ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Kling”

29 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 7AI industry 1Exploit / PoC 1Phishing & fraud 1
SeverityAllcritical 3high 4medium 2low 0info 1

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Expert-Space Exploration in MoE Reinforcement Learning

ESRL explores MoE expert-routing space during RL, lifting Qwen3-30B-A3B Pass@1 by 3.2 points over GRPO at no extra cost.

ESRL (Expert-Space Exploration Reinforcement Learning) is an architecture-aware framework that treats expert routing in Mixture-of-Experts models as an additional source of rollout diversity. It preserves high-confidence experts as anchors, restricts stochastic routing to a plausible candidate pool, adapts perturbation strength to router entropy, and replays recorded expert paths during policy optimization. ESRL achieves the best performance across top-K, top-1, and shared-expert routing backbones on mathematics, science, and code tasks; on Qwen3-30B-A3B it improves average Pass@1 and Pass@8 over GRPO by 3.2 and 4.5 percentage points respectively, without additional sampling or compute.

arXiv cs.AI / cs.LG / cs.CL · 5d agoAI research 2 sources

KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions

Elastic Security Labs details KREMLIN, a Brazilian banking malware that implants malicious Chrome and Edge extensions by forging Chromium integrity values to steal banking sessions.

Elastic Security Labs tracks the KREMLIN banking malware operation as REF9334, active since at least May 2025 across seven campaigns primarily targeting 12 Brazilian banks. The malware is installed by a victim-run JavaScript loader, achieves scheduled-task persistence, and side-loads a malicious DLL via SentinelOne's SentinelMemoryScanner.exe. It modifies Chrome and Edge Secure Preferences files, enables developer mode, and regenerates Chromium MAC values to silently install extensions, while extracting browser encryption material including the newer App-Bound OSCrypt key. An Ethereum smart contract serves as a dead-drop resolver for C2 config; Elastic disrupted over 1,500 infections via a canary domain.

GBHackers · 12h agoMalware in the wild 2 sources

Adobe is trying to make its AI generators idiot-proof in Premiere

Adobe adds in-timeline generative media to Premiere, letting editors generate video and audio clips using Firefly, Veo, Runway, Luma, and Kling models.

Adobe's new Generative Media tool lets Premiere editors highlight empty gaps in the timeline and generate context-aware, editable video, sound effects, music, and soundscapes without leaving the project. Editors can choose among underlying models including Adobe Firefly, Google Veo, Runway, Luma, and Kling. Beta AI audio tools can separate overlapping speakers and duck music under speech, and an AI Assistant is coming to After Effects for plain-language project commands.

The Verge · AI · 8d agoAI industry

Rare Not Random Using Token Efficiency for Secrets Scanning

Researcher proposes token efficiency (string length divided by BPE token count) as a better post-regex filter than entropy for secrets scanning, validated on CredData.

The post explores whether Byte-Pair Encoding tokenization can replace Shannon entropy as the primary filter for candidate secrets captured by regex in tools like Gitleaks. It defines 'token efficiency' as string length divided by token count under the cl100k_base tokenizer; secret-like strings such as GitHub tokens tokenize into many small tokens and score low, while natural text scores high. Evaluating labeled secrets from the CredData dataset shows a usable separation, with roughly 2.5 suggested as a minimum cutoff versus Gitleaks' 3.5 entropy threshold. The technique is positioned as a post-regex filtering step rather than a standalone detector.

Lobsters · security · 4d agoResearch

The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

Elastic details KREMLIN, a Brazilian banking malware whose malicious Chrome/Edge extension forges Chromium integrity checks to steal sessions.

Elastic Security Labs tracked operation REF9334 and its KREMLIN toolkit, a Brazilian banking malware campaign impersonating twelve banks across seven campaigns since May 2025. The infection chain uses multi-stage obfuscated JavaScript loaders with sandbox checks (file and process counting), scheduled-task persistence, and an Ethereum smart contract acting as a dead-drop resolver for C2 and payload URLs, abusing Archive.org for hosting. The malicious browser extension bypasses Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs and App-Bound encrypted hashes. Threat Command disrupted over 1,500 infections by registering the kill-switch canary domain.

Elastic Security Labs · 2d agoMalware in the wild

K-Bench: a clinically calibrated benchmark for evaluating large language models in high-risk mental health conversations

Clinician-calibrated K-Bench evaluates 125 LLM configurations on 200 high-risk mental health vignettes, exposing wide variation in suicide and violence risk handling.

K-Bench is a clinician-calibrated, protected benchmark evaluating 125 model configurations from 33 base models across 14 providers on 200 multi-turn vignettes covering suicide, self-harm, domestic violence, substance misuse and no-risk presentations. A frozen GPT-4o judge achieved 94.2% exact agreement with clinician consensus across 6,751 eligible comparisons from 151 clinician-rated transcripts. Leading models combined supportive conversation with combined-risk scores above 95, while risk exploration varied substantially among weaker configurations; therapeutic prompting helped weaker models and elevated reasoning produced no average improvement. A continuously updated public leaderboard is hosted at k-bench.ai with protected test materials.

arXiv cs.AI / cs.LG / cs.CL · 2d agoAI safety & security

Kraken: LLM-based Speech-to-Speech Translation via Low-bitrate VQ and Dual-path Source Conditioning

Kraken speech-to-speech translation model builds on Qwen3-8B with low-bitrate vector quantization and source-conditioned vocoding.

Kraken augments a pre-trained Qwen3-8B LLM with speech feature inputs and low-bitrate single-layer vector-quantized tokens trained to reconstruct SSL features. A separate token-to-waveform decoder, Autowave-X, is conditioned on source speech to improve non-linguistic transfer. Training used 150k hours of multilingual and multitask speech data. The model reportedly beats SeamlessM4T-Large v2 and Qwen2.5-Omni in translation quality and speaker/prosody transfer.

arXiv cs.AI / cs.LG / cs.CL · 5d agoAI research1

Knowing What Not to Answer: Selective Non-Compliance in Vision-Language Models

Researchers introduce KoNA, a benchmark exposing vision-language models' failures at selective non-compliance, plus fine-tuning that improves refusal and abstention accuracy.

KoNA is a benchmark for evaluating selective non-compliance in vision-language models across five categories: False Premise, Visual Inaccessibility, Universal Unknown, Task Feasibility and Safety. It tests both query-level and component-level non-compliance using paired single and compound queries, and evaluations across diverse VLMs show models often fail to refuse, correct or abstain appropriately, with failures worsening on compound queries. Fine-tuning VLMs on KoNA examples substantially improves non-compliance accuracy while largely maintaining performance on fully answerable tasks.

Hugging Face daily papers · 12d agoAI research1

KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension

Elastic tracks KREMLIN banking malware that used fake Brazilian bank JavaScript lures to deploy malicious Chrome and Edge extensions on 1,515 systems.

Elastic researchers tracked the KREMLIN banking malware operation across seven campaigns over 15 months, infecting 1,515 systems, 98.75% of them in Brazil. Portuguese-language lures posing as bank records and invoices deploy a hostile 'AVSync' extension into Chrome and Edge profiles that harvests passwords, session cookies, keystrokes and screenshots. Loaders check for sandboxes, create scheduled tasks and fetch fresh infrastructure from an Ethereum smart contract; a network canary takeover temporarily disrupted infections.

Cyber Security News · 9h agoMalware in the wild

Competence-Gated Pooling of Language Models and Priors for Event Forecasting

Paper proposes a competence gate pooling language model forecasts with external priors, improving Brier score from 0.0771 to 0.0732 across 2,357 binary questions.

The paper defines a language model's relative competence as its marginal value beyond an available external forecast, and derives conditions under Brier loss where model disagreement improves that forecast. A competence gate estimates domain-level source weights from resolved outcomes, shrinks uncertain estimates toward a global weight, and recalibrates the pooled forecast. Across 2,357 resolved binary questions and five language models, it improves the external baseline from 0.0771 to 0.0732 Brier and beats global forecast combinations, though it defers to the market on ForecastBench. Across four Qwen models, verbal confidence failed to identify when the model outperformed the external forecast, while outcome-estimated competence supported better abstention.

Hugging Face daily papers · 6d agoAI research

Subgroup Packing for Batched PASTA Transciphering

Interleaved subgroup packing cuts PASTA homomorphic transciphering server cost by a median 1.60x at the expense of remaining noise capacity.

The paper studies how record word layout affects the cost of PASTA transciphering, where a server converts symmetrically encrypted records into homomorphic ciphertexts. A subgroup layout interleaves records so cyclic shifts preserve positions, reducing required displacements from 255 to 128 versus contiguous packing. In HElib across twelve paired corpora under six homomorphic keys, the median direct-to-subgroup server cost ratio is 1.60 including fresh generation, conversion, and two queries, but with less remaining noise capacity.

arXiv cs.CR · 5d agoResearch

MetroLLM-Bench: Evaluating Language Models as Transit Kiosk Runtimes

MetroLLM-Bench is a 955-case benchmark testing language models as transit kiosk tool-calling runtimes across six real metro systems.

The benchmark covers 37-414-station metro systems and eleven task categories including routing, fare calculation, disruptions, accessibility, and adversarial input, with 14 deterministic and 8 semantic scoring components. Of 26 models from six vendors, a PEFT-tuned 4B Qwen 3.5 student scored 91.3 on Tier 1, exceeding GPT-5.6 (90.6/90.0), while Muse Glimmer 30B led the composite ranking. A deterministic rule-based baseline reached 84.6, and PEFT gains over base models shrank from +7.03 points at 2B to -0.91 at 27B.

Hugging Face daily papers · 7d agoAI research

Building Multilingual Bridges: Data Mixing as the Pillar of Generalization for In-Language Reasoning

Tiny Aya L2-Thinker, a 3.35B model, achieves over 93 percent in-language reasoning across 60 languages via optimized multilingual data mixing; weights released.

The paper studies L2 reasoning, the ability to reason consistently in the language of the user's prompt, approached through SFT data composition and scheduling. Tiny Aya L2-Thinker (3.35B) achieves an in-language reasoning rate above 93 percent across 60 languages on six benchmarks spanning math, commonsense, instruction following, open-ended generation, and cultural reasoning. Findings show generalization to held-out languages comes from broader language coverage, multilingual non-reasoning data, and a strong English reasoning backbone, suggesting reasoning is language-agnostic and transferable without per-language supervision. Model weights and multilingual reasoning data are publicly released.

arXiv cs.AI / cs.LG / cs.CL · 7d agoAI research1

Building Multilingual Bridges: Data Mixing as the Pillar of Generalization for In-Language Reasoning

Researchers train Tiny Aya L2-Thinker, a 3.35B model achieving over 93% in-language reasoning across 60 languages via multilingual data mixing.

The paper addresses L2 reasoning, where models reason consistently in the language of the user's prompt rather than defaulting to English. Through data-centric SFT optimization, the 3.35B Tiny Aya L2-Thinker reaches above 93% L2 reasoning rate across 60 languages on 6 benchmarks covering math, commonsense, instruction following, open-ended generation, and cultural reasoning. The authors find that generalization to held-out languages relies on broad language coverage, multilingual non-reasoning data, and a strong English reasoning backbone, without needing reasoning supervision in every target language. Model weights and multilingual reasoning data are released.

Hugging Face daily papers · 7d agoAI research1

Right Tool, Right Job: Native-Language Evaluation, Tokenizer Sensitivity, and Methodological Findings from a French-Only BabyLM

French BabyLM entry METRON-FR (125M GPT-2, 92.47M words) shows tokenizer artifacts dominate child-scale zero-shot evaluation; proposes standard diagnostics.

METRON-FR is a 125M-parameter GPT-2 pretrained on 92.47M French words, submitted to the BabyLM 2026 Strict track, scoring 85.97% on the native Quebec-French QFrBLiMP benchmark and 62.80% on the BabyLM-weighted leaderboard. A cross-lingual GLUE protocol combining French task-data translation with rank-16 LoRA shows relational tasks gain while world-knowledge tasks regress. Bilingual Lexicon Induction reaches p@1 of 68.84%, 18x above chance, and ablations show single-token zero-shot scoring is dominated by tokenizer and template artifacts at child scale.

arXiv cs.AI / cs.LG / cs.CL · 1d agoAI research

Augustinian BabyLM: What Ostensive Definition Can and Cannot Teach a Small Language Model

Study shows visually grounded token embeddings in a small masked LM persist through training and improve object-property knowledge, but escape standard BabyLM benchmarks.

The paper implements ostensive definition for a small DeBERTa masked language model trained on 10M words, seeding visually grounded tokens with embeddings derived from labeled image regions before training. Visual initialization leaves a persistent, seed-replicated advantage on object-property knowledge (COMPS) and a corpus-tailored Visual-Property Swap benchmark covering color, material, size, and shape, but has no effect on most BabyLM grammar benchmarks. Synthetic grounding of previously unseeded words causally transfers the advantage to exactly those words.

arXiv cs.AI / cs.LG / cs.CL · 6d agoAI research

Once popular for attacking AI, ASCII smuggling is embraced by spammers

Spammers adopt ASCII smuggling—invisible Unicode tag characters—to evade email filters, with Microsoft Defender detections spiking to 2.5 million per day.

ASCII smuggling hides text in Unicode tag characters (e.g., U+E0041 for "A") that are invisible to humans but readable by LLMs and text processors. The technique gained attention as a stealthy prompt-injection vector and is now used by spammers to obfuscate keywords from email detectors. Microsoft reported Defender for Office smuggling detections jumped from roughly 21,000 per day to over 1.3 million in early February, reaching 2.5 million within four days, before falling sharply in mid-May.

Ars Technica · Security · 12d agoPhishing & fraud

MInTRL: Off-policy Intervention can boost On-policy RL

MInTRL injects sparse judge corrections into on-policy RL rollouts, expanding exploration beyond on-policy sampling while preserving learnability on math and code benchmarks.

Minimal Intervention Reinforcement Learning periodically has a judge-intervention policy replace erroneous suffixes of the current policy's output with short corrections, then returns control, keeping trajectories largely on-policy. Training uses a sequence-level advantage-regression objective that removes the need for importance sampling. Across math and code benchmarks it consistently beats standard on-policy and off-policy baselines, remains effective with self-intervention, and performs best at moderate intervention intensity.

Hugging Face daily papers · 5d agoAI research

MCRL2: Multi-resource Cross-attention-based Representation Learning-augmented Reinforcement Learning for Cloud Microservice Scheduling

MCRL2 augments reinforcement learning with multi-resource cross-attention representations to improve cloud microservice scheduling and load balancing.

MCRL2 combines a multi-resource cross-attention representation learning module (MCRL) with an actor-critic architecture and maximum entropy objective for microservice scheduling. The approach captures interdependencies among nodes, resources, and microservices in data centers. Experiments on real production cluster traces show improvements in load balancing, scheduling success rate, and average completion time versus baselines.

arXiv cs.AI / cs.LG / cs.CL · 5d agoAI research1

Technical Manual for a Toolkit for Measuring Contextual Individuation in Transformer Language Models

An open methodology toolkit measures whether transformer language models contextualize fixed word forms across domains using bridge forms and layer-wise silhouette analysis.

The manual documents an open toolkit built around 'bridge forms' - identical written words recurring across two or more subject domains with a different sense in each - to test whether transformer language models individuate word occurrences by context beyond the embedding layer. It covers declarative specification of bridge forms, Wikipedia corpus acquisition, occurrence localization, layer-wise representation extraction, domain-pairwise silhouette measurement, and visualization, justifying each choice against failure modes such as sense contamination and subword-tokenization misalignment. It is a methodological and implementation reference and reports no empirical results.

arXiv cs.AI / cs.LG / cs.CL · 12d agoAI research

From Parameters to Answers: How LLMs Retrieve and Use Their Internal Knowledge

Interpretability study traces how Qwen, Llama, and Gemma route query information and internal knowledge across layers when answering questions.

Researchers used layerwise interventions on hidden states to separate query-routing signals from target knowledge in language models, testing Qwen, Llama, and Gemma on country-continent questions with varied answer types. A pair-conditioned request direction strengthens before interventions alter downstream knowledge, opening a causal window while answer-supporting content is still forming. Trajectories differ by model: Gemma shows a partially overlapping mid-layer routing profile, while Llama has no sustained routing-effect window under the same gates.

arXiv cs.AI / cs.LG / cs.CL · 6d agoAI research1

Discrete Beckmann Transport Models for One-Step Language Modeling and Reasoning

DBTM achieves one-step text generation via a time-independent transport map trained directly from data, removing pretrained teacher distillation.

Discrete Beckmann Transport Models (DBTM) build a time-independent flow whose autonomous transport map provably carries any point in ambient space to a fixed point on simplex vertices in a single step. The fixed-point property is characterized by a conservation equation whose residual can be minimized directly from data, eliminating the need for a teacher flow, distillation, and time conditioning. A partial-context interpolant extension turns additional function evaluations into refinement steps rather than ODE integration steps. On language modeling and reasoning tasks, DBTM's one- and few-step generation improves quality and accuracy over discrete diffusion and continuous flow baselines.

arXiv cs.AI / cs.LG / cs.CL · 2d agoAI research1

A Princeton Researcher Proposes Recurrent Looped Transformer (RLT) that Carries Decoder State across Every Token, Fixing 96 Blocks per Token with Unbounded Temporal Depth

Princeton researcher Yifan Zhang proposes Recurrent Looped Transformer, carrying full decoder state across every token for unbounded temporal depth.

Yifan Zhang's technical report defines the Recurrent Looped Transformer (RLT), pairing a causal encoder with a recurrent decoder whose final output and layerwise sliding-window attention cache carry into every subsequent token with no prompt-response boundary reset. The reference configuration ties 48 encoder and 48 decoder layers, executing 96 logical blocks per token while the state path grows to 48t blocks after t tokens at fixed per-token compute. The report details RL replay contracts that rebuild all states under current parameters and exact prefix snapshots for multi-turn serving, but explicitly reports no measured efficiency, reasoning quality, or scaling results.

MarkTechPost · 3d agoAI research1

Researchers built a $7 gadget for anyone paranoid about hidden cameras in hotel rooms

KAIST-led researchers built SweepLED, a sub-$7 smartphone LED clip using AI to detect hidden cameras with 93.9-95.1% accuracy.

SweepLED, built by KAIST with the National University of Singapore and Singapore Management University, clips 15 LEDs to a smartphone camera and sweeps multi-angle light while the phone films reflections. A spatio-temporal AI model compares LED-on and LED-off frames to distinguish lens reflections from glossy surfaces across three viewpoints. Testing on 30 objects, 12 with hidden cameras, achieved 93.9% accuracy handheld and 95.1% static. Core components cost under $7, targeting privacy checks in hotels and short-term rentals.

Help Net Security · 13d agoResearch1

Grouped Value Attention: Efficient KV Caching via On-Demand Key Reconstruction

Grouped Value Attention stores grouped values and reconstructs content keys via a learned linear map, cutting KV-cache size about 45-47% versus GQA.

GVA stores only grouped values and reconstructs content keys with a learned linear map absorbed into the query at decode time, while a small shared decoupled RoPE channel preserves positional information via a separately cached positional key. At 350M parameters trained on 30B FineWeb-Edu tokens, the 16-dimensional positional variant scores 44.18 average accuracy across five tasks versus 44.36 for GQA and 43.88 for MLA. Custom decoding kernels are in development with an open-source release planned.

Hugging Face daily papers · 8d agoAI research

Kimi K3 (2.8T) at 1 token/s on a MacBook Pro, streamed from four SSDs

A GitHub project streams Moonshot's 2.8T-parameter Kimi K3 from four SSDs to run at 1 token/s on a MacBook Pro.

A GitHub repository (argonautlabsai/deltafin) demonstrates running Moonshot AI's Kimi K3, a 2.8-trillion-parameter model, on a MacBook Pro by streaming its weights from four SSDs at 1 token per second. The project drew 55 points and 22 comments on Hacker News, highlighting consumer-hardware inference for extremely large models.

Hacker News · AI · 7d agoAI tools & infraHN 55↑ · 22 comments

KlueセキュリティインシデントとRecorded Futureへの影響

Recorded Future disclosed a Klue incident that exposed some Salesforce business data, including contacts and emails, via a compromised OAuth token.

Recorded Future disclosed that unauthorized activity in marketing vendor Klue's integration layer, starting June 12, 2026 and contained the same day, affected some of its Salesforce data through a compromised OAuth token in the Salesforce-Klue integration. Impacted fields are limited to business data such as customer contact names, email addresses, and possibly business contract information. No evidence indicates Recorded Future's core platform, Intelligence Graph, internal databases, or customer platform data were accessed. The company revoked all relevant OAuth tokens, coordinated with Salesforce and law enforcement, and began reviewing all third-party Salesforce integrations.

Recorded Future · Aug 12, 2026Data breach

Kimwolf v7: An Evolution of the Kimwolf Botnet

Unit 42 details Kimwolf v7 botnet evolution hitting Android IoT devices with HTTP/2 DDoS fingerprinting and ENS-based C2.

Palo Alto Unit 42 analyzes Kimwolf v7, the latest evolution of the Kimwolf botnet targeting Android-based IoT devices. The variant introduces HTTP/2 DDoS fingerprinting, Ethereum ENS-based C2 resolution, and Tor backup routing for operational resilience.

Palo Alto Unit 42 · Aug 11, 2026Malware in the wild