training state-of-the-art deep networks from image classification to large language models. Despite its widespread usage and being extensively studied in the classical literature, its role remains poorly understood for deep learning. In this work, we high…

Cited by 27Source ↗PDF ↗code ↗Scholar ↗
2023

(S)GD over Diagonal Linear Networks: Implicit bias, Large Stepsizes and Edge of Stability

Mathieu Even, Scott Pesme, Suriya Gunasekar, Nicolas Flammarion
NeurIPS 2023poster

In this paper, we investigate the impact of stochasticity and large stepsizes on the implicit regularisation of gradient descent (GD) and stochastic gradient descent (SGD) over $2$-layer diagonal linear networks. We prove the convergence of GD and SGD with macroscopic stepsizes in an overparametrise…

Cited by 16Source ↗PDF ↗Scholar ↗
2023

A Modern Look at the Relationship between Sharpness and Generalization

Maksym Andriushchenko, Francesco Croce, Maximilian Müller, Matthias Hein, Nicolas Flammarion
ICML 2023poster

Sharpness of minima is a promising quantity that can correlate with generalization in deep networks and, when optimized during training, can improve generalization. However, standard sharpness is not invariant under reparametrizations of neural networks, and, to fix this, reparametrization-invariant…

Cited by 71Source ↗PDF ↗code ↗Scholar ↗
2023

On the spectral bias of two-layer linear networks

Aditya Vardhan Varre, Maria-Luiza Vladarean, Loucas Pillaud-Vivien, Nicolas Flammarion
NeurIPS 2023poster

This paper studies the behaviour of two-layer fully connected networks with linear activations trained with gradient flow on the square loss. We show how the optimization process carries an implicit bias on the parameters that depends on the scale of its initialization. The main result of the paper…

Cited by 15Source ↗PDF ↗Scholar ↗
2023

SGD with Large Step Sizes Learns Sparse Features

Maksym Andriushchenko, Aditya Vardhan Varre, Loucas Pillaud-Vivien, Nicolas Flammarion
ICML 2023poster

We showcase important features of the dynamics of the Stochastic Gradient Descent (SGD) in the training of neural networks. We present empirical observations that commonly used large step sizes (i) may lead the iterates to jump from one side of a valley to the other causing *loss stabilization*, and…

Cited by 66Source ↗PDF ↗code ↗Scholar ↗
2023

Sharpness-Aware Minimization Leads to Low-Rank Features

Maksym Andriushchenko, Dara Bahri, Hossein Mobahi, Nicolas Flammarion
NeurIPS 2023poster

Sharpness-aware minimization (SAM) is a recently proposed method that minimizes the sharpness of the training loss of a neural network. While its generalization improvement is well-known and is the primary motivation, we uncover an additional intriguing effect of SAM: reduction of the feature rank w…

Cited by 31Source ↗PDF ↗code ↗Scholar ↗
2023

Transferable Adversarial Robustness for Categorical Data via Universal Robust Embeddings

Klim Kireev, Maksym Andriushchenko, Carmela Troncoso, Nicolas Flammarion
NeurIPS 2023poster

Research on adversarial robustness is primarily focused on image and text data. Yet, many scenarios in which lack of robustness can result in serious risks, such as fraud detection, medical diagnosis, or recommender systems often do not rely on images or text but instead on tabular data. Adversarial…

Cited by 5Source ↗PDF ↗code ↗Scholar ↗
2022

Gradient flow dynamics of shallow ReLU networks for square loss and orthogonal inputs

Etienne Boursier, Loucas Pillaud-Vivien, Nicolas Flammarion
NeurIPS 2022accept

The training of neural networks by gradient descent methods is a cornerstone of the deep learning revolution. Yet, despite some recent progress, a complete theory explaining its success is still missing. This article presents, for orthogonal input vectors, a precise description of the gradient flow…

Cited by 78Source ↗PDF ↗code ↗Scholar ↗
2022

On the effectiveness of adversarial training against common corruptions

Klim Kireev, Maksym Andriushchenko, Nicolas Flammarion
UAI 2022poster

The literature on robustness towards common corruptions shows no consensus on whether adversarial training can improve the performance in this setting. First, we show that, when used with an appropriately selected perturbation radius, Lp adversarial training can serve as a strong baseline against co…

Cited by 124Source ↗PDF ↗code ↗Scholar ↗
2022

Sparse-RS: A Versatile Framework for Query-Efficient Sparse Black-Box Adversarial Attacks

Francesco Croce, Maksym Andriushchenko, Naman D. Singh, Nicolas Flammarion, Matthias Hein
AAAI 2022technical

We propose a versatile framework based on random search, Sparse-RS, for score-based sparse targeted and untargeted attacks in the black-box setting. Sparse-RS does not rely on substitute models and achieves state-of-the-art success rate and query efficiency for multiple sparse attack models: L0-boun…

Cited by 129Source ↗PDF ↗code ↗Scholar ↗
2021

Continuized Accelerations of Deterministic and Stochastic Gradient Descents, and of Gossip Algorithms

Mathieu Even, Raphaël Berthier, Francis Bach, Nicolas Flammarion, Hadrien Hendrikx, Pierre Gaillard +2
NeurIPS 2021oral

We introduce the ``continuized'' Nesterov acceleration, a close variant of Nesterov acceleration whose variables are indexed by a continuous time parameter. The two variables continuously mix following a linear ordinary differential equation and take gradient steps at random times. This continuized…

Cited by 24Source ↗PDF ↗Scholar ↗
2021

Implicit Bias of SGD for Diagonal Linear Networks: a Provable Benefit of Stochasticity

Scott Pesme, Loucas Pillaud-Vivien, Nicolas Flammarion
NeurIPS 2021poster

Understanding the implicit bias of training algorithms is of crucial importance in order to explain the success of overparametrised neural networks. In this paper, we study the dynamics of stochastic gradient descent over diagonal linear networks through its continuous time version, namely stochasti…

Cited by 127Source ↗PDF ↗Scholar ↗
2021

Last iterate convergence of SGD for Least-Squares in the Interpolation regime.

Aditya Vardhan Varre, Loucas Pillaud-Vivien, Nicolas Flammarion
NeurIPS 2021poster

Motivated by the recent successes of neural networks that have the ability to fit the data perfectly \emph{and} generalize well, we study the noiseless model in the fundamental least-squares setup. We assume that an optimum predictor perfectly fits the inputs and outputs $\langle \theta_* , \phi(X)…

Cited by 45Source ↗PDF ↗Scholar ↗
2021

RobustBench: a standardized adversarial robustness benchmark

Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang +2
NeurIPS 2021poster

As a research community, we are still lacking a systematic understanding of the progress on adversarial robustness which often makes it hard to identify the most promising ideas in training robust models. A key challenge in benchmarking robustness is that its evaluation is often error-prone leading…

Cited by 843Source ↗code ↗Scholar ↗
2021

Sequential Algorithms for Testing Closeness of Distributions

Aadil Oufkir, Omar Fawzi, Nicolas Flammarion, Aurélien Garivier
NeurIPS 2021spotlight

What advantage do sequential procedures provide over batch algorithms for testing properties of unknown distributions? Focusing on the problem of testing whether two distributions $\mathcal{D}_1$ and $\mathcal{D}_2$ on $\{1,\dots, n\}$ are equal or $\epsilon$-far, we give several answers to this que…

Cited by 5Source ↗PDF ↗Scholar ↗
2020

On Convergence-Diagnostic based Step Sizes for Stochastic Gradient Descent

Scott Pesme, Aymeric Dieuleveut, Nicolas Flammarion
ICML 2020poster

Constant step-size Stochastic Gradient Descent exhibits two phases: a transient phase during which iterates make fast progress towards the optimum, followed by a stationary phase during which iterates oscillate around the optimal point. In this paper, we show that efficiently detecting this transiti…

Cited by 27Source ↗PDF ↗Scholar ↗
2020

Square Attack: a query-efficient black-box adversarial attack via random search

Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, Matthias Hein
ECCV 2020poster

We propose the Square Attack, a score-based black-box $l_2$- and $l_\infty$- adversarial attack that does not rely on local gradient information and thus is not affected by gradient masking. Square Attack is based on a randomized search scheme which selects localized square-shaped updates at random…

Cited by 1243Source ↗PDF ↗code ↗Scholar ↗
2018

Gen-Oja: Simple & Efficient Algorithm for Streaming Generalized Eigenvector Computation

Kush Bhatia, Aldo Pacchiano, Nicolas Flammarion, Peter L Bartlett, Michael I Jordan
NeurIPS 2018poster

In this paper, we study the problems of principle Generalized Eigenvector computation and Canonical Correlation Analysis in the stochastic setting. We propose a simple and efficient algorithm for these problems. We prove the global convergence of our algorithm, borrowing ideas from the theory of fas…

Cited by 22Source ↗PDF ↗Scholar ↗
2018

On the Theory of Variance Reduction for Stochastic Gradient Monte Carlo

Niladri Chatterji, Nicolas Flammarion, Yian Ma, Peter Bartlett, Michael Jordan
ICML 2018oral

We provide convergence guarantees in Wasserstein distance for a variety of variance-reduction methods: SAGA Langevin diffusion, SVRG Langevin diffusion and control-variate underdamped Langevin diffusion. We analyze these methods under a uniform set of assumptions on the log-posterior distribution, a…

Cited by 113Source ↗PDF ↗Scholar ↗