AI Research Radar
August 5–11: 13 frontier papers out of 2,153 read.
Frontier
Papers rated as moving the field
How we chooseSkillJack
“Results show that skill extraction substantially reduces attack detectability: in SkillX, safety detection drops from 98.5% for poisoned trajectories to 11.4% for extracted skills, while Anything2Skill shows a similar effect.”
C³PO
“Through attention probes, we find 86-95% of failures stem from modality dominance: models commit to one modality while ignoring contradictory evidence, concentrating 87-95% of attention on text.”
Evading Chain-of-Thought Monitoring Through Model Poisoning
“We find that these CoT-Hidden backdoors can be induced through simple fine-tuning recipes across reasoning-model architectures and sizes.”
Motif 3
“Across a broad evaluation suite, Motif 3 demonstrates competitive performance against leading open weight models, including strong results on long-horizon agentic tasks, mathematical reasoning, scientific knowledge, and hallucination-sensitive evaluation.”
ComplexityWorld
“Under direct inference, all evaluated models ex- cept GPT-5.6-Sol remain below 40% verifier ac- ceptance rate (VAR), while GPT-5.6-Sol reaches 75.6%.”
Social Gym and SPaRTan
“Our results show that SPaRTan playbooks help GPT-5-mini agents level their performance on weaker roles, but largely do not improve Qwen3-32B's performance.”
SWE-Bench ProMax
“Experiments with frontier models under two agent scaffolds show that the best model achieves only 41.2% resolve rate, confirming that SWE-Bench ProMax presents a meaningful and unsaturated challenge for current AI coding agents.”
Scaling Inherently Interpretable Language Models
“Steerling-8B remains competitive with open peer models trained on substantially 2-16x more compute, suggesting a different scaling paradigm: interpretability can be designed into training, and it improves with scale.”
MatrAIx
“The declared behavior was expressed or correctly suppressed in 366 trials (91.5%).”
WorldCup Arena
“On match outcome they average 63.9%, level with backing the bookmaker's favourite -- which is in fact what they usually do.”
CircuitReason-1k
AI Security Leaderboard
The week by field
Aug 5–11: 171 cleared, 13 frontier
The week’s papers have not been sorted into fields yet.
Models under test
Papers this week that name the model
Labs publishing
Papers this week with an author at the lab
Also cleared
158 papers
- Targeted Counterfactual Fingerprinting for Black-Box LLM Ownership VerificationAlibaba, Microsoft
- PolicyGuard: Prompt-Configurable Semantic DLP for LLM Coding AgentsAmazon, OpenAI
- From Inaudible Inputs to Model Failures: Low-Frequency Safety Risks in LALMsTencent
- RynnValue: Scaling Robotic Value Foundation Models with Temporal DistanceAlibaba
- HunyuanOCR-1.5: Making Lightweight OCR VLMs Faster and BetterTencent
- Detecting Safety Training Modification in Language Models via Activation AnalysisGoogle
- A Multimodal Automatic Redteaming Evaluation based on Atomic Jailbreak Strategy Decoupling and CombinationByteDance
- FinProBench: Evaluating Financial AI Agents with Role-Grounded Rubrics Derived from Professional DeliverablesAlibaba
- Social Pressure Breaks Majority Voting in LLM Safety PanelsAmazon
- Architectural Implications of Agentic AI WorkflowsMicrosoft
- Private Direct Preference Optimization for LLM AlignmentAlibaba
- Argus: A General-Purpose Agentic Runtime for Long-Horizon ReasoningMicrosoft
All 158 papers
- Hunyuan3D-Buffalo 1.0: A Unified Multimodal Model for Scalable 3D Generation, Understanding, and EditingTencent
- Cross-Model KV Cache Transfer in LLM Families: A Closed-Form Linear Mapping for Prefill ReuseNVIDIA
- Yesterday's Shield, Today's Spear: A Self-Evolving Safety Guardrail in ProductionCode
- StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt InjectionCode
- When Context Bites: Detecting RAG Poisoning via Document-Level Attention CollapseCode
- Diffusion LLMs as Targets and Adversaries: Mechanistic Safety ExploitsCode
- WitCert: Sound Runtime Risk Observability and Gating for KV-Cache QuantizationCode
- Towards a Risk Assessment of Malicious Skill Files in Coding AgentsCode
- Reversible Unlearnable Examples: Towards the Copyright Protection in Deep Learning EraCode
- Gradient Immunity: Null-Space Resistance to Malicious Fine-TuningCode
- Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection ExposureCode
- A Blind Spot in Alignment: Quantifying Biosecurity Risks in Large Language ModelsCode
- Evaluation Blindness: How Silent Measurement Failures Corrupt AI Systems from Training to DeploymentCode
- MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM AgentsCode
- The Moving Target: A Longitudinal Audit of Trust-Benchmark Score Drift Across Open-Source Chat LLM Release Lines
- Coordinated incentives in AI-generated misinformation governance
- Designing for Ethical AI: HCI Feature Considerations to Improve Fairness and User Experience in AutoML use for Human Resources
- The Transparency Trap: How AI Disclaimers Create Overconfidence in High-Stakes Decisions
- KumbhDoot: A Scale-Ready, LLM-Bounded Architecture for Mass-Gathering Public-Service Assistants
- The Knowing-Saying Gap: When Probes See Errors that Confidence Misses
- From Single Chatbots to Governed Agent Ecosystems: An Agentic AI Pattern Catalogue and Orchestration Framework for Mission-Critical Hospital Information Management Systems
- Adversarial Attacks on Deep OCR Systems
- Protecting patient privacy in clinical foundation models: Technical and legal perspectives
- Who Verifies the Benchmark? Decentralizing Trust in Large Language Model Evaluation
- Can AI Write Compliant Code, and to What Extent? Evaluating SOC 2 Compliance of Claude Fable 5, Claude Opus 4.8, and Claude Opus 5 Across Four Use Cases
- Who Built This Model? Tracing LLM Lineage via Spectral Fingerprints in Weight Space
- The Anatomy of a Prompt Injection: A Component Model for Structured Analysis
- How Much Does It Cost to Answer My Question? Benchmarking Cloud VLM-based VQA Systems
- Forged Peer Judgments Mislead Multimodal LLM Judge Panels: Source-Blind Anchoring and Panel-Consensus Verification
- Persistent Semantic Entities in Tool-Augmented LLM Systems
- BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes
- Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection
- Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario
- TokenPrint: A Calibrated Token-Space Fingerprint for Language-Model Provenance
- The Replay Gap: Static Evaluation of Model Switching in LLM Agents Scores the Wrong World
- OBLIVION: Workflow-Level Operational Skill Unlearning for Deployed Agents
- Query-Only Backdoor Attacks on Self-Evolving Skills via Trajectory Poisoning
- VectraYX-Vision-1B: A Sub-2B Spanish/LATAM Cybersecurity Vision-Language Model with Structured Visual Reasoning and Native Tool Use
- Task-to-Model Optimization for Enterprise LLM Coding Assistants: A Data-Driven Framework for Cost-Optimal Routing
- The Scaffolding Matters More Than the Interface: A Controlled Comparison of MCP and CLI Tool Use Across Seven Agent Scaffoldings, Five Language Models, and One Software Task
- Toward Metacognitive One-Shot Indirect Prompt Injection: Strategy Abstraction Via Outcome-Conditioned Reflection
- Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection
- Same Question, Different Answer? Measuring and Mitigating Prompt Privilege for Equitable AI Access
- Measuring the Tokenization Premium: A Cost Audit for Underserved Language Communities
- Telemetry and Concealment in Self-Adapting Generative AI: Logging Architecture, Adversarial Model Hiding, and the Limits of Detection
- SLAC: Access-Driven CPU-to-GPU Side-channel Attacks via System-Level Cache on Apple Silicon
- Governing the KV Cache: Preventing Timing Side-Channel Leakage in Multi-Tenant LLM Inference
- Business Truth, not SQL Accuracy: A Rule-Gated 7B Analytics Agent Outperforms a Direct-Prompted 32B Baseline
- DiffSafeMerge: Mitigating Backdoor Inheritance in Diffusion Model Merging
- Carnot: Interpretable, Interactive, and Optimized Execution of Deep Research Queries
- Pragmatic Attack Surface: Vulnerabilities of Implicit Context in Large Language Models
- ElasticBack: Stealthy Conditional Backdoor in LLM-Agent Skills via Coupled Trigger-Rule Optimization
- Activation Probes Surface Code-Security Signals that the Model's Output Misses
- ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners
- Macaron-V1: Towards Open Continual Learning with Self-Improvement and Mixture-of-LoRA
- Stealing Reasoning Traces from Proprietary LLM APIs
- XPolicyLab: A Unified Standard and Open Ecosystem for Robot Policy Evaluation and Deployment
- WorldMark: A Plug-and-Play World Knowledge Interface for Cross-Host Language Model Watermarking
- Sharding Prevents LLM Oversight Failures and Adversarial Exploitation
- Fairis: Fairness-Aware Aggregation with Provable Influence Containment against Fairness Poisoning Attacks in Collaborative Machine Learning
- Corrupting Attention: Evasion-Based Adversarial Attacks on Encoder Attention in Detection Transformers
- CubicQuant: Parametric Non-Uniform Codebooks for High-Throughput LLM Inference with 1-8-Bit Weights
- Genotypic Triggers: Exposing Pharmacogenomic Blind Spots via Host-Specific Backdoors in Generative Antimicrobial Peptide Models
- LoRAScan: Detecting Backdoor Prompts in Low-Rank Adapters for Large Language Models via Down-Projection Activation Spikes
- When Coordination Becomes a Threat: Communication Attacks in LLM-Controlled Multi-Robot Systems
- SynChain: Inducing Computer-Use Agent Systems to Construct Their Own Attack Chains
- Does Splitting a Triage Decision Across Agents Hide Bias or Help Catch It? A Multi-Agent Simulation Study of LLM-Based Resource Allocation Under Audit Capacity Constraints
- Invisible to the Machine: Auditing AI Restaurant, Cafe, and Bar Recommendation Against a Complete Market Census
- NiyamAI - An Intent-Bound AI Agent with Cryptographically Verifiable Guardrails using Zero-Knowledge Proofs
- Taxonomy-Driven Analysis of Open-Source AI Risk Mitigation Tools
- Large Language Models Threaten Double-blind Review
- SemiAdapt-Instruct: Extensible Instruction Tuning via Latent Domain-Specialised Adapters
- Cross-Architecture Steering Transfer in Language Models: A Systematic Empirical Study
- IMMENSE: Inductive Multi-perspective User Classification in Social Networks
- Mood Matters: How Syntactic Sensitivity Undermines Safety Alignment
- Negotiating Risk Boundaries in AI for Policing Through Mixed-Stakeholder Deliberation
- PromptShield Home: Ambient Multimodal Prompt Injection Defense for Smart-Home Agents
- AffectDF: The Most Comprehensive Benchmark for Speech Deepfake Detection against Emotionally Expressive Attacks
- When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems
- Epistemic Trustworthiness in Generative AI: A Normative Framework for Warranted Reliance in High-Stakes Workflows
- Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks
- DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model
- Hijacking Robots with a Piece of Paper: A Systematic Study of Physical Prompt Injection in VLM-Controlled Robots
- Subliminal Learning is Non-Semantic Distillation
- Once a Response, Always a Response: Detecting LLM-generated Text via Latent Prompt Restoration
- CodeGrep: An RL-Trained Retrieval Agent for LLM Coding Agents
- From Siloed Algorithms to Compliance-First Agentic Platforms: A Multi-Layered Architecture for Hospital AI Systems
- Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture
- Decolonizing Linguistic Policies in Automated Speech Recognition: A Framework for Cross-Culturally Competent Speech AI
- Reducing belief in conspiracy theories as they unfold using large language models
- AV-AIVAT: 74x Cheaper Agent Evaluation with Certified Anytime-Valid Stopping in Imperfect-Information Games
- Transplanting, inverting, and preventing a misalignment persona: method-conditional emergent misalignment in Qwen2.5
- Governing Execution Risk in Agentic AI Systems: A Trajectory-Guided Framework for Red Teaming
- SoK: How Frontier AI Reshapes System-Level Security Risk Dynamics in Critical Infrastructure
- AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection
- An Inline Control Architecture for Language Models in Intelligent Transportation Systems
- Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills
- The Fairness Collapse Phenomenon: Bias Amplification in Language Models Trained on Synthetic Data
- Binding Biometrics with AI Agent Identifiers for Delegation of Authority
- Trident : How to Break Deep Reinforcement Learning Cyber Defenses (Agentic)
- DataRx: Missingness-Aware Sampling for Safer Large Language Model Task-Specific Fine-Tuning
- Manipulation-Proof Oblivious Audits against Deceptive Model Providers
- Combating Knowledge Corruption in Agent Systems: A Byzantine-Tolerant Secure Collaborative RAG Framework
- CofactVLA: Deconfounding Vision-Language-Action Models via Counterfactual Intervention
- Deltoris: Enabling Real-time VLA Inference in Embodied AI via Bit-level Sparsity and Speculative Inference
- TwinIR: Coordinated Invisible Dual-Point Attacks on Online HD Map Construction
- DeepInvert: Semi-Supervised Embedding Inversion Against Obfuscated Language Models
- EuroExec: Frontier Language Models Fall Short of Expert Judgment on European Executive Decision Tasks
- Breadcrumbing Search Agents
- EmpaAva: An Open-source Agentic 3D-Avatar Empathetic Live Chatbot
- What We Observe as LLM Behavior Can Be a Side-effect of Inference Backend
- LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents
- Scrouting: Cost-Aware Routing of Coding Agents by Scouting the Repository First
- When Does Latent Communication Pay? A Causal Audit of Relayed KV Caches in Multi-Agent LLMs
- SciCode-Verified: How Benchmark Defects Underestimated the Scientific-Coding Ability of Language Models
- DelusionEval: Measuring Delusion-Linked Behaviors in AI Chatbots
- Short-term load forecasting under EU-AI Act Requirements in Safety-Critical Environments: Results from a 41-day live challenge on the aggregated German transmission-grid load
- When Do PEFT Adaptations Leak Structure? Measuring Black-Box Structural Bounds in Public-Base Model Services
- Hardware Design and Security in the Era of Chiplets and LLMs
- Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming
- Evaluating OpenAI's Privacy Filter: Cross-Lingual, Cross-Domain PII Detection Across 42 Benchmarks
- Moving the Safety Barrier: Dynamic Routing Adaptive Alignment Against White-Box Attacks
- DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial
- Safety in Batches? Understanding and Mitigating Safety Failures in Batch Prompting
- Steganalysis of Adaptive Covert Collusion in Tool-Using Agent Populations: A Black-Box, Cross-Principal Approach
- Confident but Unreliable: A Behavioral Safety Audit of Vision-Language Models on Brain MRI
- Toward Certified Functional Safety for Industrial Humanoid Robots: The Fail-Passive Gap and a Feasibility Study
- AnchorKV: Anchor-Residual KV Cache Compression
- Aligned in Form, Not in Meaning: The Comprehension - Containment Decoupling of LLM Safety in Low-Resource Bangla Derogatory Speech
- Qwen-3D: A Generalist 3D Vision-Language Model for Spatial Understanding
- Temporal Leakage in LLM Backtesting: Measurement, Validation, and Adjusted Scores
- SparSEEty: Extracting Tokens from Sparsity-Exploiting LLM Serving Systems via Deterministic Side Channels
- Tiny Enough to Break In: Agentic Remote Access Trojans Powered by Small Language Models
- DHMark: Public-Key Watermarking for LLM-Generated Text via Diffie-Hellman-Guided Rejection Sampling
- DP-MemView: A Memory Interface for Attribute-Level Transcript Privacy in Long-Term LLM Agents
- Attribute-based Undetectable Watermarking for Generative AI Models
- DRIFT: Derailing Denoising Trajectories of Flow-Matching VLAs with Adversarial Patch Attack
- ICO: Enhancing Semantic-Shift Jailbreaks via Iterative Context Optimization
- Structure-Aware Robust Fine-Tuning: Defending Vision-Language-Action Robots Against Physical Attention Hijacking
- Making AI Visible, Not Vanished: How AI Policies Reshape Developer Experience on GitHub
- FACTWASH: Catching AI Rewrites That Wash Hearsay into Fact
- A Security-Oriented Lifecycle Model for Large Language Model Systems
- Empirical Analysis of Evasion and Poisoning Against Malware Data Drift Detection
- Does Forgetting Transfer Across Modalities? A Real-World Benchmark for Cross-Modal Knowledge Unlearning Evaluation
- LatentGuard: Efficient and Inspectable Latent Reasoning for LLM Safeguards
- ADMITBench: A Safety-Governed Reference Framework for Evaluating the Admissibility of Industrial LLM Advisories