GPT-Red
Automated Red Teaming via Self-Play at Scale
AI Research Radar
July 24–30: 9 frontier papers out of 1,892 read.
Frontier
Papers rated as moving the field
How we chooseGemma 4 Technical Report
Kimi K3
“Together with Stable LatentMoE, which effectively activates 16 of 896 routed experts per token, and refined training and data recipes, these advances yield an approximately 2.5x improvement in overall scaling efficiency over Kimi K2.”
APEX-Accounting
“No model scores more than 2.6% Pass^8 (GPT-5.6-Sol (Max+Pro)) and the highest Pass@8 is 21.5% (Muse-Spark-1.1 (xHigh)).”
TLA⁺-Bench
On-Policy Distillation for LLM Safety
“Our results demonstrate that when baseline defenses face template mismatches, often accompanied by severe degradation in downstream task performance.”
Explanation-Bound Tool Execution for AI Agents
Architectural Backdoors in Vision-Language Model Supply Chains via Representation Steering
“The results show that the proposed architectural steering backdoor compromises integrity, safety enforcement, and ranking fairness while preserving normal behavior on clean inputs.”
SAGE
The week by field
Jul 24–30: 160 cleared, 9 frontier
The week’s papers have not been sorted into fields yet.
Models under test
Papers this week that name the model
Labs publishing
Papers this week with an author at the lab
Also cleared
151 papers
- Choosing Where and How to Moderate: End-to-End Trade-offs in Filter Placement and Response RewritingMicrosoftCode
- Incast-Free MoE Rate-Based SchedulingNVIDIA
- Hearsay: Vision-Language Medical Diagnoses Without an ImageAmazon
- Qwen-Audio-3.0-Gen-Preview Technical ReportAlibaba
- Harm is not Universal: Community-Specific Toxicity Detection is Urgently NeededMicrosoft
- Mage-VL: An Efficient Codec-Native Streaming Multimodal Foundation ModelMicrosoft
- The User Asks, Platforms Compete: How Agentic Recommendation Markets Take ShapeTencent
- Hybrid Analysis for Secure MCP Tool Use in LLM AgentsAlibaba
- Qwen-Audio-3.0-TTS: Freely Controllable and Highly Robust Speech Synthesis with Multi-Stage Training ParadigmAlibaba
- FilmBench: A Film-Grade Benchmark for Cinematic Video GenerationAlibaba
- Do VLMs Read or Rewrite? On Transcription Faithfulness in Vision-Language ModelsAmazon
- JAXBench: Benchmarking Autonomous TPU Kernel OptimizationGoogle
All 151 papers
- Windowed-MTP: Removing the Full-Context Draft-KV Tax at Million-Token ContextNVIDIA
- OpenForgeRL: Train Harness-native Agents in Any EnvironmentMicrosoft
- Steering Instruction Hierarchies at Inference TimeCode
- TurboVLA: Real-Time Vision-Language-Action Model at 32 Hz on an RTX 4090 with <1 GB VRAMCode
- Ranked by Position: Order Sensitivity as an Exploitable Attack Surface in LLM Listwise RecommendersCode
- ScalableRAG: High-Quality RAG at Zero Ingestion CostCode
- LabRobFail: A Benchmark for Robotic Failure Analysis in Chemical Self-driving LaboratoriesCode
- PhantomSeal: Proactive Deepfakes Defense with Identity/Context Protection and Forensic TracingCode
- Explainable Deepfake Detection ChallengeCode
- When Are Reasoning-Based Guardrails Not Efficient? ResponseGuard: A Fast Vision-Language Guard for Real-Time ModerationCode
- ResearchArena: Evaluating Sabotage and Monitoring in Automated AI R&D
- Transforming Keystroke Noise to Text: Self-Supervised Acoustic Eavesdropping Attacks on Keyboards
- The Human Utility Factor: A Computable Welfare Metric That Reframes AI Governance as a Constrained Optimisation Problem
- AI Security Priorities: A Field-Wide Agenda
- Meta-Learned Reward Shaping for Reinforcement Learning from Human Feedback
- Validating ETCS Data with the B Mathematical Language: An Industrial Pipeline and a Blueprint for LLM Integration
- StealthBench: Measuring Operational Stealth in Autonomous Offensive-Security Agents
- RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning
- (Im)Paired Programming: Coding Agents Improve Productivity but Harm Understanding
- Prosody-driven Jailbreaks in Audio LLMs: A Controlled Study and Mechanistic Analysis
- Recover, Decode, Reguard: Guard-Agnostic Defense Amplification againstEncoded VLM Jailbreaks
- Physically Real-time Infrared Attack against Optical Flow Estimation Networks
- ToxScreen: Detecting Whether an LLM Has Been Poisoned
- AgentSnare: Learning to Delay, Divert, and Defuse Autonomous Penetration Agents
- InferScale: GPU-Native KV Injection for Personalized LLM Serving
- Pangram 4 Technical Report
- RDQ: Residual Distribution Quantization for Large Language Models
- ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents
- LLM Scheming Inversely Scales with Pretraining Language Coverage
- The Mirage of LLM Guardrails: A Case Study in AI-Assisted Medical Note Manipulation
- The Missing Layer: Specification Infrastructure for AI Oversight
- Early Detection of Distributed Backdoors in Multi-Agent LLM Systems: A Characterization Study
- TYPO: Instruction-Dense Visual Jailbreaks against Commercial Closed-Source Image-Generation Models
- ALIBI: Adaptive Agentic Attacks on LLM-Based Vulnerability Detectors via Adversarial Code Comments
- Decision-Level Hijacking: Injecting Cognitive Bias into Large Language Models via Bit-Flip Attacks
- Instruction-Tuned Language Models Cannot Sample from Distributions They Can Describe
- Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response
- From Dyad to Triad: Eliciting XAI Requirements in Stroke Rehabilitation
- I2VShield: An Efficient Proactive Defense Framework against DiT-based Image-to-Video Models
- PILA: Plug-and-Play Insertion for LLM-native Advertising
- SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents
- Construction-Driven Injection: Linguistically-Grounded Edit-Based Code-Mixing Fingerprints for Large Language Models
- Why Public Service AI Governance Frameworks Risk Failing in the Age of General-Purpose AI: Lessons from Policing
- Runtime Uncertainty Monitoring for LLM-Based Multi-Agent Systems Using Bayesian Networks
- TIGA: Trajectory-Injected Generative Attack against Black-box AIGC Detectors
- Minimizing Targeted Activations: Input-Only Suppression of Evaluation-Awareness Latents in Large Language Models
- Toward Standardized Cross-Vendor Agent Tool Trust Management in Autonomous Networks
- From Role Prompt to Infinite Thinking: Exploiting Persona Conditioning for Inference Cost Attacks in LLMs
- Falling Behind Drives Unsafe Development in an Idealised AI Race Experiment
- "Uncensored" open LLMs are measurably more optimistic than their base models
- DONDO: Open w2v-BERT Speech-Recognition Base Models for African Languages
- Agentic Evaluation of Copyright Law Compliance
- Nanbeige4.2-3B: Unlocking Agentic Capabilities in a Compact Model
- TRACE-ROUTER: Task-Consistent and Adaptive Online Routing for Agentic AI
- Opaque Epistemic Mediation: How LLM Deployment Configurations Shape the Validation of Pseudo-Science
- Semalith v1.4: A Calibrated 184M Safety Classifier Achieving State-of-the-Art Prompt-Injection Detection at 44x Fewer Parameters than Llama-Guard-3-8B
- AIR-BENCH Live: An Evolving Safety Benchmark for Foundation Models
- Towards Nexus-Score: Metadata Gaps Limit Scholarly AI Attribution
- PANOPTICON: A PII-Based Assemblage of Naturalistic Output Tokens for Investigating Privacy Leakage Within LLM Context Window
- StepX-Edge: An On-Device UI Vision-Language Model via Architecture-Training-Deployment Co-Design
- Not All LLM Reasoning is Visible in the Chain-of-Thought
- Beyond Exact Match: How Evaluation Methodology Dominates Model Choice in LLM-Based Product Attribute Extraction
- Mask2Shield: Strengthening LLM Safety against Neuron-Pruning Attacks
- False Prophets: On the Security of World Models in Agentic Systems
- Hiding in Plain Sight: An Effective Physical Adversarial Patch Attack against Visual-Infrared Fused Face Detection
- UltraViT: Latency-Optimized On-device Vision Encoder for Large Vision-Language Models
- Confidently Wrong: Exception Chain Collapse in Frontier LLM Rule Evaluation
- Inference-Time Consensus for Mitigating Hidden Behaviors from LLM Fine-Tuning
- Separating Capability from Permission: A Governance Framework for Agentic AI Autonomy Levels
- Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents
- Do LLMs Know Their Vulnerable Scenarios?
- The Illusion of Secure LLM Code: Closing the Security Gap via Iterative Reprompting
- Melo: A Production LLM-Powered Music Recommendation Agent
- AI Strategy: How to Choose What AI Product to Implement
- N₀-VTLA: Scaling Vision-Tactile-Language-Action Model with Latent Tactile Tokens
- N₀-TWAM: Scaling Tactile-Native World-Action Model for Contact-Rich Manipulation
- Memory Efficient Audio Synthesis with Decoupled Temporal Depth Diffusion Transformers
- SpecBox: Speculative Sandbox Scheduling for Efficient LLM Agent Serving
- A Cybersecurity MLPS Large Language Model with Multi-Path Retrieval Fusion
- Just Testing, Move Along: Evasion of LLM-based System Log Interpretation by Prompt Injection
- EXE-Bench: Ranking the Tradeoffs of AI-based Windows Malware Detectors for Real-World Usability
- Face Age Verification Vulnerabilities Under Simple Appearance Manipulations
- Gubernaut: A Deterministic Homeostatic Controller for Affect-Regulated LLM Agents, Validated Across Independent Model Families
- Beyond Aggregate Risk: Role-Stratified Conformal Risk Control for LLM Tool Calls
- When LLM Defenses Backfire: Characterizing Safety, Performance, and Cost Trade-offs
- The SpiNNaker2 chip: a many-core platform for flexible and scalable brain-inspired computing
- LLM-SoccerArena: Benchmarking LLMs on Real-World Predictions in Sports
- Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents
- RecGPT-V3 Technical Report
- CARE: Pre-Execution Command Verification for Shell-Executing LLM Agents
- Pixels for Programs? A Cross-Provider Case Study of Input-Token Accounting for Source Code as Text and Images
- Oxygen-TryOn: Fashion-Native Foundation Model for Any-item Virtual Try-On
- Every Model Cheats: Prompt-Level Mitigation of Cheating on Offensive Cyber Tasks
- Protocol-Level Attacks on Agentic Commerce Platforms: A Cross-Platform Taxonomy, AIP-Bench, and Unified Defense
- ToolGuardian: Declarative Security for AI Agent-Tool Interactions
- Certified in Theory, Broken in Practice: Assumption Gaps in Cryptographic Model Certification
- ISPCloak: Weaponizing ISP for Optimization-Free Physical Camouflage against Deepfake Detectors
- RIS-Kernel: A Model-Agnostic Architecture for Long-Context LLM Inference via Sparse Attention
- SIREN (Luring LLMs onto the Rocks): PAIR-Driven Preference Manipulation in Web-RAG Recommenders
- Efficient Online LLM Watermark Detection via Rao-Blackwellized E-Processes
- Analysing Self-Harm Representations in Language Models: a Cross-Architecture Study
- Zero-Shot Mission-Level Evaluation for Aerial MLLM Agents
- MEUSLI: a Multilingual Projector for LLM-based ASR and Beyond
- Universal BCI Personalization: One API for Frozen EEG Trunks and Foundation Models
- Dynamic Capability Scoping for Enterprise AI Agents: A Synthetic Dataset and Three-Source Permission Architecture
- Where FactsGo Missing: A LayerwiseTaxonomy and Per-Layer Attribution of Information Omissionin Air-Gapped LLM Agent Pipelines
- Compile, Then Page: Executable SOP Programs and a Capability-Gated Runtime for Procedural LLM Agents
- Making Open-Source Text LLM Watermarks Durable Against Merging
- Routing Subspaces: Auditing Evaluation-to-Deployment Mismatch in Fine-Tuned Language Models
- TopoGuard: Graph Theory Based Defenses Against Split-Knowledge Attacks on RAG
- Answer-then-Edit: Reasoning Skeleton Editing for Anti-Distillation with Preserved Utility
- Confidently Deceptive: How Confidence Amplifies the Risk of LLM Deception
- Domyn-Small: A European 10B Reasoning Language Model
- Marking the Wrong Symptoms: Evaluating LLM Watermarks in Medical Texts
- InferenceBench: A Benchmark for Open-Ended LLM Inference Optimization by AI Agents
- Incomplete Prompt Jailbreaks in Large Language Models
- PhantomFill: When the Form Demands an Answer, Language Models Invent One
- CANN Bench: Benchmarking Agent Generated Kernels against Real NPU and Algorithmic Limits
- Autonomous disproofs of the sum-product conjecture over R with GPT-5.5 Pro
- Evaluating and Guarding Citation Faithfulness in Agentic Scientific Synthesis
- PromptPack: Scaling LLM Annotation Agents for Online Recommendation
- StrideDiffusion: Accelerating Diffusion Models for Time-series Generation
- Geometric Configurations of Perturbed Jailbreak Prompts
- Frontier Financial Judgement: Can agents tell what might move a stock?
- Security Vulnerability Patterns in AI-Generated Code: A Cross-Model Comparative Study
- Leaky Language Models: Stealing Architecture and Inference Optimizations via Per-Token Timing
- IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests
- Robostral Navigate
- Refusal-Gated Decoding: Preserving Refusal Behavior Under High-Temperature Sampling
- Which Model Is Actually Serving You? IRIS: Budgeted Black-Box Auditing of Model Substitution and Routing Dilution in LLM Gateways
- GeoThreat: Transferable Targeted Adversarial Attacks on Large Vision-Language Models for Remote Sensing Image Interpretation
- QuantiBias: Benchmarking Quantization-Induced Bias in LLMs
- V-DEAL: Diagnosing Video Safety De-Calibration as an Understanding-Refusal Coupling Failure
- Detectors Learn the Wrong Thing: Shortcut-Resistant Adversarial Training Against Physically Realizable Attacks
- The Dark Room in the Reward Channel: Dense Prediction Rewards Collapse GRPO-Trained LLM Agents -- and What Actually Works
- Emergent Misalignment Recruits a Pre-existing Persona Subspace
- Agentic Context Management: Solving Agent Memory and Cost by Treating Them as Lifecycle and Architecture Problems
- Same Dangerous Objective, Opposite Advice: Direct Exposure versus Multi-Agent Mediation
- AXIS: A Growable Community-Driven Data Engine for Scalable Robot Manipulation