September 10–16: 12 frontier papers out of 1,973 read.
Papers rated as moving the field
How we choose“We show that this can severely underestimate worst-case vulnerability: across three LLaMA-3-8B backdoor settings, holding the model, clean data, and poison count fixed, attack success ranges from 3% to 80% depending only on which poison set is chosen.”
The authors, in the abstract
Learning to Select Poison Sets for Stronger LLM Backdoor Attacks
“For CBRN, we measure uplift across eight steps of a hypothetical bioweapon attack chain and find that consultation raises Gemma-4-31B's mean rubric score from 62.3 to 83.1 on a 100-point rubric scale.”
“On Long-Horizon Terminal Bench, T1 reaches 27.9% and surpasses GPT-5.4 and GLM-5.1.”
“Replaying identical factorial responses also yields a Claude headline mean 12.5 percentage points below Astra's, demonstrating evaluator sensitivity separately from target behavior.”
“Evaluation of 18 LLMs shows hallucination rates ranging from 0% to 39% across dimensions, and among non-hallucinated correct-positive judgments, over 70% cite evidence fails to logically support the stated reason.”
“We had registered a prediction for that 58% before the run: 35%.”
“We also show that our pre-training design offers a 4.2x efficiency improvement in 16K pre-training time-to-loss.”
“Finally, we find cases where extra monitor resources cause harm - giving the monitor access to the injected plan drops detection by as much as 50% in the Bio-Math task and in a case study on monitor reasoning budget, we find transcripts where additional thinking tokens are spent rationalizing the injected plan rather than flagging it.”
“Pilot analysis on 363 LLM-judged trajectories reveals that process traces expose behavioral differences invisible to output-only evaluation: all three frontier models achieve comparable success rates (84--89%), yet Claude Opus 4.6 produces 30× more errors than GPT-5.4 (2.5 vs. 0.08 per trajectory, p < 0.0001, Cliff's \delta = 0.613), with qualitatively different error profiles---66.7% tool misuse for Claude versus 83.6% reasoning errors for GPT-5.4.”
“Experiments with existing reviewer models show that collective review can remain sound without an aligned individual, even when some disapprovals are tolerated.”
Sep 10–16: 204 cleared, 12 frontier
The week’s papers have not been sorted into fields yet.
Papers this week that name the model
Papers this week with an author at the lab
192 papers