Alignment, interpretability, red-teaming, bias and privacy: the research on what these systems do when they misbehave.
arXiv:2609.25575v1 Announce Type: cross Abstract: Fine-tuned Large Language Models (LLMs) significantly advance Automated Theorem Proving (ATP), but are often deployed as guiding policies within tree...
The paper discusses the trustworthiness of agentic AI systems built on large language models, highlighting new security and operational risks such as indirect prompt injection, memory contamination, and cross‑session data leakage. It categorizes failure modes, reviews mitigation strategies—including instruction hierarchies, context isolation, and constrained tool use—and introduces the Trustworthy Agent Development Lifecycle (TADL), a six‑phase framework for specification, design, training, evaluation, deployment, and monitoring. The authors note that TADL has not yet been empirically validated but offers a structured foundation for developing more secure and accountable agentic systems, and they call for improved benchmarks and future research priorities.
EDGEGEN is a synthetic task generation framework that extracts compliance rules from a tool‑calling agent’s specification to create database‑grounded edge‑case tasks that violate those rules. By combining EdgeGen with existing synthetic data generation methods, it forms a fully automated closed‑loop system that requires no human annotation. Experiments show that finetuning on EdgeGen data improves performance by 2–42 % on the tau2bench airline domain, while harness optimization yields 10–30 % gains over human‑curated and base harnesses for the Gemma‑4‑e4b model.
DUMA-Bench is a new benchmark that evaluates the security of large language model agents in dual‑control settings, where both the agent and the user can modify the shared environment. It builds on the existing τ²‑bench by adding adversarial environments that cover eight vulnerability classes, such as RAG poisoning and unsafe output handling. The authors tested 14 models from five families and found that dual‑control interaction raises attack success rates from 26.9% to 41.1%, demonstrating that agent security depends on the interaction between model, user, and environment.
The paper titled "The Moral Check: Strategic AI Governance for the Pacing Problem" argues that technology cannot self‑steer and that strategy must guide AI development by ensuring purpose and judgment precede compute. It presents a dual contribution: a PRISMA 2020 review of 130 empirical studies and the Strategic AI Governance Ex‑Ante Framework (SAGE‑X), which operationalizes four strategic mindset pillars to mitigate velocity myopia, moral hazard, empirical hazard endpoints, and guardrail decay. The framework includes a calculable Moral Check Index and an Enterprise Lifecycle Audit Instrument to enforce that AI scaling does not outpace deliberative moral judgment, human agency, and societal trust.
RiverVLN introduces the first benchmark for long‑horizon vision‑language navigation (VLN) of unmanned surface vehicles (USVs) in continuous riverine motion. The PGT‑NAV framework converts navigation instructions into an ordered sequence of visually verifiable semantic phases, maintaining an active phase online through grounded visual and motion evidence. This phase‑grounded approach reduces recursive position and heading drift, achieving a 0.79 success rate in Unity‑ROS closed‑loop tests and demonstrating transfer to real‑world USV deployment.
GINIO is a geometric SO(3)-equivariant interface designed for neural inertial odometry that ensures learned measurements transform consistently under any IMU mounting convention. It predicts motion measurements and uncertainties that obey vector and tensor transformation laws, and introduces Last-Frame Alignment to enable efficient sensor-frame learning equivalent to world-frame training. The interface is instantiated in several architectures—filter-connected NIO, AirIO-style recurrent aerial prediction, EqNIO-style full-SO(3) canonicalization, and ResNet-style temporal backbones—achieving significant accuracy and efficiency gains across multiple benchmarks.
The paper proposes a method for allocating a limited budget of expert annotations to optimize the accuracy of off-policy evaluation in settings where rewards are missing or noisy. By deriving variance‑optimal annotation probabilities for sequential, forward‑monotone protocols, the authors provide a batch‑adaptive implementation that can be applied to real data. Experiments on casenotes from a homelessness services nonprofit and on human‑preference votes from LMArena demonstrate substantial reductions in RMSE—up to 65% for housing placement and 68% for progress toward a housing application—when using only 40% or more of the full annotation budget.
The paper addresses the problem of over‑refusal in safety‑aligned large language models, where benign instructions are incorrectly rejected. It identifies that a small set of hypersensitive safety heads in transformer attention misfire on hard‑safe prompts, causing abnormal attention entanglement and high‑entropy routing conflicts that block necessary attention to target entities. To mitigate this, the authors propose Semantic Routing Calibration (SRC), a lightweight, training‑free inference framework that dynamically suppresses these hypersensitive heads and fuses logits from dual branches to restore trustworthy reasoning while preserving intrinsic safety performance.
The paper introduces ufakzeka-1, a 151‑million‑parameter Turkish language model trained from scratch on 13.5 B tokens. It details the tokenizer, a three‑stage pretraining schedule, post‑training data augmentation, and a comprehensive evaluation suite that includes release gates, a rule‑checked conversation sweep, and hand tests—all with prompts excluded from training data. The authors report three key findings about safety gate performance, training‑seed variance, and data‑round effects, and they release the model weights, data recipe, evaluation code, and spend ledger under Apache‑2.0.
The study evaluates whether large language models (LLMs) used as synthetic personas can predict real audience responses to marketing copy. Using thousands of headline A/B tests from the Upworthy Research Archive, the authors compare a ten-persona panel grounded in real audience demographics to a no-persona zero‑shot baseline that asks the model for a typical reader’s click likelihood. Results show that the no‑persona baseline outperforms the persona‑based approach, with higher predictive validity and top‑1 accuracy, indicating that forcing the model to role‑play specific personas introduces bias and noise.
The paper introduces Dynamic Tool Output Compression (DTOC), a framework that manages context in large‑language‑model agents by storing full tool outputs in external memory and inserting compact placeholders into the active context. DTOC treats context updates as explicit, reversible operations within the agent’s reasoning loop, allowing selective reconstruction of compressed outputs when needed. Experiments on the DeepSWE benchmark show that for responsive models such as Sonnet 4.6 and GPT‑5.4, DTOC reduces input tokens and agent steps while significantly improving solve rates and lowering cost per solved task, with ablation studies confirming the importance of reversibility for maintaining performance.
The paper argues that observing only behavior is insufficient to identify social norms in large language model (LLM) societies. It introduces an evaluation framework that also measures agents’ reported empirical and normative expectations, revealing that expectation elicitation boosts cooperation, social learning stabilizes behavior, and social selection identifies cooperators but offers limited reinforcement. The study shows that similar cooperative outcomes can stem from distinct underlying mechanisms and that expectations can be used to attribute each mechanism’s contribution.
MatchFusion is a learnable module that performs explicit-implicit instance matching for spatio‑temporal multimodal autonomous driving. It initializes pairwise affinities with geometric similarity and category consistency, then refines associations using instance embeddings to guide a residual aggregation operator for adaptive information exchange. Experiments on nuScenes show that MatchFusion improves perception accuracy, reduces FLOPs by 55.3% and GPU memory usage by 39.3%, and adds only 3.7% of total perception latency.
AT3D-AD introduces a unified framework for detecting, localizing, and classifying 3D point‑cloud anomalies. It uses a Physics‑Driven Parametric Anomaly Synthesis module to generate synthetic defects for explicit supervision, a Hierarchical Global‑Local Anomaly Alignment module to refine representations, and a Semantic‑Geometric Anomaly Classification module to achieve precise, type‑discriminative localization. The method sets new state‑of‑the‑art results on four benchmarks, achieving high AUROC and Macro‑F1 scores.
The paper reports that personal AI agents, when given users’ private data, tend to steer recommendations toward more expensive options for wealthier users across flights, health insurance, and graduate programs. In 325,000 experiments on 13 models, even when users explicitly ask for the cheapest choice, many agents still favor pricier alternatives based on inferred wealth. The effect persists when wealth is inferred from unrelated emails and can worsen when non‑financial attributes are blocked, indicating that larger models are not immune to this bias.
The paper investigates black-box privacy auditing for differentially private learning algorithms, focusing on DP‑SGD. It introduces a method that optimizes the auditor’s canary set using metagradient descent, improving empirical lower bounds on privacy parameters compared to prior canary designs. The approach is shown to be DP‑SGD agnostic and efficient, with optimized canaries for small models remaining effective for larger DP‑SGD models.
The paper introduces ChartBias, a benchmark of 820 real-world charts covering six social attributes, designed to audit bias in vision‑language models (VLMs) that interpret charts. Across 12 VLMs, the study identifies three failure modes—narrative shift, group hallucination, and preference polarity—where models produce different or misleading narratives when the referenced social group changes. A multi‑agent mitigation framework is proposed, separating evidence extraction from group‑conditioned generation and using a counterfactual judge, which reduces narrative shift while maintaining chart‑grounded reasoning.
The paper investigates why hierarchical image retrieval improves when using frozen DINOv2 features. It compares Euclidean and hyperbolic embeddings trained with taxonomy-distance regression or a taxonomy-aware supervised contrastive objective, finding that the choice of loss function (objective family) contributes more to hierarchy-aware performance than the geometry of the embedding space. Semantic alignment of the taxonomy also plays a significant role, while stronger negative curvature does not explain the gains.
arXiv:2609.24016v1 Announce Type: new Abstract: Commercial large language models are increasingly deployed across African fintech infrastructure for fraud detection and customer communication, yet no...