The paper investigates how the choice of feature space affects the effectiveness of label‑only backdoor detection. By keeping the test, labels, and metric constant while swapping feature spaces, the authors show that defenses can perform very differently—e.g., a nearest‑neighbor check yields AUROC 0.546 on poisoned features but 0.995 on frozen DINOv2 features. They also demonstrate that higher detection scores do not necessarily translate to safer models and that static prototype‑based audits can be bypassed by adaptive attackers.
By Arnab Dey, Mohammad Mahfuzul Islam
arXiv:2607. 06596v1 Announce Type: cross Abstract: Trusted monitoring is a central defense in AI control: a cheaper trusted model scores an untrusted model's actions for sabotage, and the most suspicious are audited or deferred.
By Lucas Pinto
arXiv:2607. 04510v1 Announce Type: cross Abstract: Emergent misalignment (EM) -- the broad misbehaviour a language model acquires after fine-tuning on narrow harmful data -- is mediated in Qwen2.
By Lyndon Drake (University of Oxford), Zandi Eberstadt (University of Oxford)
arXiv:2608. 15286v1 Announce Type: cross Abstract: We introduce AgentRelBench, an environment-agnostic reliability instrument that computes ground-truth, severity-priced damage from database state diffs across repeated runs, with no LLM in the measurement path, demonstrated on EnterpriseOps-Gym.
By Shiven Khurdi
arXiv:2610.33849v1 Announce Type: cross
Abstract: Query-time filters that screen each retrieved document before it reaches the generator are the dominant published defense against retrieval-augmented...
By Pushkal Kumar, Arvin Sahaym
arXiv:2606. 02822v1 Announce Type: cross Abstract: Production LLM applications stack several defense families -- refusal-phrase filters, token-budget controls, model allowlists, rate limits, tool-registry authentication -- yet existing breach-and-attack-simulation (BAS) benchmarks report a single aggregate coverage number, hiding which family closes which threat.
By Alexandre Cristov\~ao Maiorano
arXiv:2608. 16190v1 Announce Type: cross Abstract: Trusted monitoring has a cheap, trusted model score a stronger untrusted model's actions, and a diverse ensemble of them beats a single stronger monitor at matched cost.
By Anik Jha
arXiv:2608. 11295v1 Announce Type: cross Abstract: Open-weight LLM agents are vulnerable to backdoors installed during fine-tuning, which may be undetectable if the trigger conditions are never met during testing.
By Gabriel Huang, Abhay Puri, L\'eo Boisvert, Alexandre Drouin, Perouz Taslakian, Spandana Gella, Christopher Pal
arXiv:2606. 15474v1 Announce Type: new Abstract: Continuous evaluation of LLM products relies on a strong LLM judge treated as ground truth: a cheap monitor scores every interaction and a team is paged when the score drifts down.
By Yitao Li
The paper reports that agent evaluations often show a tool‑call rate of zero even when the model emits valid calls, because the interface censors the trajectory before downstream components see it. Experiments on BFCL v4 and tau‑bench demonstrate that swapping the serving adapter can change the observed call rate from 0.00 to 0.96/0.19 or from 0 to 636 calls, indicating that the interface—not the model—causes the discrepancy. A 98‑line preflight check is released to detect such silent failures, highlighting that tool‑call rates depend on the model‑interface stack rather than the model alone.
By Wenbo Wang
The study evaluates how runtime gates for agent tool calls stack, assuming their errors multiply. Using 1,119 labeled agent actions from three corpora, the authors compare a deterministic rule layer with four LLM judges, measuring the effective number of multiplication-equivalent layers (n_mult). Results show that two judges compose to about 1.2–1.4 layers, while a rule layer plus one judge composes to roughly 1.86–2.09 layers, with variations depending on miss definitions and corpora.
By Chenglin Yang
arXiv:2608.00745v3 Announce Type: replace
Abstract: The literature on self-adapting malware is open-loop: adaptation is evaluated against static detectors in simulators, with fitness computed by expe...
By Zihan Luo