DeepSeek-V4.1-Flash
Pushing the Limits of KV Cache Compression
AI Research Radar
September 16–22: 11 frontier papers out of 2,334 read.
Frontier
Papers rated as moving the field
How we chooseAPort Vault
“The zero spans 790 source sessions, giving a per-session upper bound of 0.38%.”
Beyond Task Completion
“Starting from Qwen3.5-9B, SCOPE-RL achieves a 54.17% task success rate on OSWorld and a 64.30% attack-avoidance rate on OS-BLIND, yielding the best aggregate capability--safety score of 58.80% among the evaluated agents.”
Euston
“Median response length also falls from 19,217 to 18,296 tokens and the truncation rate from 25.8% to 8.3%, so the improvement does not come from thinking longer.”
TabPFN-3.5
“For faster inference, our variant TabPFN-3.5-Fast runs up to 3x faster than TabPFN-3 while keeping most of the accuracy gains.”
Monitoring and Discovering Reward Hacking with Internal Representations during LLM Evaluations
“We show that DoM vectors are similarly effective but virtually free, catching 3.1% more hacks in Kimi K3 and 7.9% fewer hacks in GLM 5.2 on DeepSWE at a monitor matched false positive rate.”
Easy to Catch a Liar, Hard to Clear an Honest One: Language Models Diagnosing a Corrupted Reward Channel from a Verified Record
“We had registered a prediction for that 58% before the run: 35%.”
OPBackdoor
Open ultrasound foundation model for robust segmentation and clinical measurement across heterogeneous settings
Harm Laundering in GPT Models
Compiled Agency
The week by field
Sep 16–22: 197 cleared, 11 frontier
- Security35◆ 2
- Agents11
- Safety11◆ 1
- Society9
- Language7
- Robotics6
- Inference5
- 4 moreTraining, Vision, Reasoning, Science5◆ 1
- ML4
- Security35◆ 2
- 8 moreLanguage, Robotics, Inference, ML, Training, Vision, Reasoning, Science27◆ 1
- Agents11
- Safety11◆ 1
- Society9
Size: cleared papers◆ and tint: frontier papers104 papers not yet sorted into a field
Also cleared
186 papers, by field
Security & privacy33
- Beyond Predictable Paths: Redefining AI Security Incident Reporting for AgentsMicrosoft
- Team DArgk at the 2026 ELOQUENT lab for evaluating generative language model quality: Residuals of Humanity: AI Detection Evasion via GRPO Fine-Tuning
- The Corroboration Illusion: When More News Makes LLM Forecasts Less True
- Defusing Explosive Prompts: Understanding and Preventing Trigger-Based Prompt Injections in LLM Agents
- From Capability to Assurance in Autonomous Penetration-Testing Harnesses: A Framework and Reference Implementation
All 33 papers in Security & privacy
- UBA-ORL: Unlearning-Activated Backdoor Attacks on Offline Reinforcement Learning
- The Price of Safety: Benign-Case Utility and Token Overhead of Memory-Poisoning Defenses in LLM Agents
- Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems
- When Agentic Trust Crosses Organizational Boundaries: Structural Externalization and a Reference Model for Trust Evidence
- LLMs as Linguistic Chameleons: Decoupling Semantics and Structure for Privacy-Preserving Communication
- Runtime Authorization Consistency Checking for MCP-based Agentic Workflows
- An Efficient and Effective Watermarking Scheme for the Protection of the Intellectual Property Rights of Video Generative Models
- When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems
- Agents That Edit Documents: Measuring Agentic PDF Forgery Against a Non-Agentic Control
- MobileCybench: Evaluating Agent Vulnerability Discovery via Executable Probes
- LeaseGuard: Incumbent-Preserving Admission Control for Privileged LLM Agents
- From Bits to Beliefs: Recoverable Semantic Fingerprints for Black-Box Verification of Large Language Models
- Forgeable Confirmation in Automated Computer Security Testing: Deterministic Rules versus AI Judges
- ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
- State-Aware Fuzzing of JavaScript Engines with LLM-Guided Instrumentation
- Feedback Coding Enables Inference-Time Covert Agentic Communication
- The Right Tool for the Job: On the Selection of Mitigations for GenAI Privacy Threats
- Origin Is All You Need: Provenance-Aware Transformers for Structural Trust-Boundary Separation
- Conformal Privacy Auditing: Calibrated Re-identification Attacks with Statistical Guarantees
- Hiding in Plain Sight: A Diffusion-based Mitigation of Geolocation Privacy Leakage in Vision-Language Models
- DEFEAT: Stitching Fragmented File I/O Contexts for Early Ransomware Detection
- HE-Guardrail: A Homomorphic Guardrail Against Jailbreak Attacks for Encrypted Large Language Model Inference
- ServeGuard: Verifiable, Bounded-Residual Confinement of Operator-Invisible Channels Without Revealing the Certified Read Factor
- Micro-Collaborative Poisoning: A Distributed Attack on RAG Systems
- Towards Zero-Shot Attribution of Synthetic Speech via Audio-Text Contrastive Retrieval
- CIPL: A Channel-Aware Framework for Recoverable Privacy Leakage in LLM Agents
- TERMon: Detecting Persistent Behavioral Threats in Edge AI via Hardware-Native Ternary Runtime Monitor
- CASCADE Against Jailbreaks: Combination Across Stages with Controlled Attack-Defense Evaluation
Agents11
- MemCalib: Benchmarking and Optimizing Memory Use in LLM AgentsAlibaba
- BI-Agent and BI-Bench: Towards Automating End-to-End Business IntelligenceMicrosoft
- Scaling Discovery through Test-Time CommunicationMicrosoft
- Verify, Don't Trust: Agentic Model Development for Video Discovery Retrieval at ScaleMeta
- An Empirical Cost Attribution of Context-Compression Gateways in Multi-Turn Coding Agents
All 11 papers in Agents
- NostrAgent: A Decentralized Identity and Delegation Architecture for Sovereign Agentic Systems
- AgentRouter: Heterogeneous Model Routing for Cost-Optimal Multi-Step Agentic Workflows
- Total Cost of Agency: Exact Attribution of Memory Injection Cost in Multi-Agent LLM Workflows
- LEGIT: Credentialing Protocol for Trustworthy AI Agent Marketplaces
- What Stops a Small Language Model From Driving a Database Agent
- MintAct: A Unified Visual Agent for Digital Environments
Safety & alignment10
- Swiss-Knife: A Framework for Reconfigurable Externalised Multi-Objective Alignment at Decode TimeGoogle, Amazon
- Correcting Learning-based Perception for Safety
- SafeTune: A Unified Faithful Library for Auditing and Repairing Safety Drift in Fine-Tuned LLMs
- VLPSA: Vision-Language-Poisson-Safe Actions for Full-Body Safety of Learned Policies
- Agreement Overstates Evidence: Error Dependence in LLM Judge Consensus
All 10 papers in Safety & alignment
- Auditing Political Alignment in LLM Assistants: Engagement, Stance, and User Identity
- Directing large language models to follow the letter or spirit of the law
- Self-Healing Harness for Runtime Oversight of Agent Self-Modification
- Emergent Collusion in Long-Horizon LLM Agent Interaction
- SafeStage: Evaluating Safety Before, During, and After Vision-Language-Conditioned Robot Manipulation
AI & society9
- EnterpriseVal: Quantifying the Efficacy, Reliability and Value of Generative AI in the EnterpriseNVIDIA
- Monocultural Biases: Correlated biases in large language models lead to unequal systemic exclusion rates in hiring
- Fairness Beyond Anonymization? Demographic Leakage in German LLM-Generated Resumes
- The Moral Check: Strategic AI Governance for the Pacing Problem
- The Law of Stop: Interruptibility, Injunctions, and the Governance of Agentic AI
All 9 papers in AI & society
- OmniEdu: Open Foundation Models for Learning and Teaching
- Context-Aware Pre-Deployment Evaluation of AI Systems: A Regulatory Framework for Nigerian Fintech
- Convex AI Compositionality and the Governance of AI System Populations
- AI-GRACE: A Use-Case Operationalization Framework for Agentic AI: From Organizational Objectives and Obligations to Deployment Capabilities and Architecture
Language & speech7
- I'll Keep an Ear Out: Teaching AudioLLMs Proactive Audio AssistanceMeta
- EvidenT: Building Trustworthy Enterprise Assistants through Evidence Groundedness and Traceability
- Per-Query Gating of LLM Rerankers for Multi-Hop Retrieval
- Attributable Post-Rationalization in RAG Citations: A Controlled Reproduction and an RLVR Comparison
- Auditing Source Exposure in Baidu and Google AI Search
Robotics & embodied AI6
- ME-VLM:A Unified VLM for Embodied Cognition and Agent CoordinationCode
- Robot World Models Are Not Invariant to How the Actions Are Written
- Catch Me If You Can: Real-Time Feedback Denoising for Responsive VLAs
- DEXTERA: From a Single Image to Deployable Dexterous Manipulation via Real-to-Sim-to-Real
- Demonstration Synthesis from a Single Scan via Gaussian Splatting for Visuomotor Policy Learning
- SynthDemo-RL: Breaking the Zero-Reward Barrier in VLA Adaptation with LLM-Guided Synthetic Demonstrations
Inference & efficiency5
- SPHQuant: Efficient extreme low bit weight quantization for Vision-Language ModelsCode
- Measured Joules, Learned Routes: Learning to Route for Energy-Efficient LLM Serving
- this-that-model-1.0: A typed decision model that decides in 30 ms, for a millionth of a cent
- How Much of a Real Workload Can LLM-Generated GPU Kernels Actually Reach?
- SpecQuant: Speculative Decoding with Multi-Parent Quantization for Adaptive LLM Inference
Machine learning4
Training & data2
Vision & multimodal1
Science & health1
Not yet sorted97
- Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding AgentsAnthropicCode
- Decaf: A privacy preserving speech codec using speaker disentanglement and canonical voice conversionMicrosoft
- Quantifying Overclaiming Propensity in Frontier LLM AgentsCohere
- BLINDSPOT: A Benchmark for Safety and Refusal Calibration in Long-Horizon Tool-Using AgentsIBM
- SAFARI: An Industrial Benchmark for LLM-Assisted Hazard Analysis and Risk AssessmentCode
All 97 papers in Not yet sorted
- Safety-Flag: A Unified Benchmark for the Reliability and Calibration of LLM Content ModeratorsCode
- Latent Undertow: How Ordinary Typos Break ProbesCode
- Bias Audits Detect Bias but Disagree on Ranking: Evidence from Ten Instruments and Ten Frontier ModelsCode
- Universal Defenses for Tool-Integrated LLM Agents Against Adversarial AttacksCode
- FluxVLA Engine: A One-Stop VLA Engineering Platform for Embodied IntelligenceCode
- Towards Detecting AI-Assisted Responses in Online SurveysCode
- What Users Think of Generative AI: A Cross-Platform NLP Analysis of Trust and Friction in App Store Reviews
- Code-as-Auditor: Executable Compliance Reasoning via Regulation-to-Code
- Robust Conformal Intrusion Detection via Traffic-Aware Calibration and Attack-Orbit Invariance
- MAGS: Multi-agent Auto-formalization Guarantees Safety for Agentic Outputs
- Beyond Private Training: The New Landscape of AI Privacy
- DeltaSelect: Affordable A/B Testing for Coding Agents
- MiX: Micro-Inverted-Scaling for End-to-End Low-Bit Vision-Language Model Acceleration
- ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers
- Benchmarking LLM Compliance with China AI Generated Content Regulations
- Geopolitical Divisions Across Languages in Large Language Models
- Governance-as-Code: Translating EU AI Act Technical Requirements into Executable Compliance Pipelines for Generative AI Systems
- Can Data Attribution Filter Out Subliminal Learning? Not Reliably
- Astronex-World 1.0: Real-Time Interactive World Model Foundation
- Local Sparsity Enables Unsupervised LLM Safety Detection
- Designing Against Deskilling: Metacognitive Feedback Reduces Cognitive Offloading to LLM Assistants
- ResumeShield: Channel Separation and an Open Benchmark for Indirect Prompt Injection in AI Resume Screening
- Silence Is Endorsement: Verification-Status Laundering in LLM Agent Pipelines
- Is It Still Worth Training a Classical Model in the Era of LLMs? A Crossover Benchmark on Tabular Data
- Detecting Deceptive Recruitment: A Signal-theoretic Machine Learning Framework for Early Identification of Labour Exploitation
- The More It Says, the More You Pay: A Black-Box Audit of Provider-Side Token Inflation in LLM Services
- Fingerprinting Multimodal Large Language Models
- greCAPTCHA: Assessing Understanding as Evidence of Research Authorship Under Generative AI
- Towards TEE-Certified DP: Verifiable Differentially Private Training on Legacy GPUs
- Refuse, Decompose, Refresh: A Claim-Safe Protocol for Closed-Loop AI Evaluation
- Inference-Engine Fingerprinting Attacks are Practical: Exploring Model-Driven Environmental Discovery, Exploitation, and Escape
- Register Bias in Complexity-Based Large Language Model Routing
- Pay Only for Disagreement: Certified No-Regression Verdicts for Model Updates with Matching Label-Complexity Bounds
- Democratizing Clinical Tumor Whole Genome Sequencing: 18-hour End-to-end Analysis via Trillion-parameter Large Language Models Locally Deployed on Consumer-grade Hardware
- Making AI-Assisted Claims Independently Challengeable: Publication Authority and a Protocol for Falsifiable Publication Records
- Trust propagation and structural containment in Multi-agent LLM pipelines
- Reflections on Trusting Trust, Revisited: Contaminating Self-Modifying AI Coding Agents with Poisoned Benchmarks
- Do Frontier Models Seek Safety Evidence Before Acting?
- Timely Activation of Safety Filters via One-Step Reachability Expansion
- Whom Do AI Agents Work For? Role Assignment Induces Sponsorship Bias in LLM Recommenders
- From a River in Gilead to the Inference Distributions of Large Language Models: Covert Dialect Bias and Linguistic Profiling at Scale
- Linguistic Triggers of Gender and Racial Bias in Open-Weight LLMs Applied to Recruitment
- Token Latency Fairness: Performance Isolation for Multi-Tenant LLM Serving
- PentestChain: A Cost-Aware, MCP-Orchestrated Framework for Automated Penetration Testing with Free-Tier LLMs
- "Your Robot Was Trained on a Lie": Collision Mesh Poisoning Attacks on Robotic Manipulation
- AutoTuneBench: Trustworthy Measurement for Agent Auto-Tuning of LLM Serving Engines
- Measuring and Exploiting Implicit Trust in LLM Tool-Calling Pipelines
- Who Audits Whom, on What Substrate, with What Evidence? An Independence-Graded Audit Protocol for Agentic AI
- Understanding AI Provider Recommendations in Local Service Markets
- Market Signal Injection: Adversarial Context Manipulation of LLM Pricing Agents
- The Verifiable Action Card: Trustworthy Human-in-the-Loop Control for Secure Autonomous Agents
- Robot Visions: Breaking reCAPTCHA at Zero Cost and Zero Shot
- The Illusion of Local Privacy: Confidentiality Boundary Failures in Consumer LLM Serving Systems
- PACT: Can Enterprise AI Assistants Be Trusted Under Pressure?
- CaMeLoT: CaMeL orchestrated with Temporal logic for static verification and liveness
- "If I Had to Buy Just ONE: Galaxy S26 Ultra": Auditing AI-Generated Product Recommendations
- Infinite-Parameter LLMs: Generating and Adapting Weights from Live Data
- Taming the Agentic RAN: Stability-Guaranteed Arbitration of Autonomous AI Agents in O-RAN
- Decodable but Misrouted: Sparse Features Uncover a Readout Gap in Vision-Language Models for Harmful Meme Detection
- CASHEWS: Source Preprocessor for LLM-based Malicious Package Detection
- In-Context Robot Learning with VLM Agents
- Measuring AI harms with multidimensional Lorenz Zonoids
- RAG-CT: Mitigating Privacy Risks on Retrieval-Augmented Generation Systems via Scanning Prompt Distribution
- Occupancy Network-Guided Autonomous Robotic Partial Nephrectomy
- Permutation-Based Stegomalware in Large Language Models: Threats and Countermeasures
- Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration
- Feasibility of Homomorphic Inference for a Genomic Foundation Model
- Test-Time Unlearning via Sparse Autoencoder
- Mapping U.S. Federal AI Governance Against Sector Vulnerability
- Spurious Tool Use: When RL Agents Learn the Wrong Reason to Act
- Illusion of Depth: Revealing Hidden Stereo Vision Vulnerabilities in Depth Estimation
- Implementing a White-Box Undetectable Backdoor for Random Fourier Features
- From Manual Construction to AI-Driven Scenario Emergence: Rethinking Catastrophe Risk Modeling
- Challenges of Auditing: Variability in Outputs of Large Language Models for Health
- MarkSec: Capability-Aware Evaluation of Adversarial Attacks Against LLM Watermarks
- TAME: Token Attribution and Masking for Emergent misalignment
- InceptionRAG: Stealthy Poisoning Attack Against Retrieval-Augmented Generation
- Cascade: Hierarchical Recoverability Control for Large Language Model Unlearning
- OptiPrime: Optimizing Private Inference through Protocol-Hardware Co-design
- Disrupted Companionship: A Risk Assessment Framework and Cross-Platform Quantitative Analysis of Psychosocial Responses to AI Companion Disruptions
- ROSETTA: Efficient and Accurate Privacy-Preserving LLM Decoding via Hybrid CKKS/TFHE Evaluation
- Nameless Tokenization: A Lossless Tokenizer-Level Defense Against Control-Token Forgery in Open-Weight LLMs
- FlexEE: Self-Speculative and KV-Compatible Early Exiting for Offloading-Aware LLM Inference
- Memorisation bias in medical AI
- Semantic-Spatial Agreement Verification for Mitigating Object Hallucination in Multimodal Large Language Models
- Conformal Policy Learning with Distribution-Free Safety Guarantees
- Emergence World: Adversarial Stress-Testing of Long-Horizon Multi-Agent Systems
- Vroom-Vroom at SHROOM-Visions: A Multi-Judge Committee for Detecting Hallucinated Spans in Vision-Language Outputs
- Never Stop Thinking: Continuous-Time Language Agents
- When Should LLMs Abstain? Chain-of-Self-Questioning for Selective Risk Control
- ScienceBuddy: Recursive-in-Recursive Self-Improvement for Interactive Scientific Agents
- Agentic Societies Need a Social Harness