Saeed Mahloujifar — accepted AI-conference papers

2026

CIMemories: A Compositional Benchmark For Contextual Integrity In LLMs

Niloofar Mireshghallah, Neal Mangaokar, Narine Kokhlikyan, Arman Zharmagambetov, Manzil Zaheer, Saeed Mahloujifar +1

ICLR 2026poster

Large Language Models (LLMs) increasingly use persistent memory from past interactions to enhance personalization and task performance. However, this memory creates critical risks when sensitive information is revealed in inappropriate contexts. We present CIMemories, a benchmark for evaluating whet…

Cited by 0 Source ↗code ↗Scholar ↗

2026

How much can language models memorize?

John Morris, Chawin Sitawarin, Narine Kokhlikyan, Chuan Guo, Edward Suh, Alexander Rush +2

ICML 2026oral

We propose a new method for estimating how much a model knows about a datapoint and use it to measure the capacity of modern language models. Prior studies of language model memorization have struggled to disentangle memorization from generalization. We formally separate memorization into two compon…

Cited by 0 Source ↗Scholar ↗

2025

Auditing $f$-differential privacy in one run

Saeed Mahloujifar, Luca Melis, Kamalika Chaudhuri

ICML 2025oral

Empirical auditing has emerged as a means of catching some of the flaws in the implementation of privacy-preserving algorithms. Existing auditing mechanisms, however, are either computationally inefficient -- requiring multiple runs of the machine learning algorithms —- or suboptimal in calculating…

Cited by 4 Source ↗PDF ↗Scholar ↗

2024

A New Linear Scaling Rule for Private Adaptive Hyperparameter Optimization

Ashwinee Panda, Xinyu Tang, Saeed Mahloujifar, Vikash Sehwag, Prateek Mittal

ICML 2024poster

An open problem in differentially private deep learning is hyperparameter optimization (HPO). DP-SGD introduces new hyperparameters and complicates existing ones, forcing researchers to painstakingly tune hyperparameters with hundreds of trials, which in turn makes it impossible to account for the p…

Cited by 5 Source ↗PDF ↗Scholar ↗

2023

A Randomized Approach to Tight Privacy Accounting

Jiachen T. Wang, Saeed Mahloujifar, Tong Wu, Ruoxi Jia, Prateek Mittal

NeurIPS 2023poster

Bounding privacy leakage over compositions, i.e., privacy accounting, is a key challenge in differential privacy (DP). However, the privacy parameter ($\varepsilon$ or $\delta$) is often easy to estimate but hard to bound. In this paper, we propose a new differential privacy paradigm called estimate…

Cited by 10 Source ↗PDF ↗Scholar ↗

2023

Bounding training data reconstruction in DP-SGD

Jamie Hayes, Borja Balle, Saeed Mahloujifar

NeurIPS 2023poster

Differentially private training offers a protection which is usually interpreted as a guarantee against membership inference attacks. By proxy, this guarantee extends to other threats like reconstruction attacks attempting to extract complete training examples. Recent works provide evidence that if…

Cited by 49 Source ↗PDF ↗Scholar ↗

2023

Effectively Using Public Data in Privacy Preserving Machine Learning

Milad Nasr, Saeed Mahloujifar, Xinyu Tang, Prateek Mittal, Amir Houmansadr

ICML 2023poster

Differentially private (DP) machine learning techniques are notorious for their degradation of model utility (e.g., they degrade classification accuracy). A recent line of work has demonstrated that leveraging *public data* can improve the trade-off between privacy and utility when training models w…

Cited by 19 Source ↗PDF ↗Scholar ↗

2023

MultiRobustBench: Benchmarking Robustness Against Multiple Attacks

Sihui Dai, Saeed Mahloujifar, Chong Xiang, Vikash Sehwag, Pin-Yu Chen, Prateek Mittal

ICML 2023poster

The bulk of existing research in defending against adversarial examples focuses on defending against a single (typically bounded $\ell_p$-norm) attack, but for a practical setting, machine learning (ML) models should be robust to a wide variety of attacks. In this paper, we present the first unified…

Cited by 10 Source ↗PDF ↗code ↗Scholar ↗

2023

Revisiting the Assumption of Latent Separability for Backdoor Defenses

Xiangyu Qi, Tinghao Xie, Yiming Li, Saeed Mahloujifar, Prateek Mittal

ICLR 2023poster

Recent studies revealed that deep learning is susceptible to backdoor poisoning attacks. An adversary can embed a hidden backdoor into a model to manipulate its predictions by only modifying a few training data, without controlling the training process. Currently, a tangible signature has been widel…

Cited by 124 Source ↗PDF ↗code ↗Scholar ↗

2023

Uncovering Adversarial Risks of Test-Time Adaptation

Tong Wu, Feiran Jia, Xiangyu Qi, Jiachen T. Wang, Vikash Sehwag, Saeed Mahloujifar +1

ICML 2023poster

Recently, test-time adaptation (TTA) has been proposed as a promising solution for addressing distribution shifts. It allows a base model to adapt to an unforeseen distribution during inference by leveraging the information from the batch of (unlabeled) test data. However, we uncover a novel securit…

Cited by 11 Source ↗PDF ↗Scholar ↗

2022

Formulating Robustness Against Unforeseen Attacks

Sihui Dai, Saeed Mahloujifar, Prateek Mittal

NeurIPS 2022accept

Existing defenses against adversarial examples such as adversarial training typically assume that the adversary will conform to a specific or known threat model, such as $\ell_p$ perturbations within a fixed budget. In this paper, we focus on the scenario where there is a mismatch in the threat mode…

Cited by 12 Source ↗PDF ↗code ↗Scholar ↗

2022

Overparameterization from Computational Constraints

Sanjam Garg, Somesh Jha, Saeed Mahloujifar, Mohammad Mahmoody, Mingyuan Wang

NeurIPS 2022accept

Overparameterized models with millions of parameters have been hugely successful. In this work, we ask: can the need for large models be, at least in part, due to the \emph{computational} limitations of the learner? Additionally, we ask, is this situation exacerbated for \emph{robust} learning? We…

Cited by 3 Source ↗PDF ↗Scholar ↗

2022

Renyi Differential Privacy of Propose-Test-Release and Applications to Private and Robust Machine Learning

Tianhao Wang, Saeed Mahloujifar, Shouda Wang, Ruoxi Jia, Prateek Mittal

NeurIPS 2022accept

Propose-Test-Release (PTR) is a differential privacy framework that works with local sensitivity of functions, instead of their global sensitivity. This framework is typically used for releasing robust statistics such as median or trimmed mean in a differentially private manner. While PTR is a commo…

Cited by 7 Source ↗PDF ↗Scholar ↗

2022

Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?

Vikash Sehwag, Saeed Mahloujifar, Tinashe Handina, Sihui Dai, Chong Xiang, Mung Chiang +1

ICLR 2022poster

While additional training data improves the robustness of deep neural networks against adversarial examples, it presents the challenge of curating a large number of specific real-world samples. We circumvent this challenge by using additional data from proxy distributions learned by advanced genera…

Cited by 177 Source ↗PDF ↗code ↗Scholar ↗

2022

SparseFed: Mitigating Model Poisoning Attacks in Federated Learning with Sparsification

Ashwinee Panda, Saeed Mahloujifar, Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal

AISTATS 2022poster

Federated learning is inherently vulnerable to model poisoning attacks because its decentralized nature allows attackers to participate with compromised devices. In model poisoning attacks, the attacker reduces the model’s performance on targeted sub-tasks (e.g. classifying planes as birds) by uploa…

Cited by 125 Source ↗PDF ↗code ↗Scholar ↗

2021

A Separation Result Between Data-oblivious and Data-aware Poisoning Attacks

Samuel Deng, Sanjam Garg, Somesh Jha, Saeed Mahloujifar, Mohammad Mahmoody, Abhradeep Guha Thakurta

NeurIPS 2021poster

Poisoning attacks have emerged as a significant security threat to machine learning algorithms. It has been demonstrated that adversaries who make small changes to the training set, such as adding specially crafted data points, can hurt the performance of the output model. Most of these attacks requ…

Cited by 3 Source ↗PDF ↗Scholar ↗

2021

Model-Targeted Poisoning Attacks with Provable Convergence

Fnu Suya, Saeed Mahloujifar, Anshuman Suri, David Evans, Yuan Tian

ICML 2021spotlight

In a poisoning attack, an adversary who controls a small fraction of the training data attempts to select that data, so a model is induced that misbehaves in a particular way. We consider poisoning attacks against convex machine learning models and propose an efficient poisoning attack designed to i…

Cited by 53 Source ↗PDF ↗code ↗Scholar ↗

2019

Empirically Measuring Concentration: Fundamental Limits on Intrinsic Robustness

Saeed Mahloujifar, Xiao Zhang, Mohammad Mahmoody, David Evans

NeurIPS 2019spotlight

Many recent works have shown that adversarial examples that fool classifiers can be found by minimally perturbing a normal input. Recent theoretical results, starting with Gilmer et al. (2018b), show that if the inputs are drawn from a concentrated metric probability space, then adversarial examples…

Cited by 24 Source ↗PDF ↗code ↗Scholar ↗

2019

Universal Multi-Party Poisoning Attacks

Saeed Mahloujifar, Mohammad Mahmoody, Ameer Mohammed

ICML 2019accepted

In this work, we demonstrate universal multi-party poisoning attacks that adapt and apply to any multi-party learning process with arbitrary interaction pattern between the parties. More generally, we introduce and study $(k,p)$-poisoning attacks in which an adversary controls $k\in[m]$ of the parti…

Cited by 54 Source ↗PDF ↗Scholar ↗

2018

Adversarial Risk and Robustness: General Definitions and Implications for the Uniform Distribution

Dimitrios Diochnos, Saeed Mahloujifar, Mohammad Mahmoody

NeurIPS 2018poster

We study adversarial perturbations when the instances are uniformly distributed over {0,1}^n. We study both "inherent" bounds that apply to any problem and any classifier for such a problem as well as bounds that apply to specific problems and specific hypothesis classes.

Cited by 95 Source ↗PDF ↗Scholar ↗