Summer School on
Artificial Intelligence and Cybersecurity
22-26 September 2025, Vienna, Austria

Benefits

• Most prominent logo placement
• 30-min tech demo
• Table-top stand
• Flyer or swag in welcome bag
• 4 free passes
• 2 seats at speakers' dinner

Benefits

• Medium-sized logo placement
• Table-top stand
• Flyer or swag in welcome bag
• 2 free passes
• 1 seat at speakers' dinner

Benefits

• Logo on website and program
• Flyer or swag in welcome bag
• 1 free pass

No day goes by without reading machine learning (ML) success stories across various application areas. Systems security is no exception, where ML’s tantalizing performance leave one to wonder whether there are any unsolved problems left. However, ML has no clairvoyant abilities and once the magic wears off, we’re left in uncharted territory. Is ML truly capable of ensuring systems security? In this lecture, we will take malware research as a representative example of a long-studied, thriving, yet challenging subject and, after offering a quick historical perspective, we will illustrate some of the open issues that are affecting learning-based malware models. When relevant, we will also delve into behind-the-scenes aspects to encourage reflection on the reproducibility crisis. Our goal is to foster a deeper understanding of ML’s role in systems security along with a discussion on promising directions the research community is and should be pursuing to address such challenges and open problems.

Lorenzo Cavallaro grew up on pizza, spaghetti, and Phrack, and soon developed a passion for underground and academic research. He is a Full Professor of Computer Science at University College London (UCL), where he leads the Systems Security Research Lab — https://s2lab.cs.ucl.ac.uk. Lorenzo’s research vision is to enhance the effectiveness of machine learning for systems security in adversarial settings. To this end, he works with his team to investigate the interplay among program analysis abstractions, representations, ML models, and their crucial role in creating Trustworthy AI for Systems Security. Lorenzo publishes at and sits on the Program Committee of leading conferences in computer security and ML, received the Distinguished Paper Award at USENIX Security 2022, and an ICML 2024 Spotlight Paper. He is also Associate Editor of ACM TOPS and IEEE TDSC. In addition to his love for food, Lorenzo finds his Flow in science, music, and family.

Privacy concerns are becoming a major obstacle to using data in the way that we want. It's often unclear how current regulations should translate into technology, and the changing legal landscape surrounding privacy can cause valuable data to go unused. How can data scientists make use of potentially sensitive data, while providing rigorous privacy guarantees to the individuals who provided data? A growing literature on differential privacy has emerged in the last decade to address some of these concerns. Differential privacy is a parameterized notion of database privacy that gives a mathematically rigorous worst-case bound on the maximum amount of information that can be learned about any one individual's data from the output of a computation. Differential privacy ensures that if a single entry in the database were to be changed, then the algorithm would still have approximately the same distribution over outputs. In this talk, we will see the definition and properties of differential privacy; survey a theoretical toolbox of differentially private algorithms that come with a strong accuracy guarantee; and discuss recent applications of differential privacy in major technology companies and government organizations.

Dr. Rachel Cummings is an Associate Professor of Industrial Engineering and Operations Research and (by courtesy) Computer Science at Columbia University, where she is also a member of the Data Science Institute and co-chairs the Cybersecurity Research Center. Before joining Columbia, she was an Assistant Professor of Industrial and Systems Engineering and (by courtesy) Computer Science at the Georgia Institute of Technology, and she received her Ph.D. in Computing and Mathematical Sciences from the California Institute of Technology. Her research interests lie primarily in data privacy, with connections to machine learning, algorithmic economics, optimization, statistics, and public policy. Dr. Cummings is the recipient of numerous awards including an NSF CAREER award, a DARPA Young Faculty Award, a DARPA Director’s Fellowship, an Early Career Impact Award, multiple industry research awards, a Provost’s Teaching Award, two doctoral dissertation awards, and Best Paper Awards at DISC 2014, CCS 2021, and SaTML 2023. Dr. Cummings also serves or has served on the U.S. Census Scientific Advisory Committee, the ACM U.S. Technology Policy Committee, the IEEE Standards Association, and the Future of Privacy Forum’s Advisory Board, and was a Fellow at the Center for Democracy & Technology.

This lecture addresses the gap between theoretical AI security research and real-world vulnerabilities. While for example jailbreaking attacks on large language models are widely recognized, threats to classical models, like image classifiers, often remain overlooked. We will explore the practical relevance of current AI attack research through the lens of autonomous driving and backdoor attacks. To bridge the theory-practice divide, we propose actionable solutions: AI security incident reporting and AI security testing methodologies, the latter with a focus on model stealing, where we outline practical evaluation guidelines for practitioners.

Kathrin Grosse is a Research Scientist at IBM Research, Zurich, Switzerland. Her research interests focus on AI security in practice. Her work bridges research (in AI security) and industry needs. She received her master’s degree from Saarland University and her Ph.D. at CISPA Helmholtz Center, Saarland University, in 2021 under the supervision of Michael Backes, followed by a Postdoc with Battista Biggio in Cagliari, Italy and Alexandre Alahi at EPFL, Switzerland. She interned with IBM in 2019 and Disney Research in 2020/21. As part of her work, she serves as a reviewer for IEEE S&P, Usenix Security, and ICML and organizes workshops at ICML and develops patents. In 2019, she was nominated as an AI Newcomer for the German Federal Ministry of Education and Research’s Science Year.

In this mini-course, I will discuss certification methods for the robustness of neural networks, focusing on a set of techniques that will work throughout the lifecycle of the neural network development and deployment to quantify and reduce risks with provable guarantees. This includes (1) formal verification methods that provide strong guarantees to the local robustness, concerning whether the neural network is free from adversarial attacks within a small region, (2) regulated training techniques where we enhance PAC-Bayesian theory with structural information in order to more tightly quantify, and effectively reduce, risks to the generalisation and robustness of neural networks during training, (3) randomised smoothing techniques that achieve robustness guarantees through the construction of another machine learning model that is randomised from the original model, (4) conformal prediction techniques that utilise a coverage set of the output, rather than a single output, to ensure the achievement of a statistical guarantee over the inference, as well as (5) runtime monitoring techniques where the risks are actively reduced in operation. For these topics, we will cover a diverse set of machine learning models, including conformal prediction for image retrieval, randomised smoothing for reinforcement learning, PAC-Bayesian regulated training for classifiers, runtime monitoring for object detection, etc.

Prof. Xiaowei Huang is currently based at the University of Liverpool, UK, where he founded the Trustworthy Autonomous Cyber-Physical Systems Lab. He works on AI algorithms with a focus on developing rigorous methods to improve the safety, security, and trustworthiness of deep learning models. His research explores verification, falsification, improvement, and explanation techniques for deep learning. He has published over 120 papers, most of which appear in top venues of artificial intelligence (such as NeurIPS, ICML, CVPR, AAAI, IJCAI) or software engineering (ICSE, ASE, TACAS, CAV). He has been the PI (or institutional PI) for projects valued over £10m, and co-I for over £20m. He currently coordinates an EU Horizon project RobustifAI, which aims to develop rigorous methodologies for designing and deploying robust Generative AI systems.

Learning-based pattern classifiers have shown impressive performance in many application domains, ranging from computer vision to cybersecurity. However, it has also been shown that adversarial perturbations of input data can easily subvert their predictions. The vulnerability of machine learning to such malicious perturbations has been investigated in the research field of adversarial machine learning. In this lecture, we review the fundamental concepts of adversarial machine learning and AI security to provide the audience with a gentle introduction to this field in constant progress and distillate the current state of our knowledge. To this end, we also discuss concepts and misconceptions that are frequent in research papers and public debate. Some of these misconceptions concern the relationship between adversarial machine learning and the security of AI systems. Finally, we critically analyse existing benchmarking tools and highlight their issues and limitations, avoiding known mistakes to ensure high-quality evaluations.

Maura Pintor is an Assistant Professor at the University of Cagliari, Italy. She received her PhD in Electronic and Computer Engineering from the University of Cagliari in 2022. Her research interests focus on optimizing and debugging adversarial attacks for machine learning robustness evaluations. She is reviewer for ECCV, ICPR, CVPR, ICLR (top reviewers '24), ICCV, USENIX Security, ACM CCS, ACSAC, and for the journals IEEE TIFS, IEEE TIP, IEEE TDSC, IEEE TNNLS, TOPS. She is Associate Editor for Pattern Recognition and co-chair of the ACM Workshop on Artificial Intelligence and Security (AISec), co-located with ACM CCS.

Learning-based systems effectively assist in various computer security challenges, such as preventing network intrusions, reverse engineering, vulnerability discovery, or detecting malware. However, modern (deep) learning methods often lack understandable reasoning in their decision process, making crucial decisions less trustworthy. Recent advances in “Explainable AI” (XAI) have turned the tables, enabling precise attribution of an input feature’s relevance to the final decision for otherwise opaque models. This lecture will provide an introduction to XAI and specifically discuss the application for computer security. We will demonstrate in which situations XAI can and cannot (yet) be used reliably.

Christian Wressnegger is a professor of computer science at the Karlsruhe Institute of Technology (KIT), heading the chair of Artificial Intelligence & Security. Additionally, he is the spokesperson of the KIT Graduate School Cyber Security and co-director of the KASTEL Security Research Labs, one of three competence centers for cyber security in Germany. He holds a Ph.D. from TU Braunschweig and has graduated from Graz University of Technology, where he majored in computer science. His research revolves around combining machine learning (or AI in the broader scope) and computer security. He develops methods for system security and application security but also researches the robustness of machine learning against attacks, striving for secure AI. He is particularly visible for his work on the security of XAI.