Project lead, main contributor, correspondence to alexandre.rame@isir.upmc.fr. Equal experimental contribution, order determined at random. Further information and resources related to this project can be found on this website.

Based on this, we propose a novel approach, Diffusion-DICE, that directly performs this transformation using diffusion models.

In a backdoor attack, an adversary injects corrupted data into a model's training dataset in order to gain control over its predictions on images with a specific attacker-defined trigger. A typical corrupted training example requires altering both the image, by applying the trigger, and the label. Models trained on clean images, therefore, were considered safe from backdoor attacks. However, in some common machine learning scenarios, the training labels are provided by potentially malicious third-parties. This includes crowd-sourced annotation and knowledge distillation. We, hence, investigate a fundamental question: can we launch a successful backdoor attack by only corrupting labels?

Inside the Colosseum's Passage of Commodus, where emperors once walked One theory suggests the infamous Roman emperor survived an assassination attempt in the tunnel now open to the public. From October 2024 to September 2025, a team of experts restored part of the tunnel that's open to visitors for the first time. Breakthroughs, discoveries, and DIY tips sent six days a week. They say all roads lead to Rome . But in the Eternal City, all of the major roads were thought to lead somewhere very specific--a single column called the Milliarium Auereum, or the golden milestone.

Figure 1: R-Blur adds Gaussian noise to image (a) with the fixation point (red dot) to obtain (b).

Until now, no tabular method has consistently outperformed classical supervised learning, which ignores these shifts.

Transformers learn to approximate second-order optimization methods for ICL.

We believe that our work can deepen the understanding and methodology of MIAs in the context of VLLMs.