30
CategoryAll
Smart search ranks by meaning as well as keywords (one row per story, last 45 days).
LLM-Driven Algorithm Design for Quantum Circuit Synthesis based on Binary Decision Diagrams
QuantumEvo uses an LLM to evolve BDD variable-ordering heuristics, achieving a 70.9% tie-or-win rate on quantum circuit cost versus baseline methods.
The QuantumEvo framework uses an LLM as a heuristic generator for quantum-cost-aware BDD variable ordering in reversible circuit synthesis, searching over heuristics initialized from multiple families and selecting them by downstream quantum circuit cost. The discovered heuristic HGA-QE modifies the sifting step inside a genetic algorithm and achieves a 70.9% tie-or-win rate against the per-function best baseline, with strict wins on 13.5% of functions. Advantages are clearer on benchmark suites not used for heuristic discovery.
20
A Princeton Researcher Proposes Recurrent Looped Transformer (RLT) that Carries Decoder State across Every Token, Fixing 96 Blocks per Token with Unbounded Temporal Depth
Princeton researcher Yifan Zhang proposes Recurrent Looped Transformer, carrying full decoder state across every token for unbounded temporal depth.
Yifan Zhang's technical report defines the Recurrent Looped Transformer (RLT), pairing a causal encoder with a recurrent decoder whose final output and layerwise sliding-window attention cache carry into every subsequent token with no prompt-response boundary reset. The reference configuration ties 48 encoder and 48 decoder layers, executing 96 logical blocks per token while the state path grows to 48t blocks after t tokens at fixed per-token compute. The report details RL replay contracts that rebuild all states under current parameters and exact prefix snapshots for multi-turn serving, but explicitly reports no measured efficiency, reasoning quality, or scaling results.
40
Recurrent GraphNeural NetworkswithSet-BasedAggregation
Paper proves two-directional equivalence between recurrent GNNs with set-based aggregation and Boolean closure of reachability/safety properties in modal mu-calculus, checkable from weights.
The authors study recurrent graph neural networks with set-based aggregation and identify sufficient conditions, checkable directly from network weights, for compiling networks into logical formulas and formulas into networks. They establish an effective two-directional equivalence with the Boolean closure of reachability and safety properties, the fragment BΣ°1 of the modal μ-calculus, shown to be the exact expressive level of stabilization over finite vocabulary. The correspondence needs no counting logic, external halting signal, or non-effective acceptance condition, yielding a verifiable path from weights to symbolic explanations.
15
Sound Debloating of Redundant Checks in Zero-Knowledge Machine-Learning Circuits
Automated framework soundly removes up to 48.7% of redundant constraints in ezkl and zkml ZK-ML circuits, cutting prover time by up to 72.8%.
The framework uses whole-circuit abstract interpretation and a provenance graph to verify that each removed redundant check (range proofs, sign lookups, bit decompositions) remains entailed by the rest of the circuit, provably preserving soundness. It was evaluated on MLP, CNN, RNN, and transformer circuits generated by ezkl and zkml, with up to 25.3 million constraints. It removes up to 48.7% of constraints and reduces prover time by up to 72.8% without weakening security. Under-constrained circuits in deployed ZK systems have previously enabled attackers to forge transactions and bypass verification.
35
Analog Pin Directionality as an Exfiltration Attack Surface in Mixed-Signal ICs
Researchers demonstrate exfiltration through nominally input-only analog pins in mixed-signal ICs, recovering data at 10 kbps on a 55nm PPG front-end.
The paper identifies a directionality-based attack class in analog/mixed-signal (AMS) ICs where data-dependent circuit-offset modulation converts a nominally input-only pin into an outbound information channel. Three host conditions enable the attack: a closed-loop amplifier, an exposed amplifier input, and sufficiently high impedance at that pin. Silicon validation on a photoplethysmography analog front-end in 55nm CMOS showed exfiltration at up to 10 kbps with error-free PRBS recovery, under 0.001% area overhead, and only 0.03 dB SNR reduction.
30
Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration
Researchers introduce Decoy Direction Optimization, a cheap weight-editing defense that blinds refusal-direction ablation attacks against open-weight LLM safety guardrails.
Refusal Feature Ablation bypasses safety guardrails in open-weight LLMs by projecting out a linear refusal direction, often with high attack success rates. Decoy Direction Optimization injects a high-magnitude nonlinear decoy into MLP neurons so attackers' contrastive estimators ablate a harmless orthogonal feature instead. Evaluated across six model families, DDO keeps ASR below 10% under standard RFA and on Llama-3-8B-Instruct reduces Heretic weight-level attack ASR from 88.7% to 18%. It costs 30 to 450 times less per configuration than trained defense baselines.
55
Chypothermia: Clock Freezing for Static Side-channel Attacks
Chypothermia attack uses cryogenic cooling to disable clock and voltage sensors, evading detection and blocking key zeroization on OpenTitan root of trust.
Chypothermia is a static side-channel attack that exposes chips to cryogenic temperatures, disrupting on-chip mixed-signal components to disable the clock sensor, clock generation circuit, and voltage sensors without electrical tampering. Combined with Chypnosis (IEEE S&P 2026), it halts the clock while evading temperature-based anomaly detection. It was implemented on multiple FPGA/SoC platforms and applied to the OpenTitan root of trust's alert handler, evading detection and preventing key zeroization. The authors also propose an FPGA-compatible self-heating sensor as a countermeasure.
32
ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?
Formalizes residual authorization state language agents must preserve under revocable delegation; token-budget summaries mostly fail while hard gates stop unauthorized effects.
The paper shows two authorization histories with identical current permissions can require opposite decisions after the same direct-edge revocation, formalizing the needed information as residual authorization state. Exponentially many future-distinct states can share one transitive closure, with exact or tight asymptotic bounds on the state an exact monitor requires. Across four open-weight models, fixed 256-token summaries solved at most 2 of 16 paired episodes while authenticated current-query reads solved 15-16 of 16. A hard effect gate reduced eight observed unauthorized effects to zero without changing preceding attempts.
27
Towards Tackling Application Logic Flaws through Autonomous Formal-Logic Modeling and Automated Reasoning
LL-Verifier combines LLMs with logic model checking to automatically discover logic flaws, uncovering vulnerabilities in 27 IoT access-control protocols.
Researchers present LL-Verifier, a framework that uses LLMs to autonomously convert natural-language protocol descriptions and security goals into formal logic models in a new logic language built on Maude, then applies logic model checking for exhaustive verification. The framework targets application-logic flaws that are tied to business semantics and hard to scale with manual analysis. Evaluation on 27 access-control protocols of widely used IoT devices uncovered a range of sophisticated logic vulnerabilities with security and privacy implications.
42
Variational Continuation for Double Pendulum Periodic Orbits
Researchers introduce a Hessian-based, integrator-free method using automatic differentiation to continue periodic orbits in the double pendulum, uncovering previously unreported orbit families.
A new arXiv paper presents a variational, Hessian-based framework for numerically continuing periodic orbits in dynamical systems, parametrizing candidate loops as Fourier series and minimizing deviation from the governing differential equations. Automatic differentiation replaces hand-derived Jacobians, and flat directions of the loss landscape guide the continuation search. The method is demonstrated on the double pendulum, mapping bifurcations along orbit families, including periodic orbits where neither pendulum mass is ever simultaneously at rest.
15
Recognition-Refusal Misalignment in LLMs: Why Models Answer Structurally Unanswerable Questions
A linear hidden-state direction encodes question impossibility in 1.7B-70B LLMs, but misalignment with the safety-refusal pathway explains why models answer unanswerable questions.
The study examines why instruction-tuned LLMs from 1.7B to 70B parameters answer structurally unanswerable math and code questions instead of abstaining. A single linear direction in the hidden state separates answerable from impossible prompts, showing models represent impossibility before generation, but this direction is nearly orthogonal to the canonical safety-refusal direction. Generation-time steering along the recognition direction changes invalidity-aware behavior dose-responsively, and the geometry is present even at the pretraining endpoint, indicating a routing failure rather than an encoding failure.
30
Autonomy in Check: Governor-Mediated Adaptive Security at the Edge
Split-control architecture adds a deterministic governor to validate LLM and rule-based planner intents before eBPF enforcement at the edge.
Researchers propose a split-control edge security architecture in which an untrusted planner emits typed security intents that a deterministic governor checks against safety, resource, temporal-stability, and proportionality invariants. Admitted actions are bound to signed receipts and compiled into pre-installed eBPF map updates. A Raspberry Pi 5 prototype on a university 5G test network admitted, rejected, and bounded intents at microsecond cost.
35
DeCAL: Towards Physically-Grounded Dexterous Vision-Language-Action Models via Contact-Aware Latent Co-Imagination
DeCAL, a contact-aware dexterous vision-language-action model with visuo-tactile fusion, reports 71% average task success.
DeCAL is a physically-grounded dexterous vision-language-action (VLA) model built on a Mixture-of-Transformers architecture with specialized experts for understanding, imagination, and action generation. It introduces Adaptive Visuo-Tactile Fusion with contact-aware gating and Visuo-Tactile Latent Co-Imagination to jointly model visual and tactile dynamics. It reports state-of-the-art results with a 71% average success rate and 83.4% progress success rate, plus generalization to unseen scenarios.
30
Explainability Assistant: A Conversational XAI Interface for Interpreting Energy Consumption Models
Researchers release Explainability Assistant, an open-source conversational XAI tool using LLM function calling, lifting intent-parsing accuracy from 76.8% to 94%.
The paper introduces the Explainability Assistant, an open-source conversational XAI system for interpreting energy consumption forecasting models such as genetic-programming symbolic regressors. It uses LLM function calling instead of rigid custom grammars, achieving 94% intent-parsing accuracy versus 76.8% for prior work TalkToModel, and adapts to different ML problem types without task-specific fine-tuning. Comparative evaluation with energy domain specialists against a traditional XAI dashboard showed improved usability, with all experts preferring the conversational interface.
25
Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems
An empirical study finds no major agent-memory system enforces fact revocation at retrieval, causing agents to act on superseded, unsafe information.
Researchers tested five agent-memory systems across nine policy scenarios, nine models, and six defense conditions, tracking whether revoked facts are returned and acted upon. No system enforces revocation by default: revoked records are returned whenever the revocation label is visible to the retrieval layer, outrank their replacements, and lead agents to unsafe actions. The authors propose a backend-agnostic guard that sits between the agent and any memory store and withholds revoked or conflicting records at retrieval time.
38
Injected and Leaked: Actively Inducing Side-Channel Leakage Using Electromagnetic Injection and Hardware Nonlinearity
Researchers introduce InjectEave, using electromagnetic injection and hardware nonlinearity to induce side-channel leakage and eavesdrop on headphone audio from 30 meters.
An arXiv paper shows electromagnetic injection can actively amplify side-channel leakage: nonlinear hardware such as amplifiers, ADCs, and power converters modulates secret electrical signals onto an injected EM carrier, upconverting low-frequency secrets into measurable EM emissions. By tuning injection frequency and amplitude, an adversary can shape the effective spectrum and entropy of the resulting leakage. The InjectEave attack demonstrated eavesdropping on wired and wireless headphone audio from up to 30 meters and in through-wall scenarios using accessible RF equipment, plus leakage of smart home device power consumption and analog sensor inputs. Case studies show closed-loop eavesdropping and manipulation of landline phone conversations, and the paper discusses mitigations.
34
Train Smarter, Not Harder: Switching Signal-Guided Training in Active Learning
HybridAL is an active-learning training schedule that switches from retraining to fine-tuning on stabilization signals, saving up to 49% time.
Researchers find that choosing between retraining from scratch and fine-tuning is an exploitable decision variable in active learning: retraining helps in early rounds while fine-tuning is safer once the model trajectory stabilizes. HybridAL monitors an online stabilization signal using spectral exponent change and accuracy change, switching from retraining to fine-tuning after sustained stabilization. Across three encoder backbones and six text-classification tasks with five seeds each, HybridAL keeps endpoint macro-F1 non-inferior within a 0.010 margin, saves up to 49% of retraining time, and improves the time-calibration trade-off measured by negative log-likelihood.
20
How Fragile Is Safety Alignment at Frontier Scale? A Single-Direction Attack on a 320B MoE
Researchers show directional ablation breaks refusal in GLM-5.3-Flash, a 320B-parameter MoE, cutting refusal by 41–89 points across seven benchmarks.
The study extends directional ablation, a white-box attack that removes an aligned LLM's refusal behavior, from dense models up to ~70B parameters to GLM-5.3-Flash, a 320B-parameter mixture-of-experts model with 288 routed experts, four-wide hyper-connection residual, and block-FP8 quantization. Editing attention, dense, and routed-expert writers jointly removes 0.776 of refusal, with 74% of the effect existing only under the joint intervention; the conventional module-name-based recipe reaches only 0.066 and fails silently on MoE architectures. The attack yields 41–89 percentage-point reductions in refusal across seven harmful benchmarks with no detected capability change, and a category-concentrated refusal residue survives all edits at ranks 1 to 12.
45
Guppy: Efficient Light Clients via Recursive Zero-Knowledge Proofs
Guppy lets blockchain light clients verify full state via recursive zero-knowledge proofs without validators maintaining state commitments, processing thousands of updates per second.
Guppy is a light-client protocol in which validators commit only to state updates while an off-chain, untrusted service secured by recursive zero-knowledge proofs maintains a verifiable Merkle tree over the full state. A hash-chain commitment moves validator signature verification out of the proving circuit, and a parallel recursive proving pipeline keeps latency growth logarithmic with throughput. A Plonky2-based implementation maintains a tree of size 2^30 while processing thousands of updates per second, adding only 2-4 seconds of latency without increasing block-construction complexity.
22
When LLM Decompilers Recompile More and Preserve Less
Researchers show LLM decompiler outputs can recompile yet diverge behaviorally, proposing the Decompile-Diverge fuzzing oracle to catch hidden changes.
The paper demonstrates that LLM-based decompilers can produce code that recompiles and passes all shipped tests yet diverges on other legitimate inputs—4.9% overall and up to 13% for one system—and can make disclosed vulnerabilities vanish without a visible crash. Across 300 real GitHub functions and 287 CVE-grounded functions, a refinement LLM lifted Ghidra's build rate from 75% to 90% while Matched rate fell from 74% to 62%, with up to one tenth of vulnerabilities showing Crash Absence. Decompile-Diverge detects these gaps by synthesizing drivers, growing fuzzing corpora from the reference, and rerunning decompiled code on identical inputs.
42
The Verifiable Action Card: Trustworthy Human-in-the-Loop Control for Secure Autonomous Agents
Verifiable Action Card architecture blocks indirect prompt injection in agentic browsers, cutting attack success from 68-100% to 0%.
Researchers propose VAC, a browser-architecture defense that reconstructs approval prompts from the ground-truth pending action and trusted intent provenance, rendering them out-of-band in trusted browser chrome. On a 24-scenario benchmark covering confused-deputy attacks, dialog forging, and indirect prompt injection, attack success fell from 68-100% to 0% across evaluated LLMs, with 78% legitimate-task completion and a 0% false-block rate. Approval is bound to the exact action re-verified at dispatch.
55
Procedural Graphs: Self-Evolving Execution Structures for LLM Agents
Researchers introduce Procedural Graphs, self-evolving (procedure, relation, procedure) structures guiding LLM agent tool use and planning.
Procedural Graphs organize procedural knowledge into (procedure, relation, procedure) triplets to guide LLM agent actions, addressing drift such as lost objectives, out-of-order tool calls, and repeated unproductive steps. At each decision step the framework localizes the active node and a guidance model translates the surrounding subgraph into step-level situational guidance. An LLM refiner edits graph topology by contrasting failed with successful trajectories, and across datasets, task types and LLMs the approach outperforms memory-based baselines and matches or surpasses hand-designed graphs.
25
Access Control as Verified Parse Constraints
Researchers verify a class of EverParse validators that correctly enforce access-control policies, deploying a machine-checked enforcement gate on seL4.
The paper targets enforcement-code bugs in commercial security gateways by proving that forward-only, backtrack-free EverParse validators are verified recognizers for a bounded finite-state class that includes access-control decision functions with fixed-offset fields and bounded disjunction. Encoding a bounded policy language into a fixed-size byte buffer allows an SMT solver to verify the enforcement code once, covering all byte values, policies, requests, and sessions. Editing rule content over a fixed endpoint set requires no new proof, while adding endpoints reruns the toolchain. A deployment on the seL4 microkernel ensures every request passes through the gate and unverified components cannot corrupt the enforcement chain.
28
Show-Harness: Just a VLM Agent Can Play Robots
Show-Harness enables VLM agents to control robots via a semantic action interface, achieving zero-shot frontier control and few-GPU-hour adaptation of small VLMs.
Show-Harness exposes discrete semantic action units that VLMs reason over, with embodiment-specific interpreters deterministically grounding them into local robot actions. It enables zero-shot closed-source frontier VLM control and adapts small open-source VLMs for low-cost deployment with a few GPU-hours of fine-tuning. The companion GUMI interface extends the same semantic action space to GUI-based demonstration collection without teleoperation hardware, and Show-Harness-equipped agents outperform representative agentic and VLA paradigms.
28
The Router Within: Eliciting Native Skill Routing from a Frozen LLM
Gavel reads skill-routing signals from a frozen LLM's forward passes with two linear maps, beating retrieval pipelines by up to 21.9 points.
Gavel (Glance And Verdict) shows a frozen agent LLM already contains skill-routing signals in its forward passes, read out via two trained linear maps without loading skill text into context. A glance step scores the full library using mid-layer states and per-skill banks built in one forward pass; a verdict step fuses the model's own likelihood and yes/no judgment as a product of experts. Trained once, it transfers zero-shot to three public benchmarks and SkillTraj (372 simulated agent trajectories); on Qwen3-32B it beats progressive disclosure and retrieve-and-rerank pipelines adding 1.2B-16B external parameters by up to 13.4 points (21.9 mid-rollout).
42
Beyond the Turing threshold: Productive grammars generate essentially undecidable languages
A theoretical paper designs formal grammars that emulate Post's productive sets, generating languages that are provably beyond Turing decidability.
The paper elaborates on Emil Post's productive sets, which are not even semi-computable, and builds formal grammars that emulate their construction over natural numbers. The resulting languages are shown to be essentially undecidable, placing them beyond Turing decidability. This is pure computability and formal language theory with limited direct security relevance.
10
Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety
Unit 42 research shows LLM safety refusals concentrate in a thin neural layer, motivating external, multi-layered AI security controls.
Palo Alto Networks Unit 42 introduces Perturbation Probing, a diagnostic technique for measuring the fragility of LLM safety mechanisms. The research finds that safety refusal behavior is localized within a thin neural layer, implying small perturbations can undermine built-in refusals. The authors argue this motivates external, multi-layered security defenses on top of model-internal safety training.
45
Opaque recurrence, and other AI terms that you should probably know
TechCrunch updates its plain-English glossary defining common AI terms from AGI and agents to chain-of-thought reasoning.
TechCrunch maintains a regularly updated glossary of AI terminology, defining terms such as AGI, AI agents, API endpoints, chain of thought, coding agents, compute, deep learning, and diffusion. It highlights 'opaque recurrence', the reasoning technique in OpenAI's new Astra model that has drawn attention from AI safety researchers. The piece is an educational living document rather than new research or a product announcement.
18
CaMeLoT: CaMeL orchestrated with Temporal logic for static verification and liveness
Researchers present CaMeLoT, extending CaMeL with CTL model checking that statically rejects unsafe LLM agent plans before any tool executes.
CaMeLoT adds a static verification layer to CaMeL, a runtime defense against prompt injection in tool-using LLM agents. It translates a generated plan into a finite-state transition system, labels it with tool calls, provenance, and taint information, and checks it against CTL temporal policies using the nuXmv model checker before any tool is invoked. Failed checks return counterexamples for plan repair, avoiding LLM calls, tool calls, and sandbox teardown. Evaluation covers policies derived from AgentDojo, SOC workflows, and prompt-extraction experiments.
40