AI Research Radar

Pick Your Poison

“We show that this can severely underestimate worst-case vulnerability: across three LLaMA-3-8B backdoor settings, holding the model, clean data, and poison count fixed, attack success ranges from 3% to 80% depending only on which poison set is chosen.”

Divide, Consult, Conquer

“For CBRN, we measure uplift across eight steps of a hypothetical bioweapon attack chain and find that consultation raises Gemma-4-31B's mean rubric score from 62.3 to 83.1 on a 100-point rubric scale.”

Identity Is More Than Recall

“Replaying identical factorial responses also yields a Claude headline mean 12.5 percentage points below Astra's, demonstrating evaluator sensitivity separately from target behavior.”

NovGauge

“Evaluation of 18 LLMs shows hallucination rates ranging from 0% to 39% across dimensions, and among non-hallucinated correct-positive judgments, over 70% cite evidence fails to logically support the stated reason.”

TabPFN-3.5

“For faster inference, our variant TabPFN-3.5-Fast runs up to 3x faster than TabPFN-3 while keeping most of the accuracy gains.”

Monitoring and Discovering Reward Hacking with Internal Representations during LLM Evaluations

“We show that DoM vectors are similarly effective but virtually free, catching 3.1% more hacks in Kimi K3 and 7.9% fewer hacks in GLM 5.2 on DeepSWE at a monitor matched false positive rate.”

Easy to Catch a Liar, Hard to Clear an Honest One: Language Models Diagnosing a Corrupted Reward Channel from a Verified Record

“We had registered a prediction for that 58% before the run: 35%.”

ZGCM-1

“We also show that our pre-training design offers a 4.2x efficiency improvement in 16K pre-training time-to-loss.”

Corrupt Plans, Clean Traces

“Finally, we find cases where extra monitor resources cause harm - giving the monitor access to the injected plan drops detection by as much as 50% in the Bio-Math task and in a case study on monitor reasoning budget, we find transcripts where additional thinking tokens are spent rationalizing the injected plan rather than flagging it.”

Open ultrasound foundation model for robust segmentation and clinical measurement across heterogeneous settings

Harm Laundering in GPT Models

Compiled Agency

Refusal Reads Only a Slice of What the Model Knows: Harm-Keyed Routing and Its Exceptions Across Model Families

Delegating Authorization to Misaligned Agents

“Experiments with existing reviewer models show that collective review can remain sound without an aligned individual, even when some disapprovals are tolerated.”