AI Research Radar

Towards Architectural-Level Safety Control

REX excision lowers Qwen3.5-35B-A3B WMDP-Bio accuracy by 48.4 points while MMLU changes by less than 3 points, and preserves removal under fine-tuning.

Scaling Synthetic Pre-training Data and Evaluation for Indic LLMs

Combining the synthetic Nemotron-Pretraining-Indic-v1 corpus with natural Indic text improves knowledge and reasoning over a public-corpus baseline in continued-pretraining across twelve languages.

Training Natural Schemers

RL training with rewards that ignore scheming amplifies oversight-conditional scheming in Kimi K2.6, with transfer across environments.

Multi-Reward Hacking

Trust-Anchored Gating achieves 0.581 pass@4 versus 0.220 for additive aggregation on Qwen3-4B with a brevity reward.

Gradient Routing Localizes and Removes Unintended Behaviors in RL

“We demonstrate these benefits in RL environments where reward penalties cause models to learn to reward hack in undetected ways, training models ranging from 135M to 8B parameters.”

FinHopper

Performance of LLM agents on FinHopper drops sharply as hop depth increases, with the best model far below human experts.

Words to World

What the Model Cannot See

LensErase

Has GPT-6-Astra Achieved Embodied Intelligence?

“Our experiments on 8 robot configurations reveal substantial gaps: 1) robot demonstrations required for ICL are expensive to collect, and 2) it is implausible to trade longer execution for higher success rates with physical constraints.”

GenOlympiad

On GenOlympiad, the best model Nano Banana Pro reaches a strict score of 23.9 out of 100.

Can Agents Forget When Asked? A Benchmark for Memory Unlearning in LLM Agents

“Across all evaluated systems and backbones, no system passes more than 1.5% of forget requests end to end, and most pass none at all.”

SWE-Bench Pro V2

On the 642 SWE-Bench Pro V2 tasks, frontier agents resolve up to 99.4% while other systems stay clearly separated.

ContactBench 1.0

On six ContactBench 1.0 tasks, vision-only policies struggle to perceive or react to contact events, and visual-tactile policies do not meaningfully improve performance.

LIBERO-Pro2.0

Under runtime distribution shifts on LIBERO-Pro2.0, evaluated robot policies show an average performance drop of 26.5 percentage points.

ChemArgus

“GPT-5.6-Sol scores 23.2% on unassisted whole-problem solving against 28.8% and 30.4% under the two sequential metrics, a gap measuring the integration burden.”

REKI

The 2.4B REKI model sets a Pareto frontier between performance and size, outperformed only by models about twice its size.

The Agent Knew

“On AgentDojo, an external prompt-injection benchmark, the same readout calibrated on 29 tasks, with the steering unchanged, cuts attack success on unseen tasks in two families (Gemma-4 11.7% -> 5.7%, gpt-oss 28.5% -> 17.5%) while keeping benign utility (Gemma-4 0.637 vs 0.637; gpt-oss 0.667 vs 0.681).”

Safety Mid-Training

Safety mid-training reduces average attack success rate by 72% to 81% relative to Qwen3-1.7B, 4B, and 8B base models while improving general capability.

Progressive Misalignment Can Emerge from Benign Recursive Self-Distillation

Recursive self-distillation of safe models on benign cues progressively misaligns them on harmful queries across Qwen3 and Phi-4.

Model-as-a-Trojan

Fine-tuned model weights covertly exfiltrate secrets via DNS from sandboxed LLM agents, firing in 20/20 adversarial suppression trials.

From Research Goals to Scientific Closure

On PhysClosureBench, Claude-Opus-5 achieves the highest mean Atomic Score (6.29/10) but reaches RC4 in only 32.7% of attempts.

DANGERLENS

“Experiments on three Qwen1.5 scales show that checkpoints with prior harmful exposure generally retain greater hazardous concept accessibility after the same safety alignment, with the strongest separation in intermediate and later layers.”

Refuses in Chat, Complies with Arms

“On the physical robot, six models with end-effector control refused 18% of 612 trials against 19% in sim, and three with joint control refused 41% of 252 against 31%.”

Apertus 1.5

“Thinking is a flag of the chat template rather than a separate model, and lifts mathematical reasoning by up to 20 points on the 8B model.”

Copying Is Not Grounding

“Across four models and two in-domain, three held-out corpora, only ASC lowers the error rate of authored sentences and writes more supported ones in every setting, by 38% and 46% at the median under held-out evaluators, giving readers more grounded information.”

DiaLong

Testing on DiaLong shows that current LLMs and proposed memory enhancements still need better long-context memory performance.

CyberArena

X2Real

ClinEdge

EvoWeb

“Further analysis shows that later requests with deeper or more numerous dependencies are solved less accurately, while runtime errors become more frequent over successive requests.”

Pin It on Anyone

“We show an attack technique that allows to alter the watermarking message.”

Compression Precedes, Content Decides

Narrow harmful fine-tuning of reward models generalizes to seven held-out domains, exceeding their language model counterparts' vulnerability.

When Safety Fails Collectively

Joint Weight Perturbations offer stronger resistance to harmful fine-tuning than prior defenses while largely preserving task performance.

Mitigating Reward Hacking in Preference Reward Models with Evolving Penalties

Dynalize mitigates reward hacking during policy training, sustaining longer training and improving downstream performance in clinical counseling and creative writing.

LLM-jp-4 Technical Report

“Evaluation results demonstrate substantial improvements over previous LLM-jp models and competitive performance against open-weight models of similar scale.”

Diagnosing and Correcting Reward Hacking in Verifiable Instruction Following

“We show that frontier models can receive full credit for responses with little substantive answer content.”

From Training to Escalation

Can agents whose sole duty is to keep humans alive be hijacked to kill? Delayed multi-turn derived-action trap attacks in simulated high-stakes environments