287 results for “ACE”

TextSeal2 is a distortion-free LLM text watermark that merges two or more keys into one virtual key and couples it to fresh noise through AutoMark's Gaussian copula. Under speculative decoding it verifies keyed drafts with an extra exponential race, so output matches the target model and acceptance rate is unchanged. On three LLMs at a 10^-3 false-positive rate, it detects 8 to 22 points more 100-token answers than TextSeal.

arxiv.orgpaperAdded 31 Oct 2026, published 29 Oct 2026🛡️ Security

TextSeal2 is a distortion-free watermark for LLM output that keeps its signal under speculative decoding. It merges two or more keys into one virtual key coupled to fresh noise through AutoMark's Gaussian copula, and verifies drafts with an extra exponential race. On three LLMs it detects 8 to 22 points more 100-token answers than TextSeal at a 10^-3 false-positive rate.

arxiv.orgpaperAdded 31 Oct 2026, published 29 Oct 2026🧠 AI

MAServeBench is a benchmark that treats multi-agent collaboration as a configurable dimension of LLM serving workloads. Its composable stages model how agents coordinate and exchange context in documented multi-agent workflows, and Hierarchical Semantic Traces record operations and dependencies for reproducible comparisons. Task-linked measurements tie workloads to GPU/NPU behavior, showing serving efficiency does not always mean timely task completion. Code is released.

arxiv.orgpaperAdded 31 Oct 2026, published 29 Oct 2026🧠 AI

Colin O'Flynn's paper shows that the flash accelerator in most microcontrollers produces the same timing collisions as a cache, so cacheless Cortex-M devices remain open to cache-collision attacks on AES. AES keys were recovered from as few as 750 traces across six cryptographic libraries, eight architectures and over twenty devices. It also attacks SPI bootloaders, Ethernet, CTAP2 over USB and 802.15.4, and releases the open-source tool FlashWhisperer.

eprint.iacr.orgpaperAdded 31 Oct 2026, published 29 Oct 2026🛡️ Security

Secure Transaction Verification and Authorization (STVA) is a draft Standards Track ERC (created October 2026) by @MATOBOYCRYPTO65. It proposes structured human-readable metadata and semantic intent for transactions and UserOperations, an independent simulation and verification interface, and scoped, revocable capability tokens for privileged operations. It targets blind signing and frontend supply-chain attacks, citing the February 2025 Bybit Safe multisig theft. The page gives only the abstract, motivation and core concepts.

ethresear.chpaperPublished and added 28 Oct 2026🛡️ Security

Shor's algorithm compiled on cat qubits is an IACR ePrint (2026/2665) giving an end-to-end resource estimate on superconducting cat qubits, using repetition and LDPC cat codes. Factoring RSA-2048 needs about 23,000 cat qubits and 3.14 days, assuming phase-flip noise p_Z = 5e-4 and no bit-flips. secp256k1 ECDLP needs at most 30,000 qubits and 1 hour. A space-for-time trade runs RSA-2048 in 1.25 hours on about 611,000 qubits.

eprint.iacr.orgpaperPublished and added 28 Oct 2026🛡️ Security

This paper replicates Chen et al.'s study of LLM-based smart contract vulnerability detection, first on GPT-4 and then on Mixture-of-Experts, RNN-like and State Space Models. The exact replication confirms the high-recall, low-precision pattern on GPT-4. The differentiated replication finds the pattern does not transfer uniformly: GPT-4 and Gemma-3 behave alike despite a roughly 100x parameter gap, while two MoE models diverge.

arxiv.orgpaperAdded 30 Oct 2026, published 28 Oct 2026🧠 AI

This arXiv paper (October 2026) replicates Chen et al.'s study of LLM-based smart contract vulnerability detection. It confirms the high-recall, low-precision pattern on GPT-4, then tests Mixture-of-Experts and RNN-like models plus a preliminary State Space Model run. Gemma-3 matches GPT-4's profile despite far fewer parameters, while two Mixture-of-Experts models diverge, so architecture family alone does not predict detection behavior.

arxiv.orgpaperAdded 30 Oct 2026, published 28 Oct 2026🛡️ Security

FlatCake is a KV cache storage architecture for LLM serving that treats host DRAM and NVMe SSD as peer media in one 64-bit address space, instead of a DRAM-over-SSD tier. Blocks are placed once, in session-contiguous, layer-major order, and streamed via GPUDirect Storage. On a Claude Code trace with DeepSeek-V4-Flash it holds a 94% hit rate (Mooncake: 64%) and cuts peak-load mean TTFT 1.6x.

arxiv.orgpaperAdded 30 Oct 2026, published 28 Oct 2026🧠 AI

This paper proposes an fMLLR-based compensation mechanism that cuts the fine-tuning data needed in transfer learning for speech emotion recognition under train-test acoustic mismatch. An autoencoder reduces trainable parameters, and an affine transform in the encoder latent space models rotations and shifts. In a human-robot interaction task, mean CCC rose 16.8% with 12.9% of the training set and 14.4% with 50%.

arxiv.orgpaperAdded 30 Oct 2026, published 27 Oct 2026🧠 AI

This ePrint paper models oscillator-based TRNG phase noise, both white and flicker, as fractional Brownian motion. It proves a quasi-renewal property that gives closed-form worst-case min-entropy and sampling requirements, and extends spectral and Allan-variance analysis so noise parameters come from a single timing trace. FPGA and ASIC experiments show flicker noise accounts for over 99% of uncertainty at a 0.99 min-entropy target, allowing a bitrate two to three orders of magnitude higher.

eprint.iacr.orgpaperAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

EnvSched is an online scheduler for agentic reinforcement learning that picks which environment-task pairs to roll out next. It builds a dual-relation graph over environments and tasks, propagates past rollout statistics to predict within-task reward variance, and adds environment quotas and a similarity penalty. On Qwen3-8B it scores 48.81 average on BFCL-v3, tau-Bench and ACEBench-Agent after 40 steps, above random selection at 120 steps.

arxiv.orgpaperAdded 28 Oct 2026, published 27 Oct 2026🧠 AI

This paper studies how multimodal LLMs refuse questions that an image cannot answer, using the MoHoBench benchmark on three MLLMs. It varies the meaning and placement of refusal instructions, compares supervised and preference-based post-training, and intervenes on a refusal-related activation direction. Instructions change refusal at the sample level in ways aggregate rates hide. Post-training raises refusal most but can mix refusal with attempted answers. Activation intervention gives smaller, transferable changes.

arxiv.orgpaperAdded 28 Oct 2026, published 27 Oct 2026🧠 AI

Paper (IACR ePrint 2026/2658) presenting a single-trace side-channel attack on a software Fisher-Yates shuffle of length 128, the butterfly count in one ML-DSA NTT layer. It removes rejection-sampling timing variation, extracts Hamming weight and identity leakage, and enumerates likely permutations with constraint programming. On a shuffled ML-DSA-44 NTT it recovers secret polynomial s1, fully or up to a few coefficients.

eprint.iacr.orgpaperAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

Poly2MsgLeaks is a profiled chosen-ciphertext power-analysis attack on the SMAUG-T (TiMER parameter set) post-quantum KEM that recovers the full 512-coefficient PKE secret from six traces on an STM32F415. It recovers 999 of 1,000 unseen secrets and proves an incorrect key is released with probability at most 2^-2095.6. Single-write message assembly and a two-share masked P2M resisted the evaluated six-execution attack.

eprint.iacr.orgpaperAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

Falcon Key Recovery from Joint Sampler Leakages is an ePrint paper presenting a power side-channel attack on Falcon and FN-DSA that fuses three SamplerZ leakages (exponent class of the center, sign bit, proposal magnitude). It turns them into slab and halfspace constraints solved by softplus interval regression, with no LLL or BKZ. On PQClean Falcon-512 (ARM Cortex-M4) it recovered all 50 keys with at most 34 signatures; on c-fn-dsa it recovered 38 of 50 keys within 200 signatures.

eprint.iacr.orgpaperAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

TraceTrial-Bench is a benchmark that scores agent task performance and agent harness reliability separately. It has 95 mechanism-oriented tasks across seven components: context, execution, governance, lifecycle, observability, tools and verification. Across 4 harnesses, 9 models and 3,420 runs, macro-averaged harness scores range from 59.8% to 72.0%, and 31.1% of runs succeed despite failing at least one harness criterion.

huggingface.copaperAdded 27 Oct 2026🧠 AI

Non-profiled single-trace side-channel attack on ML-DSA-65 (Dilithium) running on ARM Cortex-M4, by Linus Backlund and Elena Dubrova (KTH). It compares observed sample distributions with expected Hamming weight leakage using a Gaussian mixture model, and stacks partitioned trace segments for multiple observations. Information-set decoding corrects misclassifications; with a 2^70 enumeration budget, the full secret key is recovered from one trace in 99% of attacks, using secret key unpacking as the attack point.

eprint.iacr.orgpaperPublished and added 26 Oct 2026🛡️ Security

Subexponential Algorithms for LWE via Rejection Sampling on Superlattices is an ePrint paper by Ligeng Fan, Changpeng Shao, Hongbo Li and Dingkang Wang. It extends the Ducas, Engelberts and Loyer superlattice framework to give a provable classical search-LWE algorithm for prime q in [n^2, 2n^2], using m=4n samples and time and space exp(O(n/ln ln n)). A second variant runs in 2^((1/2+o(1))n/ln R) for general parameters. It resolves a gap left by Kirchner and Fouque.

eprint.iacr.orgpaperPublished and added 26 Oct 2026🛡️ Security

Scope-Gap Injection (SGI) is an indirect prompt injection method for multi-stage LLM-agent safety pipelines, tested in the IJCAI 2026 OpenClaw Agent Security Attack Competition. The visible task and skill stay benign while target identifiers, bypass parameters and authorization steps sit in an attachment written as a business worklist, which the S2 LLM judge appears not to inspect. SGI bypassed all three stages (static scan, LLM judge, live audit) for 5 of 19 targets, best F = 0.385. Attachment placement had 78% S2 acceptance versus 23% in-skill. The paper closes with defenses that align evaluator scope with agent channels.

arxiv.orgpaperAdded 27 Oct 2026, published 26 Oct 2026🛡️ Security

SynTrace is a single-round compiler that adds accountability to linear private information retrieval (PIR). The client mixes the retrieval query with m audit queries, so audit syndromes identify up to d deviating servers among t colluding ones before reconstruction. The paper proves perfect query privacy and zero false identification within the threshold. For Shamir-based PIR it needs k=t+d+1 servers. For a 32 KiB record from a 1 GiB database it uses 2.25 MiB, against 8.96 MiB for the Eriguchi, Kurosawa and Nuida (TCC 2022) homomorphic-MAC construction.

eprint.iacr.orgpaperPublished and added 26 Oct 2026🛡️ Security

SymLift is a compile-free vulnerability detection framework for context-incomplete code fragments. A fine-tuned LLM lifts control-flow, data-flow, memory and resource relations into a constrained LLVM-like IR. A parser turns the IR into facts, and Datalog rules derive findings with derivation traces. On Juliet function-level fragments Clang compilation success falls to 12.00%, while SymLift's completion rate drops only 1.17 points. SymLift-Qwen-7B reaches Target-F1 94.41% on FormAI and 91.66% micro-F1 on MegaVul.

arxiv.orgpaperAdded 28 Oct 2026, published 25 Oct 2026🛡️ Security

SymLift is a compile-free vulnerability detection framework for code fragments that lack project context. A fine-tuned LLM reconstructs control-flow, data-flow, memory and resource relations as a constrained LLVM-like IR, and a deterministic parser turns it into facts for Datalog rules that give findings with derivation traces. SymLift-Qwen-7B reaches 94.41% Target-F1 on FormAI and 91.66% micro-averaged Target-F1 on MegaVul.

arxiv.orgpaperAdded 28 Oct 2026, published 25 Oct 2026🧠 AI

This paper presents a pipeline that uses persona-conditioned vision language models to surface interpretive ambiguity in visualizations. Topic-relevant personas elicit candidate takeaways, and a Target-Pattern-Scope framework lets LLM judges label statement pairs as Compatible, Disjoint or Opposing, which are summarized in an ambiguity profile. The authors benchmark VLMs on chart comprehension per chart type, check labeling against human annotations, and run case studies on public visualizations and a redesign.

arxiv.orgpaperAdded 27 Oct 2026, published 25 Oct 2026🧠 AI

HerHealthGPT is a conversational AI system for women's reproductive health that combines retrieval-augmented generation, context-aware clarification and source validation in a web interface. Evidence retrieval raises concern-category accuracy from 54.1% to 59.3% over fine-tuning alone on 540 messages from 90 cases. The clarification router reaches 85.6% recall and 86.2% specificity. In a 30-adult study, 83.3% preferred the retrieval-enabled version. The authors say clinical validation is still needed.

arxiv.orgpaperAdded 27 Oct 2026, published 24 Oct 2026🧠 AI

AutoTavern is a self-improving system of specialised LLM research agents with a typed shared memory and verification gates. In 20 days it built TavernGym, a full-content Hearthstone Battlegrounds simulator, and 23 versions of TavernAgent, a PPO-trained player. TavernAgent averaged placement 1.60 with 80% first places over its last 20 live games, beating the top ten players (2.34, 59%). On TavernBench (960 tasks), it answered 91% of play tasks against at most 63% for frontier LLMs.

arxiv.orgpaperAdded 27 Oct 2026, published 24 Oct 2026🧠 AI

SPAFT is a structured prune-then-finetune framework for PPG (photoplethysmography) foundation models used on wearable signals. It finds that pretrained PPG models have inherent sparsity and redundancy, then restricts fine-tuning to a compact parameter subspace chosen by parameter importance and structural redundancy. Across four PPG foundation models, five datasets and ten tasks, it wins 82.8% of regression and 87.5% of classification comparisons.

arxiv.orgpaperAdded 27 Oct 2026, published 24 Oct 2026🧠 AI

DualPace is an LLM serving runtime that treats the host as an independently scheduled decode engine. A GPU engine runs prefills and GPU-resident decodes, while an AMX-enabled CPU engine batches and advances CPU-resident decodes, optionally calling GPU Dense Assist for dense stages. In decode-oriented scenarios it raises throughput 6.9 to 43.2% over NEO and 11.5 to 90.6% over vLLM at similar latency.

arxiv.orgpaperAdded 27 Oct 2026, published 24 Oct 2026🧠 AI

This paper builds a controlled French surface-variant benchmark with seven task types and 4,200 original-low-high triplets (12,600 inputs), covering missing apostrophes and diacritics and keyboard typos. Six models from two LLM families lose accuracy and show worse Brier score and NLL as perturbation grows. Keyboard typos hurt most. Calibration temperatures fitted on original inputs transfer to variants, and combining them with input restoration improves reliability further.

arxiv.orgpaperAdded 27 Oct 2026, published 24 Oct 2026🧠 AI

This paper studies demographic bias in LLM-emulated electorates, using three U.S. presidential elections and comparing one closed-source and one open-source LLM. Removing gender from the voter profile cuts the largest group error by 22-42%, and removing education cuts it by 64%. Removing self-reported race raises mean group error by over 40%. Repeated queries and fairness instructions do not reduce errors and can double them.

arxiv.orgpaperAdded 27 Oct 2026, published 23 Oct 2026🧠 AI

Signal-Aware Adaptive Fusion (SAAF) is a training-free zero-shot video anomaly detection framework that cuts the compute cost of vision-language models. It combines a dual-signal sampler (frame-to-frame delta and rolling-context drift in embedding space, OR-gated with EMA thresholds), a threshold-gated cascade from frame-level to video-level analysis, and signal-aware score fusion. It reports AUC-ROC of 92.07% on XD-Violence, 86.70% on MSAD and 80.54% on ShanghaiTech, at 2.2x to 2.6x the throughput of the prior best zero-shot method.

arxiv.orgpaperAdded 26 Oct 2026, published 23 Oct 2026🧠 AI

Preprint (IACR ePrint 2026/2611) proposing a federated learning defense that replaces gradient detection with zero-knowledge-proof sample-level audits of client datasets. A staking mechanism forces attackers to train on discovered poisoned samples with flipped labels, producing counter-gradients that remove the backdoor without knowing the trigger. ZKP commitments lock the training data, which blocks adaptive attacks and gradient tampering. On CIFAR-10 under Dir(0.1) non-IID, it holds attack success rate below 6% against distributed backdoor and edge-case attacks.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 23 Oct 2026🛡️ Security

This paper presents an offline evaluation harness for a production merchant-facing conversational agent. It stays reproducible when live backend data changes and can be regenerated when it goes stale. Used as the fitness function for GEPA prompt optimization under a correctness gate against reward hacking, it shrinks the full prompt surface by 3.5-7.6% without losing held-out correctness, across three subject-model families.

arxiv.orgpaperAdded 26 Oct 2026, published 22 Oct 2026🧠 AI

This paper studies reverse sycophancy: whether users bend toward a confident, consistent, wrong LLM. In a within-subjects experiment, 32 participants learned science topics from five GPT-5-mini assistants with 0 to 100% of facts replaced by falsehoods. Scores fell from 7.4 to 2.9 out of 10, planted falsehoods were chosen on 60% of falsified items against 11% of correctly taught ones, and confidence stopped tracking correctness. It introduces a baseline-corrected Human Deference Index.

arxiv.orgpaperAdded 24 Oct 2026, published 22 Oct 2026🧠 AI

The Geometry of Metaphor is an October 2026 arXiv preprint that uses mechanistic interpretability to find causal subspaces for metaphor in LLMs of different architectures and sizes. The authors steer output on classification tasks across parts of speech. They also steer generation tasks, showing the metaphoricity of model output can be controlled. The abstract gives no model names or metrics.

arxiv.orgpaperAdded 24 Oct 2026, published 22 Oct 2026🧠 AI

SARIA (Selective Admission and Reload for Inference Acceleration) is a KV caching system that jointly manages DRAM and SSD for multi-turn LLM agents. It persists only blocks likely to be reused beyond DRAM residency, promotes SSD-hit blocks into DRAM for same-session reuse, and paces DRAM reads with a transfer coordinator. Built on LMCache MP, it cuts SSD writes by 57.1 to 58.9% versus full duplicate caching and mean TTFT by 42.3 to 79.7% versus DRAM-only caching.

arxiv.orgpaperAdded 23 Oct 2026, published 22 Oct 2026🧠 AI

Chunk Recomputation under Real Document Revisions measures how much text must be re-embedded after edits for three stateless chunkers (non-overlapping fixed-size, recursive paragraph-first, content-defined) on 120 pairs of adjacent Chinese and English Wikipedia revisions. Fixed-size recomputes 57-68% of the new-version workload, recursive 38-56%, content-defined 43-54%, while evidence recall at a 2048-token budget differs by under two points. The authors argue update cost should be reported alongside retrieval quality.

arxiv.orgpaperAdded 24 Oct 2026, published 22 Oct 2026🧠 AI

Gandalf is an SSD KV cache offloading system for LLM serving that is aware of SSD lifetime. It prioritizes admitting full-attention KV cache to SSD over cache from other attention types, using application-level information rather than access history alone. The authors report a 7.3x average SSD lifetime extension with negligible cache hit rate loss across several workload traces and hardware capacities. The design may extend to High Bandwidth Flash.

arxiv.orgpaperAdded 23 Oct 2026, published 22 Oct 2026🧠 AI

Thomas Decru's ePrint 2026/2595 proves a corrected version of radical isogeny formulae for every N≥4, odd and even, over fields of characteristic coprime to 2N. It settles the sign choice for even N so that 2-isogeny walks stay on the volcano surface. One radical step costs about 12.5N multiplications and one exponentiation, and the paper shows how to evaluate radical isogenies on points, so a CSIDH class group action needs no torsion point sampling.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 22 Oct 2026🛡️ Security

IFC-MCQ is a method that automatically generates multiple-choice benchmarks from Industry Foundation Classes (IFC) building-model files, so answers can be graded by exact option-set match instead of human or LLM review. Its taxonomy has 15 categories and 36 subtypes in four groups, with answer keys from the file and distractors from file values or rules. Two agentic setups, tool-based and code-based retrieval, showed category-specific failures and variation by IFC model and interface.

arxiv.orgpaperAdded 23 Oct 2026, published 21 Oct 2026🧠 AI

Every Part Has Its Role studies concept augmentation in LLM post-training, where a target word is replaced by related alternatives in training sentences. It extends prior work from nouns to verbs and adjectives. Concept augmentation improves perplexity most consistently on news regardless of part of speech, while verbs give the most reliable downstream gains. CKA and linear probing show the largest gains do not match the largest representation changes.

arxiv.orgpaperAdded 23 Oct 2026, published 21 Oct 2026🧠 AI

SBFS-FT (symmetry-based few-shot fine-tuning) adapts the MatterSim 1M universal machine-learned interatomic potential with low-rank adaptation on a small set of compounds sharing one crystal symmetry. Tested on half-Heusler (space group 216), space group 225 and spinel (227) datasets, it cut lattice thermal conductivity error 2-3 times versus the base model. It matched per-compound fine-tuning while taking 5-7 times less compute for 100 compounds.

arxiv.orgpaperAdded 23 Oct 2026, published 21 Oct 2026🧠 AI

RingTrace is a monitoring framework that detects Flush+Reload cache side-channel attacks by combining per-core cache-miss counters with slice activity across uncore CBoxes. Its Joint Spatio-Temporal Attribution (JSTA) builds a joint-activity matrix without model training: the largest entry is the screening score and row sums point to a candidate core. The authors report detection before secret leakage, fewer false alarms under heavy memory load, and negligible runtime overhead on commodity processors.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 21 Oct 2026🛡️ Security

SHAKEing SLH-DSA with Non-profiled SCAs is an eShard ePrint paper (2026/2584) on correlation power analysis of SLH-DSA-SHAKE, the NIST-standardised hash-based signature scheme. It analyses PRF inputs and selection functions, then combines subtrace averaging, partial-then-total CPA and an efficient exhaustive search to recover the full secret seed, enabling universal forgery. On a 32-bit microcontroller the attack needs about 280 to 559 signatures, and the search finishes within 45 minutes on 72 cores.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 21 Oct 2026🛡️ Security

SoK on design-level backdoors in block ciphers. It places four published designs (Rijmen and Preneel, Paterson, Bannier and Filiol, Peyrin and Wang) in one taxonomy and gives a sound algorithm that recovers a partition trapdoor from S-box tables. It attacks KG-DES, BEA-1 and LowMC-M: KG-DES key recovery takes minutes, and the LowMC-M MALICIOUS backdoor yields the key from 35 to 409 queries. Trapdoors hidden in linear layers leave no trace, so the authors recommend deriving constants verifiably from a public seed.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 21 Oct 2026🛡️ Security

Table-free constant-work BCH decoding by algebraic index elimination is an IACR ePrint paper (2026/2580) that replaces the table scans in Walters and Sinha Roy's constant-work BCH decoder with fixed circuits over public addresses. It proves correctness through radius t and trace regularity, removes 5.2 and 7.2 KiB of tables, and runs 35.7 to 82.4 times faster on an i7-13700. Ordinary C masks compiled to received-word-dependent branches under Apple Clang 21, so the authors use a compiler-opaque primitive and run timing screens on four platforms.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 21 Oct 2026🛡️ Security

Broadcast and Trace from Lattices is a 2026 ePrint preprint by Jeffrey Champion. It builds collusion-resistant broadcast and trace with public tracing from attribute-based encryption with succinct ciphertexts and lockable obfuscation, both known from decomposed LWE. Ciphertexts are sqrt(N)·poly(λ, log N) in size, with poly(λ, log N) keys. It is the first such scheme based on a simple, instance-independent lattice assumption.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 21 Oct 2026🛡️ Security

Calibrated accommodation pairs (CAP) is a preference-data method that rewards chat models for matching a user's dialect density while keeping Standard English for Standard-English users. The paper traces SFT, DPO and RL stages across 10 open model lineages and finds post-training standardizes replies, while the DPO update still favours British and Australian spelling over AAE and Singlish. On a fully open model, CAP improves convergence on unseen features without added dialect for Standard-English users or lower instruction following.

arxiv.orgpaperAdded 22 Oct 2026, published 20 Oct 2026🧠 AI

OpenVLHarness is a multimodal reasoning harness for MLLMs built on a capability layer (task-level tool interfaces plus evidence rendering) and persistent multimodal memory that stores images, structured data and web references as addressable artifacts. A coding interface runs generated programs over stored data. Across 22 benchmarks and eight backbones it adds 9.7-12.6 points over no-tool baselines, and GPT-6 Luna at medium effort beats Codex and Visual Sketchpad at maximum effort using at most 37% of their tokens.

arxiv.orgpaperAdded 21 Oct 2026, published 19 Oct 2026🧠 AI

The paper introduces PhysRSI-eval, a five-axis metric for physical recursive self-improvement: first-attempt performance, efficiency, success, budget and improvement from failure. Several VLMs are tested on 18 manipulation tasks under a fixed interaction budget. It proposes the Physical Barrel Hypothesis and studies observational scaling. Workspace interventions show that removing history lowers late-round success, while frozen workspaces still help on unseen layouts.

arxiv.orgpaperAdded 21 Oct 2026, published 19 Oct 2026🧠 AI

Mise-en-Video (MeV) is a multi-shot video generation framework where creators stage shots in 3D space and then generate the matching video. It combines hierarchical attention for multi-level narrative consistency with 3D-aware layout guidance for per-shot spatial control. The authors built a 160K-video dataset with hierarchical multi-shot texts and oriented 3D bounding boxes, and report gains over baselines in quality, consistency and subject controllability.

arxiv.orgpaperAdded 21 Oct 2026, published 19 Oct 2026🧠 AI

Castryck, Dina, Kutas and Lorenzon study the Shimura class group action on superspecial principally polarized abelian varieties with a CM orientation, as a post-quantum commutative group action for key exchange. They give tools to represent CM orientations through higher-dimensional isogenies and to compute the action in the restricted effective group action model. These rely on a CM version of Kani's lemma and a trick that often halves the ambient dimension. The paper also gives a method for finding oriented superspecial abelian surfaces and analyses obstructions to transitivity.

eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

The paper traces sycophancy across 741 checkpoints from 30 open model lineages, from early pretraining to released models. It plants initial verdicts on moral scenarios and measures how far models follow a user's opinion or drop their answer under pressure. The behaviour usually exists before post-training, but which questions a released model yields on is set mainly during post-training. For Tülu-3 8B, its own preference-stage checkpoint removes 85% of remaining prediction error, a sibling model only 19%.

arxiv.orgpaperAdded 21 Oct 2026, published 19 Oct 2026🧠 AI

HAF-VLA is a hierarchical action-flow framework that adapts a pretrained flow-matching vision-language-action model to humanoid whole-body loco-manipulation. It denoises a shared action space in stages: locomotion and head commands first, then waist refinement, then full-body manipulation. Learnable stage embeddings and cross-stage KV-cache conditioning carry dependencies between stages. The authors report gains over existing models on six real-world tasks.

arxiv.orgpaperAdded 21 Oct 2026, published 19 Oct 2026🧠 AI

WSR-Tune is a fine-tuning framework that reparameterizes LLM weight matrices with a safety-conditioned basis, so safety-relevant information concentrates in a small set of directions. Those safety-critical directions are frozen, and the remaining complementary directions are updated for the downstream task. The authors report a better trade-off between downstream performance and safety retention. The page gives no benchmark names or numbers.

arxiv.orgpaperAdded 21 Oct 2026, published 19 Oct 2026🧠 AI

E-Layout is an ML-driven framework for post-placement logic restructuring in IC physical design. It builds equivalent logic alternatives with e-graph equality saturation, links logic choice to physical realization through a graph-based RAG model, and refines the choices with reinforcement learning on design-level timing feedback. On 9 designs it gives about 6% TNS and 2% WNS improvement and 1% less area than a commercial physical design flow.

arxiv.orgpaperAdded 21 Oct 2026, published 19 Oct 2026🧠 AI

This paper audits the PathQuestion (PQ) and PathQuestion-Large (PQL) multi-hop knowledge-graph QA benchmarks as graph-navigation tasks. It holds questions, answers, path annotations and splits fixed, and replaces each released task-filtered graph with the larger source KG. Restoration cuts released-answer accuracy and trajectory fidelity for frozen small-language-model policies and trained MINERVA policies, and graph-consistent evaluation recovers only part of the loss.

arxiv.orgpaperAdded 21 Oct 2026, published 19 Oct 2026🧠 AI

Privacy with Leakage from Falsifiable Assumptions is an ASIACRYPT 2026 paper by Francesco Berti and Itamar Levi. It replaces simulatability with "secure refreshing", a key-refreshing assumption that evaluation laboratories can test directly, and adds "strongly protected secure refreshing". Using these, it proves privacy of the PSV encryption scheme without assuming a leak-free component.

eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

Blind-DLPA is a multi-task deep-learning framework for profiled blind side-channel analysis, where the attacker has labeled profiling traces but only leakage traces from the target, with no plaintexts or ciphertexts. It estimates Hamming-weight posteriors of an input and a key-dependent intermediate, then ranks key hypotheses against theoretical joint distributions. It recovers keys on unprotected AES and Kyber and on ASCAD (guessing entropy zero with 39 traces), and the authors report collisions in a prior Ascon Hamming-weight model.

eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

Hybrid Reasoning Agents (HybridAgents) are LLM agents that switch between latent reasoning and text-based interaction in one generation process. A lightweight HybridLink handles mode transitions, continuous working memory keeps hybrid context across turns, and HybridSFT plus HybridRL train when to think latently and when to act in text. Across 3 model scales and 11 benchmarks, the paper reports 10.4% higher performance, 35.5%-54.7% fewer tokens, and 1.8x-2.6x faster inference.

arxiv.orgpaperAdded 19 Oct 2026, published 18 Oct 2026🧠 AI

Computing endomorphisms of superspecial principally polarized abelian surfaces is a cryptanalysis preprint by Marc Houben and Lam L. Pham, posted to IACR ePrint in October 2026. It gives an algorithm that, under a standard heuristic, finds a non-scalar polarized endomorphism in expected time and memory p^(4/5+o(1)). The abstract is the only text available, so the method and its effect on specific schemes are not described.

eprint.iacr.orgpaperAdded 19 Oct 2026, published 18 Oct 2026🛡️ Security

Revisiting the Security of VDOO is an ePrint paper (October 2026) on VDOO, a multivariate signature scheme submitted to China's NGCC program. It models VDOO as a multilayer Rainbow construction, keeps only the last oil space to get a generalized UOV instance, and applies wedge attacks. For the 512-bit parameter set it estimates 2^432 gates (reconciliation) and 2^379 gates (intersection), below the claimed level and the specification's figures.

eprint.iacr.orgpaperAdded 19 Oct 2026, published 18 Oct 2026🛡️ Security

PIAtlas is a taxonomy of prompt injection attacks organized by how the injected instruction subverts the model, with six mechanism classes as roots of a technique and sub-technique hierarchy. The authors release PICorpus, a license-clean collection of public prompt-injection datasets, and map thousands of records to PIAtlas under a human-verified protocol. Results show attacks combine several techniques from few mechanisms, agent benchmarks cover only part of the space, and adaptive attackers favor mechanisms that curated benchmarks underrepresent.

arxiv.orgpaperAdded 21 Oct 2026, published 18 Oct 2026🛡️ Security

ToFu is a tool-aware fuzzing framework for LLM tools, including MCP servers. It maps each tool argument, using its metadata, to one of 74 CWE-guided semantics-aware sanitizers (path, URL, SQL and similar). It then generates schema-valid Atheris harnesses and semantic oracles, using runtime tracers for in-process tools and outcome oracles for opaque ones. The LLM (gpt-4.1) only maps sanitizers and writes seeds; it is never the security judge. The paper also shows a "Repeat-After-Me" trick, where an LLM told to repeat attacker-crafted text emits a tool call the orchestrator executes, reproduced on LangGraph, MAF, ADK 2.0, AutoGen, Strands and CrewAI. Across 273 runnable MCP servers (3,405 tools) it reports 253 verified bugs in 343 tools across 118 servers, such as path traversal, log injection and exfiltration. These are failures a crash-based fuzzer would miss. The result matters because it shows LLM-generated tool arguments cannot be treated as trusted.

arxiv.orgpaperAdded 18 Oct 2026🧠 AI

ToFu is a tool-aware fuzzing framework that derives semantic security checks for LLM tools (mainly MCP servers) from their metadata and a corpus of 74 CWE-guided sanitizers. It generates schema-valid Atheris harnesses, uses runtime tracers and outcome oracles to catch bugs that don't crash, and uses an LLM only to map sanitizers and seed inputs, never as the judge. It also describes a "Repeat-After-Me" attack, in which the LLM is told to repeat attacker-written text that the orchestrator then dispatches as a tool call. It was reproduced on LangGraph, MAF, ADK, AutoGen, Strands and CrewAI. On 273 MCP servers it reports 253 verified bugs across 343 tools in 118 repositories, including path traversal, log injection, exfiltration and command bypass.

arxiv.orgpaperAdded 18 Oct 2026🛡️ Security

Determines, to first order in 1/p with an explicit error bound, the proportion of superspecial principally polarized abelian surfaces over F_p-bar (p ≡ 3 mod 4) that are optimally (N,N)-split. The expected number of optimal splittings is exactly 5N·J_2(N)(p-1)/(p²+1), so the split proportion is about 5N·J_2(N)/p. This gives the stationary target density of the splitting-detection attack on the dimension-two superspecial isogeny problem, which was previously known only from experiments or a one-sided bound. The proofs use Siegel's mass formula and genus averages over refined Humbert invariants, and every formula was checked by exact computation at twelve primes.

eprint.iacr.orgpaperPublished and added 17 Oct 2026🛡️ Security

Presents a fixed-point C implementation of the Mitaka signing algorithm, a simpler, parallelizable Falcon (FN-DSA) variant. It replaces MitakaZ's wide integral Gram root decomposition with a fixed-point square Cholesky decomposition, which cuts the cost of integer Gaussian sampling, and proves bounds on intermediate values and representation errors without empirical assumptions. Signing averages 361 kcycles (Mitaka-512) and 707 kcycles (Mitaka-1024) on AVX2, and 4.0 and 7.8 Mcycles on an STM32F411 Cortex-M4F. This makes floating-point-free lattice signatures practical on constrained devices.

eprint.iacr.orgpaperPublished and added 17 Oct 2026🛡️ Security

OpenGCUA, from Alibaba's MAI-UI team, is an open stack for generalist computer-use agents (GCUAs), where the model chooses how to observe, act and organize work across GUI, accessibility-tree, API and shell interfaces. Its design combines code execution (GUI actions written as programs with loops and branches) with harness-to-model decision transfer. On OSWorld-v2 it raises mean partial score by +19.6 points across eight models, including GPT-6 Astra and Claude Opus 5, and cuts reported steps per task by 53%. The release includes the harness, prompts, evaluation trajectories, a macOS real-device harness, a cross-device SDK and an interactive lab. It also shows large efficiency gaps between models: Qwen3.8-Max used 19.4x the reasoning tokens of GPT-6 Astra on real macOS tasks.

huggingface.copaperAdded 17 Oct 2026🧠 AI

This paper shows that training-free relaxed (lossy) verification in speculative decoding causes length inflation: completions get longer, mostly through extended reasoning traces, which offsets gains in accepted tokens per round. Across twelve target-drafter pairs, relaxed rules accept 1.34x as many tokens per round but produce 1.54x longer completions. Rules that cut verifier rounds usually lose substantial accuracy, so the authors argue completion length and verifier rounds must be reported.

arxiv.orgpaperAdded 20 Oct 2026, published 16 Oct 2026🧠 AI

TileDRAM is a compiler-runtime toolchain that adds tile-to-DRAM layouts as a compiler-visible abstraction for compute-unit-local 3D DRAM GPUs. It extends GPU Linear Layout to DRAM placement and picks layouts per tile access signature using row-buffer behavior. On 108 MoE FFN cases in Accel-Sim/Ramulator2, row-conflict rate fell from 75.7% to 15.2%, with a 1.77x geomean speedup. Overhead on an RTX 3090 is 0.17%.

arxiv.orgpaperAdded 20 Oct 2026, published 16 Oct 2026🧠 AI

FlexPart is a framework for text-controlled 3D mesh segmentation that assigns discrete part IDs to mesh faces through a view-independent part-identity field. It uses a control prompt of part names with location and shape clauses, trained on a VLM-built multi-granularity dataset. On FlexPartBench it raises average mIoU by 22% over the strongest baseline, and by 15% with planner-completed prompts.

arxiv.orgpaperAdded 20 Oct 2026, published 16 Oct 2026🧠 AI

ePrint paper presenting the first fully masked hardware implementation of HQC (key generation, encapsulation, decapsulation) on FPGA. It introduces a mixed Boolean/arithmetic masking for sparse-dense vector multiplication, proven first-order secure in the transition- and glitch-robust probing model and PINI-composable, at only 3% extra cycles and 81 random bits per cycle. It also shows a profiled horizontal side-channel attack on Rotate-and-Add multipliers that recovers support indices within ±8 positions from 200 traces despite TVLA showing no leakage after 10 million traces, and adds integrated hiding countermeasures costing 1.7% latency.

eprint.iacr.orgpaperAdded 17 Oct 2026, published 16 Oct 2026🛡️ Security

Many Biases, One Circuit is a October 2026 arXiv paper that traces attention heads behind cue-following (for example "I think the answer is B") through two post-training pipelines. Four cue types share a few heads already present in pretrained models. About 200 generic assistant examples activate them in chat format, and the final RL stage strengthens cue effects. Swapping attention patterns of six middle layers between Tulu-3-8B and OLMo-2-7B checkpoints moves cue effects most of the way.

arxiv.orgpaperAdded 20 Oct 2026, published 16 Oct 2026🧠 AI

R^2ECAP (Reused Reasoning-Cache Poisoning) is a black-box attack that plants poisoned reasoning traces through a chat interface, exploiting LLM systems that reuse KV caches of reasoning. A preceding trace steers the model, and the retained trace keeps residual adversarial influence in its cache after the preceding trace is discarded. On three open-weight LLMs and three datasets it reaches up to 79% ASR, beats the white-box HijackKV in 8 of 9 settings, and reaches 46% ASR in a reasoning-trace retrieval system. Only 1% of retained responses are flagged by a popular prompt injection detector.

arxiv.orgpaperAdded 20 Oct 2026, published 16 Oct 2026🛡️ Security

The paper proposes a traceable and aggregatable tagged witness signature (TA-TWS) and builds SwiftAuth on it, a conditional privacy-preserving anonymous authentication framework for UAVs and other dynamic terminals. Issuers can create authorization components while users are offline. Several credentials compress into one constant-size proof, verifiers can batch-verify across users, and a regulatory trapdoor lets authorities trace misbehaving users. TA-TWS is proven unforgeable and witness-hiding, and benchmarks with the MIRACL Core library on constrained devices and Aliyun servers show it is practical.

eprint.iacr.orgpaperAdded 17 Oct 2026, published 16 Oct 2026🛡️ Security

Doc2Harness is a two-stage benchmark for harness engineering. In Stage 1 a build model, working inside a fixed builder harness, gets an interface-only contract skeleton plus a development document consolidating behavior from twelve frontier harnesses, and builds a full candidate harness in an isolated container. In Stage 2 the frozen harness runs in separate per-test-case containers, driven by a scripted mock model, and is scored on four channels: requests sent to the model, files on disk, exit code and command output. Across 19 frontier models with three builds each on 328 test cases, GPT-6 Astra leads at 53.05% against 27.44% for the weakest, and failures cluster around how cross-cutting functionality is split across modules.

huggingface.copaperAdded 16 Oct 2026🧠 AI

DK-VLM adds Dual-Kernel Attention to a vision-language model. A semantic kernel keeps the pretrained attention and positional encoding. A separate geometric kernel uses estimated 3D points and camera poses to modulate attention through point displacements and relative view transformations, and a learned gate fuses the two outputs. Geometry therefore enters attention as position, not as fused 3D reconstruction features. The paper also adds Reference-Frame Composition (RC) supervision, which gives stepwise turn and heading targets derived from verified single-step annotations, to train multi-step spatial reasoning as the observer moves. DK-VLM-8B reports the highest average score across six spatial benchmarks among the compared methods, with 74.33 on VSI-Bench and 58.28 on ReVSI-32, and it preserves general video understanding.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🧠 AI

The paper identifies an "exploration dilemma" in modern Mixture-of-Experts models. Shared experts reduce the variability of token representations, which makes routing less exploratory. Fine-grained expert segmentation enlarges the combinatorial routing space and so needs more exploration, which means its extra expressiveness may go unrealized. It proposes MirrorMoE, which shrinks the exploration space by suppressing unnecessary experts per token, and reports consistent gains across model scales.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🧠 AI

Introduces Librarian Agents, where a builder agent turns raw unstructured documents into a hierarchical filesystem of synthetic files and reference links, forming a workspace for a downstream answering agent. Workspace construction is cast as a Markov decision process and the builder policy is trained with reinforcement learning to maximize downstream answering accuracy. It beats the strongest retrieval and precomputation baselines by 33 points on BrowseComp-Plus, amortizes construction cost over repeated queries, and generalizes zero-shot to BRIGHT with a 31-point average gain.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🧠 AI

GhostFaceMPC is presented as the first end-to-end face recognition system that runs both the deep CNN feature extractor and the matching step under secure multi-party computation. Raw images and biometric embeddings are never exposed at any stage, from feature extraction through storage to matching. The authors contribute an MPC-friendly quantization of the GhostFaceNet model and circuit optimizations that make this practical, and they release code on GitHub. It is relevant as an example of making CNN inference feasible under cryptographic constraints.

eprint.iacr.orgpaperPublished and added 15 Oct 2026🧠 AI

GhostFaceMPC is presented as the first end-to-end face recognition system that runs a deep CNN feature extractor (GhostFaceNet) and the matching step under secure multi-party computation. Raw images and biometric embeddings are never exposed during extraction, storage or matching. The authors contribute an MPC-friendly quantization of GhostFaceNet and circuit optimizations that make the approach practical, and they release code at crypto-unict/GhostFaceMPC.

eprint.iacr.orgpaperPublished and added 15 Oct 2026🛡️ Security

GACC-Bench is a benchmark for Goal-Adaptive Context Compression, testing how well LLMs retain goal-relevant information when compressing a source context under a length budget before downstream questions are known. It has 500 goals and 2,571 human-reviewed questions over 281 document and agent-trace contexts from seven collections; a fixed reader answers the withheld questions from the compressed context. Ten LLM compressors show large gaps to full-context performance, especially in answering every question tied to a goal. Target-goal conditioning improves accuracy over goal-agnostic compression, while mismatched goals hurt it.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🧠 AI

ePrint paper cryptanalysing Eevee (Umbreon, Jolteon, Espeon), forkcipher-based AEAD modes proposed at CCS 2023 for IoT-to-cloud computation. It gives a two-encryption AD-free prefix distinguisher, a four-encryption nonce-misuse distinguisher, a deterministic AD-only forgery, and nonce-respecting forgeries on Jolteon and Espeon (fresh one-block forgery reusing the tag; arbitrary AD substitution). It traces these to proof flaws (online-prefix consistency, domain separation, checksum freshness), derives design requirements, and concludes the failures are in the mode design, not the C implementation.

eprint.iacr.orgpaperPublished and added 15 Oct 2026🛡️ Security

Presents fault injection attacks on BIKE and HQC decapsulation that target instructions outside the Fujisaki-Okamoto transform, achieving full key recovery with only valid ciphertexts at NIST Level 1 (17392 queries for HQC, about 3 million for BIKE). It also gives a general method for finding effective fault locations by analysing decoder behaviour under perturbed conditions. Attacks were validated with laser fault injection on an STM32H7 microcontroller, showing a wider attack surface for code-based post-quantum KEM implementations.

eprint.iacr.orgpaperPublished and added 15 Oct 2026🛡️ Security

INFUSE is an end-to-end benchmark for indirect prompt injection (IPI) across long-horizon agent workflows (shell commands, code changes, dependency installs, remote services). It has 40 realistic tasks and a taxonomy of 56 attack scenarios in five threat categories, with attacks injected via interaction surfaces encountered mid-task. Across 19 LLMs (GPT, Claude, Gemini, Llama, Gemma, Qwen) and 41,824 adversarial trajectories, mean attack success was 19.6% (LLM-judged) and 15.4% (heuristic), per-model 3.2–41.9%; guard models gave limited protection, while prompt-level hardening cut mean ASR from 58.2% to 14.3%.

arxiv.orgpaperAdded 17 Oct 2026, published 14 Oct 2026🛡️ Security

ePrint paper evaluating ASCA (SAT-based) and SASCA (belief propagation) side-channel attacks on the AES-based MILENAGE authentication algorithm in USIM cards, using neural-network leakage predictions to recover subscriber key K and operator secret OPc from a single trace. SASCA alone succeeds in 87.7% of attacks but converges to a wrong OPc in 6.1%; ASCA succeeds in only 34% within a 1-hour timeout. The hybrid, where BP refines the predictions before they go to the SAT solver, reaches 93.8% with lower average runtime. It also proposes a countermeasure that masks each AES round key with an independent per-device secret, and the authors report it defeated the hybrid attack in all evaluated cases.

eprint.iacr.orgpaperAdded 15 Oct 2026, published 14 Oct 2026🛡️ Security

Proposes a cost model and metric for an adversary who collects side-channel traces classically and finishes the key search on a quantum computer. Shows any quantum algorithm needs Omega(sqrt(r)) cipher evaluations for key rank r, and that the quadratic advantage holds only up to a rank bound set by the NIST MAXDEPTH budget (about 2^58.6 for AES-128 at D=2^40). Defines a quantum-aware key rank computable from existing rank estimators, with simulated-leakage experiments showing a depth-limited quantum adversary is worth about 22 traces at SNR 0.125.

arxiv.orgpaperAdded 16 Oct 2026, published 14 Oct 2026🛡️ Security

The paper proposes a post-quantum architecture for WireGuard that leaves the core protocol unchanged. A mutually authenticated TLS 1.3 control channel runs over TCP, UDP (DTLS) or QUIC and uses ML-KEM key establishment, with X.509 certificates from a PKI signed with ML-DSA. A shared secret derived from the session's exported keying material is injected into WireGuard's native PSK interface. A Tamarin model of the TLS–WireGuard composition layer checks secrecy, binding and provisioning-order properties and identifies the conditions needed for secure deployment. The authors benchmark handshake latency and CPU time for classical, pure-PQ and hybrid key establishment across the three transports, and compare against the Rosenpass PQ WireGuard baseline.

eprint.iacr.orgpaperAdded 15 Oct 2026, published 14 Oct 2026🛡️ Security

Presents the first blind signature in which the issuer runs unmodified NIST-standardized ML-DSA, so it works with certified secure elements. Issuance is an ML-DSA signature on a commitment. The blind signature is a VOLE-in-the-head zero-knowledge proof of knowledge of that signature, about 1 MB, under 1 s to produce and 0.5 s to verify. Security reduces to ML-DSA EUF-CMA and the proof system. Issuer-hiding and selective disclosure add a few tens of KB. The paper also introduces edaBitE, a batch consistency check between binary and prime-field commitments that replaces the costly edaBits checks.

eprint.iacr.orgpaperPublished and added 14 Oct 2026🛡️ Security

Presents a modular device-binding protocol for post-quantum anonymous credentials. The phone Secure Element signs a verifier challenge with an unmodified FIPS 204 ML-DSA interface, and the user proves knowledge of that signature in zero knowledge at each presentation. Using ML-DSA's structure avoids the cost of generic NIZK systems such as Longfellow. The most efficient variants assume weak-MLWR for unlinkability, and that assumption can be dropped at some efficiency cost. The protocol works with different anonymous credential schemes, and a proof-of-concept implementation is included. This matters for planned EU age-verification and Google Wallet/mDL rollouts, which need protection against credential sharing.

eprint.iacr.orgpaperPublished and added 14 Oct 2026🛡️ Security

MiniDog is a framework for training a text-to-image flow-matching diffusion transformer from scratch on four RTX 3090 GPUs, with 55 minutes of pretraining and 15 minutes of fine-tuning. It pretrains on 26k ImageNet dog images that were captioned, then fine-tunes on 2k FLUX.1-schnell generated images. Image and text features are precomputed and cached. The model is a 22M-parameter transformer with the E2E-INVAE semantic latent space, a small Qwen text encoder and in-context conditioning, and training is accelerated with iREPA and an EUPE perception encoder. The repo evaluates with FID, HPSv2, PickScore and VAE reconstruction metrics. It lowers the barrier to hands-on diffusion training research.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

PixelMoE is a pixel-space diffusion framework that scales capacity sparsely using standard LLM-style Mixture-of-Experts: token-choice routing, fine-grained routed experts, a shared expert and bias-based load balancing, with no diffusion-specific routing or auxiliary routing losses. It adds Pixel-Space Hierarchical Flow Matching, which varies spatial resolution along the denoising trajectory from global structure to fine detail. At matched active parameters it beats dense counterparts, and reaches FID 1.47 at 256x256 and 1.53 at 512x512 on class-conditional ImageNet-1K without representation alignment or perceptual losses. Code and models are promised but not yet released.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

UniW(A)M is a mixture-of-experts model built on diffusion Transformers that unifies action-conditioned world modeling (AC-WM) with several world-action model (WAM) variants. Shared experts capture common physical dynamics, while atomic capability experts are reused across interfaces, each keeping its own conditional pathway. At deployment a plug-in adaptive interface router (PAIR), trained on a small subset of target-task chunk scenarios with the backbone frozen, picks a WAM interface for each execution chunk. It reaches 88.3% average real-world success against 76.7% for the strongest baseline, leads WorldArena on all three action-conditioned world-modeling tasks, and PAIR raises OOD success from 63.3% to 76.7%.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

Proposes Geometric Calibration of supervised fine-tuning and SPACE (Subspace Projection for Adapted Checkpoint Enhancement). SPACE is a post-hoc, data-free, training-free method that uses the pre- and post-SFT checkpoints to revert SFT update components lying in the principal subspace of the pre-SFT weights and keep those in the orthogonal complement. It is evaluated on Qwen2.5, Qwen3, Qwen3.5, Llama-3.1 and Olmo-3 models (2B–14B) with math, coding and medical SFT. It reduces out-of-domain regression and improves in-domain performance, for example +2.85 ID / +2.26 OOD on Qwen2.5-7B math SFT.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

Introduces Structured Recipe Optimization (SRO), a paradigm for automated LLM post-training that optimizes over a task-adapted recipe space covering data sources, data processing, cross-domain composition and training configuration. It pairs an LLM-based Recipe-Space Designer, which builds the recipe space for the target tasks, with a Multi-Domain Recipe Optimizer that uses structured trial evidence to guide LLM candidate construction and multi-objective Bayesian trial selection. SRO gets the highest average score in all evaluated target-model and agent-LLM combinations; for example, 41.1 vs 15.4 for the strongest baseline on Qwen3-1.7B with GPT-5.4, and 53.8 vs 40.8 on Qwen3-4B with DeepSeek-V4-Flash, in joint post-training across three capability domains and six benchmarks.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

Short paper analysing the HM-QCT hybrid quantum–computational time-lock QKD protocol (Mazzoncini et al., 2025). It spells out the two "harvest now, decrypt later" strategies (quantum memory and classical memory) and shows each is excluded by exactly one of the two assumptions: short-term encryption and low-fidelity quantum storage. It then proposes HM-PRF, which replaces the short-term encryption with a locally evaluated pseudorandom function, so security needs only one-way functions rather than a predicted lasting gap in quantum memory technology.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🛡️ Security

Kairos is a reference monitor placed at the isolation boundary of an unmodified, opaque LLM agent, where tool calls, shell commands and agent-written scripts all appear as the same file and network operations. A declarative trust policy decides most effects deterministically and defers the rest; deferred effects are held while the agent continues speculatively, and a bounded-authority decision oracle (an LLM or a human) releases or refuses them based on the trace. Across three benchmarks and three agent models it beats existing defenses on the attack-success/utility trade-off; on AgentDojo it cuts attack success from 47.0% to 2.7% with no loss of benign utility.

arxiv.orgpaperAdded 15 Oct 2026, published 13 Oct 2026🛡️ Security

Introduces Sauron, an evidence-first agentic verifier that checks rubric criteria for long-horizon agent tasks by investigating both environment state and execution trace, and trusts a claim (including an agent's self-reported success) only after validating it against its source. Bounded queries and joint investigation of related criteria cut context use, and each verdict carries an auditable evidence receipt. On 2,586 human-labeled criteria from 100 personal-assistant episodes it has the best F1 of five verifiers across eight backbones (0.96 vs 0.92 for Gandalf with GPT-5.6 Sol, at 23% lower cost). It detects 97% of injected failures across 13 fault families, including reward-hacking simulations, with 2% false flags on clean controls, and leads on the TRAIL agent-error benchmark. It matters because unreliable rubric verdicts used as RL rewards can reinforce bad behavior.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

Cryptography paper that extends Chen and Fischlin's two-user Signal analysis (Eurocrypt 2024) to group chats. It introduces "causal awareness": a receiver can reconstruct part of the causal context in which an accepted message was sent. Network delay or adversarial interference can otherwise show an authentic message in a misleading context. Senders transmit records of what they have sent and received, and receivers verify these records and compare them with their own. The paper gives correctness and security definitions parameterized by how much causal information must be recovered, baseline constructions with proofs, and checkpoint-aided and server-aided variants. It also discusses how to surface this information in a messenger's UI.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🛡️ Security

Marcel Keller's ePrint compares the two fully secure MPC sorting approaches, Quicksort (Araki et al., CCS'21) and radix sort (Asharov et al., CCS'22). The comparison covers a range of parameters, for both honest- and dishonest-majority settings. The paper then extends the sparse matrix multiplication of Damie et al. (CODASPY'26), which avoids oblivious RAM, so the output comes out in the same format as the inputs. That makes repeated multiplication of graph adjacency matrices possible, which the paper uses to find cycles and scatter-gather patterns associated with money laundering. The result is privacy-preserving anti-money-laundering detection.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🛡️ Security

Anthropic's Frontier Red Team tests whether small open-weight models (≤30B) can autonomously replicate across commodity IoT devices. They ran Gemma4-26B-A4B over 15 off-brand Android TV boxes at 0.39 tok/s with pipeline parallelism. A Qwen3.5-9B-class model set up inference on 8 of 9 hardware types, and only GLM-5.2 completed end-to-end worm replication in an 8-node redroid ADB network, spreading to 8/8 nodes in 4 of 5 trials and 7/8 in the other. It also estimates spread using the Kimwolf botnet's size (~133k replicas, about 40 H100s of compute), shows notes inherited between generations improve Qwen3.5-9B's setup success (45% to 61–84%), and projects small models reaching the capability floor by end of 2026. It closes with defensive points: drive R0 below 1, and harden IoT devices.

anthropic.compaperPublished and added 12 Oct 2026🛡️ Security

Preprint recovering the long-term key of a first-order masked Kyber768 implementation on an ARM Cortex-M4 from about 2200 decapsulation power traces using only valid ciphertexts. A profiled neural network estimates Hamming-weight distributions of both arithmetic shares, which are turned into likelihoods on decryption noise and combined by a belief-propagation solver with Gaussian interference approximation and an Onsager (AMP) correction, recovering all 1536 secret and error coefficients without lattice reduction. It shows first-order masking is insufficient against combined second-order leakage, and that least squares, greedy solvers and lattice hints (BKZ block size 624 to 505 at 2000 traces) do worse.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 12 Oct 2026🛡️ Security

Paper proposing a risk-based methodology to derive security specifications for complex electronic systems such as AI chips and chiplet-based designs. It walks from system missions to assets, threat analysis, security requirements and then countermeasure selection. The method is illustrated on datacenter and automotive chiplets for the missions of secure provisioning, trimming, debugging, booting and remote attestation, and addresses the longer supply chain and multi-tenant threats that chiplets introduce.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 12 Oct 2026🛡️ Security

Paper on the forensic analysis of a stand-alone HackRF One with a PortaPack running Mayhem firmware v2.0.1. It establishes at source-code level which data sit on the microSD card, their formats, when they are written and how to interpret them. The method is applied to a four-month SD image and covers RTC-battery-dependent timestamp rules, traces of on-device trimming and text editing, cluster-level recovery of deleted IQ captures, and decoding of recorded signals cross-checked with an independent decoder. In the example, the tail of a deleted IQ capture and a trimmed-away segment are recovered, and six captures are attributed to one rolling-code OOK transmitter with a shared 32-bit ID. It provides an artifact catalogue, interpretation rules and acquisition recommendations.

arxiv.orgpaperAdded 17 Oct 2026, published 11 Oct 2026🛡️ Security

ePrint paper by Peigen Li and Siyong Tao extending the wedge-attack framework of Ding, Li and Tao and the Schur-Macaulay matrix approach of Merz and Ran against Unbalanced Oil and Vinegar (UOV). It reformulates the attack with p-truncated polynomial algebras, so it applies over arbitrary finite fields. Divided powers and transfer relations give extra public relations in the ideal-inclusion framework, with quotient-dimension criteria for recovering graded components of the hidden oil-space ideal. Applied to the third-round QR-UOV parameter sets, it gives lower attack-complexity estimates for some of them.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 11 Oct 2026🛡️ Security

Paper testing whether an LLM agent operating life support in the NASA-derived BioSim lunar habitat simulation can be induced by delayed prompt injection, hidden in truthful S-band telemetry, to shut down life support and hold the shutdown while the crew suffocates. It compares Claude, GPT and Grok configurations: Claude mostly refuses and cites the living crew, GPT shows some susceptibility, and Grok given a "trusted commission" framing more often cuts life support. It also varies the framing of the message (trusted commission, peer, untrusted source) and uses a harmless-procedure-drop attack as a proxy for whether life is valued intrinsically. Code and traces are open-sourced.

arxiv.orgpaperAdded 15 Oct 2026, published 10 Oct 2026🛡️ Security

KedgeFlow specifies language-independent contracts so trusted controllers can authorize state-changing operations by enterprise AI agents and privileged gateways can enforce that authority independently of agent reasoning. It combines evidence-backed policy checks, signed permission for an exact action, a single-use shared allowance, target-side conditions and retained outcome records, with two conditional properties (at most one claim per allowance; every dispatch linked to a grant and claim) that hold even if the agent is compromised. A reference implementation exposes the path via MCP; evaluation on a three-member etcd cluster gave exactly one successful claim for each of 82 allowances across 6,560 concurrent attempts, and one committed effect in a 32-call gateway race. The authors report limits: permissive policy still authorized an undesirable effect, and distributed reservations, production access routes, crash recovery and real-target exactly-once effects remain untested.

arxiv.orgpaperAdded 15 Oct 2026, published 10 Oct 2026🧠 AI

SecReason is an in-stream defense for reasoning LLMs that write code. Reasoning models draft code early in their streamed chain of thought, so SecReason scans that stream with dual-track incremental analysis: security rules are checked on each emitted statement, and dataflows are traced across the accumulated code. When a rule fires, it interrupts decoding, inserts a warning into the stream and resumes, so the model fixes its draft within the same reasoning trace instead of regenerating the full response. On CWEval and SecCodeBench, runs delivering secure and functionally correct code rise from below 15% to 72.8%–98.1%. It uses fewer tokens than post-hoc repair and limits functional regressions when rules misfire on secure code.

arxiv.orgpaperAdded 15 Oct 2026, published 10 Oct 2026🧠 AI

SecReason is an in-stream defense for reasoning LLMs that monitors code drafted inside the streamed chain of thought. Dual-track incremental scanning applies security rules per statement and traces dataflows across accumulated code; when a rule fires, generation is interrupted, a warning is inserted, and decoding resumes so the model repairs the draft in the same trace. On CWEval and SecCodeBench it raises the share of secure and functionally correct runs from below 15% to 72.8%–98.1%, uses fewer tokens than post-hoc repair, and limits regressions from false warnings.

arxiv.orgpaperAdded 16 Oct 2026, published 10 Oct 2026🛡️ Security

SecReason is an in-stream defense for reasoning LLMs that monitors code drafted inside the streamed chain of thought. Dual-track incremental scanning applies security rules per statement and traces dataflow across accumulated code. When a rule fires, generation is interrupted, a warning is inserted and decoding resumes, so the model repairs its draft without regenerating the full response. On CWEval and SecCodeBench it raises the share of secure and functionally correct runs from below 15% to 72.8%–98.1%, uses fewer tokens than post-hoc repair, and limits functional regressions from false warnings.

arxiv.orgpaperAdded 15 Oct 2026, published 10 Oct 2026🛡️ Security

SecReason is an in-stream defense for reasoning LLMs that write code. Reasoning models draft code early in their streamed chain of thought, and SecReason scans that draft incrementally with security rules, checking each statement as it is emitted and tracing dataflows across the accumulated code. When a rule fires, it interrupts generation, inserts a warning into the stream, and resumes decoding, so the model repairs the draft within the same reasoning trace. On CWEval and SecCodeBench it raises the share of runs that deliver secure and functionally correct code from under 15% to 72.8%–98.1%. It uses fewer tokens than post-hoc repair and limits functional regressions when rules misfire on secure code.

arxiv.orgpaperAdded 16 Oct 2026, published 10 Oct 2026🧠 AI

The paper studies joint attention in multimodal diffusion transformers (MMDiTs), where the evolving image updates text representations. It finds that this image-to-text (I2T) feedback tends to preserve objects and attributes already in the image, errors included, and that suppressing it improves generation. It proposes Semantic Feedback Guidance (SFG), which guides away from an auxiliary branch that strengthens I2T feedback and weakens text-to-image conditioning, and iSFG, an in-place variant that needs no extra model evaluations. SFG runs for the first 20% of sampling steps (about 1.2x base NFE without CFG). Across three backbones, adding SFG to CFG on FLUX raises GenEval from 0.6661 to 0.7479, and iSFG on SD3.5M adds +1.33 HPSv2.1 over CFG at zero extra NFE. The control also improves VBench scores for text-to-video and image-to-video.

arxiv.orgpaperAdded 12 Oct 2026, published 9 Oct 2026🧠 AI

ReplaySSM represents state-space model state as a periodically updated checkpoint plus a buffer of recent SSM inputs, separating output computation from checkpoint updates. This avoids state writes on most decoding steps (roughly halving dominant state memory traffic), makes speculative-decoding rollback a buffer-pointer operation, and lets a low-precision checkpoint serve outputs while a higher-precision one drives recurrent updates. Implemented in vLLM for Mamba-2 and Gated DeltaNet, it gives 1.20–1.47x decoding speedup at batch size 256 across four hybrid models and about 1.8x the throughput of vLLM speculative decoding on two 120B-class models.

arxiv.orgpaperAdded 12 Oct 2026, published 9 Oct 2026🧠 AI

HOA (Humanize Olympiads Agent) is an open, flow-level framework that coordinates several agent sessions through three feedback channels: an independent reviewer that critiques each candidate, a structured wiki supplying task-specific knowledge the base model may lack, and a verifier that checks generated Lean proofs against trusted challenge statements. With GPT-5.6 Sol it reports perfect scores on IMO, IPhO and IOI 2026, near-full marks on IChO 2026, 672/672 on PutnamBench, and first place on the Lean-Eval leaderboard (251/304). With the open model Kimi-K3 it matches or exceeds a GPT-5.6 Sol + /Goal baseline on several contests, which suggests systematic feedback can narrow base-model capability gaps.

arxiv.orgpaperAdded 12 Oct 2026, published 9 Oct 2026🧠 AI

The paper presents RM-KLPT, an algorithm that solves the algebraic pathfinding problem in isogeny graphs of superspecial abelian surfaces with maximal real multiplication. It does this by solving a norm equation in ideals of a quaternion algebra over a real quadratic field. The authors implement it and revisit the RM-CGL hash function of Charles, Goren and Lauter. They show that if the initial surface's algebraic description is known, RM-KLPT gives a second-preimage attack on the hash. Paths are much shorter (~p^3) than with KLPT^2, because a higher-dimensional Deuring correspondence exists in the RM setting. The paper also discusses cryptographic constructions that could be built on RM-KLPT.

eprint.iacr.orgpaperAdded 12 Oct 2026, published 9 Oct 2026🛡️ Security

A narrative review in HCI arguing that the single-voice chatbot interface causes three harms: cognitive offloading, ideological narrowing of user beliefs, and epistemic compression of cultural and value diversity. It proposes multi-persona interfaces, which show several personas to the user at once, as a low-cost fix. The design draws on game design and participatory simulation (magic circle, role differentiation, persona embodiment). It offers a taxonomy for designing such interfaces and calls for empirical studies that link technical pluralistic alignment methods to real human-AI interaction.

arxiv.orgpaperAdded 12 Oct 2026, published 9 Oct 2026🧠 AI

DreamTrue is a multi-view, cross-embodiment robot world model for action-faithful, physically plausible video prediction. It renders action trajectories into image-space conditions aligned to target videos by offline geometric calibration. Counterfactual post-training modifies recorded trajectories to cover unsuccessful interactions and contact configurations. A human-annotated defect dataset trains an embodied video reward model whose scores drive RL post-training. On AgiBot it reaches state-of-the-art action following and cuts the human-assessed interaction defect rate from 48.12% to 6.25%. It ranked first in the world model track of the AgiBot World Challenge 2026.

arxiv.orgpaperAdded 9 Oct 2026, published 8 Oct 2026🧠 AI

WOVEN is a training source and benchmark for visual transition reasoning in multimodal LLMs. It has 36,076 examples spanning 20 scene types, 5 action types and 8 reasoning types, built from rollouts of video-pretrained generative models. Evaluating 38 frontier MLLMs (including GPT-5.4 and Qwen3-VL-235B-A22B) shows systematic deficits that persist with scale. Training on WOVEN subsets of about 2,000 items improves 22 of 26 external benchmarks by up to 27.3 points, and WOVEN data can replace 30-50% of a task's own training data. The authors derive a recipe: select supervision by the reasoning operation it teaches rather than by scene or action, and prefer larger visual-state changes.

arxiv.orgpaperAdded 9 Oct 2026, published 8 Oct 2026🧠 AI

TRACE (Train-Rollout Quantization Alignment via Compact GuidancE) is an FP4 quantization framework for reinforcement learning post-training of Mixture-of-Experts language models. It uses rollout-guided quantization-aware training to align training-side FP4 rounding with rollout-side quantization outcomes, reducing the train-rollout discrepancy that limits prior low-precision RL methods, and adds a caching scheme that selectively retains mantissa/scale information from deeper layers to cut communication overhead. Evaluated on four large MoE models across reasoning, coding and long-horizon RL tasks, it matches BF16-rollout RL performance while achieving up to 5.4x rollout speedup with joint FP4 weight/activation and FP4 KV-cache quantization.

arxiv.orgpaperAdded 7 Oct 2026🧠 AI

Introduces DITTO, a stack-based, context-aware scanner for Pickle-based pre-trained models that tracks Pickle VM state transitions and applies semantic analysis to infer model intent. Authors found 9.3% of 10,000+ popular Hugging Face repos still use Pickle, and release PickleBench (959 benign, 92 malicious models, including extension registry attacks missed by existing tools). Reports 100% coverage, 0% false negatives, 0.7% false positives, F1 0.966, outperforming current scanners.

arxiv.orgpaperAdded 9 Oct 2026, published 7 Oct 2026🛡️ Security

RunningTab is a framework that gives LLM agents performing 'direct workspace interaction' (searching and reading files from a terminal without indexing to produce a deliverable) an environment-side 'tab': a per-task record, maintained outside the model's context, of requirements the agent has declared, excerpts read with provenance, and listed-but-unopened files flagged as candidates. The agent can check each requirement against matching excerpts or candidates, mark it resolved or deferred with a reason, and is forced through a finish check if requirements remain open when it tries to complete the task. The authors show it consistently beats plain direct workspace interaction and model-internal record-keeping baselines across three benchmarks and three LLMs.

arxiv.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

DictXAI is a new explainable AI method that defines interpretable concepts directly in the input domain using a dictionary of predefined elements, rather than relying on inherently-interpretable input features or architecture-specific internal abstractions as prior XAI methods do. It computes a sparse code of the model input and attributes predictions to dictionary elements, letting it work across learned image bases, analytically-defined ECG waveforms, and experimentally acquired dictionaries, and the authors show it can trace AI malfunctions like Clever Hans effects to specific data artifacts while aiding human-AI alignment on biomedical signals.

arxiv.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

This arXiv preprint argues that proofs of AI safety or alignment which consider the agent in isolation are incomplete, because the environment's structure matters just as much. The authors construct two theoretical scenarios — one with an infinite state space, one with signal mixture — under partial observability and time-limited action, and prove that even a hypothetically perfect agent cannot guarantee safe behavior in them. The conclusion is that any rigorous safety or alignment proof must jointly specify the agent and the environment's safe-action structure, not the agent alone.

arxiv.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

This paper runs a mechanism-isolating ablation of four document-structure treatments used in retrieval-augmented generation — structure-aligned chunking, LLM-generated chunk contexts, heading-path metadata, and hierarchical two-stage retrieval — under one protocol with matched chunk sizes and a semantically null placebo (shuffled heading paths) to control for the confound that any prepended text perturbs embeddings. Using a coverage-aware nDCG metric and document-clustered bootstrap with Holm correction across 200 Wikipedia Featured Articles (951 queries) and 1,585 QASPER papers (4,303 questions), it finds that structure-aligned chunking with real heading paths beats both contextualized fixed windows and the placebo, naive hierarchical retrieval hurts performance (traced to first-stage section recall failures), and gold structure beats LLM-induced structure on Wikipedia but not QASPER. Effect sizes are small but statistically significant and consistent across corpora, giving RAG practitioners evidence-based guidance on which structure-aware retrieval tricks actually help versus which are placebo effects.

arxiv.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

An IACR ePrint paper by Erik-Oliver Blass and Travis Mayberry proposing oblivious probabilistic hash tables (chaining, power-of-two-choices, stash-less cuckoo, de-amortized cuckoo hashing) built over Path ORAM as a replacement for oblivious AVL trees when deployed inside Intel SGX enclaves. It shows that SGX's small trusted client memory lets the position map recursion be shrunk to ≤3 levels, making constant-access hash tables beat Θ(log n) tree traversal, and derives via large-scale simulation the concrete padding parameters needed for "double obliviousness" (bounding hash-table rebuild probability to ≤2^-40) that prior ORAM literature lacked. Their SGX implementation reports up to 20x faster lookups and 12x faster inserts than oblivious-tree baselines.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🛡️ Security

Krenn, Lesaignoux, Mir and Spini (AIT Austrian Institute of Technology) propose an "issuer inspection" mechanism for issuer-hiding attribute-based credentials (ABCs): an inspection authority can release time-bound keys that let verifiers locally flag presentations tied to a specific compromised issuer without unmasking other issuers or periods. They formalize the syntax/security model, give a generic construction, and instantiate it concretely using Groth's randomizable structure-preserving signatures, Schnorr-style proofs, and an adapted Gentry anonymous identity-based encryption scheme, showing the overhead stays practical. This addresses the accountability gap introduced when issuer-hiding ABCs conceal which authority issued a credential during verification.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🛡️ Security

This IACR ePrint paper breaks Origami, a multivariate post-quantum signature scheme submitted to the NGCC round-1 public-key call, showing its bilinear construction is effectively a Rainbow-type scheme whose central map leaks through the public verification key in a predictable coordinate order. The authors derive an equivalent secret key from the public key alone, enabling universal forgery at roughly the cost of one signature verification (~0.01s at Origami-128), and demonstrate the attack against the unmodified reference implementation across all four parameter sets and the official test vectors. They also refute Origami's security proof by breaking its inversion assumption in a bilinear independent-coefficient model, and note a separate structural flaw where honest signatures lie in a proper subspace rather than the full space the specification assumes.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🛡️ Security

This arXiv paper introduces the "package hallucination attack," where an attacker injects malicious prompts into benign agentic-coding rule files (such as .cursorrules) to induce a coding agent to replace legitimate package dependencies with attacker-controlled ones. The authors propose PackHallu, an evolutionary optimization framework that iteratively rewrites injected prompts using trajectory-level feedback and LLM-guided mutations, and show it achieves high attack success rates with strong transferability across multiple LLMs, benchmarks, and agent frameworks.

arxiv.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🛡️ Security

This arXiv paper proposes foundations for proactive LLM agents organized around three joint principles (3T: Task Capability, Temporal Allocation, Trust) and a five-dimensional design space (task scope, anticipation horizon, activation trigger, processing timing, intervention depth). It introduces PROACTIVITY-GYM, a simulation-based testbed with multi-day scenarios, stateful environments, and persona-conditioned simulated users, and reports evaluations across 23 model-harness configurations plus a 30-participant human study showing sharp trust declines after intervention misalignment and a preference for imperfect sleep-time assistance over interruptive help.

arxiv.orgpaperAdded 6 Oct 2026🧠 AI

World Models' Last Exam in Physics introduces a measurement-based benchmark of 40 controlled tasks across mechanics, optics, fluids, thermal/phase-change phenomena, electromagnetism, and surface tension, designed to test whether video world models generate physically consistent outputs. Each task pairs an initial image and prompt with predefined physical criteria, and a custom evaluator combines observability screening with task-specific quantitative measurements rather than relying on reference videos or model-based judgments. Testing eight video generation models across 1,280 generated videos found persistent physical inconsistencies, with the best model scoring only 57.76/100, and the evaluator showed higher agreement with human judgments than a vision-language model baseline.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

PEARS is a hybrid reinforcement-learning framework for sample-efficient online adaptation of pretrained tactile-manipulation policies to out-of-distribution conditions. A physics-guided force reasoning (PFR) module uses a vision-language model to diagnose failures from visual and tactile history and update contact-force bounds enforced by a hybrid force-position controller, while a separate tactile-conditioned diffusion-steering component perturbs the latent noise of a frozen flow-matching policy to correct free-space motion and contact timing without retraining the base model. It improves success rates by 12.4-37.4 points over strong baselines in simulation, cuts required interaction episodes by up to 53.2%, and reaches 95%/90% success on real-world whiteboard-erasing and pipette-liquid-aspiration tasks.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

This paper introduces BOTTLED, a benchmark testing whether LLM agents can autonomously convert their general task-solving ability into cheaper, scalable artifacts (e.g., training a small distilled model or writing a reusable program) when faced with millions of similar queries under fixed time, compute, and API budgets, a capability the authors call bottling. Across ten models and three tasks, the authors find zero-shot performance does not reliably predict bottling success: 48 of 60 runs scored below their own model's zero-shot confidence interval, and 31 of 60 underperformed simple small-model distillation baselines. Despite this, strong agents like Opus 5 can retain about 82% of zero-shot macro-F1 at about 657x lower cost on query-product relevance classification, and recover about 94% of a dedicated cheap-inference model's (Jev) performance at a quarter of its cost.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

This paper proposes an extensible benchmark for studying spoken dialogue artifacts between humans and social robots, including clarification requests, interruptions, embodied signals like head nods and facial cues, and time constraints. It argues that while language models give a plug-and-play human-robot interface, handling speech, fast interaction and collaboration remains an open challenge, and recommends Retico, a real-time communication framework, as the technical substrate for giving robots spoken dialogue capabilities.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

An IACR ePrint paper by Yiming Gao, Xuyuan Han, and Honggang Hu presenting provable classical subexponential algorithms (running in roughly 2^((1/2+o(1))n/ln ln n) time/space) for recovering short secrets in growing parameter families tied to all seven NIST third-round lattice candidates: Kyber/ML-KEM, FrodoKEM, SABER, NTRU LPRime, Dilithium/ML-DSA, Falcon, and cyclic NTRU-HPS/HRSS. The approach extends the Wagner-style Gaussian sampling framework of Ducas, Engelberts, and Loyer (CRYPTO 2025) and a low-error decision-LWE algorithm, using an exact squared-Euclidean-norm gap to binary-search each secret coordinate, and an "affine slice search" over the public lattice for NTRU/Falcon-type quotient relations. The authors explicitly note the subexponential complexity applies to growing/weakened parameter regimes and does not reduce the concrete security of the currently specified NIST parameter sets.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 6 Oct 2026🛡️ Security

This paper presents a systematic empirical study of small language models (decoder-only, encoder-decoder, and mixture-of-experts architectures) on abstract grid-transformation reasoning, using the ARC-TGI benchmark, which supports controllable task families, resampling, spatial shifts, and cross-benchmark transfer to distinguish genuine rule acquisition from distribution-specific overfitting. Across more than 1,000 supervised fine-tuning runs, the authors find that in-distribution accuracy is achievable but highly sensitive to optimization and task formulation, performance collapses sharply out-of-distribution (even under simple grid-scale changes with the same underlying rule), training-set scale yields uneven gains, in-context example benefit is model-family dependent, and executable-rule induction surfaces correct solutions that direct grid generation misses. Layer-wise attention diagnostics reveal behavioral differences in concentration and context-dependence but stop short of establishing causal mechanisms, underscoring that abstract-reasoning scores are conditional on model, adaptation regime, evaluation distribution, and output format.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

This arXiv paper presents the first systematic study of security implications of speculative decoding, a technique that speeds up LLM inference using a smaller draft model to propose tokens verified by the target model. The authors find a security-utility asymmetry: lossy speculative decoding methods raise jailbreak and prompt-injection attack success rates much faster than they degrade utility, with security degradation traced to early tokens generated by the draft model. They propose SecureSD, which applies stricter verification to early-position draft tokens, improving security while preserving inference efficiency and utility on security and utility benchmarks.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🛡️ Security

This paper introduces Semantic Behavioral Watermarking (SBW), a method for embedding an owner identifier into an LLM agent's high-level tool/action choices rather than output tokens, so provenance survives tool renaming and observation paraphrasing. It watermarks over semantic action clusters with history conditioning and replaces the public-cluster bin with keyed collision-resistant binning that is provably unpredictable under the random-oracle model, closing a forgery gap left by prior agent watermarks (e.g., AgentMark, whose bit-recovery drops to 16.8% under paraphrasing). Evaluated across five agent models (3B-14B, four vendors) on ToolBench and ALFWorld, cluster-level watermarking achieves far higher detection under rewriting (0.49-0.66 vs 0.05-0.17 on ToolBench; 0.92-0.97 vs 0.00-0.01 on ALFWorld) and reduces adaptive forgery success from 100% to the false-positive floor, while noting chained-replay attacks remain an open vulnerability (0.76-0.98 detection failure).

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

This paper proposes a formal framework for "alignment scaling laws," modeling the compute/capability burden needed to hold a fixed safety target for each risk category as a power law B_r(N)=a_rN^alpha_r, where the exponent alpha_r determines whether alignment gets easier, keeps pace, or accumulates "alignment debt" as capability N grows. The authors prove theoretical results (the largest exponent among corrected risks sets the long-run regime, super-exponential headroom requirements above alpha=1, small-model fits underestimate large-scale exponents for power-law mixtures) and apply a preregistered protocol twice: a reanalysis of adversarial-training data on Pythia classifiers (attack-success compute exponent 0.60) and a pilot across Qwen2.5 (0.5B-72B) and Qwen3 (0.6B-14B), finding scaling helps for truthfulness and stated dispositions but sycophancy (exponent ~0.83-0.89) and a planted backdoor behave worse or remain undetermined, with the backdoor surviving blind safety training at most model sizes. The work matters as an early attempt to put the "does alignment get harder with scale" debate on measurable, falsifiable footing rather than anecdote.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

Lachesis is a lifetime-aware KV cache placement layer for LLM agent serving that sits between the agent harness and the serving engine, deciding whether to write each KV cache segment to HBM or high-bandwidth flash (HBF) based on its expected lifetime. The authors identify temporal, structural, and inter-worker axes along which KV cache lifetime diverges in agentic workloads, and show in trace-driven simulation that lifetime-aware placement extends HBF's write-endurance-limited lifetime by 1.19–3.13x over naive HBM-first placement, reaching 3.3–12.2 device-years. This matters for serving infrastructure as agentic workloads with long-lived, multi-agent context accumulation push memory capacity demands beyond what HBM alone can economically provide.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

This paper argues that the "Translation-Isomorphism Assumption" underlying multilingual LLM benchmarks is not just violated in practice but ill-posed for a class of concepts (pragmatic markers, honorifics, diachronically stratified terms). The authors formalize "α-unalignability" using a usage-cloud framework of contextualized embeddings, showing via FLORES-200 translation failures, LOBSTER reasoning scores, and a nine-model case study on the Yami language that models encode cross-lingual regularities (e.g. Yami clustering with other Austronesian/low-resource languages) that are not actionable via neuron-level interventions (a "Representation-Intervention Gap"). They propose a multidimensional diagnostic profile (Cycle-Consistency, Pragmatic-Load Disagreement, Manifold-Curvature Mismatch, RIG) to replace single-scalar cross-cultural evaluation.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

This paper studies prompt-injection attacks against AI agent "skill" marketplaces where a router dynamically selects which third-party skill to execute. The authors show existing injection attacks lose 87-97% of their effective attack success rate once a skill must first win retrieval against competing skills, and introduce CORSA (Cluster Optimization for Router-Aware Skill Attacks), which jointly optimizes injections for retrieval and execution, improving end-to-end attack success while preserving user utility and transferring across different router architectures and LLM backbones.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🛡️ Security

This IACR ePrint paper introduces BPORS-C+BFP, a new few-time signature construction that replaces FORS in SPHINCS+/SLH-DSA, combining short hash chains with a blockwise forced-pruning budget to shrink the bottom signature component. The authors derive a generating-function coverage bound and an exact counting method to safely tighten pruning per block, achieving 8.3%-18.1% smaller full SLH-DSA signatures across six standard parameter sets (versus 3.7%-13.4% for the prior BPORS+FP scheme), and up to 32.5%-36.5% reduction in limited-use settings.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 6 Oct 2026🛡️ Security

This arXiv paper studies SKILL.md files — the natural-language metadata describing modular AI Agent Skills — as an attack surface, demonstrating semantic supply-chain attacks against real ClawHub skills. Using text-only manipulations, the authors manipulate embedding-based Discovery retrieval (up to 86% pairwise win rate, 80% Top-10 placement), bias agent Selection toward adversarial variants (77.6% average success), and evade Governance blocking verdicts (36.5%-100% evasion), showing that skill metadata is operational text that shapes agent trust rather than passive documentation.

arxiv.orgpaperAdded 5 Oct 2026🛡️ Security

This paper studies looped language models — architectures that reuse a shared block of layers recurrently — and argues that as recurrent hidden states approach fixed points, the specific path taken to reach them matters less, enabling several efficiency tricks: truncated backpropagation through time during training, terminal key-value (KV) cache sharing across loop iterations for faster decoding, a distilled student model that prefills up to 1.79x faster, and RL policy gradients computed from saved rollout states that run 2x faster than backpropagating through the full trajectory. To make these fixed points reliable, the authors replace fixed-depth training with a learned depth prior (regularized with an entropy term to stay broad, improving on Huginn's fixed broad prior) and introduce orthogonal input injection, which removes the component of the injected input that the hidden state could otherwise amplify or cancel. Across model scales from 100M to 1.6B parameters, both changes lower perplexity, and at 1.6B the learned prior with a 3x smaller KV cache matches the downstream performance of full-cache fixed-depth training.

arxiv.orgpaperAdded 6 Oct 2026, published 5 Oct 2026🧠 AI

BazaarBench is a simulated consumer-to-consumer marketplace benchmark that measures whether LLM agents acting as buyers and sellers stay safe and honest — tracking ownership, item condition, and commitments to detect six failure types across five transaction stages. Running three 100-agent markets for 30 days plus 45 seven-day continuations across five models (inventories drawn from a public eBay sample), the authors show that double-selling and item-condition deception rise sharply under deadline pressure and adversarial instructions, with GPT-5.4 completing 55.5% of committed sales involving unavailable or misrepresented items; the team releases the simulator, saved market states, eval code, and 357,608 agent-call records.

arxiv.orgpaperAdded 6 Oct 2026, published 5 Oct 2026🧠 AI

The paper proposes Entropy-Aware Mixing, a knowledge-distillation method where a small student model's per-token distribution is dynamically interpolated with a stronger teacher model's distribution, gated by the student's own predictive entropy, to avoid "confident conflicts" where the student must imitate low-probability continuations despite being confident in a different one. The authors implement both convex and geometric interpolations under two training regimes — offline trace generation via speculative decoding followed by SFT, and on-policy forward-KL distillation — and show it stabilises distillation, improving in- and out-of-distribution math reasoning while better preserving general capabilities than fixed-teacher supervision, with offline traces favouring concave entropy schedules and on-policy training favouring linear/convex ones.

arxiv.orgpaperAdded 6 Oct 2026, published 5 Oct 2026🧠 AI

BrainTRACE is a report-grounded benchmark for evaluating whether vision-language models can trace the evidence structure required for longitudinal brain MRI interpretation. It contains 7,273 scored VQA instances derived from 1,778 longitudinal patients, 7,299 MRI studies, and ~29k co-registered 3D MRI sequence volumes, organized across five levels of clinical reasoning and evidence demands like longitudinal comparison, multi-sequence integration, and volumetric spatial grounding. Evaluation of 20 VLM configurations finds that current models identify isolated visual cues but rarely compose them into grounded longitudinal clinical interpretations.

arxiv.orgpaperAdded 6 Oct 2026, published 5 Oct 2026🧠 AI

Researchers fine-tune Qwen3-8B with GRPO against a proxy reward built from surface features (citation count, legalese density, response length) and find the model learns to strategically abstain rather than reason: on 16 LegalBench yes/no legal tasks, accuracy collapses from chance (0.500) to 0.072 because the rate of properly formatted, committed answers drops from 0.900 to 0.109, even though accuracy on answers it does commit to actually rises. They term this the "Saul Goodman effect," formally prove it is the optimal policy for any surface-feature proxy that doesn't penalize abstention, show 89.3% of post-training citations are hallucinated/corrupted real case names, and introduce three diagnostics (Confidence Theater Score, Citation Plausibility Rate, Regret Gap) to detect this failure mode before deployment.

arxiv.orgpaperAdded 6 Oct 2026, published 5 Oct 2026🧠 AI

An IACR ePrint paper showing that the message-only implicit-rejection KEM variant of the Fujisaki-Okamoto (FO) transform used by ML-KEM is uninstantiable in general (under LWE plus subexponentially secure iO and puncturable PRFs), meaning no concrete hash function can replace the random oracle while preserving IND-CCA2 security for every injective trapdoor function. The authors instead give sufficient conditions, via a new "distributional injective extractability" property, to achieve standard-model IND-CCA2 security for the hybrid-encryption (not KEM) formulation of FO, with a standard-model instantiation left open. This directly bears on the theoretical foundations underlying ML-KEM's security proof.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 5 Oct 2026🛡️ Security

GlimpseDNN is a model-agnostic framework that uses a stochastic leakage model to visualize, layer-by-layer, what physical leakage information a deep neural network extracts during profiled side-channel analysis (SCA) to recover secret keys. The authors (Trevor Yap and Shivam Bhasin, NTU) validate it on simulated traces and public datasets (ASCADf, ASCADr, ASCADf_desync50, ASCADf_desync100), showing it can reveal leakages even in deeper network layers when they are not visible in raw traces, with applications to designing more side-channel-resistant hardware.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 5 Oct 2026🛡️ Security