---
title: "InferPilot — paper by Wu et al. (2026) — summary and ideas"
description: "The authors present InferPilot, an LLM-driven system that carries out such audits on its own, given only black-box access and… 64 references."
authors: ["Yixin Wu", "Rui Wen", "Chi Cui", "Michael Backes", "Yang Zhang"]
year: 2026
venue: "Findings of the Association for Computational Linguistics: ACL 2026"
source: "https://aclanthology.org/2026.findings-acl.572/"
doi: "10.18653/v1/2026.findings-acl.572"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/wu-2026-inferpilot-autonomous-inference-attacks-against/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/wu-2026-inferpilot-autonomous-inference-attacks-against/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/37/) / InferPilot: Autonomous Inference Attacks Against ML Services With LLM-Based Agents

# InferPilot: Autonomous Inference Attacks Against ML Services With LLM-Based Agents

**Authors:** [Yixin Wu](https://md.research.elamur.ai/free/en/authors/yixin-wu/), [Rui Wen](https://md.research.elamur.ai/free/en/authors/rui-wen/), Chi Cui, [Michael Backes](https://md.research.elamur.ai/free/en/authors/michael-backes/) and [Yang Zhang](https://md.research.elamur.ai/free/en/authors/yang-zhang/) · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: ACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.findings-acl.572/) · [PDF](https://aclanthology.org/2026.findings-acl.572.pdf) · [DOI 10.18653/v1/2026.findings-acl.572](https://doi.org/10.18653/v1/2026.findings-acl.572) · [OpenAlex](https://openalex.org/W7166831440)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
Running inference attacks to audit ML services is hard for non-specialists. They must pick shadow datasets with matching labels, choose suitable architectures and tune hyperparameters, and these choices multiply into a huge configuration space. The authors present InferPilot, an LLM-driven system that carries out such audits on its own, given only black-box access and a short description of the service's task and input/output formats. Its design splits the work between two agents. A ControllerAgent decides which attacks apply, launches them and tracks their progress. Parallel AttackAgents execute the attacks inside an environment that provides Linux shells, starter attack scripts, datasets and models. Each agent works from a hand-crafted, task-specific action set with guidelines.

The system was tested on 20 target services. With GPT-4o it finished every possible attack in all runs, cost little per run, and came close to an expert baseline built on ML-Doctor. An analysis of execution traces shows how the design reduces typical agent errors. The tool could let providers, auditors and regulators assess privacy and IP risks without deep expertise.

## Key points
- **Attacks and test setup:** InferPilot covers four attack families: membership inference, model stealing, data reconstruction and attribute inference. The 20 target services were built from five datasets and four model architectures.
- **Task completion:** GPT-4o reached a 100.0% task completion rate over five runs. MLAgentBench, adapted to the same environment, completed only 26.3%.
- **Attack quality and cost:**
  - Membership inference accuracy was just 1.0% below the ML-Doctor human-expert baseline.
  - An average run cost $0.627 in tokens and took 27.11 steps.
- **Adaptivity and backbones:** The agent changes its strategy under constraints such as query quotas, adversarial training and label-only access. Closed-source backbones performed best, though open-source ones, notably DeepSeek, have closed much of the gap.
- **LLM-based targets:** In an extension to in-context-learning membership inference on DBPedia, attack accuracy was 75.50% on Vicuna-7B, 88.75% on LLaMA-2-7B and 77.00% on Mistral-7B. The code is on GitHub (TrustAIRLab/InferPilot), with access granted on request.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Helmholtz Center for Information Security](https://md.research.elamur.ai/free/en/labs/helmholtz-center-for-information-security/) — Research institute, Saarbrücken, Germany · 20 works · 1,172 citations
- [Institute of Science Tokyo](https://md.research.elamur.ai/free/en/universities/institute-of-science-tokyo/) — University, Tokyo, Japan · 14 works · 20 citations

📚 Shelves (2): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works

## Cite

Cite as: Yixin Wu, Rui Wen, Chi Cui, Michael Backes and Yang Zhang. 2026. InferPilot: Autonomous Inference Attacks Against ML Services With LLM-Based Agents. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{wu2026inferpilot,
  title = {{InferPilot: Autonomous Inference Attacks Against ML Services With LLM-Based Agents}},
  author = {Yixin Wu, Rui Wen, Chi Cui, Michael Backes and Yang Zhang},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.572},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.572}
}
```

- [← previous Individual and Combined Effects of English as a Second Language and Typos on LLM Performance](https://md.research.elamur.ai/free/en/papers/liu-2026-individual-combined-effects-english-second/)
- [next → InfiAgent: An Infinite-Horizon Framework for General-Purpose Autonomous Agents](https://md.research.elamur.ai/free/en/papers/yu-2026-infiagent-infinite-horizon-framework-general/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/37/)

## References

64 references, 13 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Sahar Abdelnabi, Kai Greshake, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. [Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://md.research.elamur.ai/free/en/papers/greshake-2023-ve-signed-up-compromising-real/). In Workshop on Security and Artificial Intelligence (AISec), pages 79– 90. ACM.
2. Alex Krizhevsky and Vinod Nair and Geoffrey Hinton. 2009. CIFAR. [https://www.cs.toronto](https://www.cs.toronto). edu/˜kriz/cifar.html. [↗](https://www.cs.toronto)
3. AutoGPT. 2023. An open-source autonomous software agent. [https://agpt.co/](https://agpt.co/). [↗](https://agpt.co/)
4. Islem Bouzenia, Premkumar T. Devanbu, and Michael Pradel. 2024. RepairAgent: An Autonomous, LLM-Based Agent for Program Repair. CoRR abs/2403.17134. — [arXiv:2403.17134](https://arxiv.org/abs/2403.17134) [find](https://scholar.google.com/scholar?q=Islem+Bouzenia%2C+Premkumar+T%2E+Devanbu%2C+and+Michael+Pradel%2E+2024%2E+RepairAgent%3A+An+Autonomous%2C+LLM%2DBased+Agent+for+Program+Repair%2E+CoRR+abs%2F2403%2E17134%2E+%E2%80%94+%5BarXiv%3A2403%2E17134%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2403%2E171)
5. Ruisheng Cao, Fangyu Lei, Haoyuan Wu, Jixuan Chen, Yeqiao Fu, Hongcheng Gao, Xinzhuang Xiong, Hanchong Zhang, Yuchen Mao, Wenjing Hu, Tianbao Xie, Hongshen Xu, Danyang Zhang, Sida Wang, Ruoxi Sun, Pengcheng Yin, Caiming Xiong, Ansong Ni, Qian Liu, Victor Zhong, Lu Chen, Kai Yu, and Tao Yu. 2024. Spi… — [arXiv:2407.10956](https://arxiv.org/abs/2407.10956) [find](https://scholar.google.com/scholar?q=Ruisheng+Cao%2C+Fangyu+Lei%2C+Haoyuan+Wu%2C+Jixuan+Chen%2C+Yeqiao+Fu%2C+Hongcheng+Gao%2C+Xinzhuang+Xiong%2C+Hanchong+Zhang%2C+Yuchen+Mao%2C+Wenjing+Hu%2C+Tianbao+Xie%2C+Hongshen+Xu%2C+Danyang+Zhang%2C+Sida+Wang%2C+Ruoxi+Sun%2C+Pen)
6. Nicholas Carlini, Matthew Jagielski, and Ilya Mironov. 2020. Cryptanalytic Extraction of Neural Network Models. In Annual International Cryptology Conference (CRYPTO), pages 189–218. Springer. [find](https://scholar.google.com/scholar?q=Nicholas+Carlini%2C+Matthew+Jagielski%2C+and+Ilya+Mironov%2E+2020%2E+Cryptanalytic+Extraction+of+Neural+Network+Models%2E+In+Annual+International+Cryptology+Conference+%28CRYPTO%29%2C+pages+189%E2%80%93218%2E+Springer%2E)
7. Nicholas Carlini, Javier Rando, Edoardo Debenedetti, Milad Nasr, and Florian Tramèr. 2025. AutoAd-vExBench: Benchmarking Autonomous Exploitation of Adversarial Example Defenses. In International Conference on Machine Learning (ICML). PMLR. [find](https://scholar.google.com/scholar?q=Nicholas+Carlini%2C+Javier+Rando%2C+Edoardo+Debenedetti%2C+Milad+Nasr%2C+and+Florian+Trame%CC%80r%2E+2025%2E+AutoAd%2DvExBench%3A+Benchmarking+Autonomous+Exploitation+of+Adversarial+Example+Defenses%2E+In+International+Conf)
8. Nicholas Carlini and David Wagner. 2017. Towards Evaluating the Robustness of Neural Networks. In IEEE Symposium on Security and Privacy (S&P), pages 39–57. IEEE. [find](https://scholar.google.com/scholar?q=Nicholas+Carlini+and+David+Wagner%2E+2017%2E+Towards+Evaluating+the+Robustness+of+Neural+Networks%2E+In+IEEE+Symposium+on+Security+and+Privacy+%28S%26P%29%2C+pages+39%E2%80%9357%2E+IEEE%2E)
9. François Chollet. 2017. Xception: Deep Learning with Depthwise Separable Convolutions. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 1800–1807. IEEE. [find](https://scholar.google.com/scholar?q=Franc%CC%A7ois+Chollet%2E+2017%2E+Xception%3A+Deep+Learning+with+Depthwise+Separable+Convolutions%2E+In+IEEE+Conference+on+Computer+Vision+and+Pattern+Recognition+%28CVPR%29%2C+pages+1800%E2%80%931807%2E+IEEE%2E)
10. Christopher A. Choquette Choo, Florian Tramèr, Nicholas Carlini, and Nicolas Papernot. 2021. Label-Only Membership Inference Attacks. In International Conference on Machine Learning (ICML), pages 1964–1974. PMLR. [find](https://scholar.google.com/scholar?q=Christopher+A%2E+Choquette+Choo%2C+Florian+Trame%CC%80r%2C+Nicholas+Carlini%2C+and+Nicolas+Papernot%2E+2021%2E+Label%2DOnly+Membership+Inference+Attacks%2E+In+International+Conference+on+Machine+Learning+%28ICML%29%2C+pages+196)
11. Adam Coates, Andrew Y. Ng, and Honglak Lee. 2011. An Analysis of Single-Layer Networks in Unsupervised Feature Learning. In International Conference on Artificial Intelligence and Statistics (AISTATS), pages 215–223. JMLR. [find](https://scholar.google.com/scholar?q=Adam+Coates%2C+Andrew+Y%2E+Ng%2C+and+Honglak+Lee%2E+2011%2E+An+Analysis+of+Single%2DLayer+Networks+in+Unsupervised+Feature+Learning%2E+In+International+Conference+on+Artificial+Intelligence+and+Statistics+%28AISTATS%29)
12. Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. [Deep Residual Learning for Image Recognition](https://md.research.elamur.ai/free/en/papers/he-2015-deep-residual-learning-image-recognition/). In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770– 778. IEEE.
13. Qian Huang, Jian Vora, Percy Liang, and Jure Leskovec. 2024. [MLAgentBench: Evaluating Language Agents on Machine Learning Experimentation](https://md.research.elamur.ai/free/en/papers/huang-2023-mlagentbench-evaluating-language-agents/). In International Conference on Machine Learning (ICML).
14. Matthew Jagielski, Nicholas Carlini, David Berthelot, Alex Kurakin, and Nicolas Papernot. 2020. High Accuracy and High Fidelity Extraction of Neural Networks. In USENIX Security Symposium (USENIX Security), pages 1345–1362. USENIX. [find](https://scholar.google.com/scholar?q=Matthew+Jagielski%2C+Nicholas+Carlini%2C+David+Berthelot%2C+Alex+Kurakin%2C+and+Nicolas+Papernot%2E+2020%2E+High+Accuracy+and+High+Fidelity+Extraction+of+Neural+Networks%2E+In+USENIX+Security+Symposium+%28USENIX+Secu)
15. Emiliano De Cristofaro. 2020. An Overview of Privacy in Machine Learning. CoRR abs/2005.08679. — [arXiv:2005.08679](https://arxiv.org/abs/2005.08679) [find](https://scholar.google.com/scholar?q=Emiliano+De+Cristofaro%2E+2020%2E+An+Overview+of+Privacy+in+Machine+Learning%2E+CoRR+abs%2F2005%2E08679%2E+%E2%80%94+%5BarXiv%3A2005%2E08679%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2005%2E08679%29)
16. Carlos E. Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, and Karthik R. Narasimha. 2024. [SWE-bench: Can Language Models Resolve Real-world Github Issues?](https://md.research.elamur.ai/free/en/papers/jimenez-2024-swe-bench-can-language-models/) In International Conference on Learning Representations (ICLR).
17. Vasisht Duddu, Sebastian Szyller, and N. Asokan. 2024. SoK: Unintended Interactions among Machine Learning Defenses and Risks. In IEEE Symposium on Security and Privacy (S&P), pages 2996– 3014. IEEE. [find](https://scholar.google.com/scholar?q=Vasisht+Duddu%2C+Sebastian+Szyller%2C+and+N%2E+Asokan%2E+2024%2E+SoK%3A+Unintended+Interactions+among+Machine+Learning+Defenses+and+Risks%2E+In+IEEE+Symposium+on+Security+and+Privacy+%28S%26P%29%2C+pages+2996%E2%80%93+3014%2E+IEEE%2E)
18. Kalpesh Krishna, Gaurav Singh Tomar, Ankur P. Parikh, Nicolas Papernot, and Mohit Iyyer. 2020. Thieves on Sesame Street! Model Extraction of BERT-based APIs. In International Conference on Learning Representations (ICLR). [find](https://scholar.google.com/scholar?q=Kalpesh+Krishna%2C+Gaurav+Singh+Tomar%2C+Ankur+P%2E+Parikh%2C+Nicolas+Papernot%2C+and+Mohit+Iyyer%2E+2020%2E+Thieves+on+Sesame+Street%21+Model+Extraction+of+BERT%2Dbased+APIs%2E+In+International+Conference+on+Learning+Re)
19. Flask. 2010. A lightweight WSGI web application framework. [https://flask.palletsprojects.com/en/stable/](https://flask.palletsprojects.com/en/stable/). [↗](https://flask.palletsprojects.com/en/stable/)
20. Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2016. Adversarial Examples in the Physical World. CoRR abs/1607.02533. — [arXiv:1607.02533](https://arxiv.org/abs/1607.02533) [find](https://scholar.google.com/scholar?q=Alexey+Kurakin%2C+Ian+Goodfellow%2C+and+Samy+Bengio%2E+2016%2E+Adversarial+Examples+in+the+Physical+World%2E+CoRR+abs%2F1607%2E02533%2E+%E2%80%94+%5BarXiv%3A1607%2E02533%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F1607%2E02533%29)
21. Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. 2015. Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 1322–1333. ACM. [find](https://scholar.google.com/scholar?q=Matt+Fredrikson%2C+Somesh+Jha%2C+and+Thomas+Ristenpart%2E+2015%2E+Model+Inversion+Attacks+that+Exploit+Confidence+Information+and+Basic+Countermeasures%2E+In+ACM+SIGSAC+Conference+on+Computer+and+Communications)
22. Yuhang Lai, Chengxi Li, Yiming Wang, Tianyi Zhang, Ruiqi Zhong, Luke Zettlemoyer, Wen-Tau Yih, Daniel Fried, Sida I. Wang, and Tao Y. 2023. DS-1000: A Natural and Reliable Benchmark for Data Science Code Generation. In International Conference on Machine Learning (ICML), pages 18319– 18345. PMLR. [find](https://scholar.google.com/scholar?q=Yuhang+Lai%2C+Chengxi+Li%2C+Yiming+Wang%2C+Tianyi+Zhang%2C+Ruiqi+Zhong%2C+Luke+Zettlemoyer%2C+Wen%2DTau+Yih%2C+Daniel+Fried%2C+Sida+I%2E+Wang%2C+and+Tao+Y%2E+2023%2E+DS%2D1000%3A+A+Natural+and+Reliable+Benchmark+for+Data+Science+C)
23. Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. [Explaining and Harnessing Adversarial Examples](https://md.research.elamur.ai/free/en/papers/goodfellow-2014-explaining-harnessing-adversarial-examples/). In International Conference on Learning Representations (ICLR).
24. Faegheh Hasibi, Fedor Nikolaev, Chenyan Xiong, Krisztian Balog, Svein Erik Bratsberg, Alexander Kotov, and Jamie Callan. 2017. DBpedia-Entity v2: A Test Collection for Entity Search. In International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR), pages 1265– 1268.… [find](https://scholar.google.com/scholar?q=Faegheh+Hasibi%2C+Fedor+Nikolaev%2C+Chenyan+Xiong%2C+Krisztian+Balog%2C+Svein+Erik+Bratsberg%2C+Alexander+Kotov%2C+and+Jamie+Callan%2E+2017%2E+DBpedia%2DEntity+v2%3A+A+Test+Collection+for+Entity+Search%2E+In+International+)
25. Jamie Hayes, Ilia Shumailov, Christopher A. Choquette-Choo, Matthew Jagielski, Georgios Kaissis, Katherine Lee, Milad Nasr, Sahra Ghalebikesabi, Niloofar Mireshghallah, Meenatchi Sundaram Mutu Selva Annamalai, Igor Shilov, Matthieu Meeus, Yves-Alexandre de Montjoye, Franziska Boenisch, Adam Dziedzic… — [arXiv:2505.18773](https://arxiv.org/abs/2505.18773) [find](https://scholar.google.com/scholar?q=Jamie+Hayes%2C+Ilia+Shumailov%2C+Christopher+A%2E+Choquette%2DChoo%2C+Matthew+Jagielski%2C+Georgios+Kaissis%2C+Katherine+Lee%2C+Milad+Nasr%2C+Sahra+Ghalebikesabi%2C+Niloofar+Mireshghallah%2C+Meenatchi+Sundaram+Mutu+Selva+A)
26. LangChain. 2022. com/. [https://www.langchain](https://www.langchain). [↗](https://www.langchain)
27. Zheng Li and Yang Zhang. 2021. Membership Leakage in Label-Only Exposures. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 880–895. ACM. [find](https://scholar.google.com/scholar?q=Zheng+Li+and+Yang+Zhang%2E+2021%2E+Membership+Leakage+in+Label%2DOnly+Exposures%2E+In+ACM+SIGSAC+Conference+on+Computer+and+Communications+Security+%28CCS%29%2C+pages+880%E2%80%93895%2E+ACM%2E)
28. Junwei Liu, Kaixin Wang, Yixuan Chen, Xin Peng, Zhenpeng Chen, Lingming Zhang, and Yiling Lo. 2024a. Large Language Model-Based Agents for Software Engineering: A Survey. CoRR abs/2409.02977. — [arXiv:2409.02977](https://arxiv.org/abs/2409.02977) [find](https://scholar.google.com/scholar?q=Junwei+Liu%2C+Kaixin+Wang%2C+Yixuan+Chen%2C+Xin+Peng%2C+Zhenpeng+Chen%2C+Lingming+Zhang%2C+and+Yiling+Lo%2E+2024a%2E+Large+Language+Model%2DBased+Agents+for+Software+Engineering%3A+A+Survey%2E+CoRR+abs%2F2409%2E02977%2E+%E2%80%94+%5BarXiv)
29. Yiyong Liu, Zhengyu Zhao, Michael Backes, and Yang Zhang. 2022a. Membership Inference Attacks by Exploiting Loss Trajectory. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 2085–2098. ACM. [find](https://scholar.google.com/scholar?q=Yiyong+Liu%2C+Zhengyu+Zhao%2C+Michael+Backes%2C+and+Yang+Zhang%2E+2022a%2E+Membership+Inference+Attacks+by+Exploiting+Loss+Trajectory%2E+In+ACM+SIGSAC+Conference+on+Computer+and+Communications+Security+%28CCS%29%2C+pag)
30. Yugeng Liu, Rui Wen, Xinlei He, Ahmed Salem, Zhikun Zhang, Michael Backes, Emiliano De Cristofaro, Mario Fritz, and Yang Zhang. 2022b. [find](https://scholar.google.com/scholar?q=Yugeng+Liu%2C+Rui+Wen%2C+Xinlei+He%2C+Ahmed+Salem%2C+Zhikun+Zhang%2C+Michael+Backes%2C+Emiliano+De+Cristofaro%2C+Mario+Fritz%2C+and+Yang+Zhang%2E+2022b%2E)
31. ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models. In USENIX Security Symposium (USENIX Security), pages 4525–4542. USENIX. [find](https://scholar.google.com/scholar?q=ML%2DDoctor%3A+Holistic+Risk+Assessment+of+Inference+Attacks+Against+Machine+Learning+Models%2E+In+USENIX+Security+Symposium+%28USENIX+Security%29%2C+pages+4525%E2%80%934542%2E+USENIX%2E)
32. Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. 2024b. [Formalizing and Benchmarking Prompt Injection Attacks and Defenses](https://md.research.elamur.ai/free/en/papers/liu-2023-formalizing-benchmarking-prompt-injection-attacks/). In USENIX Security Symposium (USENIX Security). USENIX.
33. Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. 2015. Deep Learning Face Attributes in the Wild. In IEEE International Conference on Computer Vision (ICCV), pages 3730–3738. IEEE. [find](https://scholar.google.com/scholar?q=Ziwei+Liu%2C+Ping+Luo%2C+Xiaogang+Wang%2C+and+Xiaoou+Tang%2E+2015%2E+Deep+Learning+Face+Attributes+in+the+Wild%2E+In+IEEE+International+Conference+on+Computer+Vision+%28ICCV%29%2C+pages+3730%E2%80%933738%2E+IEEE%2E)
34. Chris Lu, Cong Lu, Robert Tjarko Lange, Jakob Foerster, Jeff Clune, and David Ha. 2024. [The AI Scientist: Towards Fully Automated Open-Ended Scientific Discovery](https://md.research.elamur.ai/free/en/papers/lu-2024-ai-scientist-fully-automated/). CoRR abs/2408.06292.
35. Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. [Towards Deep Learning Models Resistant to Adversarial Attacks](https://md.research.elamur.ai/free/en/papers/madry-2017-towards-deep-learning-models-resistant/). In International Conference on Learning Representations (ICLR).
36. Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. 2019. Exploiting Unintended Feature Leakage in Collaborative Learning. In IEEE Symposium on Security and Privacy (S&P), pages 497–512. IEEE. [find](https://scholar.google.com/scholar?q=Luca+Melis%2C+Congzheng+Song%2C+Emiliano+De+Cristofaro%2C+and+Vitaly+Shmatikov%2E+2019%2E+Exploiting+Unintended+Feature+Leakage+in+Collaborative+Learning%2E+In+IEEE+Symposium+on+Security+and+Privacy+%28S%26P%29%2C+pages+)
37. Meta. 2023. [https://huggingface.co/](https://huggingface.co/) meta-llama/Llama-2-7b-chat. [↗](https://huggingface.co/)
38. Mistral AI. 2023. [https://huggingface.co/](https://huggingface.co/) mistralai/Mistral-7B-Instruct-v0.2. [↗](https://huggingface.co/)
39. Milad Nasr, Reza Shokri, and Amir Houmansadr. 2019. Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning. In IEEE Symposium on Security and Privacy (S&P), pages 1021–1035. IEEE. [find](https://scholar.google.com/scholar?q=Milad+Nasr%2C+Reza+Shokri%2C+and+Amir+Houmansadr%2E+2019%2E+Comprehensive+Privacy+Analysis+of+Deep+Learning%3A+Passive+and+Active+White%2Dbox+Inference+Attacks+against+Centralized+and+Federated+Learning%2E+In+IEEE+)
40. Tuan Anh Nguyen and Anh Tuan Tran. 2021. WaNet - Imperceptible Warping-based Backdoor Attack. In International Conference on Learning Representations (ICLR). [find](https://scholar.google.com/scholar?q=Tuan+Anh+Nguyen+and+Anh+Tuan+Tran%2E+2021%2E+WaNet+%2D+Imperceptible+Warping%2Dbased+Backdoor+Attack%2E+In+International+Conference+on+Learning+Representations+%28ICLR%29%2E)
41. Zhenxing Niu, Mo Zhou, Le Wang, Xinbo Gao, and Gang Hua. 2016. Ordinal Regression with Multiple Output CNN for Age Estimation. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 4920–4928. IEEE. [find](https://scholar.google.com/scholar?q=Zhenxing+Niu%2C+Mo+Zhou%2C+Le+Wang%2C+Xinbo+Gao%2C+and+Gang+Hua%2E+2016%2E+Ordinal+Regression+with+Multiple+Output+CNN+for+Age+Estimation%2E+In+IEEE+Conference+on+Computer+Vision+and+Pattern+Recognition+%28CVPR%29%2C+pag)
42. OpenAI. 2025. [https://platform.openai.com/docs/pricing](https://platform.openai.com/docs/pricing). [↗](https://platform.openai.com/docs/pricing)
43. Maria Rigaki and Sebastián Garcı́a. 2024. A Survey of Privacy Attacks in Machine Learning. ACM Computing Surveys. [find](https://scholar.google.com/scholar?q=Maria+Rigaki+and+Sebastia%CC%81n+Garc%C4%B1%CC%81a%2E+2024%2E+A+Survey+of+Privacy+Attacks+in+Machine+Learning%2E+ACM+Computing+Surveys%2E)
44. Ahmed Salem, Andrew Paverd, and Boris Köpf. 2023. Maatphor: Automated Variant Analysis for Prompt Injection Attacks. CoRR abs/2312.11513. — [arXiv:2312.11513](https://arxiv.org/abs/2312.11513) [find](https://scholar.google.com/scholar?q=Ahmed+Salem%2C+Andrew+Paverd%2C+and+Boris+Ko%CC%88pf%2E+2023%2E+Maatphor%3A+Automated+Variant+Analysis+for+Prompt+Injection+Attacks%2E+CoRR+abs%2F2312%2E11513%2E+%E2%80%94+%5BarXiv%3A2312%2E11513%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2312%2E11513%29)
45. Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. 2019. ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models. In Network and Distributed System Security Symposium (NDSS). Internet Society. [find](https://scholar.google.com/scholar?q=Ahmed+Salem%2C+Yang+Zhang%2C+Mathias+Humbert%2C+Pascal+Berrang%2C+Mario+Fritz%2C+and+Michael+Backes%2E+2019%2E+ML%2DLeaks%3A+Model+and+Data+Independent+Membership+Inference+Attacks+and+Defenses+on+Machine+Learning+Mode)
46. Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017. [Membership Inference Attacks Against Machine Learning Models](https://md.research.elamur.ai/free/en/papers/shokri-2016-membership-inference-attacks-against-machine/). In IEEE Symposium on Security and Privacy (S&P), pages 3–18. IEEE.
47. Congzheng Song and Ananth Raghunathan. 2020. Information Leakage in Embedding Models. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 377–390. ACM. [find](https://scholar.google.com/scholar?q=Congzheng+Song+and+Ananth+Raghunathan%2E+2020%2E+Information+Leakage+in+Embedding+Models%2E+In+ACM+SIGSAC+Conference+on+Computer+and+Communications+Security+%28CCS%29%2C+pages+377%E2%80%93390%2E+ACM%2E)
48. Congzheng Song and Vitaly Shmatikov. 2020. Overlearning Reveals Sensitive Attributes. In International Conference on Learning Representations (ICLR). [find](https://scholar.google.com/scholar?q=Congzheng+Song+and+Vitaly+Shmatikov%2E+2020%2E+Overlearning+Reveals+Sensitive+Attributes%2E+In+International+Conference+on+Learning+Representations+%28ICLR%29%2E)
49. Liwei Song and Prateek Mittal. 2021. Systematic Evaluation of Privacy Risks of Machine Learning Models. In USENIX Security Symposium (USENIX Security). USENIX. [find](https://scholar.google.com/scholar?q=Liwei+Song+and+Prateek+Mittal%2E+2021%2E+Systematic+Evaluation+of+Privacy+Risks+of+Machine+Learning+Models%2E+In+USENIX+Security+Symposium+%28USENIX+Security%29%2E+USENIX%2E)
50. The Vicuna Team. 2023. Vicuna: An Open-Source Chatbot Impressing GPT-4 with 90%* Chat-GPT Quality. [https://lmsys.org/blog/](https://lmsys.org/blog/) 2023-03-30-vicuna/. [↗](https://lmsys.org/blog/)
51. Florian Tramèr, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart. 2016. Stealing Machine Learning Models via Prediction APIs. In USENIX Security Symposium (USENIX Security), pages 601–618. USENIX. [find](https://scholar.google.com/scholar?q=Florian+Trame%CC%80r%2C+Fan+Zhang%2C+Ari+Juels%2C+Michael+K%2E+Reiter%2C+and+Thomas+Ristenpart%2E+2016%2E+Stealing+Machine+Learning+Models+via+Prediction+APIs%2E+In+USENIX+Security+Symposium+%28USENIX+Security%29%2C+pages+601%E2%80%936)
52. Rui Wen, Michael Backes, and Yang Zhang. 2025. Understanding Data Importance in Machine Learning Attacks: Does Valuable Data Pose Greater Harm? In Network and Distributed System Security Symposium (NDSS). Internet Society. [find](https://scholar.google.com/scholar?q=Rui+Wen%2C+Michael+Backes%2C+and+Yang+Zhang%2E+2025%2E+Understanding+Data+Importance+in+Machine+Learning+Attacks%3A+Does+Valuable+Data+Pose+Greater+Harm%3F+In+Network+and+Distributed+System+Security+Symposium+%28ND)
53. Rui Wen, Zheng Li, Michael Backes, and Yang Zhang. 2024. Membership Inference Attacks Against In-Context Learning. In ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM. [find](https://scholar.google.com/scholar?q=Rui+Wen%2C+Zheng+Li%2C+Michael+Backes%2C+and+Yang+Zhang%2E+2024%2E+Membership+Inference+Attacks+Against+In%2DContext+Learning%2E+In+ACM+SIGSAC+Conference+on+Computer+and+Communications+Security+%28CCS%29%2E+ACM%2E)
54. Chunqiu Steven Xia, Yinlin Deng, Soren Dunn, and Lingming Zhang. 2024. [Agentless: Demystifying LLM-based Software Engineering Agents](https://md.research.elamur.ai/free/en/papers/xia-2024-agentless-demystifying-llm-based/). CoRR abs/2407.01489.
55. Tianbao Xie, Danyang Zhang, Jixuan Chen, Xiaochuan Li, Siheng Zhao, Ruisheng Cao, Toh Jing Hua, Zhoujun Cheng, Dongchan Shin, Fangyu Lei, Yitao Liu, Yiheng Xu, Shuyan Zhou, Silvio Savarese, Caiming Xiong, Victor Zhong, and Tao Yu. 2024. [OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in…](https://md.research.elamur.ai/free/en/papers/xie-2024-osworld-benchmarking-multimodal-agents-open/)
56. John Yang, Carlos E. Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik Narasimhan, and Ofir Pres. 2024. [SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering](https://md.research.elamur.ai/free/en/papers/yang-2024-swe-agent-agent-computer-interfaces/). CoRR abs/2405.15793.
57. Ziqi Yang, Jiyi Zhang, Ee-Chien Chang, and Zhenkai Liang. 2019. Neural Network Inversion in Adversarial Setting via Background Knowledge Alignment. In ACM SIGSAC Conference on Computer and Communications Security (CCS), page 225–240. ACM. [find](https://scholar.google.com/scholar?q=Ziqi+Yang%2C+Jiyi+Zhang%2C+Ee%2DChien+Chang%2C+and+Zhenkai+Liang%2E+2019%2E+Neural+Network+Inversion+in+Adversarial+Setting+via+Background+Knowledge+Alignment%2E+In+ACM+SIGSAC+Conference+on+Computer+and+Communicati)
58. Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri. 2022. Enhanced Membership Inference Attacks against Machine Learning Models. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 3093–3106. ACM. [find](https://scholar.google.com/scholar?q=Jiayuan+Ye%2C+Aadyaa+Maddi%2C+Sasi+Kumar+Murakonda%2C+Vincent+Bindschaedler%2C+and+Reza+Shokri%2E+2022%2E+Enhanced+Membership+Inference+Attacks+against+Machine+Learning+Models%2E+In+ACM+SIGSAC+Conference+on+Compute)
59. Hongxu Yin, Pavlo Molchanov, Jose M. Alvarez, Zhizhong Li, Arun Mallya, Derek Hoiem, Niraj K. Jha, and Jan Kautz. 2020. Dreaming to Distill: Data-Free Knowledge Transfer via DeepInversion. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 8712–8721. IEEE. [find](https://scholar.google.com/scholar?q=Hongxu+Yin%2C+Pavlo+Molchanov%2C+Jose+M%2E+Alvarez%2C+Zhizhong+Li%2C+Arun+Mallya%2C+Derek+Hoiem%2C+Niraj+K%2E+Jha%2C+and+Jan+Kautz%2E+2020%2E+Dreaming+to+Distill%3A+Data%2DFree+Knowledge+Transfer+via+DeepInversion%2E+In+IEEE+Con)
60. Andy K. Zhang, Neil Perry, Riya Dulepet, Eliot Jones, Justin W. Lin, Joey Ji, Celeste Menders, Gashon Hussein, Samantha Liu, Donovan Jasper, Pura Peetathawatchai, Ari Glenn, Vikram Sivashankar, Daniel Zamoshchin, Leo Glikbarg, Derek Askar-yar, Mike Yang, Teddy Zhang, Rishi Alluri, Nathan Tran, Rinna… [find](https://scholar.google.com/scholar?q=Andy+K%2E+Zhang%2C+Neil+Perry%2C+Riya+Dulepet%2C+Eliot+Jones%2C+Justin+W%2E+Lin%2C+Joey+Ji%2C+Celeste+Menders%2C+Gashon+Hussein%2C+Samantha+Liu%2C+Donovan+Jasper%2C+Pura+Peetathawatchai%2C+Ari+Glenn%2C+Vikram+Sivashankar%2C+Daniel)
61. Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song. 2020. The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 250–258. IEEE. [find](https://scholar.google.com/scholar?q=Yuheng+Zhang%2C+Ruoxi+Jia%2C+Hengzhi+Pei%2C+Wenxiao+Wang%2C+Bo+Li%2C+and+Dawn+Song%2E+2020%2E+The+Secret+Revealer%3A+Generative+Model%2DInversion+Attacks+Against+Deep+Neural+Networks%2E+In+IEEE+Conference+on+Computer+Vis)
62. Zhifei Zhang, Yang Song, and Hairong Qi. 2017. Age Progression/Regression by Conditional Adversarial Autoencoder. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 4352– 4360. IEEE. [find](https://scholar.google.com/scholar?q=Zhifei+Zhang%2C+Yang+Song%2C+and+Hairong+Qi%2E+2017%2E+Age+Progression%2FRegression+by+Conditional+Adversarial+Autoencoder%2E+In+IEEE+Conference+on+Computer+Vision+and+Pattern+Recognition+%28CVPR%29%2C+pages+4352%E2%80%93+4360)
63. Nan Zhong, Zhenxing Qian, and Xinpeng Zhang. 2022. Imperceptible Backdoor Attack: From Input Space to Feature Representation. In International Joint Conferences on Artifical Intelligence (IJCAI), pages 1736–1742. IJCAI. [find](https://scholar.google.com/scholar?q=Nan+Zhong%2C+Zhenxing+Qian%2C+and+Xinpeng+Zhang%2E+2022%2E+Imperceptible+Backdoor+Attack%3A+From+Input+Space+to+Feature+Representation%2E+In+International+Joint+Conferences+on+Artifical+Intelligence+%28IJCAI%29%2C+page)
64. Shuyan Zhou, Frank F. Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Yonatan Bisk, Daniel Fried, Uri Alon, and Graham Neubig. 2023. [WebArena: A Realistic Web Environment for Building Autonomous Agents](https://md.research.elamur.ai/free/en/papers/zhou-2023-webarena-realistic-web-environment-building/). CoRR abs/2307.13854.

*Updated 2 November 2026*