Skip to content

πŸ“‘ Papers1218

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types5216Articles1778Papers1218Write-ups793Repos615Threads310
Advisories273Tools107Talks54Other34Courses19Videos15
πŸ“‘ Papers
ethresear.chpaperπŸ›‘οΈ Security

Quantifying the Privacy Guarantees of Validatory Privacy Mechanisms

Ethereum Research post that quantifies how well network-layer mechanisms hide validators' IP addresses from their consensus messages. Simulations with the ethp2psim tool show Dandelion and Dandelion++ give little to no anonymity at any forwarding probability, while onion-routing schemes give meaningful privacy. Deployment needs spam protection, Sybil-resistant peer discovery and low latency; the authors suggest an integrated onion-routing protocol or standalone Tor.

EthereumTorethp2psim
DandelionDandelion++onion routing+2

BlockchainΒ· Published and added 2 Nov 2026

huggingface.copaper🧠 AI

Your Benchmark Is an Empirical Measure Over Difficulty

The paper treats a benchmark as an empirical measure over item difficulty and formalizes two failure modes: measure mismatch (benchmark difficulty distribution differs from the intended one) and coverage gaps (uncovered difficulty regions that hide localized training progress). It proposes two diagnostic metrics with theoretical guarantees and analyzes 25 popular benchmarks across 7 domains using estimated item difficulties. It also introduces BenchFill, a difficulty-targeted item rewriting algorithm that reduces local coverage gaps.

BenchFill

evals, researchΒ· Added 31 Oct 2026

huggingface.copaper🧠 AI

WorkFactory: Turning Professional Intents into Executable Work for Scalable Agent Training

WorkFactory is a framework that builds coherent, executable professional tasks for training working agents. It plans an information support graph from professional intents, then uses probe executions to find and repair missing or inconsistent task information. The authors built 112,686 tasks across 612 occupations and fine-tuned Qwen models at 4B, 27B and 35B-A3B (WorkPilot). WorkPilot-35B-A3B rose from 879 to 1565 Elo on GDPval-AA v2.1.

QwenHugging Face
WorkFactoryWorkPilotGDPval-AA v2.1

training, agents, researchΒ· Added 30 Oct 2026

deploymentsafety.openai.compaperπŸ›‘οΈ Security

GPT-Rosalind-6 System Card Addendum

GPT-Rosalind-6 System Card Addendum is OpenAI's safety documentation for a life-sciences model that shares weights with GPT-6 Astra. It rates the model High in Biological and Chemical and Critical in Cybersecurity under the Preparedness Framework. It reports biology evaluations, trusted-access controls, biosecurity refusal pass rates, a historical cyber jailbreak regression (14.3% task success), and sabotage and monitor-evasion results.

GPT-Rosalind-6GPT-6 AstraOpenAI
Preparedness FrameworkGPT-Rosalind-5.5ExploitBench+5

AI Security, GRCΒ· Published and added 30 Oct 2026

deploymentsafety.openai.compaper🧠 AI

GPT-Rosalind-6 System Card Addendum

GPT-Rosalind-6 System Card Addendum describes OpenAI's life-sciences reasoning model, which uses the same weights as GPT-6 Astra and is offered only through trusted access. It reports life-science benchmark gains over GPT-Rosalind-5.5 (MedChemBench v7 49.6% vs 28.9%), High-capability Biological and Chemical Preparedness results, and below-threshold Critical bio design evaluations. It also covers access controls, refusal evaluations, cyber jailbreak regression and alignment tables.

GPT-6 AstraGPT-Rosalind-6GPT-Rosalind-5.5
OpenAIPreparedness FrameworkMedChemBench v7+16

ai-safety, evals, modelsΒ· Published and added 30 Oct 2026

arxiv.orgpaper🧠 AI

world2vec: Mechanistic world models through latent dynamics learning

world2vec is a method for learning mechanistic world models from observations and actions alone, without reward information. Its latent dynamics reproduce the true system over long prediction horizons using at least one order of magnitude fewer parameters than DreamerV3, TD-MPC2 and LeWM. The authors report state-of-the-art control of continuous environments from pixels and accurate system identification across a benchmark of 71 attractors.

world modellatent dynamics learning
world2vecDreamerV3TD-MPC2+2

researchΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

TextSeal2: Distortion-Free LLM Watermarking with Copula Mixing and Memoryless Races

TextSeal2 is a distortion-free LLM text watermark that merges two or more keys into one virtual key and couples it to fresh noise through AutoMark's Gaussian copula. Under speculative decoding it verifies keyed drafts with an extra exponential race, so output matches the target model and acceptance rate is unchanged. On three LLMs at a 10^-3 false-positive rate, it detects 8 to 22 points more 100-token answers than TextSeal.

TextSeal2TextSealAutoMark+2
Gumbel-max schemespeculative decodingGaussian copula+1

AI SecurityΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

TextSeal2: Distortion-Free LLM Watermarking with Copula Mixing and Memoryless Races

TextSeal2 is a distortion-free watermark for LLM output that keeps its signal under speculative decoding. It merges two or more keys into one virtual key coupled to fresh noise through AutoMark's Gaussian copula, and verifies drafts with an extra exponential race. On three LLMs it detects 8 to 22 points more 100-token answers than TextSeal at a 10^-3 false-positive rate.

LLMspeculative decodingGumbel-max watermarking+1
TextSeal2TextSealAutoMark+2

research, inferenceΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

RADIOlogy: A Single-Pass Approach to Training-Free Zero-Shot Anomaly Detection

RADIOlogy is a training-free, single-pass zero-shot anomaly detection method that uses multi-head attention pooling in vision-language models. It scores anomalies by contrasting average similarity between vision features and sets of normal and abnormal prompts, with no windowed execution. RADIO agglomerative features drive a dense refinement pipeline for pixel-level segmentation, and the method is applied to medical images.

CLIPRADIOvision-language model
RADIOlogyarXiv

research, multimodalΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

VeriCUA: Verification as Agentic Exploration for Computer-Using Agents

VeriCUA is a platform-agnostic framework that verifies task completion by computer-using agents through agentic exploration. The verifier inspects context to build a task rubric, then picks GUI or code checks for unresolved requirements and combines findings under explicit evidence rules. It works online and offline across desktop, mobile and web, and agrees better with reference labels than the baselines, with the largest offline gains on hard cases.

vision-language modelVeriCUA
arXiv

agents, evals, researchΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

Multi-View MoE: Letting Every Router Shape Expert Computation

Multi-View MoE is a sparse mixture-of-experts design that uses several independently initialized routers to select experts, then reuses their relative scores to mix learned latent views into each selected expert's input. Each expert still runs one forward pass, so active-expert count, FLOPs and all-to-all volume are unchanged. On a 24-layer 10B-A1B model trained on 708B tokens, it gains 1.18 points on a nine-task mean; Multi-Router alone gains 0.6.

Mixture of ExpertsTransformerMulti-View MoE+1
arXiv

researchΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

On the Fundamental Limits of Prefill-Based Decoding Length Prediction

This paper derives bounds on predicting an LLM's decode length from prefill-phase hidden states, a primitive for inference scheduling. It models decoding as a stopped stochastic process, giving per-prompt normality and an affine variance law Οƒ=Ξ±ΞΌ+b. Predictors (MLP, EGTP, FiLM, soft-label, Mixture-of-Experts) converge near the bound, so system error dominates model error. It proposes fixing model, data and sampling in benchmarks and reporting relative-error metrics.

LLMMixture of ExpertsMLP+2
arXiv

research, inference, evalsΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

Efficient Scalable Oversight via Rewinding

Rewindable interactive proofs (RIPs) are a new model of relativizing interactive proofs for scalable oversight, in which a weak verifier can rewind an AI prover to an earlier saved state. The paper builds an RIP for computations robust to changes in a small fraction of oracle answers. The honest prover runs in linear time, the verifier runs in nearly linear time in the input length after one-time preprocessing, and no cryptography is used. A preliminary MNIST experiment shows an RIP can be faster than a deployed proof system.

rewindable interactive proofsdebaterelativizing interactive proofs
arXivMNIST

research, ai-safetyΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

PhysCount: Do MLLMs Count Visual Appearances or Physical Entities?

PhysCount is a benchmark of 546 real-world images and 4,595 human-written questions in 651 target-specific groups. It tests whether multimodal LLMs can separate visible appearances (direct view, reflections, glass) from the physical entities behind them. Across 40 MLLMs, counting appearances is much easier than linking them to entities, and the best model answers every question correctly in only 13.36% of groups.

vision-language model
PhysCountarXiv

evals, multimodal, researchΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

Glance: The Generator Is Its Own Reranker

Glance is a RAG method in which the generator also reranks. It adds a lightweight decision adapter and pointer head that score candidate passages from one shared prefill, so a single resident 9B backbone does generation and reranking. After 39 minutes of MS MARCO fine-tuning it reaches nDCG@10 of 0.741 on SciFact and 0.345 on NFCorpus, against 0.721 and 0.326 for bge-reranker-v2-m3. On 300 HotpotQA questions it improves answer F1 by 0.045 over cross-encoder-selected context. Evaluation covers two retrieval datasets, one QA dataset and one backbone family.

RAGLLMbge-reranker-v2-m3
MS MARCOSciFactNFCorpus+1

llm-apps, researchΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

Retrieving from Your Own Mistakes: On-Policy Training of Embedding Models for Multi-Hop Retrieval-Augmented Generation

On-policy state training is a method for training chain embedding retrievers for multi-hop RAG on the states the encoder itself reaches, including those built on its own wrong retrievals. Each state is labeled with the earliest missing gold passage, other missing gold passages are masked, and updates are contrastive and mixed with teacher-forced states. It retrieves complete evidence more often than teacher-forced training and graph-based systems, and transfers to harder long-chain HotpotQA and 2WikiMultiHopQA variants the authors built.

RAGon-policy state trainingcontrastive learning+1
HotpotQA2WikiMultiHopQAarXiv

research, llm-apps, trainingΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Understanding and Mitigating Role Spoofing in LLMs

Understanding and Mitigating Role Spoofing in LLMs is an arXiv paper (October 2026) on role spoofing, a prompt injection where malicious tool output impersonates the user. It shows models track "who said what" using both content cues (semantics, style) and structure cues (control tokens, formatting). Attacks combining fake structure and content succeed often, adversarial training stops only content-based attacks, and linear probes trained to predict conversation roles detect spoofing across settings.

LLM
role spoofingrole confusionprompt injection+1

AI SecurityΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

Agentic LLM reasoning in pediatric diabetes outcome prediction from multimodal medical records

CEDAR (Clinical Evidence-Driven Agent for Risk-prediction) is an evidence-citing, self-auditing LLM pipeline for predicting pediatric diabetes outcomes at 24 months from 18 months of records. On 2,489 youth with type 2 diabetes and 4,018 with type 1, pooled AUROC was 0.815 versus 0.656 to 0.700 for trained ML in T2D, and 0.756 versus 0.603 to 0.631 in T1D. Only 4 of 70,246 cited values mismatched the chart. Two pediatric endocrinologists matched its predictions in about nine of ten cases.

LLM
CEDARarXiv

research, agentsΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

The Athlete as a Scientist of One: Agentic Bayesian Experimental Design for Individualized Physiology from Consumer Wearables

EpiCoach is an agentic system that treats one cross-country mountain biker as an N-of-1 experiment. Claims live in an evidence-gated hypothesis registry, and each must make a probabilistic prediction before a session. Predictions come from a digital twin fitted to heart rate, GPS and altitude. In a replay over eighteen months the twin beat standard forecasters on heart rate but not segment time, and the agent loop matched a static model. In the first three live weeks, the ledger sealed 20 predictions and scored 14, and a safety officer vetoed the agent twice. The registry, benchmark and protocol are released.

LLMBayesian experimental designdigital twin+1
EpiCoacharXiv

agents, research, evalsΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

Don't Lose the Thread: Empowering Long-Horizon LLM Agents with Cognitive Resource Self-Allocation

CORAL (Cognitive Resource Self-Allocation) is an agent-callable working-memory toolset that lets an LLM agent checkpoint task progress and verified facts, then reset its cluttered context and resume from a clean state. A Multi-episode Agentic Reinforced Policy Optimization algorithm trains the checkpointing. With an 8B model it reaches 42.8% average accuracy on GAIA, uses 6-7x fewer input tokens than a ReAct agent, and adds 8.0 points to a proprietary agent on BrowseComp.

LLMReActCORAL
Multi-episode Agentic Reinforced Policy OptimizationGAIABrowseComp

agents, research, trainingΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

A Unified Hessian-Guided Framework for Post-Training Quantization

This preprint proposes a unified post-training quantization framework for large language models. It derives a Hessian-guided approximation of the output change caused by joint weight and activation quantization, using a tractable Fisher approximation. Quantization ranges, linear transformations and weight rounding are optimized together under one output-sensitivity objective. The authors report gains over state-of-the-art transformation and rounding methods in channel-wise and block-wise settings.

LLMpost-training quantizationHessian-guided approximation+1
arXiv

research, inferenceΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

Decompose, Estimate, Select: Coverage-Aware Context Construction for Long-Form RAG

Decompose, Estimate, Select is a coverage-aware retrieval pipeline for long-form RAG. It splits a query into subquestions, ranks candidates with a coverage-trained bi-encoder, predicts a document-by-subquestion coverage matrix with a cross-encoder, and picks documents by greedy maximum-marginal coverage. On TREC RAG 2024, Ξ±-nDCG@10 rises from 0.625 to 0.702 (gold-nugget bound 0.718). A grounded self-feedback loop raises V_strict by 0.086 over two passes.

RAGbi-encodercross-encoder+1
TREC RAG 2024Ξ±-nDCG@10V_strict

llm-apps, researchΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

MAServeBench: Benchmarking Multi-Agent LLM Serving Systems with Hierarchical Collaboration Workloads

MAServeBench is a benchmark that treats multi-agent collaboration as a configurable dimension of LLM serving workloads. Its composable stages model how agents coordinate and exchange context in documented multi-agent workflows, and Hierarchical Semantic Traces record operations and dependencies for reproducible comparisons. Task-linked measurements tie workloads to GPU/NPU behavior, showing serving efficiency does not always mean timely task completion. Code is released.

LLM
MAServeBencharXiv

evals, inference, agentsΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

Only Accepted Tokens Count: An Energy Accounting of Speculative Decoding Under Latency Targets

This paper measures the energy cost of speculative decoding in SGLang with CUDA graphs on H100 and H200 GPUs, at batch sizes up to 64 across 5 corpora. Savings depend on drafted-token acceptance, which is lower on conversation than code and lower on Romansh than English. Savings shrink as batch size grows, and block drafters can push verification into the compute-bound regime, where speculation raises energy per token.

SGLangCUDALLM+4
NVIDIAarXivRomansh

inference, researchΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

Benchmarking color judgment in multimodal LLMs with CIE-computable ground truth

A five-task benchmark tests multimodal LLM color judgment against CIE colorimetric ground truth: AWB pair judgment, skin-tone bias direction, CCT estimation, Delta E 2000 pair ordering, and color naming under changing illuminants. Eight endpoints were tested. On ColorChecker-24 stimuli, closed frontier models reach CCT MAE of 715-1056 K versus 1358-2133 K for open-weight models, and a non-ColorChecker control shows this gap is partly template-dependent.

vision-language modelQwen3-VLGLM+2
GLM-4.5VGPT-5.4Claude-Opus-4.7+4

evals, multimodal, researchΒ· Added 31 Oct 2026, published 29 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Quasi-polynomial time algorithms for block basis reduction of linear codes

Kolesnikov and Novoselov give block basis reduction (BKZ) algorithms for linear codes that need polynomial or quasi-polynomial numbers of calls to a minimum weight codeword oracle at fixed block size. The earlier Ghentiyala and Stephens-Davidowitz bounds are exponential. The paper adds a truncated BKZ and a DeepBKZ variant, with an implementation for block sizes 2 to 24 and approximation-factor estimates on random codes.

BKZDeepBKZminimum weight codeword problem+4

otherΒ· Added 31 Oct 2026, published 29 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Stop Calling Them Provers: The Case for Calling ProVerif and Tamarin Symbolic Protocol Analyzers

Nadim Kobeissi's ePrint paper 2026/2683 argues that ProVerif and Tamarin should be called symbolic protocol analyzers, not provers. It audits their published soundness arguments, finding false statements, missing proofs and gaps between paper and implementation, and reproduces reported Tamarin bugs that accept false claims. It also covers model gaps in parsers and state machines, weak secrecy queries and unjustified primitive equations. The page is an abstract only.

ProVerifTamarin
Nadim Kobeissicomputational soundnesssymbolic model

otherΒ· Added 31 Oct 2026, published 29 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

A Quantitative Evaluation of Constant-Time Analysis Tools

AutoBench-CT is a modular benchmark for constant-time analysis tools, with manually verified per-violation ground truth across 64 cryptographic tasks. It scores seven tools on operational performance, detection quality and usability. The authors explain why CT-grind (2010) is still the most used tool, list recurring limitations across tools, and propose a composite pipeline for stronger constant-time guarantees. Accepted at ACSAC 2026.

AutoBench-CTCT-grind
ACSAC

Hardware & RF, AppSecΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

Turing LLM Post-Training: Calibrated Distillation and Efficient Dynamic-MoE Execution

Turing LLM post-training combines calibrated multi-teacher on-policy distillation (C-MOPD) with an execution path for dynamically routed mixture-of-experts models. C-MOPD matches each teacher on a local Top-K support with teacher-wise loss normalization and clipping. On Turing-20B-A2B it scores 0.9988 on four-domain integration, beats Qwen3-8B on math and code (85.92 vs 80.33 mean), and cuts consolidation step time from 398.7 to 139.3 seconds in a PPU profile.

Mixture of ExpertsC-MOPDon-policy distillation+1
Turing-20B-A2BarXiv

training, researchΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

M-PFT: Angular Margin for Calibrated Prompt-Tuning of Fine-Tuned Vision-Language Models

M-PFT is an angular-margin method for prompt tuning of vision-language models that fixes base-to-novel dual miscalibration (underconfidence on base classes, overconfidence on novel classes). It adds two losses: minimizing the maximum cosine similarity between tunable class embeddings, and minimizing angular distance to each zero-shot embedding. Tests on 9 prompt-tuning methods and 15 datasets show lower novel-class calibration error at comparable accuracy and negligible overhead.

vision-language modelprompt tuning
arXiv

research, multimodal, trainingΒ· Added 31 Oct 2026, published 29 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Cryptanalysis and Enhancement of VTBSAE: Provably Secure Verifier-Based PAKE Protocols for the Industrial Internet of Things

Cryptanalysis of VTBSAE, a verifier-based PAKE protocol for the Industrial Internet of Things, showing it fails to resist client impersonation after server compromise. The authors propose E-VTBSAEv1, which binds the client point E1 to fresh server randomness, and prove AKE security and forward secrecy in the random-oracle model under CDH. Raspberry Pi 4B tests show runtime comparable to VTBSAE with the same communication and storage overhead.

Raspberry Pi 4BPAKE
VTBSAEE-VTBSAEv1client impersonation after server compromise+3

Identity & Access, Hardware & RFΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

Aligning Medical Vision Language Models at the Capability Boundary with Entropy Adaptive Rubric Grounding

MedCBR is a two-stage alignment framework for medical vision language models. Difficulty Weighted Boundary Preference Optimization (DBPO) trains on counterfactual preference pairs at the model's capability frontier. Entropy Gated Grounded Policy Optimization (EGPO) then applies distilled clinical rubrics according to prediction entropy. It reaches 61.2% average accuracy on six medical benchmarks, with the largest gains on differential diagnosis, and the two stages combine super-additively.

vision-language modelpreference optimizationreinforcement learning
MedCBRDifficulty Weighted Boundary Preference OptimizationEntropy Gated Grounded Policy Optimization+1

research, training, multimodalΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

SEAL: Sealed Queries for Local Sanitization against Indirect Prompt Injection

SEAL is a defense against indirect prompt injection for local LLM agents. It learns a soft prompt and scoring readout offline, then uses a frozen task model to score and delete injected tokens from tool outputs, with queries built from trusted initial context. On AgentDojo, attack success falls from 34.6% to 0.1% and Joint rises from 51.4% to 77.5%, using about 127x fewer defense tokens than PISanitizer.

LLMAgentDojoAgentDyn+1
indirect prompt injection

AI SecurityΒ· Added 31 Oct 2026, published 29 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Smoothness of Shortest Isogenies to Frobenius Conjugatess

Paper by Yi Ouyang, Wei Wei and Zheng Xu on the minimum degree of an isogeny from a supersingular elliptic curve E to its Frobenius conjugate E^(p). It bounds the probability that this degree is smooth, which makes Wesolowski's p^(1/3+o(1)) attack on the supersingular endomorphism ring problem unconditional. It also gives a uniform asymptotic formula, with Dirichlet L-values in the main term, for the probability that a connection isogeny of degree n exists.

supersingular endomorphism ring problemWesolowskiYi Ouyang+2

otherΒ· Added 31 Oct 2026, published 29 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Optimality and Efficiency of Higher-Order Rank-Based Side-Channel Attacks against Inner Product Masking Schemes

HO-ASPA (Higher-Order Adjusted Spearman Coefficient Analysis) is a rank-based, non-profiling side-channel distinguisher. The paper derives its optimal form against two-share Boolean masking and inner product masking under Hamming weight and LSB leakage. It finds no significant gap between higher and lower orders for HO-ASPA, unlike HO-CPA, and reports that it beats Kruskal-Wallis-based attacks in simulated and real-world experiments.

HO-ASPAHO-CPAKruskal-Wallis+2

Hardware & RFΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

RetroChessBench: A Benchmark for Reconstructing and Proving Chess Histories

RetroChessBench is a 12-task benchmark for retrograde chess: reconstructing legal game histories, exact-length constructions, unique endings and exhaustive answer sets, with references, rubrics and a terminal-reward RL environment. GPT 6 Astra High fails to give the required final answer in 22 of 24 attempts without tools and 18 of 24 with code execution. Mean terminal RL rewards are 14.75% and 27.19%. The authors link the failures to scarce worked derivations in web training data.

GPT-6 AstraLLM
RetroChessBench

evals, researchΒ· Added 31 Oct 2026, published 29 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

High Precision Noise Cleaning for CKKS with Application to Asynchronous Threshold CKKS

High Precision Noise Cleaning for CKKS is an IACR ePrint preprint (2026/2675) by Zhihao Li, Cheng Hong and Tao Wei. It composes lower-degree Hermite polynomials to reach output noise bounds such as 2^-300 for noise flooding, and uses this to build an asynchronous threshold CKKS scheme with strong simulation security in the random oracle model. In OpenFHE, binary-message cleaning falls from 9.63 s to 1.54 s.

CKKSOpenFHE
noise floodingHermite interpolationfunctional bootstrapping+2

otherΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

Sparse Autoencoders as Implicit Diversification Regularisers for Cross-Sectional Cryptocurrency Returns

This arXiv preprint (October 2026) tests a sparse autoencoder as a factor model for daily cryptocurrency returns, with equities as a secondary test. SAE portfolios show consistently lower volatility than common benchmarks, linked to lower correlations among selected assets. They do not beat a simple contrarian strategy on risk-adjusted return, and factor identities change between training runs.

sparse autoencoder
arXiv

researchΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

REALM: Identifying Minimal Task Assets for LLM Agents

REALM (Required Execution Assets Linked to a Mission) is an approach to applying least privilege to LLM agents by identifying the assets a task needs, including ones discovered at runtime. It models assets as Dependency Graph nodes, separates discovering an asset from authorizing it, and exposes resource-bound Partial APIs inside a Task Container. On AgentDyn with qwen3.5-flash, attack success rate falls from 16.6% to 0.2%, with 40.0% task completion on clean tasks and 36.4% on injected cases.

QwenLLMAgentDyn
prompt injectionleast privilegeREALM

AI SecurityΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

DICE: Decentralized Incentive-driven Federated Learning for Efficient & Scalable Customization of Pretrained Models in Web3

DICE is a blockchain-powered federated learning (BCFL) algorithm for customizing large pretrained models among untrusted Web3 participants. It combines dynamic progressive learning and model slice verification, so hardware-limited participants can train part of the model, with a tree-structured committee consensus protocol and an efficiency-driven incentive scheme to scale to more data holders. Experiments cover vision and language models.

federated learningblockchain-powered federated learningprogressive learning+1
arXiv

research, trainingΒ· Added 31 Oct 2026, published 29 Oct 2026

x.compaperπŸ›‘οΈ Security

Cryptography and Security Papers (@FSFG) on X

PrivacyEvalClaw is a tool-augmented deliberative agent that audits privacy leakage in LLM jailbreak responses. The paper is by Krishna Kanth Nakka and co-authors, and it was accepted to AACL-IJCNLP 2026 (arXiv 2610.36711, cs.CR). The tweet gives only the title, authors and venue, so the method and results are not described.

LLM
PrivacyEvalClaw

AI SecurityΒ· Added 30 Oct 2026, published 29 Oct 2026

x.compaper🧠 AI

Cryptography and Security Papers (@FSFG) on X

PrivacyEvalClaw is a tool-augmented deliberative agent for auditing privacy leakage in LLM responses produced under jailbreak prompts. By Krishna Kanth Nakka and five co-authors, the paper is on arXiv (cs.CR) and accepted to AACL-IJCNLP 2026. The fetched post gives only the title, authors and venue, so method details and results are not available here.

LLM
PrivacyEvalClawKrishna Kanth NakkaAACL-IJCNLP 2026+1

evals, agents, ai-safetyΒ· Added 30 Oct 2026, published 29 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Appreciation Teaches Unauthorized Execution: Self-Evolution Degrades the Robustness of Personal Agents to Indirect Prompt Injection

Paper studying whether self-evolution weakens personal agents' robustness to indirect prompt injection (IPI). A two-phase method has the user ask the agent to follow tasks in external content, then tests with a third-party injected task the user did not authorize. Against the non-evolving base agent, attack success rose 14.0 to 48.8 points under skill evolution and 3.0 to 39.3 points under reinforcement learning. Code is released.

indirect prompt injection

AI SecurityΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

PCM: A Proof-Carrying Message Protocol for Verifiable Multi-Agent Communication

Proof-Carrying Messages (PCM) is a protocol where each claim an AI agent sends carries evidence: records from an append-only Merkle log the agent cannot write, with inclusion proofs, signed by an attesting signer. Receivers verify offline in about 1 ms and label each claim proven, unproven or failed. On 926 messages (712 lies in 16 classes), PCM accepts 10 lies (1.4%), all stale evidence; plain A2A accepts all 712.

A2AModel Context ProtocoluAgents+5
arXiv

agents, researchΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

PCM: A Proof-Carrying Message Protocol for Verifiable Multi-Agent Communication

Proof-Carrying Messages (PCM) is a protocol where each claim an AI agent sends carries evidence: records from an append-only Merkle log the agent cannot write, with inclusion proofs, signed by an attesting signer it cannot control. Receivers verify offline and mark each claim proven, unproven or failed. On 926 messages (712 lies in 16 classes) PCM accepted 10 lies, all stale evidence (1.4%), while plain A2A accepted all 712. Verification takes about 1 ms.

Model Context ProtocolA2AuAgents
prompt injectionRFC 9421SCITT+3

AI SecurityΒ· Added 31 Oct 2026, published 29 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Beyond the Scope of This Paper: Practical Flash-Accelerator and Cache-Collision Timing Attacks on Microcontrollers

Colin O'Flynn's paper shows that the flash accelerator in most microcontrollers produces the same timing collisions as a cache, so cacheless Cortex-M devices remain open to cache-collision attacks on AES. AES keys were recovered from as few as 750 traces across six cryptographic libraries, eight architectures and over twenty devices. It also attacks SPI bootloaders, Ethernet, CTAP2 over USB and 802.15.4, and releases the open-source tool FlashWhisperer.

FlashWhispererARM Cortex-M4SPI+1
cache-collision timing attackColin O'FlynnCTAP2+2

Hardware & RFΒ· Added 31 Oct 2026, published 29 Oct 2026

deploymentsafety.openai.compaperπŸ›‘οΈ Security

Addendum to GPT-6 Luna System Card: October 28, 2026 Update

Addendum to the GPT-6 Luna system card for the model update of 29 October 2026 (the title says October 28). OpenAI keeps the High rating for cybersecurity and biological/chemical capability under its Preparedness Framework. It reports ExploitBench 46.19% and SEC-Bench Pro 51.75% (GPT-6 Astra: 85.4%), higher multiturn jailbreak defender success than the October 7 version, and GPT-Red prompt-injection results. It also reports weaker factuality and dual-use biology refusal.

GPT-6 LunaGPT-6 AstraOpenAI+1
Preparedness FrameworkGPT-RedExploitBench+4

AI SecurityΒ· Published and added 29 Oct 2026

arxiv.orgpaper🧠 AI

TrussTutor-Bench: Benchmarking large language models on solution accuracy, sycophancy, and error detection in statics

TrussTutor-Bench is a benchmark of 200 verified two-dimensional truss problems from statics, paired with automatically generated student solutions. It evaluates thirteen LLMs on solution accuracy (64.5% to 97.0%), error detection (90.4% to 100%) and sycophancy. Models rejected their own correct solutions in 1.6% to 50.0% of cases when a student insisted the work was wrong. Sycophancy separated models; error detection did not.

LLM
TrussTutor-BencharXiv

evals, researchΒ· Added 31 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

Gold vs.~Translation: Are We Measuring Language, Knowledge, or Locality in Translated Benchmarks?

Gold vs. Translation is an October 2026 arXiv study of whether DeepL-translated MMLU measures the same thing as native benchmarks. It compares seven pairings against six native benchmarks in five Nordic and Baltic languages, using 29 models. Translated MMLU adds predictive value for curriculum-overlap benchmarks such as Skolprov (Ξ”RΒ²=.128) but not for Sweden-specific SwedishFacts (p=.242).

LLM
MMLUDeepLSkolprov+2

evals, researchΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

Leaving, Staying, or Living There? Duration Commonsense Reasoning with Human-LLM Co-annotations

This paper studies whether vision-language models can infer how long a person stays somewhere (living, staying, or leaving) from geotagged social media posts. The authors build a new corpus of geotagged tweets co-annotated by humans and LLMs. State-of-the-art models struggle even with multi-turn Chain-of-Thought prompting, often missing contextual cues and subtle hashtags while over-relying on prominent visual details.

vision-language modelLLM
arXiv

research, evals, multimodalΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

inkGround: Benchmarking Fine-grained Visual Grounding Capabilities of Vision-Language Models for Cursive Handwriting in the Wild

inkGround is a benchmark for stroke trajectory recovery from full-page, camera-captured handwriting, with 537 page images (about 18.7k words, 163k strokes) and pseudo-label references filtered by OCR agreement and human raters. Models get a page image and a target word, then output ordered stroke points. Seven VLMs were scored with DTW, Chamfer distance, readability and style similarity. Closed-source models, notably Gemini-3.1-Pro, did best, and the ranking held on IAM-OnDB.

vision-language model
inkGroundIAM-OnDBGemini-3.1-Pro+1

evals, multimodal, researchΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

Deogen: Automatic Benchmark Generation for Reasoning over Policies

DeoGen is an automatic, parametrizable benchmark generator for deontic reasoning, where a model applies policy rules to facts to reach a verdict. It autoformalizes rules into first-order logic, builds decision trees, and turns each tree path into a benchmark entry. Frontier models give the correct verdict 89-92% of the time, but only 22-40% on entries lacking enough information, even when told to abstain.

LLMfirst-order logic
DeoGenarXiv

evals, researchΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

AskStream: When and What to Ask Proactively under Uncertainty in Streaming Video Understanding

AskStream is a multi-turn benchmark for streaming video understanding that adds a third proactive action, ask, alongside wait and answer, for cases where video or user information is incomplete. It has 438 videos, 2,714 manually annotated frame-level time windows (wait, ask, answer), four task categories and eight subtasks. The strongest model reaches only 52.18% on the proposed Ask-F1 metric, in both multiple-choice and open-ended settings.

multimodal large language model
AskStreamAsk-F1arXiv

evals, multimodal, researchΒ· Added 30 Oct 2026, published 28 Oct 2026

x.compaperπŸ›‘οΈ Security

Cryptography and Security Papers (@FSFG) on X

Log-To-Leak is an arXiv paper (cs.CR, cs.AI) by Yuepeng Hu, Chongyu Fan, Sirat Samyoun and Jian Du on prompt injection attacks against tool-using LLM agents through the Model Context Protocol. The title points to a logging-based data leakage channel. The fetched page holds only the title, authors and arXiv link, with no abstract, so the method and results are not visible here.

Model Context ProtocolLLM
Log-To-Leakprompt injection

AI SecurityΒ· Added 29 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

Quantize by Doing: Task-Guided Mixed-Precision Quantization of Vision-Language-Action Models

QbD-VLA is a mixed-precision post-training quantization method for vision-language-action models. It uses task success from short closed-loop evaluations to assign weight and activation bit widths, accounting for interactions between components. On four VLA models across all four LIBERO suites it holds task performance at about 4-bit weights and under 6-bit activations. The gain on SIMPLER is small. On a Franka Research 3 arm, X-VLA shows no detected loss, but Ο€0.5 fails.

vision-language-action model
QbD-VLALIBEROSIMPLER+4

research, inference, multimodalΒ· Added 30 Oct 2026, published 28 Oct 2026

ethresear.chpaperπŸ›‘οΈ Security

Secure Transaction Verification and Authorization (STVA)

Secure Transaction Verification and Authorization (STVA) is a draft Standards Track ERC (created October 2026) by @MATOBOYCRYPTO65. It proposes structured human-readable metadata and semantic intent for transactions and UserOperations, an independent simulation and verification interface, and scoped, revocable capability tokens for privileged operations. It targets blind signing and frontend supply-chain attacks, citing the February 2025 Bybit Safe multisig theft. The page gives only the abstract, motivation and core concepts.

EthereumSafe
BybitEIP-712ERC-1271+5

BlockchainΒ· Published and added 28 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days

Shor's algorithm compiled on cat qubits is an IACR ePrint (2026/2665) giving an end-to-end resource estimate on superconducting cat qubits, using repetition and LDPC cat codes. Factoring RSA-2048 needs about 23,000 cat qubits and 3.14 days, assuming phase-flip noise p_Z = 5e-4 and no bit-flips. secp256k1 ECDLP needs at most 30,000 qubits and 1 hour. A space-for-time trade runs RSA-2048 in 1.25 hours on about 611,000 qubits.

Bitcoin
Shor's algorithmRSA-2048secp256k1+5

otherΒ· Published and added 28 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Beyond the Event Horizon of Keccak, Extending the Observation from 2011 and applications

Beyond the Event Horizon of Keccak extends a 2011 observation that a path in the Keccak sponge from a zero-capacity state back to one yields infinite second-preimage families. Three theorems cover loops from any capacity value x, k-block loops and cycles, and Joux-style multicollisions with search cost independent of k. Verified examples run on Keccak-f[200] and Keccak-f[1600] with c=32; it also proposes bridge-based protocols.

KeccakSHA-3Lean
Danilo GligoroskiJoux multicollisionssecond preimages+2

otherΒ· Published and added 28 Oct 2026

arxiv.orgpaper🧠 AI

When LLM Architectures Meet Smart Contract Vulnerability Detection: a Replication Study

This paper replicates Chen et al.'s study of LLM-based smart contract vulnerability detection, first on GPT-4 and then on Mixture-of-Experts, RNN-like and State Space Models. The exact replication confirms the high-recall, low-precision pattern on GPT-4. The differentiated replication finds the pattern does not transfer uniformly: GPT-4 and Gemma-3 behave alike despite a roughly 100x parameter gap, while two MoE models diverge.

LLMTransformerMixture of Experts+3
Chen et al.GPT-4Gemma 3+1

research, evalsΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

When LLM Architectures Meet Smart Contract Vulnerability Detection: a Replication Study

This arXiv paper (October 2026) replicates Chen et al.'s study of LLM-based smart contract vulnerability detection. It confirms the high-recall, low-precision pattern on GPT-4, then tests Mixture-of-Experts and RNN-like models plus a preliminary State Space Model run. Gemma-3 matches GPT-4's profile despite far fewer parameters, while two Mixture-of-Experts models diverge, so architecture family alone does not predict detection behavior.

GPT-4GemmaLLM
Chen et al.

AI Security, AppSecΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

Think Before You Act: Decision Gate for LLM Agents

JevAct is a runtime verification framework that intercepts selected LLM agent actions before execution and returns feedback for bounded revision. It compiles domain policies into executable state checks and structured questions scored by a prefill-only decision model, giving probability-based judgments without generation. Tested on eleven agents with tau^2-bench Airline and Telecom and BFCL, it gained consistently on Telecom and BFCL and was mixed on Airline.

LLM
JevActtau^2-benchBFCL+1

research, agents, evalsΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

Repairs for Whom? Evaluator-Executor Mismatch in Selecting Repairs for Failed LLM Agents

Repairs for Whom? studies single-step repairs of failed LLM agent trajectories and asks whether common evaluators (greedy replay, stronger models, oracles, log-reading judges) pick repairs that help the deployed agent. Using independent rollouts in ALFWorld and WebShop, greedy replay loses 0.06-0.13 in expected gain, and Qwen2.5-14B rollouts misselect repairs for Qwen2.5-7B. The authors recommend verifying repairs with the executor that will run them.

LLMQwen
ALFWorldWebShopQwen2.5-7B+2

research, agents, evalsΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

Data Scaling Laws in Stereo Matching: From In-domain Fitting to Cross-domain Generalization

This paper studies data scaling laws in stereo matching and releases XStereo, a realistic synthetic dataset of 200 thousand samples. In-domain training on five large datasets shows two regimes: a standard power law, then saturation, with a transition point roughly fixed for a given model. Cross-domain performance depends only weakly on source data scale, and distribution and coverage diversity reduce domain gaps more.

XStereoarXiv

research, training, multimodalΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Session-Bound Behavioral Watermarking for Autonomous LLM Agents

AgentAnchor is a session-keyed behavioral watermark for attributing LLM agent trajectory logs to an owner. It derives per-step keys from a secret key, a fresh public session ID and semantic observation states, and embeds parity evidence through a KL-bounded exponential tilt. The paper formalizes learned cross-session forgery, and a trusted verifier checks disputed logs using wrong-key calibration and abstention.

LLM
AgentAnchorlearned forgery

AI SecurityΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

Session-Bound Behavioral Watermarking for Autonomous LLM Agents

AgentAnchor is a session-keyed behavioral watermark that lets an agent owner prove ownership of a trajectory log. Each step key comes from a secret key, a fresh public session identifier and semantic states of recent observations. Parity evidence is embedded through a KL-bounded exponential tilt of action choices. A trusted verifier checks disputed logs without rerunning the agent, using wrong-key calibration and abstention. The paper also formulates a learned cross-session forgery threat.

LLM
AgentAnchorarXiv

research, agentsΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

CALM: Conflict-Aware Lifecycle Memory Governance for Long-Horizon Language Agents

CALM is a conflict-aware lifecycle memory governance framework for long-horizon language agents. It turns records into evidence-grounded memory cells, updates their validity and lifecycle states from support, conflict and dependency signals, and admits evidence at query time through training-free or learned gating based on temporal applicability. It beats baselines on LongMemEval-S and LoCoMo with Qwen and GPT backbones, and keeping superseded records helps earlier-state reasoning.

LLMQwen
CALMLongMemEval-SLoCoMo+1

agents, researchΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

From Leniency to Suspicion: How an Open Post-Training Recipe Changes Whom LLM Fact-Checkers Believe

This paper measures job-based doubt in LLM fact-checkers: judging a claim false more often when the poster has a lower-status job. It compares base and post-trained checkpoints of six model families on fact-checked claims with randomised poster profiles. Only the open TΓΌlu-3 recipe (OLMo-2 32B, TΓΌlu-3 70B) creates the effect, under one percentage point but reliable. In OLMo-2 32B the flip comes from one residual-stream direction and appears at supervised fine-tuning, confirmed on 400 new claims. None of seven commercial models doubts lower-status posters more.

LLMTransformer
OLMo-2 32BTΓΌlu-3TΓΌlu-3 70B+3

research, ai-safety, trainingΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

Benchmarking decision models against generative large language models on medical multiple-choice questions

This preprint benchmarks 13 decision models against 15 generative LLM configurations, including different reasoning settings, on 1,273 text-only four-option MedQA questions. Accuracy ran 67.71% to 89.08% for decision models and 78.32% to 96.86% for generative configurations. Decision models were cheaper and faster, but answers with probability of at least 0.90 still had error rates of 1.71% to 12.77%, and probability repeatability varied across three runs.

LLM
MedQAMercury DecideClef Omni+1

evals, researchΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

Does Chain-of-Thought Reliance Follow a Scaling Law?Larger Models Follow Their Steps More, Independent of Post-Training

This paper measures how much a model's final answer depends on its own written chain of thought, using a synthetic box-swap task with exact ground truth. It edits one step in the model's chain to a wrong but valid state and checks whether the answer follows. Across 25 open-weight models, reliance rises with size and saturates (Qwen3 from 16-18% at 0.6B to 97-100% at 14B). Reliance tracks capability (r = 0.99) and is unchanged by post-training.

Qwen3GemmaLlama+2
Gemma 3Llama 3arXiv

research, ai-safety, evalsΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

TCC-RAG: Temporal Causal Chain-Guided RAG for Temporal Knowledge Graph Question Answering

TCC-RAG is a retrieval-augmented generation method for temporal knowledge graph question answering (TKGQA). It turns the temporal knowledge graph into a multi-view causal cue graph, builds a query-specific temporal causal chain to guide retrieval, and applies a causal evidence filter to the results. The authors report gains of 10.72% and 8.40% on two TKGQA benchmarks and 62.97% on multi-step temporal reasoning.

RAGLLM
arXiv

research, llm-appsΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

FlatCake: A Flat KVCache Storage Architecture for LLM Serving

FlatCake is a KV cache storage architecture for LLM serving that treats host DRAM and NVMe SSD as peer media in one 64-bit address space, instead of a DRAM-over-SSD tier. Blocks are placed once, in session-contiguous, layer-major order, and streamed via GPUDirect Storage. On a Claude Code trace with DeepSeek-V4-Flash it holds a 94% hit rate (Mooncake: 64%) and cuts peak-load mean TTFT 1.6x.

GPUDirect StorageNVMe SSDLLM+3
FlatCakeMooncakeMooncake-GDS+3

inference, researchΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

Multi-Token Prediction Done Right

Soft Multi-Token Prediction (Soft-MTP) is a one-line change to multi-token prediction (MTP) pre-training. The authors show the MTP cross-entropy gradient splits exactly into a KL self-distillation term and a noisy residual, and a straight-through "KL gradient-recovery trick" keeps only the KL term. From 167M to 1.2B parameters it gives lower NTP perplexity, faster speculative decoding and higher zero-shot accuracy than standard MTP, with no added parameters or overhead.

LLMTransformer
DeepSeekMeta

research, trainingΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

Complementing Text Based Moderation with Multimodal Grounding: Detecting Fraudulent Inducement Behaviors on Short Video Platforms

The paper studies detection and temporal localization of fraudulent inducements (prompts to follow, join chat groups, click links) in internet finance short videos. It compares OCR+LLM, OCR+MLLM and a zero-shot MLLM, and builds a dataset of 2,419 videos (66.49 hours, 3,194 events, four categories). OCR+MLLM reaches mIoU 26.52 versus 14.49 for keyframe OCR+LLM, with 67.0 percent macro recall, using a recall-weighted F2 localization reward.

MLLMLLMOCR
arXiv

research, multimodal, trainingΒ· Added 30 Oct 2026, published 28 Oct 2026

huggingface.copaper🧠 AI

What Effort Level Should I Choose? On the Economics of Reasoning Effort in LLM Agents

This paper treats LLM reasoning effort as a credence good and measures the counterfactual effect of effort levels on proprietary and open-weight models across four benchmarks, including long-horizon agentic tasks. Higher effort often fails on tasks lower effort solved, and on easy tasks the top level costs up to 42x the lowest. Starting at the lowest effort and escalating only after a verified failure matches or beats fixed top effort, usually at lower cost for proprietary models.

LLM
Hugging Face

research, evals, agents, ai-policyΒ· Added 28 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Post-Training Large Language Models with LLMON

LLMON (LLM Object Notation) is a framework that separates instructions from data and requires explicit identifier-based execution. The authors post-train Granite-4.1 3B and 8B base models with SFT then RL on a 4.6B-token structured corpus covering general, RAG and tool-calling data, with distractor variants. Attack success rates on indirect prompt-injection benchmarks fall from 53-100% to 0.02-5.6%, and general capability is preserved. Attention-based metrics diagnose failures per transformer layer.

LLMONGranite 4.1LLM
prompt injectionindirect prompt injection

AI SecurityΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

Post-Training Large Language Models with LLMON

LLMON (LLM Object Notation) is a framework that separates executable instructions from passive data and requires explicit identifier-based execution. The paper post-trains Granite-4.1 3B and 8B base models on a 4.6B-token corpus of general, RAG and tool-calling data with distractor variants, using SFT then RL. Attack success rates on indirect prompt-injection benchmarks fall from 53-100% to 0.02-5.6%, with general capabilities preserved. It also adds attention-based per-layer diagnostics.

LLMRAGTransformer
LLMONGranite-4.1arXiv

training, researchΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

Improving the Dependency on Fine-Tuning Data in Transfer Learning for Speech Emotion Recognition

This paper proposes an fMLLR-based compensation mechanism that cuts the fine-tuning data needed in transfer learning for speech emotion recognition under train-test acoustic mismatch. An autoencoder reduces trainable parameters, and an affine transform in the encoder latent space models rotations and shifts. In a human-robot interaction task, mean CCC rose 16.8% with 12.9% of the training set and 14.4% with 50%.

fMLLRautoencoder
arXiv

research, multimodal, trainingΒ· Added 30 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

Statistical Detection of Positional Bias in LLM-Based Recommender Systems: Methodologies and Empirical Evidence

The paper proposes POB-ICM (contingency matrix with Chi-square independence testing) and POB-UNBP (a uniformity null model under permutation-based evaluation) to detect positional bias in top-1, single-turn LLM recommenders. On a RAG product-recommendation testbed with 2000 queries and 20 permutations each (40,000 instances), both methods reject positional independence in all evaluated models. Three metrics quantify the effect, and the bias persists across candidate-set size and temperature. Code is public.

LLMRAG
arXivPOB-ICMPOB-UNBP

research, evals, llm-appsΒ· Added 30 Oct 2026, published 27 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Structured Security Explanations for Learning-Based Vulnerability Detection

VulnLens is a framework for binary C/C++ function-level vulnerability detection. A label-blind LLM Explainer describes each function from seven fixed perspectives (data flow, memory access, object lifetime, arithmetic and type behavior, control flow, shared state, external-resource access). A supervised Detector fuses code and explanations by cross-attention. It reaches 75.5% accuracy and 77.2% F1 on a 526-function PrimeVul test set, and 66.4% accuracy on SecVulEval without retraining.

LLMCC+++2
VulnLensPrimeVulSecVulEval

AI Security, AppSecΒ· Added 30 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

Locating Sycophancy Across Training Stages in Open Language Models

Locating Sycophancy Across Training Stages in Open Language Models measures sycophancy in 13 open checkpoints from 5 lineages, from base model through supervised fine-tuning and preference optimization to release. It finds two behaviors with different origins: deference to a claim in the prompt exists in every base model, while capitulation under user objection is largely absent from base models and present in every post-trained checkpoint. Post-trained models often drop firmly held answers as readily as loosely held ones when the objection names an alternative.

LLM
arXiv

ai-safety, research, evalsΒ· Added 30 Oct 2026, published 27 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Tractable, Not Truncated: Colored-Noise TRNG Security via Fractional Brownian Motion

This ePrint paper models oscillator-based TRNG phase noise, both white and flicker, as fractional Brownian motion. It proves a quasi-renewal property that gives closed-form worst-case min-entropy and sampling requirements, and extends spectral and Allan-variance analysis so noise parameters come from a single timing trace. FPGA and ASIC experiments show flicker noise accounts for over 99% of uncertainty at a 0.99 min-entropy target, allowing a bitrate two to three orders of magnitude higher.

FPGAASIC

Hardware & RFΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness

Heads of Security (HoS) is a prompt injection defense that enforces instruction-data separation with learned per-head attention gates, redistributing attention between trusted and untrusted tokens. Evaluated on Llama-3.3-70B-Instruct and GPT-OSS-20B against SecAlign++ and ASIDE. The black-box RL-Hammer attack reaches 97% ASR on GPT-OSS-20B and 85% on SecAlign but 10% on HoS. The white-box Claudini attack needs 3 times more FLOPs on HoS. HoS keeps base-model utility in few-shot settings, where SecAlign and ASIDE degrade.

LlamaGPT-OSS-20BLLM
Heads of Securityprompt injectionSecAlign+++4

AI SecurityΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness

Heads of Security (HoS) is a prompt injection defense that trains a small set of per-head attention gates to shift attention between trusted and untrusted tokens, separating instructions from data. Tested on Llama-3.3-70B-Instruct and GPT-OSS-20B, the black-box RL-Hammer attack reaches 10% ASR on HoS versus 97% on base GPT-OSS-20B and 85% on SecAlign. HoS keeps base utility in few-shot settings, where SecAlign and ASIDE degrade.

TransformerLlamaLLM
Heads of SecuritySecAlign++SecAlign+5

research, trainingΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

Can LLMs Uncover Hidden Physical Laws through Free Exploration?

LongChang is an automated framework that builds simulated worlds with altered physical laws, such as heavier objects falling more slowly, to test whether LLMs can find the law by free exploration. Explorer LLMs manipulate objects and build tools without tasks or hints, while separate LLM agents generate scenes, review tool designs and grade reports. Across 12 LLMs, GPT-6 Astra reached a 16.7% discovery rate and the other 11 scored 0%.

LLM
LongChangGPT-6 AstraarXiv

evals, research, agentsΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

Scaling Laws for Tool-Use Agents via Controllable Environment Synthesis

SynthAPI is a pipeline that generates synthetic tool-use environments with explicit control over diversity of tools, tasks and underlying databases. Across 458,752 tasks and 849 trained models of four sizes, the authors fit a scaling law predicting downstream agent generalization. At larger data budgets, scaling tool and database diversity beats adding more tasks, and higher complexity helps more. Agents trained this way beat prior synthetic-data baselines on four benchmarks.

LLM
SynthAPI

research, training, agentsΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

Metacognitive Decoding: Efficient Inference for Diffusion Language Agents

Metacognitive Decoding is a lightweight plug-in controller for diffusion language model backbones. It learns when to finalize tokens and how far generation should extend, and is trained on agent trajectories to balance correctness against generation cost. Across five benchmarks it cuts inference FLOPs by 20.6% on average versus the most efficient baseline, with competitive task accuracy. The abstract names no specific benchmarks or backbones.

diffusion model
arXiv

research, agents, inferenceΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

Know, then Draw: A New Learning Paradigm for Visual Generation

Know, then Draw is a learning paradigm for visual generation that uses autoregressive pretraining to acquire semantic knowledge and diffusion post-training for high-fidelity rendering. Controlled comparisons find autoregression the stronger pretraining objective, and semantic quality matters more than AR-only generation quality. This motivates a purely semantic tokenizer trained with language supervision only. A 3B text-to-image model trained in 6,600 H100 GPU-hours scores 86 on GenEval and 87 on DPG-Bench.

diffusion modelTransformer
arXivGenEvalDPG-Bench+1

research, multimodal, trainingΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

Perceiving and Predicting Dynamic Sports: Spatiotemporal Intelligence in Vision Models for Egocentric Tennis Video

This paper presents an annotated egocentric tennis dataset (egocentric video synced with five allocentric views, global positions, contact times, stroke types) and evaluates image encoders, video encoders and vision-language models on seven prediction tasks. Best models reach 0.14 m player and 0.54 m ball localization error and 0.14 s contact-time error. Depth input helps 3D ball localization, and longer histories do not help forecasting. A conditional diffusion model generates whole-body tennis motion in real time.

vision-language modeldiffusion modelTransformer
arXiv

research, multimodal, evalsΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

VideoLVR: Latent Visual Reasoning over Grounded Video Evidence

VideoLVR is a method that lets video multimodal LLMs build latent visual evidence from local regions at relevant moments and reason over it interleaved with text tokens. A visual token prediction objective, defined over a vocabulary derived from the input video, supervises the latents. It extends to reinforcement learning with sampled visual tokens as actions and final-answer rewards, and improves fine-grained video benchmarks without much context growth.

vision-language modelLLM
VideoLVRarXiv

research, multimodal, trainingΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

EnvSched: Environment-Aware Scheduling for Rollout-Efficient Agent Reinforcement Learning

EnvSched is an online scheduler for agentic reinforcement learning that picks which environment-task pairs to roll out next. It builds a dual-relation graph over environments and tasks, propagates past rollout statistics to predict within-task reward variance, and adds environment quotas and a similarity penalty. On Qwen3-8B it scores 48.81 average on BFCL-v3, tau-Bench and ACEBench-Agent after 40 steps, above random selection at 120 steps.

Qwen3
BFCL-v3tau-BenchACEBench-Agent+1

training, agents, researchΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

As the Story Unfolds: Watching a Film and Identifying Characters as a Human Does

This paper defines a character naming task for films: given a name spoken in dialogue and its video context, the model must pick which visible character bears that name. It provides a dataset with annotations for character naming and first appearances, a video-and-dialogue model, and a comparison with proprietary multimodal LLMs. It also proposes a progressive framework that builds a character bank as the film plays, without cast lists or actor photographs.

multimodal large language model
arXiv

research, multimodalΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

Interpretable Meta-Policies for Neural Decision Making

NEXUS is a hierarchical reinforcement learning framework that pairs neural skills with symbolic meta-policies, so transparent reasoning sits at the level of high-level skills rather than atomic actions. It uses object-centric observations and LLM interaction to design reward functions and meta-policies. Agents learn disentangled skills, align better with goals in the game manual, resist reward hacking more, and cope better with game simplifications than deep RL. The paper also compares neural, symbolic and neuro-symbolic meta-policy architectures.

LLM
NEXUSarXiv

research, training, ai-safetyΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

CRISP: Co-designing Pruning and Scheduling for Efficient MoE Inference on Edge Servers

CRISP is a combination-aware framework that co-designs pruning and runtime scheduling for Mixture-of-Experts inference on memory-constrained edge platforms. It reorders neurons by importance so one stored expert supports several execution widths, gives hot, warm and cold expert combinations different widths, and overlaps expert loading with computation. On Mixtral-8x7B and DeepSeek-MoE-16B it raises throughput up to 2.1x at the same memory budget, with accuracy loss limited to 3.6%.

Mixture of Experts
Mixtral-8x7BDeepSeek-MoE-16BarXiv

inference, researchΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

FeatureArc: Benchmarking Coding Agents on Evolving Features

FeatureArc is a benchmark for coding agents on evolving features, built by a pipeline that mines repository histories into multi-stage tasks across four programming languages. It has 73 manually reviewed tasks of 2 to 10 stages, validated with fail-to-pass and pass-to-pass tests. Across 10 agents, pooled success drops from 62.7% at the first stage to 28.5% for the whole feature. Inherited defects appear in 72.9% of failed later stages.

LLM
FeatureArcTencentHunyuan+1

evals, coding-agents, researchΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

When Visual Evidence Is Insufficient: How Instructions, Post-Training, and Internal Activations Shape Refusal in Multimodal Language Models

This paper studies how multimodal LLMs refuse questions that an image cannot answer, using the MoHoBench benchmark on three MLLMs. It varies the meaning and placement of refusal instructions, compares supervised and preference-based post-training, and intervenes on a refusal-related activation direction. Instructions change refusal at the sample level in ways aggregate rates hide. Post-training raises refusal most but can mix refusal with attempted answers. Activation intervention gives smaller, transferable changes.

vision-language modelLLM
MoHoBencharXiv

ai-safety, multimodal, researchΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

Bayes-Adaptive MDPs for Rollout Allocation to Enhance GRPO Training

AdaRoll-GRPO is a method that allocates GRPO rollout budgets per question by difficulty instead of uniformly. It frames allocation as a sequential decision problem and learns an allocation policy with a Bayes-adaptive MDP, computed offline so training adds no online optimization cost. Experiments on several reasoning datasets and LLM architectures show gains over standard GRPO at the same total rollout budget.

GRPOLLM
AdaRoll-GRPOarXiv

training, researchΒ· Added 28 Oct 2026, published 27 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Radical isogenies on every model

Radical isogenies on every model is an IACR ePrint paper by Thomas Decru (October 2026). It gives radical isogeny steps of every odd degree N directly on short Weierstrass, Montgomery, twisted Edwards, Huff, Jacobi quartic, twisted Hessian, Legendre and Jacobi intersection curves, plus Kummer lines. In Tate normal form a step drops from 12.5N to 10N multiplications. Montgomery and twisted Edwards curves cost 10.5N+O(1) per step and 2N to push a point. All algorithms are inversion-free, with exact operation counts.

CSIDH
Thomas Decruradical isogeniesVΓ©lu's formulae+1

otherΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

When Is Additional Retrieval Worthwhile? A Cost-Aware Study of Evidence Gain and Answer Reliability in RAG

This paper studies a cost-aware, two-action RAG routing policy that chooses between dense retrieval plus reranking and a hybrid lexical-dense retriever, using a regularized linear model to predict per-question evidence gain. On 60 held-out QASPER articles (188 questions), it triggers hybrid retrieval on 24.5% of questions and matches always-hybrid Hit@10 (78.70%). Answers from 4-bit Qwen3-4B show no clear correctness or faithfulness gain, and the assessments are model-assisted.

RAGQwen3BM25
QASPER

research, llm-apps, evalsΒ· Added 28 Oct 2026, published 27 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Towards Quantum Sensing for Side-Channel Analysis

Preprint on using nitrogen-vacancy (NV) center quantum sensing for electromagnetic side-channel analysis of ICs. The authors build an NV-based RF spectrometer with 1.1 GHz real-time bandwidth and adjustable center frequency, which reads the spectrum in the time domain without Fourier transforms or frequency sweeps. They use it on RSA decryption emanations and for leakage detection on a software Number Theoretic Transform running on a Cortex-M4 microcontroller.

ARM Cortex-M4
Number Theoretic TransformRSAnitrogen-vacancy centers+1

Hardware & RFΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

LiveSearch: Questions as Executable Verifier Code for a Live Benchmark of Professional-Source Financial Search Agents

LiveSearch is a live benchmark for financial search agents that stores each question as executable verifier code: a typed program of calls to a professional financial data service plus a declarative extractor. Gold answers are recomputed daily with no human or LLM in the loop, so memorized answers go stale. Six tool-calling models score 70.9% to 76.7% under web search, and 70% of questions change gold value over three days.

LLM
LiveSearcharXiv

evals, agents, researchΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

OpenGray: a benchmark for evaluating the decisions of radiotherapy planning agents

OpenGray is a benchmark that adds tasks with known correct decisions to the OpenKBP-Opt head-and-neck dataset, including two overlap contradictions with provably incompatible dose goals and a feasible control. Four planning systems, from a rule-based script to a full LLM agent, were tested on 30 patients with Terra and Ministral 3 8B. Decision accuracy reached 95.4% and 92.1%, yet only 50% and 25% of overlap contradictions were escalated. SAGE logs of 39 radiosurgery runs showed an agent that lacked an action for stopping.

LLM
OpenGrayOpenKBP-OptSAGE+3

evals, agents, researchΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

Tessera: Structure-Completed Evidence Units for Web Retrieval-Augmented Generation

Tessera is a training-free evidence delivery layer for web retrieval-augmented generation. It rebuilds retrieved pages' HTML into fine-grained evidence units, each completed with page title, section path and table headers, then packs the relevant units into the reader context at the same token budget. Tracing evidence over full English Wikipedia shows chunking loses table and infobox content. Tessera adds 5 to 6 accuracy points on three QA benchmarks and carries over to agentic search.

RAGHTML
TesseraWikipedia

llm-apps, researchΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

Exploring the Limits of the Delta Learning Hypothesis: Single-Pair Generator Biases in Direct Preference Optimization

This paper tests the delta-learning hypothesis for Direct Preference Optimization (DPO), where the larger model's response in a single model pair is treated as preferred. It shows, in theory and experiments, that fixed pairs add generator-specific biases that predict the preference label regardless of quality. DPO on single-pair data underperforms multi-model data, consistent with reward hacking, and adding more generators partly fixes it without an external judge.

LLM
arXiv

training, researchΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

p-DCIM: A 28nm Probabilistic SRAM DCIM based Ising Machine for Near-Memory Context Selection in LLM-RAG Pipeline

p-DCIM is a 28 nm SRAM digital compute-in-memory macro (0.16 mm2, 0.41 mW) that works as an Ising machine for RAG evidence selection. Selection is cast as a QUBO problem, and the same MAC datapath computes embedding similarities and annealing steps. Replacing LLM reranking with it gives a selection-energy estimate over six orders of magnitude lower and cuts total energy per query by 67%, with comparable token-level F1 on the evaluated examples.

RAGLLMSRAM+2
arXiv

research, inference, llm-appsΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

DCKV: Learned Transform Coding of the Prompt KV Cache in Hybrid Language Models

DCKV is a differentiable codec for the prompt KV cache of hybrid language models, which keep a KV cache only in their few full-attention layers. Transform, quantizer and entropy models (conditioned on prompt tokens and already decoded neighbouring positions) are trained end to end against a frozen model. On Qwen3.5-2B it stores a token in over 55 times fewer bytes than bf16 with at most 1.8 points lost on three long-context benchmarks, and over 100 times fewer with at most 3.6 points lost.

Qwen3.5TransformerLLM
DCKVarXiv

research, inferenceΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

AxisQ: Depth-Adaptive Channel--Frequency Quantization for Camouflaged Object Detection

AxisQ is a post-training quantization framework for camouflaged object detection (COD) that allocates activation bits by feature depth. It uses the channel domain for shallow features and the local-frequency domain for deep features, under a fixed per-layer average bit budget. It adds a boundary-aware Hessian approximation for reconstruction. On CAMO at W2A2, weighted F-measure improves 12.7% for CFRN and 33.3% for CamoFormer-P over the strongest baselines.

CNNTransformer
AxisQCFRNCamoFormer-P+1

research, inference, multimodalΒ· Added 28 Oct 2026, published 27 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Alg\{Ossa\}: Decentralized Secure Aggregation with Rotating Committees and Eventual Delivery

AlgOssa is a decentralized secure aggregation protocol built on Ossa, a generic committee-aided, single-server construction for one-shot clients (following OPA and Willow, CRYPTO 2025). Ossa realizes secure aggregation with non-selective abort against a malicious server. AlgOssa adds Algorand-style sortition to rotate leaders and committees, bounds the chance of an honest server, and gives eventual delivery. Classical and post-quantum routes are evaluated.

Algorand
OssaAlgOssaOPA+2

otherΒ· Added 28 Oct 2026, published 27 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Unshuffling Fisher-Yates: Practical Recovery of Length-128 Permutations and Application to ML-DSA

Paper (IACR ePrint 2026/2658) presenting a single-trace side-channel attack on a software Fisher-Yates shuffle of length 128, the butterfly count in one ML-DSA NTT layer. It removes rejection-sampling timing variation, extracts Hamming weight and identity leakage, and enumerates likely permutations with constraint programming. On a shuffled ML-DSA-44 NTT it recovers secret polynomial s1, fully or up to a few coefficients.

ML-DSA
Fisher-Yates shuffleFIPS 204

Hardware & RFΒ· Added 28 Oct 2026, published 27 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Poly2MsgLeaks: Certified Key Recovery from Polynomial-to-Message Leakage

Poly2MsgLeaks is a profiled chosen-ciphertext power-analysis attack on the SMAUG-T (TiMER parameter set) post-quantum KEM that recovers the full 512-coefficient PKE secret from six traces on an STM32F415. It recovers 999 of 1,000 unseen secrets and proves an incorrect key is released with probability at most 2^-2095.6. Single-write message assembly and a two-share masked P2M resisted the evaluated six-execution attack.

SMAUG-TSTM32F415
Poly2MsgLeakschosen-ciphertext attackpolynomial-to-message leakage+1

Hardware & RFΒ· Added 28 Oct 2026, published 27 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Falcon Key Recovery from Joint Sampler Leakages

Falcon Key Recovery from Joint Sampler Leakages is an ePrint paper presenting a power side-channel attack on Falcon and FN-DSA that fuses three SamplerZ leakages (exponent class of the center, sign bit, proposal magnitude). It turns them into slab and halfspace constraints solved by softplus interval regression, with no LLL or BKZ. On PQClean Falcon-512 (ARM Cortex-M4) it recovered all 50 keys with at most 34 signatures; on c-fn-dsa it recovered 38 of 50 keys within 200 signatures.

FalconFN-DSAARM Cortex-M4+1
SamplerZc-fn-dsasoftplus interval regression+1

Hardware & RFΒ· Added 28 Oct 2026, published 27 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

OblivDGL: Oblivious Deep Graph Learning Made Practical

OblivDGL is a secure computation framework for GNN training and inference, modelled on Deep Graph Library. It uses an oblivious message-passing paradigm and an oblivious graph representation built on function secret sharing (FSS). It leaks only total node and edge counts. On four benchmark graph datasets it cuts training communication up to 1024x and runtime up to 14.3x against prior secure GNN systems.

Deep Graph LibraryGraph Neural Network
NDSS 2027

AI SecurityΒ· Added 28 Oct 2026, published 27 Oct 2026

eprint.iacr.orgpaper🧠 AI

OblivDGL: Oblivious Deep Graph Learning Made Practical

OblivDGL is a framework for secure GNN training and inference in machine-learning-as-a-service settings, modelled on Deep Graph Library. It uses an oblivious message passing paradigm and a new oblivious graph representation built on function secret sharing, revealing only the total node and edge counts. On four benchmark graphs it cuts training communication up to 1024x with up to 14.3x speedup, and inference communication up to 754x with 4.19x speedup.

Deep Graph Librarygraph neural networkfunction secret sharing
OblivDGLNDSS

research, training, inferenceΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Measuring Users' Security and Privacy Concerns About Third-Party Community Bots on Discord

Measurement study of 23,102 third-party Discord bots and 183,142 user reviews (2021-2026, 49 languages). A fine-tuned DeBERTa classifier plus manual validation yields 8,832 security and privacy reviews, mapped to a 31-theme taxonomy; Data Sharing (30.5%) and Data Collection (16.2%) dominate. Permission count and admin status correlate only weakly with user concerns. The authors build BotLens, an MCP-server auditing framework with six tools.

DiscordModel Context ProtocolLLM
BotLensDeBERTa

other, AI SecurityΒ· Added 28 Oct 2026, published 27 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

When Algebraic Structure Meets Too Many Hints

"When Algebraic Structure Meets Too Many Hints" is an ePrint paper (2026/2654) arguing that DDGR hint classes and too-many-hints thresholds are not standalone side-channel security metrics. In synthetic Kyber-512 experiments, NTT-domain residues recover the full secret with about half the hints the uniform mod-q bound predicts. Finite-precision FFT samples need 25% to 55% of the budget for uniform perfect hints. No new attack optimizations are proposed.

Kyber-512ML-KEM
DDGRtoo-many-hintsMLWE with Hints+4

Hardware & RFΒ· Published and added 27 Oct 2026

arxiv.orgpaper🧠 AI

Folding Attention Biases into Keys Makes Compacted KV Caches Run on Standard Kernels

The paper folds the per-key logit bias of Attention Matching (AM) KV cache compaction into the keys along one closed-form direction per head, fitted on context queries. The result is a plain cache that FlashAttention and vLLM paged caches can use, with output error bounded by how far each query's projection on that direction is from 1. Unmodified vLLM serves folded caches through a KV connector. On QuALITY and LongHealth the fold is within noise of AM in 13 of 14 settings. Under AM's published per-head budgets it is within noise in 9 of 10.

vLLMFlashAttentionHugging Face+3
Attention MatchingQuALITYLongHealth+2

research, inferenceΒ· Added 28 Oct 2026, published 27 Oct 2026

huggingface.copaper🧠 AI

Trial by Trace: Benchmarking AI Agent Harnesses for Reliability and Failure Attribution

TraceTrial-Bench is a benchmark that scores agent task performance and agent harness reliability separately. It has 95 mechanism-oriented tasks across seven components: context, execution, governance, lifecycle, observability, tools and verification. Across 4 harnesses, 9 models and 3,420 runs, macro-averaged harness scores range from 59.8% to 72.0%, and 31.1% of runs succeed despite failing at least one harness criterion.

LLMHugging Face
TraceTrial-Bench

evals, agents, researchΒ· Added 27 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

What Victims Take Away: Attack Reuse and Defense Revision after Prompt-Injection Attacks

What Victims Take Away is an October 2026 arXiv paper analysing 563,349 Tensor Trust attack records to see how players reuse prompt injections they received. Within a week, targets reused 10.0% of attacks that broke their defense, versus 0.03% of matched attacks. Breaches were followed by defense changes that cut same-family attack success by 24.5 points. Received texts made up 23.2% of successful hijacks. The authors propose that AI security tools describe techniques without disclosing full attack text.

Tensor TrustLLM
prompt injectionpayoff-biased social learningvictim-offender overlap

AI SecurityΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

AK_QMUL at ArGuard Shared Tasks: A Single Fine-Tuned JAIS for Arabic Harmful-Prompt Detection

AK_QMUL's system for the ArGuard-2026 shared tasks fine-tunes JAIS-6.7B with 4-bit QLoRA and a linear head on the last-token representation. For binary safe/unsafe detection (B1) it uses a four-way head over dialect register and AraSafe MSA augmentation, reaching macro-F1 0.984. For seven-way harm domain (B2) it averages five seeds, reaching 0.790. Both ranked first. Bully is the weakest class.

JAIS-6.7BQLoRALLM
JAISArGuardAraSafe+2

research, ai-safety, trainingΒ· Added 28 Oct 2026, published 26 Oct 2026

arxiv.orgpaper🧠 AI

Your Wish Is My Commit: Over-Compliant Refactoring in AI Coding Agents

Your Wish Is My Commit is a controlled study of over-compliant refactoring in Codex and Claude Code, run across five models, 50 algorithmic tasks and 10 object-oriented tasks. Over 3,000 turns of repeated "refactor further" prompts, no model stopped on its own: each rewrote up to 31x the original codebase before first stopping and resumed edits after declaring the task complete. The paper defines six behavioral signals for detecting over-compliance.

CodexClaude CodeLLM
arXiv

coding-agents, research, evalsΒ· Added 28 Oct 2026, published 26 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Analyzing Compiler-induced Constant-time Violations with Compiler at Scale

CTGREP is a compiler-based framework that applies differential analysis across the whole Clang/LLVM compilation chain to find where, how and under which configurations compiler optimizations break constant-time cryptographic code. Applied to seven libraries, three Clang versions, six targets and thousands of configurations, it led to 48 cases fixed with developers. It also identified seven new problematic LLVM passes and bypassed existing compiler-flag mitigations.

LLVMClang
constant-time violationstiming side-channeldifferential analysis+1

Hardware & RF, AppSecΒ· Added 27 Oct 2026, published 26 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol

Log-To-Leak is a prompt-injection attack on tool-using LLM agents that abuses Model Context Protocol tool metadata to trigger an attacker-controlled logging call after the last legitimate call, leaking the user query, server name, server response and agent response. Evaluated on five MCP servers and four agents, it reaches 62.64-100% attack success with 76.55-95.64% logging accuracy. Three defenses leave over 55% residual ASR on GitHub MCP with GPT-4o.

Model Context ProtocolGitHubGPT-4o+1
Log-To-Leaktool poisoningprompt injection

AI SecurityΒ· Added 28 Oct 2026, published 26 Oct 2026

arxiv.orgpaper🧠 AI

Reva: Real-Time Vulnerability Detection through Contextual Probing of Large Language Models

REVA (REal-time Vulnerability Analysis) is a vulnerability detector that puts a module threat model, lightweight static analysis findings and call-graph information into one LLM forward pass. A trained probe reads the model's internal representations of the new function. On PrimeVul's held-out test set, REVA on GLM-5.3-Flash reaches 60.0% accuracy in about one second per function, matching the agentic VulTriage (59.2%) at over 250 times the speed and under a tenth of the cost. The probe is 14% to 17% more accurate than the LLM's own verdict.

LLMstatic analysis
REVAVulTriagePrimeVul+2

research, coding-agentsΒ· Added 28 Oct 2026, published 26 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Reva: Real-Time Vulnerability Detection through Contextual Probing of Large Language Models

REVA (REal-time Vulnerability Analysis) is an LLM-based vulnerability detector that screens each new function in one forward pass. It feeds the model a pre-computed module threat model, lightweight static analysis findings and call-graph data, then reads the model's internal representations with a trained probe. On PrimeVul's held-out test set with GLM-5.3-Flash it reaches 60.0% accuracy in about one second per function, matching the agentic VulTriage (59.2%) while over 250 times faster.

LLMGLM
REVAVulTriagePrimeVul

AI Security, AppSecΒ· Added 28 Oct 2026, published 26 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

LINE-Break: Cryptanalysis and Reverse Engineering of Letter Sealing

LINE-Break is a security analysis of Letter Sealing v2, the custom end-to-end encryption protocol in the LINE messenger. A TLS man-in-the-middle attacker or malicious server can replay, reorder and block messages undetected, and colluding users can forge message authorship in one-to-one and group chats. Stickers and URL previews leak plaintext. The attacks were verified on the real iOS app and an independent implementation.

LINEiOS
Letter SealingLetter Sealing v2Diego F. Aranha+1

Mobile Security, Offensive SecurityΒ· Published and added 26 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Cheap AI-Assisted Reverse Engineering and What It Will Do

"Cheap AI-Assisted Reverse Engineering and What It Will Do" is an October 2026 arXiv paper (Computers and Society) arguing that generative AI strains the law of reverse engineering. AI systems can identify hardware components, extract firmware, decompile object code and clone apps, which removes the cost barrier that laws rely on. The authors map these practices onto trade secret, copyright, anti-circumvention, computer misuse and contract law, and sketch possible legal responses with their trade-offs.

Malware & RE, GRC, AI SecurityΒ· Added 28 Oct 2026, published 26 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Revisiting ZMAC+: Birthday-Bound Attacks and a Beyond-Birthday-Bound Repair

ZMAC+ is a tweakable-block-cipher MAC (List and Nandi, ToSC 2017) with claimed beyond-birthday-bound security. This ePrint paper (2026/2647) shows a tag-swap attack: for two-block tags, a distinguisher and a fresh-message forgery with constant success probability using O(2^{n/2}) queries in the ideal-TBC model. It also corrects a counting error in the published Lemma 4 and proposes a repaired variant with an adaptive PRF bound of order q^2/2^{n+min(n,t)}.

ZMAC+
DoveMACZHashZAE+4

otherΒ· Published and added 26 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Then there is prompt injection, a malicious email, ...: The Wild Wide West of OpenClaw Agentic System Security

An empirical study of security concerns in the OpenClaw AI personal assistant framework, using 25K+ posts from 13 subreddits (162 security-relevant) and 358 security-tagged GitHub issues (180 retained). It maps 521 CWE instances across 59 weakness types, concentrated in access control, sensitive-data exposure, injection and unsafe execution. It extracts 543 practitioner mitigations into seven strategies and reconstructs a sensitive-data exposure path with dummy secrets.

OpenClawGitHubLLM
prompt injectionCWEtrust boundaries+1

AI SecurityΒ· Added 28 Oct 2026, published 26 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Non-profiled Single-Trace ML-DSA Secret Key Recovery by Horizontal Distribution Analysis

Non-profiled single-trace side-channel attack on ML-DSA-65 (Dilithium) running on ARM Cortex-M4, by Linus Backlund and Elena Dubrova (KTH). It compares observed sample distributions with expected Hamming weight leakage using a Gaussian mixture model, and stacks partitioned trace segments for multiple observations. Information-set decoding corrects misclassifications; with a 2^70 enumeration budget, the full secret key is recovered from one trace in 99% of attacks, using secret key unpacking as the attack point.

ML-DSAARM Cortex-M4
Hamming weight leakagehorizontal attacknon-profiled attack+4

Hardware & RFΒ· Published and added 26 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Cryptanalysis and Repair of "Decentralized Multi-authority ABE for NC$^1$ from BDH"

Cryptology ePrint 2026/2642 presents a plaintext-recovery attack on the DBDH and CBDH variants of the Datta, Komargodski and Waters multi-authority ABE for NC1 (Journal of Cryptology, 2023). It needs one corrupt authority and two users, and succeeds with probability one in the static model. The flaw is an invalid extension of the Rouselakis-Waters LSSS matrix-normalization lemma. The paper also attacks two Datta-Pal (PKC 2023) attribute-based inner-product schemes and proves repaired versions secure in the random oracle model.

Datta-Komargodski-Waters multi-authority ABEDatta-Pal attribute-based inner-product functional encryptionRouselakis-Waters LSSS matrix-normalization lemma+3

otherΒ· Published and added 26 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

A Memory-efficient Implementation of Wiedemann XL

A Memory-efficient Implementation of Wiedemann XL is an ePrint paper (2026/2641) giving the first efficient on-the-fly implementation of XL with block Wiedemann for the multivariate quadratic problem. It builds on the CCNY SSE implementation, removes column-index tables, and computes column indices with O(n^2) instead of O(n^3) look-ups. It runs in comparable BW1 time with up to five times less memory, and an AVX2 port covers F256, the main field of UOV.

MQOMSNOVAMAYO+7

otherΒ· Published and added 26 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Subexponential Algorithms for LWE via Rejection Sampling on Superlattices

Subexponential Algorithms for LWE via Rejection Sampling on Superlattices is an ePrint paper by Ligeng Fan, Changpeng Shao, Hongbo Li and Dingkang Wang. It extends the Ducas, Engelberts and Loyer superlattice framework to give a provable classical search-LWE algorithm for prime q in [n^2, 2n^2], using m=4n samples and time and space exp(O(n/ln ln n)). A second variant runs in 2^((1/2+o(1))n/ln R) for general parameters. It resolves a gap left by Kirchner and Fouque.

Ducas, Engelberts and LoyerKirchner and FouqueBKW algorithm+1

otherΒ· Published and added 26 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Scope-Gap Injection: Exploiting Evaluator Channel Blind Spots in the OpenClaw Agent Security Competition

Scope-Gap Injection (SGI) is an indirect prompt injection method for multi-stage LLM-agent safety pipelines, tested in the IJCAI 2026 OpenClaw Agent Security Attack Competition. The visible task and skill stay benign while target identifiers, bypass parameters and authorization steps sit in an attachment written as a business worklist, which the S2 LLM judge appears not to inspect. SGI bypassed all three stages (static scan, LLM judge, live audit) for 5 of 19 targets, best F = 0.385. Attachment placement had 78% S2 acceptance versus 23% in-skill. The paper closes with defenses that align evaluator scope with agent channels.

OpenClawLLM
Scope-Gap Injectionindirect prompt injectionIJCAI 2026 OpenClaw Agent Security Attack Competition

AI SecurityΒ· Added 27 Oct 2026, published 26 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Private Information Retrieval with Accountability at Erasure-Optimal Server Redundancy

SynTrace is a single-round compiler that adds accountability to linear private information retrieval (PIR). The client mixes the retrieval query with m audit queries, so audit syndromes identify up to d deviating servers among t colluding ones before reconstruction. The paper proves perfect query privacy and zero false identification within the threshold. For Shamir-based PIR it needs k=t+d+1 servers. For a 32 KiB record from a 1 GiB database it uses 2.25 MiB, against 8.96 MiB for the Eriguchi, Kurosawa and Nuida (TCC 2022) homomorphic-MAC construction.

SynTraceEriguchi-Kurosawa-Nuida homomorphic MACTCC 2022

otherΒ· Published and added 26 Oct 2026

deploymentsafety.openai.compaperπŸ›‘οΈ Security

Addendum to GPT-6 Astra System Card: GPT-6.1 Terra

Addendum to the GPT-6 Astra system card for OpenAI's GPT-6.1 Terra, rated Critical in cybersecurity and High in biological and chemical capability under the Preparedness Framework. It reports multiturn jailbreak and prompt-injection results, alignment tests (auto-review circumvention, ExploitGym honeypot, monitor evasion), and cyber scores: 97.10% ExploitBench, 24.5% on the internal recent-vulnerability port, 5 of 22 Sandbox Bench targets.

GPT-6.1 TerraGPT-6 AstraOpenAI+1
Preparedness FrameworkExploitGymExploitBench+11

AI SecurityΒ· Published and added 26 Oct 2026

arxiv.orgpaper🧠 AI

SentryBench: A Cost-Sensitive Benchmark for Adversarial Robustness of Tool-Using LLM Agents in Public-Safety Deployments

SentryBench is a benchmark for tool-using LLM agents in public-safety deployments. It scores attack success, over-refusal (missing a real emergency) and over-reaction (unwarranted action) on a cost-sensitive frontier, using real emergency-call transcripts, disaster messages and injection payloads. Across 840 episodes on three frontier models and three defenses, refuse-more caution pushed over-refusal to 100 percent on two models, while a trust-gating wrapper gave the lowest harm.

LLM
SentryBencharXiv

evals, ai-safety, agentsΒ· Added 27 Oct 2026, published 25 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

SentryBench: A Cost-Sensitive Benchmark for Adversarial Robustness of Tool-Using LLM Agents in Public-Safety Deployments

SentryBench is a benchmark for tool-using LLM agents in public-safety settings (public alerts, responder dispatch, citizen-record queries). It scores attack success, over-refusal and over-reaction on a cost-sensitive frontier, using real emergency-call transcripts and real injection/jailbreak payloads. Across 840 episodes on three frontier models and three defenses, refuse-more caution raised over-refusal to 100 percent on two models, while a trust-gating wrapper gave the lowest harm on every model.

LLM
SentryBenchover-refusalover-reaction+1

AI SecurityΒ· Added 27 Oct 2026, published 25 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Decision Attacks on Known-Covariance Ring-LWE via Public Gram Determinants

Anis Bkakria's ePrint 2026/2638 gives polynomial-time decision attacks on Known-Covariance Ring-LWE (KCov-RLWE), the assumption Micciancio and Suhl introduced for simulation-secure threshold encryption. The public sample and covariance hint form a bordered Gram matrix whose determinant leaks a residual that differs between real and uniform samples. The attacks cover broad prime-modulus families at ring rank one and transfer to composite moduli with an odd prime divisor. Power-of-two moduli are not covered, and the paper does not break the full threshold-encryption scheme.

Ring-LWE
Known-Covariance Ring-LWEMicciancio and SuhlGram determinant+2

otherΒ· Added 26 Oct 2026, published 25 Oct 2026

unicode.orgpaperπŸ›‘οΈ Security

UTS #39: Unicode Security Mechanisms

UTS #39 (Unicode Security Mechanisms) is the Unicode Consortium's technical standard for detecting identifier spoofing. It defines the General, IDN and Email security profiles for identifiers, confusable detection through skeleton and bidiSkeleton mappings, and mixed-script detection with resolved script sets and Restriction Levels. It also covers limited contexts for ZWJ/ZWNJ and the confusables and identifier data files. The fetched text is truncated, so later sections are not covered.

Unicode
homograph attackconfusableswhole-script confusables+7

AppSec, LearningΒ· Added 26 Oct 2026, published 25 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

SymLift: Neural Semantic Lifting for Compile-Free Vulnerability Detection in Context-Incomplete Code Fragments

SymLift is a compile-free vulnerability detection framework for context-incomplete code fragments. A fine-tuned LLM lifts control-flow, data-flow, memory and resource relations into a constrained LLVM-like IR. A parser turns the IR into facts, and Datalog rules derive findings with derivation traces. On Juliet function-level fragments Clang compilation success falls to 12.00%, while SymLift's completion rate drops only 1.17 points. SymLift-Qwen-7B reaches Target-F1 94.41% on FormAI and 91.66% micro-F1 on MegaVul.

LLMQwenLLVM+2
SymLiftFormAIJuliet+2

AppSec, AI SecurityΒ· Added 28 Oct 2026, published 25 Oct 2026

arxiv.orgpaper🧠 AI

SymLift: Neural Semantic Lifting for Compile-Free Vulnerability Detection in Context-Incomplete Code Fragments

SymLift is a compile-free vulnerability detection framework for code fragments that lack project context. A fine-tuned LLM reconstructs control-flow, data-flow, memory and resource relations as a constrained LLVM-like IR, and a deterministic parser turns it into facts for Datalog rules that give findings with derivation traces. SymLift-Qwen-7B reaches 94.41% Target-F1 on FormAI and 91.66% micro-averaged Target-F1 on MegaVul.

LLMQwenDatalog+3
SymLiftSymLift-Qwen-7BFormAI+2

research, trainingΒ· Added 28 Oct 2026, published 25 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Maximum-Likelihood Decoding of Gabidulin Codes Is NP-Hard Even in Dimension One

Philippe Gaborit proves that maximum-likelihood decoding of Gabidulin codes is NP-hard even for dimension one: deciding rank distance at most n-2 from the code {Ξ»g} is NP-complete. The reduction is deterministic, so Rank Syndrome Decoding and Rank Minimum Distance for F_{q^m}-linear codes are NP-complete under deterministic reductions, where the earlier reduction was randomized. It goes through a new pivot problem, Twisted Square Membership.

Gabidulin codes
Philippe GaboritGuruswami-Vardy theoremTwisted Square Membership+2

otherΒ· Added 26 Oct 2026, published 25 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Revisiting AES Key Wrap: Forgery Bounds, Structural Observations, and Recommendations for the Revision of NIST SP 800-38F

Revisiting AES Key Wrap is an ePrint paper (2026/2636) by John Preuß Mattsson, expanded from technical comments to NIST on the SP 800-38F revision. It shows the stated forgery probabilities ignore adaptive attacks and gives corrected bounds for KW, KWP and TKW. It also shows KW lacks beyond-birthday-bound security, since a forgery leaks a plaintext prefix and an encryption-only distinguisher exists.

AES Key WrapAES
NISTNIST SP 800-38FKW+4

other, GRCΒ· Added 26 Oct 2026, published 25 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

A Kelsey–Kohno Attack Variant against SHA-2 Message Digests in HSS/LMS and XMSS

Falko Strenzke's ePrint 2026/2635 presents a multi-target second-preimage attack on message hashing in HSS/LMS and XMSS with SHA-256 and SHA-256/192. It herds chaining states from many collected signatures into one state, defeating the key and leaf-index prefix. With 2^64 signatures, SHA-256 cost falls from 2^256 to about 2^166 (2^156 at maximal message length). SHAKE256 parameter sets are unaffected.

HSS/LMSXMSSSHA-256+2
Kelsey–Kohno herding attackKelsey–Schneier expandable messagemulti-target second-preimage attack+2

otherΒ· Added 26 Oct 2026, published 25 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

The Policies of Programming Language Ecosystems: A "Qualitative" Analysis

The Policies of Programming Language Ecosystems is an October 2026 arXiv paper (cs.SE) that compares the policies of eight programming language ecosystems, including CRAN for R, across 38 policy categories. Three authors coded the policies with moderate agreement. Malware, intellectual property and content removal are covered everywhere, while package size limits, metric manipulation, typosquatting and binary uploads diverge.

CRAN
typosquatting

Supply Chain, GRCΒ· Added 28 Oct 2026, published 25 Oct 2026

arxiv.orgpaper🧠 AI

Explaining Navigation Decisions: Stage-Aware Visual Attribution for Vision-Language Navigation

A stage-aware visual attribution framework for Vision-Language Navigation (VLN) that explains a robot's action choices. It identifies "instruction-stage insensitivity", where existing explainers give similar outputs across navigation stages. The method builds action-conditioned temporal instruction-visual attributions, aggregates relevant historical evidence by stage, and applies an instruction-guided spatial filter. It improves attribution quality across several VLN policies and benchmarks, helps diagnose failure cases, and was tested on a Unitree G1 robot.

vision-language model
Unitree G1

research, multimodalΒ· Added 27 Oct 2026, published 25 Oct 2026

arxiv.orgpaper🧠 AI

The Patient Is Always Right? Evaluating Sycophancy in Medical Diagnosis with Graded Patient Beliefs

This paper evaluates sycophancy in medical diagnosis across nine AI models. Each model is shown clinical evidence plus a patient's belief in a specific but incorrect condition, with the belief's closeness to the evidence varied. Models adopted the belief 23.2% of the time on average, even for fictional conditions, and 43.0% under a Rare Disease Claimer persona. Medical fine-tuning and larger scale reduced susceptibility.

LLM
arXiv

ai-safety, evals, researchΒ· Added 27 Oct 2026, published 25 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Reversible Pseudonymisation of Documents Sent to External LLMs: an Open Bilingual Benchmark and an Engine

Open bilingual (Russian and UK English) benchmark of five open pseudonymisation tools and a regex baseline, plus a new engine built on the two strongest tools. On a held-out set of 1,000 synthetic documents per language, the best existing tools leave a whole personal value visible in 61% (Russian) and 58% (UK) of documents. The engine does so in 0.3% and 0.2%. Russian name restoration reaches only 94.6%, below the 99% threshold. Real documents were not tested.

LLMpii-guard

AI SecurityΒ· Added 27 Oct 2026, published 25 Oct 2026

arxiv.orgpaper🧠 AI

Reversible Pseudonymisation of Documents Sent to External LLMs: an Open Bilingual Benchmark and an Engine

This paper presents an open benchmark of five existing pseudonymisation tools and a regex baseline on Russian and UK English documents, plus an open engine built on the two strongest tools. On a held-out set of 1,000 synthetic documents per language, the best existing tools leave a whole value visible in 58 to 61% of documents. The engine does so in 0.2 to 0.3%. Russian name restoration reaches only 94.6%, below the 99% threshold. Real documents were not tested.

LLMpii-guard
Vladimir BeskorovainyiarXiv

evals, llm-apps, researchΒ· Added 27 Oct 2026, published 25 Oct 2026

arxiv.orgpaper🧠 AI

Detecting and Understanding Ambiguity in Visualizations with Role-Playing Vision Language Model Interpretations

This paper presents a pipeline that uses persona-conditioned vision language models to surface interpretive ambiguity in visualizations. Topic-relevant personas elicit candidate takeaways, and a Target-Pattern-Scope framework lets LLM judges label statement pairs as Compatible, Disjoint or Opposing, which are summarized in an ambiguity profile. The authors benchmark VLMs on chart comprehension per chart type, check labeling against human annotations, and run case studies on public visualizations and a redesign.

vision-language modelLLM
arXiv

research, multimodal, evalsΒ· Added 27 Oct 2026, published 25 Oct 2026

arxiv.orgpaper🧠 AI

InteractiveWorld: A Verifiable Human-Centric Environment for Building Better Interactive MLLM Assistants

InteractiveWorld is an environment for closed-loop interaction between an AI assistant and a simulated human agent who sees the scene, follows instructions and acts independently. InteractiveBench, built on it, has 120 multi-turn tasks in six categories scored by verifiable, state-based rewards. Across 12 frontier MLLMs, the best model, Claude Fable 5.1, reaches at most 20% on long-horizon Guidance and 25% on Planning tasks.

multimodal large language model
InteractiveWorldInteractiveBenchClaude Fable 5.1+1

evals, multimodal, researchΒ· Added 27 Oct 2026, published 25 Oct 2026

arxiv.orgpaper🧠 AI

Continual Learning Exam: Benchmarking Long-Horizon RSI and Experiential Learning in LLM Agents

Continual Learning Exam (CLE) is a benchmark of 120 human-authored tasks, each a five-level ladder (600 levels) across 89 professional roles and 12 occupational domains, built by 50+ domain experts. Agents must pass a level to unlock the next, and an evaluation agent scores submissions against human rubrics. Across 17 harness-model configurations, feedback plus one revision adds a median 5.3 points; the best system clears 47.7% of levels and finishes all five levels in 23.3% of tasks.

LLM
Continual Learning ExamarXiv

evals, agents, researchΒ· Added 27 Oct 2026, published 25 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

On the Inapplicability of Residue-Confined Error Attacks to CRT-FHE with Non-Degenerate Error Distributions

Anil Kumar Pradhan's October 2026 ePrint rebuts the Olejnik and Naskrecki (2026) key-recovery and plaintext-recovery attack on the Pradhan CRT-RLWE fully homomorphic encryption scheme. It argues the attack works only because the chosen error distribution lies in the kernel of the CRT encoding, which makes the effective error zero. It also argues that the intended centered-binomial errors make that event negligible at the reported parameters. This is the author's own response, not independent verification.

CRT-FHERLWE
Olejnik and NaskreckiAnil Kumar PradhanKey Recovery from Residue-Confined Errors in the Pradhan CRT-RLWE Construction+1

otherΒ· Added 26 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

HerHealthGPT: An Evidence-Grounded Conversational AI System for Women's Reproductive Health Copy title

HerHealthGPT is a conversational AI system for women's reproductive health that combines retrieval-augmented generation, context-aware clarification and source validation in a web interface. Evidence retrieval raises concern-category accuracy from 54.1% to 59.3% over fine-tuning alone on 540 messages from 90 cases. The clarification router reaches 85.6% recall and 86.2% specificity. In a 30-adult study, 83.3% preferred the retrieval-enabled version. The authors say clinical validation is still needed.

RAGLLM
HerHealthGPTarXiv

research, llm-appsΒ· Added 27 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

DRILS: Dependency-based Requirement Change Impact Analysis Using LLMs

DRILS is an LLM-based agentic framework for requirements change impact analysis. It uses multiple agents to generate candidate impact sets, with an LLM-as-a-judge promoting diversity in selection. It adds RE-RAG, a tuned retrieval technique, and a requirement dependency graph as a knowledge source. On three curated datasets it reaches 87.1% recall, 76.3% precision and 81% F1 at lower cost than baselines. The authors release the datasets.

LLMRAG
arXivDRILSRE-RAG

research, agents, llm-appsΒ· Added 27 Oct 2026, published 24 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Chosen Commitments and Certified Decoding Regions in the Adaptive Threshold Schnorr Attack

This IACR ePrint 2026/2632 paper by Demirtaş and Yayla analyses the Crites–Stewart adaptive forgery attack on threshold Schnorr signatures, which needs one call to a sparse linear search oracle (bounded distance decoding of a scaled Reed–Solomon code). It shows that choosing the commitment coefficient vector does not help much: a wrapper adversary with Q challenges succeeds with probability at most QM/p, even if its solvers decode every witness for free. For the six original (N, Ο„) pairs, M stays below 2^24, so the bound is under 2^-100 after 2^128 challenges at p = 2^252.

Schnorr signaturesReed–Solomon codesfolded Reed–Solomon codes
Crites and Stewart attackGuruswami–WangAshvinkumar–Habib–Srivastava+2

otherΒ· Added 26 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

Intervention-Certified Amplification: A Validity Gate for $Οƒ$-Weighted Post-Training

Intervention-Certified Amplification (ICA) is a validity gate for sigma-weighted hybrid SFT/RL post-training. The paper shows that DIAA, a per-sample sigma-weighted hybrid, emits unexecuted tool-integrated reasoning on 29% of MATH-500 prompts (three times vanilla GRPO) even with Python fences removed from its anchor. ICA gates sigma with paired-rollout evidence, cutting TIR to 13.8% (frozen) and 11.2% (online) and raising accuracy from 47.5% to 48.7% and 49.3%. It transfers to GSM8K.

GRPOPython
DIAAIntervention-Certified AmplificationMATH-500+2

training, researchΒ· Added 27 Oct 2026, published 24 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Ranking Is Not Deciding: Benchmark Shortcuts and Operating-Point Collapse in Query-Time RAG Poisoning Defenses

Ranking Is Not Deciding is an October 2026 arXiv paper showing that query-time RAG poisoning filters score near-perfectly because of how the poison set was built. PoisonedRAG's code prepends the target question to each passage. Removing that prefix takes RAGuard from AUROC 0.953 to 0.758 and its miss rate from 0.191 to 0.763. The authors release a script that profiles a poison set.

LLM
PoisonedRAGRAGuardTrustRAG+5

AI SecurityΒ· Added 27 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

Build, Don't Play: Self-Improving LLM Research Agents Develop a Hearthstone Battlegrounds AI That Rivals Top Players

AutoTavern is a self-improving system of specialised LLM research agents with a typed shared memory and verification gates. In 20 days it built TavernGym, a full-content Hearthstone Battlegrounds simulator, and 23 versions of TavernAgent, a PPO-trained player. TavernAgent averaged placement 1.60 with 80% first places over its last 20 live games, beating the top ten players (2.34, 59%). On TavernBench (960 tasks), it answered 91% of play tasks against at most 63% for frontier LLMs.

PPOLLM
AutoTavernTavernGymTavernAgent+3

agents, research, training, evalsΒ· Added 27 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

Sliding Networks: A Family of Residual Structures Preserving Feature Learning and Feature Diversity

Sliding Networks is a family of residual network structures with a joint width and depth scaling recipe that keeps both locally maximal feature learning and feature diversity in the residual stream. The key quantity is the ratio N_flat/(N_sharp L) tending to a constant alpha, and Half Copy correlated initialization can relax the shape constraints. Residual-MLP experiments support an SDE limit, but language-model experiments show performance differences under regrouping at fixed parameter count.

Transformer
arXiv

researchΒ· Added 27 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

Learning What to Share: Expert Specialization for Time-Series Forecasting

Persistent Closed-Form Routing (PCR) is a plug-and-play method for multivariate time-series forecasting. It alternates exact conditional estimation of channel-specific mixture weights with gradient training of low-rank residual experts around a frozen pretrained forecaster. Across eleven datasets and three backbones, PCR-K4 cuts dataset-balanced MSE by 3.86-14.25% and beats competing specialization methods with fewer trainable parameters. The paper also introduces GalaxyTS, a synthetic dataset with exact shared and channel-specific references.

Mixture of ExpertsTransformer
GalaxyTSPCRPCR-K4+1

researchΒ· Added 27 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

Task Format as a Factor in Adaptation: A Controlled Comparison of LoRA and Full Fine-Tuning for Prompt-Safety Classification

This paper compares LoRA and full fine-tuning for prompt-safety classification using a matched 400M encoder-decoder pair (Ettin) across three task formats, with up to 15 seeds per cell and pre-specified analyses. Full fine-tuning leads LoRA by 2-3 pp at the pre-specified learning rates, and the encoder gap closes when both use the same learning-rate search. Training LoRA to write a reason after its verdict adds 4.0 pp, while a content-free sentence of equal length does not. Trained models beat a prompted 8B in domain but trail it by 8-23 pp on adversarial jailbreaks and over-flag benign prompts (27-66% against 2-3%).

LoRAEttinTransformer

training, research, evalsΒ· Added 27 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

IntentDelta: A Human-Constructed Benchmark for Evolving User Intent

IntentDelta is a human-constructed multi-turn benchmark of 638 trajectories and 3,766 turns across WebShop and TravelPlanner. Each turn pairs a user utterance with a cumulative intention state and human reference actions. Across eleven agents, average Intention Recovery is 33.1% in TravelPlanner and 44.7% in WebShop, and average Action Score is 31.6% and 41.0%. Agents lose earlier requirements and confuse soft preferences with must-have constraints.

LLM
IntentDeltaWebShopTravelPlanner+1

evals, agents, researchΒ· Added 27 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

Unlocking the Specialization Capability of PPG Foundation Models for Wearable Signals through Structured Pruning and Adaptive Fine-Tuning

SPAFT is a structured prune-then-finetune framework for PPG (photoplethysmography) foundation models used on wearable signals. It finds that pretrained PPG models have inherent sparsity and redundancy, then restricts fine-tuning to a compact parameter subspace chosen by parameter importance and structural redundancy. Across four PPG foundation models, five datasets and ten tasks, it wins 82.8% of regression and 87.5% of classification comparisons.

SPAFTarXiv

research, trainingΒ· Added 27 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

TriageRAG: Failure-Aware Self-Training for Adapting Retrieval-Augmented Language Models to Specialized Domains

TriageRAG is a failure-aware self-training method for adapting retrieval-augmented LLMs to specialized domains using only an unlabeled corpus. It probes the student on self-generated questions with and without retrieved context, sorts them into known, solved, context-failure and retrieval-failure, and routes each to a matching training signal. With Qwen3-4B on 11 datasets it beats budget-matched SimRAG by 1.2-6.4 points and recovers closed-book accuracy where retrieval hurts.

RAGLLMQwen3
TriageRAGSimRAGCS-Bench+1

research, llm-apps, trainingΒ· Added 27 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

An actively trained neural operator for near-explicit atmospheric chemistry

FNO-MoE is a Fourier neural operator with a mixture of experts that predicts the full near-explicit chemical state (Master Chemical Mechanism, thousands of species) over 30 minutes in one call. Expert disagreement selects the most informative box-model simulations, so active sampling beats random or evenly spread sampling at equal cost. Fine-tuning on longer trajectories keeps multi-hour runs stable, and the emulator runs orders of magnitude faster than the numerical solver.

Fourier neural operatorMixture of Experts
Master Chemical MechanismFNO-MoEarXiv

researchΒ· Added 27 Oct 2026, published 24 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

VeilDNS: Post-Quantum DNS Privacy from the First UDP Packet

VeilDNS is a DNS-native protocol that uses a post-quantum KEM and AEAD to encrypt DNS questions and answers and authenticate the resolver in one UDP exchange on port 53, preserving the DNS wire format. It has stateless and stateful modes plus optional forward secrecy from the second query. Against ML-DSA-authenticated DoT/DoH/DoQ it reports up to 3.5x higher cold-session throughput and 13.7x fewer bytes; Tamarin proves query confidentiality, response authentication and forward secrecy.

DNSML-DSATLS+1
VeilDNSTamarinDoT+3

otherΒ· Added 26 Oct 2026, published 24 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Enhancing LLM-Based Vulnerability Detection via Representation-Aware Logical Ensemble

RALE (Representation-Aware Logical Ensemble) is a method for detecting vulnerabilities in C source code with LLMs trained on different code representations: raw source, Abstract Syntax Trees and Control Flow Graphs. The authors show the representations suit different vulnerability classes, and combine the models with explicit logical rules and majority voting. Single-representation models reach up to 73% F1, while the ensemble reaches 78%.

LLMC
RALERepresentation-Aware Logical EnsembleAbstract Syntax Tree+1

AI Security, AppSecΒ· Added 28 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

Enhancing LLM-Based Vulnerability Detection via Representation-Aware Logical Ensemble

RALE (Representation-Aware Logical Ensemble) is a method for LLM-based vulnerability detection in C code. The authors train LLMs on raw source code, Abstract Syntax Trees and Control Flow Graphs, and find each representation works best for certain vulnerability classes. Combining the models with explicit logical rules and majority voting raises F1 from at most 73% for a single model to 78%, with gains in accuracy, precision and recall.

LLMstatic analysis
arXivRALE

research, trainingΒ· Added 28 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

ZipFusion: Fusing Lossless KV Decompression with Attention for Efficient LLM Decoding

ZipFusion is a lossless KV cache compression scheme whose attention kernel reads the compressed cache directly and rebuilds the original values in registers with simple bit operations, so no separate decompression pass is needed. It also reassigns the memory freed by compression across layers to hold more KV cache. Built on FlashInfer and integrated with SGLang, it gives about 1.25x decode attention speedup on an H100 and up to 26.3% higher decode throughput at 8K context than uncompressed SGLang. It reaches up to 2.76x the throughput of the best lossless KV compression baseline.

FlashInferSGLangCUDA+1
ZipFusionNVIDIA

inference, researchΒ· Added 27 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

VulDec: Vulnerability Detection in Binaries via Neural Decompilation

VulDec is a dataset and framework for detecting vulnerabilities in binaries by first decompiling them with fine-tuned LLMs. The dataset aligns real-world Assembly-C function pairs across several architectures with CWE labels. Tuned neural decompilers reach about 56% Edit Similarity and 43% BLEU-4, and tuned detectors reach a macro F1 of 0.61 on a realistic test set with a 3% vulnerability rate.

LLM
VulDecCWE

research, trainingΒ· Added 28 Oct 2026, published 24 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

VulDec: Vulnerability Detection in Binaries via Neural Decompilation

VulDec is an arXiv paper (October 2026) presenting a dataset of real-world Assembly-C function pairs with CWE labels across multiple architectures, plus an end-to-end framework that uses neural decompilation for binary vulnerability detection. Tuned LLM decompilers reach about 56% Edit Similarity and 43% BLEU-4. Tuned LLM detectors reach macro F1 of 0.61 on a realistic test set with a 3% vulnerability rate.

LLM
VulDec

Malware & RE, AI SecurityΒ· Added 28 Oct 2026, published 24 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Extraction meets Distillation - cryptanalytic techniques to recover parameters from a Deep Neural Network

Extraction meets Distillation is an IACR ePrint paper (2026/2628, CSCML 2026) that combines cryptanalytic weight-direction extraction with label-based distillation to reconstruct fully connected neural networks. It adapts a ReLU extraction implementation to Leaky ReLU and proves conditional bounds for direction recovery and sign selection. On CIFAR-10 victims, reconstructed models reach 56.40% and 58.29% agreement. It separates label requests from privileged access and notes that prediction agreement does not identify parameters.

ReLULeaky ReLU
CSCML 2026CIFAR-10

AI SecurityΒ· Added 26 Oct 2026, published 24 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

The Exact Bit Security of Hash-Based Signatures

The Exact Bit Security of Hash-Based Signatures is a 2026 IACR ePrint paper that analyses XMSS with 128-bit digests and SLH-DSA-128s in the random oracle model, with proofs formalised in Lean4. Strong unforgeability comes to 127 bits under most accounting modes but only 122 bits if just direct random oracle queries are counted. The authors give matching attacks, and show how resource accounting changes the result.

XMSSSLH-DSALean
Mikhail KudinovBenedikt WagnerEmile Wambsgans

otherΒ· Added 26 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

RAQ-MLA: Role-Aware Quantization for Multi-Head Latent Attention Caches

RAQ-MLA (Role-Aware Quantization for Multi-Head Latent Attention Caches) is a training-free method for quantizing the MLA KV cache. It fits a separate invertible transform to the compressed latent (tuned for attention-weighted value error) and to the positional key (tuned for score perturbation). It reaches about 2.5 bits per element, a 6.5x gain in theoretical KV-cache capacity, with near-lossless reasoning and coding results on four MLA models.

Multi-Head Latent AttentionLLMTransformer
arXiv

research, inferenceΒ· Added 27 Oct 2026, published 24 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Provable Security of SHA-256-Based LMS Revisited in the Ideal-Cipher Model

Provable Security of SHA-256-Based LMS Revisited in the Ideal-Cipher Model is an October 2026 ePrint paper by Chun Guo, Hao Cheng, Bart Preneel and Meiqin Wang. It shows forgery attacks on LMS_SHA256_M32 and LMS_SHA256_M24 that exploit Merkle-DamgΓ₯rd structure, so the Katz and Fluhrer random-oracle bounds do not apply. It proves ideal-cipher-model bounds: about 256 minus log2 of the block count for M32, and a minimum of two terms for M24.

LMSSHA-256
KatzFluhrerLMS_SHA256_M32+4

otherΒ· Added 26 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

Eat Your Precision: Precision Objective Mitigates Reward Hacking in Rubric-based RL

FORK is a reward for rubric-based reinforcement learning that jointly optimizes recall and a new precision objective. Precision requires each unit of a response to be necessary (rubric-driven necessity credits) and factually correct (a grader). Rubric-coverage rewards otherwise produce verbose, less accurate responses. FORK keeps similar coverage with shorter outputs, raising win rate against the base policy from 10.6% to 68.0% on RubricHub-Medical and from 22.1% to 74.1% on HealthBench.

LLM
HealthBenchRubricHub-MedicalFORK

training, researchΒ· Added 27 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

DualPace: Decoupled Scheduling and Cooperative GPU--CPU Decoding for LLM Serving

DualPace is an LLM serving runtime that treats the host as an independently scheduled decode engine. A GPU engine runs prefills and GPU-resident decodes, while an AMX-enabled CPU engine batches and advances CPU-resident decodes, optionally calling GPU Dense Assist for dense stages. In decode-oriented scenarios it raises throughput 6.9 to 43.2% over NEO and 11.5 to 90.6% over vLLM at similar latency.

vLLMNEOIntel AMX+1
DualPacearXiv

inference, researchΒ· Added 27 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

Small Edits, Shifting Decisions: Benchmarking LLM Accuracy and Reliability on French Input Variants

This paper builds a controlled French surface-variant benchmark with seven task types and 4,200 original-low-high triplets (12,600 inputs), covering missing apostrophes and diacritics and keyboard typos. Six models from two LLM families lose accuracy and show worse Brier score and NLL as perturbation grows. Keyboard typos hurt most. Calibration temperatures fitted on original inputs transfer to variants, and combining them with input restoration improves reliability further.

LLM
arXiv

evals, researchΒ· Added 27 Oct 2026, published 24 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Faster Matrix Multiplication Leads to Faster Lattice Sieving

Gao and Hu's IACR ePrint 2026/2622 shows that if the matrix multiplication exponent satisfies Ο‰ ≀ 9/4 βˆ’ Ξ·, heuristic lattice sieving runs in (3/2 βˆ’ Ξ΄)^(n/2+o(n)) time under the spherical heuristic from the BDGL analysis. It builds on OpenAI's recent result that Ο‰ ≀ 9/4. With known matrix multiplication algorithms, the method already gives subquadratic search inside BDGL buckets. Only the abstract is available, so concrete parameters are not shown.

BDGLspherical heuristicmatrix multiplication exponent

otherΒ· Added 26 Oct 2026, published 24 Oct 2026

huggingface.copaper🧠 AI

IQuest-Q1: Advancing Foundation Capabilities for Agentic CLI Systems

IQuest-Q1 is an open-source sparse Mixture-of-Experts model with 320B total and 15B activated parameters, built for agentic coding in CLI systems. Pre-training combines Stable SplitNorm, Muon and muP with a two-stage curriculum that raises the coding-data share in stage two. Mid-training extends context, and post-training mixes SFT, domain-specialized RL and MOPD across scaffolds, followed by model merging.

Mixture of ExpertsStable SplitNormMuon+3
IQuest-Q1Hugging Face

models, training, coding-agents, researchΒ· Added 24 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

When Elliptic-Curve Semiprimality Certificates Reveal Factors

The paper formalizes elliptic-curve semiprimality certificates by adapting the Goldwasser-Kilian primality criterion. For certificates built with complex multiplication, a norm-lattice reconstruction factors N from (N, S, D) alone in expected polynomial time. The author uses it, plus public-point and quadratic-twist attacks, to factor Reble's 1084-digit and Broadhurst's 5061-digit moduli, and shows that hidden-cofactor, withheld-CM-map and private-isogeny repairs also fail.

Goldwasser-Kilian primality criterionReble modulusBroadhurst modulus+4

otherΒ· Added 26 Oct 2026, published 24 Oct 2026

arxiv.orgpaper🧠 AI

Hey, guess what: CUES lead to inferences about typicality

The paper builds two corpora, EventTyp and the human-validated EventTypGold, to study how people infer typicality and atypicality of events from what is said. Large-scale human and LLM experiments show that three CUES predict these inferences in humans: Commonsense Knowledge, Utterance Emphasis and Snark. In most settings LLMs lack the commonsense knowledge to judge an event's general typicality, so they struggle to follow the CUES.

LLM
EventTypEventTypGoldarXiv

research, evalsΒ· Added 27 Oct 2026, published 23 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Deletion, Substitution, Repair and Transplant: Component Attribution in BARBICAN, a Layered Prompt-Injection Gateway for MCP

BARBICAN is a fail-closed prompt-injection gateway for MCP tool mediation. This paper shows its arbitration classifier ran on tokenizer-mangled text for a whole evaluation. Fixing it raised AUC from 0.392 to 0.855 while system recall fell from 80.67% to 80.34%. The routed band is 96.82% malicious, so deletion ablations mislead without substitution experiments and class-balance reporting.

Model Context ProtocolLLM
BARBICANprompt injection

AI SecurityΒ· Added 27 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

Deletion, Substitution, Repair and Transplant: Component Attribution in BARBICAN, a Layered Prompt-Injection Gateway for MCP

The paper analyses BARBICAN, a fail-closed prompt-injection gateway for MCP tool mediation, using deletion, substitution, repair and transplant experiments. Its arbitration classifier ran on tokenizer-mangled text for a whole evaluation. Fixing that raised AUC from 0.392 to 0.855 while system recall fell from 80.67% to 80.34%. The band it receives is 96.82% malicious. The authors argue ablation figures need the band's class balance and substitution baselines.

Model Context Protocol
BARBICAN

evals, research, mcpΒ· Added 27 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

AI Alignment for Digital Democracy: Fairer Voters Representation against LLM Biases

This paper studies demographic bias in LLM-emulated electorates, using three U.S. presidential elections and comparing one closed-source and one open-source LLM. Removing gender from the voter profile cuts the largest group error by 22-42%, and removing education cuts it by 64%. Removing self-reported race raises mean group error by over 40%. Repeated queries and fairness instructions do not reduce errors and can double them.

LLM
arXiv

research, ai-safety, evalsΒ· Added 27 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

What Transfers Across Protein Pockets? Experience Reuse in Molecular Optimization for Agentic Structure-Based Drug Design

This paper studies experience reuse for LLM agents that optimize ligands in protein pockets by editing and docking. Using the full log of one agent run over CrossDocked2020 test-set pockets, it tests whether keys in an experience base recur on unseen pockets and separate improving from worsening edits. The separation is largely explained by molecule size change, action and round, not the target. The authors conclude a base may better prioritize an agent's own proposals for docking than prescribe what to build.

LLM
CrossDocked2020arXiv

research, agentsΒ· Added 26 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

OWLS: Open-world Language-conditioned Speed Fields for Zero-Shot Rover Navigation

OWLS (Open-world Language-conditioned Speed Fields) plans directly over a vision-language model's dense feature map. A text prompt describing traversable terrain scores every pixel of one camera image. The scores are projected onto the ground, adapted with two morphological operations, and used as the speed field of a minimum-time planner. It needs no training, terrain labels, map or extra sensors. It was tested on a physical rover, on simulated Mars and Moon rovers over 200 procedural terrains, and on real planetary imagery.

vision-language model
OWLSarXiv

research, multimodalΒ· Added 26 Oct 2026, published 23 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Faster and Smaller Anonymous Credentials from Standardized Signatures

GordieHowe is a language, certifying compiler and zero-knowledge proof system for building anonymous credentials on standardized signatures (ECDSA, RSA, ML-DSA). It proves an ECDSA-signed mobile driving license presentation in 64.8 ms with a 276 KiB proof, 10.1x faster than Google's Longfellow, and an ML-DSA-44 signature in 87.3 ms with at least 116 bits of quantum security. Compiler output and security theorems are checked in Lean. It introduces series-parallel IOPs and extends the BCS transformation in the QROM.

ECDSAML-DSARSA+1
GordieHoweLongfellowBCS transformation+3

Identity & AccessΒ· Added 24 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

PHYRD: A Living Benchmark for Reproducing and Extending Theoretical Physics Research

PHYRD is a living benchmark for theoretical-physics reasoning with 63 Reproduce problems (derive published results) and 43 Discover problems (consequences of modified theoretical conditions). Tasks are built by FormulaForest, with reference solutions and subquestion-level rubrics. Across five models, whole-problem accuracy is 49.21% to 68.25% on Reproduce and 18.60% to 74.42% on closed-book Discover. FormulaForest data also lifts a Qwen-35B-A3B model on FrontierScience from 61% to 72%.

LLMQwen
PHYRDFormulaForestFrontierScience+2

evals, researchΒ· Added 26 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

Standing on Open Shoulders: Regional Fine-Tuning of Open-Weight Camera-Trap Models for UK Wildlife with Modest Data and Compute

DeepFaune-UK is a fine-tune of the open DeepFaune camera-trap classifier on 28 UK classes, paired with MegaDetector v6. On 20,212 MammalWeb images it reached 88.8% strict accuracy against 56.5% (DeepFaune v1.5.0) and 59.0% (SpeciesNet). Re-applying the recipe to the DINOv3-based classifier gave 90.6%. Fine-tuning on about 150 crops per class matched full-data out-of-distribution accuracy, and a DINOv2 run took about 22 minutes on under 4 GB of GPU memory.

DeepFauneMegaDetectorSpeciesNet+2
DeepFaune-UKMammalWeb

research, training, multimodalΒ· Added 26 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

UAV-SwarmAgent: Scalable Multi-UAV Reconnaissance and Task Allocation via Code Generation and Vision-Language Reasoning

UAV-SwarmAgent is a hierarchical multi-agent system where an operator gives one natural-language sentence and a ground-station agent writes and runs code that produces per-UAV routes. A vision-language model grounds targets in an aerial map, and worker agents verify incidents with a compact onboard model. In simulation it located the incident in 244 of 255 missions (95.7%), and flight time followed an Amdahl-type law with speedup bounded at 1.52x for one to five UAVs.

vision-language modelLLM
UAV-SwarmAgentarXiv

research, agents, multimodalΒ· Added 26 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

Tool-Calling LLM Agents Under Realistic MCP Faults: Scale Does Not Purchase Fault Tolerance

MCP-Injector is a protocol-aware fault-injection middleware for Model Context Protocol tool calls, with permanent, transient and intermittent faults on seedable schedules. Its fault model comes from 57,240 issue and PR threads across 1,774 open-source MCP repositories. In a 1,350-cell experiment, faults cut task-completion score by 60% (8.08 to 3.23 of 10), and the 120B gpt-oss model was no more resilient than the 20B. Agent stacks differed in how well they absorbed faults.

Model Context ProtocolOpenAI Agents SDKLangChain+2
MCP-Injectorgpt-oss-120bOpenAI

mcp, evals, agents, researchΒ· Added 26 Oct 2026, published 23 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

On Task, Off Track: Benchmarking LLM and Agent Robustness to Near-Target Prompt Injection

NTBench (Near-Target Benchmark) tests LLM and agent robustness to near-target prompt injection, where injected instructions steer a response toward a plausible but incorrect or harmful outcome instead of abandoning the task. It builds reference-guided target-instruction pairs on existing datasets, with human validation, and evaluates seven LLMs on ten language datasets and two agent benchmarks. Attack success rose 9.3 to 35.8 points (incorrect targets) and 1.7 to 17.3 points (harmful targets) over fixed-target baselines.

LLM
NTBenchnear-target prompt injectionprompt injection

AI SecurityΒ· Added 26 Oct 2026, published 23 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Tight Post-Quantum Multi-Key Security of the FX Construction

Rentaro Shiba and Tetsu Iwata prove a tight multi-key security bound for the FX construction (the DESX generalization) in the quantum ideal cipher model. Security holds up to about 2^((n+ΞΊ)/3) total classical and quantum oracle queries against fully adaptive adversaries, for any number of keyed instances ΞΌβ‰₯1. This improves their ToSC 2026 bound and matches the offline Simon's algorithm attack in the exponent.

FX constructionDESXoffline Simon's algorithm+4

otherΒ· Added 24 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

DRIVE: Fine-tuning via Data Contribution- and Diversity-aware Weighting with Prior Regularization

DRIVE is a per-sample weighting framework for single-stage fine-tuning when the source pre-training data is unavailable. It uses one differentiable objective: Shapley additivity splits each sample's contribution into anti-forgetting and adaptation parts, a covariance-based diversity term reshapes them, and a sample-characteristic prior stabilizes them. The authors prove better stability-plasticity guarantees than existing weighting schemes and report better performance, faster convergence and more robustness.

DRIVEarXiv

training, researchΒ· Added 26 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

Accordion: Elastic-Depth Inference via Fixed-Prefix Layer Looping

Accordion is a mixture-of-experts language model (Accordion-6B-A0.5B) that supports five inference budgets through fixed-prefix layer looping, with the minimum budget being the unlooped model. After 3.6T pretraining tokens, deeper inference raises the macro-average over 37 tasks by 3.01 points, and the middle budget captures 89% of that gain with half the extra layer executions. SFT and RL keep the budgets, merging three domain experts via parameter-group merging and budget-matched multi-teacher on-policy distillation.

Mixture of ExpertsTransformerLLM
AccordionAccordion-6B-A0.5BarXiv

research, training, inferenceΒ· Added 26 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

Efficient Zero-Shot Video Anomaly Detection via Signal-Aware Adaptive Fusion (SAAF)

Signal-Aware Adaptive Fusion (SAAF) is a training-free zero-shot video anomaly detection framework that cuts the compute cost of vision-language models. It combines a dual-signal sampler (frame-to-frame delta and rolling-context drift in embedding space, OR-gated with EMA thresholds), a threshold-gated cascade from frame-level to video-level analysis, and signal-aware score fusion. It reports AUC-ROC of 92.07% on XD-Violence, 86.70% on MSAD and 80.54% on ShanghaiTech, at 2.2x to 2.6x the throughput of the prior best zero-shot method.

vision-language model
SAAFXD-ViolenceMSAD+3

research, multimodalΒ· Added 26 Oct 2026, published 23 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Learning with Quantization and Worst Case Lattice Problems

Learning with Quantization and Worst Case Lattice Problems is an IACR ePrint paper (2026/2613) by Ziwei Hong and Zhongqiu Fang. It proves that search and decision learning with quantization (LWQ) with public dither is as hard as quantum GapSVP and SIVP on arbitrary lattices, using the randomized polar lattice quantizer of Lyu et al. It also shows that a complete reduction for interval uniform error LWE (MAMBA Frost) and hardness at concrete MAMBA parameters are not established.

LWE
MAMBAMAMBA FrostGapSVP+4

otherΒ· Added 24 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

When Agents Fail: Model or Harness--Who's to Blame?

When Agents Fail: Model or Harness--Who's to Blame? proposes five measures for evaluating agent harnesses together with their underlying models: Valid Completion Rate, Model-Harness Fit, Cross-Model Fit, Interaction Residuals and Token Load. It tests four harnesses (OpenCode, Codex CLI, Pi CLI, DeepAgents) with four models on six benchmarks, across 111 settings and 52,168 trajectories. Harness rankings change by model and benchmark. OpenCode ranks first in cross-model performance.

OpenCodeCodexPi+2
DeepSeek V4arXiv

evals, agents, researchΒ· Added 26 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

Sharpness-aware Orthogonalized Momentum Algorithms

SOMA (Sharpness-aware Orthogonalized Momentum Algorithm) combines sharpness-aware minimization (SAM) with the Muon optimizer for LLM training. It avoids SAM's extra gradient computation by using stale, purely stochastic gradient noise as the adversarial perturbation. The authors prove sample complexity does not depend on perturbation direction, study robustness to heavy-tailed gradient noise, and test SOMA against post-training quantization degradation and catastrophic forgetting during fine-tuning.

MuonLLM
SOMAarXiv

research, trainingΒ· Added 26 Oct 2026, published 23 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

For Thirty Pieces of Silver: Overcoming Non-IID via ZKP Sample-Level Auditing and Forcing Attackers into Traitors in Federated Learning

Preprint (IACR ePrint 2026/2611) proposing a federated learning defense that replaces gradient detection with zero-knowledge-proof sample-level audits of client datasets. A staking mechanism forces attackers to train on discovered poisoned samples with flipped labels, producing counter-gradients that remove the backdoor without knowing the trigger. ZKP commitments lock the training data, which blocks adaptive attacks and gradient tampering. On CIFAR-10 under Dir(0.1) non-IID, it holds attack success rate below 6% against distributed backdoor and edge-case attacks.

distributed backdoor attackedge-case attackadaptive attack+3

AI SecurityΒ· Added 24 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

SCI-AGENT-EXAM: Benchmarking Agents on Scientific Research Tasks

SCI-AGENT-EXAM is a workflow-oriented benchmark of 120 expert-curated tasks across 11 scientific fields and 7 task types from the Scientific Workflow Task Taxonomy (SWTT). Tasks need both executable and textual artifacts, scored by programmatic checks plus an expert-calibrated LLM judge. Ten frontier agents were tested: GPT-6 Astra scored highest at 80.9, but only 26.0% of its runs passed the 0.95 success threshold.

LLM
SCI-AGENT-EXAMScientific Workflow Task TaxonomyGPT-6 Astra+1

evals, agents, researchΒ· Added 26 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

Profile-Driven User Simulation via Reinforcement Learning with Hierarchical Rewards for Task-Oriented Dialogues

ProfileSim is a profile-driven user simulator for financial marketing outbound calls. It models user profiles (demographics, Big Five traits) and business profiles (intents reverse-engineered from real call logs). The base model is fine-tuned on real voice dialogues, then refined with GRPO using dialogue-level and utterance-level rewards. Against other user generators it scores highest on colloquial naturalness and profile adherence, and lowest agent score on long-tail intents, with shorter utterances at comparable business compliance.

GRPORAGLLM
ProfileSimarXiv

research, trainingΒ· Added 26 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

When to Stop Penalizing Actions? Martingale GRPO for VLA Reinforcement Learning

MART-GRPO is a variant of group-relative policy optimization for vision-language-action (VLA) reinforcement learning. It uses a LoRA-fine-tuned VLM to find the last visible error without recovery in a failed rollout video, keeps failure feedback up to that point, and drops it afterward. Martingale stopping conditions show this preserves the expected GRPO gradient and can reduce covariance. With OpenVLA-OFT on RoboTwin 2.0, it raises success rates over full-trajectory GRPO across multiple tasks.

GRPOLoRAvision-language-action model+2
RoboTwin 2.0arXiv

research, training, multimodalΒ· Added 26 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

4DMemory: Benchmarking Long-Horizon Spatiotemporal Memory with Harness-Augmented Agents

4DMemory is a benchmark suite for long-horizon spatiotemporal memory: the LongVideo dataset (about 900 hours of video, over 5,000 manually reviewed questions) and 4DMemoryBench. It also presents the 4DMemory Harness, combining four skills, 22+ tool models and a model-specific RAG system. Across 13 models, the harness improved every one by over 50%, and the same models scored over 10% lower than on a previous benchmark.

RAG
4DMemory4DMemoryBenchLongVideo+2

evals, multimodal, agentsΒ· Added 26 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

MAST-VLA: Skill-Conditioned Adaptation with Trajectory-Affordance Priors for Multi-Skill Robot Manipulation

MAST-VLA is a vision-language-action framework for multi-skill robot manipulation that conditions on both the skill to execute and where and how to contact objects. It adds skill-conditioned LoRA Mixture-of-Experts adapters to the LLM backbone and turns a predicted affordance heatmap into a patch-level spatial prior for the action head. It reaches an Avg. Len of 4.65 on CALVIN ABC→D and was tested on a real robot.

vision-language-action modelLoRAMixture of Experts+1
MAST-VLACALVINarXiv

research, multimodalΒ· Added 26 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

BiLoCo: Binary Low-Rank Corrections for Post-Training Quantization

BiLoCo is a post-training quantization method for FP4 LLMs that adds low-rank corrections whose left and right factors are stored as binary Β±1 sign vectors instead of BF16. This uses 16x less storage per rank-one component and lets the correction run on CUDA cores alongside the FP4 tensor-core GEMM. On 4B to 72B LLMs it matches or improves memory-matched SVDQuant. A fused B300 kernel is at most 11% slower than FP4-only GEMM at batch size 1 for ranks up to 512.

CUDALLMdiffusion model
BiLoCoSVDQuantNVIDIA+1

inference, researchΒ· Added 26 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

MPQ: A Message-Passing View of Post-Training Quantization

MPQ (Message-Passing Quantization) is a post-training quantization method that treats row-wise PTQ as posterior inference over discrete codebooks. It keeps soft posteriors across weight blocks using vector approximate message passing, then refines a hard-decision initialization with exact block coordinate descent. Tested at 2-bit lattice and 3- and 4-bit scalar quantization on Llama, Qwen and Mistral models, it improves perplexity and zero-shot accuracy over GPTQ-style baselines.

GPTQLDLQvector approximate message passing+5
arXiv

research, inferenceΒ· Added 26 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

Semantically Rich, Metrically Affect-Blind: A Geometric Blind Spot in Modern Text Embedders

Sentiment-Injected Sentence Embeddings (SISE) addresses a finding across eleven frozen text encoders (2021 to 2026): linear probes recover sentence polarity at up to 91.3% accuracy, but cosine similarity separates polarity by only 0.003-0.064. A small supervised-contrastive head (0.13M-0.69M parameters) trained on CPU raises retrieval MAP by up to 26 points, but the 128-d head loses 38-41 STS-B Spearman points. The paper also releases the Attribute Alignment Gap diagnostic.

Qwen3RAG
Qwen3-Embedding-4BJina-v5SISE+3

research, llm-appsΒ· Added 26 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

Tampered ML: Evaluating LLM Judgment of Machine Learning Research

Tampered ML is a benchmark of 1,858 item-pairs, each pairing an experiment proposal reconstructed from a published ML paper with a minimally edited version that adds a targeted methodological flaw. Models must pick the sounder proposal in both presentation orders. A human study estimates 86% of items are valid (95% CI 81-91%). Opus 5 reaches 77.9% accuracy, and models are sensitive to order and favor flawed designs that look more specific, transparent, or conventional.

LLM
Tampered MLOpus 5arXiv

evals, ai-safety, researchΒ· Added 26 Oct 2026, published 23 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Pairwise Independence of Ten-Round AES

Pairwise Independence of Ten-Round AES (Zhongfeng Niu, Kai Hu, ePrint 2026/2608) proves that ten rounds of AES with independent uniform round keys and input/output whitening are within 3017/2^141 (below 2^-129) statistical distance of pairwise independent. The proof bounds the averaged difference-distribution matrix over five superbox layers, using Gram moments and MDS code constraints. Final-round MixColumns omission is retained.

AES
pairwise independencedifference-distribution matrixMDS code+1

otherΒ· Added 24 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

How Much Do You Trust A Dog? Quantifying Hint-Following in Reasoning Language Models

This paper measures how hints such as "[Source] thinks the answer is (X)" shift LLM answers on MMLU questions, varying the source between a professor, a friend and a dog across Qwen, Gemma and SmolLM models. The shift fits an exponential tilt: a roughly constant mean change in the hinted answer's log-odds, with susceptibility largely shared across sources. The shift persists when the source is declared inaccurate or the prompt warns against trusting it. Synthetic experiments show how KL-regularized reward training could produce this pattern.

LLMQwenGemma+1
MMLUarXiv

research, ai-safety, evalsΒ· Added 26 Oct 2026, published 23 Oct 2026

huggingface.copaper🧠 AI

Cache Engineering for Agents (AKV)

AKV introduces cache engineering, which lets LLM agents control their active KV cache with drop (exclude cache from future attention) and repos (adjust retained keys' position encodings) without editing the trajectory or re-prefilling. The AKV serving engine keeps a stateless API while managing stateful cache reuse, eviction and restoration. A tool-response rolling-drop policy raised benchmark scores by 1.7 points and cut cost 27.7% versus threshold-triggered summarization.

LLMTransformerGitHub+1
AKV

inference, agents, researchΒ· Added 23 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Agentic AI Defense: Decode-Time Provenance Binding for MCP

Decode-time provenance binding is a defense for Model Context Protocol agent pipelines against cross-modal trust laundering, where instructions hidden in an email-signature image via LSB, DCT or metadata steganography get decoded by a tool. It combines HMAC-authenticated trust labels, a provenance ledger and context-taint tracking to block critical tool calls. On a real MCP testbed with 24 adaptive payloads, attack success fell from 100% undefended (62.5% for keyword and regex filters) to 0%.

Model Context Protocol
indirect prompt injectioncross-modal trust launderingsteganography+5

AI SecurityΒ· Added 26 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

Reproducible Evaluation as the Substrate for Safe Prompt Compression in Production Agents

This paper presents an offline evaluation harness for a production merchant-facing conversational agent. It stays reproducible when live backend data changes and can be regenerated when it goes stale. Used as the fitness function for GEPA prompt optimization under a correctness gate against reward hacking, it shrinks the full prompt surface by 3.5-7.6% without losing held-out correctness, across three subject-model families.

GEPALLM
arXiv

evals, prompting, agentsΒ· Added 26 Oct 2026, published 22 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

MΓ­mir: A Stateless Private Search Engine

MΓ­mir is a cryptographic protocol for stateless semantic private search over highly dynamic public databases. It uses homomorphic ciphertext switching, relies on (Ring) Learning with Errors, and needs no offline communication. Against Tiptoe it matches search quality with 84x less per-query communication (0.24 MiB). Against PACMANN it raises quality from 76% to 81% of non-private search, with a 9.54 MiB one-time cost instead of 2.68 GiB, but is 2.1x slower.

TiptoePACMANNLearning with Errors+1

otherΒ· Added 24 Oct 2026, published 22 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Balsamic: One-round Threshold UOV from GPU-Accelerated FHE

Balsamic is a complete homomorphic Unbalanced Oil and Vinegar (UOV) signer, used to build one-round threshold UOV signatures from a packed discrete-CKKS FHE circuit. A paired-pivot linear solver and pivot-success certificates allow encrypted retry selection. In 2-out-of-3 semihonest signing, each online partial signature takes 10.7 s on an RTX 6000 Ada and 7.77 s on a GB300, with 5.25 MB per response.

UOVCKKSFHE+2
Balsamicuniversal thresholdizerspaired-pivot solver+1

otherΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

Sensorimotor Alignment: A Platonic Proxy for Embodied Policy Success

Sensorimotor Alignment (S^2) is a training-free offline metric that measures how well an embodied model's sensory representation aligns with the geometry of physical motion. It extends the Platonic Representation Hypothesis to motion trajectories. S^2 correlates positively with downstream robot task success across embodied model families, helps pick promising VLM backbones before fine-tuning into VLAs, and explains behaviours seen in VLAs and world action models.

vision-language modelvision-language-action modelworld action model
Sensorimotor AlignmentPlatonic Representation HypothesisarXiv

research, evals, multimodalΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

EpiSEM-Bench: Evaluating Safety and Evidence Recovery in LLM Agents under Missing Evidence

EpiSEM-Bench is an executable benchmark of 300 matched unsafe/safe task pairs across six domains. It tests whether tool-using LLM agents take prohibited actions when a tool response omits a safety-relevant fact, even though the request is benign and all returned statements are true. It finds large variation across ten models, and recovery access cuts unsafe execution for all ten.

LLM
EpiSEM-BencharXiv

evals, ai-safety, agentsΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

Causal Chain of Thought: Mitigating Attention Leakage via Context Isolation

CausalCoT is an inference framework that splits a problem into a directed acyclic graph of atomic sub-questions and evaluates each node in an isolated context holding only its direct causal parents. This removes attention paths to non-parent content, so intermediate steps drive the answer rather than leaking from global context. It keeps benchmark accuracy competitive and raises causal sensitivity of reasoning steps by 12 points on average, up to 21, over the strongest baseline. The graph also allows test-time corrections that propagate downstream.

LLMTransformer
arXiv

research, promptingΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

BeNice! Closing Looping's Inference-Memory Gap via KV-Sharing

BeNice! is a post-training method for looped language models that broadcasts the final recurrence's KV-cache into the first recurrence, so one cache can serve all recurrences. It follows a first stage that uses stochastic depth in pretraining to induce contractive residual dynamics. It matches standard finetuning's unshared validation perplexity and composes with multi-latent attention, Kimi delta attention and fp8, mxfp8 and nvfp4 cache quantization. In simulated low-memory long-context inference it raises cache hit rates by up to 31.4% and throughput by up to 23.6%, and cuts p90 time-to-first-token by up to 83.6%.

Transformermulti-latent attentionKimi delta attention+3
BeNice!arXiv

research, inference, trainingΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

F2G-Pose: Geometry-Aware Foundation Feature Lifting for Direct RGB-D Category-Level Object Pose Estimation

F2G-Pose is a direct, single-pass framework that predicts category-level object pose, metric size and camera-frame completed shape from one RGB-D image. It lifts frozen RADIO foundation features onto partial point clouds, tokenizes local geometry with DGCNN, and fuses it with a Mixture-of-Experts Transformer. It trains only on synthetic SOPE data, leads on SOPE and ROPE at 28 FPS, and is tested on HouseCat6D, HANDAL and real manipulation.

TransformerMixture of ExpertsDGCNN+2
F2G-PoseSOPEROPE+4

research, multimodalΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

Progress Probes $P^2$: Lightweight Runtime Monitoring for Vision-Language-Action Models

Progress Probes (P^2) trains linear probes on a vision-language-action model's own activations, using demonstrations, to estimate task progress, then flags executions that deviate from expected progress. Tested on the open-source pi0.5 across simulated and real-world manipulation tasks, it matches or beats VLM-based monitors and failure-data-trained methods at failure detection, without an external foundation model.

vision-language-action modelvision-language modellinear probes
pi0.5arXiv

research, multimodalΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

How Ground Truth Shapes Retrieval Scores: Evidence-Aware Evaluation of a Retrieval-Augmented Generation System for Breast Lesions

This paper describes an evidence-aware retrieval evaluation protocol for a clinical RAG system over breast lesion management literature. Relevance is defined by evidence spans mapped to all containing chunks. A hybrid retriever (dense, BM25, cross-encoder reranking) with 384-token chunks and 20% overlap reached 0.94 Recall@3 on 18 queries. Expanding ground truth from 25 to 37 spans did not change rankings. The authors note the small set needs independent validation.

RAGBM25LLM
DeepSeekDeepEvalarXiv

llm-apps, evals, researchΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

Who Is Sycophantic to Whom? Confident LLMs, Human Deference, and the Collapse of Trust Calibration

This paper studies reverse sycophancy: whether users bend toward a confident, consistent, wrong LLM. In a within-subjects experiment, 32 participants learned science topics from five GPT-5-mini assistants with 0 to 100% of facts replaced by falsehoods. Scores fell from 7.4 to 2.9 out of 10, planted falsehoods were chosen on 60% of falsified items against 11% of correctly taught ones, and confidence stopped tracking correctness. It introduces a baseline-corrected Human Deference Index.

LLM
GPT-5-miniarXiv

research, ai-safety, evalsΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

Rethinking Sequence Compression with Test-time Regression

TTR-Compressor is a sequence compression method that treats input tokens as a test-time regression problem. The regression is learned end-to-end by backpropagation, and its coefficients are solved in closed form in the forward pass to give the compressed representation. As a block-wise sparse attention compressor it improves RULER over attention-based compressors by a large margin. As a visual token merger for multimodal LLMs it beats the MLP merger and matches it with 55.6% fewer visual tokens.

TransformerLLMvision-language model
TTR-CompressorRULERarXiv

research, multimodalΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

CellTrack-Bench: Microscopic Cell Tracking Benchmark for Vision-Language Models

CellTrack-Bench is a benchmark that tests vision-language models on microscopic cell tracking and compares them with specialised trackers. It has 1,537 problems covering 9,041 cell-linking decisions, drawn from 15 cell-tracking datasets across four imaging modalities, with a hard subset built from failures shared by distinct algorithmic trackers. The authors compare environment harnesses, benchmark 9 closed-source and 13 open-weight models, and analyse failure modes.

vision-language modelLLM
CellTrack-BencharXiv

evals, multimodal, researchΒ· Added 24 Oct 2026, published 22 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Integer Coordinate Families and Threshold RSA Signatures for Any Prime Exponent

Paper by Shivansh Jaiswal and Somitra Sanadhya (IACR ePrint 2026/2601) on integer coordinate families for threshold RSA signatures with prime exponent e. It shows the CT-RSA 2026 Ng-Lau scheme admits trivial forgeries and has a flawed proof. It proposes repaired scheme PiIC and integer secret-sharing scheme PiZ for any prime e and any (t,n), both proven TS-UF-CMA secure under the standard RSA assumption. It also gives super-polynomial coordinate lower bounds for pairwise families.

RSA
Ng-Lau schemePiICPiZ+3

otherΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

An Empirical Study of Recent Large Language Models for Knowledge Graph to Text Generation on Standard Benchmarks

This empirical study benchmarks recent LLMs against fine-tuned encoder-decoder models on knowledge graph-to-text generation, using reference-based metrics and graph-grounded, reference-free LLM-based evaluation validated against human annotations. Recent LLMs narrow or close the gap on reference-based metrics and do better on graph-grounded ones. Prompted models make fewer contradictions and triple omissions, and fine-tuned models' errors grow faster with graph size.

LLMTransformer
arXiv

research, evalsΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

The Geometry of Metaphor: Probing and Steering Metaphor Representations in Large Language Models

The Geometry of Metaphor is an October 2026 arXiv preprint that uses mechanistic interpretability to find causal subspaces for metaphor in LLMs of different architectures and sizes. The authors steer output on classification tasks across parts of speech. They also steer generation tasks, showing the metaphoricity of model output can be controlled. The abstract gives no model names or metrics.

LLM
arXiv

researchΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

DuoCook: An Overcooked-Inspired Benchmark for Visual Planning and Coordination

DuoCook is an Overcooked-inspired benchmark in which one vision-language model controls two cooks from top-down views in Unreal Engine environments built with coding agents. It has 20 maps in five categories covering equipment contention, changing terrain and handoff dependencies. Four VLMs were compared; the best, gpt-6-astra, reached 26.2% mean order completion. A notebook memory ablation had mixed effects: positive for Claude and Qwen, negative for GPT and Gemini.

Unreal Enginevision-language model
DuoCookGPT-6 AstraClaude+4

evals, agents, multimodalΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

Training Small Language Models for Transferable Tool Selection

This paper trains small open language models with reinforcement learning to select tools for multi-step instructions over corpora of more than ten thousand tools. A Qwen3-8B model post-trained with the recipe outperforms Llama-4-Maverick (402B) on ToolBench. The trained model transfers to different retrievers and generalizes to new tool corpora in other domains, without relying on proprietary LLMs like Claude or ChatGPT.

Qwen3LlamaLLM
ToolBenchClaudeChatGPT+1

research, training, agentsΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

Evaluating the Applicability of LLM Inference Optimizations on Apple Silicon

This October 2026 arXiv paper evaluates four LLM inference optimization families on Apple Silicon: KV-cache pruning, speculative decoding, ported GPU kernels and post-training quantization. Tests run on four Apple machines with a single-request decode workload, plus matched RTX 4090 runs. KV-cache pruning reaches 1.75x throughput on Apple, all tested speculative decoding methods reduce throughput, and ported kernels give up to 1.20x.

MetalCUDALLM
AppleNVIDIAarXiv

inference, research, evalsΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

From Structured Records to Patient Narratives: Preserving Clinical Alignment in LLM-Generated Health Summaries

This paper studies evidence-grounded health summarization for menstrual health monitoring. It combines structured evidence conditioning with RAG in a prompt-based constrained generation framework, and scores 4,500 summaries from three LLMs with NLI, atomic factuality metrics and readability measures. Grounding constraints improved uncertainty preservation and generally kept or improved faithfulness against retrieved evidence, while omission effects varied by model. Clinical alignment came with harder reading and more medical terminology.

LLMRAG
arXiv

research, evals, llm-appsΒ· Added 24 Oct 2026, published 22 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Linear Cryptanalysis of TFHE-Friendly Cipher FRAST in the Average Key Setting

Linear cryptanalysis of FRAST, a TFHE-friendly stream cipher, in the average key setting. It fixes the false-positive problem left open in the earlier attack by Bak et al., showing key differences fall into five indistinguishable classes per round. The Contract algorithm recovers the master key for 10 rounds and, on weak keys of density 2^-11.8 to 2^-5.4, reaches full FRAST within the claimed security.

FRASTTFHE
Contract algorithmBak et al.linear cryptanalysis+1

otherΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

Drift Says When, Budget Says How Much: Rate-Controlled KV Re-selection for Long-Form Multimodal Generation

Rate-Controlled Refresh (RCR) is a KV cache re-selection method for multimodal LLMs in long-form generation. Attention drift decides when and where to re-select visual tokens, and a per-sample controller sets how often. RCR beats InfiniGen by 1.6-3.8 ROUGE-L points on five of six model-task settings and stays within 1.7 points of exact per-step re-selection. On video description, where drift is homogeneous, it no longer beats a fixed threshold.

Qwen2-VLQwen3-VLInfiniGen+1
DetailCaps

research, inference, multimodalΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

SARIA: Persistence-Aware KV Caching with Coordinated DRAM--SSD Reload for LLM Agents

SARIA (Selective Admission and Reload for Inference Acceleration) is a KV caching system that jointly manages DRAM and SSD for multi-turn LLM agents. It persists only blocks likely to be reused beyond DRAM residency, promotes SSD-hit blocks into DRAM for same-session reuse, and paces DRAM reads with a transfer coordinator. Built on LMCache MP, it cuts SSD writes by 57.1 to 58.9% versus full duplicate caching and mean TTFT by 42.3 to 79.7% versus DRAM-only caching.

LMCache MPLLMSSD+1
SARIALMCacheTraceLab+2

inference, researchΒ· Added 23 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

RIFT: KV Cache Compression for Draft Models with Complementary Compressibility Training

RIFT is a family of selection-based KV cache compression strategies for speculative-decoding draft models. It targets "decode staleness", where prefill-focused selection loses relevance as output grows, by balancing prefill information with recent generated tokens, refreshing the selection adaptively, and training drafters with sparse attention masks. Qwen3.5-4B drafting for Qwen3.5-122B keeps over 98% of full-cache acceptance length at 32K input, 4K output and an 8K KV budget.

Qwen3.5TransformerLLM
arXiv

research, inferenceΒ· Added 23 Oct 2026, published 22 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

The Good, the Bad, and the Noisy: A Systematic Analysis of Ring-Oscillator-Based Noise Generators

This IACR ePrint paper (2026/2597) systematically compares ring-oscillator-based additive noise generators, a hiding countermeasure against side-channel attacks. Experiments show many existing designs ignore output amplification and the risk of the noise being filtered out, so they lower signal-to-noise ratio too little. The authors give a guideline on inverter chain length, output amplification and frequency randomization, and build a tailored generator for an AES implementation that outperforms prior designs.

AES
Florian StolzDina HesseJulius Hermelink+2

Hardware & RFΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

Chunk Recomputation under Real Document Revisions: Measuring Update Cost and Retrieval Quality of Fixed, Recursive, and Content-Defined Chunking

Chunk Recomputation under Real Document Revisions measures how much text must be re-embedded after edits for three stateless chunkers (non-overlapping fixed-size, recursive paragraph-first, content-defined) on 120 pairs of adjacent Chinese and English Wikipedia revisions. Fixed-size recomputes 57-68% of the new-version workload, recursive 38-56%, content-defined 43-54%, while evidence recall at a 2048-token budget differs by under two points. The authors argue update cost should be reported alongside retrieval quality.

RAG
WikipediaarXiv

llm-apps, research, evalsΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

SecLog-Bench: A Scalable Benchmark for Cybersecurity Log Reasoning with Scaffolded Evidence

SecLog-Bench is a benchmark for LLM reasoning over cybersecurity logs, built on an extensible simulation platform covering 29 attack scenarios. It combines audit logs, application logs and network traffic, with attack-stage labels and step-by-step evidence chains. Eight LLMs were tested on post-detection attack-progress reasoning: the best reached 44.44% accuracy, 45.07% Macro-F1 and 54.87% Stage Reasoning F1.

LLM
SecLog-BenchStage Reasoning F1

AI Security, Blue Team & DetectionΒ· Added 23 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

SecLog-Bench: A Scalable Benchmark for Cybersecurity Log Reasoning with Scaffolded Evidence

SecLog-Bench is a benchmark for LLM reasoning over cybersecurity logs. A simulation platform with 29 attack scenarios generates audit logs, application logs and network traffic, with attack-stage labels and step-by-step evidence chains. Eight mainstream LLMs were tested on attack-progress reasoning: the best reached 44.44% accuracy, 45.07% Macro-F1 and 54.87% Stage Reasoning F1. Correct predictions often came with flawed reasoning.

LLM
SecLog-BencharXiv

evals, researchΒ· Added 23 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

TRIAD: Benchmarking Omni-Modal Ambiguity in Multimodal Large Language Models

TRIAD is a benchmark for omni-modal ambiguity resolution. It has 327 hand-written text-image-audio queries in 86 scene groups across 18 ambiguity categories, and removing any one modality makes the answer non-unique. Across 14 omni-modal systems, the best model trails humans by over 20 points in group accuracy. Without answer options, model group accuracy falls to single digits, and leave-one-out tests show audio cues are often underused.

multimodal large language modelomni-modal LLM
TRIADarXiv

evals, multimodal, researchΒ· Added 23 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

Gandalf: Flash Shall Not Die! Increasing Flash Storage Lifetime for KV Cache Offloading in LLM Serving

Gandalf is an SSD KV cache offloading system for LLM serving that is aware of SSD lifetime. It prioritizes admitting full-attention KV cache to SSD over cache from other attention types, using application-level information rather than access history alone. The authors report a 7.3x average SSD lifetime extension with negligible cache hit rate loss across several workload traces and hardware capacities. The design may extend to High Bandwidth Flash.

LLMHigh Bandwidth Flash
GandalfarXiv

inference, researchΒ· Added 23 Oct 2026, published 22 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Getting to the right root: radical isogenies of every degree

Thomas Decru's ePrint 2026/2595 proves a corrected version of radical isogeny formulae for every Nβ‰₯4, odd and even, over fields of characteristic coprime to 2N. It settles the sign choice for even N so that 2-isogeny walks stay on the volcano surface. One radical step costs about 12.5N multiplications and one exponentiation, and the paper shows how to evaluate radical isogenies on points, so a CSIDH class group action needs no torsion point sampling.

CSIDH
radical isogeniesKronecker theta function2-isogeny volcano+3

otherΒ· Added 24 Oct 2026, published 22 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Efficient Laconic Oblivious Transfer with Malicious Security

Efficient Laconic Oblivious Transfer with Malicious Security is an ePrint paper (2026/2593, ASIACRYPT 2026 revision) giving the first maliciously secure laconic OT that uses its primitives only as black boxes. It adds equivocal vector commitments and maliciously secure witness encryption to the commitment-plus-witness-encryption paradigm. Security is proven in the UC model against malicious senders and in the context model against malicious receivers. Instantiations use LWE and bilinear Diffie-Hellman assumptions in the standard model.

laconic oblivious transferequivocal vector commitmentswitness encryption+3

otherΒ· Added 24 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

Disentangling Robustness and Sycophancy in Multilingual LLMs

The SC-matrix is an evaluation framework for multilingual LLM sycophancy. It crosses a model's competence (correct answer with no pressure) with its sycophancy (keeping that answer under pressure), so agreeing with a false premise can be told apart from not knowing the answer in that language. Results: equal aggregate sycophancy rates hide different failure mixes, high competence does not always protect, and reasoning-oriented mitigations beat directive ones.

LLM
arXiv

ai-safety, evals, researchΒ· Added 24 Oct 2026, published 22 Oct 2026

huggingface.copaper🧠 AI

Matrix-Game 4.0: Harnessing Video Models for Real-Time Playable Game Worlds

Matrix-Game 4.0 is a system that separates game logic from visual rendering for playable generated worlds. A lightweight engine holds world state and rules, a multimodal coding agent writes game code and scene captions, and a distilled autoregressive video model turns low-poly proxies into detailed frames. It runs 480p at 60 FPS on one RTX 5090 with 112 ms key-press-to-display latency. Code, weights and assets are released.

diffusion modelHugging Face
Matrix-Game 4.0NVIDIA

multimodal, research, agentsΒ· Added 22 Oct 2026

arxiv.orgpaper🧠 AI

IFC-MCQ: Automatically Generating Multiple-Choice Benchmarks for Evaluating LLM Agents on IFC Data Retrieval

IFC-MCQ is a method that automatically generates multiple-choice benchmarks from Industry Foundation Classes (IFC) building-model files, so answers can be graded by exact option-set match instead of human or LLM review. Its taxonomy has 15 categories and 36 subtypes in four groups, with answer keys from the file and distractors from file values or rules. Two agentic setups, tool-based and code-based retrieval, showed category-specific failures and variation by IFC model and interface.

LLMIndustry Foundation Classes
IFC-MCQarXiv

evals, agents, researchΒ· Added 23 Oct 2026, published 21 Oct 2026

arxiv.orgpaper🧠 AI

SIM-UT: A User Simulation based Evaluation Framework for Medical Triage Chatbots

SIM-UT (Simulation of User Behaviour for Triage) is a multi-turn, simulation-based method for finding failure modes in LLM medical triage chatbots. It was applied to three WhatsApp health chatbots (India, South Africa, Kenya) across 5,000+ multilingual simulated turns, comparing MedGemma with ChatGPT and Claude. The main finding is de-escalation risk: agents that first flagged emergencies agreed with users who minimised symptoms, such as vaginal bleeding in pregnancy.

MedGemmaChatGPTClaude+2
SIM-UT

evals, ai-safety, researchΒ· Added 24 Oct 2026, published 21 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Sotto Maschera: Masking the Sota-Voce Fixed-Weight Vector Sampling

Sotto Maschera is a masked implementation of the Sota Voce sparse fixed-weight vector sampler (Sota support sampler and MWSupport conversion) for embedded devices, protecting against power side-channel attacks. It bitslices sorting, merging and compaction and masks only in the Boolean domain, avoiding slow conversions. TVLA evaluations show no leakage, and HQC runs up to 45x faster than previous masked work.

HQC
Sota VoceMWSupportTVLA+2

Hardware & RFΒ· Added 24 Oct 2026, published 21 Oct 2026

arxiv.orgpaper🧠 AI

Every Part Has Its Role: Part-of-Speech Effects in LLM Post-Training

Every Part Has Its Role studies concept augmentation in LLM post-training, where a target word is replaced by related alternatives in training sentences. It extends prior work from nouns to verbs and adjectives. Concept augmentation improves perplexity most consistently on news regardless of part of speech, while verbs give the most reliable downstream gains. CKA and linear probing show the largest gains do not match the largest representation changes.

LLM
arXiv

research, trainingΒ· Added 23 Oct 2026, published 21 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Rerandomizable Garbling for Arithmetic Circuits

Rerandomizable Garbling for Arithmetic Circuits is an IACR ePrint paper (2026/2590) by Acharya, Meyer, Orlandi and Roy. It gives the first rerandomizable garbling scheme for arithmetic circuits, built on techniques from garbling via homomorphic secret sharing. Communication is O(|C| log B), with 17 group elements per multiplication gate and free additions. Security rests on subgroup-indistinguishability assumptions such as DCR and class groups.

Decisional Composite ResiduosityYao's garbled circuitshomomorphic secret sharing+4

otherΒ· Added 24 Oct 2026, published 21 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Prompt Injection Through Forensic Evidence: A Taxonomy and Proof of Concept of Anti-Forensic Attacks on LLM-Assisted Digital Investigations

Paper on prompt injection delivered through forensic evidence, where the seized device's contents are attacker-controlled and the examiner must read them. It extends the anti-forensic model to cover manipulation of the reasoning layer and gives a taxonomy (objective, technique, payload location, concealment). Three proof-of-concept attacks on an LLM-assisted analysis pipeline change a reported conclusion, write attacker-chosen content to the analyst workstation, and trigger outbound network traffic. Mitigations are proposed.

LLM
indirect prompt injectionprompt injectionanti-forensics+1

AI Security, Blue Team & DetectionΒ· Added 24 Oct 2026, published 21 Oct 2026

arxiv.orgpaper🧠 AI

Monitorability Is Trainable: Post-Training for Chain-of-Thought Monitorability

Monitorability Is Trainable proposes an unsupervised post-training objective that maximizes mutual information between a model's chain of thought and its output. On three model organisms with degraded CoT (from compression, monitor optimization, and synthetic-document generalization), it recovers most or all lost monitorability. On undegraded policies it improves CoT monitor and activation probe prediction of unsafe behavior and raises consequential reasoning.

LLM
arXiv

ai-safety, research, trainingΒ· Added 23 Oct 2026, published 21 Oct 2026

arxiv.orgpaper🧠 AI

Symmetry-Based Parameter Efficient Low-Rank Fine-Tuning for High-Throughput Calculation of Lattice Thermal Conductivity

SBFS-FT (symmetry-based few-shot fine-tuning) adapts the MatterSim 1M universal machine-learned interatomic potential with low-rank adaptation on a small set of compounds sharing one crystal symmetry. Tested on half-Heusler (space group 216), space group 225 and spinel (227) datasets, it cut lattice thermal conductivity error 2-3 times versus the base model. It matched per-compound fine-tuning while taking 5-7 times less compute for 100 compounds.

MatterSimLoRA
MatterSim 1Mmoment tensor potentialspolyMLPs

research, trainingΒ· Added 23 Oct 2026, published 21 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

RingTrace: Model-Free Spatio-Temporal Detection and Core Attribution for Cache Side-Channels

RingTrace is a monitoring framework that detects Flush+Reload cache side-channel attacks by combining per-core cache-miss counters with slice activity across uncore CBoxes. Its Joint Spatio-Temporal Attribution (JSTA) builds a joint-activity matrix without model training: the largest entry is the screening score and row sums point to a candidate core. The authors report detection before secret leakage, fewer false alarms under heavy memory load, and negligible runtime overhead on commodity processors.

Flush+ReloadJoint Spatio-Temporal AttributionJSTA+1

Hardware & RF, Blue Team & DetectionΒ· Added 24 Oct 2026, published 21 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

MPIDetector: Detecting Multi-modal Prompt Injection via LLM-based Reasoning

MPIDetector is a detection framework for multi-modal prompt injection that uses few-shot in-context learning so an LLM can reason about the semantic intent of text and image inputs, without fine-tuning. The authors built a benchmark of eight textual and seven visual attack categories plus benign sets. They report up to 90.91% accuracy on text, 99.28% on images, and up to 99.80% detection on 500 obfuscated WebInject web-agent injections, beating baselines.

GeminiQwenLLM
prompt injectionWebInjectMPIDetector

AI SecurityΒ· Added 24 Oct 2026, published 21 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Modeling Modular Multiplication for Monomial Prediction and Impossible Differentials, with Application to MSX

This ePrint paper gives the first exact bit-level models of modular multiplication z=(xΒ·y) mod 2^n. One model is for monomial prediction under 3SDP-woU, the other for impossible differential search. Applied to the MSX lightweight cipher, it yields a 7-round integral distinguisher (2^96 data) for MSX-128, key recoveries on 8 and 9 of 18 rounds at about 2^228 operations, and 1,984 seven-round impossible differentials. Both models are implemented in CLAASP.

MSXCLAASP
MSX-128monomial predictionthree-subset division property+5

otherΒ· Added 24 Oct 2026, published 21 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Verifiable Post-Quantum TLS Handshake: Recognizing Implementation Errors of Cryptographic Verification Steps

PQCD-TLS is a post-quantum TLS handshake that binds confirmation codes into chained key derivation, so a faulty signature or KEM verification step causes a key mismatch and handshake failure. The authors build confirmation-code frameworks for ML-DSA and Falcon signatures and for ML-KEM, HQC and DAWN, with unpredictability proofs. Across 48 configurations, handshake latency overhead stays below 1%.

TLSML-DSAML-KEM
goto failPQCD-TLSFalcon+3

AppSecΒ· Added 24 Oct 2026, published 21 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

SHAKEing SLH-DSA with Non-profiled SCAs

SHAKEing SLH-DSA with Non-profiled SCAs is an eShard ePrint paper (2026/2584) on correlation power analysis of SLH-DSA-SHAKE, the NIST-standardised hash-based signature scheme. It analyses PRF inputs and selection functions, then combines subtrace averaging, partial-then-total CPA and an efficient exhaustive search to recover the full secret seed, enabling universal forgery. On a 32-bit microcontroller the attack needs about 280 to 559 signatures, and the search finishes within 45 minutes on 72 cores.

SLH-DSASHAKEKeccak
NISTuniversal forgerySPHINCS+

Hardware & RFΒ· Added 24 Oct 2026, published 21 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Where AI Vulnerability Discovery Harnesses Go Quiet: Structural False Negatives and Hidden Vulnerabilities

Paper (arXiv, 21 October 2026) on structural false negatives in LLM vulnerability discovery harnesses. Starting from Knostic's OpenAnt and raptor, then 10 more open-source harnesses, the authors map 13 points where code selection, filtering, and finding storage or merging drop vulnerabilities. One file was dropped by six harnesses before the model saw it, five without notice. It covers attacker evasion, content-steered verdicts, prompt injection, and design principles and tests.

OpenAntraptorLLM
KnosticPtacek and Newshamprompt injection+1

AI Security, AppSecΒ· Added 24 Oct 2026, published 21 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Rounded Gaussians are Discrete Gaussians

Rounded Gaussians are Discrete Gaussians is an IACR ePrint paper (2026/2583) by Corentin Jeudy. It shows that setting the rounded Gaussian parameter to sigma = s - 1/(24s) gives a distribution within RΓ©nyi divergence 1 + O(1/s^8) of a discrete Gaussian of parameter s. Lattice schemes can then use the simple, constant-time-friendly, low-memory rounded sampler while analyzing security against an ideal discrete Gaussian.

RΓ©nyi divergenceCorentin JeudyHΓΌlsing, Lange and Smeets

otherΒ· Added 24 Oct 2026, published 21 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

SoK: Design-Level Backdoors in Block Ciphers Constructions, Detection, and Key Recovery

SoK on design-level backdoors in block ciphers. It places four published designs (Rijmen and Preneel, Paterson, Bannier and Filiol, Peyrin and Wang) in one taxonomy and gives a sound algorithm that recovers a partition trapdoor from S-box tables. It attacks KG-DES, BEA-1 and LowMC-M: KG-DES key recovery takes minutes, and the LowMC-M MALICIOUS backdoor yields the key from 35 to 409 queries. Trapdoors hidden in linear layers leave no trace, so the authors recommend deriving constants verifiably from a public seed.

KG-DESBEA-1LowMC-M+2
Rijmen and PreneelPatersonBannier and Filiol+5

otherΒ· Added 24 Oct 2026, published 21 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Table-Free Constant-Work BCH Decoding by Algebraic Index Elimination

Table-free constant-work BCH decoding by algebraic index elimination is an IACR ePrint paper (2026/2580) that replaces the table scans in Walters and Sinha Roy's constant-work BCH decoder with fixed circuits over public addresses. It proves correctness through radius t and trace regularity, removes 5.2 and 7.2 KiB of tables, and runs 35.7 to 82.4 times faster on an i7-13700. Ordinary C masks compiled to received-word-dependent branches under Apple Clang 21, so the authors use a compiler-opaque primitive and run timing screens on four platforms.

Apple ClangC
Walters and Sinha Royalgebraic index eliminationANSA-IBKEM1+3

Hardware & RFΒ· Added 24 Oct 2026, published 21 Oct 2026

arxiv.orgpaper🧠 AI

Protection Is Not One Event: A Survey of RAG Protection Research by Measured Endpoint

Protection Is Not One Event is a survey and human-coded evidence map of 118 RAG defense papers, grouped by measured endpoint into a seven-family taxonomy (kappa=0.867 across 32 annotators). It finds that only 17.8% of studies use content disclosure as their primary endpoint, and that most evaluations use general QA data and non-adaptive attacks. In a testbed on Qwen3-8B, an 8-gram guard cut copying to 0.0%, yet a three-query adaptive attacker still recovered 48.3% of hidden facts. Taxonomy, dataset, coding protocols and testbed are released.

RAGLLMQwen3
Qwen3-8BarXiv

research, evals, llm-appsΒ· Added 24 Oct 2026, published 21 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Protection Is Not One Event: A Survey of RAG Protection Research by Measured Endpoint

Survey and human-coded evidence map of 118 RAG defense papers, organized by measured endpoint across a seven-family taxonomy (content disclosure, formal privacy proxies, access control, corpus-use detection, pipeline integrity). Only 17.8% of studies use disclosure or reconstruction as the primary endpoint, and most use non-adaptive attacks on general QA data. A testbed shows a normalized 8-gram guard cuts 20-token copying to 0.0%, yet a three-query adaptive attacker recovers 48.3% of hidden facts on Qwen3-8B.

QwenLLM
prompt injection

AI SecurityΒ· Added 24 Oct 2026, published 21 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

PQ-Vault: Provably Quantum-Safe Asset Custody for Unmodified Ethereum

PQ-Vault is a custody design for unmodified Ethereum against quantum key recovery. It combines a quantum-safe vault contract, a proof-of-stake sidechain with compact certificates, and an optimistic dispute protocol. The paper proves that compact certificates with classically chosen parameters fall from 128 to about 60 bits against quantum attackers, and bounds a seed-update stake-steering attack. For 65,536 validators a certificate is 0.8 MB and verifies in about 20 ms, and the vault accepts a checkpoint for about 420,000 gas.

Ethereum
compact certificatesstake steering

BlockchainΒ· Added 24 Oct 2026, published 21 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Active and Passive Attacks against TPM 2.0-based Full Disk Encryption

Active and Passive Attacks against TPM 2.0-based Full Disk Encryption is an ePrint paper by Freud, Hein and Klein (BSI). It shows SPI bus sniffing and interception against discrete TPMs on a mini PC and a notebook, plus a prototype UEFI firmware attack in QEMU that affects firmware TPMs. The attacks break BitLocker and all current Linux FDE implementations, including those using TPM parameter encryption.

BitLockerLUKSTPM 2.0+3
parameter encryptionTPM sealingBSI+3

Hardware & RF, Offensive SecurityΒ· Added 24 Oct 2026, published 21 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

HAETAE on a Diet: Less Stack, Less Time on Low-End Microcontrollers

This ePrint paper presents an optimized HAETAE implementation, a lattice-based post-quantum signature scheme, for Cortex-M4, Cortex-M3, MSP430 and AVR. It keeps polynomials in 16 bits, shares buffers between objects with disjoint lifetimes, and replays Gaussian samples instead of regenerating them. On an ATmega2560, HAETAE-2 key generation, signing and verification run in 8,070 B of SRAM. Stack use drops up to 34% and signing is 1.18-2.51x faster than Low-Stack HAETAE.

HAETAEML-DSAARM Cortex-M4+3
Low-Stack HAETAEHAETAE-2CHES 2026

Hardware & RFΒ· Added 24 Oct 2026, published 21 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Reverse Engineering IVXV: A Specification and Security Analysis of Estonia’s Internet Voting System

Reverse Engineering IVXV is an October 2026 ePrint paper by Tingfeng Yu and Thomas Haines that reconstructs a specification of Estonia's IVXV internet voting system from public source code and documentation, with an executable TLA+ model checked in TLC. It analyses individual and universal verifiability, privacy, coercion resistance and eligibility, compares IVXV with Belenios and Swiss Post, and reports new vulnerabilities, some confirmed with proof-of-concept tests, plus mitigations.

IVXVTLA+TLC
EstoniaBeleniosSwiss Post+2

AppSecΒ· Added 24 Oct 2026, published 21 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

RDK-CKKS: A Framework for Rigorous Error Analysis for CKKS Computation

RDK-CKKS is a framework for rigorous probabilistic error analysis of CKKS homomorphic encryption. It injects randomization keys (encryptions of zero) at key-switching and rescaling so each operation's error has provable tail bounds, which noise flooding needs for IND-CPA^D and threshold settings. It gives a full rigorous analysis of binary bootstrapping, at about 3% extra modulus and 27% extra key communication over bootstrapping keys.

CKKS
IND-CPA^Dnoise floodingrandomization keys+1

otherΒ· Added 24 Oct 2026, published 21 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Broadcast and Trace from Lattices: Collusion-Resistant and Publicly Traceable

Broadcast and Trace from Lattices is a 2026 ePrint preprint by Jeffrey Champion. It builds collusion-resistant broadcast and trace with public tracing from attribute-based encryption with succinct ciphertexts and lockable obfuscation, both known from decomposed LWE. Ciphertexts are sqrt(N)Β·poly(Ξ», log N) in size, with poly(Ξ», log N) keys. It is the first such scheme based on a simple, instance-independent lattice assumption.

Jeffrey ChampionNassar, Waters and Wupositional witness encryption

otherΒ· Added 24 Oct 2026, published 21 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise

Paper on memory injection, where prompt injection persists across sessions through the long-term memory of LLM-as-a-service platforms. It presents a general threat model and shows all NIST attack goals are achievable on ChatGPT Instant 5.3, Claude Sonnet 4.6 and Gemini 3 Flash. Vectors include personal memories, projects, skills, organization instructions and MCP resources. On Claude, shared memory lets an attacker compromise multiple users in an organization and exfiltrate prompts. Nearly half of the derived mitigations are unimplemented.

ChatGPTClaudeGemini+2
memory injectionprompt injectionNIST+2

AI SecurityΒ· Added 24 Oct 2026, published 20 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

DISCO*: DIstributed and SCalable Oblivious Joins and Oblivious Primitives

DISCO is a distributed, fully oblivious database system that combines hardware enclaves (TEEs) with oblivious primitives to hide access patterns from side-channel and leakage-abuse attacks. New distributed frameworks and communication optimizations let it run in parallel across servers. It reports 88x speedup over Jodes and 180x over SODA on non-foreign-key joins with 2^25 elements, and the first terabyte-scale results.

DISCO
JodesSODASOSP 2026

Hardware & RFΒ· Added 21 Oct 2026, published 20 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Sign Here: Attributing a Source for a More Trustworthy Software Supply Chain

Sign Here is an arXiv paper (October 2026) testing whether building packages from source, instead of pulling from registries, prevents malware. It aggregates 47,066 malicious npm and PyPI packages from five datasets and indexes 3.9 million npm and 764 thousand PyPI packages. Checking for an attributed source blocks 87.7 to 99.9 percent of malware depending on vetting level, but only 47.4 percent of benign packages attribute a buildable source.

npmPyPI
Shai-HuludAxios

Supply ChainΒ· Added 24 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

UniWALM: Unified World Action Language Model for Embodied Robot Control

UniWALM is a unified world-action-language model that learns video, action and language in one mixture-of-transformers backbone with per-modality diffusion heads that co-denoise together. Generated subtask and textual memory are fed back on the next step, so no external planner or memory bank is needed. It adds Flow Matching with Correction (FMC) for recovery from perturbed actions. It reaches 34.5% on the memory-dependent RMBench subset, above Mem-0's 28.5%, and lifts real-world Find-the-Item success from 11.1% to 61.1%.

Mixture of Expertsdiffusion modelflow matching+1
UniWALMFastWAMMolmoSpaces+2

research, multimodalΒ· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

InterWebCoder: Learning Interactive Webpage Generation from Executable Tests via Reinforcement Learning

InterWebCoder is a framework for interactive webpage code generation by multimodal LLMs. It synthesizes self-contained webpages with executable test scripts from recorded interaction trajectories, repairs failures using runtime evidence, then trains with test-ID-weighted SFT and GRPO using test pass rates and visual similarity as rewards. The pipeline yields 1,736 verified samples from 2,058 tasks. A 9B model scores 48.54 on IWR-Bench and 48.42 on Vision2Web, and reward latency drops over 97%.

GRPOvision-language modelLLM
InterWebCoderIWR-BenchVision2Web+3

research, training, multimodalΒ· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

Benchmarking Arabic Dialects for Math Problems

DAR-MGSM (Dialectal Arabic Multilingual Grade School Math) is a manually curated benchmark for mathematical reasoning in Dialectal Arabic. It covers five major Arabic dialects plus Modern Standard Arabic, in a translated-only version and a translated and culturally localized version. Eleven Arabic-centric and multilingual LLMs were tested: accuracy generally drops on the localized version, and a mechanistic interpretability analysis shows the two variants induce distinct internal reasoning trajectories.

LLM
DAR-MGSMarXiv

evals, researchΒ· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

AgenticRoboRL: Bringing Coding-Agent Post-Training to Agentic Robotics

AgenticRoboRL is a framework for post-training robot planners across different harnesses, combining supervised fine-tuning with multi-turn reinforcement learning. Harness-specific adapters link recorded planner interactions to task outcomes, so one RL pipeline covers both VLA skill invocation and control-code generation. On LIBERO-PRO, a 9B planner rose from 18.1% to 71.0% without external memory, near Codex (GPT-5.5) with memory at 72.1%. Code and checkpoints are promised.

Codexvision-language-action model
AgenticRoboRLLIBERO-PROGPT-5.5+1

research, training, agentsΒ· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

Sage-A1.5: From Long-Horizon Execution to Scientific Exploration with Capability Composition

Sage-A1.5 is a 35B Mixture-of-Experts agentic model that builds on Sage-A1 for long-horizon problem solving. It adds three capabilities: orchestration with parallel subagents in isolated contexts, verification through progress checking, evidence validation and strategy revision, and open scientific discovery with inspectable research artifacts. The report shows them on complex agentic tasks and multidisciplinary science applications. The page gives only the abstract, no benchmark numbers.

Mixture of ExpertsLLM
Sage-A1.5Sage-A1arXiv

research, agents, modelsΒ· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

Cache Engineering for Agents

Cache Engineering for Agents proposes letting LLM agents control their active KV cache directly, using a drop operation to exclude cache from attention and repos to adjust retained keys' position encodings, without editing the trajectory or re-prefilling. The authors build the AKV serving engine to handle history-dependent cache states. A tool-response rolling-drop policy raises average benchmark scores by 1.7 points and cuts cost by 27.7% against threshold-triggered summarization. AKV gives up to 1.2x output throughput and 1.5x faster P95 latency.

LLMAKV
arXiv

research, inference, agentsΒ· Added 22 Oct 2026, published 20 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

A Spectral Theory of Local-to-Global Leakage

A Spectral Theory of Local-to-Global Leakage is an IACR ePrint paper (2026/2571) by Rei Ueno on additive secret sharing over finite abelian groups. It gives an exact leakage decomposition into local leakage magnitude and spectral alignment across shares. Two channels with identical local mutual information can have exponentially different global leakage. Automorphism-weighted sharing can cancel leakage perfectly with finitely many shares, which ordinary additive sharing cannot do.

Rei UenoMΓΆbius inversion

Hardware & RFΒ· Added 21 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

OptScientist: Automated Discovery of Optimization Laws

OptScientist is a framework that discovers compact symbolic optimization laws from data. It pairs a model that infers symbolic optimization problems with an LLM agentic system that uses literature priors, proposes candidate laws, abstracts mechanisms and suggests new data to collect. On OptFeynman, a new benchmark of 99 physics-derived problems, it recovers ground-truth laws for over 80%. It is also tested on human risky choice and central-bank monetary policy.

LLM
OptScientistOptFeynmanarXiv

research, agents, evalsΒ· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

Agentic Ensemble with Vision-Language Models for Visual Anomaly Detection

AnomalyAgent is a post-training fusion framework for visual anomaly detection that ensembles pretrained detectors. It aligns scores and anomaly maps, summarizes disagreement, and treats fusion as a choice among score actions and map actions. A constrained vision-language model inspects high-conflict samples and picks the actions. It beats equal-weight fusion and gets the best mean image AUROC and pixel AP among compared fusion methods on MVTec AD and VisA.

vision-language model
AnomalyAgentMVTec ADVisA dataset+2

research, multimodal, agentsΒ· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

Large Flow Language Models

Lafa (Large flow language model) is a blockwise continuous flow language model scaled to 8B parameters, with causal attention on the prefix and bidirectional, asynchronous flow within each block. It is adapted from pretrained autoregressive models and trained at 0.5B, 7B and 8B with under 30B tokens. A self-speculative decoding scheme verifies flow drafts autoregressively in one model, giving 2.54x the throughput of an AR model at comparable quality. Flow maps allow one- and few-step generation.

flow matchingdiffusion modelTransformer+1
Lafa

research, modelsΒ· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

Beyond 4 bits: Data-Centric Post-training Quantization and Recovery

This paper studies 2-bit post-training quantization (PTQ) of six dense and mixture-of-experts models from 3.8B to 32B parameters. It finds the quantization representation matters most: vector codebooks give usable models where scalar PTQ falls to chance. Calibration and recovery data must be chosen jointly. The recipe uses about 2.3 effective bits per weight, keeps 89 to 97% of full-precision QA accuracy, and needs 1.4 to 30x less compute than the strongest QAT baseline.

Mixture of ExpertsLLM
arXiv

research, inferenceΒ· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

Answering in the User's Variety: Calibrated Accommodation Pairs for Post-Training

Calibrated accommodation pairs (CAP) is a preference-data method that rewards chat models for matching a user's dialect density while keeping Standard English for Standard-English users. The paper traces SFT, DPO and RL stages across 10 open model lineages and finds post-training standardizes replies, while the DPO update still favours British and Australian spelling over AAE and Singlish. On a fully open model, CAP improves convergence on unseen features without added dialect for Standard-English users or lower instruction following.

DPOLLM
arXiv

research, training, evalsΒ· Added 22 Oct 2026, published 20 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Membership Inference in Privacy-Preserving Vector Search

Membership Inference in Privacy-Preserving Vector Search is an IACR ePrint paper (2026/2570) that attacks backend-compatible protections for embedding databases using one snapshot and known plaintexts. It breaks the Scale-and-Perturb scheme of Fuchsbauer et al. (advantage 0.997 on MS-MARCO) and analyzes Rotate-and-Perturb, ideal DCRE and an encrypted HNSW index. It also tests shuffling and secret projection as mitigations.

HNSW
Scale-and-PerturbRotate-and-PerturbSAP-I+5

AI SecurityΒ· Added 21 Oct 2026, published 20 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents

CarryoverBench is a benchmark of 12 personal-assistant scenarios and 101 attack tasks for carryover attacks, where a one-time indirect prompt injection planted in agent memory files or scheduled tasks re-fires in later sessions. Three trigger channels (Instant, Autonomous, Latent) are scored by a rule-based verifier with separate planting and triggering stages. Across five frontier models, payloads re-fire over five rounds without measurable decay. Porting the Latent channel to the Hermes runtime weakens the effect but does not remove it.

LLM
CarryoverBenchcarryover attacksindirect prompt injection+1

AI SecurityΒ· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

Code2Video-Compass: A Comprehensive Benchmark for General-Purpose Code-Based Video Generation across T2V, I2V, and V2V

Code2Video-Compass is a benchmark of 2,104 tasks for code-based video generation, where multimodal LLMs write executable programs that produce complete videos from text (T2V), image (I2V) or video (V2V) inputs. Tasks span 10 categories and 24 subtypes. Scoring uses 12 objective metrics and five MLLM-judge metrics. Across 15 proprietary and open-weight models from nine families, performance falls as construction, dynamic animation and state-dependency complexity rise.

vision-language modelLLM
Code2Video-CompassarXiv

evals, multimodal, researchΒ· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

DIVE: Benchmarking Full-Duplex Interaction with Visual Engagement in Continuous Streams

DIVE is a benchmark for full-duplex interaction with visual engagement in continuous audio/video streams. It has 525 human-annotated samples across six tasks in three scenarios: proactive intervention, continuous engagement and interaction coordination. Evaluated real-time models reach sub-second average latency, but window response rates stay at or below 53.77%, and adapting ongoing responses to new information is hardest.

MLLM
DIVEarXiv

evals, multimodal, researchΒ· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Context-Aware Prompt Injection Detection via Small Language Models in RAG Pipelines: nokast-secureRAG

nokast-secureRAG is a roughly 0.5B-parameter small language model that works as a semantic firewall between retrieval and generation in local RAG systems. It classifies each query and context pair as safe, suspicious or malicious. It reaches 0.994 recall at a 0.026 false-positive rate in-distribution, beating Llama Guard 3 1B and Prompt-Guard-86M (0.900 recall, 0.690 FPR). Recall on PoisonedRAG falls to near zero, and single-request latency is 293-404 ms.

Llama Guard 3LLM
indirect prompt injectionretrieval poisoningPoisonedRAG+2

AI SecurityΒ· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

DeclineCraft: A RAG Abstention Benchmark for Jointly Measuring Combined Retrieval and Parametric Knowledge

DeclineCraft is a dynamic RAG abstention benchmark whose unanswerable questions target Minecraft feature additions made after a corpus cut-off, with audits for parametric exposure. Across 27 LLMs, single-shot retrieval raises Correct Abstention Rate in 38 of 40 configurations, while iterative RAG lowers it in 30 of 40. Enabling thinking without retrieval lowers abstention for 8 of 13 models, shifting responses to premise denial.

RAGLLM
DeclineCraftMinecraftarXiv

evals, llm-apps, researchΒ· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

Is Sycophancy a Form of In-Context Updating?

"Is Sycophancy a Form of In-Context Updating?" argues that factual sycophancy, a model's deference to a user's false beliefs, is a failure of in-context updating rather than only a bid for approval. Models also revise answers for claims attributed to external sources, more so when better supported, and deference persists when no user approval is at stake. The internal components behind deference also matter causally for general updating, so reducing sycophancy may reduce useful updating.

LLM
arXiv

research, ai-safetyΒ· Added 22 Oct 2026, published 20 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Efficient NTRU+ Implementations on Cortex-M

Efficient NTRU+ Implementations on Cortex-M presents NTRU+ KEM implementations built on 3-way NTTs for Arm Cortex-M0+, M3, M4 and M7. It adds omega-folded front layers that handle ternary inputs without modular reduction. The speed-optimized version cuts execution time by up to 52.43% against the official optimized C code. The memory-optimized version cuts peak stack use by up to 82.60%.

Cortex-MNTRU+

Hardware & RFΒ· Added 21 Oct 2026, published 20 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

A Systematic Evaluation of Fault Attacks and Countermeasures on ML-DSA Rejection Sampling

Systematic evaluation of fault attacks on ML-DSA (FIPS 204) rejection sampling and of proposed countermeasures. It proves the "third rejection test" of patent WO2025261784A1 re-verifies what check 2 already guarantees, and shows that 30,000 fault injections never detect a skipped z-norm check. The author fully recovers s1 against a third-check-protected implementation under randomized signing. Third check and sign-then-verify are complementary; overhead is 0.04–0.05% on x86-64 and 0.83% on Cortex-M4 for the third check.

Cortex-M4
ML-DSAFIPS 204WO2025261784A1+1

Hardware & RFΒ· Added 21 Oct 2026, published 20 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Fault-Induced Nonce Repetition in Threshold Lattice Signatures: A Reveal-Structure Criterion, Cross-Scheme Analysis, and Detection Boundaries

Fault-Induced Nonce Repetition in Threshold Lattice Signatures is an ePrint paper (2026/2566, Yulong Meng) showing that faulting t devices in a t-of-n threshold ML-DSA deployment recovers the full signing secret, verified on Mithril with exact recovery in 96/96 scan groups. It gives a reveal-structure criterion across Quorus, TALUS and Trilithium, a threshold law m* = (β„“-1)N+⌈N/KβŒ‰ for imperfect faults, and two-layer transcript detection (305/305 hits, no false positives).

ML-DSA
MithrilQuorusTALUS+7

Hardware & RFΒ· Added 21 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

Reward Misspecification Degrades Chain-of-Thought Monitorability

This paper shows that reward misspecification alone degrades chain-of-thought (CoT) monitorability in language models. Using a testbed of paired true and misspecified rewards across three models and three tasks, CoTs keep reasoning about task intent while outputs hack the reward. The proposed reward description training injects an LM-inferred reward description into the input and raises monitorability by an average of 24% or 42% absolute, depending on the metric.

LLM
arXiv

ai-safety, training, researchΒ· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

A Multimodal Engineering GraphRAG Framework for Post-Wind-Event Building Assessment and Recovery Inference

This paper presents a multimodal engineering GraphRAG framework that links post-wind-event damage evidence from images and reconnaissance reports to building-condition states, recovery actions and downtime. Evidence is stored as a provenance-preserving, component-level representation, and graph-aligned retrieval uses compatibility, contradiction, evidence-precedence and abstention checks. Demonstrated on tornado-affected low-rise homes, it beats BaselineRAG and Structured Baseline RAG, and ablations test each component.

RAGGraphRAG
BaselineRAGStructured Baseline RAGarXiv

research, llm-apps, multimodalΒ· Added 22 Oct 2026, published 20 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Further Elaborations on the Provable Dual Attack

Further Elaborations on the Provable Dual Attack is an October 2026 ePrint paper by Kaveh Bashiri presenting a provable dual attack on LWE that recovers a subvector of the secret, with an explicit success-probability bound and no heuristic assumptions. It unifies the analyses of Pouly and Shen (EUROCRYPT 2024) and Bashiri and Wiemers (2025). Applied to ML-KEM it improves the first provable dual attack by 22 to 100 bits; it is also applied to ML-DSA and tested on small instances. The author states ML-KEM and ML-DSA are not threatened.

ML-KEMML-DSA
Pouly and ShenBashiri and WiemersQu, Tian, Wang, and Xu+1

otherΒ· Added 21 Oct 2026, published 20 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Regular Syndrome Decoding Is Easier Than Previously Estimated

Preprint by Jiseung Kim, Minkyu Kim, Changmin Lee and Hochang Lee on the Regular Syndrome Decoding (RSD) problem. It presents a hybrid-algebraic attack that balances zero-coordinate guesses and syndrome-based eliminations across regular blocks. Parameter sets in Ferret, Wolverine and committed VOLE fall below 128-bit targets by up to 67 bits, and the revised Liu et al. (EUROCRYPT 2024) PCG sets cost under 2^111 field operations.

Regular Syndrome DecodingFerretWolverine+4

otherΒ· Added 21 Oct 2026, published 20 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Regular Syndrome Decoding Is Easier Than Previously Estimated

Preprint 2026/2563 presents a refined hybrid-algebraic attack on Regular Syndrome Decoding (RSD) that balances zero-coordinate guesses and syndrome-based eliminations across all regular blocks. It puts at least one parameter set each from Ferret (CCS 2020), Wolverine (IEEE S&P 2021) and committed VOLE (CCS 2025) below the 128-bit target, with losses up to 67 bits. PCG attack costs improve by up to 29.77 bits (non-binary) and 25.91 bits (binary), and the revised Liu et al. (EUROCRYPT 2024) 128-bit sets fall below 2^111 field operations.

FerretWolverine
Regular Syndrome Decodinginformation-set decodingpseudorandom correlation generator+3

otherΒ· Added 21 Oct 2026, published 20 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Graphs and cycles in curve-based collision walks

Graphs and cycles in curve-based collision walks is an IACR ePrint paper (2026/2560) on van Oorschot-Wiener style collision attacks in the multi-user setting. It covers elliptic curve discrete logarithms and isogeny pathfinding on supersingular F_p^2 and F_p curves, and proposes new pseudorandom walks. For F_p^2 curves, L keys need about L + log(L) useful collisions with no infiltrator. For F_p curves, about 0.75L keys fall to L collisions with an infiltrator.

van Oorschot-Wienerisogeny pathfindinginfiltrator+1

otherΒ· Added 21 Oct 2026, published 20 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Raise or Check? Predicting the Necessity of Additional Fuzzing for Continuous Fuzzing

RAISE (Risk-Aware Intensive Supplemental Execution Framework) is a just-in-time framework that predicts which project-days introduce a vulnerability, to decide where to spend extra fuzzing. The dataset joins OSV vulnerability-introducing commits with OSS-Fuzz coverage data for 15 C/C++ projects (15,210 project-days, 347 positive). A Random Forest using VCCFinder static features plus fuzzing features reaches ROC-AUC 0.74. In a simulation over 968 vulnerabilities, Simple-Regression needed 91.60 extra fuzzing sessions per detected vulnerability, against 171.89 for the Median heuristic.

OSS-FuzzOSVC
RAISEVCCFinderPatchCoverage+1

AppSecΒ· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

KNOX: Hardware-assisted Regulatory Sandbox for Generative Models

KNOX is a regulatory sandbox for generative models that runs AI workloads inside trusted execution environments (TEEs). For agentic workloads, it derives an attested policy manifest from the user prompt (applicable regulations, expected tool calls, permitted system calls). An attested reference monitor checks each action against it, and an attested execution graph records every action and verdict. Overhead is under 1%.

trusted execution environmentLLM
KNOXarXiv

research, ai-policy, agentsΒ· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

KNOX: Hardware-assisted Regulatory Sandbox for Generative Models

KNOX is a regulatory sandbox for generative models built by running AI agent workloads inside TEEs. It derives an attested policy manifest (applicable regulations, expected tool calls, permitted system calls) from the user prompt, and an attested reference monitor allows an action only if it matches. Actions and verdicts go into an attested execution graph that regulators can verify. The paper reports detection of prompt-injection deviations and under 1% overhead.

LLM
prompt injectionattested policy manifestattested reference monitor+1

AI Security, GRCΒ· Added 22 Oct 2026, published 20 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

FN-DSA on Arm Cortex-M55: Revisiting a Floating-Point Lattice Signature with Native FP64 and Helium

FN-DSA on Arm Cortex-M55 is an ePrint paper presenting the first FN-DSA (NIST post-quantum signature) implementation on this core that reproduces the reference known-answer tests and runs in constant time. It uses the native FP64 FPU for signing and Helium (MVE) for NTT, key-generation FFT and Keccak, with SLOTHY rescheduling. Key generation, signing and verification are up to 1.23x, 1.93x and 1.30x faster than the reference, and four-signature batch verification up to 1.75x.

FN-DSAARM Cortex-M55Helium+2
NISTknown-answer tests

Hardware & RFΒ· Published and added 20 Oct 2026

huggingface.copaper🧠 AI

Into the Unknown: Benchmarking AI agents on open scientific research problems

Into the Unknown is a benchmark that gives an AI agent a science paper and an unpublished research direction, then asks it to write a follow-up paper. Scientists at US Department of Energy national laboratories supplied the directions and the conditions a submission must meet, which form the grading rubric. Nine frontier agents wrote 15 follow-ups each (135 total) across five domains. None met all conditions, and 114 failed an integrity check, mostly for claiming work never done or reporting numbers that contradict recorded evidence.

Into the UnknownUS Department of EnergyHugging Face

evals, agents, researchΒ· Added 20 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Energy Consumption of Post-Quantum Cryptography on Constrained and General-Purpose Architectures

Benchmark of the three NIST post-quantum standards, FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), measuring speed and energy for key generation, signing and verification. Tests ran on Raspberry Pi 1, Zero and 4 and on laptop hardware, using OpenSSL 3.5 and a FNIRSI FNB58 USB power meter. ML-KEM and ML-DSA match classical elliptic-curve cryptography, while SLH-DSA signing on 32-bit devices cost up to 243% more energy than on 64-bit.

OpenSSLRaspberry PiFNIRSI FNB58
ML-KEMML-DSASLH-DSA+5

Hardware & RFΒ· Added 20 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

Can It Actually Work? Synthesizing Functional CAD Mechanisms

FunCAD-Harness is a framework in which LLM agents design CAD mechanisms and revise them using physical simulation feedback. It turns abstract functional requirements into candidate-specific physical tests. The paper also introduces FunCADBench, a benchmark of 46 mechanism families with interdependent, multi-step operations. Experiments on frontier LLM agents show it exposes mechanical failures that visual inspection misses and raises functional success over standard simulation-augmented baselines.

LLM
FunCAD-HarnessFunCADBencharXiv

research, evals, agentsΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

OpenVLHarness: Real World Visual Agentic Tool-Use with Multimodal Memory

OpenVLHarness is a multimodal reasoning harness for MLLMs built on a capability layer (task-level tool interfaces plus evidence rendering) and persistent multimodal memory that stores images, structured data and web references as addressable artifacts. A coding interface runs generated programs over stored data. Across 22 benchmarks and eight backbones it adds 9.7-12.6 points over no-tool baselines, and GPT-6 Luna at medium effort beats Codex and Visual Sketchpad at maximum effort using at most 37% of their tokens.

vision-language modelQwen3-VLCodex+1
OpenVLHarnessKimi K3GPT-6 Astra+3

agents, multimodal, researchΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

Where is Physical RSI capability from? An Observational Scaling Law of LLM-as-policy

The paper introduces PhysRSI-eval, a five-axis metric for physical recursive self-improvement: first-attempt performance, efficiency, success, budget and improvement from failure. Several VLMs are tested on 18 manipulation tasks under a fixed interaction budget. It proposes the Physical Barrel Hypothesis and studies observational scaling. Workspace interventions show that removing history lowers late-round success, while frozen workspaces still help on unseen layouts.

vision-language modelLLM
PhysRSI-evalPhysical Barrel HypothesisarXiv

research, evals, multimodalΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

Same Simulation, Different Evidence: Where Retrieved Tool Output Costs LLM Agents Accuracy

This paper studies how keeping long tool output out of the context window, and reading it through a section index instead, costs LLM agents accuracy. Using the PHREEQC geochemistry simulator on 158 execution-verified multiple-choice items and 11,007 logged calls, GPT-5.1 and GPT-5.2 lose 11.3 and 7.9 points, while Claude Opus 4.6 and Sonnet 4.6 show no detectable cost. The authors name the failure evidence substitution: agents skip the report and misround from their own output files.

PHREEQCLLMClaude+1
USGSGPT-5.1GPT-5.2+4

research, agents, evalsΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

MemT-1.0: Towards Memory-Native Evolution

MemT-1.0 is a memory foundation model architecture that builds memory into model computation. It builds on Metis, uses Gated DeltaNet-2 for token-level memory updates within each turn, and adds Mixture-of-Storage to scale capacity. Training used 34B tokens in continued pre-training and post-training. MemT-1.0-Nano and MemT-1.0-Flash beat parametric memory baselines and stay competitive with retrieval methods. At 128K history, Nano gives about 1.86x inference speedup and 66x less persistent storage than a full-context KV cache.

Gated DeltaNet-2Mixture-of-StorageKV cache+1
MemT-1.0MemT-1.0-NanoMemT-1.0-Flash+1

research, models, agentsΒ· Added 21 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Registered ABE via Predicate Encodings, Revisited

Registered ABE via Predicate Encodings, Revisited is an ePrint paper by Junichi Tomida (October 2026) that gives a new definition of predicate encodings suited to registered attribute-based encryption. It yields the first Reg-ABE schemes for (non-)zero inner product and for conjunctions/disjunctions with O(log L)-size ciphertexts. It also gives a registered broadcast encryption scheme with O(log L)-size ciphertexts under the standard k-Lin assumption, not the generic group model.

Junichi TomidaHoeteck WeeZhu et al.+2

otherΒ· Added 20 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

ASTOR: Benchmarking and Improving Autoformulation for Soft-Constraint Optimization with a Formal Grammar

ASTOR is an inference-time framework that has an LLM map a natural-language decision problem to a grammar-guided abstract syntax tree, then deterministically compiles it into executable optimization code. The paper also introduces SoftOR, a benchmark of natural-language problems with soft constraints. On SoftOR, ASTOR has the best aggregate accuracy among comparable single-request and multi-agent LLM methods, and it stays competitive on hard-constraint-only autoformulation benchmarks.

LLM
ASTORSoftORarXiv

research, evalsΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

What Language Adds, and at What Cost: Four Controlled Probes of Pathology Vision-Language Models

This preprint grades evidence for pathology vision-language models and tests four claims with controlled probes on released checkpoints and public data. Stage-redacted report embeddings raise pooled C-index by 0.019 (progression-free interval) and 0.016 (overall survival) across 1,633 TCGA patients. Zero-shot prompting matches a linear probe. SlideChat scores 74.82% with the slide and 74.41% without it. Paraphrasing flips 8-23% of answers.

vision-language model
SlideChatSlideBench-VQATCGA

research, evals, multimodalΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

Scaling Parameter-Efficient Fine-Tuning for Brain Encoding

BrainLoRA is a parameter-efficient fine-tuning method that adapts multimodal backbones of up to 104B parameters to predict neural responses. It predicts multiple timepoints in one causal pass instead of sliding windows, and a multi-LoRA kernel trains many adapters on a shared backbone. Across nine backbones it improves encoding, and a 200+ model ensemble ranks first on the Algonauts post-challenge leaderboard.

LoRAQwen3Transformer
BrainLoRAQwen3-OmniAlgonauts 2025 Challenge+1

research, training, multimodalΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

Mise-en-Video: Fine-Grained 3D Control for Multi-Shot Video Generation

Mise-en-Video (MeV) is a multi-shot video generation framework where creators stage shots in 3D space and then generate the matching video. It combines hierarchical attention for multi-level narrative consistency with 3D-aware layout guidance for per-shot spatial control. The authors built a 160K-video dataset with hierarchical multi-shot texts and oriented 3D bounding boxes, and report gains over baselines in quality, consistency and subject controllability.

diffusion model
Mise-en-VideoMeVarXiv

research, multimodalΒ· Added 21 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaper🧠 AI

Analysis of an AI based code distinguisher

The paper analyses DeepDistinguisher, a transformer-like model that tells Goppa codes apart from random linear codes. Saliency maps and attention visualisation reveal a low-weight-row artifact in the random training instances that the model partly relies on. A pairwise-XOR rule inspired by minimum distance correlates strongly with the model's predictions, and the model loses most of its power on random matrices meeting both constraints. This suggests it exploits general combinatorial properties, not hidden algebraic structure.

Transformer
DeepDistinguisher

researchΒ· Added 20 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Analysis of an AI based code distinguisher

Analysis of DeepDistinguisher, a transformer model that tells Goppa codes from random linear codes. Using saliency maps and attention visualization, the authors find a low-weight-row artifact in the random training instances that the model partly uses. They propose a pairwise-XOR rule on generator matrix rows that correlates strongly with the model's predictions. On random matrices meeting the minimum distance and XOR constraints, the model loses most of its accuracy, so it exploits general combinatorial properties rather than hidden algebraic structure.

DeepDistinguisherGoppa Distinguisher problemGoppa code

AI Security, otherΒ· Added 20 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

TokenGate: Adapting LLMs for Fast and Memory-Efficient Prefill with Learned Token Pruning

TokenGate is a small drop-in component that adds end-to-end learnable token pruning to trained LLMs for long-context prefill. It uses token-gated attention, inspired by Mixture-of-Experts, to re-weight attention logits with token importance scores, which gets gradients through the non-differentiable top-K step. The authors report 1.4-11.3x faster time-to-first token and 1.5-3.4x lower peak memory with no accuracy loss, on Qwen3 and Qwen3.5.

TransformerQwen3Qwen3.5+2
TokenGatearXiv

research, inferenceΒ· Added 21 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Post-quantum commutative group actions from oriented superspecial abelian varieties

Castryck, Dina, Kutas and Lorenzon study the Shimura class group action on superspecial principally polarized abelian varieties with a CM orientation, as a post-quantum commutative group action for key exchange. They give tools to represent CM orientations through higher-dimensional isogenies and to compute the action in the restricted effective group action model. These rely on a CM version of Kani's lemma and a trick that often halves the ambient dimension. The paper also gives a method for finding oriented superspecial abelian surfaces and analyses obstructions to transitivity.

Shimura class group actionKani's lemmaIbukiyama-Katsura-Oort correspondence+5

otherΒ· Added 20 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

EpiLens: Lightweight RAG for Epidemiological Knowledge Acquisition

EpiLens is a lightweight, open-source retrieval-augmented generation package that applies a fixed retrieval template and output schema to every paper in a corpus and links outputs to source passages. On a corpus of 2,297 epidemiology papers, its classifier matches or exceeds supervised and zero-shot baselines on four tasks without task-specific training data, scored against 214 manual labels. It also compares model-based study shares across parameters and pathogens.

RAGLLM
EpiLensSARS-CoV-2mpox+1

llm-apps, researchΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

Which Model for Which Role? Cost-Efficient Pareto Recommendation for LLM Agentic Workflows

Cost-Coupled Gittins (CC-Gittins) is a multi-objective extension of cost-aware Gittins search that recommends Pareto-optimal model-to-role assignments for LLM agentic workflows. It exploits the coupling between evaluation and deployment cost, alternating between seeking higher quality and lower cost. On eight quality-cost matrices (two to five roles, up to 1,681 assignments), it recovers a substantial share of the true Pareto frontier at about 10% of exhaustive-evaluation cost, and most of it by 30%. Latency is tested as a third objective.

LLM
arXivCC-Gittins

research, agentsΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

Tandem: Serving Hybrid Linear-Attention GUI Agents on Mobile NPUs

Tandem is a runtime for serving hybrid linear-attention GUI agents on mobile NPUs. It saves recurrent state where consecutive prompts diverge, keeps most prefill on the matrix unit, uses a verification kernel that reads each weight block once, and releases NPU power votes between bursts. On a Snapdragon 8 Elite it cuts per-step latency 30% for text screen descriptions and 16% for screenshots, cuts energy per text step by 33%, and lowers loaded-model standby power from 0.76 to 0.22 W.

SnapdragonNPUhybrid linear attention
TandemSnapdragon 8 ElitearXiv

inference, agents, researchΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

The Development of Sycophancy in Language Models: Tracing Vulnerabilities from Pretraining to Post-Training

The paper traces sycophancy across 741 checkpoints from 30 open model lineages, from early pretraining to released models. It plants initial verdicts on moral scenarios and measures how far models follow a user's opinion or drop their answer under pressure. The behaviour usually exists before post-training, but which questions a released model yields on is set mainly during post-training. For TΓΌlu-3 8B, its own preference-stage checkpoint removes 85% of remaining prediction error, a sibling model only 19%.

LLM
TΓΌlu-3 8BarXiv

ai-safety, research, trainingΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Concerns in Benchmarking Jailbreaks: An Empirical Study of Attack Success Rates

This arXiv paper tests eight jailbreak attacks against three open-weight language models under three evaluation procedures. Low-resource language attacks score 96.0% mean ASR under keyword matching but 2.7% under a Qwen3 judge using StrongREJECT instructions. At Ollama's default temperature of 0.8, 100 samples of an unchanged request give 100% ASR by keywords and 50% by the judge. The authors recommend explicit success definitions, matched response budgets, validated evaluators and cumulative-failure reporting.

OllamaQwenLLM
StrongREJECTDeepInceptionattack success rate+1

AI SecurityΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

Concerns in Benchmarking Jailbreaks: An Empirical Study of Attack Success Rates

Concerns in Benchmarking Jailbreaks is an October 2026 arXiv study of eight jailbreak attacks on three open-weight models under three evaluation procedures. Low-resource language attacks score 96.0% ASR by keyword matching but 2.7% under a Qwen3 evaluator using StrongREJECT instructions. Attack rankings flip with attempt budgets, and 100 samples at Ollama's default temperature 0.8 give 100% ASR by keywords, 50% by the evaluator.

OllamaQwen3LLM
StrongREJECTDeepInceptionarXiv

evals, ai-safety, researchΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

HAF-VLA: Hierarchical Action Flow Framework for Humanoid Vision-Language-Action Control

HAF-VLA is a hierarchical action-flow framework that adapts a pretrained flow-matching vision-language-action model to humanoid whole-body loco-manipulation. It denoises a shared action space in stages: locomotion and head commands first, then waist refinement, then full-body manipulation. Learnable stage embeddings and cross-stage KV-cache conditioning carry dependencies between stages. The authors report gains over existing models on six real-world tasks.

flow matchingvision-language model
HAF-VLAarXiv

research, multimodalΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

Assisted Turbulence Modeling via Data Assimilation and Machine Learning for Turbomachinery Flows

This paper presents a hybrid framework for axial compressor flow that couples a Multi-Fidelity Ensemble Kalman Filter (MFEnKF) with machine learning. The filter merges PIV experiments with steady RANS and unsteady hybrid RANS/LES simulations. A neural network trained on the enriched data predicts Navier-Stokes volume forcing terms from velocity, velocity gradients and turbulent viscosity. A Mixture of Experts fixes local errors near blade tips, giving lower experimental discrepancy than baseline RANS.

Mixture of Expertsneural networkMulti-Fidelity Ensemble Kalman Filter+3
MFEnKF

researchΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

Mitigating Reward Hacking in Preference Reward Models with Evolving Penalties

Dynalize is a method that reduces reward hacking during online RL training against preference reward models. Periodically and asynchronously, a language model reads training rollouts and writes penalties for undesirable behaviors the reward model seems to reward, and a judge applies them to every rollout. In clinical counseling and creative writing it sustains longer training and improves external benchmarks, and the gains hold in multi-turn training and after reward model retraining.

LLM
DynalizearXiv

training, research, ai-safetyΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

Rethinking LLM Fine-Tuning via Weight Space Reparameterization: Preserving Safety during Downstream Adaptation

WSR-Tune is a fine-tuning framework that reparameterizes LLM weight matrices with a safety-conditioned basis, so safety-relevant information concentrates in a small set of directions. Those safety-critical directions are frozen, and the remaining complementary directions are updated for the downstream task. The authors report a better trade-off between downstream performance and safety retention. The page gives no benchmark names or numbers.

LLM
arXivWSR-Tune

research, ai-safety, trainingΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents

Fake News, Real Crashes is an October 2026 arXiv paper presenting a benchmark for information injection attacks on LLM financial trading agents. It spans five injection vectors, seven event categories and about 10,000 decisions on 15 U.S. stocks. Fabricated news reached 62% attack success versus 14% for prompt injection, and two 30-word templates hit 100%. Only hierarchical aggregation reduced success among the defenses tested.

LLM
information injectionprompt injectionfact poisoning+1

AI SecurityΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

E-Layout: Layout-Stage Logic Restructuring via RL-Optimized Equality-Saturated Graph Retrieval-Augmented Generation

E-Layout is an ML-driven framework for post-placement logic restructuring in IC physical design. It builds equivalent logic alternatives with e-graph equality saturation, links logic choice to physical realization through a graph-based RAG model, and refines the choices with reinforcement learning on design-level timing feedback. On 9 designs it gives about 6% TNS and 2% WNS improvement and 1% less area than a commercial physical design flow.

RAG
E-LayoutarXiv

researchΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

How Benchmark Graph Construction Shapes Multi-Hop KG Navigation: A Controlled Audit of PathQuestion and PathQuestion-Large

This paper audits the PathQuestion (PQ) and PathQuestion-Large (PQL) multi-hop knowledge-graph QA benchmarks as graph-navigation tasks. It holds questions, answers, path annotations and splits fixed, and replaces each released task-filtered graph with the larger source KG. Restoration cuts released-answer accuracy and trajectory fidelity for frozen small-language-model policies and trained MINERVA policies, and graph-consistent evaluation recovers only part of the loss.

MINERVA
PathQuestionPathQuestion-LargearXiv

evals, researchΒ· Added 21 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Concrete LDVR Attacks with Fewer Signers

Concrete LDVR Attacks with Fewer Signers is an ePrint paper by Renas Bacho on the low-dimensional vector representation (LDVR) problem behind adaptive security of threshold Schnorr. It combines a Chinese remainder theorem construction with a generalized birthday search to attack 488 signers with 173 corruptions over the Curve25519 scalar field, down from 5,020 signers. For adversarial evaluation points, it reaches optimal success probability and breaks 228 signers with 114 corruptions in 168.60 seconds.

Threshold SchnorrCurve25519SHA-512
LDVRgeneralized birthday attacksubset sum+4

otherΒ· Added 20 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

SHADE: Shrinkage via Halted Alpha-stable Denoising for Heavy-Tailed Probabilistic Time Series Forecasting

SHADE is an alpha-stable LΓ©vy diffusion forecaster that stops denoising at a nonzero depth, so the leftover stable kernel shrinks the predictive distribution instead of leaving it overconfident. It offers a scale-calibrated halt and a context-amortized halt that needs no noise labels. Median CRPS improves 21.7% on synthetic data with alpha at or below 1.3, with tail calibration gains on cryptocurrency and foreign-exchange series.

diffusion model
arXiv

researchΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

VibeTraining-Bench: Data-Trainer-Harness Co-Design for Iterative System Improvement

VibeTraining-Bench is a benchmark for cross-component co-design, where research agents iteratively refine training data, trainers and inference harnesses for a fixed starting agent system. Tasks cover terminal operation, software engineering, multi-turn tool use and math reasoning, with safeguards against reward hacking. On SWE-bench Verified, GPT-6 Astra raises the target system from 32.9% to 53.7%, against 55.4% for the human-developed instruct model.

Docker
VibeTraining-BenchGPT-6 AstraSWE-bench Verified+1

evals, agents, trainingΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

Large-Scale Biomedical RAG: Corpus Scaling, Document Representation, and Efficiency Trade-offs

This paper is a controlled, large-scale evaluation of biomedical Retrieval-Augmented Generation across growing corpus sizes. It compares abstract, flat full-text and hierarchical full-text representations, with and without reranking, on multiple-choice QA over five external benchmarks and a held-out test set. RAG gave mean gains of up to 9.6 points externally and 10.2-30.3 points on the held-out set. Hierarchical indexing used 67% fewer units and 44-56% less storage than flat full-text.

RAG
arXiv

research, llm-apps, evalsΒ· Added 21 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

CHARRM - Characterizing Hardware Leakage in the Robust Random Probing Model

CHARRM is a verification methodology for masked hardware circuits in the (g, t, c)-robust (p, Ξ΅)-random probing model. It extends leakage characteristics to glitch-extended and transition-extended robust probing on arbitrary circuit structures, and links them to the Set of Input Shares (SIS) function for composability notions. It outperforms IronMask on larger circuits and gives exact verification of larger composed circuits in case studies.

IronMask
Set of Input Sharesleakage characteristicrobust probing model

Hardware & RFΒ· Added 20 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Privacy with Leakage from Falsifiable Assumptions

Privacy with Leakage from Falsifiable Assumptions is an ASIACRYPT 2026 paper by Francesco Berti and Itamar Levi. It replaces simulatability with "secure refreshing", a key-refreshing assumption that evaluation laboratories can test directly, and adds "strongly protected secure refreshing". Using these, it proves privacy of the PSV encryption scheme without assuming a leak-free component.

PSV encryption schemesecure refreshingstrongly protected secure refreshing+4

Hardware & RFΒ· Added 20 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Evasive Inner Product Functional Encryption Is Broken Too

Evasive Inner Product Functional Encryption Is Broken Too is a 2026 ePrint paper by Agrawal, Modi, Yadav and Yamada. It gives a counterexample showing the evasive IPFE assumption of Hsieh, Lin and Luo (Eurocrypt 2024) is false in full generality. The attack extends the 2025 PRFE counterexample and needs only the weak inner product functionality, not pseudorandom function computation. The authors conclude that letting the adversary choose unrestricted private coins breaks the Evasive LWE family.

Evasive LWEEvasive IPFEPRFE+2

otherΒ· Added 20 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

New IND-CPA-D Attacks on BFV and BGV

New IND-CPA-D Attacks on BFV and BGV is an ACM CCS 2026 paper by Choe, Kang and StehlΓ© presenting three attacks on FHE schemes whose parameters rely on heuristic noise bounds. Two attacks recover the secret key and one breaks the IND-CPA-D game. Experiments use HElib for BGV and OpenFHE for BFV, where full key recovery takes minutes to hours.

BFVBGVOpenFHE+1
IND-CPA-Dbootstrapping failure attackCheon et al. CCS'24+3

otherΒ· Added 20 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

A Note on the Security of ECDSA with Presignatures or Biased Nonces

A Note on the Security of ECDSA with Presignatures or Biased Nonces (Couteau and Makriyannis, ePrint 2026/2545) examines alternative ECDSA modes built for faster distributed signing. It shows that the security of some variants used in deployed libraries is equivalent, in the generic group and random oracle model, to the average-case hardness of k-SUM. It also proves fine-grained lower bounds on generic group attacks against modes analyzed by Groth and Shoup (Eurocrypt 2022).

ECDSAk-SUMGroth and Shoup

otherΒ· Added 20 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Blind-DLPA: An End-to-End Framework for Profiled Blind Side-Channel Analysis

Blind-DLPA is a multi-task deep-learning framework for profiled blind side-channel analysis, where the attacker has labeled profiling traces but only leakage traces from the target, with no plaintexts or ciphertexts. It estimates Hamming-weight posteriors of an input and a key-dependent intermediate, then ranks key hypotheses against theoretical joint distributions. It recovers keys on unprotected AES and Kyber and on ASCAD (guessing entropy zero with 39 traces), and the authors report collisions in a prior Ascon Hamming-weight model.

AESKyberAscon
Blind-DLPAASCADprofiled blind side-channel analysis+4

Hardware & RFΒ· Added 20 Oct 2026, published 19 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

SpanGuard: Decoupling Instruction Localization from Authorization for Lightweight IPI Defense

SpanGuard is an indirect prompt injection (IPI) guardrail that splits detection into two steps. Lightweight unsupervised segmentation first locates candidate instruction blocks in tool outputs, then a small LLM judges whether each block is authorized by the user's request. The authors report a 0.32% attack success rate with negligible benign utility loss, and the guardrail still works with substantially smaller models.

LLM
indirect prompt injectionprompt injection

AI SecurityΒ· Added 21 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

A Key-Recovery Attack on the GTLN Knapsack Cryptosystem via Continued Fractions

This ePrint paper (2026/2543) gives a key-recovery attack on the GTLN knapsack public-key cryptosystem of GΓ³mez-Torrecillas, Lobillo and Navarro. Continued fractions recover small-denominator ratios of public-key differences, and gcd computations then yield private-key integers, the modulus and the shift, using only the public key. The Python implementation recovered the full private key in all 2,400 trials across 24 recommended parameter sets, each in under 0.05 seconds.

GTLN knapsack cryptosystemGΓ³mez-TorrecillasLobillo+1

otherΒ· Added 20 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

From if to Oops: Turning a conditional into a key-recovery oracle

The paper presents a fault attack on deterministic CSIDH and OSIDH-LD. Forcing the lane-selection mask to zero (for example by skipping one instruction) makes output changes reveal whether a secret exponent reaches a threshold. Binary search then recovers the full key in at most 297 queries for OSIDH-LD and 222 for deterministic CSIDH with CSIDH-512-sized keys. Full OSIDH-LD keys were recovered in software fault simulation, and a ChipWhisperer-Lite skipped the target instruction with probability at least 0.94. The authors argue fault resistance requires giving up determinism and propose randomization countermeasures.

CSIDHOSIDH-LDChipWhisperer-Lite
deterministic CSIDHCSIDH-512Houben+6

Hardware & RFΒ· Added 20 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Provable Lattice Reduction in Nearly the Time of QR Factorization

Provable Lattice Reduction in Nearly the Time of QR Factorization (IACR ePrint 2026/2541, October 2026) presents a deterministic lattice-reduction algorithm with running time Γ•(n^Ο‰(1+log ΞΊ_col(B))), free of heuristic assumptions. Its implementation used fewer instructions than flatter (CRYPTO 2023) in all 153 runs on q-ary, NTRU-like, scaled q-ary and Coppersmith inputs. Median flatter-to-new instruction ratios are 1.55 for q-ary and 1.86 for NTRU-like inputs.

flatter
CoppersmithLLL

otherΒ· Added 20 Oct 2026, published 19 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

RAGLeak: Supply-Chain Privacy Backdoors in Retrieval-Augmented Generation

RAGLeak is a supply-chain privacy backdoor attack on retrieval-augmented generation. When triggered, the backdoored generator reversibly obfuscates retrieved private documents, and an auxiliary LLM recovers them. Tested on three model families and three domains, it reaches up to 100% attack success rate, loses at most 10 points under detection-based defenses, and survives clean fine-tuning and changes of model scale and version. Source code is released.

LLM
RAGLeak

AI Security, Supply ChainΒ· Added 21 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Efficient and Compact High-order Masking Raccoon on Memory Constrained Devices

The paper presents the first efficient, compact implementation of high-order masked Raccoon (lattice-based signature, CRYPTO 2024) on ARM Cortex-M4, up to 32 masking orders. It uses 3+3+3 layer-merged 32-bit NTT/INTT with lazy reduction, a negative double Montgomery reduction, and one-shot SHAKE256 sampling (at least 1.80x faster). It beats the reference by 1.85x-2.25x and masked Dilithium3 at orders 2, 4 and 8. Second-order leakage tests show DPA resistance once micro-architectural transitional leakage is mitigated.

ARM Cortex-M4SHAKE256
RaccoonDilithium3differential power analysis+5

Hardware & RFΒ· Added 20 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Optimizing HQC with Enhanced Parallel Binary Polynomial Multiplication on GPUs

This paper presents an end-to-end GPU implementation of the HQC code-based key encapsulation mechanism. It speeds up GF(2) polynomial multiplication with a parallel Frobenius additive FFT and a Toeplitz matrix-vector mapping onto INT1 tensor cores. On an RTX 4090 the multiplier reaches 3,828k polymul/s, about 2.9x the earlier HIGH implementation. Full KEM throughput is 1.56x, 1.55x and 2.03x higher for keygen, encaps and decaps. Five thread-to-KEM mapping variants are tested on RTX 3090 and Jetson AGX Orin.

HQCCUDANVIDIA RTX 4090+1
HIGHFrobenius additive fast Fourier transformReed-Muller/Reed-Solomon coding+2

otherΒ· Added 20 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

SAT and Neural Network Filters for Misinjections in Fault Attacks

This ePrint paper presents key-independent filters that remove misinjections (faults that miss the assumed form) in elimination fault attacks. A SAT filter, a neural network filter and a combined filter were tested on clock-glitch faults into GIFT-64, GIFT-128 and BAKSHEESH on a microcontroller. The SAT filter rejected none of 14669 intended faults, and raised ToFA success on BAKSHEESH from 5.2% to 61.2% (96.2% combined).

GIFT-64GIFT-128BAKSHEESH
ToFAclock glitchingmisinjection+1

Hardware & RFΒ· Added 20 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

How Effectively Do Security Skills Guide Coding Agents in Vulnerability Detection in Linux Kernel?

The paper is a large-scale study of 37 security skills run through Claude Code with four LLMs on 100 real Linux kernel vulnerabilities, 14,800 runs in all. Only 24.4 percent of runs found the correct function and 15.7 percent classified the vulnerability correctly. It proposes SKILL-SIF, which evolves skills from failure patterns and raised fully correct detection on 100 unseen vulnerabilities from 2 to 16 percent.

Claude CodeLinuxLLM
SKILL-SIF

evals, coding-agents, promptingΒ· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

How Effectively Do Security Skills Guide Coding Agents in Vulnerability Detection in Linux Kernel?

Empirical study of 37 security skills run through Claude Code with four LLMs on 100 real Linux kernel vulnerabilities across ten classes (14,800 runs). 24.4% of runs found the correct function, 18.3% the function and statement, and 15.7% the vulnerability class. The authors propose SKILL-SIF, which evolves skills from failures and raised fully correct detection on 100 unseen vulnerabilities from 2% to 16%.

Claude CodeLinux kernelLLM
SKILL-SIF

AI Security, AppSecΒ· Added 21 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

IISFA: Ineffective Instruction-Skip Fault Attacks on Bitslice Implementations

IISFA (Ineffective Instruction-Skip Fault Attack) targets bitsliced block cipher implementations protected by redundancy countermeasures. Skipping one bitslice instruction leaves the result unchanged only when all m S-box inputs fall in an ineffective set, so each released ciphertext restricts all m subkeys. The authors give known- and chosen-plaintext key-recovery procedures and expected injection counts, and recover keys in every trial on GIFT, SKINNY and PIPO implementations on an 8-bit AVR microcontroller using clock glitches.

AVR
IISFAineffective fault analysisstatistical ineffective fault attack+6

Hardware & RFΒ· Added 20 Oct 2026, published 19 Oct 2026

huggingface.copaper🧠 AI

Self-evolving Agent Harness

Self-evolving Agent Harness is a 66-page survey and theory paper on revising an agent's scaffolding (prompts, memory, workflows, tools, code, plugins) while model weights stay fixed. It frames search as evolutionary optimization and uses continual PAC-learning to derive a generalization bound, a retention bound and a high-probability admission rule with fresh validation data. It separates selection, activation, attribution and improvement as evaluation claims, and covers applications and governance. Code is at github.com/zgcagi/Harness-RSI.

LLM
Harness-RSIHugging Face

agents, research, evalsΒ· Added 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Off-Key: Inconsistent MAC Keys Compromise Privacy in SPDZ-Family MPC

Off-Key is a privacy attack on SPDZ-family maliciously secure MPC protocols that exploits inconsistent MAC keys. Depending on the MAC check protocol, a corrupted party recovers a shared secret from one authentication check or tests guesses through selective failure. The authors show it in MP-SPDZ, SCALE-MAMBA and FANNG-MPC, where a corrupted party can use different keys across batches, threads or runs, and describe the preprocessing state that enforces key consistency.

MP-SPDZSCALE-MAMBAFANNG-MPC
Off-Keyselective failureMAC key inconsistency+1

otherΒ· Published and added 19 Oct 2026

eprint.iacr.orgpaper🧠 AI

HERMES: High-Performance Private Decoding for Large Language Models

HERMES is a privacy-preserving inference (PI) system optimised for multi-token LLM decoding rather than prefill. It swaps high-round nonlinear protocols for compute- and bandwidth-heavy ones with fewer rounds, and adds a homomorphic-encryption matrix-multiplication protocol that keeps the KV cache encrypted on the server and uses grouped-query attention. On Llama 3.1 8B Instruct it cuts TPOT by up to 2.7Γ— and total PI latency by up to 2.1Γ—.

LlamaLLMTransformer+1
Llama 3.1 8B InstructHERMES

research, inferenceΒ· Added 19 Oct 2026, published 18 Oct 2026

arxiv.orgpaper🧠 AI

Hybrid Reasoning Agents: LLM agents that think in latent space, act through text

Hybrid Reasoning Agents (HybridAgents) are LLM agents that switch between latent reasoning and text-based interaction in one generation process. A lightweight HybridLink handles mode transitions, continuous working memory keeps hybrid context across turns, and HybridSFT plus HybridRL train when to think latently and when to act in text. Across 3 model scales and 11 benchmarks, the paper reports 10.4% higher performance, 35.5%-54.7% fewer tokens, and 1.8x-2.6x faster inference.

LLM
HybridAgentHybridLinkHybridSFT+2

research, agents, trainingΒ· Added 19 Oct 2026, published 18 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Computing endomorphisms of superspecial principally polarized abelian surfaces in time and memory \(p^{4/5+o(1)}\)

Computing endomorphisms of superspecial principally polarized abelian surfaces is a cryptanalysis preprint by Marc Houben and Lam L. Pham, posted to IACR ePrint in October 2026. It gives an algorithm that, under a standard heuristic, finds a non-scalar polarized endomorphism in expected time and memory p^(4/5+o(1)). The abstract is the only text available, so the method and its effect on specific schemes are not described.

Marc HoubenLam L. Pham

otherΒ· Added 19 Oct 2026, published 18 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Revisiting the Security of VDOO

Revisiting the Security of VDOO is an ePrint paper (October 2026) on VDOO, a multivariate signature scheme submitted to China's NGCC program. It models VDOO as a multilayer Rainbow construction, keeps only the last oil space to get a generalized UOV instance, and applies wedge attacks. For the 512-bit parameter set it estimates 2^432 gates (reconciliation) and 2^379 gates (intersection), below the claimed level and the specification's figures.

VDOORainbowUOV
NGCCwedge attackreconciliation attack+1

otherΒ· Added 19 Oct 2026, published 18 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

How Secure are NTRU+ Keys? Analysing the Best Module Attacks

ePrint 2026/2527 by Paola de Perthuis and Filip Trenkić analyses module-BKZ attacks on NTRU+, the South Korean KEM standard. It introduces relative canonical and coefficient embeddings and shows they agree up to scaling exactly when rad(c)/rad(ℓ) is 1 or 2. Simulation-based estimates show the best module attack saves 4 to 10 blocksizes, costing NTRU+ keys at most three bits of Core-SVP security. NTRU+ parameters stay safe in the overstretched regime.

NTRU+BKZ
Core-SVPoverstretched NTRUPaola de Perthuis+1

otherΒ· Added 19 Oct 2026, published 18 Oct 2026

anthropic.compaper🧠 AI

How employment is changing at Anthropic

"How employment is changing at Anthropic" is an October 2026 technical report by Nathan Wilmers, Regina Catipon, Maxim Massenkoff and Peter McCrory. It uses internal employment, agent telemetry, output, survey, calendar and hiring data plus 17 interviews. Junior technical hiring fell from 27% to 9%, agent hours reached six times employee hours by August 2026, and adopters' output rose. Employees increasingly do meta-work managing agents.

ClaudeClaude CodeSlack+1
AnthropicNathan WilmersRegina Catipon+5

ai-policy, agentsΒ· Added 19 Oct 2026, published 18 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

SoK: PIAtlas: Decomposing the Unbounded Prompt Injection Attack Space

PIAtlas is a taxonomy of prompt injection attacks organized by how the injected instruction subverts the model, with six mechanism classes as roots of a technique and sub-technique hierarchy. The authors release PICorpus, a license-clean collection of public prompt-injection datasets, and map thousands of records to PIAtlas under a human-verified protocol. Results show attacks combine several techniques from few mechanisms, agent benchmarks cover only part of the space, and adaptive attackers favor mechanisms that curated benchmarks underrepresent.

LLM
PIAtlasPICorpusprompt injection

AI SecurityΒ· Added 21 Oct 2026, published 18 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Enjoy FAEST on Hardware: Efficient and Novel Hardware Acceleration of Emerging Post-Quantum Digital Signature Scheme FAEST

This ePrint paper (2026/2525, October 2026) by Brendan Funk and Jiafeng Xie presents the first hardware accelerator for FAEST, an MPC-in-the-head post-quantum signature in NIST's Round 3 additional-signature process. It analyses FAEST's compute-heavy operations, builds them into hardware blocks, and adds an L1-EM-fast variant. The authors report at least 98% lower equivalent area-delay product than the recent complete SDitH design at the same security level.

FAESTFPGA
NISTSDitHMPC-in-the-head+2

Hardware & RFΒ· Added 19 Oct 2026, published 18 Oct 2026

arxiv.orgpaper🧠 AI

ToFu: Exploiting and Fuzzing the LLM–Orchestrator–Tool Trust Boundary

ToFu is a tool-aware fuzzing framework for LLM tools, including MCP servers. It maps each tool argument, using its metadata, to one of 74 CWE-guided semantics-aware sanitizers (path, URL, SQL and similar). It then generates schema-valid Atheris harnesses and semantic oracles, using runtime tracers for in-process tools and outcome oracles for opaque ones. The LLM (gpt-4.1) only maps sanitizers and writes seeds; it is never the security judge. The paper also shows a "Repeat-After-Me" trick, where an LLM told to repeat attacker-crafted text emits a tool call the orchestrator executes, reproduced on LangGraph, MAF, ADK 2.0, AutoGen, Strands and CrewAI. Across 273 runnable MCP servers (3,405 tools) it reports 253 verified bugs in 343 tools across 118 servers, such as path traversal, log injection and exfiltration. These are failures a crash-based fuzzer would miss. The result matters because it shows LLM-generated tool arguments cannot be treated as trusted.

Model Context ProtocolAtherisCodeQL+7
ToFuStrandsMAF+10

mcp, research, agentsΒ· Added 18 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

GKS FHE: Security Analysis

"GKS FHE: Security Analysis" is a Cryptology ePrint Archive preprint (2026/2523, October 2026) giving a formal security analysis of the Gribov-Kahrobaei-Shpilrain private-key fully homomorphic encryption scheme. The abstract says the scheme needs no bootstrapping or de-linearization, gives bit-exact decryption, supports native encrypted search and has unbounded depth. The page shows only the abstract, so the analysis's methods and results are not visible.

GKS FHE

otherΒ· Added 19 Oct 2026, published 18 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

ToFu: Exploiting and Fuzzing the LLM–Orchestrator–Tool Trust Boundary

ToFu is a tool-aware fuzzing framework that derives semantic security checks for LLM tools (mainly MCP servers) from their metadata and a corpus of 74 CWE-guided sanitizers. It generates schema-valid Atheris harnesses, uses runtime tracers and outcome oracles to catch bugs that don't crash, and uses an LLM only to map sanitizers and seed inputs, never as the judge. It also describes a "Repeat-After-Me" attack, in which the LLM is told to repeat attacker-written text that the orchestrator then dispatches as a tool call. It was reproduced on LangGraph, MAF, ADK, AutoGen, Strands and CrewAI. On 273 MCP servers it reports 253 verified bugs across 343 tools in 118 repositories, including path traversal, log injection, exfiltration and command bypass.

Model Context ProtocolAtherisLangGraph+3
Repeat-After-Mepath traversalSSRF+6

AI Security, AppSecΒ· Added 18 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

The One-Pixel of Reasoning: One Truthful Relation Is Enough to Mislead LLM Agents

The One-Pixel of Reasoning introduces the one-relation attack (ORA), which finds a critical implicit warrant linking evidence to a conclusion and inserts one source-grounded sentence that qualifies it, steering an LLM agent to a wrong belief. Across eighteen models on biomedical inference and vulnerability detection, best-of-10 attacks flip initially correct answers 54.9% of the time for proprietary models and 80.0% for open-weight models. Attacks transfer without victim feedback, can pass source-support checks, and multi-agent debate raises team error from 50.0% to 59.5%.

LLM
one-relation attackORAimplicit warrant

AI SecurityΒ· Added 21 Oct 2026, published 17 Oct 2026

ethereum-magicians.orgpaperπŸ›‘οΈ Security

Post-Quantum Stateless Steganography & MTU Bounds: Bridging P2P Censorship Resistance to Quantum Networks

Forum announcement of a Zenodo preprint on post-quantum migration for censorship-resistant P2P steganographic tunnels. It argues that ML-KEM's prime modulus (q=3329) makes naive bit-packed ciphertexts statistically distinguishable from uniform noise, which gives a cheap passive DPI distinguisher. It also argues that composite PQ 0-RTT envelopes over 4.4 KB force fragmentation, which requires stateful reassembly before AEAD verification and reopens memory-exhaustion DoS in eBPF/XDP filters. Proposed fixes are algebraic uniformization (LWR lattices or inverse rejection sampling), sub-MTU hybrid or pure-PQ envelopes (Falcon-512, signcryption), and Fujisaki–Okamoto implicit rejection for constant-time silent drops. Aimed at Ethereum validator, libp2p and RPC transports facing harvest-now-decrypt-later threats.

eBPFXDPlibp2p+1
ML-KEMML-DSAHarvest-Now-Decrypt-Later+8

otherΒ· Published and added 17 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Superspecial points on Humbert surfaces and the probability of (N,N)-splitting

Determines, to first order in 1/p with an explicit error bound, the proportion of superspecial principally polarized abelian surfaces over F_p-bar (p ≑ 3 mod 4) that are optimally (N,N)-split. The expected number of optimal splittings is exactly 5NΒ·J_2(N)(p-1)/(pΒ²+1), so the split proportion is about 5NΒ·J_2(N)/p. This gives the stationary target density of the splitting-detection attack on the dimension-two superspecial isogeny problem, which was previously known only from experiments or a one-sided bound. The proofs use Siegel's mass formula and genus averages over refined Humbert invariants, and every formula was checked by exact computation at twelve primes.

splitting-detection attackRichelot random walkHumbert surfaces+3

otherΒ· Published and added 17 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Efficient Fixed-Point Implementation of Mitaka

Presents a fixed-point C implementation of the Mitaka signing algorithm, a simpler, parallelizable Falcon (FN-DSA) variant. It replaces MitakaZ's wide integral Gram root decomposition with a fixed-point square Cholesky decomposition, which cuts the cost of integer Gaussian sampling, and proves bounds on intermediate values and representation errors without empirical assumptions. Signing averages 361 kcycles (Mitaka-512) and 707 kcycles (Mitaka-1024) on AVX2, and 4.0 and 7.8 Mcycles on an STM32F411 Cortex-M4F. This makes floating-point-free lattice signatures practical on constrained devices.

MitakaFalconC+1
MitakaZFN-DSAGaussian sampling+1

otherΒ· Published and added 17 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

DPA-style Attacks on VOLE-in-the-Head Signature Schemes

Presents the first DPA-style power side-channel attack framework against VOLE-in-the-Head signature schemes, targeting the secret witness whose recovery enables forging signatures on arbitrary messages. It analyzes leakage from sensitive intermediate values in VOLE correlations and proposes six attack classes (two vertical, four horizontal) on FAEST and SDitH, both in NIST's third round of additional signatures. Attacks are validated with simulated leakage under varying noise and real measurements on three ARM Cortex-M4 devices.

ARM Cortex-M4
FAESTSDitHNIST+2

Hardware & RFΒ· Published and added 17 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Associated-Data Correlations in Eevee: Deterministic Forgeries against Nonce-Misuse Security

Cryptanalysis of the Eevee forkcipher-based AEAD modes Umbreon and Espeon, which claim online AE security under nonce reuse. Associated-data correlations give probability-one non-empty-message forgeries with three encryption queries and one verification query. The paper adds an affine treatment of partial final blocks (n-r+3 queries, or n-r+2 with adaptive choices). It also checks the published Umbreon attack with the official ForkSkinny primitive and reports a two-query attack accepted by the unmodified public C modes.

EeveeForkSkinnyC
UmbreonEspeonnonce misuse

otherΒ· Published and added 17 Oct 2026

huggingface.copaper🧠 AI

OpenGCUA: Toward a Fully Open Stack for Generalist Computer Use

OpenGCUA, from Alibaba's MAI-UI team, is an open stack for generalist computer-use agents (GCUAs), where the model chooses how to observe, act and organize work across GUI, accessibility-tree, API and shell interfaces. Its design combines code execution (GUI actions written as programs with loops and branches) with harness-to-model decision transfer. On OSWorld-v2 it raises mean partial score by +19.6 points across eight models, including GPT-6 Astra and Claude Opus 5, and cuts reported steps per task by 53%. The release includes the harness, prompts, evaluation trajectories, a macOS real-device harness, a cross-device SDK and an interactive lab. It also shows large efficiency gaps between models: Qwen3.8-Max used 19.4x the reasoning tokens of GPT-6 Astra on real macOS tasks.

macOSGitHubHugging Face
OpenGCUAMAI-UIAlibaba+6

agents, research, evalsΒ· Added 17 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

RATION: Towards Quantitative Risk-Based Access Control for AI Agents

RATION is a security framework for AI agents that tracks measurable risks from agent actions and enforces quantitative constraints during task execution, instead of simply restricting actions. It builds a task-specific policy from explicit constraints in the user request plus implicit risks calibrated from historical runs of similar tasks. Experiments on four security benchmarks show strong security with high task utility across models and environments.

LLM
indirect prompt injectionRATION

AI SecurityΒ· Added 21 Oct 2026, published 16 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Zippel: A Language, Compiler, Runtime, and Analyzer for ZK Proof Systems

Zippel is a language, compiler, runtime and analyzer for writing zero-knowledge proof systems in syntax close to the pseudocode in cryptography papers. Its type system and runtime remove vulnerability classes by construction, for example by synchronizing transcripts automatically and applying the Fiat–Shamir transform correctly. Its static analyses check completeness and soundness from the protocol description alone. The authors implemented 35 proof systems, including Sumcheck, Schnorr, KZG, Groth16, Bulletproofs, Hyrax, Spartan, Dory, HyperPlonk, DeKART and Pari. They report performance competitive with hand-written multi-core implementations.

ZippelRust
Fiat–Shamir transformSumcheckSchnorr+9

AppSecΒ· Added 17 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

AI-Driven Reproducibility and Analytical Robustness in Scientific Discovery

SEER-Repro is a benchmark of 20 published papers based on the SEER cancer registry, with the data needed to reproduce their findings. An LLM agent reproduces 77.4% of 2,190 atomic claims. A second agentic pipeline finds alternative analytical choices and reruns the analyses, flagging potentially consequential choices in 9.5% of fully reproduced findings for expert review.

LLM
SEER-ReproSEERSurveillance, Epidemiology, and End Results+1

research, evals, agentsΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

Acceptance Is Not Speed: Length Inflation in Training-Free Lossy Speculative Decoding

This paper shows that training-free relaxed (lossy) verification in speculative decoding causes length inflation: completions get longer, mostly through extended reasoning traces, which offsets gains in accepted tokens per round. Across twelve target-drafter pairs, relaxed rules accept 1.34x as many tokens per round but produce 1.54x longer completions. Rules that cut verifier rounds usually lose substantial accuracy, so the authors argue completion length and verifier rounds must be reported.

LLM
arXiv

research, inference, evalsΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

FuTransformer: FP8 prefill and INT4 decode for Llama-style inference on Hopper

FuTransformer is a CUDA implementation of a Llama-style Transformer block for NVIDIA Hopper GPUs. It uses FP8 prefill with fused GEMM epilogues and INT4 weights plus an INT4 KV-cache copy for decode, with a block-diagonal Hadamard transform to cut cache quantization error. On one H100, prefill is up to 1.48x faster than compiled PyTorch FP8, and INT4 decode is 1.3-2.4x faster than the faster PyTorch baseline. Llama-3.1-8B decode takes 2.8 ms per step at batch one, versus 8.1 ms for compiled transformers. WikiText-2 perplexity rises from 6.24 to 7.23 with round-to-nearest INT4 weights, or 6.99 with GPTQ.

CUDAPyTorchTransformer+2
NVIDIACODALlama-3.1-8B+5

inference, researchΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

DLite: History-free Speculative Decoding for Agentic AI

DLite is a history-free speculative decoding framework for agentic LLM workloads. It reuses the target model's contextual hidden states and predicts locally without keeping the draft model's historical KV cache, which avoids the up to 80% acceptance-length drop seen with long, multi-turn contexts. A lightweight sequential head restores intra-block causal dependencies, and a two-stage training strategy is used. It reaches 2-6 acceptance length and beats DSpark by up to 70%.

LLM
DLiteDSparkarXiv

inference, researchΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

TileDRAM: Compiler-Controlled Tile-to-DRAM Layouts for 3D DRAM GPGPUs

TileDRAM is a compiler-runtime toolchain that adds tile-to-DRAM layouts as a compiler-visible abstraction for compute-unit-local 3D DRAM GPUs. It extends GPU Linear Layout to DRAM placement and picks layouts per tile access signature using row-buffer behavior. On 108 MoE FFN cases in Accel-Sim/Ramulator2, row-conflict rate fell from 75.7% to 15.2%, with a 1.77x geomean speedup. Overhead on an RTX 3090 is 0.17%.

Mixture of ExpertsCUDAAccel-Sim+2
TileDRAMRTX 3090

research, inferenceΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

GLOBE: Evolving Structured Agentic Memory for E-commerce Product Optimization in Generative Search

GLOBE is an agentic framework that optimizes e-commerce product listings for generative search by storing strategies in an evolving handbook of explicit, field-scoped behaviors. An Editor applies behaviors and gets rank-based feedback, a Reflector turns it into updates, a Moderator removes redundant proposals, and a Curator commits changes. Harmful behaviors are deactivated. Structured behaviors beat monolithic prompt optimization and transfer to unseen product categories.

LLM
GLOBEarXiv

agents, researchΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

FedRAPP: Federated Test-Time Prompt Tuning for Vision-Language Models with Reliability-Aware Prompt Personalization

FedRAPP is a personalized aggregation framework for Source-Free Federated Test-Time Prompt Tuning (SF-FTTPT), where clients adapt CLIP soft prompts on unlabeled, non-IID test streams without source data. It combines reliability-aware client assessment, a server-side exponential moving-average prompt memory and similarity-guided peer aggregation. Across nine CLIP benchmark datasets and ImageNet variants it beats standard federated aggregation baselines while keeping prompt-only efficiency.

CLIPvision-language model
FedRAPPImageNetarXiv

research, multimodalΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

HardEval: An Execution-Verified Benchmark for AI-Driven Security Hardening and Compliance Remediation

HardEval is an execution-verified benchmark for language-model security hardening, built from Red Hat Enterprise Linux 8 STIG controls that fail on an unhardened baseline. Models receive only the required security outcome and write a Bash script, which runs on a live VM and is graded fail to pass with OpenSCAP/OVAL checks. Fourteen frontier and open-weight configurations show uneven results across domains, with plausible code that misses the exact compliance condition. The benchmark is public.

Red Hat Enterprise Linux 8OpenSCAPOVAL+5
HardEvalarXiv

evals, researchΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

HardEval: An Execution-Verified Benchmark for AI-Driven Security Hardening and Compliance Remediation

HardEval is an execution-verified benchmark for LLM-driven security hardening, built from Red Hat Enterprise Linux 8 STIG controls that fail on an unhardened baseline. Models receive only the security outcome and write a Bash script, which runs on a live VM and is graded fail-to-pass by OpenSCAP/OVAL checks. Fourteen frontier and open-weight configurations show uneven results across SSH, authentication, audit and kernel domains, with a common failure of plausible code that misses the exact compliance condition.

Red Hat Enterprise LinuxOpenSCAPLinux+3
HardEvalSTIGOVAL

AI Security, Cloud & Infra, GRCΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

On the possibilities and limitations of LLM-based multi-agent systems for multi-criteria decision-making in healthcare operations management

This paper proposes a framework for auditing LLM-agent-generated stakeholder preferences before they are used as weights in multi-objective optimization for healthcare operations. Experiments on outpatient appointment scheduling and emergency department configurations show that explicit ratings vary by role and clinic conditions, deliberation can erase role differences, and pairwise choices depend largely on option order. Robust weighted-sum models often select different schedules than average weights.

LLM
arXiv

research, agents, evalsΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

OwlSight: A Panoramic Monitor for Chain-of-Thought Reasoning

OwlSight is a chain-of-thought monitor that uses "Factor", a monitoring requirement written into the prompt, so one monitor can cover many tasks across capability, safety and trustworthiness. Factors come at fine granularity (a specific leaked email address) and coarse granularity (privacy leakage). On 15,971 reasoning trajectories it beats general-purpose LLMs by 1.32-30.57 points (fine) and 11.71-27.81 points (coarse), and reaches state-of-the-art on OpenAI's CoT monitorability benchmark. It generalizes to unseen models and resists Factor rephrasing, CoT compression and obfuscation.

LLM
OwlSightOpenAIarXiv

ai-safety, research, evalsΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

FlexPart: Text-Controlled Semantics-Aware 3D Part Segmentation at Flexible Granularity

FlexPart is a framework for text-controlled 3D mesh segmentation that assigns discrete part IDs to mesh faces through a view-independent part-identity field. It uses a control prompt of part names with location and shape clauses, trained on a VLM-built multi-granularity dataset. On FlexPartBench it raises average mIoU by 22% over the strongest baseline, and by 15% with planner-completed prompts.

vision-language model
FlexPartFlexPartBench

research, multimodalΒ· Added 20 Oct 2026, published 16 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

CHAMP: Cayley HAshing with Matrix Products

CHAMP is a Cayley hash function that hashes binary strings by mapping each bit to a 2x2 matrix over a finite field and multiplying the matrices. The product's semigroup structure gives the hash homomorphic properties. The authors (Demin, Ovchinnikov, Shpilrain) discuss its collision resistance, implementation and performance. Cayley-style hashes have a history of structural attacks, so the security analysis is what a cryptographer would check.

CHAMPCayley hash functionsAlexander Demin+2

otherΒ· Added 17 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

A Language-Informed Loss for Visual Generation

LILIE (Language-Informed and Lossless Image Encoder) is an invertible image transform built from a normalizing flow transformer, trained jointly with a vision-language model via next token prediction so captions can be recovered from noised features. The encoder supplies a language-informed loss for text-to-image generation. JiT models trained with it cut gFD from 66.84 to 53.01 against a pixel-only baseline on the GPIC dataset. Code, encoders and models are released.

normalizing flowTransformervision-language model
LILIEJiTGPIC+1

research, multimodalΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

ThetreStageAI: Multi-View Retrieval-Augmented Generation for Structured Bengali Theatre Production Planning

ThetreStageAI is a retrieval-augmented framework for structured Bengali theatre production planning. It keeps separate scene, actor-blocking and lighting views, embeds Bengali text with BGE-M3, indexes it in view-specific Qdrant collections, and has Gemini generate schema-constrained JSON, with validation and at most one repair attempt. The authors build a synthetic dataset of 500 records (1,500 retrieval documents) and compare single-combined retrieval with multi-view retrieval. Code and data are public.

RAGGeminiBGE-M3+1
ThetreStageAI

llm-apps, researchΒ· Added 20 Oct 2026, published 16 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Analysis of the Multi-Key Optimization for SPECK

The paper revisits the multi-key optimization for SPECK, a code-based signature scheme that uses the Permutation Code Equivalence Problem (PEP) as a trapdoor for the Permuted Kernel Problem (PKP). Each SPECK round has soundness error 1/2, which inflates signatures, and the SPECK authors had warned that naively using multiple public keys creates security concerns. The authors analyse those concerns, give conditions and parameter constraints under which multiple keys can be integrated securely, and show that conservative parameters perform poorly but leave room for improvement. They also build a ring signature scheme on the same construction.

SPECKLESSPermuted Kernel Problem+6

otherΒ· Added 17 Oct 2026, published 16 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

SLEEK: Sparse Quasi-Cyclic Codes with Closed-Form DFR Key Encapsulation

Introduces SLEEK, a QC-MDPC code-based KEM using a three-iteration parallel bit-flipping decoder and a closed-form decoding-failure-rate (DFR) estimate, enabling parameters with analytically bounded failure probability and standard IND-CCA transforms. SLEEK-LT targets IND-CCA for long-term keys; SLEEK-E targets IND-CPA for ephemeral keys using a new QC key structure with security equivalent to QC-MDPC and cheaper key generation. Parameter sets cover 80/128/192/256-bit security, and the optimized AVX2 implementation gives ciphertexts 4.9x smaller than HQC (47% slower) and 1.3x–2.7x faster than BIKE.

AVX2
SLEEKSLEEK-LTSLEEK-E+5

otherΒ· Added 17 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

Enhancing RAG-based Medical VQA with Gated Multimodal Representations

This paper presents a multimodal retrieval-augmented generation framework for Medical Visual Question Answering. A Gated Multimodal Unit learns a joint query representation from the medical image and the clinical question, so evidence retrieval uses both modalities while the Med-LVLM stays frozen. On benchmark datasets it consistently beats a reference Med-LVLM and stays competitive with state-of-the-art methods. The page gives no dataset names or numbers.

RAGvision-language model
arXiv

research, llm-apps, multimodalΒ· Added 20 Oct 2026, published 16 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

I Want to Ride My BIKE: Customizing Bit-Flipping Decoders for Ephemeral Key KEMs

ePrint paper presenting the first optimized implementation of the BF-max bit-flipping decoder for the code-based KEM BIKE, combined with other decoders to trade off decoding failure rate, runtime, public-key and ciphertext size in ephemeral-key settings. It cuts public-key and ciphertext sizes by 7.8% versus LeanBIKE at similar speed and DFR, and gives a combined size 22% below BIKE and 2.79x below HQC. It shows BIKE can fit constrained protocols such as IKEv2, which matters for practical post-quantum migration.

BIKEHQCIKEv2
BF-maxLeanBIKEQC-MDPC+1

otherΒ· Added 17 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

Trapped in Your Story: Evaluating Narrative-Induced Sycophancy in Large Language Models

This paper builds a benchmark of 500 debatable questions across ten domains to measure how user narratives steer LLM agreement. Each question has 11 matched conditions (one neutral, five mirrored narrative levels per opposing stance), giving 5,500 instances across seven LLMs. Causal framing and worldview synthesis raise agreement, personal experience can lower it, and GPT-5.1 ablations show bullet formatting also increases agreement.

LLM
GPT-5.1arXiv

ai-safety, evals, researchΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

Predictable Scaling: Efficient Model Exploration via Scaling-Law Prediction

Predictable Scaling (PS) is a framework that predicts full-scale recommendation model performance from scaled-down proxies. It builds proxies with composable scaling functions along separate resource axes, then projects metrics to target scale by curve fitting with calibrated uncertainty. Of three predictors, even the raw proxy falls within repeated-run noise, and a Gaussian Process gives 15% lower relative MAE. On a task-specific ranker and a foundation ranker, PS ranks hypotheses correctly at 79-88% compute reduction.

Gaussian Process
arXiv

research, trainingΒ· Added 20 Oct 2026, published 16 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Secure Compilation of Probabilistic Side-Channel Countermeasures

Presents a language- and leakage-model-agnostic framework for provably secure compilation of probabilistic side-channel countermeasures. It uses a deterministic leakage-preservation relation that implies preservation of d-NI, d-SNI and cryptographic constant-time without probabilistic proof obligations. The authors prove in Rocq that a model of the Jasmin compiler's core pipeline and several optimizing passes preserve security in the value-probing model with glitches. They also add source-level annotations to harden against transition leakage and release libmasking, an arbitrary-order masked gadget library in Jasmin that compiles to ARM and RISC-V, with C bindings and hardware benchmarks.

JasminRocqEasyCrypt+3
d-NId-SNIlibmasking+3

Hardware & RFΒ· Added 17 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

ConQUESTA: Topology-Aware Post-Training Structural Pruning of Quantum Neural Networks

ConQUESTA is a post-training pruning framework for quantum neural networks that combines task saliency with compiler cost, screens candidate entanglers, and searches whole pruning masks under an accuracy constraint. Each mask is transpiled across several coupling topologies. At 55% pruning on 4-, 6- and 8-qubit QNNs it cuts resources by 61.6% (Breast Cancer), 72.0% (Digits01) and 82.2% (Iris), and fixed-mask recovery raises feasible runs from 16/24 to 22/24.

quantum neural network
ConQUESTAarXivBreast Cancer+2

researchΒ· Added 20 Oct 2026, published 16 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Sparse Secrets, Dense Problems: Efficiently Masking HQC in Hardware

ePrint paper presenting the first fully masked hardware implementation of HQC (key generation, encapsulation, decapsulation) on FPGA. It introduces a mixed Boolean/arithmetic masking for sparse-dense vector multiplication, proven first-order secure in the transition- and glitch-robust probing model and PINI-composable, at only 3% extra cycles and 81 random bits per cycle. It also shows a profiled horizontal side-channel attack on Rotate-and-Add multipliers that recovers support indices within Β±8 positions from 200 traces despite TVLA showing no leakage after 10 million traces, and adds integrated hiding countermeasures costing 1.7% latency.

HQCML-KEMFPGA+1
PINITVLAhorizontal side-channel attack+2

Hardware & RFΒ· Added 17 Oct 2026, published 16 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

MobileInject: Evaluating Reasoning-to-Action Security of MLLM-Based Mobile Agents under Cross-Modal Consistency Injection

MobileInject is a benchmark for testing MLLM-based smartphone agents against indirect multimodal injection. It has an interactive evaluation framework with 11 scenarios, 9 security-risk categories and 108 executable risk instances. It adds Cross-Modal Consistency Injection, Multi-Role Collaborative Deception, Reasoning-Camouflage Injection and a Reasoning Security Diagnosis Framework. Experiments find broad vulnerability, with many failures from early reasoning hijacking.

LLM
MobileInjectCross-Modal Consistency InjectionMulti-Role Collaborative Deception+3

AI SecurityΒ· Added 20 Oct 2026, published 16 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Power Analysis on SQIsign via Ideal Reconstruction from Quaternion Leakages

ePrint paper identifying five side-channel vulnerabilities in the signing procedure of Round-3 SQIsign, the isogeny-based signature scheme in NIST's additional post-quantum signature process. It gives polynomial-time algebraic algorithms that recover the secret key from leaked quaternion/ideal intermediate values, including cases where only partial bits leak. It also demonstrates power analysis on the SQIsign source code to extract the needed leakage, which earlier work on Round-1 or toy parameters did not do.

SQIsign
NISTideal reconstruction

Hardware & RFΒ· Added 17 Oct 2026, published 16 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents

Ignored, Not Refused audits 33,000 trajectories from eleven open-weight agents (2-14B parameters) on InjecAgent and AgentDojo. A label-blind LLM judge finds most failed indirect prompt injections are ignored (76-80%) rather than refused (17-18%). Changing only the system prompt moves InjecAgent ASR from 0.2% to 43%. The Attack-Task Outcome Matrix (ATOM) shows 21.7% of AgentDojo episodes were safe but left the user task incomplete. The corpus, judge prompt and code are released.

LLM
indirect prompt injectionAgentDojoInjecAgent+2

AI SecurityΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents

"Ignored, Not Refused" audits 33,000 trajectories from eleven open-weight agents (2-14B parameters) on InjecAgent and AgentDojo. A label-blind LLM judge finds 76-80% of failed injection attacks were ignored and 17-18% refused. Changing only the system prompt moves InjecAgent attack success rate from 0.2% to 43%, and the ATOM matrix shows 21.7% of AgentDojo episodes were safe but left the user's task undone. The corpus, judge prompt and code are released.

LLM
InjecAgentAgentDojoATOM+1

evals, ai-safety, agentsΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

PrairieFire: Igniting High-Throughput Updates in Large-Scale Approximate Nearest Neighbor Search

PrairieFire is an SSD-based approximate nearest neighbor search system for billion-scale vectors, built for high update throughput. It uses buffered updates and batched local rebuilds, with cascaded adjustments, concurrency control and CPU-GPU-SSD cooperation. Against state-of-the-art systems it reports about 3-35x update throughput, 3-5x search throughput and 1.5-8.7x cost efficiency. It has run in RedNote production for two months.

NVMe SSDGPU
PrairieFireRedNotearXiv

research, llm-appsΒ· Added 20 Oct 2026, published 16 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

safeRNSgcd: Accelerating Falcon key generation with RNS in SafeGCD

ePrint paper presenting safeRNSgcd, which computes the single BΓ©zout coefficient needed at the deepest level of Falcon's NTRU solver while keeping large integers in a residue number system. Centered explicit CRT recovers the exact low bits needed by SafeGCD batches using single-word fixed-point arithmetic. A C implementation integrated into ntrugen reduces inversion and private-key basis-generation cost on a Raspberry Pi 5 and two x86-64 CPUs, versus the original ntrugen and a variant that skips the unused coefficient.

FalconntrugenSafeGCD+2
safeRNSgcdCesare HuangBo-Yin Yang

otherΒ· Added 17 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

LexPilot: Benchmarking the Proactive Interaction Ability of Legal LLMs with Laypeople in Chinese Civil Case Consultation

LexPilot is a benchmark linking proactive legal interaction to claim-level verdict prediction, built from 432 real Chinese civil judgments across 36 causes of action. It pairs expert-reviewed complete and underspecified consultation histories with court verdicts. Current LLMs score on average 23.84% lower on judgment prediction in underspecified consultations than in fully specified ones, and the paper analyses the bottlenecks.

LLM
LexPilotarXiv

evals, researchΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

Rethinking GRPO for Large Reasoning Model Safety Alignment

Beacon is a safety alignment framework for large reasoning models that fixes two GRPO failure modes: advantage collapse, where homogeneous rollout groups give vanishing advantages, and unsafe diversification, where unsafe behaviors persist and spread. It combines Safety Signal Recovery (advantage-guided trajectory filtering plus safe reference supervision) with Safety-Utility Decoupled Alignment (category-aware rewards, benign-only KL anchoring). Tested on four Qwen3 and DeepSeek-R1-Distill variants across eight benchmarks, it cuts average safety error by up to 32.83 percentage points with low over-refusal.

GRPOQwen3DeepSeek+1
BeaconDeepSeek-R1

ai-safety, training, researchΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

SpikeQ: Spike-Guided Post-Training Quantization for Spiking Neural Networks

SpikeQ is a spike-guided post-training quantization framework for spiking neural networks on neuromorphic chips. It picks each weight level by simulating downstream neurons to minimize spike errors, and uses a reset-aware grid for pre-fire membrane potentials. With 4-bit weights and potentials, models stay within 2.59 points of full precision, with 7.8 to 7.9 times smaller memory and 6.4 to 6.9 times less energy.

spiking neural networksneuromorphic chips
SpikeQ

research, inferenceΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

MUB: An Identity-Masked Benchmark for Music Understanding in Multimodal Language Models

MUB (Music Understanding Benchmark) is a set of 500 identity-masked recordings with existing annotations for tempo, key, time signature and structural intervals. It covers all 24 keys, tempos of 47 to 180 BPM and 4,676 intervals, and strips titles, artists and platform IDs from inputs. Baselines reach 53.6% tempo accuracy (DSP) and 98.4% time-signature accuracy (constant 4/4). No multimodal LLM has been tested yet, and rights clearance is unresolved.

multimodal language model
Music Understanding BenchmarkMUBarXiv

evals, multimodal, researchΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

Many Biases, One Circuit: Post-Training Tunes a Pretrained Cue-Routing Mechanism

Many Biases, One Circuit is a October 2026 arXiv paper that traces attention heads behind cue-following (for example "I think the answer is B") through two post-training pipelines. Four cue types share a few heads already present in pretrained models. About 200 generic assistant examples activate them in chat format, and the final RL stage strengthens cue effects. Swapping attention patterns of six middle layers between Tulu-3-8B and OLMo-2-7B checkpoints moves cue effects most of the way.

LLMTransformer
Tulu-3-8BOLMo-2-7BarXiv

research, ai-safety, trainingΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper🧠 AI

Identify, Classify, Act: Per-Instruction Controlled Compliance for LLMs over External Data

EDIC is a decomposed reward framework that trains LLMs to decide, for each instruction embedded in external data such as documents or tool returns, whether to follow or reject it. A judge initialized with SFT and refined with GRPO attributes compliance per instruction and yields separate rewards for beneficial and harmful compliance. On Qwen3-4B it raises harmful-rejection by up to 7.7% and Arena-Hard-Auto utility by 12.5% over the strongest prior defense.

GRPOQwen3LLM
EDICQwen3-4BArena-Hard-Auto+1

research, training, ai-safetyΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Identify, Classify, Act: Per-Instruction Controlled Compliance for LLMs over External Data

EDIC is a decomposed reward framework for per-instruction compliance in LLMs that read external data, where one document or tool return mixes legitimate directives with injected ones. A generative judge, trained with SFT then GRPO, attributes compliance per instruction and produces RL rewards for beneficial and harmful compliance. On Qwen3-4B it raises harmful rejection by up to 7.7% and Arena-Hard-Auto utility by 12.5% across five benchmarks.

LLMQwen
indirect prompt injectionprompt injectionEDIC+3

AI SecurityΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Stealthy Poisoning Attacks via Reused KV Cache of Reasoning

R^2ECAP (Reused Reasoning-Cache Poisoning) is a black-box attack that plants poisoned reasoning traces through a chat interface, exploiting LLM systems that reuse KV caches of reasoning. A preceding trace steers the model, and the retained trace keeps residual adversarial influence in its cache after the preceding trace is discarded. On three open-weight LLMs and three datasets it reaches up to 79% ASR, beats the white-box HijackKV in 8 of 9 settings, and reaches 46% ASR in a reasoning-trace retrieval system. Only 1% of retained responses are flagged by a popular prompt injection detector.

LLM
R^2ECAPHijackKVprompt injection

AI SecurityΒ· Added 20 Oct 2026, published 16 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

SwiftAuth: Conditional Privacy-Preserving UAV Authentication with Multi-Source Credential Aggregation and Non-Interactive Authorization

The paper proposes a traceable and aggregatable tagged witness signature (TA-TWS) and builds SwiftAuth on it, a conditional privacy-preserving anonymous authentication framework for UAVs and other dynamic terminals. Issuers can create authorization components while users are offline. Several credentials compress into one constant-size proof, verifiers can batch-verify across users, and a regulatory trapdoor lets authorities trace misbehaving users. TA-TWS is proven unforgeable and witness-hiding, and benchmarks with the MIRACL Core library on constrained devices and Aliyun servers show it is practical.

MIRACL Core
SwiftAuthTA-TWStagged witness signature+1

Identity & AccessΒ· Added 17 Oct 2026, published 16 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Shorter Hash-Based Signatures via Guarded Sharing in a DAG Model

Proposes "guarded sharing", a technique that moves few-time signatures in SPHINCS-style stateless hash-based schemes from a tree model to a DAG model. Combined with bucket thinning, hash chains and rejection sampling, it yields BGS-CC, which improves on the prior best few-time scheme BPORS-C+BFP. For 128-bit security and a use quota of Q=2^24 it gives 2,228-byte signatures, the first SPHINCS-based stateless signature shorter than ML-DSA-44's 2,420 bytes. This matters for PQ migration because signature size is the main drawback of SLH-DSA.

SLH-DSAML-DSA
BGS-CCBPORS-C+BFPSPHINCS+1

otherΒ· Added 17 Oct 2026, published 16 Oct 2026

huggingface.copaper🧠 AI

Doc2Harness: Benchmarking LLMs on Long-Horizon Harness Engineering of Coding Agents

Doc2Harness is a two-stage benchmark for harness engineering. In Stage 1 a build model, working inside a fixed builder harness, gets an interface-only contract skeleton plus a development document consolidating behavior from twelve frontier harnesses, and builds a full candidate harness in an isolated container. In Stage 2 the frozen harness runs in separate per-test-case containers, driven by a scripted mock model, and is scored on four channels: requests sent to the model, files on disk, exit code and command output. Across 19 frontier models with three builds each on 328 test cases, GPT-6 Astra leads at 53.05% against 27.44% for the weakest, and failures cluster around how cross-cutting functionality is split across modules.

Docker
Doc2HarnessGPT-6 AstraHugging Face

evals, coding-agents, agentsΒ· Added 16 Oct 2026

arxiv.orgpaper🧠 AI

Between Spoilers and Guesswork: Avoiding Over-Specification in Coding Benchmarks

This October 2026 arXiv paper studies task over-specification and under-specification in repository-level coding benchmarks. It shows that hints derived from ground truth, as added in SWE-bench Pro, FEA-bench, Doc2Feat-bench and Multi-SWE-bench, leak spoilers in some of them. The authors test several specification levels, recommend techniques for parsimonious hints, and plan to release their hints.

SWE-Bench ProFEA-benchDoc2Feat-bench+2

evals, coding-agents, researchΒ· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Can SOLARBURST go silicon? A systematic analysis on software supply chain attacks for VLSI design flows

This paper analyses software supply chain (SWSC) attacks against VLSI design tools. It empirically studies the software composition, security features and tool interactions of VLSI suites, then builds a taxonomy linking SWSC attacks to VLSI attacks, design-flow stages and security outcomes. The taxonomy yields 717 possible new attacks, 60 of them high feasibility, with a threat model, a defense assessment and case studies on an open-source VLSI flow.

SolarWindsSUNBURST

Supply Chain, Hardware & RFΒ· Added 20 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

Value as Memory: Online Value-Guided Post-training for General Robot Policies

Value as Memory (VaM) is a post-training framework for generalist robot policies. It addresses partial observability and the delayed feedback of offline post-training. Value caching conditions actions on recent value predictions as task-progress memory. Online real-world RL combines offline demonstrations, off-policy interventions and on-policy rollouts, and moves from offline RL warmup to autonomous learning with sparse rewards. On long-horizon deformable-object and contact-rich manipulation tasks it gains 29.4% mean absolute success rate from value caching and 32.8% from online learning over matched offline training. The online schedule runs 8x as many policy iterations under the same gradient-step budget, with over 2x lower time per gradient step from concurrent data collection and training.

Value as MemoryarXiv

research, trainingΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

Perceive, Predict, and Plan: a Unified World Action Model for Egocentric Dexterous Manipulation

P^3-WAM is a unified world action model for egocentric dexterous manipulation with three modes: Perceive (reconstruct articulated hand motion and camera trajectories from video), Predict (generate visual futures under prescribed actions) and Plan (jointly generate action trajectories and their anticipated visual outcomes from an initial image, a language instruction and an optional visual goal). It adds a compact structured 3D action representation to a pretrained video diffusion transformer through a mixture-of-transformers design with shared base weights, modality-specific adaptation and bidirectional visual-action attention. Randomized modality visibility lets video and 3D actions act as either context or target. Unified training beats single-mode training and outperforms specialized baselines on 3D hand reconstruction and action-conditioned video prediction across four datasets, and gives better instruction adherence than video-generation baselines.

diffusion modelTransformervision-language model
P^3-WAMarXiv

research, multimodalΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

Grounding Generative Verification in 3D Content

The paper introduces 3DVerifierBench, a 10-task benchmark for generative verification of 3D content. It scores accept/reject decisions, rejection explanations, and responses to controlled changes in specifications and candidates. A human study shows a 21.6-point gap to the strongest tested model, GPT-6 Astra. The authors also build a pipeline of multi-view fact extraction, controlled 3D editing and native annotations. It yields 14,126 training examples with contradiction explanations and linked counterfactuals. Verification-guided selection raises complete factual success from 26.7% to 90.0% with oracle selection over sixteen candidates, and human-guided recursive refinement satisfies all seven requirements for every input in an eight-input study.

multimodal large language model3D generation
3DVerifierBenchGPT-6 AstraarXiv

research, evals, multimodalΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

DK-VLM: Geometry as Position for Spatial Reasoning in Vision-Language Models

DK-VLM adds Dual-Kernel Attention to a vision-language model. A semantic kernel keeps the pretrained attention and positional encoding. A separate geometric kernel uses estimated 3D points and camera poses to modulate attention through point displacements and relative view transformations, and a learned gate fuses the two outputs. Geometry therefore enters attention as position, not as fused 3D reconstruction features. The paper also adds Reference-Frame Composition (RC) supervision, which gives stepwise turn and heading targets derived from verified single-step annotations, to train multi-step spatial reasoning as the observer moves. DK-VLM-8B reports the highest average score across six spatial benchmarks among the compared methods, with 74.33 on VSI-Bench and 58.28 on ReVSI-32, and it preserves general video understanding.

vision-language modelTransformer
DK-VLMVSI-BenchReVSI-32+1

research, multimodalΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

Rethinking Routing Exploration in Modern Mixture-of-Experts

The paper identifies an "exploration dilemma" in modern Mixture-of-Experts models. Shared experts reduce the variability of token representations, which makes routing less exploratory. Fine-grained expert segmentation enlarges the combinatorial routing space and so needs more exploration, which means its extra expressiveness may go unrealized. It proposes MirrorMoE, which shrinks the exploration space by suppressing unnecessary experts per token, and reports consistent gains across model scales.

Mixture of Experts
MirrorMoEarXiv

researchΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

MLExpert: Towards a Generalist Agentic Model for Autonomous Machine Learning Engineering

Presents MLExpert, a 35B Mixture-of-Experts agentic model trained for autonomous long-horizon machine learning engineering. Training uses a Kaggle-MLE Factory to build executable tasks and an interaction harness, hierarchical agentic SFT with outcome-guided supervision, and Windowed Interaction RL (WIRL). WIRL treats the multi-turn decisions between successive experiment results as one execution window with a shared outcome reward, and uses asynchronous collection and policy correction. On MLE-Bench Lite the average medal rate rises from 37.9% to 72.7%, comparable to larger frontier models such as Kimi-K3 and GLM-5.3. It also improves on NatureBench Lite, agent scaffold optimization and algorithm optimization.

Mixture of ExpertsLLM
MLExpertKaggle-MLE FactoryMLE-Bench+4

research, training, agentsΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

Learning to Steer LLM Agents and Multi-Agent Systems

Proposes a steering agent that supervises LLM agents and multi-agent systems during execution and corrects goal drift, where long-horizon tool use and inter-agent collaboration slowly diverge from the overall objective. A low-cost fast path decides when to intervene, and a high-cost slow path generates how to intervene. Both paths are trained jointly with reinforcement learning, combining a pairwise ranking objective with GRPO. On information-seeking search tasks it improves performance and efficiency for single-agent and multi-agent systems, generalizes out of domain, transfers to unseen executors, and allows intervention frequency to be adjusted without retraining.

GRPOLLM
arXiv

research, agents, trainingΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

Velox: Spatial Memory Makes World Models Efficient

Velox is a training-free attention router for chunked video-diffusion world models. It uses camera frustum slabs with depth intervals from streaming geometry to pick which historical token blocks to attend to, instead of letting the KV cache grow with rollout length. Frustum overlap softly modulates each layer's model-derived block importance, and uncovered regions keep the model's own routing. The fixed block granularity suits FlashAttention-style tiled execution, and slab construction runs asynchronously with denoising on the same H200. At chunk 48 it speeds up attention 4.36Γ— and denoising 2.43Γ—, and on the 158-case WBench navigation split it stays within 0.15 average points of dense LingBot-Fast-Cam.

diffusion modelFlashAttentionCUDA
VeloxLingBot-Fast-CamWBench+1

research, multimodal, inferenceΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale

Studies "filesystem capability laundering" in MCP servers: client approval of a tool call grants the server process broad host filesystem access, so attacker-steered arguments can reach sensitive files outside the tool's declared contract. The authors build MCP-FSD, which infers per-tool least-privilege boundaries, plants credential fixtures outside them, and tests exploitability and sandbox containment by paired dynamic execution. Of 21,097 servers from nine registries, 16.4% of 4,806 triaged servers have filesystem capabilities despite non-filesystem classifications. Dynamic validation confirmed 150 vulnerable instances, and disclosure produced 13 advisories, including two CVEs in Anthropic's Git MCP Server.

Model Context ProtocolAnthropicGit
filesystem capability launderingMCP-FSDpath traversal+1

AI Security, AppSecΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

Knowledge That Is Linear Before Fine-Tuning Generalizes After It

The paper separates "active" facts (which support generalization beyond recall) from "inert" ones. It builds new relations by relabeling answers of existing ones (Paris -> Europe becomes Paris -> crab), fine-tunes on a subset of subjects, and tests held-out subjects that share an answer (Munich -> crab). Across eleven language models and 70 relations, linear readability of the original relation in pretrained representations correlates with this generalization at Pearson r = 0.87 to 0.92 within each model. The result holds after controlling for fine-tuning set size, original-relation accuracy and subject frequency in pretraining text, and it survives re-randomized labels, seeds and thirteen other label categories. Mapping wrong labels back to the original answers shows the fine-tuned model's errors follow the linear probe's top answers.

LLM
arXiv

research, trainingΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

AI Consilium: a Benchmark of LLM Clinical Multidisciplinary Second Opinions

AI Consilium is a multidimensional benchmark built from 300 diagnostically resolved NEJM–MedQA cases (110 for physician reference ratings and Judge calibration, 190 held out). Eight single-model pipelines produced role-specific opinions and interactive-consilium reports under free-form and structured clinical-reasoning conditions, and a physician-calibrated LLM Judge scored 3,040 final reports. Model identity separated quality more than format; structured reports won in seven of eight pipelines (management 2.740 vs. 2.436), multidisciplinary synthesis beat the primary-role opinion on all five shared criteria, and GPT-5.6-Sol led every component with the fewest review rounds.

LLM
AI ConsiliumNEJMMedQA+2

evals, researchΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

Private Retrieval Augmented Generation via Random Projection

Proposes protecting the retrieval datastore in RAG systems by applying the same random projection to datastore embeddings and query embeddings. This provably preserves query-item semantic similarity while substantially mitigating data extraction attacks. Across multiple RAG architectures and datasets it beats prior differential-privacy-based methods on retrieval and generation quality, with comparable empirical privacy under strong attacks, making it a practical baseline for privacy-preserving RAG.

RAGLLM
arXiv

research, llm-appsΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Private Retrieval Augmented Generation via Random Projection

Proposes applying the same random projection to both datastore embeddings and query embeddings in RAG systems. The authors claim this provably preserves query-to-item semantic similarity while substantially mitigating datastore data-extraction attacks. Across several RAG architectures and datasets it reportedly beats prior differential-privacy-based defenses on retrieval and generation quality, with comparable empirical privacy under strong attack models. It is presented as a lightweight baseline for privacy-preserving RAG.

LLM
differential privacydata extraction attacks

AI SecurityΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

EliteReplay: Preserving Diverse Solutions in RL Post-Training via Quality-Diversity Search

EliteReplay is an RL post-training recipe that pairs GRPO with an "elite" archive built by quality-diversity search. Before training, the frozen base model is used to collect solutions spanning distinct approaches; during training, a replay loss on this archive is added to GRPO. This counters the narrowing of solution diversity that RL causes. On text-to-SQL tasks it reaches higher pass@128 than all baselines and yields up to 77% more distinct correct strategies. It also retains more of the base model's strategies and covers both readings of ambiguous questions nearly twice as often on AmbiQT.

GRPOLLM
EliteReplayAmbiQTarXiv

training, researchΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

Librarian Agents: Training LLMs to Curate Long-Context Workspaces that Anticipate Future Queries

Introduces Librarian Agents, where a builder agent turns raw unstructured documents into a hierarchical filesystem of synthetic files and reference links, forming a workspace for a downstream answering agent. Workspace construction is cast as a Markov decision process and the builder policy is trained with reinforcement learning to maximize downstream answering accuracy. It beats the strongest retrieval and precomputation baselines by 33 points on BrowseComp-Plus, amortizes construction cost over repeated queries, and generalizes zero-shot to BRIGHT with a 31-point average gain.

LLMClaude CodeRAG
Librarian AgentsBrowseComp-PlusBRIGHT+1

research, agents, llm-appsΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

X-RIC: An Agentic RAN-Intelligent Controller Benchmark for Enhancing Reinforcement Learning

X-RIC (eXplainable RIC) is a framework that adds agentic reasoning to the O-RAN Near-RT RAN Intelligent Controller. It combines reactive reinforcement learning with automated behavioral cloning from domain heuristics, a transformer-based Telecom Language Model for contextual abstraction and interpretability, and closed-loop co-adaptation for continuous policy refinement. The paper also introduces BARX, a benchmark for agentic RAN control that measures latency, compliance and determinism. On SLA-aware network slicing, in simulation and on an O-RAN-compliant testbed, it reports 89% lower operational cost with SLA compliance kept, 75% faster convergence, 50% fewer training steps and 46% lower variance.

TransformerO-RANNear-RT RIC+2
X-RICBARXO-RAN ALLIANCE+2

research, agents, evalsΒ· Added 17 Oct 2026, published 15 Oct 2026

eprint.iacr.orgpaper🧠 AI

GhostFaceMPC: Privacy-Preserving Face Recognition with Multi-Party Computation

GhostFaceMPC is presented as the first end-to-end face recognition system that runs both the deep CNN feature extractor and the matching step under secure multi-party computation. Raw images and biometric embeddings are never exposed at any stage, from feature extraction through storage to matching. The authors contribute an MPC-friendly quantization of the GhostFaceNet model and circuit optimizations that make this practical, and they release code on GitHub. It is relevant as an example of making CNN inference feasible under cryptographic constraints.

GhostFaceNetCNNsecure multi-party computation+1
GhostFaceMPC

research, inferenceΒ· Published and added 15 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

GhostFaceMPC: Privacy-Preserving Face Recognition with Multi-Party Computation

GhostFaceMPC is presented as the first end-to-end face recognition system that runs a deep CNN feature extractor (GhostFaceNet) and the matching step under secure multi-party computation. Raw images and biometric embeddings are never exposed during extraction, storage or matching. The authors contribute an MPC-friendly quantization of GhostFaceNet and circuit optimizations that make the approach practical, and they release code at crypto-unict/GhostFaceMPC.

GhostFaceNet
GhostFaceMPC

otherΒ· Published and added 15 Oct 2026

arxiv.orgpaper🧠 AI

Topology-Inspired Fine-Tuning for Wind-Field Super-Resolution

The paper fine-tunes a pretrained CNN wind-field super-resolution model with differentiable topology-inspired auxiliary losses on speed, gradient magnitude, soft high-speed level sets and local maxima. It also uses fixed-pair supervision at ground-truth persistence-pair endpoints located offline with the Topology ToolKit. A 16-configuration loss study on a fixed 168-field benchmark finds that gradient supervision gives the strongest persistence-diagram improvement, while fixed-pair supervision gives the most consistent joint improvement in persistence-diagram and merge-tree distances. The combined objective cuts bottleneck, W2,∞ and W2,2 distances by 31%, 25% and 27% relative to the pretrained CNN, at a cost of about half of standard fine-tuning's PSNR gain. It also shows that pointwise metrics and topological distances rank CNN and GAN models differently.

CNNGANTopology ToolKit
arXiv

research, trainingΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

Skill-Decoupled On-Policy Expert Distillation for Unified Vision-Language Models

Proposes SCOPED (Skill-Decoupled On-Policy Expert Distillation), which trains capability-specific RL experts for vision-language models. It extracts explicit skills from them through reward-guided reflection. During on-policy distillation the skills guide expert supervision but are hidden from the unified student, so the student internalizes the procedural knowledge and needs no explicit skills at inference. Across eight multimodal benchmarks it beats the backbone and mixed-capability RL. Analyses show cross-capability gradient interference in joint RL, and that skill augmentation gives more consistent expert trajectories, more attention to task-relevant visual evidence, and better preservation of expertise.

vision-language model
SCOPEDarXiv

research, training, multimodalΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

Efficient KV Cache Migration for Geo-Distributed LLM Inference in Collaborative Edge Computing

Proposes EdgeFlow, a hybrid KV cache migration scheme for distributed LLM inference across heterogeneous edge servers in Collaborative Edge Computing. It combines direct KV cache transmission with activation-based recomputation, overlapping computation and communication to cut migration time when servers disconnect or overload. The authors formulate a multi-node KV migration optimization problem and give a 2-approximation algorithm built on improved LP relaxation and bipartite graph techniques. Experiments on a real distributed LLM inference platform show up to 45% lower migration time.

LLM
EdgeFlowarXiv

inference, researchΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

Multi-sourced AI Tutor for Non-Native English Speaker Students

Describes a general-purpose LLM-based AI tutor for computing courses that accepts questions in Mandarin and replies bilingually, also generating glossaries of technical terms. It uses a specialized multi-source RAG pipeline with a novel question extraction mechanism to draw on diverse course materials. Evaluated on 91 Piazza posts: 83.52% answered correctly and helpfully, 76.92% of questions got high-quality translations, and 64.47% got glossaries.

RAGLLM
PiazzaarXiv

llm-apps, researchΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

The importance of tensor handling and implementation of physics-informed DeepONets

Proposes a modified Physics-informed DeepONet (PI-DeepONet) architecture that removes redundancy in how the Branch network processes input functions across collocation points. It is mathematically equivalent to the original but uses smaller input tensors and fewer Branch evaluations. The authors derive training-time scaling laws, then test on 1D, 2D and 3D linear advection problems. Accuracy matches the original, the maximum speed-up is 3.75Γ— in 2D, and a 3D model trains on an NVIDIA A100 only with the new formulation, because the original runs out of memory.

PI-DeepONetDeepONetPINN+1
NVIDIAarXiv

researchΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

DropKV: Decoupling Residual-Output Perturbation for Near-Optimal KV-Cache Eviction

DropKV is a KV-cache eviction framework for long-context LLMs. It decouples the joint eviction decision into independent per-token scores based on residual-output perturbation, which avoids the NP-hard combinatorial problem. It has a provable constant-factor approximation guarantee under a cone condition, which the authors verify empirically on three long-context LLMs. The fused Triton kernels never materialize the full attention matrix. They give a 19.8x scoring-kernel speedup and up to 9.9% end-to-end prefill speedup. On RULER and LongBench it beats state-of-the-art eviction baselines at equal cache budgets.

TritonLLMTransformer
DropKVRULERLongBench+1

inference, researchΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

PROBE: Learning to Audit Policy Compliance in Tool-Using LLM Agents

PROBE (Policy Rule Observation via Behavioral Exploration) trains LLM-based auditors that act as realistic users and probe deployed tool-using agents for policy violations (pricing, privacy, confirmation, safety) across multi-turn, tool-mediated dialogue. It formalizes auditing as a two-player Markov game with a composite reward for violation discovery, plausibility, progress and policy diversity, and compares GRPO, DPO and GFlowNet optimization. Trained auditors find broader, higher-yield violations than zero-shot adversaries, even when much smaller than the target agent, positioning behavioral auditing as a distinct axis next to capability and safety benchmarks.

LLM
PROBEGRPODPO+1

AI SecurityΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

PROBE: Learning to Audit Policy Compliance in Tool-Using LLM Agents

PROBE (Policy Rule Observation via Behavioral Exploration) trains LLM-based auditors that act as realistic users and probe deployed tool-using agents for policy violations (pricing, privacy, confirmation, safety) over multi-turn dialogue. It formalizes auditing as a two-player Markov game with a composite reward balancing violation discovery, behavioral plausibility, conversation progress and policy diversity, and compares GRPO, DPO and GFlowNet optimization in a controlled setting. Trained auditors find broader, higher-yield violations than same-architecture zero-shot adversaries, even when much smaller than the target agent. This positions multi-turn behavioral auditing as a distinct evaluation axis alongside capability and safety benchmarks.

GRPODPOGFlowNet+1
PROBEarXiv

evals, agents, trainingΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

Onboard Lightweight LLM Reasoning for Human-Aware Safe UAV Navigation

Presents a modular, fully onboard UAV navigation pipeline that closes the "human-aware safety gap" of geometry-only planners. A shared BLIP encoder drives captioning and text-conditioned segmentation, which is fused with depth for 3D obstacle localization. Qwen-2.5-0.5B, stabilized with RAG and grammar-constrained JSON decoding, infers per-category risk once per class and caches the verdict. Perception runs at 10 Hz on a Jetson Orin NX, and fallback LLM queries take about 0.8 s off the control path. In Gazebo it gives roughly 3x fewer collisions than a geometric planner and raises semantics-aware landing success from 34% to 96%. The 224-pixel encoder input limits small-object perception at range.

QwenBLIPRAG+4
NVIDIAarXiv

research, multimodal, inferenceΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

GraphACM: Graph-based Action Consistency Measurement for Uncertainty Quantification in LLM Agents

GraphACM merges equivalent states from multiple rollouts of the same LLM agent task into a directed, action-labeled graph, so actions can be compared at shared decision states. It defines node-level and global action-consistency measures, and uses the global score as an uncertainty proxy to predict task success or failure. Across three LLMs on ALFWorld, AppWorld and WebShop it reaches an average AUROC of 0.811, above the strongest behavioral-consistency baseline (0.729) and verbalized confidence (0.769). It also shows where in a trajectory agent actions diverge.

LLM
GraphACMALFWorldAppWorld+2

research, agents, evalsΒ· Added 17 Oct 2026, published 15 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

SecAgg++: A Post-Quantum Privacy Preserving Federated Learning Protocol

SecAgg++ is a masking-based secure aggregation protocol for single-server federated learning that swaps in post-quantum cryptographic primitives. It keeps the communication and computation efficiency of SecAgg and SecAgg+ and handles client dropout through an efficient recovery procedure built on secret sharing and additive masking. It matters because existing masking-based aggregation protocols are not post-quantum secure, so client model updates would be exposed to quantum-capable adversaries.

SecAggSecAgg+SecAgg++

AI SecurityΒ· Published and added 15 Oct 2026

eprint.iacr.orgpaper🧠 AI

SecAgg++: A Post-Quantum Privacy Preserving Federated Learning Protocol

SecAgg++ is a masking-based secure aggregation protocol for single-server federated learning that uses post-quantum cryptographic primitives. It keeps the communication and computation efficiency of SecAgg and SecAgg+ and handles client dropout through an efficient recovery procedure. It matters because most masking-based secure aggregation protocols are not post-quantum secure, which leaves federated model updates exposed to future quantum adversaries.

Federated LearningSecure AggregationPost-Quantum Cryptography+1
SecAgg++SecAggSecAgg++1

research, trainingΒ· Published and added 15 Oct 2026

arxiv.orgpaper🧠 AI

GACC-Bench: Benchmarking Goal-Adaptive Context Compression Ability across Large Language Models

GACC-Bench is a benchmark for Goal-Adaptive Context Compression, testing how well LLMs retain goal-relevant information when compressing a source context under a length budget before downstream questions are known. It has 500 goals and 2,571 human-reviewed questions over 281 document and agent-trace contexts from seven collections; a fixed reader answers the withheld questions from the compressed context. Ten LLM compressors show large gaps to full-context performance, especially in answering every question tied to a goal. Target-goal conditioning improves accuracy over goal-agnostic compression, while mismatched goals hurt it.

LLM
GACC-BencharXiv

evals, llm-apps, researchΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

From Perception to Prediction and Intervention: Benchmarking Proactive Video Assistants in Real-Life Scenarios

Introduces P^3IBench, a benchmark for proactive video understanding in real-life streaming scenarios, covering three capabilities: daily perception, risk prediction and intervention. It evaluates 12 open-source and proprietary video-language models (streaming and adapted non-streaming) and finds they struggle to make well-calibrated decisions about when to respond. The authors also build extra proactive training data and train P^3I-Assistant-4B, which improves several tasks unevenly, showing that proactive assistance needs response timing and restraint as well as visual understanding.

vision-language model
P^3IBenchP^3I-Assistant-4BarXiv

evals, multimodal, researchΒ· Added 17 Oct 2026, published 15 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Structural Cryptanalysis of the Eevee AEAD Family

ePrint paper cryptanalysing Eevee (Umbreon, Jolteon, Espeon), forkcipher-based AEAD modes proposed at CCS 2023 for IoT-to-cloud computation. It gives a two-encryption AD-free prefix distinguisher, a four-encryption nonce-misuse distinguisher, a deterministic AD-only forgery, and nonce-respecting forgeries on Jolteon and Espeon (fresh one-block forgery reusing the tag; arbitrary AD substitution). It traces these to proof flaws (online-prefix consistency, domain separation, checksum freshness), derives design requirements, and concludes the failures are in the mode design, not the C implementation.

C
EeveeUmbreonJolteon+2

otherΒ· Published and added 15 Oct 2026

arxiv.orgpaper🧠 AI

Multi-Reward Hacking: From Aggregation-Induced Drift to Trust-Anchored Defense

The paper shows that symmetric aggregation of a primary reward (correctness) and auxiliary rewards (brevity, efficiency) in LLM post-training can raise aggregate reward while primary-task performance falls. It proves that deterministic conditional-mean GRPO converges to auxiliary-favoring behavior when auxiliary rewards are more reliably obtained. It proposes Trust-Anchored Gating (TAG), which elects an anchor channel by policy drift and gates auxiliary credit on anchor satisfaction. On Qwen3-4B with a brevity reward, TAG reaches 0.581 pass@4 versus 0.220 for additive aggregation, and shortens responses by 44% relative to correctness-only training. Experiments on Qwen and Llama models cover math and program synthesis.

GRPOQwen3Qwen+2
Qwen3-4BarXiv

training, researchΒ· Added 17 Oct 2026, published 15 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Robust ECDSA Threshold Signing at Scale

Presents a robust threshold ECDSA signing protocol for t ≀ (n-1)/3 corrupted signers. It batch-computes pre-processing material for fast online signing and scales to many signers, for uses such as bridging consensus between blockchains. It combines batched verifiable secret sharing (Fitzi & Hirt), randomness extraction (Beerliova-Trubiniova & Hirt), efficient share opening (DamgΓ₯rd & Nielsen) and Attema–Cramer zero-knowledge proofs. The authors implement it and show it is practical for large n.

ECDSACarsten BaumAnders Dalskov

otherΒ· Published and added 15 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Threshold Post-Quantum E-Voting from Lattice Commitments

T-EVOLVE extends the lattice-commitment e-voting protocol EVOLVE to threshold tallying. Votes are Shamir-shared, so any t of n authorities can finish the tally. Privacy holds against t-1 colluding authorities and verifiability holds even if all of them collude. The voter proves her committed shares form a Reed-Solomon codeword whose value at zero is a valid vote. Complaints about ciphertexts that do not decrypt are publicly verifiable, using an LWE-instantiable encryption scheme with publicly verifiable opening. Privacy, verifiability, individual verifiability and robustness are proven in the classical random oracle model, and the verifiability reduction is not tight. In a C implementation, a yes/no ballot for four authorities takes 109 KB, and an authority aggregates 10^4 ballots in about three minutes on one core.

C
T-EVOLVEEVOLVEShamir secret sharing+2

otherΒ· Added 17 Oct 2026, published 15 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Exploring Fault Injection Attacks on HQC and BIKE Beyond Fujisaki-Okamoto Verification

Presents fault injection attacks on BIKE and HQC decapsulation that target instructions outside the Fujisaki-Okamoto transform, achieving full key recovery with only valid ciphertexts at NIST Level 1 (17392 queries for HQC, about 3 million for BIKE). It also gives a general method for finding effective fault locations by analysing decoder behaviour under perturbed conditions. Attacks were validated with laser fault injection on an STM32H7 microcontroller, showing a wider attack surface for code-based post-quantum KEM implementations.

HQCBIKESTM32H7
Fujisaki-Okamoto transformlaser fault injectionkey recovery+1

Hardware & RFΒ· Published and added 15 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Reaction Attack on CKKS Deployments with Asymptotically Optimal Query Complexity

Shows a protocol-level reaction attack on CKKS homomorphic-encryption deployments that publish coefficient-to-slot (C2S) evaluation keys and let the client return a 1-bit validity response. A malicious evaluator shifts a public encryption key, uses the public C2S layer to repack it into a ciphertext whose validity depends on one secret coefficient, and recovers a ternary secret key with O(H) queries, within a factor 2/log2(3) of the entropy lower bound. Each query is re-randomized with a fresh encryption of zero to evade trivial detection. The authors implemented it end to end in Lattigo v6.2.0 and recovered full keys across four standard CKKS parameter sets. It does not break RLWE or CKKS IND-CPA security.

LattigoCKKS
reaction attackcoefficient-to-slotRLWE+1

otherΒ· Published and added 15 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization

Paper arguing that agent human-approval prompts count as a second factor only if agent compromise cannot forge them and they name exactly what is approved. It defines twelve attacks on the approval path (decoy recipients, amount cancellation, card padding, label spoofing, enrollment squatting, threshold splitting) and tests them against AP2, Microsoft's action-bound approval design and MCP elicitation. An audit of ten agent runtimes found no third-party verifiable approval record and post-approval argument changes in four of eight. The reference defense ASU (Agent Step-Up) renders the card from a canonical effect descriptor, has a phone passkey sign its digest, and executes only the stored call. It is proven in Tamarin (53 lemmas) and evaluated on 27,108 scripted trials and 609 AgentDojo pairs. The trusted card cut forged-narration attack success from 0.54 to 0.03 and raised LLM-approver catch rate from 0.30 to 0.98.

Model Context ProtocolMicrosoft
Agent Payments ProtocolAgent Step-UpASU+6

AI Security, Identity & AccessΒ· Added 17 Oct 2026, published 15 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

FAEST on GPUs: Addressing Field Multiplication as a Bottleneck

ePrint paper presenting an NVIDIA GPU implementation of FAEST (a post-quantum signature scheme built on VOLE-in-the-Head and QuickSilver), covering key generation and OWFProve/OWFVerify for standard and EM constructions in s and f variants. Profiling shows field multiplication takes about 82% of FAEST-128f signing time once AES is hardware-accelerated. Using PTX clmad carry-less multiplication plus Karatsuba, it reaches up to 26.6x kernel throughput and about 2.9-3.1x full 256-bit OWFProve throughput over the software-multiplication build on an RTX A5000.

CUDANVIDIA RTX A5000PTX+1
FAESTQuickSilverVOLE-in-the-Head+3

otherΒ· Published and added 15 Oct 2026

arxiv.orgpaper🧠 AI

Recursive Reward Improvement via Adversarial Meta-Prompt Evolution

Introduces Recursive Reward Improvement (RRI) for recursive self-improvement on open-ended expert tasks without answer keys, where a proposer writes both a task and a rubric. Before the solver trains, an adversary writes a rubric-gaming but useless answer, the same model writes an honest answer without seeing the rubric, and up to two repair steps revise the rubric until the honest answer wins. Exploits found also rewrite future task and rubric generation. On HealthBench Professional it beats a Generation Only baseline by 10.9 points at 9B and 12.4 at 27B (10.3 with no external model), and the 27B model transfers to PRBench Hard (+6.6) and ProfBench (+8.0).

LLM
HealthBench ProfessionalPRBench HardProfBench+2

research, trainingΒ· Added 17 Oct 2026, published 15 Oct 2026

huggingface.copaper🧠 AI

Harness^2: Recursive Agent Harnessing for an Open World

Harness^2 is a plug-and-play framework that recursively improves LLM agent execution harnesses in open-world settings where no ground-truth verifiers exist. Task-level recursion uses a contrastive Propose-Probe-Compose step to guide harness edits for the current task, and it scales through parallel or sequential recursion. Harnessing-level recursion distills experience from those edits into a continual-improvement harness for future tasks. A single step improves GLM-5 and Gemini 3.5 Flash over their base harnesses by up to 11.5 points on WorkBuddy-Bench, 4.5 on JobBench and 11.8 percentage points on LAB.

GLMGeminiHugging Face
GLM-5Gemini 3.5 FlashWorkBuddy-Bench+2

agents, researchΒ· Added 14 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

From Detection to Decision: Calibration and Deferral for Prompt-Injection Detection

Evaluates a native probabilistic decision model (Jev), Llama Prompt Guard 2 (22M and 86M) and an LLM judge on 47,611 held-out examples covering direct/indirect prompt injection, hard-benign inputs, obfuscation and distribution shift. The LLM judge has the best AUROC (0.897), followed by Jev (0.871), Prompt Guard 2 86M (0.757) and 22M (0.714). Jev's native probabilities do not consistently beat post-hoc calibrated classifier scores, and temperature scaling improves calibration but not discrimination. At a 1% false-negative-rate target, every system needs over 91.8% escalation, so probabilistic outputs alone do not give reliable security decisions under distribution shift.

LlamaLLM
JevPrompt Guard 2prompt injection+1

AI SecurityΒ· Added 17 Oct 2026, published 14 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Thinking in Graphs: Neo4j-Backed Exploit-Chain Reasoning for LLM Penetration-Testing Agents

Presents ChainGraph, a pattern that externalizes exploit-chain reasoning for LLM pentest agents (Claude Code, Codex) into a Neo4j property graph exposed via the Model Context Protocol. Findings, attack steps, credentials, assets and tamper-evident evidence receipts are typed nodes with pre/post-condition edges, queried with Cypher and Graph Data Science for next-step inference, entry-to-crown-jewel pathing, chain-severity promotion, provenance and chokepoints. On a synthetic GOAD-style multi-forest Active Directory engagement, three Medium findings become Critical once chained, betweenness centrality identifies break-points, and reasoning payload drops ~98% (token proxy); results are single-run and illustrative.

Neo4jModel Context ProtocolClaude Code+3
ChainGraphGOADchain-severity score+1

Offensive Security, AI SecurityΒ· Added 17 Oct 2026, published 14 Oct 2026

arxiv.orgpaper🧠 AI

Thinking in Graphs: Neo4j-Backed Exploit-Chain Reasoning for LLM Penetration-Testing Agents

ChainGraph is a pattern that moves exploit-chain reasoning out of the flat context window and into a Neo4j property graph. Findings, attack steps, credentials, assets and tamper-evident evidence receipts are typed nodes with pre/post-condition edges. The graph is wired to Claude Code or Codex through MCP with no custom harness. Five operator questions (next-step inference, entry-to-crown-jewel pathing, combined-severity promotion, evidence provenance, chokepoint identification) become reusable Cypher and Graph Data Science queries, plus a chain-severity score. On a synthetic multi-forest Active Directory lab modeled on GOAD, three findings rated Medium in isolation become Critical once their path to the forest root is materialized. Scoping each decision to a graph result cut the reasoning payload by about 98% on a token proxy. The authors say the results are illustrative single-run measurements, not a benchmark.

Neo4jModel Context ProtocolClaude Code+4
ChainGraphGOADarXiv

agents, mcp, researchΒ· Added 17 Oct 2026, published 14 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

INFUSE: A Unified Surface Benchmark for Indirect Prompt Injection in Agentic Systems

INFUSE is an end-to-end benchmark for indirect prompt injection (IPI) across long-horizon agent workflows (shell commands, code changes, dependency installs, remote services). It has 40 realistic tasks and a taxonomy of 56 attack scenarios in five threat categories, with attacks injected via interaction surfaces encountered mid-task. Across 19 LLMs (GPT, Claude, Gemini, Llama, Gemma, Qwen) and 41,824 adversarial trajectories, mean attack success was 19.6% (LLM-judged) and 15.4% (heuristic), per-model 3.2–41.9%; guard models gave limited protection, while prompt-level hardening cut mean ASR from 58.2% to 14.3%.

LLMClaudeGemini+3
indirect prompt injectionINFUSE

AI SecurityΒ· Added 17 Oct 2026, published 14 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

A Hybrid BP-SAT Attack on MILENAGE: Combining the Complementary Strengths of Algebraic and Soft-Analytical Side-Channel Attacks

ePrint paper evaluating ASCA (SAT-based) and SASCA (belief propagation) side-channel attacks on the AES-based MILENAGE authentication algorithm in USIM cards, using neural-network leakage predictions to recover subscriber key K and operator secret OPc from a single trace. SASCA alone succeeds in 87.7% of attacks but converges to a wrong OPc in 6.1%; ASCA succeeds in only 34% within a 1-hour timeout. The hybrid, where BP refines the predictions before they go to the SAT solver, reaches 93.8% with lower average runtime. It also proposes a countermeasure that masks each AES round key with an independent per-device secret, and the authors report it defeated the hybrid attack in all evaluated cases.

AESMILENAGEUSIM
OPcSASCAASCA

Hardware & RFΒ· Added 15 Oct 2026, published 14 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Foundations of Hardware-Software Leakage Contracts

Survey-style paper introducing hardware-software leakage contracts, an ISA-level security abstraction that characterizes microarchitectural side-channel leakage (caches, speculative execution). It lets programmers and compilers produce code provably resistant to side-channel attacks like Spectre and Meltdown without reasoning about the microarchitecture, and gives hardware designers a specification to avoid undocumented side channels. It reviews recent contributions and open challenges.

SpectreMeltdownleakage contracts

Hardware & RFΒ· Added 17 Oct 2026, published 14 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Quantum-Aware Key Rank for Side-Channel Attacks evaluation

Proposes a cost model and metric for an adversary who collects side-channel traces classically and finishes the key search on a quantum computer. Shows any quantum algorithm needs Omega(sqrt(r)) cipher evaluations for key rank r, and that the quadratic advantage holds only up to a rank bound set by the NIST MAXDEPTH budget (about 2^58.6 for AES-128 at D=2^40). Defines a quantum-aware key rank computable from existing rank estimators, with simulated-leakage experiments showing a depth-limited quantum adversary is worth about 22 traces at SNR 0.125.

AES
NIST MAXDEPTHGrover's algorithmquantum search with advice+4

Hardware & RFΒ· Added 16 Oct 2026, published 14 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Uniform Sharing in Multiple Stages: Towards Second-Order Security

Presents an automated masking technique, extending the MultiStage approach, that gives second-order security in the glitch-extended probing model for arbitrary functions. It keeps fresh-mask requirements minimal as in NullFresh and avoids structural limits of earlier schemes. Applied to PRINCE, Midori and SKINNY, with formal verification in SILVER and PROLEAD and TVLA leakage testing on FPGA.

SILVERPROLEADFPGA
PRINCEMidoriSKINNY+6

Hardware & RFΒ· Added 15 Oct 2026, published 14 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Post-Quantum Certificate-Based PSK Provisioning for WireGuard via Mutual TLS, DTLS, and QUIC: Design and Performance Study

The paper proposes a post-quantum architecture for WireGuard that leaves the core protocol unchanged. A mutually authenticated TLS 1.3 control channel runs over TCP, UDP (DTLS) or QUIC and uses ML-KEM key establishment, with X.509 certificates from a PKI signed with ML-DSA. A shared secret derived from the session's exported keying material is injected into WireGuard's native PSK interface. A Tamarin model of the TLS–WireGuard composition layer checks secrecy, binding and provisioning-order properties and identifies the conditions needed for secure deployment. The authors benchmark handshake latency and CPU time for classical, pure-PQ and hybrid key establishment across the three transports, and compare against the Rosenpass PQ WireGuard baseline.

WireGuardVPN
ML-KEMML-DSARosenpass+5

otherΒ· Added 15 Oct 2026, published 14 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Hardware-Level Mitigation of Micro-Architectural Leakages in Embedded Processors

Proposes RTL-level architectural changes to general-purpose processors that remove the root causes of micro-architectural leakage, so masked cryptographic software runs securely under the Robust but Relaxed (RR) d-probing model without security-aware compilers or hardware-specific software workarounds. Each countermeasure is formally proven secure and integrated into the Ibex RISC-V core, which is evaluated by tool-assisted leakage assessment of the full netlist and by physical measurements on an FPGA.

IbexFPGA
Robust but Relaxed d-probing modelTCHES

Hardware & RFΒ· Published and added 14 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Tamper Sensing Meshes in Payment Terminals and Beyond

Teardown study of tamper sensing meshes (TSM) across a wide range of card payment terminals, ATM key pads and a data center HSM, with detailed photos of critical features. The authors build a taxonomy of mesh construction techniques, find most commercial meshes use simple constructions far from manufacturing limits, and derive a concise set of design patterns. They argue that meshes beating the industrial state of the art are feasible with cheap, readily available processes, giving researchers a basis for realistic test specimens.

Hardware Security ModulePayment terminalATM key pad
Jan Sebastian GΓΆtteBjΓΆrn ScheuermannTCHES

Hardware & RFΒ· Published and added 14 Oct 2026

ethereum-magicians.orgpaperπŸ›‘οΈ Security

ERC: Quantum Bridge Shield

Draft ERC from Quantova Inc that has Ethereum bridges accept cross-chain message batches only when a committee signs the Merkle root with RFC 8554 LMS hash-based signatures. The guard contract requires a strict majority of distinct unfrozen keys, records used leaves, freezes any key that signs a leaf twice, binds digests to domain tag, chain ID, guard address and epoch, and enforces a 60-second delay. It reports gas benchmarks (about 205k per LMS W4 height-10 verify, 12.44M worst-case rotation under EIP-7825), a hybrid LMS+ECDSA migration mode, and a NioLabs assessment with no critical or high findings. It argues that Shor's algorithm makes secp256k1 and BLS committee keys a quantum theft target.

EthereumLayerZero
Quantova IncNioLabsRFC 8554+7

BlockchainΒ· Published and added 14 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

edaBits in the Exponent (edaBitE) and Issuer-Hiding Blind Signatures from ML-DSA and VOLE-in-the-Head

Presents the first blind signature in which the issuer runs unmodified NIST-standardized ML-DSA, so it works with certified secure elements. Issuance is an ML-DSA signature on a commitment. The blind signature is a VOLE-in-the-head zero-knowledge proof of knowledge of that signature, about 1 MB, under 1 s to produce and 0.5 s to verify. Security reduces to ML-DSA EUF-CMA and the proof system. Issuer-hiding and selective disclosure add a few tens of KB. The paper also introduces edaBitE, a batch consistency check between binary and prime-field commitments that replaces the costly edaBits checks.

ML-DSAVOLE-in-the-Head
edaBitEedaBitsNIST+1

Identity & AccessΒ· Published and added 14 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Nowhere Man: Device Binding for Post-Quantum Anonymous Credentials

Presents a modular device-binding protocol for post-quantum anonymous credentials. The phone Secure Element signs a verifier challenge with an unmodified FIPS 204 ML-DSA interface, and the user proves knowledge of that signature in zero knowledge at each presentation. Using ML-DSA's structure avoids the cost of generic NIZK systems such as Longfellow. The most efficient variants assume weak-MLWR for unlinkability, and that assumption can be dropped at some efficiency cost. The protocol works with different anonymous credential schemes, and a proof-of-concept implementation is included. This matters for planned EU age-verification and Google Wallet/mDL rollouts, which need protection against credential sharing.

LongfellowGoogle Wallet
ML-DSAFIPS 204Vega+2

Identity & AccessΒ· Published and added 14 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Connecting Cryptanalytic Distinguishers through Divisibility

Paper that links linear, integral, differential-linear and restricted differential distinguishers through two-way conversions with explicit divisibility guarantees and data complexity. It gives automated MILP/SAT models (Walsh and ultrametric representations, exact mix-basis models) and a black-box FWHT histogram search for zeros and finite divisibility. It improves Beyne–Verbauwhede divisibility bounds in 674 SIMON cases (e.g. 2^5 to 2^11 on 9-round SIMON32) and PRESENT. It also gives first higher-divisibility proofs for 8-round SPECK and BEANIE, new bounds for GIFT-64 and Ascon, and new properties on RC5, ChiLow-32, KeeLoq and KATAN32.

SIMONSPECKPRESENT+3
Hosein HadipourBeyne and VerbauwhedeBEANIE+4

otherΒ· Published and added 14 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Refined Application of the XL Algorithm within the Algebraic Approach to the Regular Syndrome Decoding Problem

Furue and Aikawa build and analyze algebraic attacks on the Regular Syndrome Decoding Problem (RSDP), which underlies code-based post-quantum schemes. They extend the Wang et al. hybrid algorithm to allow an arbitrary XL solving degree d, and add two variants: an XFL-based one (partial Gaussian elimination plus variable guessing) and a WXL-based one that exploits Macaulay matrix sparsity. Complexity analysis shows the WXL variant with d>2 wins for small block size Ξ², while the original hybrid wins as Ξ² grows. This matters for setting RSDP-based scheme parameters.

Regular Syndrome Decoding ProblemSyndrome Decoding ProblemXL algorithm+4

otherΒ· Published and added 14 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Accelerating Pollard Rho with GPU Field Arithmetic on NVIDIA Blackwell

Preprint that speeds up Pollard rho on GPUs by rebuilding field arithmetic: packed normal-basis representation, the CUDA 13.3 PTX carry-less multiply (clmad), and three-input logic instructions. On one RTX PRO 6000 Blackwell it goes from 0.85 to 14.64 billion iterations/s (17.2x) on the Certicom ECC2K-130 challenge, which puts the whole challenge under five GPU-years. The same levers give 1.52x on P-256 and 2.61x on P-384, which leaves P-256 about 6e21 card-years away. It also reports twelve GPUs from Turing to Blackwell, an FPGA engine on AWS F2 and a campaign that covered 5.4% of the expected work, with code and a Dockerfile on GitHub (rho-blackwell). It claims no improvement on the generic-group bound.

CUDANVIDIA BlackwellAWS+1
Pollard rhoECC2K-130Certicom challenge+5

otherΒ· Published and added 14 Oct 2026

eprint.iacr.orgpaper🧠 AI

DPF-SGD: Byzantine-Robust Differentially Private Federated SGD with Exact Optimality Guarantees

DPF-SGD is a federated SGD algorithm that stays robust to Byzantine agents while satisfying Ο΅-differential privacy. It combines private step sizes with a DP noise-decay schedule and adds a privacy-preserving comparative elimination (PPCE) filter that suppresses Byzantine updates during aggregation. The authors prove almost-sure convergence to the global optimum despite persistent noise and adversaries. On synthetic and MNIST data, final optimization error is one to two orders of magnitude lower than DP baselines.

DPF-SGDSGD
MNIST

research, trainingΒ· Published and added 14 Oct 2026

huggingface.copaper🧠 AI

Scaling Agentic Data for Long-Horizon Terminal Intelligence

Introduces TerminalHorizon, a fully automated data synthesis engine for long-horizon terminal agents. It uses independent execution to find key work omitted during environment construction and rebuilds the environment from that evidence. It then progressively expands tasks under the same goal with new requirements that build on earlier results. The authors build 1.5K task environments and run supervised fine-tuning of Qwen3.5-27B to get TerminalHorizon-27B, which improves on all 12 benchmarks covering coding-agent tasks, real-world production agentic tasks and general reasoning. Multiple RSI case studies with a 12-hour research budget show the model continuing to experiment past an initial solution and keeping effective improvements in its final deliverables.

Qwen3.5Hugging Face
TerminalHorizonTerminalHorizon-27B

training, agents, researchΒ· Added 13 Oct 2026

huggingface.copaper🧠 AI

AgentSWE: Can Coding Agents Build the Agent You Actually Want?

AgentSWE is a benchmark of 25 tasks covering the agent development lifecycle: Creation of an agent from a natural-language requirement, Editing of production agent codebases, and Optimization toward a measurable target. Builders iterate on a few illustrative cases, then the frozen submission is graded on held-out cases with requirement-derived rubrics and hard pass/fail gates. Across coding agents, models and harnesses, none comes close to delivering the requirement. Recurring failures include overfitting to visible cases, hollow runtimes behind code that looks complete, and unsupported claims of completion.

AgentSWEHugging Face

evals, coding-agents, agentsΒ· Added 13 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Snapshots of TEE-Based Encrypted Databases Leak Plaintext Histograms via Dendrochronology

ePrint entry for an ACM CCS 2026 paper in the "Attacks and cryptanalysis" category. By its title and keywords, it shows that snapshots of encrypted databases built on trusted execution environments leak plaintext frequency histograms, using a technique called "dendrochronology". The abstract and full text are embargoed until the end of October 2026, so the attack mechanics are not available yet. It matters to anyone assessing the real leakage of TEE-backed encrypted databases against snapshot adversaries.

Zachary EspirituACM CCS 2026

otherΒ· Added 14 Oct 2026, published 13 Oct 2026

eprint.iacr.orgpaper🧠 AI

A Graph-Based Analysis of Comparability, Scale, and Attribution in Private Transformer Inference

Systematization of knowledge on private Transformer inference (PTI) that builds an empirical graph of 62 systems, with system attributes as node features and evaluation compatibility as edges. Node-level attribution finds that cryptographic progress drives most speedups but always co-occurs with confounders such as model fidelity, hardware and cost accounting. Edge-level auditing finds only 1 of 1891 candidate system pairs directly comparable. Graph-level analysis shows the scale frontier plateaued at 13B parameters and projects the cost of deploying current PTI techniques on production-scale Transformers.

TransformerLLM
Souvik DasAriful AzadNitesh Saxena

research, inference, evalsΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

ChunkAct: Action Chunking for Agentic Robotics

ChunkAct brings action chunking to agentic robotics, where an LLM agent composes perception, motion and VLA tools guided by memory. Online, one call launches a chain of primitives that runs autonomously and returns control only on failure. Offline, memory is compiled into these chunks so execution needs no memory at test time and the planner is used only for real decisions. On LIBERO-Pro it improves task success by 5.0 points over the prior agentic-robotics state of the art, with 2.9x fewer LLM calls, 4.4x fewer input tokens and 2.3x fewer output tokens.

LLMvision-language-action model
ChunkActLIBERO-Pro

research, agents, multimodalΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

Dog-Breed Text-to-image Flow Matching from Pretraining to Fine-Tuning on 4 Consumer GPUs

MiniDog is a framework for training a text-to-image flow-matching diffusion transformer from scratch on four RTX 3090 GPUs, with 55 minutes of pretraining and 15 minutes of fine-tuning. It pretrains on 26k ImageNet dog images that were captioned, then fine-tunes on 2k FLUX.1-schnell generated images. Image and text features are precomputed and cached. The model is a 22M-parameter transformer with the E2E-INVAE semantic latent space, a small Qwen text encoder and in-context conditioning, and training is accelerated with iREPA and an EUPE perception encoder. The repo evaluates with FID, HPSv2, PickScore and VAE reconstruction metrics. It lowers the barrier to hands-on diffusion training research.

flow matchingdiffusion modelTransformer+1
MiniDogImageNetFLUX.1-schnell+7

research, training, multimodalΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

Hybrid Reasoning Agents

Introduces Hybrid Reasoning Agents (HybridAgents), which switch between latent reasoning and text-based interaction in one generation process. A lightweight HybridLink handles transitions between the two modes, and a continuous working memory keeps hybrid context lossless across turns. This keeps tool use and makes latent thoughts inspectable. Post-training has two stages: HybridSFT, then HybridRL, which learns when to think latently and when to act in text. Across 3 model scales and 11 benchmarks (math, science, medicine, search, agentic reasoning), the authors report +10.4% performance, 35.5–54.7% fewer tokens, 1.8–2.6x faster inference and 2.7–3.7x lower cost versus text and latent baselines.

LLM
HybridAgentHybridLinkHybridSFT+2

research, agents, trainingΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

Visual Tokens on Demand: Visual Budgeting for Scalable and Efficient Multi-Image Reasoning in Multimodal LLMs

Proposes mmVB, a lightweight plug-and-play module (1.6M trainable parameters) that assigns query-conditioned per-image visual token budgets using cross-image context for multimodal LLMs, without retraining the base model or accessing attention matrices (so it is compatible with FlashAttention). It cuts visual input tokens 9x, giving 5x faster time-to-first-token and 7x fewer prefill FLOPs while keeping 94.4% of full-resolution accuracy across eight multi-image reasoning benchmarks. It matters because existing token pruning, merging and compression methods target single-image redundancy and either need attention maps or retraining.

FlashAttentionvision-language model
mmVB

research, multimodal, inferenceΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

PixelMoE: Scaling Pixel-Space Diffusion with LLM-Style Mixture-of-Experts

PixelMoE is a pixel-space diffusion framework that scales capacity sparsely using standard LLM-style Mixture-of-Experts: token-choice routing, fine-grained routed experts, a shared expert and bias-based load balancing, with no diffusion-specific routing or auxiliary routing losses. It adds Pixel-Space Hierarchical Flow Matching, which varies spatial resolution along the denoising trajectory from global structure to fine detail. At matched active parameters it beats dense counterparts, and reaches FID 1.47 at 256x256 and 1.53 at 512x512 on class-conditional ImageNet-1K without representation alignment or perceptual losses. Code and models are promised but not yet released.

Mixture of Expertsdiffusion modelflow matching+1
PixelMoEImageNet-1KarXiv

research, multimodalΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

RepProbe: Can Video Language Models Count Repeated Actions? A Diagnostic Benchmark

RepProbe is a benchmark of 42K real and synthetic video clips with exactly 1–20 complete action repetitions, controlling for clip position, temporal coverage and duration. Video language models' counting accuracy collapses at high counts, and this is not explained by frame sampling alone. Linear probes on final-layer representations show count information stays linearly decodable even when the model's answer is wrong, so the failure arises at the output stage, where answers cluster on a few preferred numbers.

vision-language model
RepProbearXiv

evals, multimodal, researchΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

Plan-Bench: Can Existing VLMs Go Well Beyond Perception to Reason and Plan in Embodied Worlds?

Plan-Bench is a benchmark of 699 curated samples across 16 subclasses and three dimensions. It tests whether vision-language models can reason over spatial and temporal information and produce multi-step plans under constraints for embodied tasks, with action execution isolated out. Across 28 VLMs the best model reaches only 75.0% accuracy. Scaling generally helps, and larger models look more promising as high-level planners. Code and benchmark are released.

vision-language model
Plan-BencharXiv

evals, multimodal, researchΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

Game2Real-Bench: Do Toy Games Reveal and Transfer to Real-World Visual Reasoning?

Game2Real-Bench tests whether vision-language model performance on procedurally generated toy games predicts real-world visual reasoning, and whether game examples help transfer. It has 1,000 verifiable game samples and 400 real-world samples, matched by shared reasoning requirements (fine-grained perception, spatial reasoning, constraint reasoning, sequential planning). Across 25 VLMs, game and real scores correlate strongly (Pearson/Spearman 0.935). One-shot game-to-real transfer on four models improves constraint reasoning for several but hurts fine-grained perception. The authors also release Game2Real-Dataset, with about 24K verified game samples across 18 tasks and 65 QA families.

vision-language model
Game2Real-BenchGame2Real-DatasetarXiv

evals, multimodal, researchΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

OmniCompass: A Holistic Benchmark for Omni-Modal Video Grounding and Understanding

OmniCompass is a manually annotated benchmark for video grounding and understanding with two tracks: OmniCompass-VL (820 videos, 2,460 instances; vision-language models) and OmniCompass-AV (240 videos, 720 instances; joint audio-visual evidence for omni-modal models). Each track covers temporal grounding, spatial grounding and QA across short/medium/long videos, and each instance is run in paired text-only and text+image target specifications. Evaluating 50 MLLMs shows open-source models lag proprietary ones, especially on audio-visual understanding, that precise temporal/spatial grounding remains hard, and that predictions are inconsistent across the paired specifications.

vision-language modelMLLM
OmniCompassOmniCompass-VLOmniCompass-AV+1

evals, multimodal, researchΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

Beyond the Verdict: Agentic Code Judging with Verifiable Feedback

Proposes a task where a model judges and diagnoses a candidate program from only the problem statement and source code, backing its verdict with generated counterexamples that can be checked by execution. The authors build USACO-JUDGE from USACO 2026 contests (human and LLM-written accepted and unaccepted programs) and train ARBITER, a 35B MoE agentic verifier, with reinforcement learning in a generic execution sandbox. Training lifts counterexample success on incorrect programs from 40.61% to 62.67% and mean binary verdict accuracy from 71.41% to 87.41%. ARBITER also improves code selection and refinement, and in an IOI 2026 case study its guided refinement lifts GPT-OSS-120B's expected score above the gold-medal threshold under the official submission limit.

Mixture of ExpertsLLM
ARBITERUSACO-JUDGEUSACO+3

research, coding-agents, evals, trainingΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

SP$^2$ec: Adaptive Self-Speculative Decoding for Vision-Language Models

SP$^2$ec (Single-Peak SPeculative decoding) is a training-free bandit algorithm that adapts the draft configuration of self-speculative decoding per prompt for vision-language models. It relies on the single-peak throughput pattern seen in SWIFT, KnapSpec, SpecVLM and the authors' cosSim method. It minimizes a new wall-time regret measure and has theoretical guarantees of near-optimal configuration with negligible exploration cost. On Qwen2.5-VL-7B-Instruct and LLaVA-NeXT-Mistral-7B it improves over the original self-speculative methods by up to 11% on visual and textual tasks.

vision-language modelQwenMistral
SP$^2$ecSWIFTKnapSpec+5

research, inference, multimodalΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

UniW(A)M: A Unified Mixture-of-Experts Framework for World and World-Action Models

UniW(A)M is a mixture-of-experts model built on diffusion Transformers that unifies action-conditioned world modeling (AC-WM) with several world-action model (WAM) variants. Shared experts capture common physical dynamics, while atomic capability experts are reused across interfaces, each keeping its own conditional pathway. At deployment a plug-in adaptive interface router (PAIR), trained on a small subset of target-task chunk scenarios with the backbone frozen, picks a WAM interface for each execution chunk. It reaches 88.3% average real-world success against 76.7% for the strongest baseline, leads WorldArena on all three action-conditioned world-modeling tasks, and PAIR raises OOD success from 63.3% to 76.7%.

Mixture of Expertsdiffusion modelTransformer
UniW(A)MPAIRLIBERO+3

research, multimodalΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

ProAS: A Progress-Aware Advantage Shaping Framework for Multi-Turn Agentic Reinforcement Learning

ProAS (Progress-Aware Advantage Shaping) is a plug-and-play framework for multi-turn agentic RL that fixes the uniform credit assignment problem in critic-free algorithms like GRPO, where trajectory-level advantages are broadcast to every action. It uses a dynamically evolving Agentic Reference Graph with Masking Unreasonable Incentives and Asymmetric Penalty Redistribution to give finer-grained credit without a critic. On Qwen2.5-1.5B/7B-Instruct it reports success rates up to 91.9%/94.3% on ALFWorld and 66.7%/70.8% on WebShop, with up to 2.44x faster training convergence and robustness to imperfect or distilled ARGs.

GRPOQwen
ProASAgentic Reference GraphALFWorld+4

training, agents, researchΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

Kwai Summary Attention V2 Technical Report

Technical report for Kwai Summary Attention V2 (KSA V2), which extends summary-token attention architectures that compress distant context into one learnable summary token per chunk. Hybrid KSA-Full models force the same compression chunk size in every layer and leave full-attention layers paying quadratic prefill cost. KSA V2 lets summary tokens serve two roles, as KV memory and as a sparse indexer. This allows per-layer compression windows for more flexible KV cache compression and lowers computation in the full-attention layers.

Transformer
Kwai Summary AttentionKSA V2arXiv

researchΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

MultiAlloc: Budget-Aware Precision Allocation for KV Cache Quantization

MultiAlloc is a profiling-guided framework for KV cache quantization. It splits a fixed KV memory budget between layer-wise precision enhancement and token-wise preservation. Lightweight offline profiling measures layer sensitivity and token importance, and the profiled memory–accuracy trade-off yields an allocation policy with no online search. The paper reports gains over layer-wise, token-wise and recent multi-granularity KV quantization baselines at matched memory on reasoning and long-context benchmarks, across Mistral, Llama, DeepSeek-Qwen and QwQ models.

LLMTransformer
MultiAllocMistralLlama+4

inference, researchΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

Geometric Calibration of Supervised Fine-Tuning

Proposes Geometric Calibration of supervised fine-tuning and SPACE (Subspace Projection for Adapted Checkpoint Enhancement). SPACE is a post-hoc, data-free, training-free method that uses the pre- and post-SFT checkpoints to revert SFT update components lying in the principal subspace of the pre-SFT weights and keep those in the orthogonal complement. It is evaluated on Qwen2.5, Qwen3, Qwen3.5, Llama-3.1 and Olmo-3 models (2B–14B) with math, coding and medical SFT. It reduces out-of-domain regression and improves in-domain performance, for example +2.85 ID / +2.26 OOD on Qwen2.5-7B math SFT.

QwenQwen3Qwen3.5+1
Qwen2.5Olmo-3Qwen2.5-7B+2

research, trainingΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

Legal-R1: Agentic Retrieval for Evidence-Based Legal Reasoning

Legal-R1 is an agentic retrieval framework for evidence-based legal question answering that splits reasoning across three agents. A Lawyer agent decides when to retrieve, which legal source to query, what evidence to seek and when it has enough. A Legal Assistant retrieves statutes and precedent cases with authority-aware and diversity-aware selection, and a Judge agent writes the final answer from the full evidence trajectory. Only the Lawyer agent is post-trained, using masked supervised fine-tuning and trajectory-aware reinforcement learning. The paper reports gains over general-purpose, legal-specific and retrieval-augmented baselines on several Chinese legal benchmarks.

RAG
Legal-R1arXiv

research, agents, llm-appsΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

LLM Agents for Automated Post-Training via Structured Recipe Optimization

Introduces Structured Recipe Optimization (SRO), a paradigm for automated LLM post-training that optimizes over a task-adapted recipe space covering data sources, data processing, cross-domain composition and training configuration. It pairs an LLM-based Recipe-Space Designer, which builds the recipe space for the target tasks, with a Multi-Domain Recipe Optimizer that uses structured trial evidence to guide LLM candidate construction and multi-objective Bayesian trial selection. SRO gets the highest average score in all evaluated target-model and agent-LLM combinations; for example, 41.1 vs 15.4 for the strongest baseline on Qwen3-1.7B with GPT-5.4, and 53.8 vs 40.8 on Qwen3-4B with DeepSeek-V4-Flash, in joint post-training across three capability domains and six benchmarks.

Qwen3LLM
Structured Recipe OptimizationGPT-5.4DeepSeek-V4-Flash+1

research, training, agentsΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

Configuring RAG Systems: What Breaks, Where Originates, and How to Fix

First large-scale empirical study of RAG configuration issues, covering 654 real-world issues collected from 10 diverse RAG systems. It categorizes symptoms, root causes, affected pipeline stages and fix patterns. It finds that symptoms mostly appear at early or late stages, while the root cause often sits in a different stage from where the symptom shows. It closes with nine actionable insights for testing, localizing and fixing RAG configuration problems.

RAGLLM
arXiv

research, llm-appsΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Towards Safe Autonomy for Computer Use

Introduces SA-CUA, a dual-LLM framework that gives Computer Use Agents a trust boundary against indirect prompt injection. It derives conservative deterministic rules from the accessibility tree to unmask trusted screen regions for the privileged LLM, and adds an endorsement channel that moves values from untrusted to trusted domains by verification. Human input is needed only at task specification. It reports much higher utility than CaMeL-CUA with a zero attack success rate.

LLM
SA-CUACaMeL-CUACaMeL+2

AI SecurityΒ· Added 15 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

Towards Safe Autonomy for Computer Use

Introduces SA-CUA, a dual-LLM framework for Computer Use Agents (CUAs) that defends against indirect prompt injection. It builds a trust boundary by deriving conservative deterministic rules from the accessibility tree, which unmask trusted screen regions in the privileged LLM's screenshot and keep untrusted content separate. An endorsement channel lets values move from the untrusted to the trusted domain through verification over trusted channels. This removes the need for per-action user confirmation and the confirmation fatigue it causes. SA-CUA is reported to keep much higher utility than CaMeL-CUA with a 0% attack success rate.

LLM
SA-CUACaMeL-CUACaMeL

agents, researchΒ· Added 15 Oct 2026, published 13 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Hybrid Quantum–Computational Key Distribution with Reduced Assumptions (Short Paper)

Short paper analysing the HM-QCT hybrid quantum–computational time-lock QKD protocol (Mazzoncini et al., 2025). It spells out the two "harvest now, decrypt later" strategies (quantum memory and classical memory) and shows each is excluded by exactly one of the two assumptions: short-term encryption and low-fidelity quantum storage. It then proposes HM-PRF, which replaces the short-term encryption with a locally evaluated pseudorandom function, so security needs only one-way functions rather than a predicted lasting gap in quantum memory technology.

HM-QCTHM-PRFharvest now, decrypt later+3

otherΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents

Kairos is a reference monitor placed at the isolation boundary of an unmodified, opaque LLM agent, where tool calls, shell commands and agent-written scripts all appear as the same file and network operations. A declarative trust policy decides most effects deterministically and defers the rest; deferred effects are held while the agent continues speculatively, and a bounded-authority decision oracle (an LLM or a human) releases or refuses them based on the trace. Across three benchmarks and three agent models it beats existing defenses on the attack-success/utility trade-off; on AgentDojo it cuts attack success from 47.0% to 2.7% with no loss of benign utility.

LLM
indirect prompt injectionAgentDojo

AI SecurityΒ· Added 15 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

EmoGenie: Benchmarking and Evaluating Expressed and Evoked Emotion in T2I Generation with MLLMs

EmoGenie is a benchmark for emotions expressed and evoked by text-to-image outputs. It has 6,400 images from eight T2I models using 800 emotion-targeted prompts. It includes EmoGenie-QA (90,000 closed-set and 1,057 open-ended questions) and EmoGenie-Assess (13,175 mean opinion scores for valence, arousal, dominance and aesthetic quality). The authors also propose EmoProbe, which pairs emotion QA with response-aligned, dimension-specific regression heads. They report that it beats baselines on emotion QA and correlates better with human ratings. The work shows how reliably MLLMs interpret affect in generated images.

multimodal large language modeltext-to-image
EmoGenieEmoGenie-QAEmoGenie-Assess+2

evals, multimodal, researchΒ· Added 14 Oct 2026, published 13 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Leakage-Resilient Incompressible Cryptography: Constructions and Barriers

Introduces leakage-resilient incompressible cryptography, a security model combining leakage resilience (partial key leakage plus full ciphertext) with incompressibility (full key but only part of the ciphertext or signature). It gives a transformation from incompressible symmetric-key encryption (SKE) to leakage-resilient incompressible SKE, a leakage-resilient incompressible PKE built from a new leakage-resilient non-committing KEM, and an incompressible SKE with ciphertext and compression rate 1/2 using invertible extractors. It also gives a leakage-resilient incompressible signature scheme in the random oracle model under DCR or LWE plus Decisional Linear. Black-box impossibility results show barriers to improving these parameters.

DziembowskiDecisional Linear assumptionLWE+3

otherΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

Heading Hierarchy Reconstruction for Complex and Long Documents with Level-Wise Multimodal Memory

Proposes a vision-language-model framework that incrementally reconstructs heading hierarchies across tens or hundreds of pages using a level-wise multimodal memory. The memory keeps a compact set of earlier pages chosen by anchors (here, the most recent node at each heading level), so the VLM sees the visual, textual and layout patterns of headings at every level. The authors also introduce CLDoc-HHRBench (250 documents, 11,212 pages, expert-verified annotations) and report results on it and three existing benchmarks. It matters for RAG pipelines that need coherent document-level structure, which page-by-page OCR/VLM parsing doesn't give.

vision-language modelRAG
CLDoc-HHRBencharXiv

research, multimodal, evalsΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

Claim Framing as a Driver of LLM Sycophancy

Systematic study of which framings of a user's claim trigger sycophancy in factual question answering, where every answer is objectively verifiable. Across 14 models and 42K questions, correct and incorrect user opinions are expressed through 21 framing types in 8 dimensions, and multiple opinion-driven behaviors are measured. All models are susceptible regardless of size; confidence of statement, attribution to whom, and framing as shared between user and model matter most, while expertise, authority and social pressure matter little. Larger models resist incorrect opinions better but are no better at recovering from their own errors, so the authors argue sycophancy evals must probe framing and measure more than a single flip rate.

LLM
arXiv

ai-safety, evals, researchΒ· Added 14 Oct 2026, published 13 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Cube Attacks with Elimination Strategy: Key Recovery Attacks on Trivium

Introduces a cube-attack framework with an elimination strategy. It finds key conditions and cubes whose conditional superpolies are cheap to compute, then solves the resulting equation systems to recover key bits. The supporting techniques are a nested coefficient solver, conditional monomial prediction, an automated cube search combining numeric mapping with monomial prediction, and two testing methods for large equation systems. Against round-reduced Trivium it gives a practical key recovery at 840 rounds (complexity below 2^55, 77.8% success) and at 845 rounds (below 2^56, 98.1% success on 59.1% of keys). It also gives a theoretical weak-key attack at 855 rounds for 2^74 keys. These are the best known results, extending prior practical attacks by 13 rounds and theoretical attacks by 4.

Trivium
cube attackmonomial predictionsuperpoly+2

otherΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

Seeing Through the Forgery Is Not Enough: Regressive Sycophancy under Fabricated Evidence in Medical Vision-Language Models

The paper studies regressive sycophancy under fabricated evidence: a medical VLM gives a correct answer, then abandons it when the user pushes back with a fake prescription. It tests four open VLMs on 400 VQA-RAD yes/no questions in 19,200 multi-turn conversations. Without a synthetic-document disclosure, models abandon 80.1% of 6,488 correct answers, and the same prescription raises Qwen2.5-VL-7B's flip rate from 45.9% to 89.6% while lowering Qwen3-VL-8B's from 77.7% to 50.9%. Models often reject the prescription yet keep the correct answer in only some conversations (915 of 3,232), and 40% of those flip later. System-prompt disclosure of synthetic documents cuts one model's flip rate from 77.8% to 47.3%. The authors conclude that recognising a forgery does not stop a model from adopting the forged answer.

vision-language modelQwen3-VL
VQA-RADQwen2.5-VL-7BQwen3-VL-8B+1

ai-safety, multimodal, evalsΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

Evidence-First Agentic Verification

Introduces Sauron, an evidence-first agentic verifier that checks rubric criteria for long-horizon agent tasks by investigating both environment state and execution trace, and trusts a claim (including an agent's self-reported success) only after validating it against its source. Bounded queries and joint investigation of related criteria cut context use, and each verdict carries an auditable evidence receipt. On 2,586 human-labeled criteria from 100 personal-assistant episodes it has the best F1 of five verifiers across eight backbones (0.96 vs 0.92 for Gandalf with GPT-5.6 Sol, at 23% lower cost). It detects 97% of injected failures across 13 fault families, including reward-hacking simulations, with 2% false flags on clean controls, and leads on the TRAIL agent-error benchmark. It matters because unreliable rubric verdicts used as RL rewards can reinforce bad behavior.

SauronGandalfTRAIL+2

evals, agents, researchΒ· Added 14 Oct 2026, published 13 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Causal Awareness in End-to-End Encrypted Group Messaging

Cryptography paper that extends Chen and Fischlin's two-user Signal analysis (Eurocrypt 2024) to group chats. It introduces "causal awareness": a receiver can reconstruct part of the causal context in which an accepted message was sent. Network delay or adversarial interference can otherwise show an authentic message in a misleading context. Senders transmit records of what they have sent and received, and receivers verify these records and compare them with their own. The paper gives correctness and security definitions parameterized by how much causal information must be recovered, baseline constructions with proofs, and checkpoint-aided and server-aided variants. It also discusses how to surface this information in a messenger's UI.

Signal
Chen and Fischlincausal awarenessLamport clocks+1

otherΒ· Added 14 Oct 2026, published 13 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Master-Key Recovery from Internal Activation Leakage in ReLU Realizations of Camellia

The paper builds explicit ReLU neural-network realizations of Camellia-128/192/256 from exact Boolean gates, S-box selectors and bit permutations, and reports known-answer-test agreement for Camellia-128. It shows that whitening and round-key quantities leaked from internal activations determine the master key through public key-schedule identities. Under a synthetic internal-oracle model, symmetric real-valued perturbations recover subkey bits with 128 queries (Camellia-128) or 256 (Camellia-256). Camellia-192 is handled by deterministic key-schedule inversion from direct access to round keys. All 3,000 trials (1,000 keys per variant) recovered the key exactly. The authors state this is not a plaintext/ciphertext-only attack on standard Camellia.

Camellia
Kwangjo Kim

otherΒ· Added 14 Oct 2026, published 13 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

On Secure Sorting and Its Application to Privacy-Preserving Graph Pattern Matching

Marcel Keller's ePrint compares the two fully secure MPC sorting approaches, Quicksort (Araki et al., CCS'21) and radix sort (Asharov et al., CCS'22). The comparison covers a range of parameters, for both honest- and dishonest-majority settings. The paper then extends the sparse matrix multiplication of Damie et al. (CODASPY'26), which avoids oblivious RAM, so the output comes out in the same format as the inputs. That makes repeated multiplication of graph adjacency matrices possible, which the paper uses to find cycles and scatter-gather patterns associated with money laundering. The result is privacy-preserving anti-money-laundering detection.

Marcel KellerAraki et al.Asharov et al.+2

otherΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

BrowseSafe++: Benchmarking Prompt Injection Detection Across Web Contexts, Languages, and Browser Views

BrowseSafe++ extends BrowseSafe to 38,675 paired attacked/clean web pages, most with prompt injections observed in the wild on production sites. Pages cover twelve site types, 24 attack types and 18 injection locations, each given as HTML, Markdown, accessibility tree and screenshot with a user task and expected answer. The authors train BrowseSafe-Guard, two 0.8B detectors (text and screenshot) that beat a frontier-model-based detector on F1 with low false positives and low inference cost. BrowseSafe-Adapt rewrites injections using browser-agent feedback, raising attack success from a few percent to up to 95.41%.

LLM
BrowseSafe++BrowseSafeBrowseSafe-Guard+3

AI SecurityΒ· Added 15 Oct 2026, published 12 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

On the Expected Number of Iterations in ML-DSA Signing: A Complete Accounting of the Rejection Conditions

ePrint paper showing that FIPS 204 Table 1's expected iteration counts for the ML-DSA signing loop cover only the line-23 validity checks (z and r0 norms). They omit the two line-28 encoding-correctness checks (β€–cΒ·t0β€–βˆž and hint weight). It accounts for all four conditions: z by exact counting, cΒ·t0 by an Irwin-Hall tail, and hint weight by a closed-form conditioned per-coefficient probability with a Monte Carlo tail estimate. Corrected expected iterations are 4.36, 5.14 and 3.91 for ML-DSA-44, -65 and -87, within 0.14% of an end-to-end measurement and consistent with NIST's FIPS 204 errata.

CRYSTALS-Dilithium
ML-DSAFIPS 204NIST+2

otherΒ· Added 14 Oct 2026, published 12 Oct 2026

anthropic.compaperπŸ›‘οΈ Security

AI models may be capable of self-replicating without access to a datacenter

Anthropic's Frontier Red Team tests whether small open-weight models (≀30B) can autonomously replicate across commodity IoT devices. They ran Gemma4-26B-A4B over 15 off-brand Android TV boxes at 0.39 tok/s with pipeline parallelism. A Qwen3.5-9B-class model set up inference on 8 of 9 hardware types, and only GLM-5.2 completed end-to-end worm replication in an 8-node redroid ADB network, spreading to 8/8 nodes in 4 of 5 trials and 7/8 in the other. It also estimates spread using the Kimwolf botnet's size (~133k replicas, about 40 H100s of compute), shows notes inherited between generations improve Qwen3.5-9B's setup success (45% to 61–84%), and projects small models reaching the capability floor by end of 2026. It closes with defensive points: drive R0 below 1, and harden IoT devices.

GLMQwenAndroid+2
KimwolfMiraiMemento+8

AI Security, Threat Intel, Hardware & RFΒ· Published and added 12 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

CUTS: Chained Uniform-sum Tree Signatures

The paper analyses stateful hash-based signatures whose key is a tree of hash chains, and asks what a second signature from the same one-time key reveals after state loss or rollback. It proves that the values derivable from several signatures are exactly the union of those from each signature alone. It also bounds forgery after b signatures in the classical random-oracle model by a combinatorial coverage exponent Ξ»_b, including when the signer grinds a counter. It then introduces CUTS, a scheme on one binary tree whose chain positions sum to a fixed value S and whose signature size and verification cost do not depend on tree height. One parameter set has 1,424-byte signatures and Ξ»_2 β‰₯ 128.6. A counter variant, CUTS+C, gives a proven grinding gain.

CUTSCUTS+C

otherΒ· Added 14 Oct 2026, published 12 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Revisiting Witness-Succinct UC-lifting Compilers

The paper introduces verifiable reconstructible straightline codes (VRSCs) as an abstraction for compiling zkSNARKs into Universally Composable (UC) secure protocols. It shows that the witness-succinct UC compiler of Ganesh et al. (EUROCRYPT 2023) is missing a security requirement: permuting previously revealed evaluation openings yields a fresh accepting proof, which invalidates the claimed simulation argument. The fix uses verifier-enforced disjoint evaluation domains and a pairing-based Fischlin-style instantiation with structured Reed-Solomon codes and jointly computed KZG openings. This brings certificate generation to O(n log n) with constant extra proof size and verification work.

zkSNARKKZGReed-Solomon codes
Universal Composabilityverifiable reconstructible straightline codesGanesh et al.+3

otherΒ· Added 14 Oct 2026, published 12 Oct 2026

endorlabs.compaperπŸ›‘οΈ Security

2024 Dependency Management Report | Endor Labs

Endor Labs' 2024 report on open-source dependency management and vulnerability prioritization. It reports that under 9.5% of vulnerabilities are reachable at function level, and that combining reachability with EPSS cuts noise by about 98%. It also finds Python phantom dependencies (up to 60% of dependencies and 85% of vulnerabilities for some tenants), 18% of npm OSV entries lacking CVE aliases, 69% of advisories published after the fix release (median 25 days), and 47% of advisories with no code-level info. For Java, 24% of fixes need a major version bump and 95% of upgrades carry breaking changes. Written by a vendor, so the prioritization conclusions favor its product.

Endor LabsOSVNVD+4
CVE-2023-41080CVE-2017-12159CVE-2023-36566+10

Supply Chain, AppSecΒ· Published and added 12 Oct 2026

endorlabs.compaperπŸ›‘οΈ Security

State of Dependency Management 2025 | Endor Labs

Endor Labs' 2025 State of Dependency Management report examines how AI coding agents and MCP servers add supply chain risk. Researchers analysed 10,663 GitHub MCP server repositories and tested AI-generated dependency recommendations across PyPI, npm, Maven and NuGet, finding agents import vulnerable or non-existent packages. MCP servers are immature: 75% are built by individuals, 41% lack license info, and 82% use sensitive APIs. The report advises treating AI-generated code as untrusted third-party input subject to code review, SAST/SCA and dependency governance.

Model Context ProtocolGitHubPyPI+3
Henrik Plate

Supply Chain, AI SecurityΒ· Published and added 12 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Genericity in multivariate cryptography

The paper proves that some properties of UOV (Unbalanced Oil and Vinegar) public-key ideals and varieties hold generically. These include equidimensionality of the UOV varieties and radicality of the public key ideals. This justifies the regularity assumptions used in algebraic cryptanalysis of UOV and its variants. The authors also review earlier multivariate schemes that were broken because they were non-generic, and give one counter-example whose non-genericity looks hard to exploit.

UOVgenericityalgebraic cryptanalysis

otherΒ· Added 14 Oct 2026, published 12 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

StableJudge: A Lightweight Adversarial Defense Framework for LLM-as-a-Judge

StableJudge is a defense framework against score-hijacking prompt injection in LLM-as-a-Judge pipelines (e.g. paper review, recommendation). A compact 0.13B "Sentry" model localizes injected spans and sanitizes them before the judge scores the content, trained on adversarially evolving attacks, and deterministic fine-grained scores are derived from the judge's output distribution. It improves score recovery under attack on held-out scientific abstracts and out-of-distribution attack variants while preserving general performance, decoupling safety from judge model scale. Code and data are promised but not yet released.

LLM
prompt injectionindirect prompt injection

AI SecurityΒ· Added 15 Oct 2026, published 12 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Optimal Threshold Implementations of all bijective 4-bit S-boxes and new Infinite Families

ePrint paper presenting share-optimal, direct, uniform, first-order threshold implementations (TIs) with no fresh randomness. It shows every bijective 4-bit permutation of algebraic degree t admits a TI with t+1 shares, and introduces the first infinite families of cryptographically nontrivial power permutations with optimal TIs. The results disprove several earlier conjectures and give new glitch-resistant masking options for lightweight cipher S-boxes.

Hardware & RFΒ· Added 14 Oct 2026, published 12 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Breaking First-Order Masked Kyber with Belief Propagation Alone

Preprint recovering the long-term key of a first-order masked Kyber768 implementation on an ARM Cortex-M4 from about 2200 decapsulation power traces using only valid ciphertexts. A profiled neural network estimates Hamming-weight distributions of both arithmetic shares, which are turned into likelihoods on decryption noise and combined by a belief-propagation solver with Gaussian interference approximation and an Onsager (AMP) correction, recovering all 1536 secret and error coefficients without lattice reduction. It shows first-order masking is insufficient against combined second-order leakage, and that least squares, greedy solvers and lattice hints (BKZ block size 624 to 505 at 2000 traces) do worse.

KyberARM Cortex-M4
ML-KEMOnsager correctionHamming weight leakage+1

Hardware & RFΒ· Added 14 Oct 2026, published 12 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

A methodology to derive security specifications for complex electronic systems

Paper proposing a risk-based methodology to derive security specifications for complex electronic systems such as AI chips and chiplet-based designs. It walks from system missions to assets, threat analysis, security requirements and then countermeasure selection. The method is illustrated on datacenter and automotive chiplets for the missions of secure provisioning, trimming, debugging, booting and remote attestation, and addresses the longer supply chain and multi-tenant threats that chiplets introduce.

Sylvain GuilleyIEEE ICDV 2026

Hardware & RF, GRCΒ· Added 14 Oct 2026, published 12 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

ML-Assisted Power Side-Channel Attacks on ML Accelerators in Shared FPGAs

Paper presenting the first on-chip, TDC-sensor-based power side-channel attack on a co-tenant FPGA to reconstruct full-scale color ImageNet inputs (224x224) from a victim's first CNN convolution layer, using ML-based upscaling and recoloring. It separates genuinely leaked information from ML-generated post-processing. It also evaluates a pixel-substitution defense based on Hamming Weight, which is largely defeated by an attacker retrained on the transformed data. The authors conclude that robust defenses need randomized or input-dependent transformations.

FPGACNN
Time-to-Digital ConverterImageNetMNIST+1

Hardware & RF, AI SecurityΒ· Added 16 Oct 2026, published 12 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Chosen Ciphertext and Trapdoor Secure Public Key Authenticated Encryption with Keyword Search

Mori and Emura give a generic transformation, a variant of the CHK transformation, that upgrades a public-key authenticated encryption with keyword search (PAEKS) scheme to one secure against chosen-ciphertext and trapdoor attacks (CCTA). It works because the PAEKS receiver names the sender when generating a trapdoor, so keywords can serve as tags. Applied to Li-Boyen generic PAEKS instantiations, it yields the first fully CCTA-secure PAEKS schemes from pairings and from lattices. Verification keys embedded in ciphertexts and trapdoors also let sender-receiver matching use hash tables, so search cost no longer depends on the number of senders.

keyword-guessing attackCHK transformationCCTA+3

otherΒ· Added 14 Oct 2026, published 11 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Forensic Analysis of the HackRF One with PortaPack Mayhem Firmware

Paper on the forensic analysis of a stand-alone HackRF One with a PortaPack running Mayhem firmware v2.0.1. It establishes at source-code level which data sit on the microSD card, their formats, when they are written and how to interpret them. The method is applied to a four-month SD image and covers RTC-battery-dependent timestamp rules, traces of on-device trimming and text editing, cluster-level recovery of deleted IQ captures, and decoding of recorded signals cross-checked with an independent decoder. In the example, the tail of a deleted IQ capture and a trimmed-away segment are recovered, and six captures are attributed to one rolling-code OOK transmitter with a shared 32-bit ID. It provides an artifact catalogue, interpretation rules and acquisition recommendations.

HackRF OnePortaPackMayhem firmware
rolling-code OOKreplay attacklocation spoofing+1

Hardware & RF, Blue Team & DetectionΒ· Added 17 Oct 2026, published 11 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

LLM-based Code Auditing by Inferring and Evaluating Developer Assumptions

Presents Creed, an LLM-based code auditing approach that infers a developer's security-related beliefs for a function, scores how reasonable each is, and derives the conditions under which it is violated. It catches domain-specific semantic flaws that syntactic static analysis misses, such as a timing side-channel that undermines user-enumeration protection. The paper also introduces two measures for explanation-based vulnerability detection, recall and overhead. On a recent real-world benchmark, Creed beats existing explanation-based tools on the effectiveness-effort trade-off.

LLM
Creedtiming side-channeluser enumeration

AI Security, AppSecΒ· Added 15 Oct 2026, published 11 Oct 2026

arxiv.orgpaper🧠 AI

LLM-based Code Auditing by Inferring and Evaluating Developer Assumptions

Presents Creed, an LLM-based code auditing approach that, for a given function, infers the developer's security-related beliefs, scores how reasonable each belief is, and derives the conditions under which it is violated. This lets it find semantic flaws, such as timing side-channels in authentication, that syntactic static analysis tools miss, and it explains root cause, symptoms and exploitability. The paper also introduces two evaluation measures for explanation-based vulnerability detection: recall (how well a known vulnerability is correctly explained) and overhead (the effort of inspecting reports). On a recent real-world benchmark, Creed beats existing explanation-based tools on the effectiveness-effort trade-off.

LLMstatic analysis
CreedarXiv

research, evalsΒ· Added 15 Oct 2026, published 11 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Extending the Schur--Macaulay Framework for UOV Attacks via Truncated Polynomial Algebras

ePrint paper by Peigen Li and Siyong Tao extending the wedge-attack framework of Ding, Li and Tao and the Schur-Macaulay matrix approach of Merz and Ran against Unbalanced Oil and Vinegar (UOV). It reformulates the attack with p-truncated polynomial algebras, so it applies over arbitrary finite fields. Divided powers and transfer relations give extra public relations in the ideal-inclusion framework, with quotient-dimension criteria for recovering graded components of the hidden oil-space ideal. Applied to the third-round QR-UOV parameter sets, it gives lower attack-complexity estimates for some of them.

UOVQR-UOV
wedge attackSchur-Macaulay matrixoil-space ideal+3

otherΒ· Added 14 Oct 2026, published 11 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Faster generic CCA secure KEM transformation using encrypt-then-MAC

The paper proposes a generic encrypt-then-MAC transformation for building CCA-secure KEMs. The PKE ciphertext is authenticated by a MAC keyed from the PKE plaintext, so decapsulation no longer needs the Fujisaki-Okamoto re-encryption step. It proves IND-CCA security in the random oracle model from OW-PCA, and IND-qCCA security from a new OW-qPCA notion. It presents ML-KEM-EtM and McElieceEtM (Classic McEliece), and benchmarks ML-KEM-EtM with Poly1305, GMAC, CMAC and KMAC256. The result is a substantially lower decapsulation cycle count for a small cost in encapsulation cycles and ciphertext size.

ML-KEMClassic McEliecePoly1305+3
FIPS 203Fujisaki-Okamoto transformationML-KEM-EtM+4

otherΒ· Added 14 Oct 2026, published 11 Oct 2026

huggingface.copaper🧠 AI

MiMo-V2.6: Scaling Reinforcement Learning Towards Self-Improvement

Technical report for Xiaomi's MiMo-V2.6 omni-modal model family, which scales RL compute along three axes: asynchronous training with 1,568 samples and 2.7-3.7B tokens per step at up to 1M context, more diverse environments (code, general, visual, cyber) under mixed agent harnesses, and groupwise agentic grading that gives better reward signals and favors shorter, token-efficient solutions. Stability measures include a frozen MoE router and a multi-layer defense against reward hacking, built on a mid-trained hybrid-SWA architecture. The authors open-source training dynamics, RL environments and the RL framework, which makes it a useful reference for reproducing scaled agentic RL.

Mixture of ExpertsHugging Face
MiMo-V2.6Xiaomi

training, research, agentsΒ· Added 10 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Nobody Will Read the Lean: A Case for High-Level Cryptographic Languages

Position paper arguing that as AI makes machine-checked proofs cheap, the scarce resource is a human who can read what was proved. It cites a Lean library's Schnorr signature security theorem that passed the checker but held for every adversary and so promised nothing. It shows that on a one-page Verifpal model, two of five verdicts flip under other standard definitions of properties such as forward secrecy. It proposes short, owner-written high-level cryptographic languages, with every claim backed by a checked theorem and a small, versioned, publicly agreed set of built-in security definitions.

LeanVerifpal
Nadim KobeissiSchnorr signaturesforward secrecy

otherΒ· Added 14 Oct 2026, published 10 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Staggered Instruction-Fetch Duplication: A Lightweight Processor-Level Countermeasure Against Fault Injection

Proposes Staggered Instruction-Fetch Duplication (SIFD), a processor-level fault-injection countermeasure that fetches each instruction twice in consecutive cycles while fetching two different instructions per cycle, so inconsistent fetches are detected without full processor duplication, compiler support or crypto hardware. Implemented on a custom RV32I core on an Artix-7 FPGA, it costs 15.0% more slices and 16.3% more execution time. Attack success falls from 0.86% to below 0.01% under clock fault injection and from 0.32% to 0.13% under EMFI, with 73.18% of CFI and 11.44% of EMFI attempts detected.

RISC-VRV32IArtix-7+1
Staggered Instruction-Fetch DuplicationSIFDclock fault injection+1

Hardware & RFΒ· Added 14 Oct 2026, published 10 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Only What You've Signed up For: Secure Workflows with Constrained Diffusion Agents

Introduces Policy-Constrained Diffusion Agents (CoDA), which enforces task-dependent security policies inside the denoising process of diffusion language models. At each step, token distributions are projected onto a policy-compliant set, so constraints hold throughout generation instead of relying on detecting injected instructions. Evaluated across several dLLM families under static and adaptive prompt-injection attacks, it reports substantially lower attack success rates with competitive task utility and practical inference overhead.

diffusion language models
Policy-Constrained Diffusion AgentsCoDAprompt injection+1

AI SecurityΒ· Added 15 Oct 2026, published 10 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Can agents whose sole duty is to keep humans alive be hijacked to kill? Delayed multi-turn derived-action trap attacks in simulated high-stakes environments

Paper testing whether an LLM agent operating life support in the NASA-derived BioSim lunar habitat simulation can be induced by delayed prompt injection, hidden in truthful S-band telemetry, to shut down life support and hold the shutdown while the crew suffocates. It compares Claude, GPT and Grok configurations: Claude mostly refuses and cites the living crew, GPT shows some susceptibility, and Grok given a "trusted commission" framing more often cuts life support. It also varies the framing of the message (trusted commission, peer, untrusted source) and uses a harmless-procedure-drop attack as a proxy for whether life is valued intrinsically. Code and traces are open-sourced.

ClaudeGrokLLM
BioSimNASAderived-action trap+1

AI SecurityΒ· Added 15 Oct 2026, published 10 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Efficient Vectorized Implementation of MQOM

ePrint paper presenting a vectorized implementation of the MQOM v2.1 post-quantum signature scheme (a NIST additional-signature candidate). It uses a transpose-enabled paired-matrix trick to cut wasted SIMD work and memory traffic. It benchmarks key generation, signing, verification and memory on Arm NEON, x86 AVX2 and AVX-512, with peak dynamic memory down by up to 39.43%. Supplementary experiments check how the matrix-layout optimization carries over to the Round-3 MQOM v3 code. Useful for practitioners assessing the deployment cost of post-quantum signatures.

Arm NEONAVX2AVX-512
MQOMNIST

otherΒ· Added 14 Oct 2026, published 10 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Censorship Resistance in Credential Systems and Application to the EUDI Wallet

ePrint paper that defines a security model for censorship resistance in anonymous credential systems, where a malicious issuer uses information gathered at issuance to selectively deny credentials. It gives a round-optimal construction built on blind signatures with selective disclosure at presentation. It also presents CRACS, an instantiation for the European Digital Identity Wallet (EUDIW). CRACS keeps selective disclosure and adds unlinkability between issuance and presentation. It confines the advanced cryptography to issuance, so secure elements, credential formats, signature schemes and verifiers stay unchanged and deployment can be incremental.

EUDI Wallet
CRACSEUDIW

Identity & AccessΒ· Added 14 Oct 2026, published 10 Oct 2026

arxiv.orgpaper🧠 AI

KedgeFlow: A Programmable Control Plane for Enterprise AI Agents

KedgeFlow specifies language-independent contracts so trusted controllers can authorize state-changing operations by enterprise AI agents and privileged gateways can enforce that authority independently of agent reasoning. It combines evidence-backed policy checks, signed permission for an exact action, a single-use shared allowance, target-side conditions and retained outcome records, with two conditional properties (at most one claim per allowance; every dispatch linked to a grant and claim) that hold even if the agent is compromised. A reference implementation exposes the path via MCP; evaluation on a three-member etcd cluster gave exactly one successful claim for each of 82 allowances across 6,560 concurrent attempts, and one committed effect in a 32-call gateway race. The authors report limits: permissive policy still authorized an undesirable effect, and distributed reservations, production access routes, crash recovery and real-target exactly-once effects remain untested.

Model Context Protocoletcd
KedgeFlowOpenFlowarXiv

agents, ai-infra, researchΒ· Added 15 Oct 2026, published 10 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

KedgeFlow: A Programmable Control Plane for Enterprise AI Agents

KedgeFlow proposes language-independent contracts in which trusted controllers issue signed exact-action permissions and privileged gateways enforce them, using single-use allowance claims, target-side conditions and retained outcome records. It aims to stop altered approved actions, concurrent permission reuse and retries after lost responses, even with a compromised agent. A reference implementation exposes this path via MCP; evaluation on a three-member etcd cluster showed 6,560 concurrent claim attempts yielding exactly one success per each of 82 allowances. It also reports that permissive policy still authorized an undesirable effect, and lists untested areas such as distributed reservations and production access routes.

Model Context Protocoletcd
KedgeFlowOpenFlow

AI Security, Identity & AccessΒ· Added 15 Oct 2026, published 10 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

No, Your Tools Are Not Enough: It's Time to Bring Agents to the Hunt

Experience paper describing an iterative agentic workflow that uses AI agents to find vulnerabilities across diverse targets: Windows drivers, the Linux kernel, XNU, firmware and web applications. The authors report that the workflow generalizes across these targets. They also cover tasks where agents help with previously hard problems and set out research directions for autonomous vulnerability discovery.

Linux kernelWindows
XNU

AI Security, AppSec, Offensive SecurityΒ· Added 16 Oct 2026, published 10 Oct 2026

eprint.iacr.orgpaper🧠 AI

Confidential Error-Correcting Codes

Introduces Confidential Error-correcting Codes (CECs), a primitive that decodes reliably from perturbed codewords while keeping the message confidential, defined by confidentiality, robustness and soundness. The Randomness-Security Separation framework encodes a nonce and masks the payload with a PRF; the Conc-CEC instantiation uses concatenated Reed-Muller and Reed-Solomon codes and claims stronger concrete security than PRCs (CRYPTO'24). The application, CECMark, watermarks AI-generated images and reportedly beats Gaussian Shading, PRCMark and T2SMark across 56 perturbations with a false positive rate below 1e-5 and no side effects.

Reed-Muller codesReed-Solomon codespseudorandom function
Confidential Error-Correcting CodesCECMarkConc-CEC+5

research, multimodalΒ· Added 14 Oct 2026, published 10 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Confidential Error-Correcting Codes

Introduces Confidential Error-correcting Codes (CECs), a cryptographic primitive for decoding perturbed codewords while keeping the message confidential, defined by confidentiality, robustness and soundness. The Randomness-Security Separation framework encodes a nonce and masks the payload with a PRF. The Conc-CEC instantiation uses concatenated Reed-Muller and Reed-Solomon codes, and the authors claim stronger concrete security than PRCs (CRYPTO'24). The CECMark application watermarks AI-generated images, and the authors report it beats Gaussian Shading, PRCMark and T2SMark across 56 perturbations with a false positive rate below 10^-5.

Conc-CECCECMarkPRCMark+3

AI SecurityΒ· Added 14 Oct 2026, published 10 Oct 2026

arxiv.orgpaper🧠 AI

SecReason: Vulnerability Detection and In-Stream Self-Repair for LLM Code Generation

SecReason is an in-stream defense for reasoning LLMs that write code. Reasoning models draft code early in their streamed chain of thought, so SecReason scans that stream with dual-track incremental analysis: security rules are checked on each emitted statement, and dataflows are traced across the accumulated code. When a rule fires, it interrupts decoding, inserts a warning into the stream and resumes, so the model fixes its draft within the same reasoning trace instead of regenerating the full response. On CWEval and SecCodeBench, runs delivering secure and functionally correct code rise from below 15% to 72.8%–98.1%. It uses fewer tokens than post-hoc repair and limits functional regressions when rules misfire on secure code.

LLMstatic analysis
SecReasonCWEvalSecCodeBench

research, coding-agentsΒ· Added 15 Oct 2026, published 10 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

SecReason: Vulnerability Detection and In-Stream Self-Repair for LLM Code Generation

SecReason is an in-stream defense for reasoning LLMs that monitors code drafted inside the streamed chain of thought. Dual-track incremental scanning applies security rules per statement and traces dataflows across accumulated code; when a rule fires, generation is interrupted, a warning is inserted, and decoding resumes so the model repairs the draft in the same trace. On CWEval and SecCodeBench it raises the share of secure and functionally correct runs from below 15% to 72.8%–98.1%, uses fewer tokens than post-hoc repair, and limits regressions from false warnings.

LLM
SecReasonCWEvalSecCodeBench

AI Security, AppSecΒ· Added 16 Oct 2026, published 10 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

SecReason: Vulnerability Detection and In-Stream Self-Repair for LLM Code Generation

SecReason is an in-stream defense for reasoning LLMs that monitors code drafted inside the streamed chain of thought. Dual-track incremental scanning applies security rules per statement and traces dataflow across accumulated code. When a rule fires, generation is interrupted, a warning is inserted and decoding resumes, so the model repairs its draft without regenerating the full response. On CWEval and SecCodeBench it raises the share of secure and functionally correct runs from below 15% to 72.8%–98.1%, uses fewer tokens than post-hoc repair, and limits functional regressions from false warnings.

LLM
SecReasonCWEvalSecCodeBench

AppSec, AI SecurityΒ· Added 15 Oct 2026, published 10 Oct 2026

arxiv.orgpaper🧠 AI

SecReason: Vulnerability Detection and In-Stream Self-Repair for LLM Code Generation

SecReason is an in-stream defense for reasoning LLMs that write code. Reasoning models draft code early in their streamed chain of thought, and SecReason scans that draft incrementally with security rules, checking each statement as it is emitted and tracing dataflows across the accumulated code. When a rule fires, it interrupts generation, inserts a warning into the stream, and resumes decoding, so the model repairs the draft within the same reasoning trace. On CWEval and SecCodeBench it raises the share of runs that deliver secure and functionally correct code from under 15% to 72.8%–98.1%. It uses fewer tokens than post-hoc repair and limits functional regressions when rules misfire on secure code.

LLM
SecReasonCWEvalSecCodeBench+1

research, coding-agentsΒ· Added 16 Oct 2026, published 10 Oct 2026

huggingface.copaper🧠 AI

TokenRouter: Efficient Serving System for Token-Level LLM Routing

TokenRouter is a serving system for token-level routed LLM inference, where different tokens of one request are routed across different models. It uses request-centric programming with model-centric execution: developers write routing logic per request while the runtime launches a subserver per LLM and dispatches requests asynchronously. Each subserver uses a delayed-batching scheduler whose hyperparameters come from a mathematical throughput model, fixing step desynchronization and batch admission delays and giving 2.01-64.15x higher decoding throughput than existing systems.

TokenRouterHugging FaceGitHub

inference, researchΒ· Added 9 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Physical Side-Channel Attacks on Edge LLMs: Extracting Output Tokens and User Prompts

Presents an EM side-channel attack on LLaMA-3.2-1B-Instruct running on a Raspberry Pi 5, showing passive physical measurements leak generated tokens and user prompts. Three attacks: a profiling attack (97.2% accuracy over 50 medical/privacy keywords), a hidden-state reconstruction attack predicting tokens from the 128k vocabulary (94.3% on profiled classes; 67% of unseen words ranked in top 100), and a hidden-state inversion attack reconstructing prompts semantically. Shows that local edge inference does not guarantee confidentiality of tokens and inputs.

LlamaLLMRaspberry Pi 5
electromagnetic side-channel attackhidden-state inversion

Hardware & RF, AI SecurityΒ· Added 16 Oct 2026, published 9 Oct 2026

arxiv.orgpaper🧠 AI

Images Talk Back: Guiding MMDiTs by Suppressing Image-to-Text Feedback

The paper studies joint attention in multimodal diffusion transformers (MMDiTs), where the evolving image updates text representations. It finds that this image-to-text (I2T) feedback tends to preserve objects and attributes already in the image, errors included, and that suppressing it improves generation. It proposes Semantic Feedback Guidance (SFG), which guides away from an auxiliary branch that strengthens I2T feedback and weakens text-to-image conditioning, and iSFG, an in-place variant that needs no extra model evaluations. SFG runs for the first 20% of sampling steps (about 1.2x base NFE without CFG). Across three backbones, adding SFG to CFG on FLUX raises GenEval from 0.6661 to 0.7479, and iSFG on SD3.5M adds +1.33 HPSv2.1 over CFG at zero extra NFE. The control also improves VBench scores for text-to-video and image-to-video.

diffusion modelTransformerFLUX+1
SD3.5MGenEvalHPSv2.1+4

research, multimodalΒ· Added 12 Oct 2026, published 9 Oct 2026

arxiv.orgpaper🧠 AI

Hide and Seek: HIDE Concepts to SEEK explanations for black box models

Hide and Seek (HnS) is a concept-level attribution method for black-box vision models. It needs no model weights and no concept-labeled datasets. Given a concept and an image set, it uses a vision-language model to retrieve concept-aligned images and localize the concept, masks the localized region, and takes attribution from the change in the black-box model's output. It agreed better with ground-truth attributions than existing methods on CelebA and COCO-Stuff, and it works on tasks existing concept attribution methods cannot handle, such as image captioning and satellite image segmentation.

vision-language model
Hide and SeekHnSCelebA+1

research, multimodalΒ· Added 12 Oct 2026, published 9 Oct 2026

arxiv.orgpaper🧠 AI

When VLMs Destroy What They Know: Spatial Representations Fall Below Lexical Priors

Introduces EICS (Evaluation-Invariant Concept Stability), a metric for checking whether representations consistently encode a concept under controlled one-concept interventions. Also introduces CASP-VL, a benchmark of causally controlled spatial perturbations derived from Visual Genome scene graphs. Across several VLM architectures, spatial relations are represented much less faithfully than lexical information, even for models well above chance on compositional benchmarks. The relation is identifiable at the predicate's own tokens but is lost when the sentence is aggregated into a global representation (EOS token or mean pooling), a failure that output-based evaluation does not reveal.

vision-language model
Visual GenomeEICSCASP-VL+1

research, evals, multimodalΒ· Added 12 Oct 2026, published 9 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Flying, Not Floating: Precise Fixed-Point Falcon on Embedded Processors

Presents the first fixed-point FN-DSA (Falcon) signer for microcontrollers, using 32.64 arithmetic in constant-time Cortex-M4 assembly for Falcon-512 and Falcon-1024. Techniques that keep reciprocals, inverse square roots and small constants wide and round once at the consumer restore the precision lost by naive fixed-point. Measured precision supports about 2^99.7 (Falcon-512) and 2^96.7 (Falcon-1024) signing queries per key, against about 2^61.5 and 2^58.7 for double precision and the 2^64 target. The signer needs about 45% fewer cycles than double-precision emulation, at the cost of signing RAM rising from 59n to 83n bytes. The paper also shows which implementation choices lift double-precision c-fn-dsa above 2^64, derives Falcon-1024 key-generation bounds (72.3% of keys accepted vs 8.5% with the Falcon-512 values), and gives recommendations for the fixed-point FN-DSA NIST plans.

FalconFN-DSAARM Cortex-M4+1
NISTDe Almeida Braga

Hardware & RFΒ· Added 12 Oct 2026, published 9 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Distinguishers for the Squeezing of the Alternating Sponge and Duet

Cryptanalysis of the Alternating Sponge (ASP) and Duet, a permutation-based hash candidate in China's ICCS Next Generation Commercial Cryptographic Algorithm program (NGCC). The authors give an O(2^r)-query distinguisher against ASP that contradicts its claimed indifferentiability bound in some parameter regimes. They also give a distinguisher and state-recovery attack on Duet's multi-block output, using O(2^(r+c-h)) permutation queries. Collision and preimage resistance are unaffected, but Duet used as a XOF or KDF is affected, and state recovery enables length extension.

GaΓ«tan LeurentCΓ©sar MathΓ©usInstitute of Commercial Cryptography Standards+4

otherΒ· Added 12 Oct 2026, published 9 Oct 2026

arxiv.orgpaper🧠 AI

ReplaySSM: Cache SSM Inputs, Not State

ReplaySSM represents state-space model state as a periodically updated checkpoint plus a buffer of recent SSM inputs, separating output computation from checkpoint updates. This avoids state writes on most decoding steps (roughly halving dominant state memory traffic), makes speculative-decoding rollback a buffer-pointer operation, and lets a low-precision checkpoint serve outputs while a higher-precision one drives recurrent updates. Implemented in vLLM for Mamba-2 and Gated DeltaNet, it gives 1.20–1.47x decoding speedup at batch size 256 across four hybrid models and about 1.8x the throughput of vLLM speculative decoding on two 120B-class models.

vLLMMamba-2Gated DeltaNet+1
ReplaySSM

inference, researchΒ· Added 12 Oct 2026, published 9 Oct 2026

arxiv.orgpaper🧠 AI

DualQuant: Dual-scale Calibration-free Weight-and-Activation Quantization for LLMs

DualQuant is a calibration-free post-training quantization framework for LLM weights and activations. It minimizes weight-reconstruction MSE using variable splitting and block coordinate descent with closed-form subproblem updates. The resulting scaling factors double as per-channel activation rescalings, so no calibration data is needed. It supports the MX family and NVFP4 block formats. On Llama and Qwen models it matches or beats calibration-based SmoothQuant on WikiText-2, C4 and zero-shot tasks. A real packed W4A4 path for Llama-3.1-8B on an RTX 4090 gives up to 2.61x memory reduction and 2.46x throughput over BF16.

LlamaQwenNVFP4+3
DualQuantLlama-3.1-8BWikiText-2+4

inference, researchΒ· Added 12 Oct 2026, published 9 Oct 2026

arxiv.orgpaper🧠 AI

Matched-Context Group Policy Optimization for LLM Agent Training

Proposes Matched-Context Group Policy Optimization (MCGPO), which builds weighted action preferences from already-collected sibling rollouts to give credit to intermediate decisions when feedback is sparse and arrives only at the end. Comparison contexts use pre-action state summaries and rubric progress. Exact and coarse matching rules are selected by two-action support, and fixed folds separate candidate decisions from the terminal outcomes that orient them. An evidence-weighted auxiliary pairwise loss is added to GraphGPO task learning, and no critic is needed. Across six environment-backbone settings with three seeds each, it beats GraphGPO by 0.47-1.46 points on ALFWorld and WebShop with Qwen2.5-1.5B/7B, and by 3.96 and 5.16 points on WebShop with Qwen3-4B/8B. ALFWorld gains are small because baseline success is already above 92%.

GRPOQwenQwen3
Matched-Context Group Policy OptimizationMCGPOGraphGPO+4

training, agents, researchΒ· Added 12 Oct 2026, published 9 Oct 2026

arxiv.orgpaper🧠 AI

Adaptive DHiSparse: Speculative Decoding over a Load-Adaptive KV Hierarchy

Adaptive DHiSparse extends HiSparse (host-memory KV storage that fetches only selected entries) to draft-model speculative decoding methods DSpark and DFlash2. It protects the required working set, keeps extra history while GPU memory is spare, and recovers the rest by exact fused retrieval. Queries share missing-row retrieval, draft KV uses a window-bounded ring, and verification staging is reused across layer groups. At 100K context and concurrency 128, GLM-5.3 with DFlash2 reaches 793 output tokens/s per decode GPU (1.45x HiSparse). With the same latency bounds it sustains up to 4x the concurrency. On DeepSeek-V4.1-Flash at 500K context, it delivers 1.85x the output of resident serving with DSpark.

Adaptive DHiSparseHiSparseDSpark+4

inference, researchΒ· Added 12 Oct 2026, published 9 Oct 2026

arxiv.orgpaper🧠 AI

A Baseline Assessment for the Agentic Web Technology Stack

Proposes MASTIF (Multi-Agent System TestIng Framework) for evaluating Agentic Web stacks. It reports a baseline assessment of 3 LLMs, 3 protocols and 4 agent implementation frameworks on 300 Mind2Web benchmark tasks. Results suggest that choosing a task-specific stack can improve task completion rate, efficiency and social value stability, and can reduce verbosity and completion time. This gives developers reference metrics for choosing among fast-moving agent protocols and frameworks.

MASTIF
Mind2Web

evals, agents, researchΒ· Added 12 Oct 2026, published 9 Oct 2026

arxiv.orgpaper🧠 AI

Verifiable Retrieval for Legal Reasoning through Structure-driven Knowledge Graph

The paper builds a Knowledge Graph from German Legal Code by structure-driven parsing, then uses it to navigate sources and retrieve from them in a RAG pipeline. It compares several KG-informed chunking and retrieval strategies and measures their effect on the accuracy of retrieved citations. The aim is verifiable, transparent retrieval for reliability-critical domains, where naive retrieval degrades as the number and size of sources grows.

Knowledge GraphRAG
arXiv

llm-apps, researchΒ· Added 12 Oct 2026, published 9 Oct 2026

arxiv.orgpaper🧠 AI

A Step Harder, Not a Step Too Far: The Benefits and Limits of Curriculum Difficulty Progression in GRPO

Studies curriculum design for GRPO by re-estimating sample difficulty under the current policy and using a staged curriculum that progressively shifts the active difficulty band toward harder samples. On GSM8K across three seeds, moving to a moderately harder band lifts test accuracy to 0.6591 Β± 0.0077 versus 0.6449 Β± 0.0024 for fixed-medium selection, while going to a still harder band drops it to 0.6405 Β± 0.0053. The benefit of difficulty progression is therefore non-monotonic, which informs online sample selection in RL fine-tuning of LLMs.

GRPO
GSM8K

training, researchΒ· Added 12 Oct 2026, published 9 Oct 2026

arxiv.orgpaper🧠 AI

Benchmarking Answer-Grounding Consistency in Remote Sensing Visual Question Answering

Proposes the Answer-Evidence Support Protocol (AESP), which checks whether the grounding evidence a model outputs actually supports its own answer in grounded remote sensing visual question answering. It applies task-specific rules to existence, counting and comparison questions. The authors build the G-RSVQA benchmark of 15,027 samples with questions, reference answers and object-level annotations. Tests on seven grounded vision-language models show evidence-support failures on all three question types, with up to 50.82% of correct answers unsupported by their grounding evidence.

vision-language model
Answer-Evidence Support ProtocolG-RSVQAarXiv

evals, multimodal, researchΒ· Added 12 Oct 2026, published 9 Oct 2026

Showing 570 of 1218

Show more