Call for Papers
CfP poster (PDF)LLMs and AI agents now browse the web, write and run code, read our email and act with our credentials. Every new capability is also a new attack surface: a poisoned web page, document or memory entry can hijack an agent; a jailbreak can turn a model against its own guardrails; a single manipulated output can become a tool call, a data leak or a code execution. As these systems move into deployment, one question becomes pressing: how do we know whether an LLM or agent is secure enough?
STALA focuses on security testing and assurance for LLMs and agents: finding vulnerabilities systematically, evaluating defenses rigorously, and turning the resulting evidence into security claims that can be trusted. Attack and defense papers are central to this. Every successful attack is a test the system failed, and every defense is a security claim that needs evidence. We welcome them alongside work on how to explore the attack space, what has actually been tested, and what assurance the results support as models, prompts and tools change.
Topics include, but are not limited to:
Discovering vulnerabilities
- Jailbreak and prompt-injection attacks, direct and indirect
- Agent hijacking via tools, APIs and MCP
- RAG, memory and context poisoning
- Training-data poisoning and backdoors
- Privacy leakage, training-data and system-prompt extraction
- Multi-agent and delegation attacks
- Insecure code generation and vibe coding
- AI-on-hardware and side-channel attacks
Evaluating defenses
- Adaptive-attack evaluation of guardrails, filters and prompt-injection defenses
- Validating sandboxing, permissions and access control for agents
- Runtime monitoring, detection and containment of unsafe actions
- Measuring security–utility trade-offs of defenses
- Robustness of safety alignment under adversarial pressure
- Detection of poisoned data and backdoored models
- Testing information-flow control in agent architectures
Testing & coverage
- Security fuzzing and search-based testing
- Automated red teaming and adversarial test generation
- Long-horizon and stateful agent evaluation
- Test oracles, differential and metamorphic testing
- Coverage of prompt, attack and behavior spaces
- Coverage of agent states, trajectories and tool use
- Internal neuron, circuit, expert and routing coverage
- Benchmarks, testbeds and contamination
Assurance
- Test adequacy, diversity and stopping criteria
- Failure-discovery rates and residual-risk estimation
- Confidence and calibration of security evidence
- Probabilistic assurance and evidence aggregation
- Combining testing with formal verification
- Compositional assurance for agentic systems
- Regression, transfer and continuous assurance
- Quantitative deployment and release criteria
Paper categories
- Full papers: up to 8 pages, excluding references.
- Short, position and experience papers: up to 4 pages, excluding references. Early results, new attack ideas, benchmarks and datasets, experience reports, negative results and technically grounded positions. Negative results are particularly welcome when they show that an intuitive metric, benchmark or security claim is misleading.
Review criteria
- Each paper will receive two to three independent reviews, followed by PC discussion for borderline or divergent cases.
- Reviewers look for a clear threat model and a convincing evaluation: attacks should show what generalizes beyond the cases tested, and defenses should be evaluated against adaptive attackers.
- Novelty can lie in the evaluation itself: a paper need not introduce a new vulnerability if it materially improves how failures are found, measured or interpreted.
- Release of code, data and other artifacts is strongly encouraged.
Submission format
- Template: papers must be submitted as PDF using the NDSS 2027 templates: US letter size (not A4), two-column layout with columns no more than 9.25 in. high and 3.5 in. wide, Times font of 10 pt or larger with 11 pt or larger line spacing.
- Anonymity: the review process is double-blind. Submissions must not include author names or affiliations, and authors should cite their own prior work in the third person.
- Originality: submissions must not substantially overlap with papers already published or simultaneously submitted to a journal, conference or workshop.
- Policies: submissions must follow the NDSS 2027 policies, including disclosure of generative AI use and treatment of ethical considerations.
- Submission site: Opens soon
Publication and presentation
Accepted papers will be published by the Internet Society in the NDSS Symposium 2027 co-located workshop proceedings, before the workshop. At least one author of each accepted paper must register for the workshop and present the paper.
Important Dates
- 11 December 2026Paper submission deadline
- 1 February 2027Author notification
- 19 February 2027Camera-ready due
- 22 March 2027Workshop
All deadlines are 23:59 Anywhere on Earth (UTC−12).
Program
Tentative; the final program will be published by 26 February 2027.
| 09:00–09:15 | Opening: the test-to-assurance problem |
| 09:15–10:00 | Keynote I Ahmad-Reza Sadeghi TU Darmstadt |
| 10:00–10:30 | Coffee break |
| 10:30–12:00 | Session I Adaptive testing, fuzzing, red teaming and agent exploration |
| 12:00–13:30 | Lunch break |
| 13:30–14:15 | Keynote II Masashi Sugiyama RIKEN AIP / The University of Tokyo |
| 14:15–14:30 | Coffee break |
| 14:30–16:00 | Session II Coverage, test adequacy and quantitative assurance |
| 16:00–16:50 | Panel “When have we tested enough to deploy?” |
| 16:50–17:05 | Paper awards |
| 17:05–17:20 | Closing synthesis and research agenda |
Committee
Organizing committee
Lichao Wu
Wenkai Xu
Stjepan Picek
Alexandra Dmitrienko
Nan Lu
Program committee
To be announced
Attend
Register for the workshop through the NDSS Symposium 2027 website.