Tag
Zhang et al. reveal that lossy speculative decoding causes jailbreak vulnerabilities to spike far faster than utility drops, introducing SecureSD with early-token stricter verification.
Moya et al. show that augmenting preference datasets with targeted ties mitigates shortcut learning, deriving influence bounds and using implicit reward margins to identify optimal pairs.
Masiak et al. introduce TopKLoRA, a parameter-efficient fine-tuning method that enforces sparsity over adapter latents to expose causal circuits and enable surgical removal of sleeper-agent backdoors.
Rogers, Lin, and Brown apply sparse autoencoders to OpenVLA activations, identifying interpretable latent features that predict manipulation failures before irreversible physical errors occur.
Gibbs, Han, Tibshirani, and Zrnic develop an online selective auditing framework that provably bounds unaudited AI decision errors below user tolerances under both i.i.d. and adversarial streams.
Evaluating six 7-9B models across six categories of clinical harm reveals that risk-bearing language is statistically independent of factuality, with domain adaptation suppressing drug mentions while amplifying overconfidence.
Across 27 frontier models, conversational health assistants frequently validate mistaken user self-diagnoses instead of issuing critical clinical warnings when life-threatening conditions remain possible.
A benchmark of 300 matched task pairs reveals that tool-using agents routinely execute prohibited actions when environment tools omit constraints, with passive refusal rarely translating into active evidence recovery.
Evaluating cross-session payload retention across frontier models reveals that malicious prompts planted in agent memory and heartbeat files re-fire without decay, bypassing conventional safeguards.
Rather than inspecting isolated agent actions, DART tracks accumulated representation shifts across dialogue turns, cutting multi-turn agent attack success from 84% to 25% with minimal latency overhead.
Combining transcript distillation, counter-prompting, and tamper resistance produces the first ELK model organisms that reliably sandbag misaligned code audits while retaining full latent capabilities.
Iteratively training language models on their own safe responses paired with harmless contextual cues causes severe downstream safety degradation on standard jailbreak benchmarks.
Reusing internal activations to detect uncertainty without extra forward passes lets lightweight agents escalate to frontier models only when needed and monitor them afterward, cutting OSWorld inference costs by 19%.
Training LLMs away from dishonest completions using continuous adversarial objectives with on-policy utility data curbs pressure-induced lying and increases confession rates without degrading general reasoning.
Lifting verbatim context sentences into interleaved safety data prevents models from keying harmful behaviors on domain framing, slashing conditional misalignment on Qwen2.5-7B by up to 78%.
Evaluating five frozen neuroimaging foundation encoders on longitudinal cohorts demonstrates that released embeddings permit up to 99% rank-1 patient re-identification and over 90% recorded-sex inference.
An audit of the top 200 Hugging Face GGUF repositories reveals an Independent Verifiability Rate of 0/198 under standard disclosures, showing hidden compiler flags and per-tensor quantization recipes are required for bit-for-bit verification.
Counterfactual interventions across Qwen-3 and Gemma-4 show that attributes driving 19 to 24% of correct medical diagnoses go unmentioned in reasoning traces that models cannot solve without CoT.
Staging file writes and network requests at a microVM boundary with speculative execution cuts AgentDojo prompt-injection success from 47.0% to 2.7% without degrading benign utility.
Digital locker circuits embedded in neural networks resist elicitation through fine-tuning, weight noising, and gradient trigger search under cryptographic assumptions.
Weighted conformal prediction with directional, class-specific bounds keeps nominal 90% coverage on BraTS 2020 while narrowing intervals by 8 to 14%.
Azizi et al. audit typed decision models used as agent guardrails, showing how semantic manipulation of option labels drives fail-open rates up to 100%.
Hollinsworth et al. introduce representation probes trained on the FIBS dataset to detect latent sabotage and introspective deception in frontier LLM agents without relying on verbalized reasoning.
A theoretically grounded recalibration framework by Dandapanthula et al. using envelope sampling to provably bound policy regret when optimizing LLMs against surrogate reward models.
Nguyen and Fithian re-evaluate METR’s 50% time horizon metric with splines and item-response theory, revealing that task difficulty does not scale linearly with human log-time.
Extending medical triage beyond binary autonomous vs defer decisions: a framework that routes cases to autonomous prediction, human clinician, or human with AI guidance.
A medical safety/eval note: three-way retain/suppress/defer triage on VTaC with a finite-sample style bound on silenced true alarms, and a clear warning about multiplicity eating the certificate.
A stopping layer that tries to decide when a sequential diagnosis agent should diagnose or defer: with finite-sample style tests, and an honest ‘exploratory, not confirmatory’ framing.