Thorsten Eisenhofer
Tenure-track Faculty at CISPA
I lead the moosec research group at CISPA Helmholtz Center for Information Security in Saarbrücken, where I am a tenure-track faculty member.
I work on adversarial machine learning and systems security. I study how AI systems can be attacked and protected, from the software and hardware that run models to agents that act on our behalf. I am interested in defenses that protect the system even when the model itself is vulnerable. I also explore how AI can help us analyze software and improve security tools.
Before joining CISPA, I was a postdoctoral researcher with Konrad Rieck at BIFOLD & TU Berlin. I received my PhD from Ruhr University Bochum, advised by Thorsten Holz.
Publications
2027
IEEE/CVF Winter Conference on Applications of Computer Vision (WACV)
@inproceedings{huzaifa-27-wise, title = {{WISE-ATTA: When to Ask for Labels in Budgeted Active Test-Time Adaptation}}, author = {Huzaifa, Muhammad and Sch{\"o}nherr, Lea and Eisenhofer, Thorsten}, booktitle = {IEEE/CVF Winter Conference on Applications of Computer Vision (WACV)}, year = {2027} }2026
NeurIPS Evaluations and Datasets Track
@inproceedings{mavali-26-task, title = {{No More, No Less: Task Alignment in Terminal Agents}}, author = {Mavali, Sina and Pape, David and Evertz, Jonathan and Abedini, Samira and Srivastav, Devansh and Eisenhofer, Thorsten and Abdelnabi, Sahar and Sch{\"o}nherr, Lea}, booktitle = {NeurIPS Evaluations and Datasets Track}, year = {2026} }Network and Distributed System Security Symposium (NDSS)
@inproceedings{evertz-26-chasing, title = {{Chasing Shadows: Pitfalls in LLM Security Research}}, author = {Evertz, Jonathan and Risse, Niklas and Neuer, Nicolai and M{\"u}ller, Andreas and Normann, Philipp and Sapia, Gaetano and Gupta, Srishti and Pape, David and Shaw, Soumya and Srivastav, Devansh and Wressnegger, Christian and Quiring, Erwin and Eisenhofer, Thorsten and Arp, Daniel and Sch{\"o}nherr, Lea}, booktitle = {Network and Distributed System Security Symposium (NDSS)}, year = {2026} }IEEE/ACM International Conference on Software Engineering (ICSE)
@inproceedings{weissberg-26-llm, title = {{LLM-based Vulnerability Discovery through the Lens of Code Metrics}}, author = {Weissberg, Felix and Pirch, Lukas and Imgrund, Erik and M{\"o}ller, Jonas and Eisenhofer, Thorsten and Rieck, Konrad}, booktitle = {IEEE/ACM International Conference on Software Engineering (ICSE)}, year = {2026} }Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA)
@inproceedings{evertz-26-whispers, title = {{Whispers in the Machine: Confidentiality in Agentic Systems}}, author = {Evertz, Jonathan and Chlosta, Merlin and Sch{\"o}nherr, Lea and Eisenhofer, Thorsten}, booktitle = {Detection of Intrusions and Malware \& Vulnerability Assessment (DIMVA)}, year = {2026} }ACM Asia Conference on Computer and Communications Security (ASIACCS)
@inproceedings{fard-26-shape, title = {{Shape-Shifting Malicious Code in Software Backdoors via Language Models}}, author = {Fard, Mohammad Ebrahimi and Weissberg, Felix and Imgrund, Erik and Eisenhofer, Thorsten and Rieck, Konrad}, booktitle = {ACM Asia Conference on Computer and Communications Security (ASIACCS)}, year = {2026} }ACM Workshop on Artificial Intelligence and Security (AISec) Spotlight Paper
@inproceedings{hanfeld-26-controlling, title = {{Controlling Autonomous Vehicles using Continuous Adversarial Patches}}, author = {Hanfeld, Pia and Imgrund, Erik and Weissberg, Felix and Eisenhofer, Thorsten and H{\"o}nig, Wolfgang and Rieck, Konrad}, booktitle = {ACM Workshop on Artificial Intelligence and Security (AISec)}, year = {2026} }ACM Workshop on Artificial Intelligence and Security (AISec)
@inproceedings{stuelpnagel-26-data, title = {{Data Augmentation in Learning-Based Binary Code Analysis}}, author = {von St{\"u}lpnagel, Lennart and Weissberg, Felix and M{\"o}ller, Jonas and Greb, Benjamin and Eisenhofer, Thorsten and Rieck, Konrad}, booktitle = {ACM Workshop on Artificial Intelligence and Security (AISec)}, year = {2026} }Computing Research Repository (CoRR)
@misc{huzaifa-26-safety, title = {{Safety of Latent Communication in Multi-Agent Systems}}, author = {Huzaifa, Muhammad and Mavali, Sina and Eisenhofer, Thorsten}, howpublished = {Computing Research Repository (CoRR)}, year = {2026}, url = {https://arxiv.org/abs/2609.39788} }Computing Research Repository (CoRR)
@misc{moeller-26-hardware, title = {{Hardware-Triggered Backdoors}}, author = {M{\"o}ller, Jonas and Imgrund, Erik and Eisenhofer, Thorsten and Rieck, Konrad}, howpublished = {Computing Research Repository (CoRR)}, year = {2026}, url = {https://arxiv.org/abs/2601.21902} }2025
ACM Conference on Computer and Communications Security (CCS) Distinguished Paper Award
@inproceedings{imgrund-25-adversarial, title = {{Adversarial Observations in Weather Forecasting}}, author = {Imgrund, Erik and Eisenhofer, Thorsten and Rieck, Konrad}, booktitle = {ACM Conference on Computer and Communications Security (CCS)}, year = {2025} }International Conference on Machine Learning (ICML)
@inproceedings{moeller-25-adversarial, title = {{Adversarial Inputs for Linear Algebra Backends}}, author = {M{\"o}ller, Jonas and Pirch, Lukas and Weissberg, Felix and Baunsgaard, Sebastian and Eisenhofer, Thorsten and Rieck, Konrad}, booktitle = {International Conference on Machine Learning (ICML)}, year = {2025} }USENIX Security Symposium
@inproceedings{weissberg-25-seeing, title = {{Seeing Through: Analyzing and Attacking Virtual Backgrounds in Video Calls}}, author = {Weissberg, Felix and Hilgefort, Jan Malte and Grogorick, Steve and Arp, Daniel and Eisenhofer, Thorsten and Eisemann, Martin and Rieck, Konrad}, booktitle = {USENIX Security Symposium}, year = {2025} }USENIX Security Symposium
@inproceedings{pape-25-prompt, title = {{Prompt Obfuscation for Large Language Models}}, author = {Pape, David and Mavali, Sina and Eisenhofer, Thorsten and Sch{\"o}nherr, Lea}, booktitle = {USENIX Security Symposium}, year = {2025} }IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)
@inproceedings{eisenhofer-25-verifiable, title = {{Verifiable and Provably Secure Machine Unlearning}}, author = {Eisenhofer, Thorsten and Riepel, Doreen and Chandrasekaran, Varun and Ghosh, Esha and Ohrimenko, Olga and Papernot, Nicolas}, booktitle = {IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)}, year = {2025} }Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA)
@inproceedings{beste-25-exploring, title = {{Exploring the Potential of LLMs for Code Deobfuscation}}, author = {Beste, David and Menguy, Gr{\'e}goire and Hajipour, Hossein and Fritz, Mario and Cin{\`a}, Antonio Emanuele and Bardin, S{\'e}bastien and Holz, Thorsten and Eisenhofer, Thorsten and Sch{\"o}nherr, Lea}, booktitle = {Detection of Intrusions and Malware \& Vulnerability Assessment (DIMVA)}, year = {2025} }Transactions on Machine Learning Research (TMLR)
@article{schuster-25-learned, title = {{Learned-Database Systems Security}}, author = {Schuster, Roei and Zhou, Jin Peng and Eisenhofer, Thorsten and Grubbs, Paul and Papernot, Nicolas}, journal = {Transactions on Machine Learning Research (TMLR)}, year = {2025} }2024
IEEE Symposium on Security and Privacy (S&P)
@inproceedings{frank-24-study, title = {{A Representative Study on Human Detection of Artificially Generated Media Across Countries}}, author = {Frank, Joel and Herbert, Franziska and Ricker, Jonas and Sch{\"o}nherr, Lea and Eisenhofer, Thorsten and Fischer, Asja and D{\"u}rmuth, Markus and Holz, Thorsten}, booktitle = {IEEE Symposium on Security and Privacy (S\&P)}, year = {2024} }ACM Asia Conference on Computer and Communications Security (ASIACCS)
@inproceedings{weissberg-24-where, title = {{SoK: Where to Fuzz? Assessing Target Selection Methods in Directed Fuzzing}}, author = {Weissberg, Felix and M{\"o}ller, Jonas and Ganz, Tom and Imgrund, Erik and Pirch, Lukas and Seidel, Lukas and Schloegel, Moritz and Eisenhofer, Thorsten and Rieck, Konrad}, booktitle = {ACM Asia Conference on Computer and Communications Security (ASIACCS)}, year = {2024} }ACM Asia Conference on Computer and Communications Security (ASIACCS)
@inproceedings{moeller-24-cross, title = {{Cross-Language Differential Testing of JSON Parsers}}, author = {M{\"o}ller, Jonas and Weissberg, Felix and Pirch, Lukas and Eisenhofer, Thorsten and Rieck, Konrad}, booktitle = {ACM Asia Conference on Computer and Communications Security (ASIACCS)}, year = {2024} }2023
Dissertation Award for Outstanding Doctoral Achievement
@phdthesis{eisenhofer-23-dissertation, title = {{Security of Machine Learning Systems}}, author = {Eisenhofer, Thorsten}, school = {Ruhr University Bochum}, year = {2023} }USENIX Security Symposium
@inproceedings{eisenhofer-23-subverting, title = {{No more Reviewer \#2: Subverting Automatic Paper-Reviewer Assignment using Adversarial Learning}}, author = {Eisenhofer, Thorsten and Quiring, Erwin and M{\"o}ller, Jonas and Riepel, Doreen and Holz, Thorsten and Rieck, Konrad}, booktitle = {USENIX Security Symposium}, year = {2023} }IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)
@inproceedings{aghakhani-23-venomave, title = {{VenoMave: Targeted Poisoning Against Speech Recognition}}, author = {Aghakhani, Hojjat and Sch{\"o}nherr, Lea and Eisenhofer, Thorsten and Kolossa, Dorothea and Holz, Thorsten and Kruegel, Christopher and Vigna, Giovanni}, booktitle = {IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)}, year = {2023} }Network and Distributed System Security Symposium (NDSS)
@inproceedings{schiller-23-dronesecurity, title = {{Drone Security and the Mysterious Case of DJI's DroneID}}, author = {Schiller, Nico and Chlosta, Merlin and Schloegel, Moritz and Bars, Nils and Eisenhofer, Thorsten and Scharnowski, Tobias and Domke, Felix and Sch{\"o}nherr, Lea and Holz, Thorsten}, booktitle = {Network and Distributed System Security Symposium (NDSS)}, year = {2023} }European Symposium on Artificial Neural Networks, Computational Intelligence and Machine Learning (ESANN)
@inproceedings{pape-23-model, title = {{On the Limitations of Model Stealing with Uncertainty Quantification Models}}, author = {Pape, David and D{\"a}ubener, Sina and Eisenhofer, Thorsten and Cin{\`a}, Antonio Emanuele and Sch{\"o}nherr, Lea}, booktitle = {European Symposium on Artificial Neural Networks, Computational Intelligence and Machine Learning (ESANN)}, year = {2023} }2022
Annual International Cryptology Conference (CRYPTO)
@inproceedings{abdalla-22-pake, title = {{Password-Authenticated Key Exchange from Group Actions}}, author = {Abdalla, Michel and Eisenhofer, Thorsten and Kiltz, Eike and Kunzweiler, Sabrina and Riepel, Doreen}, booktitle = {Annual International Cryptology Conference (CRYPTO)}, year = {2022} }Computer Speech & Language (CSL)
@article{schoenherr-22-accidental, title = {{Exploring Accidental Triggers of Smart Speakers}}, author = {Sch{\"o}nherr, Lea and Golla, Maximilian and Eisenhofer, Thorsten and Wiele, Jan and Kolossa, Dorothea and Holz, Thorsten}, journal = {Computer Speech \& Language (CSL)}, year = {2022} }2021
USENIX Security Symposium
@inproceedings{eisenhofer-21-dompteur, title = {{Dompteur: Taming Audio Adversarial Examples}}, author = {Eisenhofer, Thorsten and Sch{\"o}nherr, Lea and Frank, Joel and Speckemeier, Lars and Kolossa, Dorothea and Holz, Thorsten}, booktitle = {USENIX Security Symposium}, year = {2021} }2020
International Conference on Machine Learning (ICML)
@inproceedings{frank-20-frequency, title = {{Leveraging Frequency Analysis for Deep Fake Image Recognition}}, author = {Frank, Joel and Eisenhofer, Thorsten and Sch{\"o}nherr, Lea and Fischer, Asja and Kolossa, Dorothea and Holz, Thorsten}, booktitle = {International Conference on Machine Learning (ICML)}, year = {2020} }Annual Computer Security Applications Conference (ACSAC)
@inproceedings{schoenherr-20-imperio, title = {{Imperio: Robust Over-the-Air Adversarial Examples for Automatic Speech Recognition Systems}}, author = {Sch{\"o}nherr, Lea and Eisenhofer, Thorsten and Zeiler, Steffen and Holz, Thorsten and Kolossa, Dorothea}, booktitle = {Annual Computer Security Applications Conference (ACSAC)}, year = {2020} }Academic Service
Conference Organization
Program Committees
- 2025
- USENIX Security · RAID · SaTML · AISec Top Reviewer · WORMA
- 2022
- ICML · USENIX Security Artifact Evaluation Distinguished Reviewer
- 2020
- RuhrSec
Journal Reviewing
- 2026
- TAISAP
- 2025
- TOSEM · DTRAP
- 2024
- OJCO
Teaching
Instructor
Research Problems in Machine Learning and SecuritySaarland University · Master · Hands-on class · Summer 2026
Security and Privacy of AITU Berlin · Master · Seminar · Summer 2025
Reproducing AI Attacks and DefensesTU Berlin · Master · Hands-on class · Winter 2024/25
Privacy and Security in LearningTU Berlin · Master · Seminar · Summer 2024
Security Playground for Generative AgentsTU Berlin · Master · Hands-on class · Summer 2024
ML & Computer SecurityRuhr University Bochum · Master · Hands-on class · Winter 2021/22
ML & Computer SecurityRuhr University Bochum · Master · Hands-on class · Summer 2021
ML & Computer SecurityRuhr University Bochum · Master · Hands-on class · Winter 2020/21
Teaching Assistant
Machine Learning for Computer SecurityTU Berlin · Master · Lecture · Summer 2025
Adversarial Machine LearningTU Berlin · Master · Lecture · Winter 2024/25
Machine Learning for Computer SecurityTU Berlin · Master · Lecture · Summer 2024
System SecuritySaarland University · Bachelor · Lecture · Summer 2021
System SecurityRuhr University Bochum · Bachelor · Lecture · Summer 2020
Operating System SecurityRuhr University Bochum · Master · Lecture · Winter 2019/20
System SecurityRuhr University Bochum · Bachelor · Lecture · Summer 2019
Talks & Panels
2026
Adversarial Machine Learning: From Models to AgentsGuest lecture, “Machine Learning for Computer Security”, TU Wien
KI: Revolution für die InformationssicherheitKeynote, bwInfoSec Cybersicherheitstag, Heidelberg
Trustworthy Agentic SystemsLecture and hands-on session, BIFOLD Berlin Summer School of Artificial Intelligence and Society, Berlin
Trustworthy Agentic SystemsKeynote, Cyber Security Symposium Africa, University of Cape Town
Security of Machine Learning SystemsGuest lecture, “Machine Learning for Computer Security”, Reykjavik University
2025
Security of Machine Learning SystemsGuest lecture, “Machine Learning for Computer Security”, TU Wien
Verifiable and Provably Secure Machine UnlearningConference talk, SaTML, Copenhagen
Security of Machine Learning SystemsLecture, Spring school “SAIL”, Bielefeld University
2024
Security of Machine Learning SystemsKeynote, Winter school “WinterHack”, Ruhr University Bochum
Maschinelles Lernen in der IT-SicherheitLecture, Lecture series “KI und Informationssicherheit”, Heidelberg University
International Research EnvironmentsPanel discussion, Ruhr University Bochum
Machine Learning and SecurityLecture, Lecture series “Machine Learning in Science & Industry”, TU Berlin
2023
Subverting Automatic Paper-Reviewer AssignmentConference talk, USENIX Security
Security of Machine Learning SystemsDefense, Ruhr University Bochum
Communicating ResearchPanel discussion, Ruhr University Bochum
2021
Adversarially Robust Speech RecognitionSpotlight presentation, CASA Retreat
Taming Audio Adversarial ExamplesConference talk, USENIX Security
Press
2026
- Forscher zur KI-Entwicklung: Risiken ernst nehmen, aber nicht dramatisieren tagesschau.de
- Windpark - Nepal - KI Risiken WDR 5 Quarks
- BIFOLD Research Reveals a Blind Spot in Software Security BIFOLD
- Complexity has to pay off BIFOLD
- Cyberattacken in neuer Dynamik: sichtbare Sicherheitslücken Handelsblatt Journal
- Strategischer Technologieeinsatz: smart verzahnt Handelsblatt Journal
- ML-Modelle sind in der Praxis selten das direkte Ziel von Angriffen CISPA
2025
2024
- Warum Menschen KI-erstellte Inhalte häufig nicht mehr erkennen radioeins
- New Findings from AI Research: Humans Can Hardly Recognize AI-Generated Media Ruhr University Bochum
- KI: Großer Teil kann KI-Inhalte nicht erkennen und weiß nicht, was KI ist heise online
2023
- Security Researchers Find Vulnerabilities that Could Crash DJI Drones and Pinpoint Pilots Bitdefender
- NDSS: DroneID von DJI kann leicht durch Angreifer gekapert werden Caschys Blog
- DJI-Drohnen verraten Standort des Piloten Golem.de
- Security vulnerabilities detected in drones made by DJI Ruhr University Bochum
- This Hacker Tool Can Pinpoint a DJI Drone Operator's Exact Location WIRED
- Adversarial Papers: New attack fools AI-supported text analysis BIFOLD
2022
- Russische Angriffe auf ukrainische Drohnenpiloten: DJI gesteht unsichere Datenübertragung ein derSTANDARD
- Warum Ukrainer deutsche Drohnen-Hacker um Rat bitten DER SPIEGEL
- IT-Sicherheit heißt: Immer einen Schritt voraus zu sein WAZ
- Die Forschungsreise „Möglichmacher“ legt Halt in Bochum ein Ruhr University Bochum
2020
- Alexa, Who Else Is Listening? rC3
- Erkennt Greta Deep Fakes? ZDF logo!
- Mathematische Analyse soll alle Deep Fakes enttarnen Spektrum
- Fake-Bilder anhand von Frequenzanalysen erkennen Ruhr University Bochum
- Uncovered: 1,000 phrases that incorrectly trigger Alexa, Siri, and Google Assistant Ars Technica
- When Speech Assistants Listen Even Though They Shouldn't Ruhr University Bochum
- Sex, Streit, Arztgespräche: wie oft Smart Speaker heimlich mithören STRG_F
- Wenn Alexa aus Versehen lauscht Süddeutsche Zeitung
- Die lauschenden Lautsprecher tagesschau.de
- Sprachassistenten hören mit Tagesthemen
- Hat Siri schlechte Ohren? ZDF logo!
2019
- Wie Sprachassistenten unhörbare Befehle befolgen RUBIN