A new preprint systematically compares tokens, bytes, and pixels as language model encodings, controlling for both linguistic content and downstream model capacity. Using parallel sentences in 13 languages, the study traces rate-utility frontiers and finds that no single encoding is optimal across all tasks or capacity regimes. Pixels best preserve surface form, bytes excel at cross-lingual alignment, and tokens are most effective for topic prediction.
Why it matters: This work provides a principled framework for selecting language encodings based on specific tasks, language diversity, and computational constraints, challenging the default reliance on subword tokens.
Policy & Safety→Official→arXiv Computation and Language
Researchers show that harmful chain-of-thought (CoT) traces from compromised language models can transfer unsafe behavior to other models and be distilled into reusable jailbreak attacks. Transferred traces increase harmful-response rates above 80% on the most vulnerable open-source models, and distilled patterns outperform direct transplantation on strongly aligned models like GPT-4.1 by up to 10 times. Reasoning-enabled models are more than twice as vulnerable, and output safeguards often fail to detect harmful generations.
Why it matters: This work demonstrates that harmful reasoning can transfer between models at both the trace and pattern levels, highlighting the need for defenses that evaluate reasoning context as well as final outputs.
Researchers have introduced a triple-hoisted baby-step giant-step algorithm that further decomposes the baby step to significantly reduce the number of ciphertext rotations required for linear transformations in CKKS homomorphic encryption. They also propose a memory-optimized data path and an FPGA-based hardware accelerator, which together reduce off-chip memory access by 2.9x and computational latency by 5.8x compared to previous designs.
Why it matters: This work represents a notable advance in making privacy-preserving neural network inference more efficient by addressing key computational and memory bottlenecks in homomorphic encryption.
Researchers introduce three client-side detection techniques—label flipping, backdoor trigger injection, and model fingerprinting—to identify targeted overfitting attacks orchestrated by a dishonest aggregator in federated learning. Their methods can detect such attacks within 1-2 training rounds, achieving F1 scores up to 0.7, and allow clients to disengage early. Experiments indicate that detection effectiveness varies with cohort composition and method parameters.
Why it matters: This work offers practical early-warning tools for clients in federated learning, potentially improving the security and trustworthiness of these systems against orchestrator-driven attacks.
A new preprint uses chess as a controlled environment to systematically investigate how pretraining choices affect reinforcement learning (RL) outcomes for reasoning in large language models (LLMs). The study finds that post-RL performance is strongly predicted by pretraining loss, and that RL amplifies correct moves on easy puzzles while surfacing new correct moves on harder ones. These patterns also appear in math-domain text tasks, suggesting generalizable principles for the pretraining-to-RL pipeline.
Why it matters: This work offers a quantitative framework for understanding how pretraining impacts the effectiveness of RL in improving LLM reasoning, informing future model development strategies.
VeriX-Anon is a multi-layered verification framework for outsourced target-driven k-anonymization, combining deterministic, probabilistic, and explainable AI-based mechanisms. In evaluations across seven datasets and four cloud profiles, it detected 25 to 27 out of 28 adversarial deviations with no false alarms, and client-side verification completed in under one second for datasets with one million rows. The framework addresses a gap in verifying that privacy-sensitive data transformations are faithfully executed by cloud providers.
Why it matters: VeriX-Anon offers a practical, mathematically grounded method for data owners to verify the integrity of outsourced privacy-preserving data transformations, addressing a key trust issue in cloud-based data processing.
Researchers introduce memorywire, a JSON-Schema 2020-12 wire format supporting five core memory operations (remember, recall, forget, merge, expire) across four memory types (semantic, episodic, procedural, emotional) for agent-memory frameworks. The open-source reference implementation includes five backend adapters and demonstrates strong performance on a microbenchmark, achieving recall@5=1.000 and low median latencies for ingest and recall. The protocol also features an optional human-in-the-loop governance channel and is designed for compatibility with the Model Context Protocol.
Why it matters: memorywire provides a standardized, vendor-neutral protocol for agent memory operations, facilitating interoperability, migration, and governance across diverse memory frameworks.
A new preprint introduces ADS-C, an antidistillation defense for classification models that provably preserves top-1 accuracy while significantly degrading the performance of student models trained via knowledge distillation. ADS-C adapts gradient-directed perturbation techniques from large language models to classifiers, using a closed-form, per-input margin budget to ensure the teacher model's predictions remain unchanged. The method achieves up to 29.6 percentage point degradation in student accuracy on standard benchmarks, with no loss in teacher accuracy.
Why it matters: ADS-C provides a practical and provable defense against model stealing attacks via knowledge distillation, enabling secure deployment of classifiers without sacrificing their accuracy.
KDFlow is a new knowledge distillation framework for large language models that introduces a decoupled architecture, using SGLang for teacher inference and FSDP2 for student training. By transmitting only hidden states via zero-copy data transfer, KDFlow achieves 1.44x to 6.36x speedup over existing frameworks. The system supports both off-policy and on-policy distillation and offers user-friendly APIs for extensibility.
Why it matters: KDFlow enables significantly faster and more efficient distillation of large language models, reducing engineering overhead and accelerating model development.
A new method called RLearner-LLM with Hybrid-DPO is proposed, combining a DeBERTa-v3 NLI signal and a verifier LLM score to address verbosity bias in standard Direct Preference Optimization (DPO) for language models. Evaluated across five academic domains and three model architectures, the approach achieves up to 6x improvement in NLI entailment over supervised fine-tuning (SFT), with consistent gains in answer coverage and effective scaling to compact models like Gemma 4 E4B-it. The method also demonstrates faster inference and mitigates the alignment tax associated with preference optimization.
Why it matters: This work demonstrates a significant advance in preference optimization for knowledge-intensive language generation by showing that hybrid logic-aware signals can improve logical correctness without sacrificing fluency, highlighting the limitations of current LLM-as-a-judge metrics.
Researchers introduce BusinessCaseBench, a new benchmark that evaluates frontier AI models on analytical knowledge work using business school case studies from 18 disciplines. The study finds that current large language models already achieve high scores against expert rubrics, with notable improvements observed over the past two years. This demonstrates rapid progress in AI's ability to perform complex tasks such as synthesis, judgment under uncertainty, and strategic thinking.
Why it matters: The benchmark highlights that AI is making significant strides toward matching human-level performance in analytical reasoning tasks central to white-collar professional work, with potential implications for business education and early-career roles.
Policy & Safety→Official→arXiv Cryptography and Security
Researchers formalize the concept of payload recoverability in LLM steganography and introduce new low-recoverability schemes using embedding-space mappings. Their experiments show that while these schemes reduce the ease of secret recovery, mechanistic interpretability methods—specifically linear probes on later-layer activations—can still detect steganographic content with up to 33% higher accuracy in fine-tuned models compared to base models.
Why it matters: This work highlights both the evolving threat of covert communication via LLMs and the potential for interpretability-based defenses, signaling a new dynamic in model security.
A new method, Velocity Gated Patch Velocity Profiling (V-PVP), improves detection of AI-generated videos by replacing the standard global readout in video backbone models with a lightweight module that preserves local temporal artifacts. V-PVP achieves a 95.28 AUC on the AIGVDBench benchmark using a frozen backbone and adds only about 0.5 million parameters. The approach is plug-and-play and consistently boosts performance across various video backbones.
Why it matters: This work offers a practical and effective solution to enhance the detection of AI-generated videos, addressing a key challenge in deepfake detection.
Researchers have demonstrated that intentional electromagnetic interference (IEMI) using commonly available radio frequency (RF) equipment can disrupt the operation of facial recognition systems. The study evaluates the robustness of state-of-the-art face recognition methods against such hardware-level attacks and introduces a benchmark dataset of facial images captured with and without RF interference.
Why it matters: This work reveals a previously underexplored vulnerability in biometric systems, showing that facial recognition can be compromised by hardware-based attacks, which has significant implications for the security of systems relying on these technologies.
A new preprint introduces ToxGate, a trust-fusion head that conditions external toxicity signals on encoder representations to enhance abuse detection in multilingual and code-mixed text. Evaluated across three short-text abuse datasets and multiple transformer encoders, ToxGate outperforms plain encoders in 10 of 12 in-domain and 7 of 8 transfer settings, with the most significant improvements in high-risk moderation slices such as explicit slurs and violent threats. The study demonstrates that treating external toxicity tools as conditional evidence, rather than fixed features, leads to more reliable moderation.
Why it matters: This work provides a practical advance for content moderation by improving the reliability of abuse detection in challenging multilingual and code-mixed scenarios.
Researchers introduce Looped Latent Attention (LLA), a post-training cache codec that compresses the key/value (KV) cache in looped (weight-tied) transformers by leveraging low-rank structure across recurrence steps. LLA achieves up to 21.3x compression on an H200 GPU, increasing batch capacity from 32 to 768 sequences at 4k context length, and improves MATH-500 accuracy from 0.43 to 0.66 at 4x compression. The method outperforms other cache reduction techniques and remains near-lossless up to 32x compression in decoder-independent evaluation.
Why it matters: This work enables much larger batch sizes and longer rollouts for reasoning models by demonstrating that the recurrent KV cache in looped transformers can be aggressively compressed without loss.
A new method, Object-Part Hierarchical Reflective Grounding (OP-HRG), is introduced to address the challenge of part-level visual grounding in multimodal large language models. OP-HRG employs a coarse-to-fine reasoning strategy, first localizing the parent object and then the specific part, with a reflective self-check mechanism. Trained with a part-aware reinforcement learning framework, the approach achieves state-of-the-art results on several part grounding benchmarks, outperforming larger existing models.
Why it matters: This work advances fine-grained visual understanding in multimodal models, enabling more accurate part-level grounding for applications such as robotics and image editing.
Researchers introduce Publicly-Verifiable Certificates of Statistical Validity (pvCSVs), a new framework for non-interactive, distributionally-robust certification of learning algorithm results. pvCSVs allow any user to efficiently verify the validity of a published hypothesis against their own data distribution, with sample complexity that scales logarithmically in the number of adaptive queries. The work provides constructions for adaptive Statistical Query algorithms and analyzes both the strengths and limitations of this approach.
Why it matters: This work represents a meaningful advance in verifiable machine learning by enabling efficient, public, and non-interactive verification of statistical learning outcomes.
Policy & Safety→Official→arXiv Cryptography and Security
A new benchmark, AgentRedBench, systematically evaluates indirect prompt injection threats in LLM agents using 215 scenarios across 24 enterprise SaaS integrations. The authors also introduce AgentRedGuard, a defense that reduces attack success rates by 75-77 percentage points with near-zero false positives, outperforming existing open-source baselines. The benchmark and defense are openly released, with evaluation designed to prevent contamination of training data and preserve result validity.
Why it matters: This work provides the first large-scale, dynamic benchmark and an effective defense for a critical security vulnerability in LLM agents interacting with third-party services, advancing both measurement and mitigation of indirect prompt injection threats.
Researchers introduce Loopie, a looped Transformer architecture that outperforms vanilla Transformer baselines when trained with the same compute budget. The Loopie series includes 20B-parameter (2B active) and 6B-parameter (0.6B active) Mixture-of-Experts models. Extensive ablation studies show Loopie achieves superior performance, including gold-medal results at the 2025 IMO and IPhO benchmarks without external tools.
Why it matters: Loopie demonstrates that looped Transformer architectures can surpass traditional Transformers under equal compute constraints, suggesting a new direction for efficient model scaling.