GPT-Red
Automated Red Teaming via Self-Play at Scale
AI Research Radar
July 29 – August 4: 10 frontier papers out of 2,153 read.
Frontier
Papers rated as moving the field
How we chooseAPEX-Accounting
“No model scores more than 2.6% Pass^8 (GPT-5.6-Sol (Max+Pro)) and the highest Pass@8 is 21.5% (Muse-Spark-1.1 (xHigh)).”
CITBench
No Single Neuron of Failure
“Extensive experiments show that DSA substantially improves robustness against white-box neuron-level safety attacks while preserving the model's general language and multimodal utility.”
Measuring in-context algorithmic reasoning in language models against an exact Bayes-optimal standard
Benign Alone, Harmful Together
Memory Provenance Laundering in LLM Agents
On-Policy Distillation for LLM Safety
“Our results demonstrate that when baseline defenses face template mismatches, often accompanied by severe degradation in downstream task performance.”
Explanation-Bound Tool Execution for AI Agents
Architectural Backdoors in Vision-Language Model Supply Chains via Representation Steering
“The results show that the proposed architectural steering backdoor compromises integrity, safety enforcement, and ranking fairness while preserving normal behavior on clean inputs.”
The week by field
Jul 29 – Aug 4: 160 cleared, 10 frontier
The week’s papers have not been sorted into fields yet.
Also cleared
150 papers
- CLIFT: Turning Gemini Robotics On-Device into Humanoid Specialists via Non-Invasive Closed-Loop Iterative Fine-TuningGoogle, NVIDIA
- Choosing Where and How to Moderate: End-to-End Trade-offs in Filter Placement and Response RewritingMicrosoftCode
- Google's AI & Economy ATLAS v1.0: Mapping Gemini Usage in the EconomyGoogle
- DiffusionGemma Technical ReportGoogle
- Scoring Rules! Statistical and Strategic Alignment for Text Evaluation MetricsMicrosoft
- Two Sides of the Same Coin: Co-Evolving Search for Cross-Task Attacks on Vision-Language ModelsByteDance
- Can AI Agents Simulate A/B Test Outcomes? A Validation Framework for Agentic ExperimentationAmazon
- Right Answer, Wrong Method: Shortcut Hacking Misleads the Evaluation of LLM Reasoning on Frontier Science BenchmarksAlibaba
- The Asymmetric Effects of Knowledge Distillation on Bias in Small Language ModelsMeta
- Data Turnstile: A Scalable Open Framework for Function-Calling Data GenerationAmazon
- CryptanalysisBench: Can LLMs do Cryptanalysis?Anthropic
- ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework MappingAmazon
All 150 papers
- LoRA Scaffolded Policy Optimization (LSPO): A Sampling-Time Low-Rank Scaffold for Recovering Reinforcement-Learning Gradient on Zero-Reward Cliff PromptsNVIDIA
- Agent Harness Distillation: Inference-Time Harness Extraction and Exploitation in Autonomous Multi-Agent SystemsBaidu
- Incast-Free MoE Rate-Based SchedulingNVIDIA
- Hearsay: Vision-Language Medical Diagnoses Without an ImageAmazon
- Qwen-Audio-3.0-Gen-Preview Technical ReportAlibaba
- Harm is not Universal: Community-Specific Toxicity Detection is Urgently NeededMicrosoft
- Mage-VL: An Efficient Codec-Native Streaming Multimodal Foundation ModelMicrosoft
- The User Asks, Platforms Compete: How Agentic Recommendation Markets Take ShapeTencent
- Hybrid Analysis for Secure MCP Tool Use in LLM AgentsAlibaba
- LLM-OSDA: An Optimal-Stopping Dynamic Auction for Native Advertising in Multi-Turn LLM ConversationsCode
- Stateful Cooperative Agents Safeguarding LLMs Against Evolving Multi-Turn AttacksCode
- DeBERTa-Sentinel: Toward Transparent and Trustworthy Detection of AI-Generated TextCode
- Attend to Your Own Thoughts: Breaking the Barrier for Post-Training Quantization of Reasoning LLMs through the Lens of 1.58-Bit QuantizationCode
- SoK: Intent-Oriented Systematization of Multi-Turn LLM JailbreaksCode
- Gecko: Fast Private Inference via Secure Public Encoder OffloadingCode
- Retrieval-Driven Training-Free AI-Generated Video AttributionCode
- Tool Specifications Matter: Uncovering and Mitigating Safety Risks in AI AgentsCode
- Steering Instruction Hierarchies at Inference TimeCode
- TurboVLA: Real-Time Vision-Language-Action Model at 32 Hz on an RTX 4090 with <1 GB VRAMCode
- Ranked by Position: Order Sensitivity as an Exploitable Attack Surface in LLM Listwise RecommendersCode
- ScalableRAG: High-Quality RAG at Zero Ingestion CostCode
- MoWorld: A Flash World Model
- Cross-Branch Conflict as a Shield: Safeguarding Facial Identities in Unified Multimodal Image Editing
- CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFs
- InfoOps Bench: A live information operations safety benchmark
- Obshazard-bench: Benchmarking Multimodal Foundation Models for Real-Time Disaster Intelligence from Raw Earth Observation Streams
- Leak It: A Probabilistic Approach to Training-Data Extraction from Black-Box Language Models
- From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems
- A Few Neurons Reveal When LLMs Misuse Tools: Sparse Detection and Selective Steering for Reliable Tool Use
- Bayesian and Motivated Reasoning in AI Agents
- Auditable Release Control for Pedagogical Leakage in LLM Tutors
- Robust Watermarks Meet Backdoored Models: Evading Diffusion Semantic Watermarks via Stealthy Backdoor
- Crushing the Evidence: A Dual-Penalty Evasion Framework for Fooling White-Box Explainable AI Auditors
- OpenART: Scaling Agent Red Teaming via Open-Ended Environment Evolution
- EduPluginBench: Executable Assurance for AI-Generated Educational Plugins
- When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems
- Measurement Without Validity: The Compounding Reliability Problem in Agentic AI Evaluation
- SoniSpeech: A Large-Scale Open-Vocabulary Tri-Modal Dataset for Wearable Silent Speech Interfaces
- Stipple: Real-Time Incremental Gaussian Splatting with Visual-Inertial Tracking
- MonitorVLM-v2: A Deployed Vision-Language Framework for Real-Time Safety Violation Detection
- Toward Fine-Grained Forgetting:Attribute Unlearning for Multimodal Large Language Models
- Inverting the Hidden: Unveiling Multimodal Privacy Leakage in Collaborative LVLM Inference
- VLAGuard: A Framework for Evaluating and Mitigating Physical Attention Hijacking in Vision-Language-Action Robots within Wireless Sensor Networks
- Opt.Gear Technical Report
- Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreaks
- Don't Offer What Can't Be Done: Deterministic Executability Gating for LLM Skill Selection at Scale
- ReACT-CLIP: Response-Aware Test-Time Defense for Vision--Language Models
- When Collaboration Becomes a Trigger: Collective Evidence-Threshold Backdoors in Multi-Agent Systems
- Fighting Fire with Fire: On the Feasibility of Protecting Exercises Against AI Cheating
- When May a Model Replace the Experiment? Audits, Licenses, and the Price of Trust in Surrogate-Driven Design
- Same violence, different answer: how AI responds to coercive control against women across languages
- Sweet Little Lies: Strategic Deception in AI Emotional Support Chatbots
- Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw
- Understanding Sparse Attention Selectivity in Long-Context Foundation Models via Counterfactual Evaluation
- LaCache: Robust Semantic Caching for LLM Serving
- MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication
- Invisible Ink Threats: Adversarial Goals Behind Legitimate Tasks in Computer-Use Agents
- Secrets Everywhere: Auditing Memorization in Mobility Prediction Models
- Auditing Data Provenance in LLM Fine-tuning via Intrinsic Distributional Fingerprints
- Lost in Permissions: Exploring the Microsoft 365 App Ecosystem
- Advancing Relevance Measurement with Vision-Language Models for Web-Scale Search
- Real-Time Detection and Repair of LLM Agent Failures
- Magnet: Detecting Cross-Session AI Misuse Through Capability Accumulation
- ScopeJudge: Cost-Aware Pre-Execution Gating for Offensive Security Agents
- The Checking Problem: What must be true before AI ships in a regulated firm
- Reasoning in Real World Clinical Care: Why Large Language Models Are Not Yet Safe for Autonomous Clinical Decision Support
- Cloned Voices, Real Consequences: Evaluating Bias in Political Deepfake Detection for Electoral Integrity in Brazil
- TextCloak: Thwarting Unauthorized LLM Exploitation via RL-Driven Unlearnable Text
- Hollow-LLM Attack: Computationally Trivial Weights in Zero-Knowledge Verification of LLM Inference
- DiffAttack: Evasion Attacks Against Face Recognition via Latent Diffusion Models
- SULAND v2: A Refined RGB Dataset and Deep Learning Object Detection Benchmark for UAV/UGV-Based SUrface LANDmine Detection Under Domain Shift
- Have I Seen You? Embedding Behavior Signals Synthetic Face Dataset Membership
- ActFovea: Runtime Safeguarding for VLA Policies via Spatiotemporal Visual-Action Consistency
- MOSAIC: Masked Outsourcing of Secure AI Computations
- BWM: A Low-Cost High-Fidelity World Simulator for Robot Learning
- The persuasive power of large language models does not depend on their perceived national origin
- QR-Structured Thermal Triggers for Targeted Semantic Attacks on Infrared Vision-Language Models
- TokTier: Exact Stateful Tokenization for Agentic LLM Serving
- Refusing Intent, Not Form: Wrapper-Based Intent-Group Supervision for LLM Safety
- Conformal Cascade: Distribution-Free Accuracy Guarantees for Multi-Tier LLM Inference
- Flat Score, Amplified Failures: How the Error Budget Masks Damage in Quantized LLM Agents
- Open Security Benchmark: Towards Autonomous Enterprise Cyber Defense
- VETO: Towards Protecting Images From Frontier AI Editing
- SIGIL: Compiling Agent Skills into Typed Harnesses
- LayerRAG-Bench: A Cross-Layer Reliability Benchmark for Agentic Retrieval-Augmented Generation
- RoguePrompt: Dual-Layer Encoding for Self-Reconstruction to Circumvent LLM Moderation
- Stop Shipping AI Agents on Faith: Capability Is Not Production Readiness
- Safety-Gated Agentic Supervisory Control on a Coupled Distillation Benchmark: Regime Map, Auditable Gate, and Co-Design Findings
- Don't Trust the AI Ecosystem: Analyzing Privacy Leakage in Compromised Open-Source Components
- TriShield: Zero-Utility-Loss Defense Against Privacy Backdoors in Federated Language Model Fine-Tuning via Orthogonal Gradient Projection and Optimizer State Entanglement
- Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs
- Beyond Binary Rewards: A Comparative Study of Reward Design for Reinforcement Unlearning
- Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attacks
- Temporal Poisoning: Clean-Label Backdoors via Event Redistribution in SNNs
- Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents
- Old Tricks, New Models: How Simple Image Transformations Break Modern AI-based Content Moderation
- Fidelity Is Not Safety: Gently-Compressed LLMs Pass Every Data-Free Quality Guard Yet Invent Procedure Steps in Agentic Execution
- CoGate: Confidence-Gated Co-Decoding for Secure Code Generation
- AISPA: User-Centric System Prompt Auditing for Large Language Model Applications
- ResearchArena: Evaluating Sabotage and Monitoring in Automated AI R&D
- Transforming Keystroke Noise to Text: Self-Supervised Acoustic Eavesdropping Attacks on Keyboards
- The Human Utility Factor: A Computable Welfare Metric That Reframes AI Governance as a Constrained Optimisation Problem
- AI Security Priorities: A Field-Wide Agenda
- Meta-Learned Reward Shaping for Reinforcement Learning from Human Feedback
- Validating ETCS Data with the B Mathematical Language: An Industrial Pipeline and a Blueprint for LLM Integration
- StealthBench: Measuring Operational Stealth in Autonomous Offensive-Security Agents
- RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning
- (Im)Paired Programming: Coding Agents Improve Productivity but Harm Understanding
- Prosody-driven Jailbreaks in Audio LLMs: A Controlled Study and Mechanistic Analysis
- Recover, Decode, Reguard: Guard-Agnostic Defense Amplification againstEncoded VLM Jailbreaks
- Physically Real-time Infrared Attack against Optical Flow Estimation Networks
- ToxScreen: Detecting Whether an LLM Has Been Poisoned
- AgentSnare: Learning to Delay, Divert, and Defuse Autonomous Penetration Agents
- InferScale: GPU-Native KV Injection for Personalized LLM Serving
- Pangram 4 Technical Report
- RDQ: Residual Distribution Quantization for Large Language Models
- ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents
- LLM Scheming Inversely Scales with Pretraining Language Coverage
- The Mirage of LLM Guardrails: A Case Study in AI-Assisted Medical Note Manipulation
- The Missing Layer: Specification Infrastructure for AI Oversight
- Early Detection of Distributed Backdoors in Multi-Agent LLM Systems: A Characterization Study
- TYPO: Instruction-Dense Visual Jailbreaks against Commercial Closed-Source Image-Generation Models
- ALIBI: Adaptive Agentic Attacks on LLM-Based Vulnerability Detectors via Adversarial Code Comments
- Decision-Level Hijacking: Injecting Cognitive Bias into Large Language Models via Bit-Flip Attacks
- Instruction-Tuned Language Models Cannot Sample from Distributions They Can Describe
- Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response
- From Dyad to Triad: Eliciting XAI Requirements in Stroke Rehabilitation
- I2VShield: An Efficient Proactive Defense Framework against DiT-based Image-to-Video Models
- PILA: Plug-and-Play Insertion for LLM-native Advertising
- SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents
- Construction-Driven Injection: Linguistically-Grounded Edit-Based Code-Mixing Fingerprints for Large Language Models
- Why Public Service AI Governance Frameworks Risk Failing in the Age of General-Purpose AI: Lessons from Policing
- Runtime Uncertainty Monitoring for LLM-Based Multi-Agent Systems Using Bayesian Networks
- TIGA: Trajectory-Injected Generative Attack against Black-box AIGC Detectors
- Minimizing Targeted Activations: Input-Only Suppression of Evaluation-Awareness Latents in Large Language Models
- Toward Standardized Cross-Vendor Agent Tool Trust Management in Autonomous Networks
- From Role Prompt to Infinite Thinking: Exploiting Persona Conditioning for Inference Cost Attacks in LLMs
- Falling Behind Drives Unsafe Development in an Idealised AI Race Experiment