Leo Schwinn

I am a PI at Helmholtz AI, where I lead the Secure Machine Learning Group. I am additionally affiliated with the Technical University of Munich and the Mila Quebec AI Institute as an independent visiting researcher with Prof. Gauthier Gidel. I am interested in robust machine learning with a focus on data-efficient learning and robustness vulnerabilities of Large Language Models (LLMs). I am currently the main organizer of the ICLR BlogPost Track and am always happy to answer questions about the track.

Previously, I did my Ph.D. at Friedrich-Alexander University Erlangen-Nürnberg (FAU) under the supervision of Prof. Björn Eskofier, receiving the ATE dissertation price. During my PhD I conducted an internship under the supervision of Prof. Doina Precup at the Mila Quebec AI Institute. After my PhD, I worked as a Postdoc at FAU, as a Machine Learning Engineer at Robert Bosch on robust computer vision for autonomous driving, and as a Postdoc and later Lecturer at the Technical University of Munich.

News

• April, 2026: 3 papers accepted at ICML 2026! Two AI safety works highlighting weaknesses in current LLM robustness evaluations, LLM-Safety Evaluations Lack Robustness and A Coin Flip for Safety: LLM Judges Fail to Reliably Measure Adversarial Robustness, and we introduce a tokenization scheme for efficient time-series forecasting in Byte Pair Encoding for Efficient Time Series Forecasting.

• January, 2026: 4 papers accepted at ICLR 2026, Converting a bug into a feature by using model collapse as a reliable machine unlearning technique for LLMs in Model Collapse Is Not a Bug but a Feature in Machine Unlearning for LLMs , and showcasing the importance of probabilistic evaluations and sampling in adversarial attacks in LLMs Sampling-aware Adversarial Attacks Against Large Language Models. Additionally, two of our TMLR papers were selected for the journal to conference track: assessing image classifier robustness against semantic adversarial examples generated via score-based diffusion models in Assessing Robustness via Score-Based Adversarial Image Generation, and improving the robustness of Graph Transformers in Adversarial Robustness of Graph Transformers.

• September, 2025: 2 papers accepted at NeurIPS 2025, We capture complex inter-table dependencies in graph generation tasks Joint Relational Database Generation via Graph-Conditional Diffusion Models , and we make Vision Language Models work for high-detail VQA tasks in FOCUS: Internal MLLM Representations for Efficient Fine-Grained Visual Question Answering

• May, 2025: We are presenting 2 papers at ICML 2025, How to make your time-series transformer and state-space model efficient: Efficient Time Series Processing for Transformers and State-Space Models through Token Merging , and we formalize the question “When to retrain a machine learning model” in real-world environments where new data is constantly arriving and changing.

• February, 2025: We are presenting 1 paper at CVPR 2025 :-), In Joint Out-of-Distribution Filtering and Data Discovery Active Learning, we introduce Joda, the first active learning approach to handle both out-of-distribution data and new category discovery at the same time.

• February, 2025: A probabilistic perspective into unlearning in LLMs was awarded an Oral presentation at ICLR 2025 🥳

• January, 2025: We are presenting 2 papers at ICLR 2025! A probabilistic perspective into unlearning in LLMs, where we reveal that current evaluations are unreliable. Moreover, we introduce a novel probabilistic time series forcasting algorithm combining Gaussian Process priors and flow matching

• September, 2024: Happy to have 3 papers accepted at NeurIPS 2024!, we explore new threat models in LLMs, propose the first efficient adversarial training algorithm for LLMs presented as spotlight 🥳, and explore scaling properties of Lipschitz-1 neural networks

• June, 2024: Position is filled! Open PhD position available at my research group at the chair of Prof. Stephan Günnemann! For more information, see [here](/files/E13_Geomar.pdf)

• December, 2023: I am one of the review process chairs of the 2024 Conference on Lifelong Learning Agents (CoLLAs). Looking forward to see everyone in Pisa!

• November, 2023: I will start as a Postdoc at the Technical University of Munich and Munich Data Science Institute in the Data Analytics and Machine Learning group supervised by Prof. Stephan Günnemann

• October, 2023: We will present “Adversarial Attacks and Defenses in Large Language Models: Old and New Threats” as a spotlight presentation at NeurIPS 2023 I Can’t Believe It’s Not Better (ICBINB): Failure Modes in the Age of Foundation Models Workshop.

• October, 2023: I’m now a member of ELLIS - the European Laboratory for Learning and Intelligent Systems

• April, 2023: I am an organizer / track chair of the ICLR Blogpost track 2024