Nils Lukas
Assistant Professor • MBZUAI • Abu Dhabi, UAE
nils.lukas@mbzuai.ac.ae • nilslukas.github.io • Google Scholar
Updated on July 26, 2026
Research Interests
Design secure and private AI agents in the presence of untrustworthy providers, data, models, and users.
  1. Providers: Confidential computing & encrypted inference.
  2. Data: Poisoning, prompt injection & training-data privacy.
  3. Models: Scalable oversight & differentially private inference.
  4. Users: Detect misuse via watermarking & safety monitoring.
Research Grants
Awarded$1,458,000
United Al-Saqer Group MedBoard: Privacy-preserving Multi-Agent AI for Healthcare
$136,000 · 2026
PI: Nils Lukas · Co-PIs: Praneeth Vepakomma, Preslav Nakov
IAAI Research Program Trust Layer for Safe Smallholder Advisory
$500,000 · 2026
PI: Salem Lahlou · Co-PIs: Nils Lukas, Martin Takáč
Amazon Research Awards – Special Call AdvSim2Real: Robustifying Agents in Simulated Adversarial Environments
$100,000 · 2025
PI: Nils Lukas · Co-PI: Praneeth Vepakomma
Etihad Airways Conversational Booking Agents
$450,000 · 2025
PI: Nils Lukas · Co-PIs: Salem Lahlou, Alham Fikri Aji, Martin Takáč, Mingming Gong
United Al-Saqer Group Privacy-preserving Brain–Computer Interfaces
$136,000 · 2025
PI: Abdulrahman Mahmoud · Co-PIs: Nils Lukas, Elizabeth Churchill
TII Funding GFlowNets for Fuzzing of Agentic Applications
$136,000 · 2025
PIs: Salem Lahlou & Nils Lukas
Conference Publications
Underlined authors are students and postdocs I supervise as primary advisor.
[ECCV'26]
SPQR: A Multi-Dimensional Benchmark for Safety Alignment under Benign Model Adaptation
Mohammed Talha Alam, Nada Saadi, Fahad Shamshad, Nils Lukas, Karthik Nandakumar, Fakhri Karray, Samuele Poppi. European Conference on Computer Vision, 2026.
[CVPR'26]
AR: 25.4% (4,090/16,092)
🏆 Oral (top 0.8%)
RAVEN: Erasing Invisible Watermarks via Novel View Synthesis
Fahad Shamshad, Nils Lukas, Karthik Nandakumar. IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2026.
[ICML'26]
AR: 26.6% (6,352/23,918)
Collaborative Threshold Watermarking
Tameem Bakr, Anish Ambreth, Nils Lukas. The Forty-Third International Conference on Machine Learning, 2026.
[ICML'26]
AR: 26.6% (6,352/23,918)
CoRe: Collaborative Reasoning via Cross Teaching
Kshitij Mishra, Mirat Aubakirov, Martin Takáč, Nils Lukas, Salem Lahlou. The Forty-Third International Conference on Machine Learning, 2026.
[ACL'26]
Main Conference
AR: 18.9% (2,296/12,148)
Forest Before Trees: Latent Superposition for Efficient Visual Reasoning
Yubo Wang, Juntian Zhang, Yichen Wu, Yankai Lin, Nils Lukas, Yuhan Liu. The 64th Annual Meeting of the Association for Computational Linguistics, 2026.
[ACL'26]
Findings
AR: 17.8% (2,163/12,148)
Detecting AI-Generated Video: A Vision-Language Dual-View Survey
Dylan Xinming Hou, Juntian Zhang, Xu Gu, Yichen Wu, Nils Lukas, Gus Xia, Xiuying Chen, Yuhan Liu. Findings of the Association for Computational Linguistics, 2026.
[ICLR'26]
AR: 27.4% (5,355/19,525)
DP-Fusion: Token-Level Differentially Private Inference for Large Language Models
Rushil Thareja, Preslav Nakov, Praneeth Vepakomma, Nils Lukas. The Fourteenth International Conference on Learning Representations, 2026.
[EACL'26]
Findings
SD-E²: Semantic Exploration for Reasoning Under Token Budgets
Kshitij Mishra, Nils Lukas, Salem Lahlou. Findings of the European Chapter of the Association for Computational Linguistics, 2026.
[NeurIPS'25]
AR: 24.5% (5,290/21,575)
Mask Image Watermarking
Runyi Hu, Jie Zhang, Shiqian Zhao, Nils Lukas, Jiwei Li, Qing Guo, Han Qiu, Tianwei Zhang. The Thirty-Ninth Annual Conference on Neural Information Processing Systems, 2025.
[EMNLP'25]
AR: 22.2% (1,811/8,172)
SPIRIT: Patching Speech Language Models against Jailbreak Attacks
Amir Djanibekov, Nurdaulet Mukhituly, Kentaro Inui, Hanan Aldarmaki, Nils Lukas. Empirical Methods in Natural Language Processing (Main Conference), 2025.
[ICML'25]
AR: 26.9% (3,260/12,107)
★ Spotlight (Top 2.6%)
Optimizing Adaptive Attacks against Content Watermarks for Language Models
Abdulrahman Diaa, Toluwani Aremu, Nils Lukas. The Forty-Second International Conference on Machine Learning, 2025.
[ICML'25]
AR: 26.9% (3,260/12,107)
Cowpox: Towards the Immunity of VLM-based Multi-Agent Systems
Yutong Wu, Jie Zhang, Yiming Li, Chao Zhang, Qing Guo, Han Qiu, Nils Lukas, Tianwei Zhang. The Forty-Second International Conference on Machine Learning, 2025.
[USENIX'24]
AR: 19.1% (417/2,176)
PEPSI: Practically Efficient Private Set Intersection in the Unbalanced Setting
Rasoul Mahdavi, Nils Lukas, Faezeh Ebrahimianghazani, Thomas Humphries, Bailey Kacsmar, John Premkumar, Xinda Li, Simon Oya, Ehsan Amjadian, Florian Kerschbaum. In the 33rd USENIX Security Symposium, 2024.
[USENIX'24]
AR: 19.1% (417/2,176)
Fast and Private Inference of Deep Neural Networks by Co-designing Activation Functions
Abdulrahman Diaa, Lucas Fenaux, Thomas Humphries, Marian Dietz, Faezeh Ebrahimianghazani, Bailey Kacsmar, Xinda Li, Nils Lukas, Rasoul Akhavan Mahdavi, Simon Oya, Ehsan Amjadian, Florian Kerschbaum. In the 33rd USENIX Security Symposium, 2024.
[ICLR'24]
AR: 30.8% (2,250/7,262)
Leveraging Optimization for Adaptive Attacks on Image Watermarks
Nils Lukas, Abdulrahman Diaa, Lucas Fenaux, Florian Kerschbaum. In the Twelfth International Conference on Learning Representations, 2024.
[ICLR'24]
AR: 30.8% (2,250/7,262)
◉ Media Coverage
Universal Backdoor Attacks
Benjamin Schneider, Nils Lukas, Florian Kerschbaum. In the Twelfth International Conference on Learning Representations, 2024.
[USENIX'23]
AR: 29.2% (422/1,444)
PTW: Pivotal Tuning Watermarking for Pre-Trained Image Generators
Nils Lukas and Florian Kerschbaum. In the 32nd USENIX Security Symposium, 2023.
[S&P'23]
AR: 17.0% (195/1,147)
★ Distinguished Contribution Award at Microsoft MLADS
Analyzing Leakage of Personally Identifiable Information in Language Models
Nils Lukas, Ahmed Salem, Robert Sim, Shruti Tople, Lukas Wutschitz, Santiago Zanella-Béguelin. In the 44th IEEE Symposium on Security and Privacy, 2023.
[S&P'22]
AR: 14.5% (147/1,012)
SoK: How Robust is Image Classification Deep Neural Network Watermarking?
Nils Lukas, Edward Jiang, Xinda Li, Florian Kerschbaum. In the 43rd IEEE Symposium on Security and Privacy, 2022.
[ICLR'21]
AR: 28.7% (860/2,997)
★ Spotlight (Top 5%)
Deep Neural Network Fingerprinting by Conferrable Adversarial Examples
Nils Lukas, Yuxuan Zhang, Florian Kerschbaum. The Ninth International Conference on Learning Representations, 2021.
[IH&MMSEC'21]
AR: 40.3% (128/318)
On the Robustness of Backdoor-based Watermarking in Deep Neural Networks
Masoumeh Shafieinejad, Nils Lukas, Jiaqi Wang, Xinda Li, Florian Kerschbaum. Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security, 2021.
[ACSAC'20]
AR: 20.9% (104/497)
Practical Over-Threshold Multi-Party Private Set Intersection
Rasoul Mahdavi, Thomas Humphries, Bailey Kacsmar, Simeon Krastnikov, Nils Lukas, John Premkumar, Masoumeh Shafieinejad, Simon Oya, Florian Kerschbaum, Erik-Oliver Blass. Annual Computer Security Applications Conference (ACSAC), 2020.
[EuroS&P'20]
AR: 20.9% (39/187)
Differentially Private Two-Party Set Operations
Bailey Kacsmar, Basit Khurram, Nils Lukas, Alexander Norton, Masoumeh Shafieinejad, Zhiwei Shang, Yaser Baseri, Maryam Sepehri, Simon Oya, Florian Kerschbaum. IEEE European Symposium on Security and Privacy (EuroS&P), 2020.
PostDocs, Students
Postdoctoral Researchers
Research Engineers
PhD Students
MSc Students
Alumni
  • Tameem Bakr (ML)MSc · Mar 2026
  • Shaikha Jasem Mohamed Ismail Alhosani (ML)MSc · Mar 2026
  • Maryam Abdulla Rashed Abdulla Alshamsi (ML)MSc · Mar 2026
  • Maryam Alshehyari (ML)MSc · Mar 2026
  • Abdalla Khalid Mohamed Abdalla Alzaabi (ML)MSc · Mar 2026
  • Ali Al-Ali (ML)MSc · Mar 2026
Talks & Keynotes
AI Safety Workshop: Alignment, Oversight and Deception
The Role of Watermarking for ML Security
  • CyberQ, UAE Cyber Security Council & TII, Abu Dhabi2025
Adaptively Robust and Forgery-Resistant Watermarking
  • Meta (FAIR), hosted by Hady Elsahar2025
  • International Symposium on Trustworthy Foundation Models, MBZUAI2025
Emerging Topics in Machine Learning
Optimizing Adaptive Attacks against Content Watermarks
Analyzing Leakage of Personal Information in Language Models
How Reliable is Watermarking for Image Generators?
Keynotes
  • Aviation Future Week, hosted by Emirates, Dubai2024
  • Cyber Energy Leadership Forum, Abu Dhabi2024
Honors & Awards
Amazon Research Award [100,000 USD]2025
First Place at the NeurIPS'24 Watermarking Competition [4,400 USD]2024
First Place at DGE Elite Hackathon, GITEX'24 [10,900 USD]2024
Top Mathematics Doctoral Thesis, University of Waterloo [1,080 USD]2024
Alumni Gold Medal, One PhD Award Yearly, University of Waterloo2024
Best Poster Award, Sponsored by David R. Cheriton [220 USD]2023
Distinguished Contribution Award, Microsoft MLADS conference2023
David R. Cheriton Scholarship, University of Waterloo [14,400 USD]2022, 2023
Outstanding Reviewer, ICML'222022
Best Poster Award, Sponsored by Rogers [720 USD]2019
Workshop Papers
[GenAI4Health]
Sanitizing Medical Documents with Differential Privacy using Large Language Models
Rushil Thareja, Gautam Gupta, Preslav Nakov, Praneeth Vepakomma, Nils Lukas. 2025.
[WMARK'25]
First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challenge
Fahad Shamshad, Tameem Bakr, Yahia Salaheldin Shaaban, Noor Hazim Hussein, Karthik Nandakumar and Nils Lukas. The 1st Workshop on GenAI Watermarking, 2025.
[WMARK'25]
★ Oral Presentation
Optimizing Adaptive Attacks against Content Watermarks for Language Models
Abdulrahman Diaa, Toluwani Aremu, Nils Lukas. The 1st Workshop on GenAI Watermarking, 2025.
Working Papers
Mitigating Watermark Forgery in Generative Models via Randomized Key Selection, Submitted.
Toluwani Aremu, Noor Hazim Hussein, Munachiso S Nwadike, Samuele Poppi, Jie Zhang, Karthik Nandakumar, Neil Zhenqiang Gong, Nils Lukas. 2025.
Robust and Calibrated Detection of Authentic Multimedia Content, Submitted.
Sarim Hashmi, Abdelrahman Elsayed, Mohammed Talha Alam, Samuele Poppi, Nils Lukas. 2025.
Journal Publications
[IEEE S&P'23]
Privacy-Preserving Machine Learning [Cryptography]
Florian Kerschbaum, Nils Lukas. IEEE Security & Privacy, Volume 21, Issue 6, 2023.
[AIP'18]
SunFlower: A new Solar Tower Simulation Method for use in Field Layout Optimization
Pascal Richter, Gregor Heiming, Nils Lukas, Martin Frank. AIP Conference Proceedings, Volume 2033, Issue 1, 2018.
Service
Area Chair
  • AAAI Conference on Artificial Intelligence (AAAI), Senior Program Committee2027
  • Neural Information Processing Systems (NeurIPS)2026
  • International Conference on Learning Representations (ICLR)2026
  • International Conference on Machine Learning (ICML)2026
Program Committee
  • ACM Conference on Computer and Communications Security (CCS)2025
  • IEEE Symposium on Security and Privacy (IEEE S&P)2025–2027
  • Recent Advances in Intrusion Detection (RAID)2024
Artifact Evaluation Committee
  • The ACM Conference on Computer and Communications Security (CCS)2023, 2024
Reviewer
  • European Conference on Computer Vision (ECCV)2026
  • Conference on Language Modeling (COLM)2026
  • British Machine Vision Conference (BMVC)2026
  • FAGEN Workshop @ ICML2026
  • Workshop on GenAI Watermarking (WMark @ ICLR)2025
  • NETYS2025
  • ACM TheWebConf (WWW)2025
  • International Conference on Learning Representations (ICLR)2024, 2025
  • International World Wide Web Conference (TheWebConf)2024
  • Recent Advances in Intrusion Detection (RAID)2023
  • Neural Information Processing Systems (NeurIPS)2022, 2023
  • International Conference on Machine Learning (ICML)2022, 2025
  • The Conference on Information and Knowledge Management (CIKM)2020
Journal Reviewer
  • Communications of the ACM (CACM)2025
Other
  • External Examiner, PhD Dissertation, CISPA Helmholtz Center for Information Security2026
  • Faculty Search Committee, Machine Learning Department at MBZUAI2025–2026
  • Chair for the invited faculty talk program, International Symposium on Trustworthy Foundation Models at MBZUAI2025
  • Admission's Committee, MBZUAI Machine Learning Department2025
  • Student Board Member, Cybersecurity and Privacy Institute2022–2024
  • Session Chair, IEEE Symposium on Security and Privacy (S&P)2023
  • Sub-Reviewer, Proceedings on Privacy Enhancing Technologies (PETS)2021–2023
  • School Advisory Committee on Appointments Liaison, CrySP Lab2022
  • Organization, Workshop on Semantic Web Solutions for Large-Scale Biomedical Data Analytics (SeWeBMeDA)2018
Teaching
Instructor, MBZUAI, UAE
  • ML8502: Machine Learning Security (14 weeks)2025, 2026
  • ML8509: Collaborative Machine Learning (w/ S. Horvath)2026
  • ML807: Federated Learning (7 weeks)2025
  • ML818: Emerging Topics in Trustworthy Machine Learning (4 weeks)2024
Teaching Assistant, University of Waterloo, Canada
  • CS458/658: Computer Security and Privacy2020, 2021
  • CS246 – Object Oriented Programming2021
Co-Instructor, RWTH-Aachen, Germany
  • Course: Data-driven Medicine2018
Education
University of Waterloo, Canada2019 – 02/2024
Ph.D. in Computer Science
RWTH-Aachen, Germany
M.Sc. in Computer Science (w/Distinction)2016 – 2018
B.Sc. in Computer Science10/2012 – 2016
Work Experience
Assistant Professor, MBZUAI, Abu Dhabi, UAEsince 08/2024
Research Intern, Royal Bank of Canada, Borealis AI, Toronto2024
Research Intern, Microsoft Research, Cambridge, UK2022
Research Assistant, RWTH-Aachen, Aachen2014 – 2018
Student Researcher, DSA Daten- und Systemtechnik GmbH, Aachen2016
Software Engineer Intern, A.R. Bayer DSP Systeme GmbH, Düsseldorf2012