Alignment, interpretability, red-teaming, bias and privacy: the research on what these systems do when they misbehave.
arXiv:2608. 18339v1 Announce Type: cross Abstract: Vision-language models (VLMs) have demonstrated remarkable zero-shot capabilities yet remain sensitive to real-world distribution shifts during inference.
FairGlucose is a 300‑patient CGM cohort balanced across 12 demographic strata, providing 132,480 forecasting samples and 3,945 behavioral events. Benchmarking 33 models on 2‑hour glucose forecasting revealed that population‑level validation masks significant subgroup disparities, with error ratios ranging from 0.8 to 1.4 and T1D patients experiencing 6 mg/dL higher error than T2D. The study shows that these gaps persist across all models, align with clinically hard cases, and vary with input‑length sensitivity, underscoring the need for subgroup‑disaggregated reporting in digital health AI.
The paper introduces MIFR, a modality‑invariant and fair representation framework for skin disease classification that jointly processes clinical photographs and dermoscopic images using ViT‑based encoders. It employs a five‑component multi‑objective loss to balance classification accuracy, fairness across skin tones, class alignment, and modality invariance. Experiments on paired and external datasets demonstrate competitive predictive performance and fairness, with t‑SNE visualizations confirming alignment of embeddings from different modalities.
The paper investigates on‑policy self‑distillation (OPSD), where a student model learns from its own outputs using token‑level supervision conditioned on privileged reference information. Experiments with Qwen3 models on science and mathematics datasets show that the correct reference does not consistently improve performance; students can improve without it, and solutions from other problems sometimes outperform the correct reference. The study finds that student predictions align more closely with the base model’s reasoning than with the reference supervision, and that alignment alone does not reliably predict performance gains.
The paper reviews how large language models are applied in mental health, covering areas such as social media analysis, clinical conversational agents, therapy support tools, prompt engineering, and multimodal learning. It synthesizes interdisciplinary studies that use social media posts, electronic medical records, and multimodal inputs to detect depression, assess suicide risk, provide personalized therapy, and generate psychoeducational content. The review also discusses advances in model interpretability, annotation strategies, multimodal fusion techniques, and highlights ethical, sociotechnical, and regulatory challenges while proposing frameworks for safe, equitable, and accountable deployment.
The paper introduces a Tsetlin Machine (TM)-based framework for Non‑Intrusive Load Monitoring (NILM) that can run in real time on resource‑constrained microcontrollers. By reformulating NILM as a classification problem, the authors achieve high accuracy—90 % precision and 96 % recall for two appliances, and 77 % precision and 80 % recall for four appliances on the REDD dataset—while keeping the trained model to only 18 KB of flash memory. On an ESP32, the system delivers inference in 0.43 ms, demonstrating its feasibility for privacy‑preserving edge deployment.
The paper introduces an adaptive jailbreak attack framework that evaluates both cascaded pipelines and end‑to‑end large audio‑language models (LALMs) under a unified setting. It employs a feedback‑guided mutation engine to automatically generate and refine jailbreak candidates across textual prompts and audio perturbations, thereby broadening attack diversity. Experiments on six audio‑based systems show that both paradigms remain highly vulnerable, with the framework achieving higher attack success rates than existing methods.
SuTRA (Structurally-Unified Tokenization with Root Awareness) is a morphology-aware tokenization algorithm designed to address the problem of Morphological Shattering in morphologically rich Indic languages. It preserves the indivisibility of aksharas—complex orthographic syllables—by penalizing merges that cross morphological boundaries, thereby reducing over-fragmentation of words. The authors also release a new morphological segmentation dataset for Hindi, Marathi, and Gujarati, and demonstrate that SuTRA improves morphological alignment by up to 14.7% and semantic recoverability by 34% over BPE, leading to an average machine translation gain of +8.08 chrF2.
The paper titled "Safety Alignment Illusion: The Cross-Lingual Safety Gap in LLMs" highlights that current safety alignment training for large language models is predominantly English-centric, leading to failures in non‑English languages. It introduces INCLUDE, a multilingual benchmark with 2,604 prompts in six languages (English, Hindi, Bengali, Marathi, Tamil, and Hinglish) to measure Indian‑centric socio‑cultural biases. Evaluation of ten open‑ and closed‑source LLMs shows that Bengali models exhibit the highest bias scores among open‑source models, while English shows the lowest bias in open‑source but the highest in closed‑source models.
The paper introduces Jacobian-Guided Anisotropic Noise Reshaping, a method that improves data utility under Local Differential Privacy by selectively reducing noise in task-relevant subspaces of data representations. It uses the Jacobian of a public downstream model to identify critical directions and reshapes isotropic LDP noise into an anisotropic distribution, preserving privacy while enhancing performance. Experiments on CIFAR-10-C show significant accuracy gains, especially for PrivUnit variants at ε=7.5.
The study examines whether large language models (LLMs) discriminate against candidates based on institutional prestige and geographic location. Three factorial experiments (4,320 API calls across four LLMs and five domains) reveal a significant institution‑tier gradient (+0.297 points on a 10‑point scale), a stronger prestige effect than country‑of‑origin effect, and a dominant journal prestige effect (Nature vs. a peripheral journal). The authors also identify a ‘rescue effect’ where publishing in Nature mitigates low institutional prestige, and quantify bias using the Neutrosophic Bias Index, highlighting evaluation inconsistency for low‑prestige profiles.
The paper introduces the Explanation Consistency Score (ECS), a fairness‑aware metric that uses Jensen‑Shannon divergence to measure how similar attribution maps are across demographic subgroups. Applied to diabetic retinopathy screening, ECS is evaluated both overall and within disease severity levels. Results show that although predictive performance varies among ethnic groups, explanation consistency remains high and is not significantly linked to performance disparities, indicating that predictive fairness and explanation consistency assess different aspects of model behavior.
Redakto is a new tool designed to anonymize text before it is processed by large language models (LLMs). It offers state‑of‑the‑art redaction of personally identifiable information (PII) and pseudonymization, accessible via a web interface, REST APIs, and model context protocol hooks. The authors evaluate its performance on legal and medical datasets, showing that anonymized texts retain utility comparable to the originals, enabling LLM tasks without significant loss of effectiveness.
DeepTCM1.0 is a multi‑expert AI agent built on the DeepSeek V3.2 large language model, designed to integrate classical traditional Chinese medicine (TCM) theory with modern life sciences for mechanistic analysis of TCM compound formulas. The framework employs a three‑tier collaborative architecture and a three‑round iterative quality‑control workflow, simulating 11 interdisciplinary intelligent agents. It was validated on the Guizhi Decoction, with performance evaluated through double‑blind five‑dimensional scoring, ICC reliability testing, Mann‑Whitney U tests, and effect size analysis across 100 independent assessments by four large language models.
The paper introduces MEHnet-MG, an equivariant neural network that predicts a one‑electron Hamiltonian from a single inexpensive B3LYP/def2‑SVP calculation and uses it to compute a wide range of molecular properties—energy, optical gap, dipole, quadrupole, polarizability, Mulliken charges, and Mayer bond orders—at coupled‑cluster accuracy for nine main‑group elements, including phosphorus, sulfur, and chlorine. Trained on a new CCSD(T) dataset, the model reduces property errors by factors ranging from 3.8 to 230 compared to various DFT methods while adding only ~25 ms per molecule. Importantly, by deriving properties from a predicted Hamiltonian rather than pooling atomic features, the architecture naturally incorporates correct size‑scaling, enabling accurate extrapolation to large π‑conjugated systems (up to 58 atoms) where traditional pooling‑based models fail.
The paper introduces Interval POMDP Shielding for agents with imperfect perception, aiming to prevent unsafe actions when sensor readings may be misclassified. By estimating perception uncertainty from finite labeled data, the authors construct confidence intervals and model the system as a finite Interval Partially Observable Markov Decision Process. They propose an algorithm that computes a conservative belief set, enabling a runtime shield that guarantees, with high probability, that any action allowed by the shield meets a specified safety lower bound. Experiments on four case studies demonstrate that this shielding approach outperforms state‑of‑the‑art baselines in safety.
The paper "Jailbreaking in the Haystack" introduces NINJA, a jailbreak technique that exploits long-context language models by appending benign, model-generated content to harmful user goals. It demonstrates that the position of harmful goals within the context is crucial for safety, and shows that NINJA significantly boosts attack success rates on models such as LLaMA, Qwen, Mistral, and Gemini. Unlike previous methods, NINJA is low-resource, transferable, less detectable, and compute‑optimal, revealing that carefully crafted benign long contexts can expose fundamental vulnerabilities in modern LMs.
DA‑WAM is a framework that integrates predictive representation learning, action‑conditioned future modeling, and trajectory scoring into a single decision‑making objective for autonomous driving. It uses an online encoder with a stable momentum target to keep future representations aligned with the driving task, generating a distinct future latent for each trajectory candidate. A future‑latent‑conditioned scorer evaluates these latents, with expert‑matched trajectories supervised by observed futures and safety‑critical hard negatives providing additional guidance, achieving state‑of‑the‑art results on NAVSIM‑v1 and NAVSIM‑v2.
The paper extends a dynamical systems approach to classify unsafe outputs from large language models (LLMs) by projecting prompts and responses into high‑dimensional embeddings and fitting separate Koopman-based predictive models for safe and unsafe regimes. A differential residual score compares prediction errors from these models to classify new outputs. Experiments on three safety benchmarks show that including prompt embeddings improves detection of interaction‑dependent violations, especially with causal decoders like Llama‑3, while response‑only violations benefit more from dense semantic embeddings.
Training fast generators on new domains with limited data remains challenging for two reasons. First, adapting a pretrained diffusion or flow model to a new domain leaves its costly multi-step sampling unaddressed, and existing acceleration methods are tied to the source parameterization--$ε$, $x$, $v$, or $u$--leaving heterogeneous pretrained models with no common acceleration target.