Identifies modular addition representations as topologically equivalent manifolds across different attention architectures. This evidence for universal circuit motifs suggests that mechanistic safety audits and interpretability findings may generalize across model families.

ResponseRank learns preference strength from noisy proxies (e.g., response times) via local ranking, improving reward model sample efficiency and cardinal utility. This enhances RLHF robustness and alignment precision, especially when binary feedback lacks sufficient nuance.

DMSAEs use iterative distillation and gradient-based attribution to isolate a stable core of features across Matryoshka sparsity levels. This improves feature consistency and transferability, addressing SAE instability to enable

Evaluates quantization, pruning, and weight clustering on CNN robustness using CIFAR-10/100-C. Finds that specific technique combinations can improve resilience to natural corruptions,

MSACL integrates exponential stability theory with maximum entropy RL to learn Lyapunov certificates via multi-step Exponential Stability Labels (ESL). This ensures provable stability and rapid convergence, offering a robust foundation for verifiably

Iterative deployment with user-curated fine-tuning functions as an implicit RL outer-loop, driving emergent planning capabilities. This poses safety risks as the underlying reward function is undefined and uncontrolled, potentially leading to misaligned model properties.

Reliable Consensus Sampling (RCS) provides provable security for generative AI by tracing acceptance probabilities to resist adversarial model manipulation. RCS eliminates abstention and uses dynamic feedback to maintain a controllable risk threshold

PrivacyBench evaluates secret preservation in personalized agents via socially grounded multi-turn dialogues. It reveals that RAG architectures create a single point of failure by retrieving sensitive data indiscriminately, leading to leakage in ~2

Triangulation formalizes a causal acceptance rule requiring necessity, sufficiency, and invariance across reference families. It filters spurious circuits via transformation scores over interchange interventions, ensuring mechanistic claims are robust across diverse linguistic...

OMWU provides the first unregularized, last-iterate linear convergence guarantee for Nash Learning from Human Feedback (NLHF). By eliminating regularization bias and the NE uniqueness assumption, it enables more robust alignment with

Employs physics-in-the-loop optimization and CMA-ES to generate projection-based adversarial attacks on monocular depth estimation. By causing objects to "vanish" in depth

Introduces actor-critic methods with sparse robust estimator oracles for high-dimensional offline RL ($N < d$). Provides the first non-vacuous guarantees under single-policy concentrability and adversarial corruption, ensuring robust policy learning despite data poisoning.

Optimizes the Pareto front of accuracy, group, individual, and counterfactual fairness using NSGA-II for insurance pricing. This multi-objective approach addresses the alignment challenge of mutually exclusive fairness constraints in high

LSRE distills VLM-derived semantic safety rules into a recurrent world model’s latent space, enabling 10Hz risk detection for complex social constraints. This provides a low-latency mechanism for monitoring high-level semantic hazards that are difficult to encode explicitly.

MUSIC improves multi-turn reward modeling via unsupervised data augmentation that synthesizes contrastive pairs across multiple conversational steps. This enhances RM robustness in complex dialogues, mitigating reward hacking and ensuring stable alignment during multi-turn RLHF.

HeteroHBA employs saliency-based screening and AdaIN/MMD feature alignment to inject generative backdoors into HGNNs. Its bilevel optimization ensures high success and stealth even against structural defenses, exposing critical security risks in heterogeneous graph learning.

Frontier LLMs exhibit persistent overconfidence that worsens during multi-step agentic tasks, regardless of model size or reasoning capabilities. This miscalibration drives suboptimal decision-making, highlighting a critical

SliceLens leverages LLMs and VLMs to discover fine-grained error slices in multi-instance vision tasks via grounded hypothesis generation. It identifies systematic failure modes in complex scenarios, enabling targeted model repair and more robust safety evaluations.

MultiRisk provides a dynamic programming framework for test-time filtering that enforces multiple prioritized risk constraints. By leveraging data exchangeability, it offers finite-sample guarantees for simultaneous, nearly tight risk control

CPR uses a Structural Causal Model (SCM) to disentangle invariant pathological features from non-causal artifacts. By enforcing physiological priors, it matches certified robustness against smooth adversarial perturbations with single-

HaluNet improves LLM truthfulness via a multi-branch architecture that fuses token-level probabilities, distributional uncertainty, and internal semantic embeddings for one-pass hallucination detection. This multi-granular approach

Localizes intent misalignment in LLM code via white-box probing for calibrated uncertainty on arbitrary spans. Small supervisor models achieve low calibration error, enabling scalable oversight and error detection that generalizes from code to natural

Identifies "Temporal Asymmetry" where past-tense framing bypasses LLM safety filters (15.6% safe) vs. future-tense (57.2%). Using HausaSafety

Semantic Lookout uses VLMs to detect semantic hazards and select cautious fallback maneuvers from candidate-constrained, world-anchored trajectories. This fast-slow pipeline enables safe OOD handling and human handover, outperforming

13) causal (7) control (8) via (4) interventions (14) enables (8) auditing (9) of (3) black-box (10) physics

Establishes a cross-domain benchmark for profit-seeking direct prompt injection in LLM agents. It quantifies how techniques like payload splitting induce unauthorized financial concessions, exposing critical robustness gaps in policy-bound agentic workflows and oversight.

Derives efficient influence functions for reward functionals in MaxEnt IRL, enabling $\sqrt{n}$-consistent, debiased inference with flexible ML. This provides the statistical guarantees necessary for robustly recovering

RSA utilizes nested risk measures for token-level constrained policy optimization, addressing the limitations of risk-neutral alignment. It explicitly suppresses low-probability, high-impact harmful behaviors (tail risks) and prevents excessive model shift during fine-tuning.

Mitigates reward hacking in diffusion RLHF via $D^2$-Align, which applies a directional correction in the reward embedding space to prevent Preference Mode Collapse. This ensures alignment remains robust to

Enables inference-time control of Masked Diffusion Language Models (MDLMs) via contrastive activation steering. Applying layer-wise vectors during iterative denoising provides a training-free mechanism to

GARDO mitigates reward hacking in diffusion RL via gated regularization of high-uncertainty samples and an adaptive reference policy. It prevents mode collapse by amplifying rewards for diverse outputs, ensuring robust alignment even when proxy reward functions are misspecified.

Generates scene-consistent adversarial objects for Monocular Depth Estimation using diffusion models and JVP Guidance. This exposes critical vulnerabilities in autonomous driving perception to physically plausible threats, highlighting risks that traditional patch attacks miss

The Composite Reliability Score (CRS) integrates calibration, robustness, and uncertainty quantification into a unified metric. This framework identifies hidden failure modes missed by isolated evaluations, ensuring LLMs maintain safety under perturbations and

AHA mitigates LALM hallucinations using counterfactual hard negative mining to create preference data. By forcing models to distinguish acoustic evidence from plausible linguistic fabrications, it improves temporal reasoning and grounding, enhancing multimodal reliability.

Systematically evaluates jailbreak attacks against the full inference pipeline, including I/O safety filters. Finds that standalone LLM assessments overestimate risk, as filters catch most attacks. Highlights the efficacy of

RepetitionCurse exposes a DoS vulnerability in MoE models where repetitive token patterns trigger extreme router imbalance. By concentrating tokens into the same top-k experts, it creates bottlenecks in expert-parallel systems

E" is the tool. "Reasoning vectors" is the concept. * Let's try to make it punchier. "RISE applies Sparse Autoencoders to sentence-

Integrates Operations Research into agentic GenAI via flow-based ODEs for auditable, constraint-aware generation and adversarial robustness using uncertainty sets. This framework ensures verifiable feasibility and tail-risk discipline in high-consequence autonomous workflows.

T2VAttack introduces semantic and temporal adversarial objectives to evaluate T2V diffusion robustness. By optimizing prompt perturbations via word replacement and insertion, it reveals that single-word changes significantly degrade video-text alignment

Formalizes the search for less discriminatory algorithms (LDAs) as an optimal stopping problem, providing an adaptive algorithm that yields high-probability upper bounds on potential fairness gains. This enables verifiable certification of "

Introduces a universal targeted latent-space attack on audio encoders that forces specific LLM outputs across diverse speakers without LLM access. This reveals a critical, transferable vulnerability where encoder-level perturbations

DDFT quantifies epistemic robustness by testing factual consistency under semantic compression and adversarial fabrication. It identifies error detection as the primary bottleneck for reliability, showing that scale is orthogonal to a model's ability to verify its own knowledge.

Exploits intermediate attention layer token distributions to generate adversarial examples from internal model hypotheses. This mechanistic approach identifies vulnerabilities in LLM-based evaluators, highlighting risks to the reliability of automated safety

Establishes near-optimal suboptimality bounds for RLHF under differential privacy and adversarial corruption. Proves log loss MLE optimality for private alignment and provides the first guarantees for private, robust online

ZTA-FL secures IIoT via TPM-based attestation and SHAP-weighted aggregation for explainable Byzantine detection. By integrating on-device adversarial training, it maintains 9

Introduces a generalized multi-turn formulation for online behavior elicitation, achieving up to 77% success in finding failure cases where static benchmarks fail. This highlights the necessity of dynamic, multi-turn red teaming for robust safety evaluation of LLMs.

Leverages span-level feedback to create incremental improvement chains for direct alignment. Training on localized edits rather than coarse rankings enables more precise control over model behavior and more efficient learning of nuanced safety and correctness

Demonstrates cross-lingual vulnerability to hidden prompt injections in LLM-based peer review. English, Japanese, and Chinese prompts successfully manipulate scores, while Arabic fails, revealing language-dependent robustness gaps in

ProGuard employs RL and a synonym-bank similarity reward to identify and describe out-of-distribution (OOD) multimodal risks. By leveraging a hierarchical safety taxonomy, it improves OOD detection

Introduces a Cross-Agent Multimodal Provenance-Aware Defense Framework using text/visual sanitizers and a provenance ledger to track trust levels. It prevents prompt injection propagation across multi-agent graphs, securing

Improves hallucination self-detection by mapping LLM outputs to structured knowledge graphs. This entity-relation decomposition enables robust verification of atomic facts, achieving a 16% accuracy boost over Self

PurifyGen achieves training-free T2I safety by projecting risky token embeddings into the null space of toxic concept matrices and the range space of clean concepts. This dual-space transformation neutralizes

Systematizes trustworthy ML by mapping perturbation, domain, and modality shifts against robustness, explainability, and adaptability. This framework addresses safety risks from distribution shifts, ensuring models maintain reliability and alignment in O

Proves that solving assistance and shutdown games requires non-Archimedean utilities and incomplete preferences. These formalisms prevent instrumental convergence toward power-seeking and ensure agents remain corrigible by prioritizing shutdown over task completion.

Benchmarks black-box DoS attacks using EOGen and RL-GOAL to suppress EOS tokens, inducing over-generation up to 2.81x context length. This quantifies availability risks

Leveraging Information Bottleneck principles, DIR maximizes mutual information between RM scores and preferences while minimizing it with biased attributes. This mitigates non-linear biases like length and sycophancy,

HiR addresses sparse rewards in RLHF by relabeling failed attempts as successes based on satisfied constraints. This dual-preference learning framework uses a select-then-rewrite strategy to enable efficient alignment with complex safety constraints using only binary feedback.

C2PO introduces a causal-contrastive preference optimization framework that uses counterfactual signals to isolate and suppress logit-level shortcut features. It mitigates both stereotypical and structural biases by disentangling spurious correlations from valid reasoning paths.

DDSPO optimizes diffusion models via dense, per-timestep score-space supervision, contrasting winning and losing policy trajectories. This stepwise alignment improves robustness and intent adherence, bypassing the noise of sparse rewards and manual preference labeling.

Maps the AI supply chain security landscape by analyzing 312k+ developer discussions via a distilBERT pipeline. It identifies 32 issue types, revealing that model and data-centric vulnerabilities

Integrates SHAP-based attribution with neural inverse kinematics to audit obstacle-avoidance reliability. By correlating feature importance with physical safety margins, it identifies that balanced attribution reduces collision risk, enabling transparent, safety-aligned manipu...

RobustMask achieves certified top-K robustness for neural ranking models via randomized masking and LM-based context prediction. It leverages pairwise comparisons and probabilistic smoothing to secure RAG systems against adversarial document promotion

Replaces perceptual inference with physics-based validation for nuclear control. Scaling induces a 500x variance collapse and autonomous rejection of 70% of training data, mitigating catastrophic tail risks by prioritizing outcome-space guarantees over parameter-space imitation.

Leverages Sparse Autoencoders (SAEs) to construct interpretable low-rank subspaces for safety alignment, mitigating polysemanticity in weight updates. Achieves 99.6% safety with <0.25% parameters, grounding alignment in disentangled features for improved transparency and control.

SB-TRPO achieves hard-constrained RL by biasing trust-region updates using a convex combination of reward and cost natural policy gradients. It guarantees a fixed fraction of cost reduction per step, enabling near

HyFair identifies "discrimination clusters" where protected attribute perturbations yield $k$ distinct outcome groups, exposing systematic biases missed by pairwise checks. It uses SMT/MILP and randomized search to certify

EquaCode bypasses LLM safety filters by encoding malicious intent into mathematical equations solved via code completion. This multi-strategy approach exploits cross-domain reasoning to divert attention from safety constraints, achieving a

Maps 93 ML threats via a multi-agent RAG framework, identifying novel risks like preference-guided jailbreaks and API model stealing. This ontology-driven graph links TTPs to library

TRAP benchmarks LLM web agent robustness against task-redirecting prompt injections via high-fidelity website clones. It reveals systemic vulnerabilities to social engineering, with frontier models failing 25%

InSPO derives a globally optimal policy conditioned on both context and alternative responses, ensuring invariance to arbitrary scalarization and reference choices. This "intrinsic self-reflection" improves alignment robustness by leveraging comparative data during training.

GRPO improves in-distribution performance but degrades cross-dataset transferability by 19% in medical VLMs. This "generalization paradox" shows RL-driven reasoning overfits to benchmark features,

RM accuracy fails to predict behavioral alignment in reward-guided decoding, showing weak correlation (τ=0.08-0.31) with policy discrimination. Pref-LaMP reveals a decoupling between

Rebuts the Biasing Features metric, showing CoT "unfaithfulness" is often lossy compression rather than deception. Causal Mediation Analysis proves non-verbalized hints still caus

APO uses Csiszar alpha-divergence to interpolate between forward and reverse KL in an anchored geometry. A confidence-guarded $\alpha$ schedule enables a stable transition from mode-covering to mode

DECEPTICON benchmarks agent susceptibility to dark patterns, finding SOTA models are manipulated into malicious outcomes in >70% of tasks. Susceptibility scales with model size and reasoning, highlighting a critical, unmitigated vulnerability in agentic instruction-following.

M-ErasureBench exposes that concept erasure fails against non-text modalities like inverted latents. IRECE mitigates these bypass attacks by using cross-attention to localize and perturb target concepts

Identifies spurious correlations by detecting dispersed feature distributions, bypassing the need for attribute labels. A neutralization-alignment pipeline eliminates these shortcuts, improving worst-group accuracy by 20% and enhancing robustness

HalluMat reduces materials science hallucinations by 30% via a multi-stage detector using contradiction graph analysis and multi-source retrieval. It introduces the PHCS metric to quantify reliability through consistency

Selective Adversarial Training (SAT) scales robustness by applying PGD only to critical samples via margin-based or gradient-matching selection. Reducing adversarial overhead by 50% without sacrificing performance addresses the

SC-NLP-LMF operationalizes NIST AI RMF and ISO 42001 via a six-phase NLP lifecycle. It mitigates safety risks through integrated differential privacy, federated learning

BadVSFM introduces a two-stage backdoor attack for VSFMs, steering image encoders and mask decoders to force target masks across prompt types. By decoupling triggered and clean representations, it bypasses

LVLM-VA uses LVLMs as a bidirectional interface to align small vision models with human domain knowledge. By mapping class-level specs to image-level critiques, it mitigates spurious

Optimistic Feasible Search (OFS) mitigates feedback-induced disparities in closed-loop systems. By using confidence bounds for optimistic feasibility, it maintains demographic parity under bandit feedback, preventing the

Bolsters medical MLLM robustness via the training-free IMC framework, using prototype-guided feature calibration for visual artifacts and a multi-agent system for text denoising. This mitigates safety-critical failures caused by real-world clinical input perturbations.

Let's go with a version that emphasizes the "single-index model" and "link-agnostic" nature.* "SPO mitigates reward misspecification by modeling

Benchmarks LLMs on multi-vulnerability detection in long-context code (10k tokens), revealing "count bias" and a 40% F1 drop as density increases. This

Introduces a 50k-pair multimodal benchmark evaluating LVLM copyright compliance. SOTA models fail to respect visual copyright notices, risking infringement. A novel tool-augmented defense framework is proposed to

Reveals that common KL estimators yield biased gradients, causing RLHF instability. Proves that unbiased configurations improve OOD performance and alignment robustness, providing a more reliable mechanism to constrain LLMs to safe reference

Evaluates code injection in multi-agent systems, finding that poisonous few-shot examples can bypass security agents to increase attack success from 0% to 71.95%. This reveals critical robustness

EGA targets the ~20% of high-entropy tokens that act as critical decision forks in VLM generation. This selective attack achieves 35-49% harmful conversion rates and transfers across

Establishes a framework for conceptualizing cross-cultural bias and evaluating societal harms by synthesizing 2025 NLP research. It mandates stakeholder-integrated metrics to mitigate representational misalignment, ensuring

SAE analysis reveals warning-framed data fails because "describing X" and "performing X" share non-orthogonal latent features. This "stealth slip" bypasses linear probes,

CENNET integrates Structural Causal Models (SCMs) with neural networks to provide causal explanations for tabular data. Using an entropy-based index to distinguish causal drivers from pseudo-correlations, it mitigates safety risks arising from reliance on spurious features.

Causal and adversarial analysis reveals COCONUT’s latent tokens are uninterpretable placeholders masking shortcut exploitation. This "pseudo-reasoning" resists steering but fails OOD, posing a transparency risk

Benchmarks Bengali deepfake detection using the BanglaFake dataset, revealing zero-shot failures and the efficacy of fine-tuned ResNet18 (84.37% AUC). This improves robustness against synthetic speech attacks in low-resource languages, addressing a critical gap in AI security.

Implements reasoning-layer governance through a multi-model consensus architecture where a dedicated agent consolidates outputs from heterogeneous LLMs/VLMs. This enforces safety constraints and exposes cross-model disagreement, providing

VenomRACG demonstrates that poisoning 0.05% of an RACG knowledge base can force GPT-4o to generate vulnerable code in >40% of cases. By bypassing latent-

Integrates Sparse Autoencoders (SAEs) and forensic manifold analysis to map latent features to specific deepfake artifacts. Quantifying manifold geometry (curvature, dimensionality) enables mechanistic auditing of synthetic media detectors, improving

Unifies hallucination as inaccurate world modeling relative to a reference source and conflict policy. This distinguishes epistemic failures from planning errors and enables synthetic benchmarks to stress-test model truthfulness via fully specified, controllable

Defines bidirectional alignment as a sociotechnical framework coupling technical value-embedding with human-side interpretability and critique. This mitigates risks to student agency and equity by framing alignment as a dynamic process