By section · Sunday, 9 August 2026
Everything that cleared the bar
The full catalog behind today's front page — 11 of 15 sections have something in them. A story can top its section and still miss the flat front-page cut, so this is not the leftovers.
Research
LLM security
Attacks, defenses, and evaluation of LLM systems: jailbreaks, prompt injection, data extraction, red-teaming, alignment-adjacent safety failures with a security framing.
-
Optimizing What Policies Learn From: Recoverability-aware Rollout Intervention Learning
The paper introduces Recoverability-Aware Intervention Learning (RAIL), a training-time framework that adaptively selects rollout interventions for critic-free group-based RL in LLM post-training, addressing the inefficiency of uniform rollout allocation. RAIL formulates intervention selection as an online contextual bandit and trains a recoverability controller via a shadow-to-live procedure so the controller adapts as the policy changes. Experiments show RAIL improves effectiveness, adaptivity, expressiveness, and efficiency under limited rollout budgets by generating more informative, less redundant rollouts that yield stronger learning signals.
Why it matters It offers a principled, adaptive rollout allocation mechanism that can boost post-training efficiency and signal quality—relevant to safety-aligned RLHF-style pipelines and budgeted data collection for foundation models, including time-series variants.
-
Detecting Safety Training Modification in Language Models via Activation Analysis
The paper presents AMS, an activation-space scanner that detects modifications to safety training in LLMs by measuring geometric separation and direction of safety-relevant concepts, validated across 14 configurations from Llama, Gemma, Qwen, and Mistral and four safety-mod categories. It reports 71% leave-one-out accuracy on sigma-threshold detection with median 3.4-sigma bootstrap CI width, and finds sigma on the harmful-content concept correlates with behavioral compliance on JailbreakBench (r = -0.546, p = 0.043). A mechanistic taxonomy distinguishes four modification types with distinct activation-space signatures, where Tier 1 sigma-thresholding detects collapse/rotation-plus-collapse, Tier 2 direction checks detect rotation-only, and behavioral-only fine-tunes are undetectable by activation probes, with discussion of threshold calibration and single-run limitations.
Why it matters Offers a concrete activation-geometry diagnostic for detecting safety training tampering (and its limits), tying internal metrics to jailbreak compliance—useful for red-teaming, eval pipelines, and mechanistic audits of LLM safety interventions.
-
Robust Context-Aware Detection of Malicious Instructions in Text
This work introduces a context- and query-aware sentence-level detector for malicious instructions in text, targeting IPI by segmenting benign vs. malicious sentences. It further hardens the detector with two adversarial training methods: embedding-space PGD-style feature perturbations and LLM-based paraphrase simulations, each parameterized to trade off utility and robustness. Experiments on IPI benchmarks show gains over state-of-the-art under static attacks and improved utility and lower attack success under adaptive attacks, with optimal AT parameters shown to be domain-dependent and thus requiring domain-specific tuning.
Why it matters It proposes a practical, query-relative segment classifier with AT schemes (including LLM-paraphrase-in-the-loop) that improve robustness against adaptive IPI—relevant for securing agentic LLM pipelines and for evaluating tradeoffs in domain-specific deployments.
-
Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming
The paper proposes PIMiner, an agentic red-teaming system for prompt injection that trains over sequences of (dataset, target model) pairs to build a strategy library from scratch. At test time, it transfers this library to unseen target LLMs without additional training and uses only a small number of target-agent queries per sample (e.g., 10). Experiments show strong ASR on IPIArena (76.2% Gemini-2.5-Pro, 61.9% GPT-5.1, 42.9% Claude-Sonnet-4.5) and AgentDojo (86.7% Gemini-2.5-Pro, 53.3% GPT-5.1, 40.0% Claude-Sonnet-4.5), outperforming RL-based approaches that generalize poorly.
Why it matters Offers a transferable, query-efficient prompt-injection attacker that challenges current RL-based red teaming and provides high-quality adversarial data for evaluating and training agent defenses.
-
SkillSentry: Adaptive Honey Worlds for Dynamic Safety Testing of Agent Skills
SkillSentry is a dynamic safety-testing framework that uses adaptive honey worlds to probe LLM agent skills for conditional, execution-time harms. It infers a skill’s intended capability boundary, builds an LLM-simulated environment with controlled decoy resources, adaptively generates tasks, and contrasts skill-enabled trajectories with matched no-skill runs, attributing suspicious behaviors to code and verified traces before deciding. Evaluated against seven scanner configurations, it attains 99.50% Recall and 96.26% average F1 on standard benchmarks, and 92.95% average F1 under semantics-preserving evasion versus 80.07% for the strongest baselines.
Why it matters Offers a practical, attribution-grounded dynamic testing approach that outperforms static/one-shot scanners, relevant for securing tool-augmented agents and adversarial evaluation pipelines.
-
Temporal Leakage in LLM Backtesting: Measurement, Validation, and Adjusted Scores
The usual pre/post-cutoff contamination check in LLM backtests is uninformative, as flagship models fail it even on post-cutoff questions due to structural recency effects, and no passive backtest can disentangle recency or leakage from genuine skill. The authors introduce two external-information approaches: using a known cutoff to identify boundary leakage and a matched clean control to estimate global leakage and produce leakage-adjusted scores, along with a characterization showing leakage concentrates on surprising, well-covered outcomes and that partial memorization is over-rewarded. They validate via twin-model leakage injection and find recovery of the planted dose with nulls on clean items, then apply to frontier models, detecting one cutoff-localized signature while clearing five models whose apparent gains were due to recency, concluding that backtests remain viable given a defensible reference.
Why it matters It offers concrete, validated estimators and an adjustment recipe to separate recency from leakage, directly improving LLM security audits and forecasting/time-series backtesting of foundation models.
-
Gradient Immunity: Null-Space Resistance to Malicious Fine-Tuning
The paper targets the PPOW setting where most weights are trainable but a small safety-critical component is preserved, and proposes a Unidirectional Safety Gate implemented as a Null Space Cubic Layer plus an Inverse Adapter after the final Transformer layer. The cubic layer blocks or suppresses gradients from harmful samples whose hidden states lie within a calibrated protected region (threshold set using defender-held harmful data), while the Inverse Adapter restores the base model’s forward behavior. Across six model–dataset settings, this keeps post-finetuning attack success near pre-release levels under a fixed threshold, maintains high safe-pass on easier settings, and shows a clearer safety–utility trade-off on BeaverTails unsafe samples, indicating release-time representation-space blocking can raise the cost of malicious adaptation without downstream cooperation.
Why it matters Offers a concrete, release-time gradient-blocking mechanism that preserves forward behavior while resisting malicious fine-tuning—relevant to robust alignment under open-weight releases and complementary to gradient/representation-control methods in LLM safety.
-
Mitigating Scoring Bias in LLM-as-a-Judge via Random Number Generation
The paper addresses scoring bias in LLM-as-a-Judge by instructing an LLM to generate random number tokens and estimating its latent numerical bias from deviations from a uniform distribution. It conditions this random-number estimation on the downstream task to capture task-specific bias and then rectifies token generation probabilities during evaluation accordingly. Experiments on alignment evaluation, summarization evaluation, STS, and STR show improved performance over undebiased LLMs and prior calibration methods, and reveal that scoring bias varies by model, task, and score range.
Why it matters Offers a practical, task-conditioned calibration scheme for LLM judges that corrects numeric propensity at the token level, improving reliability over existing calibration baselines.
-
Teaching Nemotron Greek: Mining a Corpus, Adapting Retrieval, and Grounding Generation for Modern Greek across Specialist Domains
The paper adapts NVIDIA’s Nemotron retrieval stack to Modern Greek via corpus mining, synthetic supervision, dense retriever training, reranker adaptation, reader fine-tuning, and introduces the HERA benchmark. It finds BM25 strong on specialist Greek corpora, but after fine-tuning on 65,773 Greek pairs, a Nemotron 1B embedder boosts nDCG@10 from 0.362 to 0.835 and transfers some gains to general-domain Greek; a cross-encoder reranker further improves results across domains. A LoRA-tuned Nemotron 30B-A3B reader improves grounded generation correctness from 29.4% to 66.9% with better faithfulness and citations, and both models and HERA are released.
Why it matters Demonstrates an end-to-end, domain-focused RAG adaptation pipeline for a low-resource language with strong empirical gains, plus a new benchmark and released models that can inform security, grounding, and retrieval design choices for multilingual and domain-specific LLM systems.
-
Enhancing Anomaly Resilience in Research Networks: A Large-Scale Forecasting Benchmark for Dynamic Security Baselining
The paper introduces a high-fidelity traffic forecasting framework to create dynamic security baselines for RENs, addressing the challenge that elephant flows resemble volumetric attacks to conventional monitors. Using a 57-day Internet2 dataset (13.7B packets across ten backbone routers), it benchmarks six forecasting model families, including SARIMA and long-sequence architectures (TiDE, PatchTST), over 960 configurations. Results show advanced models—especially TiDE—reduce baseline prediction error by 30–42% (p < 0.001) and that a new anomaly-integration strategy yields a 3.3% robustness gain under noise, improving separation of scientific bursts from anomalies.
Why it matters It provides a statistically validated, large-scale benchmark showing long-sequence LLM-adjacent forecasters (e.g., TiDE/PatchTST) materially improve dynamic baselining for REN security, informing robust anomaly detection under bursty traffic.
-
When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems
The paper introduces PoisonedEvolution, a trajectory-poisoning attack on self-evolving skill (SES) systems that distill agent trajectories into persistent skills, where an attacker with skill-level black-box access contributes bounded evidence to influence skill promotion. It formalizes artifact poisoning as requiring Inclusion, Evolution Attribution, and Realization, identifying Attribution—making target behaviors appear causally useful, recurrent, and generalizable—as the key bottleneck, and demonstrates high success embedding target behaviors across six LLM evolvers in SkillClaw (91.0% SER) and transfer to Trace2Skill (61.5% SER) at 10% attacker support. Controlled studies show three consistent attacker records in a 30-record batch suffice while one is much weaker, and ablations highlight recurring support, causal framing, and domain-aligned encoding as main success factors, framing evidence promotion as a critical security boundary for self-evolving agents.
Why it matters It pinpoints the promotion/attribution step in skill evolution as an attack surface with quantified vulnerability and transferable effects, informing defenses for agentic LLMs and data-driven skill distillation pipelines.
-
When Do PEFT Adaptations Leak Structure? Measuring Black-Box Structural Bounds in Public-Base Model Services
The paper introduces VectorHijack-SR, a black-box measurement method that turns paired victim/base residuals into calibrated bounds over PEFT family, layer locality, and coarse rank, using aggregated query-level statistics and a service-disjoint classifier plus a cross-fitted hierarchical rejector to test LoRA-manifold membership. Empirically, family leakage exceeds chance across multiple backbones/tasks, rank inference varies by task, the rejector attains AUROC 0.804 and high known-set accuracy but struggles with structurally close DoRA/LoRA+head, and exact-version linkage on held-out LoRA-r64 services reaches AUC 0.940. Despite measurable structural leakage, experiments show a visibility–exploitability gap: two-stage recovery offers no fair-budget query savings, posterior-selected PEFT underperforms distill-then-convert PEFT, and free-running generation remains near chance.
Why it matters It provides concrete, black-box evidence and metrics for structural leakage from PEFTed services with known bases, informing red-team audits, model fingerprinting, and security evaluations of adapter deployment choices.
-
Towards a Risk Assessment of Malicious Skill Files in Coding Agents
The paper studies the attack surface introduced by agent skill folders in autonomous coding agents and presents an adversarial skill-synthesis method that converts 471 real shell commands into 2,826 benign-looking skills mapped to 11 ATT&CK tactics using six LLMs. It introduces a reproducible evaluation pipeline with stratification, evidence anchoring, refusal veto, and a deterministic declared-intent override, using a three-judge LLM panel validated against a blind human gold standard (κ=0.85). In large-scale tests (5,629 runs), Gemini CLI was exploited in 95.5–96.1% and Qwen Code in 71.6–74.0% of runs with only 1.99% explicit safety recognition, and code/dataset are released at https://github.com/awsm-research/AgentJailbreak.
Why it matters Provides a validated benchmark, eval pipeline, and high-base-rate exploitation evidence for skill-file attacks in coding agents—directly relevant to LLM security evals and agentic deployment risk.
-
A Security-Oriented Lifecycle Model for Large Language Model Systems
The paper proposes a security-oriented lifecycle model for LLM systems, organized around security-relevant boundaries rather than workflow efficiency. It defines 32 stages across Data, Model, Distribution, and Application layers, supported by a 12-stage LLMOps pillar and a 9-category governance pillar, introducing 13 new stages that surface distinct security concerns overlooked in existing frameworks. A governance mapping of NIST AI RMF, EU AI Act, and ISO/IEC 42001 shows governance evidence clusters at deployment-facing stages while critical decisions occur earlier with minimal regulatory visibility.
Why it matters Offers a concrete, stage-granular security framework and governance mapping that highlights blind spots where LLM security and alignment decisions actually get made.
-
AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection
The paper introduces AgentAntibody, an adaptive defense for LLM agents against prompt injection that learns a user-specific security boundary over time. It maintains a persistent library of “antibodies” that recognize boundary violations at runtime and trigger targeted immune responses, updating this library across encounters. Experiments on three benchmarks and four backbone LLMs report improved prevention of harmful actions while preserving legitimate task completion, even when both are task-compatible.
Why it matters Offers a practical, experience-driven defense paradigm that operationalizes evolving policy constraints, complementing static prompt- and tool-level guards familiar in LLM agent security work and aligning with continual-learning ideas in foundation models.
-
Hierarchical Latent Prediction for Language Models
The work argues that standard NTP’s teacher-forced training is suboptimal for long-horizon reasoning and planning, and that existing MTP and NextLat objectives either have limited horizons or suffer from compounding rollout errors. It proposes Hierarchical Latent Prediction (HiLP), introducing an auxiliary higher-level abstract latent to reduce error accumulation in latent-space rollouts. Experiments indicate HiLP yields longer-horizon coherent belief state representations, improves performance on coding and multi-step reasoning benchmarks, and enables more efficient speculative decoding.
Why it matters HiLP targets long-horizon error accumulation with a hierarchical latent rollout, offering a potentially practical auxiliary objective for robust reasoning and faster decoding compared to MTP/NextLat baselines.
-
EvoHarness-RL: Learning Self-Evolving Runtime Harness for Long-Horizon LLM Agents
The paper introduces EvoHarness-RL, which learns harness policies that construct and control an external workspace for long-horizon LLM agents by exposing Belief, Progress, and Experience (BPE) as policy-facing state. The approach combines supervised harness fine-tuning to teach the action space and state construction with cost-aware GRPO to learn selective read/update/consolidation policies during runtime. On ALFWorld with Qwen3-8B, it achieves 96.9% success and surfaces harness annealing and harness evolution dynamics that shift usage toward selective external-state access and compact, task-adaptive state consolidation.
Why it matters It provides a concrete, trainable mechanism for policy-governed external state/memory/tool use—relevant to secure, long-horizon agent design where controlling information access and minimizing attack surface are central.
-
Skill-Use: Can LLMs Actually Use Skills in Agentic Harnesses?
The paper introduces Skill-Use, a benchmark that tests whether LLM agents can recognize, retrieve, and apply structured skills under progressive disclosure, separating Trigger, Compliance, and Boundary facets and combining them into an SU score that only credits execution after triggering. It comprises 79 real skills and 177 executable tasks across nine domains, run in Docker sandboxes and scored via trajectory-based rubrics, and evaluates eight LLMs across two agent harnesses. Results show reliable skill use is not yet achieved (best SU 0.613), with triggering and procedural compliance as independent bottlenecks and scores/model rankings varying by harness, indicating skill use is harness-conditioned rather than an inherent model property.
Why it matters It provides a rigorous, execution-grounded way to diagnose harness-conditioned failure modes (triggering vs. compliance vs. boundary) in tool-using LLM agents, informing both security-sensitive agent design and modular capability evaluation akin to time-series foundation model benchmarking.
-
When Does Latent Communication Pay? A Causal Audit of Relayed KV Caches in Multi-Agent LLMs
This paper causally audits claims that relayed KV caches in multi-agent LLMs transmit example-specific “latent thoughts” by swapping the relayed cache with deranged (mismatched-example), zeroed, and moment-matched random variants. When the receiver needs the sender’s private information, relays hit ceiling performance (≈100%) versus 23–25% for answer-irrelevant relays across multiple model families, checkpoints, and a document-QA setup; when not needed, a pre-registered, Holm-corrected TOST shows equivalence within 2.8 points on GSM8K, ARC-Challenge, and MedQA for Qwen3 models (with one small in-margin advantage) and no detected advantage for a second family. They show large cache effects need not be pairing effects (e.g., zeroing costs 14.7 points while mismatching costs 0.4 in one cell), and that “need” alone is insufficient for example-specific transfer, with channels ranging from ceiling (LatentMAS), partial (KVComm), to none detected (C2C), arguing that benchmark deltas do not establish latent-thought transmission without a mismatched-cache audit, which they release.
Why it matters It provides a concrete, preregistered causal audit protocol to disentangle genuine example-specific latent communication from generic cache benefits, directly informing LLM agent security/evaluation and design of time-series-style KV relay mechanisms.
-
FBID: Adaptive Personalized Federated Learning for Robust Out-of-Distribution Attack Detection in IoT Networks
The paper introduces FBID, an adaptive PFL framework that uses server-side personalization control to avoid over-personalization and OOD detection degradation in heterogeneous IoT intrusion detection. It employs a contextual bandit at the server to modulate each client’s local training intensity based on behavior and update quality, and adds a trust-based blending mechanism to set client-specific interpolation between global and local models. Experiments on CICIoT2023 with heterogeneous clients and OOD stress tests show improvements in OOD DR (up to 7.66%) and F1 (up to 5.08% relative) over the strongest stable baseline, including better robustness to unseen attack classes.
Why it matters Server-controlled personalization via contextual bandits and trust-weighted global-local blending offers a concrete, empirically validated path to improve OOD robustness in federated IDS—relevant to securing LLM/edge deployments and to broader foundation-model personalization under distribution shift.
-
CircuitSteer: Geometrically Aligned Multi-Layer Steering via Sparse Autoencoder Circuits
CircuitSteer introduces a multi-layer steering framework that uses SAEs to identify coherent semantic circuits via feature co-activation and geometric alignment of decoder directions, enabling isolation of subcircuits tied to target behaviors. The method synthesizes dense steering vectors from sparse features and applies multi-point interventions to guide internal semantic trajectories. Evaluated on toxicity, emotion-intensity, sycophancy, and refusal across two model families, it uniquely achieves fluency-preserving interventions and maintains coverage where single-layer methods fail, with code released publicly.
Why it matters It proposes a geometry-aware, multi-layer circuit approach that outperforms single-point CAA-style interventions on hard behaviors (e.g., sycophancy/refusal), informing both alignment steering and circuit-level interpretability workflows.
-
HarnessOpt-Bench: Evaluating LLMs at Harness Optimization
The paper introduces HarnessOpt-Bench, a benchmark for end-to-end harness optimization where an LLM optimizer iteratively edits a target agent’s harness under expensive, stochastic evaluation with a fixed budget, using only graded feedback and without access to a held-out test partition. A trusted execution environment enforces evaluation boundaries, meters resource use, and preserves candidate versions for audit, and performance is measured by normalized gain over the seed harness. Evaluating five frontier LLMs across four tasks and 111 runs, the authors find optimizer models differentiate more than coding harnesses, native harnesses aren’t consistently superior, and gains vary substantially by task and seed regime, establishing harness optimization as a measurable and discriminative capability with room for improvement.
Why it matters It provides a rigorous, auditable setup to compare LLMs’ agentic self-improvement under realistic noisy/expensive evals—relevant for secure agent orchestration and optimizing time-series/tool-using pipelines.
-
When Self-Evolution Backfires: Pre-Commit Gating against Skill Contamination in LLM Agents
The paper shows that self-evolving LLM agents experience a capability-contamination phase transition: beyond a critical pool size, newly distilled skills degrade performance due to defective skills seeding cross-round contamination chains. They demonstrate structural irreversibility, where post-hoc removal of source skills recovers only a small fraction of performance, motivating pre-commit gating via Verifier-as-Gatekeeper (VaG) with three heterogeneous critics and marginal-gain subset selection. On Terminal-Bench 2, unconditional accumulation peaks then degrades with limited rollback recovery, while VaG improves every round to 72% pass@1 with a ~5x smaller pool and transfers positively to other backbones and a second benchmark, with ablations showing the critics are complementary and non-substitutable.
Why it matters It surfaces an irreversible contamination mechanism in skill distillation and proposes a concrete pre-commit gating framework that stabilizes agent evolution and transfers across models/benchmarks, directly relevant to secure, scalable LLM agent training and model-based control of evolving skill libraries.
-
GROM: Gradient-Free Rapid One-Shot Machine Unlearning
The paper introduces GROM, a gradient-free, one-shot unlearning method that replaces iterative fine-tuning with a closed-form additive weight update derived by framing unlearning as a ridge-regularized least-squares problem. The update is computed via forward passes only and enforces suppression of targeted content while preserving behavior on retained data, enabling application in seconds. Experiments report SOTA forgetting-utility trade-offs on TOFU-5%, TOFU-10%, MUSE-Books, MUSE-News, and WMDP, and robustness to low-bit quantization attacks that can undo gradient-based unlearning.
Why it matters Offers an analytically grounded, fast, and quantization-robust unlearning primitive relevant for LLM red-teaming defenses and deploy-time editing without retraining overhead.
-
Refining Over Resampling: Test-Time Self-Correction for LLM Reasoning
The paper proposes a verifier-free breadth–depth refinement framework for test-time scaling that combines multiple independent rollouts with iterative self-critique/self-correction and majority voting. This approach preserves diversity via breadth while repairing local reasoning errors via depth, avoiding reliance on external reward model calibration. Across AIME24, AIME25, AMC, OlympiadBench, and MATH500 with multiple open-weight models, it outperforms greedy decoding, majority voting, verifier-based best-of-N, beam search, and lookahead decoding, e.g., boosting Qwen2.5-1.5B to 58.0% on MATH500 and 32.5% on AMC from the strongest verifier-based baselines.
Why it matters Shows that allocating test-time compute to trajectory refinement (self-critique/correction) can beat wider sampling and verifier-guided selection, informing secure, efficient reasoning pipelines and compute–performance tradeoffs.
-
DBLAST: Dependent Block Drafting for Stochastic Speculative Decoding
The paper analyzes speculative decoding with block/diffusion drafters and shows that assuming conditional independence across drafted positions breaks down under non-greedy, higher-entropy target sampling, reducing accepted draft length. It introduces DBLAST, a dependent block drafter using a low-rank latent mixture over token positions plus an acceptance-oriented objective that optimizes expected verified length. Experiments on Qwen3-4B/8B across GSM8K, MT-Bench, HumanEval, and creative-writing benchmarks report consistent gains in accepted length over independent block sampling, particularly at higher entropy.
Why it matters It targets stochastic decoding efficiency—key for secure, diverse sampling and alignment workflows—by improving acceptance rates under high-entropy regimes, informing both LLM safety pipelines and efficient inference design.
-
Evaluation Pitfalls and Sparsity Limitations in LLM-based Confidence Estimates for Classification
The paper finds that common LLM confidence verbalization for classification is extremely sparse, e.g., Qwen3-32B yields only eight unique values on SST-2 with over half at exactly 95%, a pattern repeated across four datasets and two LLMs. This sparsity skews evaluation: AUARC rankings change drastically depending on interpolation choice, with consistency sampling dropping from best to worst under stepwise vs. linear interpolation, motivating a call to standardize stepwise interpolation. Under this fairer evaluation, “verbalization logprobs,” which weights verbalized digits by token probabilities, mitigates sparsity and yields the best AUARC, improving by 2.3 points over vanilla verbalization without extra inference cost.
Why it matters It highlights a pervasive sparsity artifact in LLM confidence verbalization that can invert AUARC-based rankings, and offers a zero-cost fix (verbalization logprobs) with standardized stepwise evaluation—directly relevant to trustworthy LLM classification pipelines and security-critical reject options.
-
Trident : How to Break Deep Reinforcement Learning Cyber Defenses (Agentic)
The paper introduces Trident, an agentic LLM red-teaming framework for evaluating DRL-based cyber defenses, consisting of a dynamic benchmark across CybORG CAGE 4 and CyberWheel, a dataset of 13k+ red-blue trajectories for RLVR, and a Code-as-Policy RLVR architecture. Trident reframes red-agent training as a contextual bandit using a Log Summarizer–Planner–Coder pipeline, where a trainable Planner produces complete attack strategies from compressed logs and a frozen Coder turns them into executable Python policies against live DRL defenders. Empirically, a single 7B planner substantially degrades blue-agent performance (average 522% reduction vs. static red baselines) and uncovers emergent behaviors like decoy avoidance and adaptive state prioritization that static heuristics miss.
Why it matters It demonstrates an RLVR-driven, code-generating agent that reliably breaks DRL cyber defenses and provides a benchmark/dataset, directly informing LLM security evaluation and agent robustness research.
-
DiagChain: A Diagnostic Benchmark for Evaluating LLM Agents on Evidence-Grounded Attack Chain Reconstruction
DiagChain is a diagnostic benchmark for evidence-grounded attack chain reconstruction that enables stage-wise evaluation of LLM agents, addressing limits of final-output or aggregate metrics. It introduces MAIN-69 (69 scenarios across OSes, evidence noise levels, and chain lengths), an Evidence-Centric RAG approach that ties retrieval to an evolving structured chain, and five metrics targeting distinct reconstruction stages for failure diagnosis. Evaluating six LLMs, they find the strongest setup correctly reconstructs only 39.6% of 849 reference steps, with smaller models failing to integrate retrieved evidence and larger models bottlenecked by evidence ordering.
Why it matters Offers a granular, stage-wise eval suite and methodology for security-focused LLM agents, highlighting integration vs ordering failures that current end-to-end metrics obscure.
-
On-Policy Self-Distillation without Any Supervision
This work introduces U-OPSD, an unsupervised on-policy self-distillation method that relies solely on a model’s own rollouts and internal consistency, avoiding any external supervision. It forms a pseudo-solution via majority vote under a self-consistency threshold, conditions a teacher distribution on the shortest pseudo-solution, and distills that into prefixes of the model’s longest incorrect completion to target confident errors. Across AIME24/25, HMMT25, MATH500, and AMC23, it consistently improves base models and matches or exceeds supervised OPSD and GRPO, with notable gains on Qwen3 (non-thinking and thinking modes) at 4B and 8B scales.
Why it matters Shows a practical path to post-train LLMs via on-policy self-consistency without GT, feedback, or larger teachers, directly relevant to scalable, secure alignment and distillation pipelines.
-
Align-RAG: Alignment Is All You Need for TSFM In-Context Learning
The paper introduces Align-RAG, a training-free method that applies closed-form amplitude rescaling and integer-lag phase alignment to retrieved past–future windows before feeding them to a frozen TSFM. On a frozen Chronos-Bolt, it outperforms a state-of-the-art trained retrieval adapter across seven benchmark datasets (average −3.75% MSE), and it also improves zero-shot MSE by 2.5%–13.7% on four additional frozen TSFMs without per-backbone tuning. Analysis shows aligned demonstrations induce prediction shifts in frozen backbones that track a closed-form ridge predictor on the same pairs, with a future-shuffle control ruling out futures-averaging, suggesting frozen TSFMs already support dynamic in-context use of retrievals.
Why it matters It challenges the need for learned fusion in RAG for forecasting by showing closed-form alignment on frozen backbones yields SOTA gains and ridge-like in-context adaptation, a strong baseline relevant to LLM alignment and retrieval studies.
-
What Current AI Benchmarks Leave Unmeasured: Modality, Search, Citations, and Implications (for Safety Evaluations)
The authors audit common LLM evaluation assumptions by comparing ChatGPT’s chat UI and OpenAI’s API, with and without web search, across 401 prompts from BBQ and SafetyBench and three runs per prompt, totaling 4,812 responses. Beyond accuracy, they measure response consistency, text similarity, citation grounding, and abstention, finding that chat UI was less accurate than API without search, enabling search reduced accuracy by up to 8 points and could flip modality performance trends, and repeated runs were inconsistent for up to 21% of prompts, with differing citations and abstention patterns across modalities. They conclude that relying solely on single-modality, single-run accuracy obscures important behavioral variation relevant to safety evaluations, and recommend accounting for modality, multi-run consistency, search conditions, and response-level behaviors.
Why it matters It highlights evaluation knobs—modality, search, and multi-run variability—that can confound safety and reliability claims for LLMs and are directly relevant to red-teaming, deployment risk assessments, and robust time-series-like benchmarking protocols.
-
Marginal Matching Does Not License Factorized Sampling: Auditing Conditional Style Leakage in Factorized Generative Models
The paper shows that matching a style latent’s marginal distribution to a Gaussian does not imply class-independent style, since class-conditional distributions can still carry label information. It provides an exact decomposition identifying four conditions required for factorized sampling and demonstrates that fixing marginal mismatch is necessary but insufficient. Empirically, across multiple models, datasets, and perturbations, strong marginal matching coexists with high label leakage, mitigations only partially reduce leakage, and post-hoc conditional priors or style banks variably improve class-conditional generation.
Why it matters It challenges common independence claims in factorized generative models and offers concrete audits/mitigations relevant to leakage, disentanglement, and conditional generation fidelity.
Adversarial ML
Adversarial examples, robustness, poisoning, and attacks/defenses on ML models generally (not LLM-specific).
-
Optimizing What Policies Learn From: Recoverability-aware Rollout Intervention Learning
The paper introduces Recoverability-Aware Intervention Learning (RAIL), a training-time framework that adaptively selects rollout interventions for critic-free group-based RL in LLM post-training, addressing the inefficiency of uniform rollout allocation. RAIL formulates intervention selection as an online contextual bandit and trains a recoverability controller via a shadow-to-live procedure so the controller adapts as the policy changes. Experiments show RAIL improves effectiveness, adaptivity, expressiveness, and efficiency under limited rollout budgets by generating more informative, less redundant rollouts that yield stronger learning signals.
Why it matters It offers a principled, adaptive rollout allocation mechanism that can boost post-training efficiency and signal quality—relevant to safety-aligned RLHF-style pipelines and budgeted data collection for foundation models, including time-series variants.
-
Is Self-Pretraining really useful to improve diagnosis in medical Time Series?
The paper evaluates whether SPT benefits transformer models on medical time series across three tasks (Camargo rehabilitation robotics, Non-EEG Stress, and Gait Parkinson’s Disease), comparing training from scratch vs. SPT with four masking-based objectives and varying model depth. SPT yields consistent accuracy gains of 0–6 percentage points across datasets, masking strategies, architectures, and even with univariate inputs. Gains increase with model depth, suggesting deeper models better exploit temporal representations learned during pre-training, without task-specific architectural changes.
Why it matters Shows SPT’s practicality for data-limited clinical time series and indicates masking-objective and depth-dependent gains relevant to transfer/scaling strategies in time-series FMs and robust pretraining regimes for LLM-adjacent architectures.
-
Detecting Safety Training Modification in Language Models via Activation Analysis
The paper presents AMS, an activation-space scanner that detects modifications to safety training in LLMs by measuring geometric separation and direction of safety-relevant concepts, validated across 14 configurations from Llama, Gemma, Qwen, and Mistral and four safety-mod categories. It reports 71% leave-one-out accuracy on sigma-threshold detection with median 3.4-sigma bootstrap CI width, and finds sigma on the harmful-content concept correlates with behavioral compliance on JailbreakBench (r = -0.546, p = 0.043). A mechanistic taxonomy distinguishes four modification types with distinct activation-space signatures, where Tier 1 sigma-thresholding detects collapse/rotation-plus-collapse, Tier 2 direction checks detect rotation-only, and behavioral-only fine-tunes are undetectable by activation probes, with discussion of threshold calibration and single-run limitations.
Why it matters Offers a concrete activation-geometry diagnostic for detecting safety training tampering (and its limits), tying internal metrics to jailbreak compliance—useful for red-teaming, eval pipelines, and mechanistic audits of LLM safety interventions.
-
Robust Context-Aware Detection of Malicious Instructions in Text
This work introduces a context- and query-aware sentence-level detector for malicious instructions in text, targeting IPI by segmenting benign vs. malicious sentences. It further hardens the detector with two adversarial training methods: embedding-space PGD-style feature perturbations and LLM-based paraphrase simulations, each parameterized to trade off utility and robustness. Experiments on IPI benchmarks show gains over state-of-the-art under static attacks and improved utility and lower attack success under adaptive attacks, with optimal AT parameters shown to be domain-dependent and thus requiring domain-specific tuning.
Why it matters It proposes a practical, query-relative segment classifier with AT schemes (including LLM-paraphrase-in-the-loop) that improve robustness against adaptive IPI—relevant for securing agentic LLM pipelines and for evaluating tradeoffs in domain-specific deployments.
-
Gradient Immunity: Null-Space Resistance to Malicious Fine-Tuning
The paper targets the PPOW setting where most weights are trainable but a small safety-critical component is preserved, and proposes a Unidirectional Safety Gate implemented as a Null Space Cubic Layer plus an Inverse Adapter after the final Transformer layer. The cubic layer blocks or suppresses gradients from harmful samples whose hidden states lie within a calibrated protected region (threshold set using defender-held harmful data), while the Inverse Adapter restores the base model’s forward behavior. Across six model–dataset settings, this keeps post-finetuning attack success near pre-release levels under a fixed threshold, maintains high safe-pass on easier settings, and shows a clearer safety–utility trade-off on BeaverTails unsafe samples, indicating release-time representation-space blocking can raise the cost of malicious adaptation without downstream cooperation.
Why it matters Offers a concrete, release-time gradient-blocking mechanism that preserves forward behavior while resisting malicious fine-tuning—relevant to robust alignment under open-weight releases and complementary to gradient/representation-control methods in LLM safety.
-
Enhancing Anomaly Resilience in Research Networks: A Large-Scale Forecasting Benchmark for Dynamic Security Baselining
The paper introduces a high-fidelity traffic forecasting framework to create dynamic security baselines for RENs, addressing the challenge that elephant flows resemble volumetric attacks to conventional monitors. Using a 57-day Internet2 dataset (13.7B packets across ten backbone routers), it benchmarks six forecasting model families, including SARIMA and long-sequence architectures (TiDE, PatchTST), over 960 configurations. Results show advanced models—especially TiDE—reduce baseline prediction error by 30–42% (p < 0.001) and that a new anomaly-integration strategy yields a 3.3% robustness gain under noise, improving separation of scientific bursts from anomalies.
Why it matters It provides a statistically validated, large-scale benchmark showing long-sequence LLM-adjacent forecasters (e.g., TiDE/PatchTST) materially improve dynamic baselining for REN security, informing robust anomaly detection under bursty traffic.
-
When Do PEFT Adaptations Leak Structure? Measuring Black-Box Structural Bounds in Public-Base Model Services
The paper introduces VectorHijack-SR, a black-box measurement method that turns paired victim/base residuals into calibrated bounds over PEFT family, layer locality, and coarse rank, using aggregated query-level statistics and a service-disjoint classifier plus a cross-fitted hierarchical rejector to test LoRA-manifold membership. Empirically, family leakage exceeds chance across multiple backbones/tasks, rank inference varies by task, the rejector attains AUROC 0.804 and high known-set accuracy but struggles with structurally close DoRA/LoRA+head, and exact-version linkage on held-out LoRA-r64 services reaches AUC 0.940. Despite measurable structural leakage, experiments show a visibility–exploitability gap: two-stage recovery offers no fair-budget query savings, posterior-selected PEFT underperforms distill-then-convert PEFT, and free-running generation remains near chance.
Why it matters It provides concrete, black-box evidence and metrics for structural leakage from PEFTed services with known bases, informing red-team audits, model fingerprinting, and security evaluations of adapter deployment choices.
-
Towards a Risk Assessment of Malicious Skill Files in Coding Agents
The paper studies the attack surface introduced by agent skill folders in autonomous coding agents and presents an adversarial skill-synthesis method that converts 471 real shell commands into 2,826 benign-looking skills mapped to 11 ATT&CK tactics using six LLMs. It introduces a reproducible evaluation pipeline with stratification, evidence anchoring, refusal veto, and a deterministic declared-intent override, using a three-judge LLM panel validated against a blind human gold standard (κ=0.85). In large-scale tests (5,629 runs), Gemini CLI was exploited in 95.5–96.1% and Qwen Code in 71.6–74.0% of runs with only 1.99% explicit safety recognition, and code/dataset are released at https://github.com/awsm-research/AgentJailbreak.
Why it matters Provides a validated benchmark, eval pipeline, and high-base-rate exploitation evidence for skill-file attacks in coding agents—directly relevant to LLM security evals and agentic deployment risk.
-
Hierarchical Latent Prediction for Language Models
The work argues that standard NTP’s teacher-forced training is suboptimal for long-horizon reasoning and planning, and that existing MTP and NextLat objectives either have limited horizons or suffer from compounding rollout errors. It proposes Hierarchical Latent Prediction (HiLP), introducing an auxiliary higher-level abstract latent to reduce error accumulation in latent-space rollouts. Experiments indicate HiLP yields longer-horizon coherent belief state representations, improves performance on coding and multi-step reasoning benchmarks, and enables more efficient speculative decoding.
Why it matters HiLP targets long-horizon error accumulation with a hierarchical latent rollout, offering a potentially practical auxiliary objective for robust reasoning and faster decoding compared to MTP/NextLat baselines.
-
Marginal Matching Does Not License Factorized Sampling: Auditing Conditional Style Leakage in Factorized Generative Models
The paper shows that matching a style latent’s marginal distribution to a Gaussian does not imply class-independent style, since class-conditional distributions can still carry label information. It provides an exact decomposition identifying four conditions required for factorized sampling and demonstrates that fixing marginal mismatch is necessary but insufficient. Empirically, across multiple models, datasets, and perturbations, strong marginal matching coexists with high label leakage, mitigations only partially reduce leakage, and post-hoc conditional priors or style banks variably improve class-conditional generation.
Why it matters It challenges common independence claims in factorized generative models and offers concrete audits/mitigations relevant to leakage, disentanglement, and conditional generation fidelity.
-
The Label Defines the Timescale: Trait-State Limits of Temporal-Aggregate Learning
The paper analyzes labels of temporal aggregates Θ_{g,T} built from a latent Gaussian process with a stable trait and correlated state, using an exact protocol-conditioned Bayes-risk identity. It shows label variance splits into an O(1) trait and O(T^{-1}) state component, derives task-dependent effective temporal spans (means tied to ordinary correlation time; occupation times to higher-order spectra), and proves state-driven occupation-label variance peaks at trait-threshold with window efficiency decaying slowly away from it. With a fixed segment budget, risks and simulations show repeated co-temporal segments saturate quickly while temporally dispersed observations keep improving state explainability; trait ceilings come from test-retest quantities, whereas state ceilings need short-lag calibration, implying observed limits can be protocol-driven rather than architectural.
Why it matters Clarifies when snapshot protocols fundamentally cap aggregate-label predictability and how to design observation schedules to separate architectural limits from acquisition ceilings—directly relevant to security evals of LLM temporal tasks and to designing time series foundation model benchmarks.
-
Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks
The paper introduces ARIA, an automated red-teaming framework that uses an attacker LLM with iterative, feedback-driven optimization to craft covert instruction backdoors for customized LLMs used in code intelligence. ARIA targets stealthiness, clean-task utility, and backdoor effectiveness, overcoming prior reliance on explicit triggers and manual, task-specific engineering. On three code tasks and four LLMs, ARIA attains up to 0.945 attack success while preserving utility, generalizes across languages and temperatures, and evades both platform- and user-side detection with high false negatives, remaining effective against existing defenses.
Why it matters It exposes a scalable, trigger-free pathway for robust instruction backdoors in prompt-based customization—relevant for red-teaming LLM agents and for designing defenses that go beyond simple trigger or heuristic prompt inspection.
TSFM
Time series foundation models: pretraining, zero-shot forecasting, benchmarks, architectures for time series.
-
GAUGE: Granularity-Adaptive Counterfactual Gating of Evidence for Incomplete Multimodal Classification
The paper introduces GAUGE, a lightweight counterfactual gating framework for incomplete multimodal classification that imputes missing modalities with a frozen imputer and encodes both observed and recovered inputs into fine-grained evidence units. It computes prediction-aware Taylor evidence scores to approximate the counterfactual effect of replacing each unit with a reference in a single forward-backward pass, mapping these scores to continuous gates that act as additive attention-logit biases without changing the backbone. Experiments on six benchmarks show performance gains over strong baselines under various incomplete-input settings, and a Taylor remainder analysis bounds the error of the first-order approximation relative to the exact counterfactual effect.
Why it matters Offers a principled, scalable unit-level gating mechanism for unreliable recovered signals—relevant to robust multimodal LLM pipelines and fine-grained evidence control under partial observability.
-
A Six-Dimensional Taxonomy of Post-Training Adaptation Techniques with Applications in AI Governance
This survey synthesizes post-training adaptation techniques—spanning retraining, fine-tuning, parameter-efficient adaptation, alignment, RAG, model editing, unlearning, calibration, and multimodal instruction tuning—and introduces a six-dimensional taxonomy by mechanism, goal, data requirement, persistence, structural scope, and model type. It clarifies conflated terms (e.g., fine-tuning vs. RAG vs. prompting), traces the evolution of adaptation across model eras, and maps relationships such as inheritance, supersession, hybridization, and layered deployment stacks. The work presents a vocabulary to support technical documentation, change tracking, and governance analysis, and highlights open challenges in evaluation, reproducibility, persistent inference-time adaptation, unlearning, multimodal adaptation, and governance-aware workflows.
Why it matters Provides a governance-aligned taxonomy that can standardize how LLM security adaptations (e.g., alignment, unlearning, RAG) are described, compared, and tracked across deployment stacks, aiding reproducible evaluation and auditability.
-
Multivariate Time Series Forecasting needs Cross Variable Loss
The paper argues that DF objectives used in multivariate forecasting are mismatched when future variables co-evolve via cross-variable and lagged dependencies, creating an objective gap. It introduces CvLoss, a plug-in structural regularizer that constrains forecast residuals over a cross-variable graph by penalizing inconsistent edge-wise residual differences across forecast patches, capturing both synchronous and asynchronous interactions. Experiments show CvLoss consistently improves competitive forecasting models, outperforms representative learning objectives, and is compatible with various backbones.
Why it matters Highlights an objective-level fix for multivariate forecasting that could transfer to structured loss design in LLM safety (e.g., constraint-based residual coupling) and time-series FMs where cross-variable dynamics are crucial.
-
Timestep-Conditioned Transformers for Global Weather Forecasting
The paper introduces GEM-3, a probabilistic global weather model that enables explicit multi-timestep inference, allowing the model timestep to be configured at inference to balance error accumulation and sub-daily usability. It reports that mixed-timestep training improves rollout stability compared to timestep-specialist models. GEM-3 is a ~134M parameter neighborhood-attention transformer on an equirectangular grid with architectural advances over GEM-2, achieving near-SOTA medium-range probabilistic skill, stable extended-range rollouts, efficient training/inference, and decision-relevant diagnostics.
Why it matters Timestep-conditioned inference and mixed-timestep training offer a general recipe for controllable rollout horizons and stability that could transfer to LLM planning/scheduling or time-series foundation models facing compounding-error tradeoffs.
-
Personalized Federated Sparse Adaptation of Time-Series Foundation Models
The paper proposes a personalized federated sparse adaptation framework for TSFMs in building energy forecasting, using a heterogeneous temporal MoE adapter placed after the pretrained representation and a sequence-level router that assigns each 168-hour window to top-k experts specialized for distinct temporal structures. It evaluates global FL, local training, and personalized FL variants with globally shared vs client-private expert banks across 50 buildings and three TSFM backbones. Results show personalization consistently outperforms Global FL-MoE and Local MoE, the best sparse-adaptation strategy depends on backbone and metric, and routing reveals client-level expert specialization, expert concentration, and near-uniform routing across backbones, implying adaptation should be client- and backbone-aware.
Why it matters Combines federated personalization with sparse MoE routing for TSFMs under non-IID meter data, offering actionable design signals (client-/backbone-aware adapters) relevant to secure on-device adaptation and privacy-preserving deployment.
-
Evolutionary Curriculum Learning Improves Biological Sequence Modeling
The paper introduces Evolutionary Curriculum Learning (ECL), which trains VAEs on MSAs by progressively sampling sequences at increasing evolutionary distances from anchors following a power-law schedule, instead of treating sequences as exchangeable. Applied to EVE for protein variant effect prediction and RfamGen for RNA sequence generation, ECL improves downstream metrics across seeds, including AUROC gains for ClinVar classification (p53: 0.981→0.989; PTEN: 1.000 in every seed vs baseline mean 0.905 with instability) and higher covariance-model bit scores across three RNA families. Ablations indicate that progressive distance-based expansion outperforms fixed-size neighborhood and uniform random sampling, suggesting evolutionary distance is a useful inductive bias for curriculum ordering in biological sequence modeling.
Why it matters Curriculum design based on domain structure (evolutionary distance) improves generative modeling and robustness—relevant to LLM security via curriculum/ordering effects and to time-series FMs as a blueprint for distance- or scale-aware training schedules.
-
Is Self-Pretraining really useful to improve diagnosis in medical Time Series?
The paper evaluates whether SPT benefits transformer models on medical time series across three tasks (Camargo rehabilitation robotics, Non-EEG Stress, and Gait Parkinson’s Disease), comparing training from scratch vs. SPT with four masking-based objectives and varying model depth. SPT yields consistent accuracy gains of 0–6 percentage points across datasets, masking strategies, architectures, and even with univariate inputs. Gains increase with model depth, suggesting deeper models better exploit temporal representations learned during pre-training, without task-specific architectural changes.
Why it matters Shows SPT’s practicality for data-limited clinical time series and indicates masking-objective and depth-dependent gains relevant to transfer/scaling strategies in time-series FMs and robust pretraining regimes for LLM-adjacent architectures.
-
The Label Defines the Timescale: Trait-State Limits of Temporal-Aggregate Learning
The paper analyzes labels of temporal aggregates Θ_{g,T} built from a latent Gaussian process with a stable trait and correlated state, using an exact protocol-conditioned Bayes-risk identity. It shows label variance splits into an O(1) trait and O(T^{-1}) state component, derives task-dependent effective temporal spans (means tied to ordinary correlation time; occupation times to higher-order spectra), and proves state-driven occupation-label variance peaks at trait-threshold with window efficiency decaying slowly away from it. With a fixed segment budget, risks and simulations show repeated co-temporal segments saturate quickly while temporally dispersed observations keep improving state explainability; trait ceilings come from test-retest quantities, whereas state ceilings need short-lag calibration, implying observed limits can be protocol-driven rather than architectural.
Why it matters Clarifies when snapshot protocols fundamentally cap aggregate-label predictability and how to design observation schedules to separate architectural limits from acquisition ceilings—directly relevant to security evals of LLM temporal tasks and to designing time series foundation model benchmarks.
-
MACRO: Markov Chain Routing of Transformer Layers
MACRO introduces a dynamic layer routing framework that treats routing over transformer layers as a context-dependent Markov policy enabling skips, repeats, and residual additions without modifying base model weights. The policy is trained with feedback on training data and decoded via a top-k Viterbi search to produce high-probability execution programs under computation budget phases and operator context. Across reasoning and knowledge benchmarks on multiple open-weight LLMs, MACRO yields a +5.0% average accuracy over unrouted baselines, outperforms Dr. LLM by +7.2%, and reduces route-search time 9.4x (14.8→1.6 hours).
Why it matters It offers a practical, label-free-at-inference routing mechanism that improves accuracy and efficiency without finetuning, relevant for secure, budget-aware deployment and compositional control of LLM computation.
-
Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks
The paper introduces ARIA, an automated red-teaming framework that uses an attacker LLM with iterative, feedback-driven optimization to craft covert instruction backdoors for customized LLMs used in code intelligence. ARIA targets stealthiness, clean-task utility, and backdoor effectiveness, overcoming prior reliance on explicit triggers and manual, task-specific engineering. On three code tasks and four LLMs, ARIA attains up to 0.945 attack success while preserving utility, generalizes across languages and temperatures, and evades both platform- and user-side detection with high false negatives, remaining effective against existing defenses.
Why it matters It exposes a scalable, trigger-free pathway for robust instruction backdoors in prompt-based customization—relevant for red-teaming LLM agents and for designing defenses that go beyond simple trigger or heuristic prompt inspection.
Alignment
RLHF/RLAIF, preference learning, interpretability aimed at alignment, value learning, scalable oversight.
-
Teaching Nemotron Greek: Mining a Corpus, Adapting Retrieval, and Grounding Generation for Modern Greek across Specialist Domains
The paper adapts NVIDIA’s Nemotron retrieval stack to Modern Greek via corpus mining, synthetic supervision, dense retriever training, reranker adaptation, reader fine-tuning, and introduces the HERA benchmark. It finds BM25 strong on specialist Greek corpora, but after fine-tuning on 65,773 Greek pairs, a Nemotron 1B embedder boosts nDCG@10 from 0.362 to 0.835 and transfers some gains to general-domain Greek; a cross-encoder reranker further improves results across domains. A LoRA-tuned Nemotron 30B-A3B reader improves grounded generation correctness from 29.4% to 66.9% with better faithfulness and citations, and both models and HERA are released.
Why it matters Demonstrates an end-to-end, domain-focused RAG adaptation pipeline for a low-resource language with strong empirical gains, plus a new benchmark and released models that can inform security, grounding, and retrieval design choices for multilingual and domain-specific LLM systems.
-
CircuitSteer: Geometrically Aligned Multi-Layer Steering via Sparse Autoencoder Circuits
CircuitSteer introduces a multi-layer steering framework that uses SAEs to identify coherent semantic circuits via feature co-activation and geometric alignment of decoder directions, enabling isolation of subcircuits tied to target behaviors. The method synthesizes dense steering vectors from sparse features and applies multi-point interventions to guide internal semantic trajectories. Evaluated on toxicity, emotion-intensity, sycophancy, and refusal across two model families, it uniquely achieves fluency-preserving interventions and maintains coverage where single-layer methods fail, with code released publicly.
Why it matters It proposes a geometry-aware, multi-layer circuit approach that outperforms single-point CAA-style interventions on hard behaviors (e.g., sycophancy/refusal), informing both alignment steering and circuit-level interpretability workflows.
-
On-Policy Self-Distillation without Any Supervision
This work introduces U-OPSD, an unsupervised on-policy self-distillation method that relies solely on a model’s own rollouts and internal consistency, avoiding any external supervision. It forms a pseudo-solution via majority vote under a self-consistency threshold, conditions a teacher distribution on the shortest pseudo-solution, and distills that into prefixes of the model’s longest incorrect completion to target confident errors. Across AIME24/25, HMMT25, MATH500, and AMC23, it consistently improves base models and matches or exceeds supervised OPSD and GRPO, with notable gains on Qwen3 (non-thinking and thinking modes) at 4B and 8B scales.
Why it matters Shows a practical path to post-train LLMs via on-policy self-consistency without GT, feedback, or larger teachers, directly relevant to scalable, secure alignment and distillation pipelines.
-
Align-RAG: Alignment Is All You Need for TSFM In-Context Learning
The paper introduces Align-RAG, a training-free method that applies closed-form amplitude rescaling and integer-lag phase alignment to retrieved past–future windows before feeding them to a frozen TSFM. On a frozen Chronos-Bolt, it outperforms a state-of-the-art trained retrieval adapter across seven benchmark datasets (average −3.75% MSE), and it also improves zero-shot MSE by 2.5%–13.7% on four additional frozen TSFMs without per-backbone tuning. Analysis shows aligned demonstrations induce prediction shifts in frozen backbones that track a closed-form ridge predictor on the same pairs, with a future-shuffle control ruling out futures-averaging, suggesting frozen TSFMs already support dynamic in-context use of retrievals.
Why it matters It challenges the need for learned fusion in RAG for forecasting by showing closed-form alignment on frozen backbones yields SOTA gains and ridge-like in-context adaptation, a strong baseline relevant to LLM alignment and retrieval studies.
-
Once a Response, Always a Response: Detecting LLM-generated Text via Latent Prompt Restoration
The paper introduces EchoPrompt, a training-free detector that leverages latent prompt restoration to identify LLM-generated text. It prepends a unified generic prefix to reactivate hidden prompt dependency, measures likelihood gains with an instruction-tuned model, calibrates against a base model, and aggregates differences into a score. Experiments report state-of-the-art zero-shot detection with strong robustness across challenging settings.
Why it matters It proposes a simple, training-free, model-comparison approach that exploits instruction-tuning artifacts—relevant for red-teaming, watermark alternatives, and robustness testing of LLM outputs.
-
Item Response Theory for AI Safety
The authors apply IRT to eight safety benchmarks across 192 LLMs to address duplication, correlation, and sandbagging issues in aggregated safety scores. They find three factors—refusal strictness, truthfulness, and contextual harm—explain most variance, and psychometrically selected or adaptive items can recover benchmark scores with far fewer queries, reducing evaluation cost by 97–99%. IRT further enables audits to detect naive sandbagging and model swaps behind APIs, positioning it as a toolkit for reading, reducing, and auditing safety benchmarks.
Why it matters Offers a principled, low-cost, and sandbagging-aware evaluation framework that can slot into LLM safety benchmarking and adaptive testing pipelines, relevant to both red-teaming and time-efficient eval design.
Agents
LLM agents: tool use, planning, multi-agent systems, agentic benchmarks and failure modes.
-
Detecting Safety Training Modification in Language Models via Activation Analysis
The paper presents AMS, an activation-space scanner that detects modifications to safety training in LLMs by measuring geometric separation and direction of safety-relevant concepts, validated across 14 configurations from Llama, Gemma, Qwen, and Mistral and four safety-mod categories. It reports 71% leave-one-out accuracy on sigma-threshold detection with median 3.4-sigma bootstrap CI width, and finds sigma on the harmful-content concept correlates with behavioral compliance on JailbreakBench (r = -0.546, p = 0.043). A mechanistic taxonomy distinguishes four modification types with distinct activation-space signatures, where Tier 1 sigma-thresholding detects collapse/rotation-plus-collapse, Tier 2 direction checks detect rotation-only, and behavioral-only fine-tunes are undetectable by activation probes, with discussion of threshold calibration and single-run limitations.
Why it matters Offers a concrete activation-geometry diagnostic for detecting safety training tampering (and its limits), tying internal metrics to jailbreak compliance—useful for red-teaming, eval pipelines, and mechanistic audits of LLM safety interventions.
-
Robust Context-Aware Detection of Malicious Instructions in Text
This work introduces a context- and query-aware sentence-level detector for malicious instructions in text, targeting IPI by segmenting benign vs. malicious sentences. It further hardens the detector with two adversarial training methods: embedding-space PGD-style feature perturbations and LLM-based paraphrase simulations, each parameterized to trade off utility and robustness. Experiments on IPI benchmarks show gains over state-of-the-art under static attacks and improved utility and lower attack success under adaptive attacks, with optimal AT parameters shown to be domain-dependent and thus requiring domain-specific tuning.
Why it matters It proposes a practical, query-relative segment classifier with AT schemes (including LLM-paraphrase-in-the-loop) that improve robustness against adaptive IPI—relevant for securing agentic LLM pipelines and for evaluating tradeoffs in domain-specific deployments.
-
Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming
The paper proposes PIMiner, an agentic red-teaming system for prompt injection that trains over sequences of (dataset, target model) pairs to build a strategy library from scratch. At test time, it transfers this library to unseen target LLMs without additional training and uses only a small number of target-agent queries per sample (e.g., 10). Experiments show strong ASR on IPIArena (76.2% Gemini-2.5-Pro, 61.9% GPT-5.1, 42.9% Claude-Sonnet-4.5) and AgentDojo (86.7% Gemini-2.5-Pro, 53.3% GPT-5.1, 40.0% Claude-Sonnet-4.5), outperforming RL-based approaches that generalize poorly.
Why it matters Offers a transferable, query-efficient prompt-injection attacker that challenges current RL-based red teaming and provides high-quality adversarial data for evaluating and training agent defenses.
-
SkillSentry: Adaptive Honey Worlds for Dynamic Safety Testing of Agent Skills
SkillSentry is a dynamic safety-testing framework that uses adaptive honey worlds to probe LLM agent skills for conditional, execution-time harms. It infers a skill’s intended capability boundary, builds an LLM-simulated environment with controlled decoy resources, adaptively generates tasks, and contrasts skill-enabled trajectories with matched no-skill runs, attributing suspicious behaviors to code and verified traces before deciding. Evaluated against seven scanner configurations, it attains 99.50% Recall and 96.26% average F1 on standard benchmarks, and 92.95% average F1 under semantics-preserving evasion versus 80.07% for the strongest baselines.
Why it matters Offers a practical, attribution-grounded dynamic testing approach that outperforms static/one-shot scanners, relevant for securing tool-augmented agents and adversarial evaluation pipelines.
-
Mitigating Scoring Bias in LLM-as-a-Judge via Random Number Generation
The paper addresses scoring bias in LLM-as-a-Judge by instructing an LLM to generate random number tokens and estimating its latent numerical bias from deviations from a uniform distribution. It conditions this random-number estimation on the downstream task to capture task-specific bias and then rectifies token generation probabilities during evaluation accordingly. Experiments on alignment evaluation, summarization evaluation, STS, and STR show improved performance over undebiased LLMs and prior calibration methods, and reveal that scoring bias varies by model, task, and score range.
Why it matters Offers a practical, task-conditioned calibration scheme for LLM judges that corrects numeric propensity at the token level, improving reliability over existing calibration baselines.
-
When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems
The paper introduces PoisonedEvolution, a trajectory-poisoning attack on self-evolving skill (SES) systems that distill agent trajectories into persistent skills, where an attacker with skill-level black-box access contributes bounded evidence to influence skill promotion. It formalizes artifact poisoning as requiring Inclusion, Evolution Attribution, and Realization, identifying Attribution—making target behaviors appear causally useful, recurrent, and generalizable—as the key bottleneck, and demonstrates high success embedding target behaviors across six LLM evolvers in SkillClaw (91.0% SER) and transfer to Trace2Skill (61.5% SER) at 10% attacker support. Controlled studies show three consistent attacker records in a 30-record batch suffice while one is much weaker, and ablations highlight recurring support, causal framing, and domain-aligned encoding as main success factors, framing evidence promotion as a critical security boundary for self-evolving agents.
Why it matters It pinpoints the promotion/attribution step in skill evolution as an attack surface with quantified vulnerability and transferable effects, informing defenses for agentic LLMs and data-driven skill distillation pipelines.
-
Towards a Risk Assessment of Malicious Skill Files in Coding Agents
The paper studies the attack surface introduced by agent skill folders in autonomous coding agents and presents an adversarial skill-synthesis method that converts 471 real shell commands into 2,826 benign-looking skills mapped to 11 ATT&CK tactics using six LLMs. It introduces a reproducible evaluation pipeline with stratification, evidence anchoring, refusal veto, and a deterministic declared-intent override, using a three-judge LLM panel validated against a blind human gold standard (κ=0.85). In large-scale tests (5,629 runs), Gemini CLI was exploited in 95.5–96.1% and Qwen Code in 71.6–74.0% of runs with only 1.99% explicit safety recognition, and code/dataset are released at https://github.com/awsm-research/AgentJailbreak.
Why it matters Provides a validated benchmark, eval pipeline, and high-base-rate exploitation evidence for skill-file attacks in coding agents—directly relevant to LLM security evals and agentic deployment risk.
-
A Security-Oriented Lifecycle Model for Large Language Model Systems
The paper proposes a security-oriented lifecycle model for LLM systems, organized around security-relevant boundaries rather than workflow efficiency. It defines 32 stages across Data, Model, Distribution, and Application layers, supported by a 12-stage LLMOps pillar and a 9-category governance pillar, introducing 13 new stages that surface distinct security concerns overlooked in existing frameworks. A governance mapping of NIST AI RMF, EU AI Act, and ISO/IEC 42001 shows governance evidence clusters at deployment-facing stages while critical decisions occur earlier with minimal regulatory visibility.
Why it matters Offers a concrete, stage-granular security framework and governance mapping that highlights blind spots where LLM security and alignment decisions actually get made.
-
AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection
The paper introduces AgentAntibody, an adaptive defense for LLM agents against prompt injection that learns a user-specific security boundary over time. It maintains a persistent library of “antibodies” that recognize boundary violations at runtime and trigger targeted immune responses, updating this library across encounters. Experiments on three benchmarks and four backbone LLMs report improved prevention of harmful actions while preserving legitimate task completion, even when both are task-compatible.
Why it matters Offers a practical, experience-driven defense paradigm that operationalizes evolving policy constraints, complementing static prompt- and tool-level guards familiar in LLM agent security work and aligning with continual-learning ideas in foundation models.
-
EvoHarness-RL: Learning Self-Evolving Runtime Harness for Long-Horizon LLM Agents
The paper introduces EvoHarness-RL, which learns harness policies that construct and control an external workspace for long-horizon LLM agents by exposing Belief, Progress, and Experience (BPE) as policy-facing state. The approach combines supervised harness fine-tuning to teach the action space and state construction with cost-aware GRPO to learn selective read/update/consolidation policies during runtime. On ALFWorld with Qwen3-8B, it achieves 96.9% success and surfaces harness annealing and harness evolution dynamics that shift usage toward selective external-state access and compact, task-adaptive state consolidation.
Why it matters It provides a concrete, trainable mechanism for policy-governed external state/memory/tool use—relevant to secure, long-horizon agent design where controlling information access and minimizing attack surface are central.
-
Skill-Use: Can LLMs Actually Use Skills in Agentic Harnesses?
The paper introduces Skill-Use, a benchmark that tests whether LLM agents can recognize, retrieve, and apply structured skills under progressive disclosure, separating Trigger, Compliance, and Boundary facets and combining them into an SU score that only credits execution after triggering. It comprises 79 real skills and 177 executable tasks across nine domains, run in Docker sandboxes and scored via trajectory-based rubrics, and evaluates eight LLMs across two agent harnesses. Results show reliable skill use is not yet achieved (best SU 0.613), with triggering and procedural compliance as independent bottlenecks and scores/model rankings varying by harness, indicating skill use is harness-conditioned rather than an inherent model property.
Why it matters It provides a rigorous, execution-grounded way to diagnose harness-conditioned failure modes (triggering vs. compliance vs. boundary) in tool-using LLM agents, informing both security-sensitive agent design and modular capability evaluation akin to time-series foundation model benchmarking.
-
When Does Latent Communication Pay? A Causal Audit of Relayed KV Caches in Multi-Agent LLMs
This paper causally audits claims that relayed KV caches in multi-agent LLMs transmit example-specific “latent thoughts” by swapping the relayed cache with deranged (mismatched-example), zeroed, and moment-matched random variants. When the receiver needs the sender’s private information, relays hit ceiling performance (≈100%) versus 23–25% for answer-irrelevant relays across multiple model families, checkpoints, and a document-QA setup; when not needed, a pre-registered, Holm-corrected TOST shows equivalence within 2.8 points on GSM8K, ARC-Challenge, and MedQA for Qwen3 models (with one small in-margin advantage) and no detected advantage for a second family. They show large cache effects need not be pairing effects (e.g., zeroing costs 14.7 points while mismatching costs 0.4 in one cell), and that “need” alone is insufficient for example-specific transfer, with channels ranging from ceiling (LatentMAS), partial (KVComm), to none detected (C2C), arguing that benchmark deltas do not establish latent-thought transmission without a mismatched-cache audit, which they release.
Why it matters It provides a concrete, preregistered causal audit protocol to disentangle genuine example-specific latent communication from generic cache benefits, directly informing LLM agent security/evaluation and design of time-series-style KV relay mechanisms.
-
CircuitSteer: Geometrically Aligned Multi-Layer Steering via Sparse Autoencoder Circuits
CircuitSteer introduces a multi-layer steering framework that uses SAEs to identify coherent semantic circuits via feature co-activation and geometric alignment of decoder directions, enabling isolation of subcircuits tied to target behaviors. The method synthesizes dense steering vectors from sparse features and applies multi-point interventions to guide internal semantic trajectories. Evaluated on toxicity, emotion-intensity, sycophancy, and refusal across two model families, it uniquely achieves fluency-preserving interventions and maintains coverage where single-layer methods fail, with code released publicly.
Why it matters It proposes a geometry-aware, multi-layer circuit approach that outperforms single-point CAA-style interventions on hard behaviors (e.g., sycophancy/refusal), informing both alignment steering and circuit-level interpretability workflows.
-
EnvACE: Internalizing Environment Dynamics via World Rehearsal for Agentic Reinforcement Learning
EnvACE replaces external environment interaction during training with a world rehearsal mechanism, where the policy alternates between acting (tool calls) and internally simulating environment responses, optimizing both roles end-to-end with task-success rewards. This internalized action–response mapping functions as an agent world model that supports decision making, achieving strong and transferable performance across BFCL-v4, tau^2-Bench, VitaBench, and FinMCP-Bench, outperforming environment-scaling baselines. Controlled studies show consistent gains across model scales, and at test time private rehearsal before execution yields additional improvements under a moderate rehearsal budget without extra external interaction.
Why it matters Offers a scalable alternative to environment-dependent RL for LLM agents, aligning with model-based RL and test-time planning ideas that could translate to secure tool use and to self-simulated dynamics in time-series decision settings.
-
HarnessOpt-Bench: Evaluating LLMs at Harness Optimization
The paper introduces HarnessOpt-Bench, a benchmark for end-to-end harness optimization where an LLM optimizer iteratively edits a target agent’s harness under expensive, stochastic evaluation with a fixed budget, using only graded feedback and without access to a held-out test partition. A trusted execution environment enforces evaluation boundaries, meters resource use, and preserves candidate versions for audit, and performance is measured by normalized gain over the seed harness. Evaluating five frontier LLMs across four tasks and 111 runs, the authors find optimizer models differentiate more than coding harnesses, native harnesses aren’t consistently superior, and gains vary substantially by task and seed regime, establishing harness optimization as a measurable and discriminative capability with room for improvement.
Why it matters It provides a rigorous, auditable setup to compare LLMs’ agentic self-improvement under realistic noisy/expensive evals—relevant for secure agent orchestration and optimizing time-series/tool-using pipelines.
-
When Self-Evolution Backfires: Pre-Commit Gating against Skill Contamination in LLM Agents
The paper shows that self-evolving LLM agents experience a capability-contamination phase transition: beyond a critical pool size, newly distilled skills degrade performance due to defective skills seeding cross-round contamination chains. They demonstrate structural irreversibility, where post-hoc removal of source skills recovers only a small fraction of performance, motivating pre-commit gating via Verifier-as-Gatekeeper (VaG) with three heterogeneous critics and marginal-gain subset selection. On Terminal-Bench 2, unconditional accumulation peaks then degrades with limited rollback recovery, while VaG improves every round to 72% pass@1 with a ~5x smaller pool and transfers positively to other backbones and a second benchmark, with ablations showing the critics are complementary and non-substitutable.
Why it matters It surfaces an irreversible contamination mechanism in skill distillation and proposes a concrete pre-commit gating framework that stabilizes agent evolution and transfers across models/benchmarks, directly relevant to secure, scalable LLM agent training and model-based control of evolving skill libraries.
-
DBLAST: Dependent Block Drafting for Stochastic Speculative Decoding
The paper analyzes speculative decoding with block/diffusion drafters and shows that assuming conditional independence across drafted positions breaks down under non-greedy, higher-entropy target sampling, reducing accepted draft length. It introduces DBLAST, a dependent block drafter using a low-rank latent mixture over token positions plus an acceptance-oriented objective that optimizes expected verified length. Experiments on Qwen3-4B/8B across GSM8K, MT-Bench, HumanEval, and creative-writing benchmarks report consistent gains in accepted length over independent block sampling, particularly at higher entropy.
Why it matters It targets stochastic decoding efficiency—key for secure, diverse sampling and alignment workflows—by improving acceptance rates under high-entropy regimes, informing both LLM safety pipelines and efficient inference design.
-
EdgeXpert: An Edge Device for Memory-Efficient LLM Inference with Mixture-of-Experts and Speculative Decoding
EdgeXpert is a software-hardware co-designed LLM accelerator targeting the EMA bottleneck in FFN layers for on-device inference, combining speculative decoding with MoE despite their typical incompatibility. In prefill, it uses prompt-wise expert reuse by selecting important tokens via a lightweight encoder to build a shared expert set and routes less important tokens with a reduced expert budget to cut expert EMA; in decode, depth-aware expert coalescing loads only salient channels across same-depth speculative candidates and applies computational calibration to maintain accuracy without extra memory access. Implemented in Samsung 28nm at 800 MHz, EdgeXpert reports up to 56.3% latency and 44.1% energy reductions versus prior work while maintaining near-baseline accuracy.
Why it matters It offers a practical path to marry MoE with speculative decoding for memory-bound edge inference, yielding sizable latency/energy gains relevant to secure, private on-device LLM deployment and efficient time-sensitive workloads.
-
Trident : How to Break Deep Reinforcement Learning Cyber Defenses (Agentic)
The paper introduces Trident, an agentic LLM red-teaming framework for evaluating DRL-based cyber defenses, consisting of a dynamic benchmark across CybORG CAGE 4 and CyberWheel, a dataset of 13k+ red-blue trajectories for RLVR, and a Code-as-Policy RLVR architecture. Trident reframes red-agent training as a contextual bandit using a Log Summarizer–Planner–Coder pipeline, where a trainable Planner produces complete attack strategies from compressed logs and a frozen Coder turns them into executable Python policies against live DRL defenders. Empirically, a single 7B planner substantially degrades blue-agent performance (average 522% reduction vs. static red baselines) and uncovers emergent behaviors like decoy avoidance and adaptive state prioritization that static heuristics miss.
Why it matters It demonstrates an RLVR-driven, code-generating agent that reliably breaks DRL cyber defenses and provides a benchmark/dataset, directly informing LLM security evaluation and agent robustness research.
-
DiagChain: A Diagnostic Benchmark for Evaluating LLM Agents on Evidence-Grounded Attack Chain Reconstruction
DiagChain is a diagnostic benchmark for evidence-grounded attack chain reconstruction that enables stage-wise evaluation of LLM agents, addressing limits of final-output or aggregate metrics. It introduces MAIN-69 (69 scenarios across OSes, evidence noise levels, and chain lengths), an Evidence-Centric RAG approach that ties retrieval to an evolving structured chain, and five metrics targeting distinct reconstruction stages for failure diagnosis. Evaluating six LLMs, they find the strongest setup correctly reconstructs only 39.6% of 849 reference steps, with smaller models failing to integrate retrieved evidence and larger models bottlenecked by evidence ordering.
Why it matters Offers a granular, stage-wise eval suite and methodology for security-focused LLM agents, highlighting integration vs ordering failures that current end-to-end metrics obscure.
-
Align-RAG: Alignment Is All You Need for TSFM In-Context Learning
The paper introduces Align-RAG, a training-free method that applies closed-form amplitude rescaling and integer-lag phase alignment to retrieved past–future windows before feeding them to a frozen TSFM. On a frozen Chronos-Bolt, it outperforms a state-of-the-art trained retrieval adapter across seven benchmark datasets (average −3.75% MSE), and it also improves zero-shot MSE by 2.5%–13.7% on four additional frozen TSFMs without per-backbone tuning. Analysis shows aligned demonstrations induce prediction shifts in frozen backbones that track a closed-form ridge predictor on the same pairs, with a future-shuffle control ruling out futures-averaging, suggesting frozen TSFMs already support dynamic in-context use of retrievals.
Why it matters It challenges the need for learned fusion in RAG for forecasting by showing closed-form alignment on frozen backbones yields SOTA gains and ridge-like in-context adaptation, a strong baseline relevant to LLM alignment and retrieval studies.
-
Agentic Bayesian Optimization through Surrogate-Augmented Autoresearch
The paper proposes agentic Bayesian optimization, where an LLM agent orchestrates the BO loop while a Bayesian backend supplies uncertainty-aware search, enabling dynamic reconfiguration (bounds, acquisition, targeted evals, or reframing) during runs. They implement this with Sara, a surrogate-augmented autoresearch agent, and lenz, a modular BoTorch-based backend exposing a structured, inspectable interface. On synthetic and real tasks, Sara matches SOTA BO without priors, beats LLM-based baselines, leverages natural-language priors to surpass standard BO, and adapts to changing requirements by reconfiguring the optimization problem on the fly.
Why it matters Bridges LLM agenticity with principled BO, offering a practical path to inject NL/code priors and dynamic task reconfiguration without sacrificing uncertainty-driven reliability—relevant for secure, adaptive tuning of LLM systems and time-series model pipelines.
-
MACRO: Markov Chain Routing of Transformer Layers
MACRO introduces a dynamic layer routing framework that treats routing over transformer layers as a context-dependent Markov policy enabling skips, repeats, and residual additions without modifying base model weights. The policy is trained with feedback on training data and decoded via a top-k Viterbi search to produce high-probability execution programs under computation budget phases and operator context. Across reasoning and knowledge benchmarks on multiple open-weight LLMs, MACRO yields a +5.0% average accuracy over unrouted baselines, outperforms Dr. LLM by +7.2%, and reduces route-search time 9.4x (14.8→1.6 hours).
Why it matters It offers a practical, label-free-at-inference routing mechanism that improves accuracy and efficiency without finetuning, relevant for secure, budget-aware deployment and compositional control of LLM computation.
-
DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model
DreamGuard is a proactive runtime guardrail for LLM agents that uses a risk-aware world model to track a compact recurrent latent state over trajectories and forecast future latent states. From these forecasts, it derives immediate-hazard and prefix-risk evidence and fuses multi-horizon signals to decide on interventions before tool executions. Across four benchmarks and an online evaluation, DreamGuard outperforms generic, reactive, and proactive baselines with the best safety-utility trade-off and averages 25 ms end-to-end latency per call.
Why it matters Introduces a trajectory-aware, low-latency guardrail with explicit risk modeling, aligning with interests in long-horizon safety for LLM agents and bridging to sequence modeling ideas from time series foundation models.
-
FOCUS: Decoupling Expert Personas in LLMs to Enhance Domain Expert Capabilities
The paper introduces FOCUS, a method that extracts expert persona vectors from LLMs, orthogonally decouples domain-specific personas to reduce cross-domain coupling, and adds an expert gating module for context-adaptive activation. It uses a two-stage training strategy with a gated selection regularizer to learn when to activate appropriate personas for single- and cross-domain tasks. Experiments on financial, legal, medical, and cross-domain benchmarks report improved task accuracy over existing persona control methods, with code available at the provided link.
Why it matters It proposes an orthogonal persona decomposition plus gating approach that could reduce harmful cross-domain behavioral bleed-through—relevant for secure expert activation and controllable capabilities in LLMs and potentially adaptable to modular time-series experts.
-
Item Response Theory for AI Safety
The authors apply IRT to eight safety benchmarks across 192 LLMs to address duplication, correlation, and sandbagging issues in aggregated safety scores. They find three factors—refusal strictness, truthfulness, and contextual harm—explain most variance, and psychometrically selected or adaptive items can recover benchmark scores with far fewer queries, reducing evaluation cost by 97–99%. IRT further enables audits to detect naive sandbagging and model swaps behind APIs, positioning it as a toolkit for reading, reducing, and auditing safety benchmarks.
Why it matters Offers a principled, low-cost, and sandbagging-aware evaluation framework that can slot into LLM safety benchmarking and adaptive testing pipelines, relevant to both red-teaming and time-efficient eval design.
Efficiency
Inference/training efficiency: quantization, distillation, sparsity, serving systems, hardware-aware methods.
-
GAUGE: Granularity-Adaptive Counterfactual Gating of Evidence for Incomplete Multimodal Classification
The paper introduces GAUGE, a lightweight counterfactual gating framework for incomplete multimodal classification that imputes missing modalities with a frozen imputer and encodes both observed and recovered inputs into fine-grained evidence units. It computes prediction-aware Taylor evidence scores to approximate the counterfactual effect of replacing each unit with a reference in a single forward-backward pass, mapping these scores to continuous gates that act as additive attention-logit biases without changing the backbone. Experiments on six benchmarks show performance gains over strong baselines under various incomplete-input settings, and a Taylor remainder analysis bounds the error of the first-order approximation relative to the exact counterfactual effect.
Why it matters Offers a principled, scalable unit-level gating mechanism for unreliable recovered signals—relevant to robust multimodal LLM pipelines and fine-grained evidence control under partial observability.
-
A Six-Dimensional Taxonomy of Post-Training Adaptation Techniques with Applications in AI Governance
This survey synthesizes post-training adaptation techniques—spanning retraining, fine-tuning, parameter-efficient adaptation, alignment, RAG, model editing, unlearning, calibration, and multimodal instruction tuning—and introduces a six-dimensional taxonomy by mechanism, goal, data requirement, persistence, structural scope, and model type. It clarifies conflated terms (e.g., fine-tuning vs. RAG vs. prompting), traces the evolution of adaptation across model eras, and maps relationships such as inheritance, supersession, hybridization, and layered deployment stacks. The work presents a vocabulary to support technical documentation, change tracking, and governance analysis, and highlights open challenges in evaluation, reproducibility, persistent inference-time adaptation, unlearning, multimodal adaptation, and governance-aware workflows.
Why it matters Provides a governance-aligned taxonomy that can standardize how LLM security adaptations (e.g., alignment, unlearning, RAG) are described, compared, and tracked across deployment stacks, aiding reproducible evaluation and auditability.
-
EvoHarness-RL: Learning Self-Evolving Runtime Harness for Long-Horizon LLM Agents
The paper introduces EvoHarness-RL, which learns harness policies that construct and control an external workspace for long-horizon LLM agents by exposing Belief, Progress, and Experience (BPE) as policy-facing state. The approach combines supervised harness fine-tuning to teach the action space and state construction with cost-aware GRPO to learn selective read/update/consolidation policies during runtime. On ALFWorld with Qwen3-8B, it achieves 96.9% success and surfaces harness annealing and harness evolution dynamics that shift usage toward selective external-state access and compact, task-adaptive state consolidation.
Why it matters It provides a concrete, trainable mechanism for policy-governed external state/memory/tool use—relevant to secure, long-horizon agent design where controlling information access and minimizing attack surface are central.
-
Personalized Federated Sparse Adaptation of Time-Series Foundation Models
The paper proposes a personalized federated sparse adaptation framework for TSFMs in building energy forecasting, using a heterogeneous temporal MoE adapter placed after the pretrained representation and a sequence-level router that assigns each 168-hour window to top-k experts specialized for distinct temporal structures. It evaluates global FL, local training, and personalized FL variants with globally shared vs client-private expert banks across 50 buildings and three TSFM backbones. Results show personalization consistently outperforms Global FL-MoE and Local MoE, the best sparse-adaptation strategy depends on backbone and metric, and routing reveals client-level expert specialization, expert concentration, and near-uniform routing across backbones, implying adaptation should be client- and backbone-aware.
Why it matters Combines federated personalization with sparse MoE routing for TSFMs under non-IID meter data, offering actionable design signals (client-/backbone-aware adapters) relevant to secure on-device adaptation and privacy-preserving deployment.
-
Evolutionary Curriculum Learning Improves Biological Sequence Modeling
The paper introduces Evolutionary Curriculum Learning (ECL), which trains VAEs on MSAs by progressively sampling sequences at increasing evolutionary distances from anchors following a power-law schedule, instead of treating sequences as exchangeable. Applied to EVE for protein variant effect prediction and RfamGen for RNA sequence generation, ECL improves downstream metrics across seeds, including AUROC gains for ClinVar classification (p53: 0.981→0.989; PTEN: 1.000 in every seed vs baseline mean 0.905 with instability) and higher covariance-model bit scores across three RNA families. Ablations indicate that progressive distance-based expansion outperforms fixed-size neighborhood and uniform random sampling, suggesting evolutionary distance is a useful inductive bias for curriculum ordering in biological sequence modeling.
Why it matters Curriculum design based on domain structure (evolutionary distance) improves generative modeling and robustness—relevant to LLM security via curriculum/ordering effects and to time-series FMs as a blueprint for distance- or scale-aware training schedules.
-
EnvACE: Internalizing Environment Dynamics via World Rehearsal for Agentic Reinforcement Learning
EnvACE replaces external environment interaction during training with a world rehearsal mechanism, where the policy alternates between acting (tool calls) and internally simulating environment responses, optimizing both roles end-to-end with task-success rewards. This internalized action–response mapping functions as an agent world model that supports decision making, achieving strong and transferable performance across BFCL-v4, tau^2-Bench, VitaBench, and FinMCP-Bench, outperforming environment-scaling baselines. Controlled studies show consistent gains across model scales, and at test time private rehearsal before execution yields additional improvements under a moderate rehearsal budget without extra external interaction.
Why it matters Offers a scalable alternative to environment-dependent RL for LLM agents, aligning with model-based RL and test-time planning ideas that could translate to secure tool use and to self-simulated dynamics in time-series decision settings.
-
DBLAST: Dependent Block Drafting for Stochastic Speculative Decoding
The paper analyzes speculative decoding with block/diffusion drafters and shows that assuming conditional independence across drafted positions breaks down under non-greedy, higher-entropy target sampling, reducing accepted draft length. It introduces DBLAST, a dependent block drafter using a low-rank latent mixture over token positions plus an acceptance-oriented objective that optimizes expected verified length. Experiments on Qwen3-4B/8B across GSM8K, MT-Bench, HumanEval, and creative-writing benchmarks report consistent gains in accepted length over independent block sampling, particularly at higher entropy.
Why it matters It targets stochastic decoding efficiency—key for secure, diverse sampling and alignment workflows—by improving acceptance rates under high-entropy regimes, informing both LLM safety pipelines and efficient inference design.
-
Is Self-Pretraining really useful to improve diagnosis in medical Time Series?
The paper evaluates whether SPT benefits transformer models on medical time series across three tasks (Camargo rehabilitation robotics, Non-EEG Stress, and Gait Parkinson’s Disease), comparing training from scratch vs. SPT with four masking-based objectives and varying model depth. SPT yields consistent accuracy gains of 0–6 percentage points across datasets, masking strategies, architectures, and even with univariate inputs. Gains increase with model depth, suggesting deeper models better exploit temporal representations learned during pre-training, without task-specific architectural changes.
Why it matters Shows SPT’s practicality for data-limited clinical time series and indicates masking-objective and depth-dependent gains relevant to transfer/scaling strategies in time-series FMs and robust pretraining regimes for LLM-adjacent architectures.
-
Agentic Bayesian Optimization through Surrogate-Augmented Autoresearch
The paper proposes agentic Bayesian optimization, where an LLM agent orchestrates the BO loop while a Bayesian backend supplies uncertainty-aware search, enabling dynamic reconfiguration (bounds, acquisition, targeted evals, or reframing) during runs. They implement this with Sara, a surrogate-augmented autoresearch agent, and lenz, a modular BoTorch-based backend exposing a structured, inspectable interface. On synthetic and real tasks, Sara matches SOTA BO without priors, beats LLM-based baselines, leverages natural-language priors to surpass standard BO, and adapts to changing requirements by reconfiguring the optimization problem on the fly.
Why it matters Bridges LLM agenticity with principled BO, offering a practical path to inject NL/code priors and dynamic task reconfiguration without sacrificing uncertainty-driven reliability—relevant for secure, adaptive tuning of LLM systems and time-series model pipelines.
-
MACRO: Markov Chain Routing of Transformer Layers
MACRO introduces a dynamic layer routing framework that treats routing over transformer layers as a context-dependent Markov policy enabling skips, repeats, and residual additions without modifying base model weights. The policy is trained with feedback on training data and decoded via a top-k Viterbi search to produce high-probability execution programs under computation budget phases and operator context. Across reasoning and knowledge benchmarks on multiple open-weight LLMs, MACRO yields a +5.0% average accuracy over unrouted baselines, outperforms Dr. LLM by +7.2%, and reduces route-search time 9.4x (14.8→1.6 hours).
Why it matters It offers a practical, label-free-at-inference routing mechanism that improves accuracy and efficiency without finetuning, relevant for secure, budget-aware deployment and compositional control of LLM computation.
-
DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model
DreamGuard is a proactive runtime guardrail for LLM agents that uses a risk-aware world model to track a compact recurrent latent state over trajectories and forecast future latent states. From these forecasts, it derives immediate-hazard and prefix-risk evidence and fuses multi-horizon signals to decide on interventions before tool executions. Across four benchmarks and an online evaluation, DreamGuard outperforms generic, reactive, and proactive baselines with the best safety-utility trade-off and averages 25 ms end-to-end latency per call.
Why it matters Introduces a trajectory-aware, low-latency guardrail with explicit risk modeling, aligning with interests in long-horizon safety for LLM agents and bridging to sequence modeling ideas from time series foundation models.
-
FOCUS: Decoupling Expert Personas in LLMs to Enhance Domain Expert Capabilities
The paper introduces FOCUS, a method that extracts expert persona vectors from LLMs, orthogonally decouples domain-specific personas to reduce cross-domain coupling, and adds an expert gating module for context-adaptive activation. It uses a two-stage training strategy with a gated selection regularizer to learn when to activate appropriate personas for single- and cross-domain tasks. Experiments on financial, legal, medical, and cross-domain benchmarks report improved task accuracy over existing persona control methods, with code available at the provided link.
Why it matters It proposes an orthogonal persona decomposition plus gating approach that could reduce harmful cross-domain behavioral bleed-through—relevant for secure expert activation and controllable capabilities in LLMs and potentially adaptable to modular time-series experts.
-
Item Response Theory for AI Safety
The authors apply IRT to eight safety benchmarks across 192 LLMs to address duplication, correlation, and sandbagging issues in aggregated safety scores. They find three factors—refusal strictness, truthfulness, and contextual harm—explain most variance, and psychometrically selected or adaptive items can recover benchmark scores with far fewer queries, reducing evaluation cost by 97–99%. IRT further enables audits to detect naive sandbagging and model swaps behind APIs, positioning it as a toolkit for reading, reducing, and auditing safety benchmarks.
Why it matters Offers a principled, low-cost, and sandbagging-aware evaluation framework that can slot into LLM safety benchmarking and adaptive testing pipelines, relevant to both red-teaming and time-efficient eval design.
Evaluation
Benchmarks, evaluation methodology, dataset/leakage critique, LLM-as-judge.
-
Robust Context-Aware Detection of Malicious Instructions in Text
This work introduces a context- and query-aware sentence-level detector for malicious instructions in text, targeting IPI by segmenting benign vs. malicious sentences. It further hardens the detector with two adversarial training methods: embedding-space PGD-style feature perturbations and LLM-based paraphrase simulations, each parameterized to trade off utility and robustness. Experiments on IPI benchmarks show gains over state-of-the-art under static attacks and improved utility and lower attack success under adaptive attacks, with optimal AT parameters shown to be domain-dependent and thus requiring domain-specific tuning.
Why it matters It proposes a practical, query-relative segment classifier with AT schemes (including LLM-paraphrase-in-the-loop) that improve robustness against adaptive IPI—relevant for securing agentic LLM pipelines and for evaluating tradeoffs in domain-specific deployments.
-
Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming
The paper proposes PIMiner, an agentic red-teaming system for prompt injection that trains over sequences of (dataset, target model) pairs to build a strategy library from scratch. At test time, it transfers this library to unseen target LLMs without additional training and uses only a small number of target-agent queries per sample (e.g., 10). Experiments show strong ASR on IPIArena (76.2% Gemini-2.5-Pro, 61.9% GPT-5.1, 42.9% Claude-Sonnet-4.5) and AgentDojo (86.7% Gemini-2.5-Pro, 53.3% GPT-5.1, 40.0% Claude-Sonnet-4.5), outperforming RL-based approaches that generalize poorly.
Why it matters Offers a transferable, query-efficient prompt-injection attacker that challenges current RL-based red teaming and provides high-quality adversarial data for evaluating and training agent defenses.
-
SkillSentry: Adaptive Honey Worlds for Dynamic Safety Testing of Agent Skills
SkillSentry is a dynamic safety-testing framework that uses adaptive honey worlds to probe LLM agent skills for conditional, execution-time harms. It infers a skill’s intended capability boundary, builds an LLM-simulated environment with controlled decoy resources, adaptively generates tasks, and contrasts skill-enabled trajectories with matched no-skill runs, attributing suspicious behaviors to code and verified traces before deciding. Evaluated against seven scanner configurations, it attains 99.50% Recall and 96.26% average F1 on standard benchmarks, and 92.95% average F1 under semantics-preserving evasion versus 80.07% for the strongest baselines.
Why it matters Offers a practical, attribution-grounded dynamic testing approach that outperforms static/one-shot scanners, relevant for securing tool-augmented agents and adversarial evaluation pipelines.
-
GAUGE: Granularity-Adaptive Counterfactual Gating of Evidence for Incomplete Multimodal Classification
The paper introduces GAUGE, a lightweight counterfactual gating framework for incomplete multimodal classification that imputes missing modalities with a frozen imputer and encodes both observed and recovered inputs into fine-grained evidence units. It computes prediction-aware Taylor evidence scores to approximate the counterfactual effect of replacing each unit with a reference in a single forward-backward pass, mapping these scores to continuous gates that act as additive attention-logit biases without changing the backbone. Experiments on six benchmarks show performance gains over strong baselines under various incomplete-input settings, and a Taylor remainder analysis bounds the error of the first-order approximation relative to the exact counterfactual effect.
Why it matters Offers a principled, scalable unit-level gating mechanism for unreliable recovered signals—relevant to robust multimodal LLM pipelines and fine-grained evidence control under partial observability.
-
Temporal Leakage in LLM Backtesting: Measurement, Validation, and Adjusted Scores
The usual pre/post-cutoff contamination check in LLM backtests is uninformative, as flagship models fail it even on post-cutoff questions due to structural recency effects, and no passive backtest can disentangle recency or leakage from genuine skill. The authors introduce two external-information approaches: using a known cutoff to identify boundary leakage and a matched clean control to estimate global leakage and produce leakage-adjusted scores, along with a characterization showing leakage concentrates on surprising, well-covered outcomes and that partial memorization is over-rewarded. They validate via twin-model leakage injection and find recovery of the planted dose with nulls on clean items, then apply to frontier models, detecting one cutoff-localized signature while clearing five models whose apparent gains were due to recency, concluding that backtests remain viable given a defensible reference.
Why it matters It offers concrete, validated estimators and an adjustment recipe to separate recency from leakage, directly improving LLM security audits and forecasting/time-series backtesting of foundation models.
-
Mitigating Scoring Bias in LLM-as-a-Judge via Random Number Generation
The paper addresses scoring bias in LLM-as-a-Judge by instructing an LLM to generate random number tokens and estimating its latent numerical bias from deviations from a uniform distribution. It conditions this random-number estimation on the downstream task to capture task-specific bias and then rectifies token generation probabilities during evaluation accordingly. Experiments on alignment evaluation, summarization evaluation, STS, and STR show improved performance over undebiased LLMs and prior calibration methods, and reveal that scoring bias varies by model, task, and score range.
Why it matters Offers a practical, task-conditioned calibration scheme for LLM judges that corrects numeric propensity at the token level, improving reliability over existing calibration baselines.
-
Teaching Nemotron Greek: Mining a Corpus, Adapting Retrieval, and Grounding Generation for Modern Greek across Specialist Domains
The paper adapts NVIDIA’s Nemotron retrieval stack to Modern Greek via corpus mining, synthetic supervision, dense retriever training, reranker adaptation, reader fine-tuning, and introduces the HERA benchmark. It finds BM25 strong on specialist Greek corpora, but after fine-tuning on 65,773 Greek pairs, a Nemotron 1B embedder boosts nDCG@10 from 0.362 to 0.835 and transfers some gains to general-domain Greek; a cross-encoder reranker further improves results across domains. A LoRA-tuned Nemotron 30B-A3B reader improves grounded generation correctness from 29.4% to 66.9% with better faithfulness and citations, and both models and HERA are released.
Why it matters Demonstrates an end-to-end, domain-focused RAG adaptation pipeline for a low-resource language with strong empirical gains, plus a new benchmark and released models that can inform security, grounding, and retrieval design choices for multilingual and domain-specific LLM systems.
-
Enhancing Anomaly Resilience in Research Networks: A Large-Scale Forecasting Benchmark for Dynamic Security Baselining
The paper introduces a high-fidelity traffic forecasting framework to create dynamic security baselines for RENs, addressing the challenge that elephant flows resemble volumetric attacks to conventional monitors. Using a 57-day Internet2 dataset (13.7B packets across ten backbone routers), it benchmarks six forecasting model families, including SARIMA and long-sequence architectures (TiDE, PatchTST), over 960 configurations. Results show advanced models—especially TiDE—reduce baseline prediction error by 30–42% (p < 0.001) and that a new anomaly-integration strategy yields a 3.3% robustness gain under noise, improving separation of scientific bursts from anomalies.
Why it matters It provides a statistically validated, large-scale benchmark showing long-sequence LLM-adjacent forecasters (e.g., TiDE/PatchTST) materially improve dynamic baselining for REN security, informing robust anomaly detection under bursty traffic.
-
When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems
The paper introduces PoisonedEvolution, a trajectory-poisoning attack on self-evolving skill (SES) systems that distill agent trajectories into persistent skills, where an attacker with skill-level black-box access contributes bounded evidence to influence skill promotion. It formalizes artifact poisoning as requiring Inclusion, Evolution Attribution, and Realization, identifying Attribution—making target behaviors appear causally useful, recurrent, and generalizable—as the key bottleneck, and demonstrates high success embedding target behaviors across six LLM evolvers in SkillClaw (91.0% SER) and transfer to Trace2Skill (61.5% SER) at 10% attacker support. Controlled studies show three consistent attacker records in a 30-record batch suffice while one is much weaker, and ablations highlight recurring support, causal framing, and domain-aligned encoding as main success factors, framing evidence promotion as a critical security boundary for self-evolving agents.
Why it matters It pinpoints the promotion/attribution step in skill evolution as an attack surface with quantified vulnerability and transferable effects, informing defenses for agentic LLMs and data-driven skill distillation pipelines.
-
When Do PEFT Adaptations Leak Structure? Measuring Black-Box Structural Bounds in Public-Base Model Services
The paper introduces VectorHijack-SR, a black-box measurement method that turns paired victim/base residuals into calibrated bounds over PEFT family, layer locality, and coarse rank, using aggregated query-level statistics and a service-disjoint classifier plus a cross-fitted hierarchical rejector to test LoRA-manifold membership. Empirically, family leakage exceeds chance across multiple backbones/tasks, rank inference varies by task, the rejector attains AUROC 0.804 and high known-set accuracy but struggles with structurally close DoRA/LoRA+head, and exact-version linkage on held-out LoRA-r64 services reaches AUC 0.940. Despite measurable structural leakage, experiments show a visibility–exploitability gap: two-stage recovery offers no fair-budget query savings, posterior-selected PEFT underperforms distill-then-convert PEFT, and free-running generation remains near chance.
Why it matters It provides concrete, black-box evidence and metrics for structural leakage from PEFTed services with known bases, informing red-team audits, model fingerprinting, and security evaluations of adapter deployment choices.
-
A Security-Oriented Lifecycle Model for Large Language Model Systems
The paper proposes a security-oriented lifecycle model for LLM systems, organized around security-relevant boundaries rather than workflow efficiency. It defines 32 stages across Data, Model, Distribution, and Application layers, supported by a 12-stage LLMOps pillar and a 9-category governance pillar, introducing 13 new stages that surface distinct security concerns overlooked in existing frameworks. A governance mapping of NIST AI RMF, EU AI Act, and ISO/IEC 42001 shows governance evidence clusters at deployment-facing stages while critical decisions occur earlier with minimal regulatory visibility.
Why it matters Offers a concrete, stage-granular security framework and governance mapping that highlights blind spots where LLM security and alignment decisions actually get made.
-
AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection
The paper introduces AgentAntibody, an adaptive defense for LLM agents against prompt injection that learns a user-specific security boundary over time. It maintains a persistent library of “antibodies” that recognize boundary violations at runtime and trigger targeted immune responses, updating this library across encounters. Experiments on three benchmarks and four backbone LLMs report improved prevention of harmful actions while preserving legitimate task completion, even when both are task-compatible.
Why it matters Offers a practical, experience-driven defense paradigm that operationalizes evolving policy constraints, complementing static prompt- and tool-level guards familiar in LLM agent security work and aligning with continual-learning ideas in foundation models.
-
Multivariate Time Series Forecasting needs Cross Variable Loss
The paper argues that DF objectives used in multivariate forecasting are mismatched when future variables co-evolve via cross-variable and lagged dependencies, creating an objective gap. It introduces CvLoss, a plug-in structural regularizer that constrains forecast residuals over a cross-variable graph by penalizing inconsistent edge-wise residual differences across forecast patches, capturing both synchronous and asynchronous interactions. Experiments show CvLoss consistently improves competitive forecasting models, outperforms representative learning objectives, and is compatible with various backbones.
Why it matters Highlights an objective-level fix for multivariate forecasting that could transfer to structured loss design in LLM safety (e.g., constraint-based residual coupling) and time-series FMs where cross-variable dynamics are crucial.
-
Hierarchical Latent Prediction for Language Models
The work argues that standard NTP’s teacher-forced training is suboptimal for long-horizon reasoning and planning, and that existing MTP and NextLat objectives either have limited horizons or suffer from compounding rollout errors. It proposes Hierarchical Latent Prediction (HiLP), introducing an auxiliary higher-level abstract latent to reduce error accumulation in latent-space rollouts. Experiments indicate HiLP yields longer-horizon coherent belief state representations, improves performance on coding and multi-step reasoning benchmarks, and enables more efficient speculative decoding.
Why it matters HiLP targets long-horizon error accumulation with a hierarchical latent rollout, offering a potentially practical auxiliary objective for robust reasoning and faster decoding compared to MTP/NextLat baselines.
-
Skill-Use: Can LLMs Actually Use Skills in Agentic Harnesses?
The paper introduces Skill-Use, a benchmark that tests whether LLM agents can recognize, retrieve, and apply structured skills under progressive disclosure, separating Trigger, Compliance, and Boundary facets and combining them into an SU score that only credits execution after triggering. It comprises 79 real skills and 177 executable tasks across nine domains, run in Docker sandboxes and scored via trajectory-based rubrics, and evaluates eight LLMs across two agent harnesses. Results show reliable skill use is not yet achieved (best SU 0.613), with triggering and procedural compliance as independent bottlenecks and scores/model rankings varying by harness, indicating skill use is harness-conditioned rather than an inherent model property.
Why it matters It provides a rigorous, execution-grounded way to diagnose harness-conditioned failure modes (triggering vs. compliance vs. boundary) in tool-using LLM agents, informing both security-sensitive agent design and modular capability evaluation akin to time-series foundation model benchmarking.
-
When Does Latent Communication Pay? A Causal Audit of Relayed KV Caches in Multi-Agent LLMs
This paper causally audits claims that relayed KV caches in multi-agent LLMs transmit example-specific “latent thoughts” by swapping the relayed cache with deranged (mismatched-example), zeroed, and moment-matched random variants. When the receiver needs the sender’s private information, relays hit ceiling performance (≈100%) versus 23–25% for answer-irrelevant relays across multiple model families, checkpoints, and a document-QA setup; when not needed, a pre-registered, Holm-corrected TOST shows equivalence within 2.8 points on GSM8K, ARC-Challenge, and MedQA for Qwen3 models (with one small in-margin advantage) and no detected advantage for a second family. They show large cache effects need not be pairing effects (e.g., zeroing costs 14.7 points while mismatching costs 0.4 in one cell), and that “need” alone is insufficient for example-specific transfer, with channels ranging from ceiling (LatentMAS), partial (KVComm), to none detected (C2C), arguing that benchmark deltas do not establish latent-thought transmission without a mismatched-cache audit, which they release.
Why it matters It provides a concrete, preregistered causal audit protocol to disentangle genuine example-specific latent communication from generic cache benefits, directly informing LLM agent security/evaluation and design of time-series-style KV relay mechanisms.
-
FBID: Adaptive Personalized Federated Learning for Robust Out-of-Distribution Attack Detection in IoT Networks
The paper introduces FBID, an adaptive PFL framework that uses server-side personalization control to avoid over-personalization and OOD detection degradation in heterogeneous IoT intrusion detection. It employs a contextual bandit at the server to modulate each client’s local training intensity based on behavior and update quality, and adds a trust-based blending mechanism to set client-specific interpolation between global and local models. Experiments on CICIoT2023 with heterogeneous clients and OOD stress tests show improvements in OOD DR (up to 7.66%) and F1 (up to 5.08% relative) over the strongest stable baseline, including better robustness to unseen attack classes.
Why it matters Server-controlled personalization via contextual bandits and trust-weighted global-local blending offers a concrete, empirically validated path to improve OOD robustness in federated IDS—relevant to securing LLM/edge deployments and to broader foundation-model personalization under distribution shift.
-
Timestep-Conditioned Transformers for Global Weather Forecasting
The paper introduces GEM-3, a probabilistic global weather model that enables explicit multi-timestep inference, allowing the model timestep to be configured at inference to balance error accumulation and sub-daily usability. It reports that mixed-timestep training improves rollout stability compared to timestep-specialist models. GEM-3 is a ~134M parameter neighborhood-attention transformer on an equirectangular grid with architectural advances over GEM-2, achieving near-SOTA medium-range probabilistic skill, stable extended-range rollouts, efficient training/inference, and decision-relevant diagnostics.
Why it matters Timestep-conditioned inference and mixed-timestep training offer a general recipe for controllable rollout horizons and stability that could transfer to LLM planning/scheduling or time-series foundation models facing compounding-error tradeoffs.
-
Evolutionary Curriculum Learning Improves Biological Sequence Modeling
The paper introduces Evolutionary Curriculum Learning (ECL), which trains VAEs on MSAs by progressively sampling sequences at increasing evolutionary distances from anchors following a power-law schedule, instead of treating sequences as exchangeable. Applied to EVE for protein variant effect prediction and RfamGen for RNA sequence generation, ECL improves downstream metrics across seeds, including AUROC gains for ClinVar classification (p53: 0.981→0.989; PTEN: 1.000 in every seed vs baseline mean 0.905 with instability) and higher covariance-model bit scores across three RNA families. Ablations indicate that progressive distance-based expansion outperforms fixed-size neighborhood and uniform random sampling, suggesting evolutionary distance is a useful inductive bias for curriculum ordering in biological sequence modeling.
Why it matters Curriculum design based on domain structure (evolutionary distance) improves generative modeling and robustness—relevant to LLM security via curriculum/ordering effects and to time-series FMs as a blueprint for distance- or scale-aware training schedules.
-
EnvACE: Internalizing Environment Dynamics via World Rehearsal for Agentic Reinforcement Learning
EnvACE replaces external environment interaction during training with a world rehearsal mechanism, where the policy alternates between acting (tool calls) and internally simulating environment responses, optimizing both roles end-to-end with task-success rewards. This internalized action–response mapping functions as an agent world model that supports decision making, achieving strong and transferable performance across BFCL-v4, tau^2-Bench, VitaBench, and FinMCP-Bench, outperforming environment-scaling baselines. Controlled studies show consistent gains across model scales, and at test time private rehearsal before execution yields additional improvements under a moderate rehearsal budget without extra external interaction.
Why it matters Offers a scalable alternative to environment-dependent RL for LLM agents, aligning with model-based RL and test-time planning ideas that could translate to secure tool use and to self-simulated dynamics in time-series decision settings.
-
HarnessOpt-Bench: Evaluating LLMs at Harness Optimization
The paper introduces HarnessOpt-Bench, a benchmark for end-to-end harness optimization where an LLM optimizer iteratively edits a target agent’s harness under expensive, stochastic evaluation with a fixed budget, using only graded feedback and without access to a held-out test partition. A trusted execution environment enforces evaluation boundaries, meters resource use, and preserves candidate versions for audit, and performance is measured by normalized gain over the seed harness. Evaluating five frontier LLMs across four tasks and 111 runs, the authors find optimizer models differentiate more than coding harnesses, native harnesses aren’t consistently superior, and gains vary substantially by task and seed regime, establishing harness optimization as a measurable and discriminative capability with room for improvement.
Why it matters It provides a rigorous, auditable setup to compare LLMs’ agentic self-improvement under realistic noisy/expensive evals—relevant for secure agent orchestration and optimizing time-series/tool-using pipelines.
-
When Self-Evolution Backfires: Pre-Commit Gating against Skill Contamination in LLM Agents
The paper shows that self-evolving LLM agents experience a capability-contamination phase transition: beyond a critical pool size, newly distilled skills degrade performance due to defective skills seeding cross-round contamination chains. They demonstrate structural irreversibility, where post-hoc removal of source skills recovers only a small fraction of performance, motivating pre-commit gating via Verifier-as-Gatekeeper (VaG) with three heterogeneous critics and marginal-gain subset selection. On Terminal-Bench 2, unconditional accumulation peaks then degrades with limited rollback recovery, while VaG improves every round to 72% pass@1 with a ~5x smaller pool and transfers positively to other backbones and a second benchmark, with ablations showing the critics are complementary and non-substitutable.
Why it matters It surfaces an irreversible contamination mechanism in skill distillation and proposes a concrete pre-commit gating framework that stabilizes agent evolution and transfers across models/benchmarks, directly relevant to secure, scalable LLM agent training and model-based control of evolving skill libraries.
-
GROM: Gradient-Free Rapid One-Shot Machine Unlearning
The paper introduces GROM, a gradient-free, one-shot unlearning method that replaces iterative fine-tuning with a closed-form additive weight update derived by framing unlearning as a ridge-regularized least-squares problem. The update is computed via forward passes only and enforces suppression of targeted content while preserving behavior on retained data, enabling application in seconds. Experiments report SOTA forgetting-utility trade-offs on TOFU-5%, TOFU-10%, MUSE-Books, MUSE-News, and WMDP, and robustness to low-bit quantization attacks that can undo gradient-based unlearning.
Why it matters Offers an analytically grounded, fast, and quantization-robust unlearning primitive relevant for LLM red-teaming defenses and deploy-time editing without retraining overhead.
-
Refining Over Resampling: Test-Time Self-Correction for LLM Reasoning
The paper proposes a verifier-free breadth–depth refinement framework for test-time scaling that combines multiple independent rollouts with iterative self-critique/self-correction and majority voting. This approach preserves diversity via breadth while repairing local reasoning errors via depth, avoiding reliance on external reward model calibration. Across AIME24, AIME25, AMC, OlympiadBench, and MATH500 with multiple open-weight models, it outperforms greedy decoding, majority voting, verifier-based best-of-N, beam search, and lookahead decoding, e.g., boosting Qwen2.5-1.5B to 58.0% on MATH500 and 32.5% on AMC from the strongest verifier-based baselines.
Why it matters Shows that allocating test-time compute to trajectory refinement (self-critique/correction) can beat wider sampling and verifier-guided selection, informing secure, efficient reasoning pipelines and compute–performance tradeoffs.
-
EdgeXpert: An Edge Device for Memory-Efficient LLM Inference with Mixture-of-Experts and Speculative Decoding
EdgeXpert is a software-hardware co-designed LLM accelerator targeting the EMA bottleneck in FFN layers for on-device inference, combining speculative decoding with MoE despite their typical incompatibility. In prefill, it uses prompt-wise expert reuse by selecting important tokens via a lightweight encoder to build a shared expert set and routes less important tokens with a reduced expert budget to cut expert EMA; in decode, depth-aware expert coalescing loads only salient channels across same-depth speculative candidates and applies computational calibration to maintain accuracy without extra memory access. Implemented in Samsung 28nm at 800 MHz, EdgeXpert reports up to 56.3% latency and 44.1% energy reductions versus prior work while maintaining near-baseline accuracy.
Why it matters It offers a practical path to marry MoE with speculative decoding for memory-bound edge inference, yielding sizable latency/energy gains relevant to secure, private on-device LLM deployment and efficient time-sensitive workloads.
-
Evaluation Pitfalls and Sparsity Limitations in LLM-based Confidence Estimates for Classification
The paper finds that common LLM confidence verbalization for classification is extremely sparse, e.g., Qwen3-32B yields only eight unique values on SST-2 with over half at exactly 95%, a pattern repeated across four datasets and two LLMs. This sparsity skews evaluation: AUARC rankings change drastically depending on interpolation choice, with consistency sampling dropping from best to worst under stepwise vs. linear interpolation, motivating a call to standardize stepwise interpolation. Under this fairer evaluation, “verbalization logprobs,” which weights verbalized digits by token probabilities, mitigates sparsity and yields the best AUARC, improving by 2.3 points over vanilla verbalization without extra inference cost.
Why it matters It highlights a pervasive sparsity artifact in LLM confidence verbalization that can invert AUARC-based rankings, and offers a zero-cost fix (verbalization logprobs) with standardized stepwise evaluation—directly relevant to trustworthy LLM classification pipelines and security-critical reject options.
-
Trident : How to Break Deep Reinforcement Learning Cyber Defenses (Agentic)
The paper introduces Trident, an agentic LLM red-teaming framework for evaluating DRL-based cyber defenses, consisting of a dynamic benchmark across CybORG CAGE 4 and CyberWheel, a dataset of 13k+ red-blue trajectories for RLVR, and a Code-as-Policy RLVR architecture. Trident reframes red-agent training as a contextual bandit using a Log Summarizer–Planner–Coder pipeline, where a trainable Planner produces complete attack strategies from compressed logs and a frozen Coder turns them into executable Python policies against live DRL defenders. Empirically, a single 7B planner substantially degrades blue-agent performance (average 522% reduction vs. static red baselines) and uncovers emergent behaviors like decoy avoidance and adaptive state prioritization that static heuristics miss.
Why it matters It demonstrates an RLVR-driven, code-generating agent that reliably breaks DRL cyber defenses and provides a benchmark/dataset, directly informing LLM security evaluation and agent robustness research.
-
DiagChain: A Diagnostic Benchmark for Evaluating LLM Agents on Evidence-Grounded Attack Chain Reconstruction
DiagChain is a diagnostic benchmark for evidence-grounded attack chain reconstruction that enables stage-wise evaluation of LLM agents, addressing limits of final-output or aggregate metrics. It introduces MAIN-69 (69 scenarios across OSes, evidence noise levels, and chain lengths), an Evidence-Centric RAG approach that ties retrieval to an evolving structured chain, and five metrics targeting distinct reconstruction stages for failure diagnosis. Evaluating six LLMs, they find the strongest setup correctly reconstructs only 39.6% of 849 reference steps, with smaller models failing to integrate retrieved evidence and larger models bottlenecked by evidence ordering.
Why it matters Offers a granular, stage-wise eval suite and methodology for security-focused LLM agents, highlighting integration vs ordering failures that current end-to-end metrics obscure.
-
On-Policy Self-Distillation without Any Supervision
This work introduces U-OPSD, an unsupervised on-policy self-distillation method that relies solely on a model’s own rollouts and internal consistency, avoiding any external supervision. It forms a pseudo-solution via majority vote under a self-consistency threshold, conditions a teacher distribution on the shortest pseudo-solution, and distills that into prefixes of the model’s longest incorrect completion to target confident errors. Across AIME24/25, HMMT25, MATH500, and AMC23, it consistently improves base models and matches or exceeds supervised OPSD and GRPO, with notable gains on Qwen3 (non-thinking and thinking modes) at 4B and 8B scales.
Why it matters Shows a practical path to post-train LLMs via on-policy self-consistency without GT, feedback, or larger teachers, directly relevant to scalable, secure alignment and distillation pipelines.
-
Align-RAG: Alignment Is All You Need for TSFM In-Context Learning
The paper introduces Align-RAG, a training-free method that applies closed-form amplitude rescaling and integer-lag phase alignment to retrieved past–future windows before feeding them to a frozen TSFM. On a frozen Chronos-Bolt, it outperforms a state-of-the-art trained retrieval adapter across seven benchmark datasets (average −3.75% MSE), and it also improves zero-shot MSE by 2.5%–13.7% on four additional frozen TSFMs without per-backbone tuning. Analysis shows aligned demonstrations induce prediction shifts in frozen backbones that track a closed-form ridge predictor on the same pairs, with a future-shuffle control ruling out futures-averaging, suggesting frozen TSFMs already support dynamic in-context use of retrievals.
Why it matters It challenges the need for learned fusion in RAG for forecasting by showing closed-form alignment on frozen backbones yields SOTA gains and ridge-like in-context adaptation, a strong baseline relevant to LLM alignment and retrieval studies.
-
What Current AI Benchmarks Leave Unmeasured: Modality, Search, Citations, and Implications (for Safety Evaluations)
The authors audit common LLM evaluation assumptions by comparing ChatGPT’s chat UI and OpenAI’s API, with and without web search, across 401 prompts from BBQ and SafetyBench and three runs per prompt, totaling 4,812 responses. Beyond accuracy, they measure response consistency, text similarity, citation grounding, and abstention, finding that chat UI was less accurate than API without search, enabling search reduced accuracy by up to 8 points and could flip modality performance trends, and repeated runs were inconsistent for up to 21% of prompts, with differing citations and abstention patterns across modalities. They conclude that relying solely on single-modality, single-run accuracy obscures important behavioral variation relevant to safety evaluations, and recommend accounting for modality, multi-run consistency, search conditions, and response-level behaviors.
Why it matters It highlights evaluation knobs—modality, search, and multi-run variability—that can confound safety and reliability claims for LLMs and are directly relevant to red-teaming, deployment risk assessments, and robust time-series-like benchmarking protocols.
-
Marginal Matching Does Not License Factorized Sampling: Auditing Conditional Style Leakage in Factorized Generative Models
The paper shows that matching a style latent’s marginal distribution to a Gaussian does not imply class-independent style, since class-conditional distributions can still carry label information. It provides an exact decomposition identifying four conditions required for factorized sampling and demonstrates that fixing marginal mismatch is necessary but insufficient. Empirically, across multiple models, datasets, and perturbations, strong marginal matching coexists with high label leakage, mitigations only partially reduce leakage, and post-hoc conditional priors or style banks variably improve class-conditional generation.
Why it matters It challenges common independence claims in factorized generative models and offers concrete audits/mitigations relevant to leakage, disentanglement, and conditional generation fidelity.
-
The Label Defines the Timescale: Trait-State Limits of Temporal-Aggregate Learning
The paper analyzes labels of temporal aggregates Θ_{g,T} built from a latent Gaussian process with a stable trait and correlated state, using an exact protocol-conditioned Bayes-risk identity. It shows label variance splits into an O(1) trait and O(T^{-1}) state component, derives task-dependent effective temporal spans (means tied to ordinary correlation time; occupation times to higher-order spectra), and proves state-driven occupation-label variance peaks at trait-threshold with window efficiency decaying slowly away from it. With a fixed segment budget, risks and simulations show repeated co-temporal segments saturate quickly while temporally dispersed observations keep improving state explainability; trait ceilings come from test-retest quantities, whereas state ceilings need short-lag calibration, implying observed limits can be protocol-driven rather than architectural.
Why it matters Clarifies when snapshot protocols fundamentally cap aggregate-label predictability and how to design observation schedules to separate architectural limits from acquisition ceilings—directly relevant to security evals of LLM temporal tasks and to designing time series foundation model benchmarks.
-
Agentic Bayesian Optimization through Surrogate-Augmented Autoresearch
The paper proposes agentic Bayesian optimization, where an LLM agent orchestrates the BO loop while a Bayesian backend supplies uncertainty-aware search, enabling dynamic reconfiguration (bounds, acquisition, targeted evals, or reframing) during runs. They implement this with Sara, a surrogate-augmented autoresearch agent, and lenz, a modular BoTorch-based backend exposing a structured, inspectable interface. On synthetic and real tasks, Sara matches SOTA BO without priors, beats LLM-based baselines, leverages natural-language priors to surpass standard BO, and adapts to changing requirements by reconfiguring the optimization problem on the fly.
Why it matters Bridges LLM agenticity with principled BO, offering a practical path to inject NL/code priors and dynamic task reconfiguration without sacrificing uncertainty-driven reliability—relevant for secure, adaptive tuning of LLM systems and time-series model pipelines.
-
Once a Response, Always a Response: Detecting LLM-generated Text via Latent Prompt Restoration
The paper introduces EchoPrompt, a training-free detector that leverages latent prompt restoration to identify LLM-generated text. It prepends a unified generic prefix to reactivate hidden prompt dependency, measures likelihood gains with an instruction-tuned model, calibrates against a base model, and aggregates differences into a score. Experiments report state-of-the-art zero-shot detection with strong robustness across challenging settings.
Why it matters It proposes a simple, training-free, model-comparison approach that exploits instruction-tuning artifacts—relevant for red-teaming, watermark alternatives, and robustness testing of LLM outputs.
-
DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model
DreamGuard is a proactive runtime guardrail for LLM agents that uses a risk-aware world model to track a compact recurrent latent state over trajectories and forecast future latent states. From these forecasts, it derives immediate-hazard and prefix-risk evidence and fuses multi-horizon signals to decide on interventions before tool executions. Across four benchmarks and an online evaluation, DreamGuard outperforms generic, reactive, and proactive baselines with the best safety-utility trade-off and averages 25 ms end-to-end latency per call.
Why it matters Introduces a trajectory-aware, low-latency guardrail with explicit risk modeling, aligning with interests in long-horizon safety for LLM agents and bridging to sequence modeling ideas from time series foundation models.
-
Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks
The paper introduces ARIA, an automated red-teaming framework that uses an attacker LLM with iterative, feedback-driven optimization to craft covert instruction backdoors for customized LLMs used in code intelligence. ARIA targets stealthiness, clean-task utility, and backdoor effectiveness, overcoming prior reliance on explicit triggers and manual, task-specific engineering. On three code tasks and four LLMs, ARIA attains up to 0.945 attack success while preserving utility, generalizes across languages and temperatures, and evades both platform- and user-side detection with high false negatives, remaining effective against existing defenses.
Why it matters It exposes a scalable, trigger-free pathway for robust instruction backdoors in prompt-based customization—relevant for red-teaming LLM agents and for designing defenses that go beyond simple trigger or heuristic prompt inspection.
Ecosystem
Model releases
New model weights or major model announcements from labs.
-
Optimizing What Policies Learn From: Recoverability-aware Rollout Intervention Learning
The paper introduces Recoverability-Aware Intervention Learning (RAIL), a training-time framework that adaptively selects rollout interventions for critic-free group-based RL in LLM post-training, addressing the inefficiency of uniform rollout allocation. RAIL formulates intervention selection as an online contextual bandit and trains a recoverability controller via a shadow-to-live procedure so the controller adapts as the policy changes. Experiments show RAIL improves effectiveness, adaptivity, expressiveness, and efficiency under limited rollout budgets by generating more informative, less redundant rollouts that yield stronger learning signals.
Why it matters It offers a principled, adaptive rollout allocation mechanism that can boost post-training efficiency and signal quality—relevant to safety-aligned RLHF-style pipelines and budgeted data collection for foundation models, including time-series variants.
-
Gradient Immunity: Null-Space Resistance to Malicious Fine-Tuning
The paper targets the PPOW setting where most weights are trainable but a small safety-critical component is preserved, and proposes a Unidirectional Safety Gate implemented as a Null Space Cubic Layer plus an Inverse Adapter after the final Transformer layer. The cubic layer blocks or suppresses gradients from harmful samples whose hidden states lie within a calibrated protected region (threshold set using defender-held harmful data), while the Inverse Adapter restores the base model’s forward behavior. Across six model–dataset settings, this keeps post-finetuning attack success near pre-release levels under a fixed threshold, maintains high safe-pass on easier settings, and shows a clearer safety–utility trade-off on BeaverTails unsafe samples, indicating release-time representation-space blocking can raise the cost of malicious adaptation without downstream cooperation.
Why it matters Offers a concrete, release-time gradient-blocking mechanism that preserves forward behavior while resisting malicious fine-tuning—relevant to robust alignment under open-weight releases and complementary to gradient/representation-control methods in LLM safety.
Policy
AI policy, regulation, governance, export controls.
-
Temporal Leakage in LLM Backtesting: Measurement, Validation, and Adjusted Scores
The usual pre/post-cutoff contamination check in LLM backtests is uninformative, as flagship models fail it even on post-cutoff questions due to structural recency effects, and no passive backtest can disentangle recency or leakage from genuine skill. The authors introduce two external-information approaches: using a known cutoff to identify boundary leakage and a matched clean control to estimate global leakage and produce leakage-adjusted scores, along with a characterization showing leakage concentrates on surprising, well-covered outcomes and that partial memorization is over-rewarded. They validate via twin-model leakage injection and find recovery of the planted dose with nulls on clean items, then apply to frontier models, detecting one cutoff-localized signature while clearing five models whose apparent gains were due to recency, concluding that backtests remain viable given a defensible reference.
Why it matters It offers concrete, validated estimators and an adjustment recipe to separate recency from leakage, directly improving LLM security audits and forecasting/time-series backtesting of foundation models.
-
FBID: Adaptive Personalized Federated Learning for Robust Out-of-Distribution Attack Detection in IoT Networks
The paper introduces FBID, an adaptive PFL framework that uses server-side personalization control to avoid over-personalization and OOD detection degradation in heterogeneous IoT intrusion detection. It employs a contextual bandit at the server to modulate each client’s local training intensity based on behavior and update quality, and adds a trust-based blending mechanism to set client-specific interpolation between global and local models. Experiments on CICIoT2023 with heterogeneous clients and OOD stress tests show improvements in OOD DR (up to 7.66%) and F1 (up to 5.08% relative) over the strongest stable baseline, including better robustness to unseen attack classes.
Why it matters Server-controlled personalization via contextual bandits and trust-weighted global-local blending offers a concrete, empirically validated path to improve OOD robustness in federated IDS—relevant to securing LLM/edge deployments and to broader foundation-model personalization under distribution shift.
Longform
Essays, blog posts, and talks worth the extended read — not papers.
-
A Six-Dimensional Taxonomy of Post-Training Adaptation Techniques with Applications in AI Governance
This survey synthesizes post-training adaptation techniques—spanning retraining, fine-tuning, parameter-efficient adaptation, alignment, RAG, model editing, unlearning, calibration, and multimodal instruction tuning—and introduces a six-dimensional taxonomy by mechanism, goal, data requirement, persistence, structural scope, and model type. It clarifies conflated terms (e.g., fine-tuning vs. RAG vs. prompting), traces the evolution of adaptation across model eras, and maps relationships such as inheritance, supersession, hybridization, and layered deployment stacks. The work presents a vocabulary to support technical documentation, change tracking, and governance analysis, and highlights open challenges in evaluation, reproducibility, persistent inference-time adaptation, unlearning, multimodal adaptation, and governance-aware workflows.
Why it matters Provides a governance-aligned taxonomy that can standardize how LLM security adaptations (e.g., alignment, unlearning, RAG) are described, compared, and tracked across deployment stacks, aiding reproducible evaluation and auditability.
Utility
Has code
Filter, not a ranker — papers in the user's areas with a working code repo linked.
-
Robust Context-Aware Detection of Malicious Instructions in Text
This work introduces a context- and query-aware sentence-level detector for malicious instructions in text, targeting IPI by segmenting benign vs. malicious sentences. It further hardens the detector with two adversarial training methods: embedding-space PGD-style feature perturbations and LLM-based paraphrase simulations, each parameterized to trade off utility and robustness. Experiments on IPI benchmarks show gains over state-of-the-art under static attacks and improved utility and lower attack success under adaptive attacks, with optimal AT parameters shown to be domain-dependent and thus requiring domain-specific tuning.
Why it matters It proposes a practical, query-relative segment classifier with AT schemes (including LLM-paraphrase-in-the-loop) that improve robustness against adaptive IPI—relevant for securing agentic LLM pipelines and for evaluating tradeoffs in domain-specific deployments.
PIMiner presents an agentic, transferable prompt-injection red-teaming system for automated attacks and dataset generation—directly relevant to scalable red-teaming, evaluation, and defenses for LLM agents.
-
SkillSentry: Adaptive Honey Worlds for Dynamic Safety Testing of Agent Skills
SkillSentry is a dynamic safety-testing framework that uses adaptive honey worlds to probe LLM agent skills for conditional, execution-time harms. It infers a skill’s intended capability boundary, builds an LLM-simulated environment with controlled decoy resources, adaptively generates tasks, and contrasts skill-enabled trajectories with matched no-skill runs, attributing suspicious behaviors to code and verified traces before deciding. Evaluated against seven scanner configurations, it attains 99.50% Recall and 96.26% average F1 on standard benchmarks, and 92.95% average F1 under semantics-preserving evasion versus 80.07% for the strongest baselines.
Why it matters Offers a practical, attribution-grounded dynamic testing approach that outperforms static/one-shot scanners, relevant for securing tool-augmented agents and adversarial evaluation pipelines.
Directly addresses dynamic, conditional attack surfaces of external agent skills with a proactive adaptive testing/honeypot approach—highly relevant to red-teaming and agent tooling attack surfaces.
-
Gradient Immunity: Null-Space Resistance to Malicious Fine-Tuning
The paper targets the PPOW setting where most weights are trainable but a small safety-critical component is preserved, and proposes a Unidirectional Safety Gate implemented as a Null Space Cubic Layer plus an Inverse Adapter after the final Transformer layer. The cubic layer blocks or suppresses gradients from harmful samples whose hidden states lie within a calibrated protected region (threshold set using defender-held harmful data), while the Inverse Adapter restores the base model’s forward behavior. Across six model–dataset settings, this keeps post-finetuning attack success near pre-release levels under a fixed threshold, maintains high safe-pass on easier settings, and shows a clearer safety–utility trade-off on BeaverTails unsafe samples, indicating release-time representation-space blocking can raise the cost of malicious adaptation without downstream cooperation.
Why it matters Offers a concrete, release-time gradient-blocking mechanism that preserves forward behavior while resisting malicious fine-tuning—relevant to robust alignment under open-weight releases and complementary to gradient/representation-control methods in LLM safety.
Direct defense proposal against malicious fine-tuning of released weights (PPOW setting) — highly relevant to LLM security, supply-chain attacks, and robustness of deployed models.
-
Towards a Risk Assessment of Malicious Skill Files in Coding Agents
The paper studies the attack surface introduced by agent skill folders in autonomous coding agents and presents an adversarial skill-synthesis method that converts 471 real shell commands into 2,826 benign-looking skills mapped to 11 ATT&CK tactics using six LLMs. It introduces a reproducible evaluation pipeline with stratification, evidence anchoring, refusal veto, and a deterministic declared-intent override, using a three-judge LLM panel validated against a blind human gold standard (κ=0.85). In large-scale tests (5,629 runs), Gemini CLI was exploited in 95.5–96.1% and Qwen Code in 71.6–74.0% of runs with only 1.99% explicit safety recognition, and code/dataset are released at https://github.com/awsm-research/AgentJailbreak.
Why it matters Provides a validated benchmark, eval pipeline, and high-base-rate exploitation evidence for skill-file attacks in coding agents—directly relevant to LLM security evals and agentic deployment risk.
Demonstrates pipeline attack surface in coding agents by hiding malicious shell commands in natural-language skill files — directly applicable to agentic-system attack vectors and red-teaming.
-
CircuitSteer: Geometrically Aligned Multi-Layer Steering via Sparse Autoencoder Circuits
CircuitSteer introduces a multi-layer steering framework that uses SAEs to identify coherent semantic circuits via feature co-activation and geometric alignment of decoder directions, enabling isolation of subcircuits tied to target behaviors. The method synthesizes dense steering vectors from sparse features and applies multi-point interventions to guide internal semantic trajectories. Evaluated on toxicity, emotion-intensity, sycophancy, and refusal across two model families, it uniquely achieves fluency-preserving interventions and maintains coverage where single-layer methods fail, with code released publicly.
Why it matters It proposes a geometry-aware, multi-layer circuit approach that outperforms single-point CAA-style interventions on hard behaviors (e.g., sycophancy/refusal), informing both alignment steering and circuit-level interpretability workflows.
CircuitSteer proposes structured multi-layer interventions to steer LLM behavior, directly relevant to steering/jailbreak mitigation and internal-control methods for model safety.