| Square attack: a query-efficient black-box adversarial attack via random search M Andriushchenko*, F Croce*, N Flammarion, M Hein ECCV 2020, 2020 | 1127 | 2020 |
| RobustBench: a standardized adversarial robustness benchmark F Croce*, M Andriushchenko*, V Sehwag*, E Debenedetti*, N Flammarion, ... NeurIPS 2021 Datasets and Benchmarks Track, Best Paper Honorable Mention …, 2021 | 772 | 2021 |
| Why ReLU networks yield high-confidence predictions far away from the training data and how to mitigate the problem M Hein, M Andriushchenko, J Bitterwolf CVPR 2019 (oral), 2019 | 664 | 2019 |
| Formal guarantees on the robustness of a classifier against adversarial manipulation M Hein, M Andriushchenko NeurIPS 2017, 2017 | 634 | 2017 |
| On the Stability of Fine-tuning BERT: Misconceptions, Explanations, and Strong Baselines M Mosbach, M Andriushchenko, D Klakow ICLR 2021, 2021 | 427 | 2021 |
| Understanding and Improving Fast Adversarial Training M Andriushchenko, N Flammarion NeurIPS 2020, 2020 | 357 | 2020 |
| Provably Robust Boosted Decision Stumps and Trees against Adversarial Attacks M Andriushchenko, M Hein NeurIPS 2019, 2019 | 305 | 2019 |
| Provable Robustness of ReLU Networks via Maximization of Linear Regions F Croce*, M Andriushchenko*, M Hein AISTATS 2019, 2019 | 191 | 2019 |
| Towards Understanding Sharpness-Aware Minimization M Andriushchenko, N Flammarion ICML 2022, 2022 | 157 | 2022 |
| On the effectiveness of adversarial training against common corruptions K Kireev*, M Andriushchenko*, N Flammarion UAI 2022, 2021 | 118 | 2021 |
| Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attacks F Croce, M Andriushchenko, ND Singh, N Flammarion, M Hein AAAI 2022, 2022 | 114 | 2022 |
| Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks M Andriushchenko, F Croce, N Flammarion ICLR 2025, 2025 | 88 | 2025 |
| JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models P Chao*, E Debenedetti*, A Robey*, M Andriushchenko*, F Croce, ... NeurIPS 2024 Datasets and Benchmarks Track, 2024 | 88 | 2024 |
| Logit Pairing Methods Can Fool Gradient-Based Attacks M Mosbach*, M Andriushchenko*, T Trost, M Hein, D Klakow NeurIPS 2018 Workshop on Security in Machine Learning, 2018 | 84 | 2018 |
| SGD with Large Step Sizes Learns Sparse Features M Andriushchenko, A Varre, L Pillaud-Vivien, N Flammarion ICML 2023, 2022 | 61 | 2022 |
| A Modern Look at the Relationship between Sharpness and Generalization M Andriushchenko, F Croce, M Müller, M Hein, N Flammarion ICML 2023, 2023 | 54 | 2023 |
| Improving Alignment and Robustness with Circuit Breakers A Zou, L Phan, J Wang, D Duenas, M Lin, M Andriushchenko, R Wang, ... NeurIPS 2024, 2024 | 50* | 2024 |
| Sharpness-Aware Minimization Leads to Low-Rank Features M Andriushchenko, D Bahri, H Mobahi, N Flammarion NeurIPS 2023, 2023 | 27 | 2023 |
| Long is more for alignment: A simple but tough-to-beat baseline for instruction fine-tuning H Zhao, M Andriushchenko, F Croce, N Flammarion ICML 2024, 2024 | 25 | 2024 |
| Why Do We Need Weight Decay in Modern Deep Learning? F D'Angelo*, M Andriushchenko*, A Varre, N Flammarion NeurIPS 2024, 2024 | 23 | 2024 |
Nicolas FlammarionEPFLVerified email at epfl.ch
