AI Research Radar
September 4–10: 12 frontier papers out of 1,890 read.
Frontier
Papers rated as moving the field
How we chooseHow Long Until Your Robot Ignores You? A Safety Benchmark for LLM Orchestrators in Human-Humanoid Collaboration
“We find that (1) model family determines the safety floor, as Claude and Gemini remain at or near zero violations while GPT-4o-mini commits up to 13 per session, (2) context management dissociates two failure axes, reducing mean behavioral issues by 42-57% for every cloud backend while nearly doubling GPT-4o-mini's violations (3.8 to 7.2 per session), and (3) proportional compliance, clamping movement speed to the rule-specified maximum rather than refusing, emerges consistently only in Gemini; the preliminary simulation layer reproduces the model ranking and the GPT-4o-mini failure-mode inversion.”
Q2D-Web
“Retaining a third of the corpus, selected by reciprocal rank fusion over pooled retriever runs, preserves the full-corpus model ranking under the combined judgments while raising absolute Recall@1000 only by 3 to 7 points.”
A Cost-Aware Agentic Architecture for NL-to-SQL over Nested Enterprise Schemas, with a New Benchmark
“On the DevRev NL2SQL benchmark the system attains 91.7% answer correctness, a margin of 54.6 percentage points over the next-best baseline; on the Spider 2.0 Snowflake public dataset, it is competitive with leading systems at a single-generation operating point.”
OpenDiscoveryTrace
“Pilot analysis on 363 LLM-judged trajectories reveals that process traces expose behavioral differences invisible to output-only evaluation: all three frontier models achieve comparable success rates (84--89%), yet Claude Opus 4.6 produces 30× more errors than GPT-5.4 (2.5 vs. 0.08 per trajectory, p < 0.0001, Cliff's \delta = 0.613), with qualitatively different error profiles---66.7% tool misuse for Claude versus 83.6% reasoning errors for GPT-5.4.”
Bait-and-Recover
“Across four open-weight models, our defense raises the minimum refusal rate against white-box edit searches from 16.25% to 71.75% under a strict behavior-preservation budget (KL <= 0.10), with negligible impact on general benchmarks.”
TrojanWorld
“Experiments with the TD-MPC2, DreamerV3, and R2-Dreamer systems across the DeepMind Control, MetaWorld, MyoSuite, and RoboDesk benchmarks show that under trigger activation, TrojanWorld achieves a target-action deviation as low as 0.026 while retaining at least 98.8% of the corresponding clean performance.”
The Profit Alignment Problem
“In 3,600 controlled trials across eight reasoning-capable LLMs, adding a profit mandate to otherwise identical prompts increases risk-dismissing judgments by 6.8 percentage points (p < 0.0001), suppresses board escalation recommendations by 13.9pp (p < 0.0001), and shifts severity assessments downward (p < 0.0001).”
TruthInsightBench
AuK Technical Report
“Experiments demonstrate leading performance on zero-shot and instruction-controlled speech generation and general instruction-guided editing, while remaining competitive on signal-level restoration tasks.”
Harness-agnostic detection and immunization of reward hacking in self-evolving language models
Scaling Bimanual Household Manipulation from 1,500 hours of Demonstrations to On-Policy Corrections
The week by field
Sep 4–10: 167 cleared, 12 frontier
The week’s papers have not been sorted into fields yet.
Models under test
Papers this week that name the model
Labs publishing
Papers this week with an author at the lab
Also cleared
155 papers
- Beyond Sparse Rewards: A New Benchmark and Structure-Aware Graph Alignment for Micro-Drama UnderstandingTencentCode
- AgenticGen: Reward-Guided Agentic Video Generation for AdvertisingByteDance
- Building the Harness Automatically: Self-Play in Code Distills a Text Harness for Black-Box OptimizationGoogle
- Inducing Emergent Misalignment from Reward Hacks with Iterative DPOGoogle
- Detokenization Leaks: Reconstructing Local LLM Outputs From Cache TracesMicrosoft
- Shortcutting the Fix: Identifying and Categorizing Agentic Exploits in Software Engineering BenchmarksNVIDIA
- Qwen-Audio-3.0-ASR Technical ReportAlibaba
- NERVE Attacks: Breaking AI-Powered Brain-Computer InterfacesMicrosoft
- Omni Interaction Agent Technical ReportTencent
- Probing Warmth-Mediated Harm in Speech-Enabled LLMs for Mental-Health ConversationsMicrosoft
- When Seeing Overrides Knowing: Visual Dominance and Deferral-Based Method for Personalized Safety in VLMsMicrosoft
- Hoss: Fast Oblivious Semantic Search with Heterogeneous GPU-CPU-TEE ArchitectureIBM
All 155 papers
- Repeat-After-Me: Black-Box Adaptive Visual Prompt InjectionMeta
- Mitra-v2 Technical ReportAmazon
- The Natural Language Interaction Protocol and Standard for AI AgentsIBM
- A Case Study on Emergent Cheating and Whistleblowing in Autonomous Research SwarmsGoogle
- Osprey: Target-agnostic Pre-training Makes Stronger Drafters in Speculative DecodingCode
- An Efficient and Effective Agentic Group Shilling Attack on Recommender SystemsCode
- PELM: Power Efficient On-Device LLM Inference with Speculative Decoding and Dynamic Voltage Frequency ScalingCode
- DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language ModelsCode
- Broken on Arrival: Silently Defective LLM Artifacts in Public Model Registries and How to Catch ThemCode
- All for 1-Bit: Towards Genuine 1-Bit Post-Training Quantization for LLMsCode
- VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain VulnerabilitiesCode
- Miles v0.1: Production-Level Post-TrainingCode
- GhostWord: A Fine-Grained Backdoor Attack on Automatic Speech RecognitionCode
- Leveraging Imperfect Restoration for Data Availability AttackCode
- ERPBench: Evaluating LLM Agents for Enterprise Decision-Making Across Competitive Market EcologiesCode
- EraseSAE: Surgical Concept Erasure in Text-to-Video Diffusion Models via Sparse AutoencodersCode
- IndicSafeEval: Safety Robustness of Large Language Models under Multilingual Persuasive Jailbreak AttacksCode
- The Double Measurement Confound in Agent Benchmarks: De-Scaffolding, Ground-Truth Scoring, and Reliability Beyond the Mean
- Scores Alone Do Not Prove Discovery: The Discovery Certification Protocol for Auditing AI Research Agents
- In RAG We Trust? Measuring Robustness of Retrieval-Augmented Generation Under Document Poisoning
- Video-MOPD: Multi-Teacher On-Policy Distillation for Video Understanding
- What Does MMLU Actually Measure? A Psychometric Audit of Difficulty Structure in Aggregate Benchmark Scores
- An Experimental Evaluation of Multimodal Prompt Injection Attacks on Agentic AI Frameworks
- Infra-Bench CLS: A Global, Open-Source Benchmark for Critical Infrastructure Classification with Earth Observation Foundation Models
- Arbitrary Cipher Attacks Against Large Language Models Do Not Require Fine-Tuning
- ECDSA.Fail: Open Autoresearch for Optimizing Elliptic-Curve Point Addition in Shor's Algorithm
- Watermarks Without Verification: AI Text Watermarking After the EU AI Act
- Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
- CT-SAFR: Safe and Interpretable Chain-of-Thought Reasoning for Autonomous Robots: A Multi-Layered Verification Framework for Trustworthy AI-Driven Robotic Decision Making
- When Auditors Fabricate: Batch-Size Degradation and Confident Hallucination in LLM Detection of Planted Document Contamination
- How Fragile Is Safety Alignment at Frontier Scale? A Single-Direction Attack on a 320B MoE
- Privacy-Preserving Split Learning for Federated LLM Fine-Tuning
- CS-Guard: Benchmarking LLM Guardrails for Code Generation Security
- The Era by Eon Benchmark: A Generated Enterprise Estate with Exact Ground Truth for Benchmarking LLM Agents
- Guaranteeing Faithful Evidence Extraction in Speculative Retrieval-Augmented Generation
- Beyond Training: A Feasibility Taxonomy for Inference-Time AI Governance
- If It's Not Buggy, Don't Fix It: On the Dynamics of Iterative Bug-fixing with LLMs
- KVShareArena: KV-Cache Reuse Across Contexts and Model Checkpoints
- Data-Driven Risk Fields for Safer End-to-End Autonomous Driving
- Forgetting Only What Matters: Layer-Selective Unlearning toward Robust LLMs
- Show-Harness: Just a VLM Agent Can Play Robots
- When Does Memory Help? A Cost-Aware Evaluation of Long-Term Memory in Tool-Using LLM Agents
- CrossModalQA: A Cross-modal and Multi-hop Benchmark for Multimodal Retrieval-augmented Generation
- Beyond the Verdict: Evidence-Aligned Evaluation of Visual Prompt-Injection Guardrails
- Knowing When Not to Answer: Abstention and Refusal Reasoning in Vision--Language Models
- Toward Sustainable Distributed LLM Inference: A Systems Synthesis and Research Agenda for an Energy-, Carbon-, and Cache-Aware llm-d Control Plane
- What LLM Trading Agents Actually Do in Production: A Six-Month, Population-Scale Record from Two Fleets
- Resilient Control Loops in Autonomous Vehicles Under Adversarial Jamming via Spectral Perception and Network-Layer Failover
- From Monolithic Blending to Agentic Orchestration: Dynamic Response for Conversational Assistants at Scale
- Recall Is Not Protection: Evaluating Safety Monitors Against Model Compliance
- Agentic BAIM-LLM Evaluation (ABLE): Benchmarking LLM Use of Protein Design Tools
- SAFEGuard: Detect Optimization-Based Jailbreak Attacks Through Harmful Semantic Analysis and Fluency Measurement
- Multimodal Resource-Exhaustion Attacks on Vision-Language Models via Joint Pixel-Prompt Optimization
- From Review to Authorization: Key-Isolated Threshold Signing for LLM Agents
- EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents
- Solving versus Verifying: Catching Contradictions in Tax Reasoning Systems
- Intent Drift at SME Scale: Deployment Practice, Not Model Capability, Determines Agentic Compliance
- Alignment by Stereotyping: How LLMs Sacrifice Individual Distinctiveness for Cultural Adaptation
- GradeTrap: Authority Cues in Images Shift VLM Judgments Despite Explicit Instructions to Ignore Them
- Automatic Red Teaming for Implicit Vulnerabilities of Text-to-Image Models
- Protocol Compression Changes Which Party Pays: Bilateral Cost in Cross-Organization LLM Agent Communication
- Beyond the Flag: Clinical Framing Closes the Moderation Gap in Suicide Risk Measurement
- Watch and Crack: Password Inference from Smart-Glasses Video
- SRD-GUARD: A Defense Framework of LLMs via Semantic Rewriting and Joint Multi-Model Scoring for Latent Intent Exposure
- A Unified Policy Architecture (UPA): The Governance Kernel for Enterprise AI Operating Systems
- LLMs Mirror Country-Specific Gender Patterns If Asked, but Skew Male When Generating Media in Local Languages
- A Novel Semantic Manifold Alignment Attack against Embedding-to-Embedding Obfuscation in Privacy-Preserving LLMs
- Hardware Trojan Threats to Multi-Chiplet Photonic Neural Network Accelerators
- Who Anchors AI Overviews in Health? Baidu, Google, and the Geography of Authority
- WAPP: Safe Learning of Positive Security WAF Policies from Live Traffic
- Learning transferable human physiology from two million hours of sleep with SleepFM-2
- Characterizing Contention-Induced Reliability Collapse in KV-Cache Timing Side Channels for Multi-Tenant LLM Serving
- MOLE: Detecting Insider Threats in AI Agents
- FreqDoor: A Hidden Trojan in the Frequency Domain for Backdoor Attacks on Vision-Language Models
- AgentLeak: Cloning Stronger LLM Agent Capabilities onto Weaker Agents Beyond Skill Stealing
- Fine-grained Distributed Backdoor Attacks in Federated Learning
- Ambient @ EgoLongQA 2026: Distilling Long-Video perception into a Sub-2B Model
- Scanning the Harness: An Empirical Study of Supply-Chain Defects in AI Coding-Agent Configurations
- DF26: We Cannot Tell Fake From Real Anymore
- FramingQA: Does the Question Shape the Answer? Measuring the Compositional Framing Effect
- CrACK: Adversarial Attacks on Cross-Model Consistency in Collaborative Vision Foundation Models
- Audit Without Verification: When LLM Accountability Layers Relay Rather Than Check
- LLM Forensics: Where Do Backdoors Hide? Localizing and Controlling Trigger Mechanisms with Sparse Autoencoders
- Do AI Coding Assistants Check Before They Install? A Pre-Registered Demand-Side Audit of Trust Signals in the Research Software Supply Chain
- SAFIRE: Safety-Critical Benchmark for Fine-grained Fire and Smoke Understanding in Multimodal LLMs
- LLM-Based Penetration Testing in the Presence of Honeypots
- CIVI: A Framework for Diagnosing Search Agent Failures in Civic Information
- When Metrics Reward the Worst Translations: Internalizing Cultural Reasoning for Social Media Translation Evaluation
- Style Over Substance: Content-Invariant Wrappers Flip LLM Safety-Judge Verdicts
- Seeing is Not Believing: Breaking the Physical-to-Digital Trust Boundary in Robotics
- HoneyRoute: Honeypot-Model Routing for Adversarial LLM Serving
- Structural Jailbreaks Generalize but Do Not Compound: A cross-provider and multilingual study of Involuntary In-Context Learning
- Feyospace-v1: How the Cyber Mercury Seven Trained Frontier Cyber Models
- An Evidence Model for Agentic Processes: Evidence Claims, Trust Assumptions, and Policy Assessment
- TontaubeV1: Streaming Text-to-Speech with Hierarchical Codec Modeling and Bounded Context
- MemSentry: A Framework for Detecting Persistent Memory Poisoning in Agentic AI
- Benchmark Scores Are Pipeline-Dependent: A Reliability Audit of Cybersecurity LLM Benchmarks
- Silent Revision: Measuring Undisclosed Change in the Safety Frameworks of Frontier AI Developers
- API Benchmark Scores Do Not Reliably Transfer to Chatbot Interfaces
- From Scores to Evidence: Auditable Decisions Can Improve Speech Deepfake Detection
- PrivEscalate: Measuring and Augmenting the Threat of LLM-Automated Linux Privilege Escalation
- Measuring LLM Sycophancy under Sustained Multi-Turn Pressure
- Auditing Bias and Safety in Voice AI Customer Care
- AI Writes Code, Humans Pay the Debt. An Empirical Study on the Sustainability and Evolution of Agent-Generated Code
- GEPARD - Generative, Prosody-aware, Autoregressive text-to-speech model for Realtime Dialogue
- Harbor Adapters and Harbor-Index: Infrastructure and a Curated Meta-Dataset for Large-Scale Agentic Evaluation
- Why Better Models Can Create Riskier Systems: Evidence from LLM Agents in Financial Markets
- Privacy Failure in Split-LLM Training, The Returned Gradient Nullifies the Decoys
- Engineered Persuasion: Evaluating Personalized Pretexts in LLM-Generated Spear Phishing
- HarvestBench: Measuring Whether LLM Agents Will Pay to Avoid Killing Animals
- Conformity Breaks Conformal Prediction
- Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal
- Beyond Code Generation: Reliability, Verification, and Cost Economics in the Agentic Software Development Lifecycle
- SQL-Zero: Self-Evolving Text-to-SQL
- AngelFingerprint: A Traceable, Explainable, and White-Box Stealthy Watermark for Text-Guided Image Editing
- Same Request, Different Answer: Quantization Amplifies Cache-Induced Divergence in LLM Serving
- Shadow Queries for Private Retrieval in Vector Databases
- MM-IFEval-Pro: A Multilingual and Attack-Resistant Benchmark for Instruction-Following in Vision-Language Models
- Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents
- MARLA: A Conceptual Scaffold for Regulatory Learning under the EU AI Act
- Language models judge war differently when tested for alignment
- LIBERO-RECOVER: Beyond Task Success Towards Failure Recovery in Robotic Manipulation Models
- Uncensored Open-weight Models: Redistribution as the Persistence Layer
- One Word, Different Action: A Real-Robot Benchmark for Language-Conditioned Embodied Reasoning
- How to Speculate about Uncertainty in Agentic Coding? A Draft-Model Gate Method
- Molecular Déjà Vu: Digit-Level Retrieval of Published Values in Frontier Language Models
- Multi-Step Tool-Calling over Korean Open Public APIs: A Benchmark and a Data-Synthesis Recipe
- Same Trajectory, Contradictory Rewards (ROBORMBENCH): Paraphrase Fragility in Vision Language Reward Models
- The Illusion of Independent Quorums: Epistemic Fault Domains and Correlated Cognitive Failures in Agentic Quorums
- When Optimization Becomes Manipulation: Defending Generative Search against Malicious Generative Engine Optimization
- Privacy-Preserving Topology-Guided Safety for LLM-Based Multi-Agent Systems via Federated Graph Learning
- Seeing Less Is Not Seeing Safely: Privacy Leakage from Task-Scoped Robot Perception Exports
- Beyond Small Patches: Black-Box Detection and Purification of Diverse Backdoor Triggers
- Reducing Catastrophic Risk from AI with Systematic Monitoring and Evaluation of Rogue AI Progression
- Mind the Gap: Robustness Risks in PII Detection Systems
- BRIDGE: An Open-Source Humanoid Platform via Morphology-Control Co-Design for Physical AI
- AlcaTRAz - Anchored Tree-Rule Defense Against Jailbreaks
- LLaDA-Image: Building Strong Image Generators with Fully Open Training Recipes
- Flip, Don't Shuffle: Watermarking LLMs at the Speed of Inference
- A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors
- FiMI Banking: A Sovereign Model for Indian Retail Banking
- A Black Box for Agentic Processes: Blockchain-Anchored Evidence for AI Agent Communication, Human Oversight, and GRC Audits
- Clean Engineering, Unstable Measurement: A Preregistered Reliability Failure of Black-Box LLM Observers on Shared Endpoints