Battista Biggio

Several open research questions are identified, including how to efficiently record incidents and how to determine whether vulnerabilities and incidents generalize, and privacy requirements are summarized and research directions for the secure and trustworthy deployment of AI agents are outlined.

Adversaries targeting multi-stage compound AI systems do not just bypass detection—they weaponize pipeline routing to induce severe latency bottlenecks, proving that operational efficiency and adversarial robustness are fundamentally at odds.

AI-based malware detectors that rely on domain knowledge significantly outperform deep learning models in long-term resilience and security against adversarial attacks.

Attack ensembles optimized for minimum-norm strategies can provide a more accurate and flexible evaluation of adversarial robustness than traditional fixed-budget methods.

Existing problem-space attacks are largely impractical, but DROIDBREAKER shows how to craft adversarial APKs that evade detection while preserving functionality.

Slash malware detection labeling costs by 90% using combined active and semi-supervised learning, without sacrificing performance.