AI Research Radar
July 31 – August 6: 11 frontier papers out of 2,254 read.
Frontier
Papers rated as moving the field
How we chooseSkillJack
“Results show that skill extraction substantially reduces attack detectability: in SkillX, safety detection drops from 98.5% for poisoned trajectories to 11.4% for extracted skills, while Anything2Skill shows a similar effect.”
Evading Chain-of-Thought Monitoring Through Model Poisoning
“We find that these CoT-Hidden backdoors can be induced through simple fine-tuning recipes across reasoning-model architectures and sizes.”
MatrAIx
“The declared behavior was expressed or correctly suppressed in 366 trials (91.5%).”
WorldCup Arena
“On match outcome they average 63.9%, level with backing the bookmaker's favourite -- which is in fact what they usually do.”
CITBench
AI Security Leaderboard
No Single Neuron of Failure
“Extensive experiments show that DSA substantially improves robustness against white-box neuron-level safety attacks while preserving the model's general language and multimodal utility.”
Measuring in-context algorithmic reasoning in language models against an exact Bayes-optimal standard
Benign Alone, Harmful Together
Memory Provenance Laundering in LLM Agents
The week by field
Jul 31 – Aug 6: 179 cleared, 11 frontier
The week’s papers have not been sorted into fields yet.
Models under test
Papers this week that name the model
Labs publishing
Papers this week with an author at the lab
Also cleared
168 papers
- PolicyGuard: Prompt-Configurable Semantic DLP for LLM Coding AgentsAmazon, OpenAI
- CLIFT: Turning Gemini Robotics On-Device into Humanoid Specialists via Non-Invasive Closed-Loop Iterative Fine-TuningGoogle, NVIDIA
- A Multimodal Automatic Redteaming Evaluation based on Atomic Jailbreak Strategy Decoupling and CombinationByteDance
- FinProBench: Evaluating Financial AI Agents with Role-Grounded Rubrics Derived from Professional DeliverablesAlibaba
- Social Pressure Breaks Majority Voting in LLM Safety PanelsAmazon
- Architectural Implications of Agentic AI WorkflowsMicrosoft
- Private Direct Preference Optimization for LLM AlignmentAlibaba
- Argus: A General-Purpose Agentic Runtime for Long-Horizon ReasoningMicrosoft
- Hunyuan3D-Buffalo 1.0: A Unified Multimodal Model for Scalable 3D Generation, Understanding, and EditingTencent
- Cross-Model KV Cache Transfer in LLM Families: A Closed-Form Linear Mapping for Prefill ReuseNVIDIA
- Google's AI & Economy ATLAS v1.0: Mapping Gemini Usage in the EconomyGoogle
- DiffusionGemma Technical ReportGoogle
All 168 papers
- Scoring Rules! Statistical and Strategic Alignment for Text Evaluation MetricsMicrosoft
- Two Sides of the Same Coin: Co-Evolving Search for Cross-Task Attacks on Vision-Language ModelsByteDance
- Can AI Agents Simulate A/B Test Outcomes? A Validation Framework for Agentic ExperimentationAmazon
- Right Answer, Wrong Method: Shortcut Hacking Misleads the Evaluation of LLM Reasoning on Frontier Science BenchmarksAlibaba
- The Asymmetric Effects of Knowledge Distillation on Bias in Small Language ModelsMeta
- Data Turnstile: A Scalable Open Framework for Function-Calling Data GenerationAmazon
- CryptanalysisBench: Can LLMs do Cryptanalysis?Anthropic
- ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework MappingAmazon
- LoRA Scaffolded Policy Optimization (LSPO): A Sampling-Time Low-Rank Scaffold for Recovering Reinforcement-Learning Gradient on Zero-Reward Cliff PromptsNVIDIA
- Agent Harness Distillation: Inference-Time Harness Extraction and Exploitation in Autonomous Multi-Agent SystemsBaidu
- Gradient Immunity: Null-Space Resistance to Malicious Fine-TuningCode
- Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection ExposureCode
- A Blind Spot in Alignment: Quantifying Biosecurity Risks in Large Language ModelsCode
- Evaluation Blindness: How Silent Measurement Failures Corrupt AI Systems from Training to DeploymentCode
- MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM AgentsCode
- LLM-OSDA: An Optimal-Stopping Dynamic Auction for Native Advertising in Multi-Turn LLM ConversationsCode
- Stateful Cooperative Agents Safeguarding LLMs Against Evolving Multi-Turn AttacksCode
- DeBERTa-Sentinel: Toward Transparent and Trustworthy Detection of AI-Generated TextCode
- Attend to Your Own Thoughts: Breaking the Barrier for Post-Training Quantization of Reasoning LLMs through the Lens of 1.58-Bit QuantizationCode
- SoK: Intent-Oriented Systematization of Multi-Turn LLM JailbreaksCode
- Gecko: Fast Private Inference via Secure Public Encoder OffloadingCode
- Retrieval-Driven Training-Free AI-Generated Video AttributionCode
- Tool Specifications Matter: Uncovering and Mitigating Safety Risks in AI AgentsCode
- Transplanting, inverting, and preventing a misalignment persona: method-conditional emergent misalignment in Qwen2.5
- Governing Execution Risk in Agentic AI Systems: A Trajectory-Guided Framework for Red Teaming
- SoK: How Frontier AI Reshapes System-Level Security Risk Dynamics in Critical Infrastructure
- AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection
- An Inline Control Architecture for Language Models in Intelligent Transportation Systems
- Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills
- The Fairness Collapse Phenomenon: Bias Amplification in Language Models Trained on Synthetic Data
- Binding Biometrics with AI Agent Identifiers for Delegation of Authority
- Trident : How to Break Deep Reinforcement Learning Cyber Defenses (Agentic)
- DataRx: Missingness-Aware Sampling for Safer Large Language Model Task-Specific Fine-Tuning
- Manipulation-Proof Oblivious Audits against Deceptive Model Providers
- Combating Knowledge Corruption in Agent Systems: A Byzantine-Tolerant Secure Collaborative RAG Framework
- CofactVLA: Deconfounding Vision-Language-Action Models via Counterfactual Intervention
- Deltoris: Enabling Real-time VLA Inference in Embodied AI via Bit-level Sparsity and Speculative Inference
- TwinIR: Coordinated Invisible Dual-Point Attacks on Online HD Map Construction
- DeepInvert: Semi-Supervised Embedding Inversion Against Obfuscated Language Models
- EuroExec: Frontier Language Models Fall Short of Expert Judgment on European Executive Decision Tasks
- Breadcrumbing Search Agents
- EmpaAva: An Open-source Agentic 3D-Avatar Empathetic Live Chatbot
- What We Observe as LLM Behavior Can Be a Side-effect of Inference Backend
- LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents
- Scrouting: Cost-Aware Routing of Coding Agents by Scouting the Repository First
- When Does Latent Communication Pay? A Causal Audit of Relayed KV Caches in Multi-Agent LLMs
- SciCode-Verified: How Benchmark Defects Underestimated the Scientific-Coding Ability of Language Models
- DelusionEval: Measuring Delusion-Linked Behaviors in AI Chatbots
- Short-term load forecasting under EU-AI Act Requirements in Safety-Critical Environments: Results from a 41-day live challenge on the aggregated German transmission-grid load
- When Do PEFT Adaptations Leak Structure? Measuring Black-Box Structural Bounds in Public-Base Model Services
- Hardware Design and Security in the Era of Chiplets and LLMs
- Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming
- Evaluating OpenAI's Privacy Filter: Cross-Lingual, Cross-Domain PII Detection Across 42 Benchmarks
- Moving the Safety Barrier: Dynamic Routing Adaptive Alignment Against White-Box Attacks
- DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial
- Safety in Batches? Understanding and Mitigating Safety Failures in Batch Prompting
- Steganalysis of Adaptive Covert Collusion in Tool-Using Agent Populations: A Black-Box, Cross-Principal Approach
- Confident but Unreliable: A Behavioral Safety Audit of Vision-Language Models on Brain MRI
- Toward Certified Functional Safety for Industrial Humanoid Robots: The Fail-Passive Gap and a Feasibility Study
- AnchorKV: Anchor-Residual KV Cache Compression
- Aligned in Form, Not in Meaning: The Comprehension - Containment Decoupling of LLM Safety in Low-Resource Bangla Derogatory Speech
- Qwen-3D: A Generalist 3D Vision-Language Model for Spatial Understanding
- Temporal Leakage in LLM Backtesting: Measurement, Validation, and Adjusted Scores
- SparSEEty: Extracting Tokens from Sparsity-Exploiting LLM Serving Systems via Deterministic Side Channels
- Tiny Enough to Break In: Agentic Remote Access Trojans Powered by Small Language Models
- DHMark: Public-Key Watermarking for LLM-Generated Text via Diffie-Hellman-Guided Rejection Sampling
- DP-MemView: A Memory Interface for Attribute-Level Transcript Privacy in Long-Term LLM Agents
- Attribute-based Undetectable Watermarking for Generative AI Models
- DRIFT: Derailing Denoising Trajectories of Flow-Matching VLAs with Adversarial Patch Attack
- ICO: Enhancing Semantic-Shift Jailbreaks via Iterative Context Optimization
- Structure-Aware Robust Fine-Tuning: Defending Vision-Language-Action Robots Against Physical Attention Hijacking
- Making AI Visible, Not Vanished: How AI Policies Reshape Developer Experience on GitHub
- FACTWASH: Catching AI Rewrites That Wash Hearsay into Fact
- A Security-Oriented Lifecycle Model for Large Language Model Systems
- Empirical Analysis of Evasion and Poisoning Against Malware Data Drift Detection
- Does Forgetting Transfer Across Modalities? A Real-World Benchmark for Cross-Modal Knowledge Unlearning Evaluation
- LatentGuard: Efficient and Inspectable Latent Reasoning for LLM Safeguards
- ADMITBench: A Safety-Governed Reference Framework for Evaluating the Admissibility of Industrial LLM Advisories
- MoWorld: A Flash World Model
- Cross-Branch Conflict as a Shield: Safeguarding Facial Identities in Unified Multimodal Image Editing
- CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFs
- InfoOps Bench: A live information operations safety benchmark
- Obshazard-bench: Benchmarking Multimodal Foundation Models for Real-Time Disaster Intelligence from Raw Earth Observation Streams
- Leak It: A Probabilistic Approach to Training-Data Extraction from Black-Box Language Models
- From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems
- A Few Neurons Reveal When LLMs Misuse Tools: Sparse Detection and Selective Steering for Reliable Tool Use
- Bayesian and Motivated Reasoning in AI Agents
- Auditable Release Control for Pedagogical Leakage in LLM Tutors
- Robust Watermarks Meet Backdoored Models: Evading Diffusion Semantic Watermarks via Stealthy Backdoor
- Crushing the Evidence: A Dual-Penalty Evasion Framework for Fooling White-Box Explainable AI Auditors
- OpenART: Scaling Agent Red Teaming via Open-Ended Environment Evolution
- EduPluginBench: Executable Assurance for AI-Generated Educational Plugins
- When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems
- Measurement Without Validity: The Compounding Reliability Problem in Agentic AI Evaluation
- SoniSpeech: A Large-Scale Open-Vocabulary Tri-Modal Dataset for Wearable Silent Speech Interfaces
- Stipple: Real-Time Incremental Gaussian Splatting with Visual-Inertial Tracking
- MonitorVLM-v2: A Deployed Vision-Language Framework for Real-Time Safety Violation Detection
- Toward Fine-Grained Forgetting:Attribute Unlearning for Multimodal Large Language Models
- Inverting the Hidden: Unveiling Multimodal Privacy Leakage in Collaborative LVLM Inference
- VLAGuard: A Framework for Evaluating and Mitigating Physical Attention Hijacking in Vision-Language-Action Robots within Wireless Sensor Networks
- Opt.Gear Technical Report
- Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreaks
- Don't Offer What Can't Be Done: Deterministic Executability Gating for LLM Skill Selection at Scale
- ReACT-CLIP: Response-Aware Test-Time Defense for Vision--Language Models
- When Collaboration Becomes a Trigger: Collective Evidence-Threshold Backdoors in Multi-Agent Systems
- Fighting Fire with Fire: On the Feasibility of Protecting Exercises Against AI Cheating
- When May a Model Replace the Experiment? Audits, Licenses, and the Price of Trust in Surrogate-Driven Design
- Same violence, different answer: how AI responds to coercive control against women across languages
- Sweet Little Lies: Strategic Deception in AI Emotional Support Chatbots
- Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw
- Understanding Sparse Attention Selectivity in Long-Context Foundation Models via Counterfactual Evaluation
- LaCache: Robust Semantic Caching for LLM Serving
- MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication
- Invisible Ink Threats: Adversarial Goals Behind Legitimate Tasks in Computer-Use Agents
- Secrets Everywhere: Auditing Memorization in Mobility Prediction Models
- Auditing Data Provenance in LLM Fine-tuning via Intrinsic Distributional Fingerprints
- Lost in Permissions: Exploring the Microsoft 365 App Ecosystem
- Advancing Relevance Measurement with Vision-Language Models for Web-Scale Search
- Real-Time Detection and Repair of LLM Agent Failures
- Magnet: Detecting Cross-Session AI Misuse Through Capability Accumulation
- ScopeJudge: Cost-Aware Pre-Execution Gating for Offensive Security Agents
- The Checking Problem: What must be true before AI ships in a regulated firm
- Reasoning in Real World Clinical Care: Why Large Language Models Are Not Yet Safe for Autonomous Clinical Decision Support
- Cloned Voices, Real Consequences: Evaluating Bias in Political Deepfake Detection for Electoral Integrity in Brazil
- TextCloak: Thwarting Unauthorized LLM Exploitation via RL-Driven Unlearnable Text
- Hollow-LLM Attack: Computationally Trivial Weights in Zero-Knowledge Verification of LLM Inference
- DiffAttack: Evasion Attacks Against Face Recognition via Latent Diffusion Models
- SULAND v2: A Refined RGB Dataset and Deep Learning Object Detection Benchmark for UAV/UGV-Based SUrface LANDmine Detection Under Domain Shift
- Have I Seen You? Embedding Behavior Signals Synthetic Face Dataset Membership
- ActFovea: Runtime Safeguarding for VLA Policies via Spatiotemporal Visual-Action Consistency
- MOSAIC: Masked Outsourcing of Secure AI Computations
- BWM: A Low-Cost High-Fidelity World Simulator for Robot Learning
- The persuasive power of large language models does not depend on their perceived national origin
- QR-Structured Thermal Triggers for Targeted Semantic Attacks on Infrared Vision-Language Models
- TokTier: Exact Stateful Tokenization for Agentic LLM Serving
- Refusing Intent, Not Form: Wrapper-Based Intent-Group Supervision for LLM Safety
- Conformal Cascade: Distribution-Free Accuracy Guarantees for Multi-Tier LLM Inference
- Flat Score, Amplified Failures: How the Error Budget Masks Damage in Quantized LLM Agents
- Open Security Benchmark: Towards Autonomous Enterprise Cyber Defense
- VETO: Towards Protecting Images From Frontier AI Editing
- SIGIL: Compiling Agent Skills into Typed Harnesses
- LayerRAG-Bench: A Cross-Layer Reliability Benchmark for Agentic Retrieval-Augmented Generation
- RoguePrompt: Dual-Layer Encoding for Self-Reconstruction to Circumvent LLM Moderation
- Stop Shipping AI Agents on Faith: Capability Is Not Production Readiness
- Safety-Gated Agentic Supervisory Control on a Coupled Distillation Benchmark: Regime Map, Auditable Gate, and Co-Design Findings
- Don't Trust the AI Ecosystem: Analyzing Privacy Leakage in Compromised Open-Source Components
- TriShield: Zero-Utility-Loss Defense Against Privacy Backdoors in Federated Language Model Fine-Tuning via Orthogonal Gradient Projection and Optimizer State Entanglement
- Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs
- Beyond Binary Rewards: A Comparative Study of Reward Design for Reinforcement Unlearning
- Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attacks
- Temporal Poisoning: Clean-Label Backdoors via Event Redistribution in SNNs
- Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents
- Old Tricks, New Models: How Simple Image Transformations Break Modern AI-based Content Moderation
- Fidelity Is Not Safety: Gently-Compressed LLMs Pass Every Data-Free Quality Guard Yet Invent Procedure Steps in Agentic Execution
- CoGate: Confidence-Gated Co-Decoding for Secure Code Generation
- AISPA: User-Centric System Prompt Auditing for Large Language Model Applications