The intersection of artificial intelligence (AI) and security is attracting growing attention, driven by the need to build secure AI-enabled systems. Cryptography is a central example of this trend, showcasing how AI can both strengthen and challenge existing security mechanisms. On one hand, AI techniques are increasingly used within cryptography itself, for instance, to advance cryptanalysis, improve the effectiveness of physical attacks, and design more robust countermeasures. On the other hand, cryptographic methods are now being explored to address security and privacy issues in AI systems.
As attacks on AI become more sophisticated, there is a pressing need to understand how cryptographic tools can mitigate these threats. This includes, for example, cryptographic backdoors in neural networks, cryptographic techniques for watermarking the outputs of large language models (LLMs), and model-stealing attacks that leverage cryptanalytic methods. These developments highlight a rich, bidirectional relationship between AI and cryptography.
The goal of AICrypt 2026 is to bring together experts from academia and industry, each contributing distinct perspectives on AI and cryptography, to foster knowledge exchange and collaborative innovation. We are particularly interested in:
We will also review recent advances in this rapidly evolving area, including those presented at previous AICrypt events, to provide participants with a comprehensive view of the current state of the field and open research directions.
Authors interested in giving a contributed talk in AICrypt are invited to submit an extended abstract of at most 2 pages (excluding references) on Easychair.
Topics of interest for this workshop include, but are not limited to:
We welcome novel research results and position paper contributions that clarify the landscape of cryptography and AI security. Work-in-progress and visionary ideas with a clear technical core are also encouraged.
Submitted abstracts for contributed talks will be reviewed by the workshop chairs for suitability and interest to the AICrypt audience. There are no formal proceedings published in this workshop. Thus, authors can submit extended abstracts related to works submitted or recently published in other venues or work in progress that they plan to submit elsewhere.
We encourage researchers working on all aspects of AI and cryptography to take the opportunity and use AICrypt to share their work and participate in discussions. The authors are invited to submit an extended abstract using the EasyChair submission system. All submitted abstracts must follow the original LNCS format with a page limit of up to 2 pages (excluding references). The abstracts should be submitted electronically in PDF format.
The speakers will be invited to present their work based on the evaluation of the workshop chairs for suitability and interest to the AICrypt audience. Every accepted submission must have at least one author registered for the workshop.
Abstract submission deadline: MARCH 6, 2026
Notification to authors: MARCH 20, 2026
Workshop date: MAY 9, 2026
Workshop registration goes through the Eurocrypt registration process. Check the Eurocrypt website for further information.
In recent years, model extraction of neural networks has received increasing attention, including from the cryptographic community. This talk will review the main techniques used today to analyze and extract the internal parameters of neural networks, focusing in particular on fully connected ReLU networks and to a lesser extend on convolutional neural networks. The talk will present the common attack techniques, discuss what are the current limitations, and highlight open problems and research directions.
Christina Boura is a Professor at Université Paris Cité, France, and a Junior Member of the Institut Universitaire de France (2025–2030). Her research primarily focuses on the cryptanalysis of block ciphers and other symmetric primitives, as well as on the analysis of the mathematical properties of their building blocks. More recently, she has developed an interest in the security of neural networks. She served as co-Editor-in-Chief of Transactions on Symmetric Cryptology (ToSC) from 2022 to 2024 and has been, or is currently, a member of several editorial and conference boards.
The program starts at 09:25 am, CEST time (UTC + 2).
| TIME CEST (UTC+2) |
SESSION/TITLE |
|---|---|
| AI-based Side-channel Analysis and Homomorphic Encryption for LLMs 09:25 - 10:30 |
|
| 09:25 - 09:30 | Opening Remarks |
| 09:30 - 9:55 | Hybrid AI-Driven Cryptanalysis via Quadrant Scan and Convolutional-Transformers Nadia Badawi, Norziana Jamil, Vincent Rijmen and Ayham Zaitouny |
| 9:55 - 10:20 | Navigating the Rise of LLMs: A Perspective on Homomorphic Cryptographic Solutions Navigating the Rise of LLMs: A Perspective on Homomorphic Cryptographic Solutions |
| 10:20 - 11:00 | Coffee Break |
| Session 2: Watermarking, Countermeasures and AI-based cryptanalysis 11:00 - 13:00 |
|
| 11:00 - 11:30 | Provably Robust Watermarks for Open-Source Language Models Miranda Christ, Sam Gunn, Tal Malkin and Mariana Raykova |
| 11:30 - 12:00 | Poison Pill: Active Entanglement for AI Weight Protection Tolga Yalcin |
| 12:00 - 12:30 | A First Study of Fully Automated End-to-End Cryptanalysis Aron Gohr and Gregor Leander |
| 12:30 - 13:00 | HATSolver: Learning Groebner Bases with Hierarchical Attention Transformers
Mohamed Malhou, Kristin Lauter and Ludovic Perret |
| 13:00 - 14:30 | Lunch Break |
| Session 3: Keynote talk 14:30 - 15:30 |
|
| 14:30 - 15:30 | Keynote Talk: Cryptanalysis of Neural Networks Christina Boura |
| 15:30 - 16:00 | Coffee break |
| Session 4: Cryptography for verifiable and privacy-preserving ML 16:00 - 17:30 |
|
| 16:00 - 16:30 | ZKBoost: Zero-Knowledge Verifiable Training for XGBoost Nikolas Melissaris, Jiayi Xu, Antigoni Polychroniadou, Akira Takahashi and Chenkai Weng |
| 16:30 - 17:00 | Meeting in the Middle: A Co-Design Paradigm for FHE and AI Inference Benjamin Marsh, Bernardo Magri and Paul Gebheim |
| 17:00 - 17:30 | Somewhat efficient blind recommender system for the MovieLens dataset Lorenzo Rovida |
| 17:30 - 17:35 | Closing Remarks |