Position: Adversarial ML for LLMs Is Not Making Any Progress

Javier Rando, Jie Zhang, Nicholas Carlini, Florian Tramèr
Proceedings of the 43rd International Conference on Machine Learning, PMLR 306:171851-171863, 2026.

Abstract

In the past decade, considerable research effort has been devoted to securing machine learning (ML) models that operate in adversarial settings. Yet, progress has been slow even for simple "toy" problems (e.g., robustness to small adversarial perturbations) and is often hindered by non-rigorous evaluations. Today, adversarial ML research has shifted towards studying larger, general-purpose language models. In this position paper, we argue that the situation is now even worse: in the era of LLMs, the field of adversarial ML studies problems that are (1) less clearly defined, (2) harder to solve, and (3) even more challenging to evaluate. As a result, we caution that yet another decade of work on adversarial ML may be failing to produce meaningful progress.

Cite this Paper

BibTeX
@InProceedings{pmlr-v306-rando26a, title = {Position: Adversarial {ML} for {LLM}s Is Not Making Any Progress}, author = {Rando, Javier and Zhang, Jie and Carlini, Nicholas and Tram\`{e}r, Florian}, booktitle = {Proceedings of the 43rd International Conference on Machine Learning}, pages = {171851--171863}, year = {2026}, editor = {Zhang, Tong and Dudik, Miroslav and Jaggi, Martin and Agarwal, Alekh and Li, Sharon and Schuurmans, Dale and Zhu, Jerry and Berkenkamp, Felix and Dong, Hanze and Bietti, Alberto}, volume = {306}, series = {Proceedings of Machine Learning Research}, month = {06--11 Jul}, publisher = {PMLR}, pdf = {https://raw.githubusercontent.com/mlresearch/v306/main/assets/rando26a/rando26a.pdf}, url = {https://proceedings.mlr.press/v306/rando26a.html}, abstract = {In the past decade, considerable research effort has been devoted to securing machine learning (ML) models that operate in adversarial settings. Yet, progress has been slow even for simple "toy" problems (e.g., robustness to small adversarial perturbations) and is often hindered by non-rigorous evaluations. Today, adversarial ML research has shifted towards studying larger, general-purpose language models. In this position paper, we argue that the situation is now even worse: in the era of LLMs, the field of adversarial ML studies problems that are (1) less clearly defined, (2) harder to solve, and (3) even more challenging to evaluate. As a result, we caution that yet another decade of work on adversarial ML may be failing to produce meaningful progress.} }
Endnote
%0 Conference Paper %T Position: Adversarial ML for LLMs Is Not Making Any Progress %A Javier Rando %A Jie Zhang %A Nicholas Carlini %A Florian Tramèr %B Proceedings of the 43rd International Conference on Machine Learning %C Proceedings of Machine Learning Research %D 2026 %E Tong Zhang %E Miroslav Dudik %E Martin Jaggi %E Alekh Agarwal %E Sharon Li %E Dale Schuurmans %E Jerry Zhu %E Felix Berkenkamp %E Hanze Dong %E Alberto Bietti %F pmlr-v306-rando26a %I PMLR %P 171851--171863 %U https://proceedings.mlr.press/v306/rando26a.html %V 306 %X In the past decade, considerable research effort has been devoted to securing machine learning (ML) models that operate in adversarial settings. Yet, progress has been slow even for simple "toy" problems (e.g., robustness to small adversarial perturbations) and is often hindered by non-rigorous evaluations. Today, adversarial ML research has shifted towards studying larger, general-purpose language models. In this position paper, we argue that the situation is now even worse: in the era of LLMs, the field of adversarial ML studies problems that are (1) less clearly defined, (2) harder to solve, and (3) even more challenging to evaluate. As a result, we caution that yet another decade of work on adversarial ML may be failing to produce meaningful progress.
APA
Rando, J., Zhang, J., Carlini, N. & Tramèr, F.. (2026). Position: Adversarial ML for LLMs Is Not Making Any Progress. Proceedings of the 43rd International Conference on Machine Learning, in Proceedings of Machine Learning Research 306:171851-171863 Available from https://proceedings.mlr.press/v306/rando26a.html.

Related Material