On the Robustness of Watermarking for Autoregressive Image Generation
A. Müller, D. Lukovnikov, S. Kodama, M. Pham, A. Jain, J. Petit, N. Cohen, and A. Fischer
Annual Conference on Neural Information Processing Systems (NeurIPS), 2026
Andreas Müller
Since 2023, I have been a PhD student at the Ruhr University Bochum with generous support by the CASA cluster of excellence in Germany. My current work aims at improving the robustness of watermarking techniques for generative AI.
Previously, I worked as an internal auditor and data analyst at Volkswagen Group.
I completed my studies at Technical University of Braunschweig, specializing in IT security. During that time, I was also a co-founder and backend developer at AIPARK, which is now called Bliq, as well as a student assistant to Erwin Quiring. I am currently being supervised by Asja Fischer.
News
- 10/2026: Our paper On the Robustness of Watermarking for Autoregressive Image Generation got accepted to NeurIPS 2026 in Paris!
- 02/2026: Our paper ClusterMark: Towards Robust Watermarking for Autoregressive Image Generators with Visual Token Clustering got accepted to CVPR 2026 in Denver!
- 12/2025: Our paper Chasing Shadows: Pitfalls in LLM Security Research got accepted to NDSS Symposium 2026 and is now available on ArXiv.
- 06/2025: I give an oral presentation on our paper Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models at CVPR 2025 in Nashville!
- 05/2025: We present our papers Towards a Correct Usage of Cryptography in Semantic Watermarks for Diffusion Models (oral) and Are Semantic Watermarks for Diffusion Models Resilient to Layout Control? (poster) at the ICLR 2025 Workshop on GenAI Watermarking (WMARK) in Singapore.
- 05/2024: Our paper The Impact of Uniform Inputs on Activation Sparsity and Energy-Latency Attacks in Computer Vision receives the best paper award at the Deep Learning Security and Privacy Workshop collocated with the S&P conference in San Francisco!
- 01/2024: I am spending a few months at the International Computer Science Institute (ICSI), affiliated with UC Berkeley, for a research visit.
Research
My research focuses on AI security and the robustness of watermarking techniques for generative AI, including diffusion models and autoregressive image generators.
ClusterMark: Towards Robust Watermarking for Autoregressive Image Generators with Visual Token Clustering
D. Lukovnikov*, A. Müller*, E. Quiring, A. Fischer
Conference on Computer Vision and Pattern Recognition (CVPR), 2026
Chasing Shadows: Pitfalls in LLM Security Research
J. Evertz, N. Risse, N. Neuer, A. Müller, P. Normann, G. Sapia, S. Gupta, D. Pape, S. Shaw, D. Srivastav, C. Wressnegger, E. Quiring, T. Eisenhofer, D. Arp, L. Schönherr.
NDSS, 2026
Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models
A. Müller, D. Lukovnikov, J. Thietke, A. Fischer, E. Quiring
Conference on Computer Vision and Pattern Recognition (CVPR), 2025 (Oral presentation)
Are Semantic Watermarks for Diffusion Models Resilient to Layout Control?
D. Lukovnikov, A. Müller, J. Thietke, E. Quiring, A. Fischer
ICLR 2025 Workshop on GenAI Watermarking (WMARK), 2025
Towards a correct usage of cryptography in semantic watermarks for diffusion models
J. Thietke, A. Müller, D. Lukovnikov, A. Fischer, E. Quiring
ICLR 2025 Workshop on GenAI Watermarking (WMARK), 2025
The Impact of Uniform Inputs on Activation Sparsity and Energy-Latency Attacks in Computer Vision
A. Müller and E. Quiring
S&P Deep Learning Security and Privacy Workshop (DLSP), 2024 (Best paper award)
On the Detection of Image-Scaling Attacks in Machine Learning
E. Quiring, A. Müller, K. Rieck
Annual Computer Security Applications Conference (ACSAC), 2023