Home

TU Wien Hauptgebäude — © TU Wien / Matthias Heisler

Join us for the first Summer School on AI and Cybersecurity at TU Wien — a unique event at the crossroads of cutting-edge research and practical application. Held in the heart of Vienna, this week-long program brings together leading experts, researchers, and students to explore how artificial intelligence is reshaping cybersecurity. Participants will engage with renowned lecturers and learn about state-of-the-art methods, from explainable AI and threat detection to adversarial machine learning and secure system design. Whether you're a student, a practitioner, or a researcher, this is a chance to deepen your knowledge, grow your network, and experience the vibrant atmosphere of one of Europe’s most beautiful and livable cities.

Speakers

For further information, click on the profile pictures:

Daniel Arp, TU Wien, Austria

Lorenzo Cavallaro, University College London, UK

Rachel Cummings, Columbia University, USA

Kathrin Grosse, IBM Research, Switzerland

Xiaowei Huang, University of Liverpool, UK

Maura Pintor, Università di Cagliari, Italy

Lea Schönherr, CISPA Helmholtz Center for Information Security, Germany

Christian Wressnegger, Karlsruhe Institute of Technology, Germany

Registration

Early-bird registration is available until July 10, 2025.

Sponsors & Partners

SpyCoDe

RobustifAI

Austrian Institute of Technology

Österreichischer
Wissenschaftsfond

City of Vienna

Beldex

CySec Wien

Become a sponsor

Partners

Program

Venue

The event will take place at TUtheSky, the rooftop venue of TU Wien, offering panoramic views over Vienna.

TUtheSky venue, rooftop room

Address:

Getreidemarkt 9, 1060 Vienna — 11th floor

View on TU Wien Campus Map

Organizers

Daniel Arp, TU Wien, Austria
Ezio Bartocci, TU Wien, Austria
Matteo Maffei, TU Wien, Austria
Stefan Neumann, TU Wien, Austria
Andreas Steininger, TU Wien, Austria

Showcase your commitment to trustworthy AI & cybersecurity while connecting with tomorrow’s talent and today’s thought-leaders.

Benefits

Most prominent logo placement
30-min tech demo
Table-top stand
Flyer or swag in welcome bag
4 free passes
2 seats at speakers' dinner

Benefits

Medium-sized logo placement
Table-top stand
Flyer or swag in welcome bag
2 free passes
1 seat at speakers' dinner

Benefits

Logo on website and program
Flyer or swag in welcome bag
1 free pass

Lecture:
Pitfalls in AI for Security

Personal website

Advances in computational power and the proliferation of massive datasets have propelled artificial intelligence (AI) to achieve major breakthroughs across a wide spectrum of applications—from image recognition and natural language processing to autonomous systems and scientific discovery. Yet when AI techniques are applied to security, they encounter a host of subtle pitfalls that can seriously undermine performance and, in the worst case, render learning-based systems unsuitable for real-world deployment. In this lecture, we will take an in-depth look at these pitfalls and explore how they manifest in various security domains, such as malware detection and vulnerability discovery, where they frequently lead to inflated assessments of system effectiveness. We’ll survey illustrative case studies drawn from academic literature to gauge the prevalence of these issues and, finally, discuss recommendations for avoiding them when designing experiments.

Daniel Arp is a tenure-track Assistant Professor in the Security and Privacy Research Unit at Technische Universität Wien. Previously, he held a postdoctoral research position at TU Berlin and a visiting research position at University College London and King’s College London. He received his Ph.D. with honours in Computer Science from TU Braunschweig. Additionally, he holds a master’s degree in Computer Engineering from TU Berlin. Daniel’s research interests encompass the development of learning-based methodologies to fortify the security and privacy of systems.

Lecture:
Trustworthy AI… for Systems Security

Personal website

No day goes by without reading machine learning (ML) success stories across various application areas. Systems security is no exception, where ML’s tantalizing performance leave one to wonder whether there are any unsolved problems left. However, ML has no clairvoyant abilities and once the magic wears off, we’re left in uncharted territory. Is ML truly capable of ensuring systems security? In this lecture, we will take malware research as a representative example of a long-studied, thriving, yet challenging subject and, after offering a quick historical perspective, we will illustrate some of the open issues that are affecting learning-based malware models. When relevant, we will also delve into behind-the-scenes aspects to encourage reflection on the reproducibility crisis. Our goal is to foster a deeper understanding of ML’s role in systems security along with a discussion on promising directions the research community is and should be pursuing to address such challenges and open problems.

Lorenzo Cavallaro grew up on pizza, spaghetti, and Phrack, and soon developed a passion for underground and academic research. He is a Full Professor of Computer Science at University College London (UCL), where he leads the Systems Security Research Lab — https://s2lab.cs.ucl.ac.uk. Lorenzo’s research vision is to enhance the effectiveness of machine learning for systems security in adversarial settings. To this end, he works with his team to investigate the interplay among program analysis abstractions, representations, ML models, and their crucial role in creating Trustworthy AI for Systems Security. Lorenzo publishes at and sits on the Program Committee of leading conferences in computer security and ML, received the Distinguished Paper Award at USENIX Security 2022, and an ICML 2024 Spotlight Paper. He is also Associate Editor of ACM TOPS and IEEE TDSC. In addition to his love for food, Lorenzo finds his Flow in science, music, and family.

Lecture:
Differential Privacy in Machine Learning

Personal website

Privacy concerns are becoming a major obstacle to using data in the way that we want. It's often unclear how current regulations should translate into technology, and the changing legal landscape surrounding privacy can cause valuable data to go unused. How can data scientists make use of potentially sensitive data, while providing rigorous privacy guarantees to the individuals who provided data? A growing literature on differential privacy has emerged in the last decade to address some of these concerns. Differential privacy is a parameterized notion of database privacy that gives a mathematically rigorous worst-case bound on the maximum amount of information that can be learned about any one individual's data from the output of a computation. Differential privacy ensures that if a single entry in the database were to be changed, then the algorithm would still have approximately the same distribution over outputs. In this talk, we will see the definition and properties of differential privacy; survey a theoretical toolbox of differentially private algorithms that come with a strong accuracy guarantee; and discuss recent applications of differential privacy in major technology companies and government organizations.

Dr. Rachel Cummings is an Associate Professor of Industrial Engineering and Operations Research and (by courtesy) Computer Science at Columbia University, where she is also a member of the Data Science Institute and co-chairs the Cybersecurity Research Center. Before joining Columbia, she was an Assistant Professor of Industrial and Systems Engineering and (by courtesy) Computer Science at the Georgia Institute of Technology, and she received her Ph.D. in Computing and Mathematical Sciences from the California Institute of Technology. Her research interests lie primarily in data privacy, with connections to machine learning, algorithmic economics, optimization, statistics, and public policy. Dr. Cummings is the recipient of numerous awards including an NSF CAREER award, a DARPA Young Faculty Award, a DARPA Director’s Fellowship, an Early Career Impact Award, multiple industry research awards, a Provost’s Teaching Award, two doctoral dissertation awards, and Best Paper Awards at DISC 2014, CCS 2021, and SaTML 2023. Dr. Cummings also serves or has served on the U.S. Census Scientific Advisory Committee, the ACM U.S. Technology Policy Committee, the IEEE Standards Association, and the Future of Privacy Forum’s Advisory Board, and was a Fellow at the Center for Democracy & Technology.

Lecture:
Challenges in Practical AI Security

Personal website

This lecture addresses the gap between theoretical AI security research and real-world vulnerabilities. While for example jailbreaking attacks on large language models are widely recognized, threats to classical models, like image classifiers, often remain overlooked. We will explore the practical relevance of current AI attack research through the lens of autonomous driving and backdoor attacks. To bridge the theory-practice divide, we propose actionable solutions: AI security incident reporting and AI security testing methodologies, the latter with a focus on model stealing, where we outline practical evaluation guidelines for practitioners.

Kathrin Grosse is a Research Scientist at IBM Research, Zurich, Switzerland. Her research interests focus on AI security in practice. Her work bridges research (in AI security) and industry needs. She received her master’s degree from Saarland University and her Ph.D. at CISPA Helmholtz Center, Saarland University, in 2021 under the supervision of Michael Backes, followed by a Postdoc with Battista Biggio in Cagliari, Italy and Alexandre Alahi at EPFL, Switzerland. She interned with IBM in 2019 and Disney Research in 2020/21. As part of her work, she serves as a reviewer for IEEE S&P, Usenix Security, and ICML and organizes workshops at ICML and develops patents. In 2019, she was nominated as an AI Newcomer for the German Federal Ministry of Education and Research’s Science Year.

Lecture:
Techniques for Certifying Robustness in Modern Neural Networks

Personal website

In this mini-course, I will discuss certification methods for the robustness of neural networks, focusing on a set of techniques that will work throughout the lifecycle of the neural network development and deployment to quantify and reduce risks with provable guarantees. This includes (1) formal verification methods that provide strong guarantees to the local robustness, concerning whether the neural network is free from adversarial attacks within a small region, (2) regulated training techniques where we enhance PAC-Bayesian theory with structural information in order to more tightly quantify, and effectively reduce, risks to the generalisation and robustness of neural networks during training, (3) randomised smoothing techniques that achieve robustness guarantees through the construction of another machine learning model that is randomised from the original model, (4) conformal prediction techniques that utilise a coverage set of the output, rather than a single output, to ensure the achievement of a statistical guarantee over the inference, as well as (5) runtime monitoring techniques where the risks are actively reduced in operation. For these topics, we will cover a diverse set of machine learning models, including conformal prediction for image retrieval, randomised smoothing for reinforcement learning, PAC-Bayesian regulated training for classifiers, runtime monitoring for object detection, etc.

Prof. Xiaowei Huang is currently based at the University of Liverpool, UK, where he founded the Trustworthy Autonomous Cyber-Physical Systems Lab. He works on AI algorithms with a focus on developing rigorous methods to improve the safety, security, and trustworthiness of deep learning models. His research explores verification, falsification, improvement, and explanation techniques for deep learning. He has published over 120 papers, most of which appear in top venues of artificial intelligence (such as NeurIPS, ICML, CVPR, AAAI, IJCAI) or software engineering (ICSE, ASE, TACAS, CAV). He has been the PI (or institutional PI) for projects valued over £10m, and co-I for over £20m. He currently coordinates an EU Horizon project RobustifAI, which aims to develop rigorous methodologies for designing and deploying robust Generative AI systems.

Lecture:
Introductory Lecture on Security of AI

Personal website

Learning-based pattern classifiers have shown impressive performance in many application domains, ranging from computer vision to cybersecurity. However, it has also been shown that adversarial perturbations of input data can easily subvert their predictions. The vulnerability of machine learning to such malicious perturbations has been investigated in the research field of adversarial machine learning. In this lecture, we review the fundamental concepts of adversarial machine learning and AI security to provide the audience with a gentle introduction to this field in constant progress and distillate the current state of our knowledge. To this end, we also discuss concepts and misconceptions that are frequent in research papers and public debate. Some of these misconceptions concern the relationship between adversarial machine learning and the security of AI systems. Finally, we critically analyse existing benchmarking tools and highlight their issues and limitations, avoiding known mistakes to ensure high-quality evaluations.

Maura Pintor is an Assistant Professor at the University of Cagliari, Italy. She received her PhD in Electronic and Computer Engineering from the University of Cagliari in 2022. Her research interests focus on optimizing and debugging adversarial attacks for machine learning robustness evaluations. She is reviewer for ECCV, ICPR, CVPR, ICLR (top reviewers '24), ICCV, USENIX Security, ACM CCS, ACSAC, and for the journals IEEE TIFS, IEEE TIP, IEEE TDSC, IEEE TNNLS, TOPS. She is Associate Editor for Pattern Recognition and co-chair of the ACM Workshop on Artificial Intelligence and Security (AISec), co-located with ACM CCS.

Lecture:
Challenges and Threats in Generative AI: Misuse and Exploits

Personal website

Generative AI (genAI) is becoming more integrated into our daily lives, raising questions about potential threats within these systems and their outputs. In this lecture, we will examine the security challenges and threats associated with generative AI. We will explore various attack vectors, the deception of humans through generated content, and the social implications in our digital world. We will cover aspects such as jailbreaks, prompt injections, and threats arising from interfaces like tool usage and external data access.

In the first part of the talk, we look at threat scenarios in which generative models are utilized to produce content that is impossible to distinguish from human-generated content. As generative models evolve, the attacks are easier to automate and require less expertise, while detecting such activities will become increasingly difficult. This talk will provide an overview of our current challenges in detecting fake media in human and machine interactions and the effects of genAI media labeling on consumers' trust.

The second part will cover exploits of LLMs to disrupt alignment or steal sensitive information. Existing attacks show that LLMs’ content filters can be easily bypassed with specific inputs and that private information can be leaked. From an alternative perspective, we demonstrate that obfuscating prompts offers an effective way to protect intellectual property. Our research demonstrates that with minimal overhead, we can maintain similar utility while safeguarding confidential data, highlighting that defenses in foundation models may require fundamentally different approaches to utilize their inherent strengths.

Lea Schönherr is a tenure-track faculty at CISPA Helmholtz Center for Information Security since 2022. Her research focuses on information security, particularly adversarial machine learning, trustworthy generative AI, and ML security applications. She is especially interested in language as an interface to machine learning models, including their cognitive representations and code generation with LLMs. She has published several papers on threat detection and defense of speech recognition systems, generative models, and on preventing the misuse of generative AI. She obtained her PhD from Ruhr University Bochum, Germany, in 2021 and is a recipient of two fellowships from UbiCrypt (DFG Graduate School) and Casa (DFG Cluster of Excellence).

Lecture:
XAI for Security

Personal website

Learning-based systems effectively assist in various computer security challenges, such as preventing network intrusions, reverse engineering, vulnerability discovery, or detecting malware. However, modern (deep) learning methods often lack understandable reasoning in their decision process, making crucial decisions less trustworthy. Recent advances in “Explainable AI” (XAI) have turned the tables, enabling precise attribution of an input feature’s relevance to the final decision for otherwise opaque models. This lecture will provide an introduction to XAI and specifically discuss the application for computer security. We will demonstrate in which situations XAI can and cannot (yet) be used reliably.

Christian Wressnegger is a professor of computer science at the Karlsruhe Institute of Technology (KIT), heading the chair of Artificial Intelligence & Security. Additionally, he is the spokesperson of the KIT Graduate School Cyber Security and co-director of the KASTEL Security Research Labs, one of three competence centers for cyber security in Germany. He holds a Ph.D. from TU Braunschweig and has graduated from Graz University of Technology, where he majored in computer science. His research revolves around combining machine learning (or AI in the broader scope) and computer security. He develops methods for system security and application security but also researches the robustness of machine learning against attacks, striving for secure AI. He is particularly visible for his work on the security of XAI.