AI Research Radar
September 3–9: 13 frontier papers out of 1,916 read.
Frontier
Papers rated as moving the field
How we chooseHow Long Until Your Robot Ignores You? A Safety Benchmark for LLM Orchestrators in Human-Humanoid Collaboration
“We find that (1) model family determines the safety floor, as Claude and Gemini remain at or near zero violations while GPT-4o-mini commits up to 13 per session, (2) context management dissociates two failure axes, reducing mean behavioral issues by 42-57% for every cloud backend while nearly doubling GPT-4o-mini's violations (3.8 to 7.2 per session), and (3) proportional compliance, clamping movement speed to the rule-specified maximum rather than refusing, emerges consistently only in Gemini; the preliminary simulation layer reproduces the model ranking and the GPT-4o-mini failure-mode inversion.”
Q2D-Web
“Retaining a third of the corpus, selected by reciprocal rank fusion over pooled retriever runs, preserves the full-corpus model ranking under the combined judgments while raising absolute Recall@1000 only by 3 to 7 points.”
A Cost-Aware Agentic Architecture for NL-to-SQL over Nested Enterprise Schemas, with a New Benchmark
“On the DevRev NL2SQL benchmark the system attains 91.7% answer correctness, a margin of 54.6 percentage points over the next-best baseline; on the Spider 2.0 Snowflake public dataset, it is competitive with leading systems at a single-generation operating point.”
Bait-and-Recover
“Across four open-weight models, our defense raises the minimum refusal rate against white-box edit searches from 16.25% to 71.75% under a strict behavior-preservation budget (KL <= 0.10), with negligible impact on general benchmarks.”
TrojanWorld
“Experiments with the TD-MPC2, DreamerV3, and R2-Dreamer systems across the DeepMind Control, MetaWorld, MyoSuite, and RoboDesk benchmarks show that under trigger activation, TrojanWorld achieves a target-action deviation as low as 0.026 while retaining at least 98.8% of the corresponding clean performance.”
The Profit Alignment Problem
“In 3,600 controlled trials across eight reasoning-capable LLMs, adding a profit mandate to otherwise identical prompts increases risk-dismissing judgments by 6.8 percentage points (p < 0.0001), suppresses board escalation recommendations by 13.9pp (p < 0.0001), and shifts severity assessments downward (p < 0.0001).”
A Finger on the Scale
“We instantiate this threat in agentic commerce and software dependency use, with SkillShift achieving attacker-favored selection rates of 81.33% and 63.33% while maintaining a 100% utility-preserving rate.”
TruthInsightBench
EvalDetectBench
AuK Technical Report
“Experiments demonstrate leading performance on zero-shot and instruction-controlled speech generation and general instruction-guided editing, while remaining competitive on signal-level restoration tasks.”
Harness-agnostic detection and immunization of reward hacking in self-evolving language models
Scaling Bimanual Household Manipulation from 1,500 hours of Demonstrations to On-Policy Corrections
The week by field
Sep 3–9: 174 cleared, 13 frontier
The week’s papers have not been sorted into fields yet.
Models under test
Papers this week that name the model
Labs publishing
Papers this week with an author at the lab
Also cleared
161 papers
- Beyond Sparse Rewards: A New Benchmark and Structure-Aware Graph Alignment for Micro-Drama UnderstandingTencentCode
- Inducing Emergent Misalignment from Reward Hacks with Iterative DPOGoogle
- Detokenization Leaks: Reconstructing Local LLM Outputs From Cache TracesMicrosoft
- Shortcutting the Fix: Identifying and Categorizing Agentic Exploits in Software Engineering BenchmarksNVIDIA
- Qwen-Audio-3.0-ASR Technical ReportAlibaba
- NERVE Attacks: Breaking AI-Powered Brain-Computer InterfacesMicrosoft
- Omni Interaction Agent Technical ReportTencent
- Probing Warmth-Mediated Harm in Speech-Enabled LLMs for Mental-Health ConversationsMicrosoft
- When Seeing Overrides Knowing: Visual Dominance and Deferral-Based Method for Personalized Safety in VLMsMicrosoft
- Hoss: Fast Oblivious Semantic Search with Heterogeneous GPU-CPU-TEE ArchitectureIBM
- Repeat-After-Me: Black-Box Adaptive Visual Prompt InjectionMeta
- Mitra-v2 Technical ReportAmazon
All 161 papers
- The Natural Language Interaction Protocol and Standard for AI AgentsIBM
- A Case Study on Emergent Cheating and Whistleblowing in Autonomous Research SwarmsGoogle
- How Fast Do Agents Rot? An Empirical Study of Long-Horizon Degradation in LLM Agents for Production Decision-MakingMicrosoft
- Architecting Conversational Data Systems for Stateless LLM APIs: The Hydration Proxy PatternGoogle
- DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language ModelsCode
- Broken on Arrival: Silently Defective LLM Artifacts in Public Model Registries and How to Catch ThemCode
- All for 1-Bit: Towards Genuine 1-Bit Post-Training Quantization for LLMsCode
- VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain VulnerabilitiesCode
- Miles v0.1: Production-Level Post-TrainingCode
- GhostWord: A Fine-Grained Backdoor Attack on Automatic Speech RecognitionCode
- Leveraging Imperfect Restoration for Data Availability AttackCode
- ERPBench: Evaluating LLM Agents for Enterprise Decision-Making Across Competitive Market EcologiesCode
- EraseSAE: Surgical Concept Erasure in Text-to-Video Diffusion Models via Sparse AutoencodersCode
- IndicSafeEval: Safety Robustness of Large Language Models under Multilingual Persuasive Jailbreak AttacksCode
- Toward Explainable and Policy-Aware AI for Carbon Credit Price Prediction: A Research Framework for Emerging Carbon MarketsCode
- WeaveMark: Robust and Scalable Multi-bit LLM Watermarking via Coded Payload SpreadingCode
- SPADE: SPaT Attack Detection from the Connected Vehicle's PerspectiveCode
- When Does Memory Help? A Cost-Aware Evaluation of Long-Term Memory in Tool-Using LLM Agents
- CrossModalQA: A Cross-modal and Multi-hop Benchmark for Multimodal Retrieval-augmented Generation
- Beyond the Verdict: Evidence-Aligned Evaluation of Visual Prompt-Injection Guardrails
- Knowing When Not to Answer: Abstention and Refusal Reasoning in Vision--Language Models
- Toward Sustainable Distributed LLM Inference: A Systems Synthesis and Research Agenda for an Energy-, Carbon-, and Cache-Aware llm-d Control Plane
- What LLM Trading Agents Actually Do in Production: A Six-Month, Population-Scale Record from Two Fleets
- Resilient Control Loops in Autonomous Vehicles Under Adversarial Jamming via Spectral Perception and Network-Layer Failover
- From Monolithic Blending to Agentic Orchestration: Dynamic Response for Conversational Assistants at Scale
- Recall Is Not Protection: Evaluating Safety Monitors Against Model Compliance
- Agentic BAIM-LLM Evaluation (ABLE): Benchmarking LLM Use of Protein Design Tools
- SAFEGuard: Detect Optimization-Based Jailbreak Attacks Through Harmful Semantic Analysis and Fluency Measurement
- Multimodal Resource-Exhaustion Attacks on Vision-Language Models via Joint Pixel-Prompt Optimization
- From Review to Authorization: Key-Isolated Threshold Signing for LLM Agents
- EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents
- Solving versus Verifying: Catching Contradictions in Tax Reasoning Systems
- Intent Drift at SME Scale: Deployment Practice, Not Model Capability, Determines Agentic Compliance
- Alignment by Stereotyping: How LLMs Sacrifice Individual Distinctiveness for Cultural Adaptation
- GradeTrap: Authority Cues in Images Shift VLM Judgments Despite Explicit Instructions to Ignore Them
- Automatic Red Teaming for Implicit Vulnerabilities of Text-to-Image Models
- Protocol Compression Changes Which Party Pays: Bilateral Cost in Cross-Organization LLM Agent Communication
- Beyond the Flag: Clinical Framing Closes the Moderation Gap in Suicide Risk Measurement
- Watch and Crack: Password Inference from Smart-Glasses Video
- SRD-GUARD: A Defense Framework of LLMs via Semantic Rewriting and Joint Multi-Model Scoring for Latent Intent Exposure
- A Unified Policy Architecture (UPA): The Governance Kernel for Enterprise AI Operating Systems
- LLMs Mirror Country-Specific Gender Patterns If Asked, but Skew Male When Generating Media in Local Languages
- A Novel Semantic Manifold Alignment Attack against Embedding-to-Embedding Obfuscation in Privacy-Preserving LLMs
- Hardware Trojan Threats to Multi-Chiplet Photonic Neural Network Accelerators
- Who Anchors AI Overviews in Health? Baidu, Google, and the Geography of Authority
- WAPP: Safe Learning of Positive Security WAF Policies from Live Traffic
- Learning transferable human physiology from two million hours of sleep with SleepFM-2
- Characterizing Contention-Induced Reliability Collapse in KV-Cache Timing Side Channels for Multi-Tenant LLM Serving
- MOLE: Detecting Insider Threats in AI Agents
- FreqDoor: A Hidden Trojan in the Frequency Domain for Backdoor Attacks on Vision-Language Models
- AgentLeak: Cloning Stronger LLM Agent Capabilities onto Weaker Agents Beyond Skill Stealing
- Fine-grained Distributed Backdoor Attacks in Federated Learning
- Ambient @ EgoLongQA 2026: Distilling Long-Video perception into a Sub-2B Model
- Scanning the Harness: An Empirical Study of Supply-Chain Defects in AI Coding-Agent Configurations
- DF26: We Cannot Tell Fake From Real Anymore
- FramingQA: Does the Question Shape the Answer? Measuring the Compositional Framing Effect
- CrACK: Adversarial Attacks on Cross-Model Consistency in Collaborative Vision Foundation Models
- Audit Without Verification: When LLM Accountability Layers Relay Rather Than Check
- LLM Forensics: Where Do Backdoors Hide? Localizing and Controlling Trigger Mechanisms with Sparse Autoencoders
- Do AI Coding Assistants Check Before They Install? A Pre-Registered Demand-Side Audit of Trust Signals in the Research Software Supply Chain
- SAFIRE: Safety-Critical Benchmark for Fine-grained Fire and Smoke Understanding in Multimodal LLMs
- LLM-Based Penetration Testing in the Presence of Honeypots
- CIVI: A Framework for Diagnosing Search Agent Failures in Civic Information
- When Metrics Reward the Worst Translations: Internalizing Cultural Reasoning for Social Media Translation Evaluation
- Style Over Substance: Content-Invariant Wrappers Flip LLM Safety-Judge Verdicts
- Seeing is Not Believing: Breaking the Physical-to-Digital Trust Boundary in Robotics
- HoneyRoute: Honeypot-Model Routing for Adversarial LLM Serving
- Structural Jailbreaks Generalize but Do Not Compound: A cross-provider and multilingual study of Involuntary In-Context Learning
- Feyospace-v1: How the Cyber Mercury Seven Trained Frontier Cyber Models
- An Evidence Model for Agentic Processes: Evidence Claims, Trust Assumptions, and Policy Assessment
- TontaubeV1: Streaming Text-to-Speech with Hierarchical Codec Modeling and Bounded Context
- MemSentry: A Framework for Detecting Persistent Memory Poisoning in Agentic AI
- Benchmark Scores Are Pipeline-Dependent: A Reliability Audit of Cybersecurity LLM Benchmarks
- Silent Revision: Measuring Undisclosed Change in the Safety Frameworks of Frontier AI Developers
- API Benchmark Scores Do Not Reliably Transfer to Chatbot Interfaces
- From Scores to Evidence: Auditable Decisions Can Improve Speech Deepfake Detection
- PrivEscalate: Measuring and Augmenting the Threat of LLM-Automated Linux Privilege Escalation
- Measuring LLM Sycophancy under Sustained Multi-Turn Pressure
- Auditing Bias and Safety in Voice AI Customer Care
- AI Writes Code, Humans Pay the Debt. An Empirical Study on the Sustainability and Evolution of Agent-Generated Code
- GEPARD - Generative, Prosody-aware, Autoregressive text-to-speech model for Realtime Dialogue
- Harbor Adapters and Harbor-Index: Infrastructure and a Curated Meta-Dataset for Large-Scale Agentic Evaluation
- Why Better Models Can Create Riskier Systems: Evidence from LLM Agents in Financial Markets
- Privacy Failure in Split-LLM Training, The Returned Gradient Nullifies the Decoys
- Engineered Persuasion: Evaluating Personalized Pretexts in LLM-Generated Spear Phishing
- HarvestBench: Measuring Whether LLM Agents Will Pay to Avoid Killing Animals
- Conformity Breaks Conformal Prediction
- Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal
- Beyond Code Generation: Reliability, Verification, and Cost Economics in the Agentic Software Development Lifecycle
- SQL-Zero: Self-Evolving Text-to-SQL
- AngelFingerprint: A Traceable, Explainable, and White-Box Stealthy Watermark for Text-Guided Image Editing
- Same Request, Different Answer: Quantization Amplifies Cache-Induced Divergence in LLM Serving
- Shadow Queries for Private Retrieval in Vector Databases
- MM-IFEval-Pro: A Multilingual and Attack-Resistant Benchmark for Instruction-Following in Vision-Language Models
- Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents
- MARLA: A Conceptual Scaffold for Regulatory Learning under the EU AI Act
- Language models judge war differently when tested for alignment
- LIBERO-RECOVER: Beyond Task Success Towards Failure Recovery in Robotic Manipulation Models
- Uncensored Open-weight Models: Redistribution as the Persistence Layer
- One Word, Different Action: A Real-Robot Benchmark for Language-Conditioned Embodied Reasoning
- How to Speculate about Uncertainty in Agentic Coding? A Draft-Model Gate Method
- Molecular Déjà Vu: Digit-Level Retrieval of Published Values in Frontier Language Models
- Multi-Step Tool-Calling over Korean Open Public APIs: A Benchmark and a Data-Synthesis Recipe
- Same Trajectory, Contradictory Rewards (ROBORMBENCH): Paraphrase Fragility in Vision Language Reward Models
- The Illusion of Independent Quorums: Epistemic Fault Domains and Correlated Cognitive Failures in Agentic Quorums
- When Optimization Becomes Manipulation: Defending Generative Search against Malicious Generative Engine Optimization
- Privacy-Preserving Topology-Guided Safety for LLM-Based Multi-Agent Systems via Federated Graph Learning
- Seeing Less Is Not Seeing Safely: Privacy Leakage from Task-Scoped Robot Perception Exports
- Beyond Small Patches: Black-Box Detection and Purification of Diverse Backdoor Triggers
- Reducing Catastrophic Risk from AI with Systematic Monitoring and Evaluation of Rogue AI Progression
- Mind the Gap: Robustness Risks in PII Detection Systems
- BRIDGE: An Open-Source Humanoid Platform via Morphology-Control Co-Design for Physical AI
- AlcaTRAz - Anchored Tree-Rule Defense Against Jailbreaks
- LLaDA-Image: Building Strong Image Generators with Fully Open Training Recipes
- Flip, Don't Shuffle: Watermarking LLMs at the Speed of Inference
- A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors
- FiMI Banking: A Sovereign Model for Indian Retail Banking
- A Black Box for Agentic Processes: Blockchain-Anchored Evidence for AI Agent Communication, Human Oversight, and GRC Audits
- Clean Engineering, Unstable Measurement: A Preregistered Reliability Failure of Black-Box LLM Observers on Shared Endpoints
- Context Inference Attacks Without Jailbreaks
- Skill-as-API: Confidential Multi-Agent Coordination for Agentic Software Engineering
- FairLens: Benchmarking Fairness in Vision-Language Models for High-Stakes Decision-Making
- Hearing the Whispers: Black-Box Membership Inference Attacks on Finetuned TTS Models
- VakyArth: Evaluating Pragmatic Competence in LLMs across Indic Languages
- Agent Memory Is a Surface for Endogenous Authorization Laundering
- Post-Training Ternarization of Qwen3-4B Capability, Effective Bit Budget, Storage Compression, and Deployment
- Implicit Manipulation for Skill Selection in LLM Agents with Semantic Matching
- Privacy Washing: Detecting Internal Contradictions in Privacy Policies
- READY or Not: Reliable Enterprise Agent Deployment
- text2ql: Multi-Target Natural Language Querying via a Language-Agnostic Intermediate Representation
- Stored Is Not Supported: Typed Provenance and Assertion Guardrails for Persistent AI Agents
- FUSE: An Evaluating Framework for Dangerous Capabilities of LLMs
- Examining the Vulnerability of Multi-Agent Medical Systems to Human Interventions for Clinical Reasoning
- ASCII Attack: Recontextualising Harmful Requests as Artistic Critique in Large Language Models
- InfraPatch: Cross-Task Targeted Grayscale Patch Attacks on Infrared-Adapted Vision-Language Models
- SCX Router: Streaming Zero-Shot Model Selection with a Decoder-KV Classifier and a Real-World Task Ontology
- SEAL: Reinforcing Global Safety in Mixture-of-Experts through Shared Expert ALignment
- Counter-GEO-Bench: Evaluating Defenses Against Information-Distorting Generative Engine Optimization
- Humanoid Safe Stop via Learned Stoppability Value
- Before the Script, Set the Stage: How Worldview Simulation Amplifies Psychologically Grounded Persuasion in Multi-Turn Jailbreaking
- Evaluating ML-based Intrusion Detection Systems: The Illusion of Model Efficacy
- Beauty is in the AI of the beholder: MLLMs systematically overrate facial attractiveness
- The Shape of Ownership: Verifying LLM Provenance through Semantic Structures
- Learning-Based Reconstruction Attacks on Coordinate-Obfuscated Point Clouds
- Competitive Market Behavior of LLMs
- ACLE-MCP: Attested Capability Leases for Execution-Time Trust in Remote LLM Tool Use
- Door-in-the-Face Requests and Refusal Behaviour in Large Language Models
- CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation
- The Implications of Linguistic Illegibility for LLM Security