GPT-Red
Automated Red Teaming via Self-Play at Scale
AI Research Radar
July 25–31: 9 frontier papers out of 1,869 read.
Frontier
Papers rated as moving the field
How we chooseGemma 4 Technical Report
Kimi K3
“Together with Stable LatentMoE, which effectively activates 16 of 896 routed experts per token, and refined training and data recipes, these advances yield an approximately 2.5x improvement in overall scaling efficiency over Kimi K2.”
APEX-Accounting
“No model scores more than 2.6% Pass^8 (GPT-5.6-Sol (Max+Pro)) and the highest Pass@8 is 21.5% (Muse-Spark-1.1 (xHigh)).”
TLA⁺-Bench
On-Policy Distillation for LLM Safety
“Our results demonstrate that when baseline defenses face template mismatches, often accompanied by severe degradation in downstream task performance.”
Explanation-Bound Tool Execution for AI Agents
Architectural Backdoors in Vision-Language Model Supply Chains via Representation Steering
“The results show that the proposed architectural steering backdoor compromises integrity, safety enforcement, and ranking fairness while preserving normal behavior on clean inputs.”
SAGE
The week by field
Jul 25–31: 145 cleared, 9 frontier
The week’s papers have not been sorted into fields yet.
Models under test
Papers this week that name the model
Labs publishing
Papers this week with an author at the lab
Also cleared
136 papers
- Choosing Where and How to Moderate: End-to-End Trade-offs in Filter Placement and Response RewritingMicrosoftCode
- CryptanalysisBench: Can LLMs do Cryptanalysis?Anthropic
- ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework MappingAmazon
- LoRA Scaffolded Policy Optimization (LSPO): A Sampling-Time Low-Rank Scaffold for Recovering Reinforcement-Learning Gradient on Zero-Reward Cliff PromptsNVIDIA
- Agent Harness Distillation: Inference-Time Harness Extraction and Exploitation in Autonomous Multi-Agent SystemsBaidu
- Incast-Free MoE Rate-Based SchedulingNVIDIA
- Hearsay: Vision-Language Medical Diagnoses Without an ImageAmazon
- Qwen-Audio-3.0-Gen-Preview Technical ReportAlibaba
- Harm is not Universal: Community-Specific Toxicity Detection is Urgently NeededMicrosoft
- Mage-VL: An Efficient Codec-Native Streaming Multimodal Foundation ModelMicrosoft
- The User Asks, Platforms Compete: How Agentic Recommendation Markets Take ShapeTencent
- Hybrid Analysis for Secure MCP Tool Use in LLM AgentsAlibaba
All 136 papers
- Qwen-Audio-3.0-TTS: Freely Controllable and Highly Robust Speech Synthesis with Multi-Stage Training ParadigmAlibaba
- FilmBench: A Film-Grade Benchmark for Cinematic Video GenerationAlibaba
- Do VLMs Read or Rewrite? On Transcription Faithfulness in Vision-Language ModelsAmazon
- Steering Instruction Hierarchies at Inference TimeCode
- TurboVLA: Real-Time Vision-Language-Action Model at 32 Hz on an RTX 4090 with <1 GB VRAMCode
- Ranked by Position: Order Sensitivity as an Exploitable Attack Surface in LLM Listwise RecommendersCode
- ScalableRAG: High-Quality RAG at Zero Ingestion CostCode
- LabRobFail: A Benchmark for Robotic Failure Analysis in Chemical Self-driving LaboratoriesCode
- Conformal Cascade: Distribution-Free Accuracy Guarantees for Multi-Tier LLM Inference
- Flat Score, Amplified Failures: How the Error Budget Masks Damage in Quantized LLM Agents
- Open Security Benchmark: Towards Autonomous Enterprise Cyber Defense
- VETO: Towards Protecting Images From Frontier AI Editing
- SIGIL: Compiling Agent Skills into Typed Harnesses
- LayerRAG-Bench: A Cross-Layer Reliability Benchmark for Agentic Retrieval-Augmented Generation
- RoguePrompt: Dual-Layer Encoding for Self-Reconstruction to Circumvent LLM Moderation
- Stop Shipping AI Agents on Faith: Capability Is Not Production Readiness
- Safety-Gated Agentic Supervisory Control on a Coupled Distillation Benchmark: Regime Map, Auditable Gate, and Co-Design Findings
- Don't Trust the AI Ecosystem: Analyzing Privacy Leakage in Compromised Open-Source Components
- TriShield: Zero-Utility-Loss Defense Against Privacy Backdoors in Federated Language Model Fine-Tuning via Orthogonal Gradient Projection and Optimizer State Entanglement
- Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs
- Beyond Binary Rewards: A Comparative Study of Reward Design for Reinforcement Unlearning
- Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attacks
- Temporal Poisoning: Clean-Label Backdoors via Event Redistribution in SNNs
- Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents
- Old Tricks, New Models: How Simple Image Transformations Break Modern AI-based Content Moderation
- Fidelity Is Not Safety: Gently-Compressed LLMs Pass Every Data-Free Quality Guard Yet Invent Procedure Steps in Agentic Execution
- CoGate: Confidence-Gated Co-Decoding for Secure Code Generation
- AISPA: User-Centric System Prompt Auditing for Large Language Model Applications
- ResearchArena: Evaluating Sabotage and Monitoring in Automated AI R&D
- Transforming Keystroke Noise to Text: Self-Supervised Acoustic Eavesdropping Attacks on Keyboards
- The Human Utility Factor: A Computable Welfare Metric That Reframes AI Governance as a Constrained Optimisation Problem
- AI Security Priorities: A Field-Wide Agenda
- Meta-Learned Reward Shaping for Reinforcement Learning from Human Feedback
- Validating ETCS Data with the B Mathematical Language: An Industrial Pipeline and a Blueprint for LLM Integration
- StealthBench: Measuring Operational Stealth in Autonomous Offensive-Security Agents
- RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning
- (Im)Paired Programming: Coding Agents Improve Productivity but Harm Understanding
- Prosody-driven Jailbreaks in Audio LLMs: A Controlled Study and Mechanistic Analysis
- Recover, Decode, Reguard: Guard-Agnostic Defense Amplification againstEncoded VLM Jailbreaks
- Physically Real-time Infrared Attack against Optical Flow Estimation Networks
- ToxScreen: Detecting Whether an LLM Has Been Poisoned
- AgentSnare: Learning to Delay, Divert, and Defuse Autonomous Penetration Agents
- InferScale: GPU-Native KV Injection for Personalized LLM Serving
- Pangram 4 Technical Report
- RDQ: Residual Distribution Quantization for Large Language Models
- ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents
- LLM Scheming Inversely Scales with Pretraining Language Coverage
- The Mirage of LLM Guardrails: A Case Study in AI-Assisted Medical Note Manipulation
- The Missing Layer: Specification Infrastructure for AI Oversight
- Early Detection of Distributed Backdoors in Multi-Agent LLM Systems: A Characterization Study
- TYPO: Instruction-Dense Visual Jailbreaks against Commercial Closed-Source Image-Generation Models
- ALIBI: Adaptive Agentic Attacks on LLM-Based Vulnerability Detectors via Adversarial Code Comments
- Decision-Level Hijacking: Injecting Cognitive Bias into Large Language Models via Bit-Flip Attacks
- Instruction-Tuned Language Models Cannot Sample from Distributions They Can Describe
- Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response
- From Dyad to Triad: Eliciting XAI Requirements in Stroke Rehabilitation
- I2VShield: An Efficient Proactive Defense Framework against DiT-based Image-to-Video Models
- PILA: Plug-and-Play Insertion for LLM-native Advertising
- SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents
- Construction-Driven Injection: Linguistically-Grounded Edit-Based Code-Mixing Fingerprints for Large Language Models
- Why Public Service AI Governance Frameworks Risk Failing in the Age of General-Purpose AI: Lessons from Policing
- Runtime Uncertainty Monitoring for LLM-Based Multi-Agent Systems Using Bayesian Networks
- TIGA: Trajectory-Injected Generative Attack against Black-box AIGC Detectors
- Minimizing Targeted Activations: Input-Only Suppression of Evaluation-Awareness Latents in Large Language Models
- Toward Standardized Cross-Vendor Agent Tool Trust Management in Autonomous Networks
- From Role Prompt to Infinite Thinking: Exploiting Persona Conditioning for Inference Cost Attacks in LLMs
- Falling Behind Drives Unsafe Development in an Idealised AI Race Experiment
- "Uncensored" open LLMs are measurably more optimistic than their base models
- DONDO: Open w2v-BERT Speech-Recognition Base Models for African Languages
- Agentic Evaluation of Copyright Law Compliance
- Nanbeige4.2-3B: Unlocking Agentic Capabilities in a Compact Model
- TRACE-ROUTER: Task-Consistent and Adaptive Online Routing for Agentic AI
- Opaque Epistemic Mediation: How LLM Deployment Configurations Shape the Validation of Pseudo-Science
- Semalith v1.4: A Calibrated 184M Safety Classifier Achieving State-of-the-Art Prompt-Injection Detection at 44x Fewer Parameters than Llama-Guard-3-8B
- AIR-BENCH Live: An Evolving Safety Benchmark for Foundation Models
- Towards Nexus-Score: Metadata Gaps Limit Scholarly AI Attribution
- PANOPTICON: A PII-Based Assemblage of Naturalistic Output Tokens for Investigating Privacy Leakage Within LLM Context Window
- StepX-Edge: An On-Device UI Vision-Language Model via Architecture-Training-Deployment Co-Design
- Not All LLM Reasoning is Visible in the Chain-of-Thought
- Beyond Exact Match: How Evaluation Methodology Dominates Model Choice in LLM-Based Product Attribute Extraction
- Mask2Shield: Strengthening LLM Safety against Neuron-Pruning Attacks
- False Prophets: On the Security of World Models in Agentic Systems
- Hiding in Plain Sight: An Effective Physical Adversarial Patch Attack against Visual-Infrared Fused Face Detection
- UltraViT: Latency-Optimized On-device Vision Encoder for Large Vision-Language Models
- Confidently Wrong: Exception Chain Collapse in Frontier LLM Rule Evaluation
- Inference-Time Consensus for Mitigating Hidden Behaviors from LLM Fine-Tuning
- Separating Capability from Permission: A Governance Framework for Agentic AI Autonomy Levels
- Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents
- Do LLMs Know Their Vulnerable Scenarios?
- The Illusion of Secure LLM Code: Closing the Security Gap via Iterative Reprompting
- Melo: A Production LLM-Powered Music Recommendation Agent
- AI Strategy: How to Choose What AI Product to Implement
- N₀-VTLA: Scaling Vision-Tactile-Language-Action Model with Latent Tactile Tokens
- N₀-TWAM: Scaling Tactile-Native World-Action Model for Contact-Rich Manipulation
- Memory Efficient Audio Synthesis with Decoupled Temporal Depth Diffusion Transformers
- SpecBox: Speculative Sandbox Scheduling for Efficient LLM Agent Serving
- A Cybersecurity MLPS Large Language Model with Multi-Path Retrieval Fusion
- Just Testing, Move Along: Evasion of LLM-based System Log Interpretation by Prompt Injection
- EXE-Bench: Ranking the Tradeoffs of AI-based Windows Malware Detectors for Real-World Usability
- Face Age Verification Vulnerabilities Under Simple Appearance Manipulations
- Gubernaut: A Deterministic Homeostatic Controller for Affect-Regulated LLM Agents, Validated Across Independent Model Families
- Beyond Aggregate Risk: Role-Stratified Conformal Risk Control for LLM Tool Calls
- When LLM Defenses Backfire: Characterizing Safety, Performance, and Cost Trade-offs
- The SpiNNaker2 chip: a many-core platform for flexible and scalable brain-inspired computing
- LLM-SoccerArena: Benchmarking LLMs on Real-World Predictions in Sports
- Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents
- RecGPT-V3 Technical Report
- CARE: Pre-Execution Command Verification for Shell-Executing LLM Agents
- Pixels for Programs? A Cross-Provider Case Study of Input-Token Accounting for Source Code as Text and Images
- Oxygen-TryOn: Fashion-Native Foundation Model for Any-item Virtual Try-On
- Every Model Cheats: Prompt-Level Mitigation of Cheating on Offensive Cyber Tasks
- Protocol-Level Attacks on Agentic Commerce Platforms: A Cross-Platform Taxonomy, AIP-Bench, and Unified Defense
- ToolGuardian: Declarative Security for AI Agent-Tool Interactions
- Certified in Theory, Broken in Practice: Assumption Gaps in Cryptographic Model Certification
- ISPCloak: Weaponizing ISP for Optimization-Free Physical Camouflage against Deepfake Detectors
- RIS-Kernel: A Model-Agnostic Architecture for Long-Context LLM Inference via Sparse Attention
- SIREN (Luring LLMs onto the Rocks): PAIR-Driven Preference Manipulation in Web-RAG Recommenders
- Efficient Online LLM Watermark Detection via Rao-Blackwellized E-Processes
- Analysing Self-Harm Representations in Language Models: a Cross-Architecture Study
- Zero-Shot Mission-Level Evaluation for Aerial MLLM Agents
- MEUSLI: a Multilingual Projector for LLM-based ASR and Beyond
- Universal BCI Personalization: One API for Frozen EEG Trunks and Foundation Models
- Dynamic Capability Scoping for Enterprise AI Agents: A Synthetic Dataset and Three-Source Permission Architecture
- Where FactsGo Missing: A LayerwiseTaxonomy and Per-Layer Attribution of Information Omissionin Air-Gapped LLM Agent Pipelines