Leo Schwinn

I am a PI at Helmholtz AI, where I lead the Secure Machine Learning Group. I am additionally affiliated with the Technical University of Munich and the Mila Quebec AI Institute as an independent visiting researcher with Prof. Gauthier Gidel. I am interested in robust machine learning with a focus on data-efficient learning and robustness vulnerabilities of Large Language Models (LLMs). I am currently the main organizer of the ICLR BlogPost Track and am always happy to answer questions about the track.

Previously, I did my Ph.D. at Friedrich-Alexander University Erlangen-Nürnberg (FAU) under the supervision of Prof. Björn Eskofier, receiving the ATE dissertation price. During my PhD I conducted an internship under the supervision of Prof. Doina Precup at the Mila Quebec AI Institute. After my PhD, I worked as a Postdoc at FAU, as a Machine Learning Engineer at Robert Bosch on robust computer vision for autonomous driving, and as a Postdoc and later Lecturer at the Technical University of Munich.

News

• September, 2026: 2 papers accepted at NeurIPS 2026! We show that diffusion LLMs can be used to generate strong adversarial prompts that transfer to any LLM in Diffusion LLMs are Natural Adversaries for any LLM, and we propose a single model that efficiently predicts hundreds of virtual sensors at once in A Scalable Multi-Task Model for Virtual Sensors.

• April, 2026: 3 papers accepted at ICML 2026! Two AI safety works highlighting weaknesses in current LLM robustness evaluations, LLM-Safety Evaluations Lack Robustness and A Coin Flip for Safety: LLM Judges Fail to Reliably Measure Adversarial Robustness, and we introduce a tokenization scheme for efficient time-series forecasting in Byte Pair Encoding for Efficient Time Series Forecasting.

• January, 2026: 4 papers accepted at ICLR 2026, Converting a bug into a feature by using model collapse as a reliable machine unlearning technique for LLMs in Model Collapse Is Not a Bug but a Feature in Machine Unlearning for LLMs , and showcasing the importance of probabilistic evaluations and sampling in adversarial attacks in LLMs Sampling-aware Adversarial Attacks Against Large Language Models. Additionally, two of our TMLR papers were selected for the journal to conference track: assessing image classifier robustness against semantic adversarial examples generated via score-based diffusion models in Assessing Robustness via Score-Based Adversarial Image Generation, and improving the robustness of Graph Transformers in Adversarial Robustness of Graph Transformers.

• September, 2025: 2 papers accepted at NeurIPS 2025, We capture complex inter-table dependencies in graph generation tasks Joint Relational Database Generation via Graph-Conditional Diffusion Models , and we make Vision Language Models work for high-detail VQA tasks in FOCUS: Internal MLLM Representations for Efficient Fine-Grained Visual Question Answering

• May, 2025: We are presenting 2 papers at ICML 2025, How to make your time-series transformer and state-space model efficient: Efficient Time Series Processing for Transformers and State-Space Models through Token Merging , and we formalize the question “When to retrain a machine learning model” in real-world environments where new data is constantly arriving and changing.

• February, 2025: We are presenting 1 paper at CVPR 2025 :-), In Joint Out-of-Distribution Filtering and Data Discovery Active Learning, we introduce Joda, the first active learning approach to handle both out-of-distribution data and new category discovery at the same time.

• February, 2025: A probabilistic perspective into unlearning in LLMs was awarded an Oral presentation at ICLR 2025 🥳

• January, 2025: We are presenting 2 papers at ICLR 2025! A probabilistic perspective into unlearning in LLMs, where we reveal that current evaluations are unreliable. Moreover, we introduce a novel probabilistic time series forcasting algorithm combining Gaussian Process priors and flow matching

• September, 2024: Happy to have 3 papers accepted at NeurIPS 2024!, we explore new threat models in LLMs, propose the first efficient adversarial training algorithm for LLMs presented as spotlight 🥳, and explore scaling properties of Lipschitz-1 neural networks

• June, 2024: Position is filled! Open PhD position available at my research group at the chair of Prof. Stephan Günnemann! For more information, see [here](/files/E13_Geomar.pdf)

• December, 2023: I am one of the review process chairs of the 2024 Conference on Lifelong Learning Agents (CoLLAs). Looking forward to see everyone in Pisa!

• November, 2023: I will start as a Postdoc at the Technical University of Munich and Munich Data Science Institute in the Data Analytics and Machine Learning group supervised by Prof. Stephan Günnemann

• October, 2023: We will present “Adversarial Attacks and Defenses in Large Language Models: Old and New Threats” as a spotlight presentation at NeurIPS 2023 I Can’t Believe It’s Not Better (ICBINB): Failure Modes in the Age of Foundation Models Workshop.

• October, 2023: I’m now a member of ELLIS - the European Laboratory for Learning and Intelligent Systems

• April, 2023: I am an organizer / track chair of the ICLR Blogpost track 2024