Title: Autonomous and Secure AI Agents through Information-flow Control

Boris Köpf, Microsoft Azure Research

Short Bio: Boris Köpf is a scientist at Microsoft's Azure Research, where he works on security of AI agents (Project Roma) and on defenses against side-channel attacks (Project Venice).

His research brings together security, formal verification, programming languages, systems, and AI. He has published at venues including IEEE S&P, USENIX Security, ACM CCS, PLDI, CAV, ASPLOS, ICML, and ICLR. His work has received a Best Paper Award at IEEE S&P (2021) and Distinguished Paper Awards at USENIX Security (2017), ACM CCS (2024), and IEEE S&P (2026).

---

Abstract: When AI agents work autonomously on rich data sources, they run the risk of oversharing sensitive information or following instructions hidden in untrusted content. Most current defenses are either probabilistic, offering no strong assurance, or rely on humans approving consequential actions, which undermines autonomy.

In this talk, we show how information-flow control (IFC) can make agents both secure and autonomous. IFC attaches confidentiality and integrity labels to data, tracks them through the agent loop, and enforces deterministic policies on where data may flow and what it may influence. We will place IFC within the broader space of deterministic guardrails for AI systems and share lessons from bringing IFC to real-world agent platforms.

Title: The AI Trust Gap: When Expectations Meet Adversarial Reality

Alexandra Dmitrienko, University of Duisburg-Essen

Short Bio: Alexandra Dmitrienko is a Full Professor of Computer Science at the University of Duisburg-Essen, Germany, where she holds the Chair of Trustworthy Systems. Previously, she held academic and research positions at the University of Würzburg, ETH Zurich, the Fraunhofer Institute for Secure Information Technology, and Ruhr University Bochum. She received her PhD in Information Technology from TU Darmstadt with distinction.

Her research interests span software and systems security, IoT security, and the intersection of artificial intelligence and cybersecurity. Her research regularly appears at the Big Four security conferences: ACM CCS, USENIX Security, NDSS, and the IEEE Symposium on Security and Privacy. She has delivered invited keynotes at AsiaCCS 2024 and ACNS 2025.

She is actively involved in the international security research community and has held several conference leadership positions, including Track Chair for ACM CCS 2025, TPC Vice Chair for USENIX Security 2024, and TPC Chair for ACM WiSec 2022. She regularly serves on the program committees of all Big Four security conferences and is serving as an Associate Chair for NDSS 2027 and Technical Program Co-Chair for IEEE CNS 2027.

Her research and academic contributions have been recognized with several awards, including the IEEE Symposium on Security and Privacy Best Student Paper Award (2013), the Intel Doctoral Student Honor Award (2013), the ERCIM STM Working Group Award (2016), the ACM AsiaCCS Distinguished Paper Award (2017), and the NDSS Distinguished Reviewer Award (2026).

---

Abstract: As large language models (LLMs) become increasingly integrated into our daily lives and software development workflows, we place growing trust in their ability to behave safely, produce reliable and secure outputs, and act according to our intentions. Yet, the gap between these expectations and the security guarantees that current AI systems can provide remains substantial, particularly in the presence of adversarial manipulation.

In this keynote, I will explore this trust gap through two fundamental challenges in LLM security. First, I will examine the robustness of safety alignment, demonstrating how targeted manipulation of safety-critical model components can undermine safeguards designed to prevent harmful behavior. I will then discuss recent approaches to strengthening safety alignment by addressing its underlying fragility. Second, I will turn to AI-assisted code generation, investigating how security-aware knowledge retrieval can improve the security of generated code, while also introducing new attack surfaces when external knowledge sources are compromised.

Finally, I will look ahead to emerging challenges in agentic AI, where security concerns extend beyond generated outputs to autonomous decisions and actions. Drawing on recent research in attacks and defenses, the talk will highlight the assumptions underlying our trust in AI systems and discuss how we can move toward more robust and trustworthy AI.

Call for Papers

Important Dates (all deadlines are 23:59 / 11:59pm AoE)

• Paper submission deadline: July 24th, 2026 (firm) []
• Reviews due: September 1st 7th, 2026
• Review Released and Acceptance notification: September 3rd 9th, 2026
• Camera ready due: September 16th, 2026 (firm)
• Workshop day: November 15th, 2026

Submission Site

Submission link: https://aisec26.hotcrp.com/

Scope of AISec

Applications of Artificial Intelligence (AI), Machine Learning (ML), and data mining to security and privacy problems are ubiquitous. The analytic tools and intelligent behavior provided by AI/ML models is now pivotal for autonomous real-time analysis and decision-making in domains with a wealth of data or that require quick reactions to constantly changing situations. The use of learning-based methods in security-sensitive domains, in which adversaries may attempt to mislead or evade intelligent machines, creates new frontiers for security research. The acknowledged widespread adoption of deep learning techniques, such as Large-Language Models (LLM), whose security properties are difficult to reason about directly, has only added to the importance of this research. At the same time, and unfortunately, application and deployment of AI/ML techniques often leads to privacy-related issues, such as the possibility to extract sensitive data from trained models, as well as training on sensitive or confidential data.
The AISec workshop provides a venue for presenting and discussing new developments in the intersection of security and privacy with AI and ML.

Topics of Interest

Topics of interest include (but are not limited to):

Theoretical topics linking AI with Security or Privacy

• Adversarial ML
• Security of AI/ML-systems
• Robust statistics
• Economics of AI/ML-based security
• Differential privacy

Security applications of AI/ML

• Computer forensics
• Spam and Phishing detection, prevention, and response
• (Network) Intrusion detection and response
• Malware identification and analysis
• Data anonymization/de-anonymization
• Security and Privacy on the Web
• Extraction of Cyber-threat Intelligence
• Security and Privacy in data markets

Security/Privacy-related AI problems

• Distributed inference and decision-making for security
• Secure multiparty computation and cryptographic approaches
• Model confidentiality
• Privacy-preserving data mining
• Adaptive side-channel attacks
• Design and analysis of CAPTCHAs
• Safe and Usable applications of AI
• Human factors in AI/ML and Security/Privacy
• AI approaches to trust and reputation
• Vulnerability testing through intelligent probing (e.g. fuzzing)
• Content-driven security policy management & access control
• AI Misuse (e.g., Large Language Models for automated hacking, misinformation, deepfakes)

AI Safety and Trustworthiness

• Alignment failure modes and specification gaming
• Scalable oversight and human-in-the-loop supervision
• Dangerous capability evaluations
• Red-teaming and stress-testing of foundation models
• Deceptive alignment and sandbagging
• Multi-agent coordination risks
• Containment and guardrails for autonomous agents
• Truthfulness, calibration, and hallucination mitigation
• Societal-scale risks from AI misues and proliferation
• AI Ethics

Submission Guidelines

We invite the following types of papers, all of which are of archival nature and, hence, cannot substantially overlap with papers that have been published previously or that are simultaneously submitted to a journal or conference/workshop with proceedings.

• Original research papers on any topic in the intersection of AI or machine learning with security, privacy, or related areas.
• Position and open-problem papers discussing the relationship of AI or machine learning to security or privacy, advocating for new perspectives, or providing a critical look at prior research.
• Systematization-of-knowledge papers, which should distill the AI or machine learning contributions of a previously-published series of security papers.
• [NEW] Benchmark papers proposing a new benchmark in the context of AI/ML and security/privacy. (Note: artifact sharing at submission time is required for papers in this category. We also encourage authors to clearly articulate what the artifact contains to facilitate reviewing.)

The authors can specify the paper type in the submission form. We encourage authors to share their artifacts at submission time by providing a link to an (anonymous) repository. We also endorse authors to reflect on the ethical implications of their research, which can be discussed in the paper in a dedicated section or paragraph.

Papers not following the following guidelines will be desk-rejected. Submissions must be in English and properly anonymized. Ensure that there is no way to identify authors, including, e.g., when linking code repositories (consider using anonymous.4open.science), when referencing prior work of the same authors, or in the header of the pages. Submitted papers must be at most 10 pages long in double-column ACM format---excluding bibliography and well-marked appendices, for which up to two additional pages can be used (hence, the paper's overall length must be of 12 pages at most). Committee members are not required to read appendices, so the paper should be intelligible without them. Papers must be submitted as PDF files, and must strictly comply with the ACM format. We point the authors to the main ACM CCS'26 formatting instructions (except with page limits as described above), which can be found here. Benchmark papers without a valid (and functional) link to a resource containing the benchmark will be rejected. Submitted papers must also comply with the "Use of Generative AI" policy described below. Accepted papers will be published in the ACM Digital Library and/or ACM Press.
NOTE: if, when submitting your paper on HotCRP, you get a warning stating that "Too many pages: the limit is 12 pages, found 13", this is OK -- as long as the 13th page contains ONLY the "Generative AI paragraph"

One author of each accepted paper is required to attend the workshop and present the paper for it to be included in the proceedings. All accepted submissions will be presented at the workshop as posters. A fraction of accepted papers will be selected for presentation as spotlights based on their potential impact and significance to the AISec community. Nonetheless, all accepted papers should be considered as having equal importance and will be included in the ACM workshop proceedings.

Use of Generative AI [NEW]

All submissions must have an explicit paragraph (which does not count towards the page limit, and to be put after the references/appendices) declaring whether, and the extent of, Generative AI tools (such as LLMs) have been used in the making of the research paper. This means that even if no AI tools have been used, it should be explicitly stated (e.g., by writing "No AI tools have been used for carrying out this research"). Regardless, using AI tools for research activities (e.g., developing experimental source code, generating new data, or as writing assistants) is allowed, but it must follow the official ACM policies (described here).
At the same time, we will also require all reviewers to explicitly declare if Generative AI tools (such as LLMs) have been used in the reviewing process. We expect reviewers to act responsibly, and in ways that comply with the official ACM policies in this regard. For instance, sharing any part of a paper with some AI tools may break the confidentiality of the peer review.

For any questions, feel free to contact the workshop organizers!