ICLR 2026 Response to Security Incident

2025-12-03 · Source: ICLR Blog · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Fundamental Awareness, short

Summary

The ICLR 2026 peer review process experienced a significant security incident starting November 27, 2025, when a bug in OpenReview's API was exploited to leak author, reviewer, and area chair identities for over 10,000 ICLR submissions, representing 45% of the conference. Malicious actors circulated this data, leading to attempts at collusion, harassment, intimidation, and bribery targeting reviewers. The ICLR team, in collaboration with OpenReview, responded by fixing the bug, freezing review form editing and public comments, reverting reviews to their pre-discussion state, and reassigning all Area Chairs (ACs). New ACs are tasked with writing metareviews based on original reviews and discussions, supported by AC triplets for challenging cases and extended deadlines until January 6, with notification aims by January 26. The individual responsible for widely sharing the leaked data has been identified and banned, and papers involved in collusion attempts face desk rejection.

Key takeaway

For AI scientists and program chairs managing peer review systems, this incident highlights the critical need for stringent platform security and a well-defined incident response plan. Your systems must be resilient against identity leaks and prepared for rapid, decisive action like review freezes and reassignments to maintain academic integrity. Proactively sharing findings with other conferences can strengthen community-wide defenses against similar attacks.

Key insights

An OpenReview API exploit led to a major ICLR security breach, compromising anonymity and academic integrity.

Principles

• Academic integrity is paramount.
• Swift, decisive action is critical.
• Transparency builds community trust.

Method

The ICLR response involved freezing discussions, reassigning ACs, reverting reviews to a pre-breach state, and implementing AC triplets for support, aiming to preserve academic integrity while minimizing disruption.

In practice

• Implement robust API security audits.
• Develop rapid incident response protocols.
• Identify and ban malicious actors.

Topics

• ICLR 2026
• Peer Review Process
• Security Incident
• OpenReview API
• Academic Integrity

Best for: AI Scientist, CTO, VP of Engineering/Data, AI Researcher, Research Scientist, AI Ethicist

Related on AIssential

• [D] ICML 2026 Review Discussion — ML peer review suffers from high variance in reviewer quality and increasing submission volumes.
• ICLR’s Commitment to OpenReview — ICLR is doubling its financial support for OpenReview to promote open science and reproducible research.
• The peer review system is breaking down. Here’s how we can fix it — The voluntary peer review system is failing due to unacknowledged labor and increased academic pressures.
• ICML paper checker is down? [D] — Website outages near deadlines disrupt critical submission processes, necessitating immediate communication and contingency planning.
• Can AI Review Improve Paper Drafting? An Empirical Study on 20 Computer Architecture Submissions — AI review can significantly align with human feedback and identify novel issues in paper drafting.
• Lessons Learned From 2025: Breaches Are Borderless And Regulators Are Watching — Data breaches and privacy fines in 2025 highlight universal vulnerability and the urgent need for robust response and AI oversight.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by ICLR Blog.