A new preprint presents controlled experiments examining how prompt format, instruction count, and context length affect large language model (LLM) instruction adherence and hallucination. The study finds that perfect response rates drop to zero by 80 instructions across all tested models and formats, and recall accuracy remains high up to 64-128k tokens before degrading sharply, with significant format-dependent differences. Notably, the experiments observe no fabrication (hallucinated facts) but a sharp rise in outright refusal to answer as models approach their context limits.
Why it matters: This work provides rare, systematic evidence on prompt design tradeoffs, clarifying practical limits on instruction count and context length for LLM reliability.
A new preprint identifies a systemic security risk in adversarial robustness-optimized machine learning defenses: breaching one defense can expose vulnerabilities across an entire family of related defenses. The authors introduce stricter transfer-only attack protocols and a simple adaptive attack, PGDTransfer, which achieves an average 80.4% transfer attack success rate against purification-based defenses. They also propose Adversarial Sensitivity Maps to visualize shared vulnerabilities and argue that future defenses should prioritize vulnerability diversity and transfer-only isolation.
Why it matters: This work reveals that many current adversarial defenses may share exploitable weaknesses, challenging the reliability of robustness-optimized models and suggesting a need for new security objectives.
Researchers present RF-Agent, a framework that generates a domain-specific reasoning dataset for radio-frequency integrated circuit (RFIC) design using knowledge distilled from seven canonical RF textbooks. The resulting dataset contains over 11,000 samples and includes a dedicated multiple-choice benchmark. Experiments demonstrate that supervised fine-tuning notably enhances RF reasoning performance, particularly for small and medium-sized language models, and that semantic retrieval is the most effective retrieval-augmented generation (RAG) strategy tested.
Why it matters: This work introduces the first large-scale, reusable dataset and benchmark for RF circuit design, addressing a key bottleneck in applying language models to this specialized engineering domain.
Researchers have proposed ChainMark, a watermarking method for text generated by large language models (LLMs) that does not require access to the underlying model. ChainMark uses keyed hashing to partition vocabulary and enforces Markov transitions, enabling detection with closed-form calibration of false positive rates. The approach demonstrates robustness against translation and substitution attacks and outperforms prior methods in empirical tests.
Why it matters: ChainMark provides a practical and theoretically grounded solution for marking synthetic text, addressing regulatory needs for reliable watermarking without requiring model access.
A new study compares the adversarial robustness of two phishing email detection models: TF-IDF + Logistic Regression and fine-tuned DistilBERT. Both models achieved over 98% accuracy on clean, in-distribution data, but their performance dropped sharply to around 64% when tested against adversarially modified phishing emails. Analysis showed that while the models relied on different features, they exhibited similar vulnerabilities and complementary error patterns. The findings demonstrate that high accuracy on clean data does not guarantee robustness to adversarial attacks, highlighting the need for adversarial testing in phishing detection research.
Why it matters: This research reveals that widely used phishing detection models are highly vulnerable to adversarial attacks, emphasizing the importance of evaluating models beyond clean-data accuracy.
Researchers introduce RLAES, a unified large language model framework that jointly optimizes automated essay scoring and feedback generation using reinforcement learning. The system incorporates Rubric-based Feedback Evaluation (RFE), which uses 166 fine-grained binary rubric items and an LLM-as-judge to make feedback quality measurable. On the ASAP benchmark, RLAES achieves the highest scoring performance among LLM-based methods (QWK = 0.803) while maintaining feedback quality comparable to GPT-5.5.
Why it matters: This work demonstrates a significant advance in automated essay scoring and feedback generation by leveraging reinforcement learning and rubric-based evaluation to achieve state-of-the-art performance without sacrificing feedback quality.
Researchers introduce the concept of cross-agent asynchronous campaign attribution for LLM agents, presenting Asynchronous Attribution Fingerprint Vectors (A²FV) as a lightweight method to link attack sessions from the same adversarial campaign, even when agents do not share runtime state. On the new SCD-v1 benchmark, A²FV achieves a pairwise AUC of 0.82, outperforming per-session detectors and LLM judges in linking distributed attacks. The study demonstrates that structural and stylometric residue are key signals for attribution, and that the method remains effective under various evasion strategies.
Why it matters: This work establishes a new evaluation layer for LLM agent security, enabling detection of coordinated attacks that evade traditional per-session defenses.
A new preprint introduces CPInj, a collaborative prompt injection attack that targets Textual Collaborative Prompt Optimization (TCPO), a decentralized method for improving LLM prompts. The attack injects malicious instructions into local prompts, which persist through aggregation and degrade downstream task performance, while evading current defenses. The authors also propose a defense method, APAgg, which partially mitigates the attack, but CPInj remains highly effective, exposing a significant vulnerability in TCPO systems.
Why it matters: This work exposes a critical and previously unexplored vulnerability in decentralized prompt optimization for LLMs, emphasizing the urgent need for more robust defenses against collaborative prompt injection attacks.
A new framework called AMLGuard is introduced to improve anti-money laundering (AML) in decentralized finance (DeFi) by combining static rule-based analysis with retrieval-augmented large language model (LLM) reasoning. AMLGuard infers high-level transaction semantics to track illicit fund flows, including across blockchains, and was evaluated on 82 real-world laundering cases involving over $1 billion in assets. The system demonstrated high precision and recall in reconstructing illicit fund-flow topologies for both single-chain and cross-chain transactions.
Why it matters: This work represents a notable advance in applying LLMs to financial security, offering improved tools for tracking and analyzing complex illicit cryptocurrency flows.
A new method enables frozen language-model agents to self-evolve their dialogue skills by predicting whether a given response will lead to positive or negative user feedback, using only fixed logged data. This 'future-feedback prediction' approach achieves over 75% accuracy on a proprietary sales-assistant dataset and allows for reproducible, offline optimization of conversational skills without requiring live user interactions.
Why it matters: This work introduces a verifiable offline optimization stage for conversational AI, addressing the challenge of evaluating counterfactual responses and potentially enabling more scalable and reliable self-improvement.
Researchers have identified a critical failure mode in long-context large language models (LLMs) called repetitive copying, where models copy input text into their reasoning traces instead of engaging in productive problem-solving. They introduce GEAR, a reward shaping method that encourages grounding in key evidence and penalizes copying from irrelevant context, leading to consistent improvements of up to +4.6 average points over standard reinforcement learning approaches across multiple benchmarks and model scales.
Why it matters: This work highlights and addresses a pervasive limitation in long-context LLMs, demonstrating that improved evidence grounding can significantly enhance reasoning performance and reduce unproductive copying.
A new preprint introduces HALLMARK, a benchmark designed to evaluate large language model (LLM) citation verifiers using 2,526 BibTeX entries and 14 types of citation hallucinations. The study finds that the false-positive rate, rather than recall, is the primary factor limiting the practical deployment of citation verification tools, with most LLMs tending to over-flag citations, especially for papers published after their training cutoff.
Why it matters: This benchmark provides a standardized way to diagnose and improve LLM citation verifiers, addressing the risk of fabricated references in AI-generated academic writing.
A new preprint investigates cross-lingual factual inconsistency in large language models (LLMs), where answers shift depending on the prompt language. The researchers evaluate four inference-time interventions on Gemma 3 12B Instruct, including persona prompting, internal representation manipulation, and weight modification. They find that persona prompting—a simple contextual intervention—most effectively balances efficacy, safety, and generalization across languages, outperforming more invasive methods.
Why it matters: This work highlights a practical approach to improving factual consistency in multilingual LLMs, suggesting that simple prompt-based methods can be more robust and transferable than complex interventions.
A new preprint introduces CryptanalysisBench, a benchmark comprising 191 cryptanalysis tasks across six families of cryptographic primitives. Testing five frontier large language models, the study finds that these models can break 65-86% of Tier 1 (known-break) schemes and also produce novel attacks, including a key-recovery attack on SpoC AEAD and the identification of an error in KINDI's security proof. The benchmark is released to track AI progress in cryptanalysis and to stress-test cryptographic schemes.
Why it matters: This work highlights the rapidly advancing capability of LLMs to perform automated cryptanalysis, raising both opportunities and concerns for digital security.
A new framework reformulates the task of mapping automotive CVEs to the Auto-ISAC Automotive Threat Matrix (ATM) as a selective automation problem. Using hierarchical in-context learning and a calibrated meta-model, the system assigns mappings to AUTO, REVIEW, or HOLD tiers based on confidence. In evaluation, the AUTO tier achieved a precision of 0.878 in high-confidence mode, substantially outperforming a zero-shot GPT-5.2 baseline.
Why it matters: This approach advances automated vulnerability mapping in automotive cybersecurity by enabling selective automation and reducing the risk of misclassification in safety-critical contexts.
A systematic measurement study assesses the effectiveness of current web bot defenses against LLM-based browser agents and commercial captcha-solving services. The study finds that challenge-based defenses like hCaptcha and reCaptcha v2 are broadly ineffective, as they can be bypassed by both commercial solvers and LLM agents with solver modules. Non-interactive defenses such as reCaptcha v3 show stronger resistance, but this is due to checks on execution-environment authenticity rather than agent behavior. The results indicate that the true security boundary for these defenses is at the environment layer.
Why it matters: This work highlights a fundamental shift in web security, showing that as LLM agents become more capable, traditional bot defenses are increasingly ineffective and future protections must focus on environment authenticity.
Researchers model Chain-of-Thought reasoning in language models as a switching dynamical system, revealing that reasoning fine-tuning globally reorganizes latent dynamics rather than merely improving token-level competence. The study finds that the recovered latent policy states show functional specialization aligned with reasoning stages, and causal interventions demonstrate their functional significance. Additionally, SDS-guided pruning of failure-prone reasoning prefixes outperforms self-consistency in 11 of 12 settings, with gains up to 12.5 percentage points.
Why it matters: This work introduces a novel mechanistic framework for analyzing and controlling reasoning in language models, with practical implications for enhancing reasoning performance through process-level interventions.
A new preprint stress-tests leading medical AI models in open-ended clinical conversations with missing information, revealing that the choice of LLM judge significantly alters apparent safety ratings. The study finds only moderate agreement between judges and identifies a same-provider bias, where models appear safer when evaluated by their own provider's judge. LLM judges are also more lenient than human clinicians, indicating that observed safety gaps are due to calibration differences rather than knowledge deficits.
Why it matters: This work highlights that current evaluation practices for medical AI may overstate safety due to evaluator bias, underscoring the need for independent, human-anchored assessments before clinical deployment.
Researchers introduce SciHazard, a benchmark comprising 2400 hazardous and 600 oversafety questions across 12 scientific disciplines, grounded in real-world regulated entities and documented failure scenarios. They propose DeHarm-Score, a decomposed evaluation framework that improves agreement with expert annotations by 90.17% over the strongest baseline. Evaluation of 31 frontier LLMs and deep research agents shows that agents yield a 32.3% higher mean DeHarm-Score, indicating greater safety risks compared to standard models.
Why it matters: SciHazard provides a rigorous, domain-grounded method for evaluating scientific misuse risks in LLMs and agents, revealing that autonomous agents may pose significantly greater hazards than standard models.
AgentDebugX is an open-source framework that structures LLM agent debugging into a closed loop of Detect, Attribute, Recover, and Rerun. Its core component, DeepDebug, achieves 28.8% exact attribution accuracy on the Who and When benchmark and repairs 13 of 73 failed tasks on GAIA in a single rerun, outperforming several baselines. The toolkit is available as a Python library, CLI, web console, and installable agentic skill.
Why it matters: AgentDebugX provides systematic root-cause diagnosis and recovery for LLM agents, addressing a key challenge in improving agent reliability and robustness.