WM-Basin is a Meta method for detecting student LLMs distilled from watermarked teacher models, described in "Watermark Basins: Black-Box Detection of Distilled LLMs" (arXiv:2610.37266, 27 October 2026). It feeds a suspect model's API text into a clean probe model and checks gradient alignment with a key-specific watermark basin. It reached 79% true-positive rate at 0.1% false-positive rate across 1,200 students, versus 29% for the prior token-level detector. Clean-data fine-tuning and paraphrasing weaken it.
LLM
MetaMeta FAIRMeta Superintelligence Labs+3
research, trainingΒ· Published and added 30 Oct 2026
Understanding and Mitigating Role Spoofing in LLMs is an arXiv paper (October 2026) on role spoofing, a prompt injection where malicious tool output impersonates the user. It shows models track "who said what" using both content cues (semantics, style) and structure cues (control tokens, formatting). Attacks combining fake structure and content succeed often, adversarial training stops only content-based attacks, and linear probes trained to predict conversation roles detect spoofing across settings.
LLM
role spoofingrole confusionprompt injection+1
AI SecurityΒ· Added 31 Oct 2026, published 29 Oct 2026
This arXiv preprint (October 2026) tests a sparse autoencoder as a factor model for daily cryptocurrency returns, with equities as a secondary test. SAE portfolios show consistently lower volatility than common benchmarks, linked to lower correlations among selected assets. They do not beat a simple contrarian strategy on risk-adjusted return, and factor identities change between training runs.
sparse autoencoder
arXiv
researchΒ· Added 31 Oct 2026, published 29 Oct 2026
PrivacyEvalClaw is a tool-augmented deliberative agent that audits privacy leakage in LLM jailbreak responses. The paper is by Krishna Kanth Nakka and co-authors, and it was accepted to AACL-IJCNLP 2026 (arXiv 2610.36711, cs.CR). The tweet gives only the title, authors and venue, so the method and results are not described.
LLM
PrivacyEvalClaw
AI SecurityΒ· Added 30 Oct 2026, published 29 Oct 2026
PrivacyEvalClaw is a tool-augmented deliberative agent for auditing privacy leakage in LLM responses produced under jailbreak prompts. By Krishna Kanth Nakka and five co-authors, the paper is on arXiv (cs.CR) and accepted to AACL-IJCNLP 2026. The fetched post gives only the title, authors and venue, so method details and results are not available here.
Gold vs. Translation is an October 2026 arXiv study of whether DeepL-translated MMLU measures the same thing as native benchmarks. It compares seven pairings against six native benchmarks in five Nordic and Baltic languages, using 29 models. Translated MMLU adds predictive value for curriculum-overlap benchmarks such as Skolprov (ΞRΒ²=.128) but not for Sweden-specific SwedishFacts (p=.242).
LLM
MMLUDeepLSkolprov+2
evals, researchΒ· Added 30 Oct 2026, published 28 Oct 2026
Log-To-Leak is an arXiv paper (cs.CR, cs.AI) by Yuepeng Hu, Chongyu Fan, Sirat Samyoun and Jian Du on prompt injection attacks against tool-using LLM agents through the Model Context Protocol. The title points to a logging-based data leakage channel. The fetched page holds only the title, authors and arXiv link, with no abstract, so the method and results are not visible here.
Model Context ProtocolLLM
Log-To-Leakprompt injection
AI SecurityΒ· Added 29 Oct 2026, published 28 Oct 2026
This arXiv paper (October 2026) replicates Chen et al.'s study of LLM-based smart contract vulnerability detection. It confirms the high-recall, low-precision pattern on GPT-4, then tests Mixture-of-Experts and RNN-like models plus a preliminary State Space Model run. Gemma-3 matches GPT-4's profile despite far fewer parameters, while two Mixture-of-Experts models diverge, so architecture family alone does not predict detection behavior.
GPT-4GemmaLLM
Chen et al.
AI Security, AppSecΒ· Added 30 Oct 2026, published 28 Oct 2026
What Victims Take Away is an October 2026 arXiv paper analysing 563,349 Tensor Trust attack records to see how players reuse prompt injections they received. Within a week, targets reused 10.0% of attacks that broke their defense, versus 0.03% of matched attacks. Breaches were followed by defense changes that cut same-family attack success by 24.5 points. Received texts made up 23.2% of successful hijacks. The authors propose that AI security tools describe techniques without disclosing full attack text.
Tensor TrustLLM
prompt injectionpayoff-biased social learningvictim-offender overlap
AI SecurityΒ· Added 28 Oct 2026, published 27 Oct 2026
"Cheap AI-Assisted Reverse Engineering and What It Will Do" is an October 2026 arXiv paper (Computers and Society) arguing that generative AI strains the law of reverse engineering. AI systems can identify hardware components, extract firmware, decompile object code and clone apps, which removes the cost barrier that laws rely on. The authors map these practices onto trade secret, copyright, anti-circumvention, computer misuse and contract law, and sketch possible legal responses with their trade-offs.
Malware & RE, GRC, AI SecurityΒ· Added 28 Oct 2026, published 26 Oct 2026
The Policies of Programming Language Ecosystems is an October 2026 arXiv paper (cs.SE) that compares the policies of eight programming language ecosystems, including CRAN for R, across 38 policy categories. Three authors coded the policies with moderate agreement. Malware, intellectual property and content removal are covered everywhere, while package size limits, metric manipulation, typosquatting and binary uploads diverge.
CRAN
typosquatting
Supply Chain, GRCΒ· Added 28 Oct 2026, published 25 Oct 2026
Ranking Is Not Deciding is an October 2026 arXiv paper showing that query-time RAG poisoning filters score near-perfectly because of how the poison set was built. PoisonedRAG's code prepends the target question to each passage. Removing that prefix takes RAGuard from AUROC 0.953 to 0.758 and its miss rate from 0.191 to 0.763. The authors release a script that profiles a poison set.
LLM
PoisonedRAGRAGuardTrustRAG+5
AI SecurityΒ· Added 27 Oct 2026, published 24 Oct 2026
VulDec is an arXiv paper (October 2026) presenting a dataset of real-world Assembly-C function pairs with CWE labels across multiple architectures, plus an end-to-end framework that uses neural decompilation for binary vulnerability detection. Tuned LLM decompilers reach about 56% Edit Similarity and 43% BLEU-4. Tuned LLM detectors reach macro F1 of 0.61 on a realistic test set with a 3% vulnerability rate.
LLM
VulDec
Malware & RE, AI SecurityΒ· Added 28 Oct 2026, published 24 Oct 2026
The Geometry of Metaphor is an October 2026 arXiv preprint that uses mechanistic interpretability to find causal subspaces for metaphor in LLMs of different architectures and sizes. The authors steer output on classification tasks across parts of speech. They also steer generation tasks, showing the metaphoricity of model output can be controlled. The abstract gives no model names or metrics.
LLM
arXiv
researchΒ· Added 24 Oct 2026, published 22 Oct 2026
This October 2026 arXiv paper evaluates four LLM inference optimization families on Apple Silicon: KV-cache pruning, speculative decoding, ported GPU kernels and post-training quantization. Tests run on four Apple machines with a single-request decode workload, plus matched RTX 4090 runs. KV-cache pruning reaches 1.75x throughput on Apple, all tested speculative decoding methods reduce throughput, and ported kernels give up to 1.20x.
MetalCUDALLM
AppleNVIDIAarXiv
inference, research, evalsΒ· Added 24 Oct 2026, published 22 Oct 2026
Paper (arXiv, 21 October 2026) on structural false negatives in LLM vulnerability discovery harnesses. Starting from Knostic's OpenAnt and raptor, then 10 more open-source harnesses, the authors map 13 points where code selection, filtering, and finding storage or merging drop vulnerabilities. One file was dropped by six harnesses before the model saw it, five without notice. It covers attacker evasion, content-steered verdicts, prompt injection, and design principles and tests.
OpenAntraptorLLM
KnosticPtacek and Newshamprompt injection+1
AI Security, AppSecΒ· Added 24 Oct 2026, published 21 Oct 2026
Sign Here is an arXiv paper (October 2026) testing whether building packages from source, instead of pulling from registries, prevents malware. It aggregates 47,066 malicious npm and PyPI packages from five datasets and indexes 3.9 million npm and 764 thousand PyPI packages. Checking for an attributed source blocks 87.7 to 99.9 percent of malware depending on vetting level, but only 47.4 percent of benign packages attribute a buildable source.
npmPyPI
Shai-HuludAxios
Supply ChainΒ· Added 24 Oct 2026, published 20 Oct 2026
This arXiv paper tests eight jailbreak attacks against three open-weight language models under three evaluation procedures. Low-resource language attacks score 96.0% mean ASR under keyword matching but 2.7% under a Qwen3 judge using StrongREJECT instructions. At Ollama's default temperature of 0.8, 100 samples of an unchanged request give 100% ASR by keywords and 50% by the judge. The authors recommend explicit success definitions, matched response budgets, validated evaluators and cumulative-failure reporting.
OllamaQwenLLM
StrongREJECTDeepInceptionattack success rate+1
AI SecurityΒ· Added 21 Oct 2026, published 19 Oct 2026
Concerns in Benchmarking Jailbreaks is an October 2026 arXiv study of eight jailbreak attacks on three open-weight models under three evaluation procedures. Low-resource language attacks score 96.0% ASR by keyword matching but 2.7% under a Qwen3 evaluator using StrongREJECT instructions. Attack rankings flip with attempt budgets, and 100 samples at Ollama's default temperature 0.8 give 100% ASR by keywords, 50% by the evaluator.
OllamaQwen3LLM
StrongREJECTDeepInceptionarXiv
evals, ai-safety, researchΒ· Added 21 Oct 2026, published 19 Oct 2026
Fake News, Real Crashes is an October 2026 arXiv paper presenting a benchmark for information injection attacks on LLM financial trading agents. It spans five injection vectors, seven event categories and about 10,000 decisions on 15 U.S. stocks. Fabricated news reached 62% attack success versus 14% for prompt injection, and two 30-word templates hit 100%. Only hierarchical aggregation reduced success among the defenses tested.
LLM
information injectionprompt injectionfact poisoning+1
AI SecurityΒ· Added 21 Oct 2026, published 19 Oct 2026
Many Biases, One Circuit is a October 2026 arXiv paper that traces attention heads behind cue-following (for example "I think the answer is B") through two post-training pipelines. Four cue types share a few heads already present in pretrained models. About 200 generic assistant examples activate them in chat format, and the final RL stage strengthens cue effects. Swapping attention patterns of six middle layers between Tulu-3-8B and OLMo-2-7B checkpoints moves cue effects most of the way.
LLMTransformer
Tulu-3-8BOLMo-2-7BarXiv
research, ai-safety, trainingΒ· Added 20 Oct 2026, published 16 Oct 2026
This October 2026 arXiv paper studies task over-specification and under-specification in repository-level coding benchmarks. It shows that hints derived from ground truth, as added in SWE-bench Pro, FEA-bench, Doc2Feat-bench and Multi-SWE-bench, leak spoilers in some of them. The authors test several specification levels, recommend techniques for parsimonious hints, and plan to release their hints.
SWE-Bench ProFEA-benchDoc2Feat-bench+2
evals, coding-agents, researchΒ· Added 20 Oct 2026, published 16 Oct 2026
Announces Design Creativity Bench, a benchmark of 80 open-ended UI design tasks, each adapted to two product domains and paired with human designer references. It evaluates 16 frontier models on Originality (how distinct a model's output is from other models' for the same brief), Creative Range (how much its design decisions change when the domain changes) and Appropriateness (how well the UI meets the brief's functional requirements). The best model, GPT-6 Astra, scores 65.5 against a human reference of 92.3. The leaderboard, methodology, arXiv paper, Hugging Face dataset and GitHub evaluation framework are published.
Reports that arXiv now caps each submitter at two submissions per calendar month, on top of the existing three-active-submission limit, with rejected papers counting toward the cap. It gives the data behind the change: 40,363 submissions in September, up from 20,569 a year earlier, cs.AI growing more than sixfold in two years, and the rejection rate rising from about 4% to 10β12%. It also covers the earlier measures (no CS review or position papers without peer review, stricter endorsement, one-year bans for unchecked AI output) and researcher criticism of applying the cap to everyone.
A study by Erfan Baghaei Potraghloo, posted to arXiv on October 8, 2026, evaluates seven open-weight LLMs used as "typed decision model" guardrails in agent systems (assigning probabilities to caller-defined allow/block options rather than generating text). It finds that six lines of unrelated server-log text raised one model's fail-open rate from 0% to 63%, and that merely renaming the permissive option's label (without changing its definition or the assessed text) drove fail-open rates to 93-100% in four models; a deterministic rule on typed values instead hit 100% accuracy, leading the author to recommend using these models only to triage reviewer workload rather than as sole decision-makers.
A set theorist who works on the Axiom of Choice responds to OpenAI's announcement that an AI system showed the Partition Principle does not imply the Axiom of Choice, a problem over a century old. They judge the preprint unclear, oddly structured and poorly referenced, and say it would be desk-rejected as a journal submission. The post argues that dumping unreadable machine-generated "solutions" on mathematicians shifts the verification burden onto them. It also raises open questions about AI disclosure statements, chat logs for reviewers, arXiv rate limiting, and how funders and the public will read these claims.
LeanChatGPT
OpenAISam AltmanarXiv
ai-policyΒ· Added 9 Oct 2026, published 8 Oct 2026
This arXiv paper shows that large language models can be trained to tolerate unreliable, faulty digital hardware, and that their error resilience improves rather than degrades as model size increases. Using modified neural scaling laws derived from 40,000 GPU-hours of training runs on simulated faulty hardware, the authors argue that LLMs learn to compute within "good" error-correcting codes whose relative overhead stays finite regardless of scale, suggesting a path toward running AI inference on low-energy, unreliable hardware for substantial energy savings.
research, trainingΒ· Added 8 Oct 2026, published 7 Oct 2026
This arXiv preprint argues that proofs of AI safety or alignment which consider the agent in isolation are incomplete, because the environment's structure matters just as much. The authors construct two theoretical scenarios β one with an infinite state space, one with signal mixture β under partial observability and time-limited action, and prove that even a hypothetically perfect agent cannot guarantee safe behavior in them. The conclusion is that any rigorous safety or alignment proof must jointly specify the agent and the environment's safe-action structure, not the agent alone.
ai-safety, researchΒ· Added 8 Oct 2026, published 7 Oct 2026
This arXiv paper examines why current LLM-based automated vulnerability-patching benchmarks overstate model performance, identifying pitfalls at the agent level (prompting/tooling inflating success without improving patch quality), framework level (permission errors, infra bugs, timeout handling silently skewing scores), and dataset level (single PoC tests failing to verify root-cause fixes). The authors curate 112 historical bugs across 84 open-source C/C++, Go, and Rust projects, each annotated with PoC tests, regression tests, and developer-intent tests, and show that while PoC pass rates look high, developer-test pass rates stay low and barely improve with newer models. They provide guidelines for more rigorous, reproducible evaluation of LLM patching systems.
LLMCGo+1
AI Security, AppSecΒ· Added 9 Oct 2026, published 7 Oct 2026
This arXiv paper introduces the "package hallucination attack," where an attacker injects malicious prompts into benign agentic-coding rule files (such as .cursorrules) to induce a coding agent to replace legitimate package dependencies with attacker-controlled ones. The authors propose PackHallu, an evolutionary optimization framework that iteratively rewrites injected prompts using trajectory-level feedback and LLM-guided mutations, and show it achieves high attack success rates with strong transferability across multiple LLMs, benchmarks, and agent frameworks.
CursorLLM
PackHallu
AI Security, Supply ChainΒ· Added 8 Oct 2026, published 7 Oct 2026
en.cryptonomist.charticleπ§ AI
