Hidden in Memory
“Crucially, among successful retrievals, poisoned memories cause attacker-intended agentic actions in 60-89% of evaluations across models.”
The authors, in the abstract
Sleeper Memory Poisoning in LLM Agents
AI Research Radar
May 16–22: 2 frontier papers out of 1,541 read.
Frontier
Papers rated as moving the field
How we chooseJudge Circuits
“We find that judgments across structured understanding and open-ended preference tasks share a sparse, generalized Latent Evaluator sub-graph in the mid-to-late multi-layer perceptrons (MLPs); zero-ablating it collapses judgment while preserving world knowledge in architecturally modular models.”
The week by field
May 16–22: 56 cleared, 2 frontier
The week’s papers have not been sorted into fields yet.
Models under test
Papers this week that name the model
Labs publishing
Papers this week with an author at the lab
Also cleared
54 papers
- Positive Alignment: Artificial Intelligence for Human FlourishingGoogle, OpenAI, Anthropic
- Causal Unlearning in Collaborative Optimization: Exact and Approximate Influence Reversal under Adversarial ContributionsMeta
- The Illusion of Intervention: Your LLM-Simulated Experiment is an Observational StudyGoogle
- DECOR: Auditing LLM Deception via Information Manipulation TheoryAmazon
- Library Drift: Diagnosing and Fixing a Silent Failure Mode in Self-Evolving LLM Skill LibrariesAmazon
- Training on Documents About Monitoring Leads to CoT ObfuscationGoogle
- LLM Agents Already Know When to Call Tools -- Even Without ReasoningCode
- Behavior Cue Reasoning: Monitorable Reasoning Improves Efficiency and Safety through OversightCode
- Conditional Equivalence of DPO and RLHF: Implicit Assumption, Failure Modes, and Provable AlignmentCode
- AgentWall: A Runtime Safety Layer for Local AI AgentsCode
- AgentStop: Terminating Local AI Agents Early to Save Energy in Consumer DevicesCode
- SaaS-Bench: Can Computer-Use Agents Leverage Real-World SaaS to Solve Professional Workflows?Code
All 54 papers
- AgentTrap: Measuring Runtime Trust Failures in Third-Party Agent SkillsCode
- HealthCraft: A Reinforcement Learning Safety Environment for Emergency Medicine
- CR4T: Rewrite-Based Guardrails for Adolescent LLM Safety
- Blind Spots in the Guard: How Domain-Camouflaged Injection Attacks Evade Detection in Multi-Agent LLM Systems
- Boundary-targeted Membership Inference Attacks on Safety Classifiers
- Evaluating Commercial AI Chatbots as News Intermediaries
- The Impact of AI Search on the Online Content Ecosystem: Evidence from Google and Reddit
- Conformal Selective Acting: Anytime-Valid Risk Control for RLVR-Trained LLMs
- Mechanistic Interpretability for Learning Assurance of a Vision-Based Landing System
- Trusted Weights, Treacherous Optimizations? Optimization-Triggered Backdoor Attacks on LLMs
- REFLECTOR: Internalizing Step-wise Reflection against Indirect Jailbreak
- Decoupling Communication from Policy: Robust MARL under Bandwidth Constraints
- roto 2.0: The Robot Tactile Olympiad
- PrivScope: Task-scoped Disclosure Control for Hybrid Agentic Systems
- Prompt2Fingerprint: Plug-and-Play LLM Fingerprinting via Text-to-Weight Generation
- UCCI: Calibrated Uncertainty for Cost-Optimal LLM Cascade Routing
- Benchmarking Commercial ASR Systems on Code-Switching Speech: Arabic, Persian, and German
- Agent Meltdowns: The Road to Hell Is Paved with Helpful Agents
- GoLongRL: Capability-Oriented Long Context Reinforcement Learning with Multitask Alignment
- Auditing Privacy in Multi-Tenant RAG under Account Collusion
- SDOF: Taming the Alignment Tax in Multi-Agent Orchestration with State-Constrained Dispatch
- Fair outputs, Biased Internals: Causal Potency and Asymmetry of Latent Bias in LLMs for High-Stakes Decisions
- Is Agentic AI Ready for Real-World Hardware Engineering? A Deep Dive with Phoenix-bench
- GQLA: Group-Query Latent Attention for Hardware-Adaptive Large Language Model Decoding
- Transformer Scalability Crisis: The First Comprehensive Empirical Analysis of Performance Walls in Modern Language Models
- STS: Efficient Sparse Attention with Speculative Token Sparsity
- On the Fragility of Data Attribution When Learning Is Distributed
- Formal Methods Meet LLMs: Auditing, Monitoring, and Intervention for Compliance of Advanced AI Systems
- Fully Open Meditron: An Auditable Pipeline for Clinical LLMs
- Invisible Orchestrators Suppress Protective Behavior and Dissociate Power-Holders: Safety Risks in Multi-Agent LLM Systems
- Measuring Google AI Overviews: Activation, Source Quality, Claim Fidelity, and Publisher Impact
- ROK-FORTRESS: Measuring the Effect of Geopolitical Transcreation for National Security and Public Safety
- ExploitBench: A Capability Ladder Benchmark for LLM Cybersecurity Agents
- Grounded Continuation: A Linear-Time Runtime Verifier for LLM Conversations
- Good to Go: The LOOP Skill Engine That Hits 99% Success and Slashes Token Usage by 99% via One-Shot Recording and Deterministic Replay
- The Great Pretender: A Stochasticity Problem in LLM Jailbreak
- MemLineage: Lineage-Guided Enforcement for LLM Agent Memory
- Sycophancy is an Educational Safety Risk: Why LLM Tutors Need Sycophancy Benchmarks
- Falkor-IRAC: Graph-Constrained Generation for Verified Legal Reasoning in Indian Judicial AI
- Mechanical Enforcement for LLM Governance:Evidence of Governance-Task Decoupling in Financial Decision Systems
- Quantifying and Mitigating Premature Closure in Frontier LLMs
- AI Knows When It's Being Watched: Functional Strategic Action and Contextual Register Modulation in Large Language Models