Search: “content-detection”

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

SAS: Simple Attention Sparsification via End-to-End Optimization of Context Ranking

SAS trains attention sparsification end-to-end with the language modeling loss, beating sparse attention baselines especially under tight context budgets.

Simple Attention Sparsification (SAS) injects the selector's continuous scores into attention logits in log form inside the softmax, letting gradients from the language modeling loss directly update the ranking of context units. The method uses normalized softmax gates calibrated against the current block and a memory-efficient Triton kernel integrated into FlashAttention-style computation. Across reasoning, long-context, and agentic tasks, SAS consistently outperforms trainable sparse attention baselines across budgets, with the largest gains under tight attention budgets.

Hugging Face daily papers·updated Sep 11, 17:58 UTC · 4d ago·first Sep 10, 20:00 UTC · 5d agoAI research 2 sources1

30

11 Best Device Control & USB Security Tools Compared (2026): Features & Pricing

2026 comparison of 11 device control and USB security tools ranks CoSoSys Endpoint Protector first for cross-platform control and DLP.

An editorial scorecard evaluates eleven device control and removable-media security tools across granularity, content-aware DLP, cross-platform parity, encryption/shadowing, and value. CoSoSys Endpoint Protector (now part of Netwrix) leads at 4.60 for genuine Windows, macOS, and Linux parity, with Ivanti DeviceLock at 4.25 for the deepest Windows peripheral control and Safetica positioned for SMB and mid-market value. Enterprise content-aware DLP anchors include Symantec (Broadcom), Forcepoint, Digital Guardian (Fortra), and Trellix, with pricing almost always per endpoint.

GBHackers·updated 09:46 UTC · 19m ago·first Sep 11, 07:08 UTC · 5d agoIndustry 12 sources

10

Det-LIME: Detector-Aware, Multi-Instance Local Interpretable Model-Agnostic Explanations for Automated Marine Mammal Detection

Det-LIME extends LIME to multi-instance object detection explanations, improving attribution for harbor seal aerial surveys.

Det-LIME adapts LIME to object detection by combining per-detection weighting, a proximity kernel emphasizing box-adjacent regions, and IoU-based matching to track instances across perturbations. It was evaluated on aerial drone imagery for harbor seal detection plus a seabird case study, and compared against vanilla LIME, Stabilized LIME, Deterministic LIME, and gradient-based attribution. Using Attribution Ratio and Max Saliency Hit Rate metrics, it consistently improved multi-instance attribution and produced box-aligned explanations useful for debugging and data augmentation.

arXiv cs.AI / cs.LG / cs.CL·Sep 15, 17:20 UTC · 16h agoAI research

15

Enoki: Efficient Multi-Level Hallucination Detection

Researchers introduce Enoki, an open information extraction framework unifying claim-level and span-level hallucination detection in LLMs at lower inference cost.

Enoki extracts text-anchored relational facts, verifies them against evidence, and projects unsupported facts back onto hallucinated spans, so claim-level verification and span-level localization share one representation without separate alignment. It supports LLM-based, encoder-based, and rule-based extraction regimes to balance accuracy against inference cost. Experiments show it stays competitive with strong claim-level systems while using fewer resources and outperforms them on fine-grained span- and entity-level localization. The authors also release EnokiQA, a dual-granularity dataset with aligned claim-level verification and span-level localization annotations.

Hugging Face daily papers·Aug 31, 22:21 UTC · 15d agoAI research

50

An Empirical Analysis of ReDoS Vulnerabilities and ReDoS Detection Tools

Study of NVD data finds ReDoS vulnerabilities growing more prevalent and more likely to be exploited, while five detection tools disagree substantially.

The study compares five publicly available ReDoS detection tools and one regex correction tool across three datasets. An empirical analysis of all ReDoS vulnerabilities reported to the NVD finds they are becoming more prevalent and are much more likely to be exploited than non-ReDoS weaknesses. The detection tools exhibited substantial disagreement on whether a given regex is vulnerable.

arXiv cs.CR·Sep 9, 15:09 UTC · 6d agoResearch

35

Domain-Incremental Learning for Multi-Channel Replay Speech Detection

First continual learning benchmark for multi-channel replay speech detection shows task-specific beamforming cuts catastrophic forgetting across 24 acoustic environments.

Researchers frame replay-attack detection for voice-controlled systems as domain-incremental learning over acoustic environments, evaluating a beamformer-based detector across all 24 environment orderings of the ReMASC corpus with five seeds. Naive sequential fine-tuning raises error rates on previously learned environments by 18.8 points, while elastic weight consolidation halves forgetting but loses plasticity and gradient projection memory is statistically indistinguishable from naive fine-tuning. A task-specific beamformer keeping one spatial front-end per environment significantly improves final and incremental accuracy, and the last environment in a sequence dominates final performance.

arXiv cs.CR·Sep 10, 08:03 UTC · 6d agoResearch1

22

Feature Recovery for Object Understanding After Irreversible Fire Damage

TRACE benchmark with 21.4K scenes studies post-fire object understanding; a Feature Recovery Module improves degraded-image retrieval by 12.5% and material recovery by 20.1%.

The paper introduces TRACE, a transformation-aware benchmark with 21.4K real-image-grounded synthetic scenes, 499 object identities across 189 categories, and five tasks covering degraded-object detection, pristine-state recovery, material recovery, description generation, and functional reasoning. Existing models degrade sharply: RF-DETR mAP falls 71% relative from least to most severe level, and InternVL3.5 retrieval R@1 drops from 93.85 to 28.11. The proposed Feature Recovery Module maps degraded encoder features to pristine-aligned representations while keeping the host model frozen, averaging relative gains of 12.5% for retrieval and 20.1% for material recovery across VLM hosts and severity levels.

Hugging Face daily papers·Sep 9, 20:00 UTC · 6d agoAI research

30

Why Is SHAP Not a Reliable Standalone Explanation Framework for Malware Detection?

arXiv paper shows SHAP gives unreliable standalone explanations for malware detection, with attribution dilution and sign reversal in dependent PE feature spaces.

The paper argues SHAP's formal guarantees are insufficient for reliable malware interpretation because the explained feature-coalition game is fixed only by analyst choices, not by malware behavior in the data. In static Portable Executable feature spaces, dependent feature groups cause conditional SHAP to dilute credit by a factor of 1/m across redundant features, attribute importance to features the model never uses, and even reverse attribution signs; interventional SHAP queries off-manifold coalitions no real executable exhibits. Experiments on EMBER-2018, EMBER-2024, and BODMAS with fixed LightGBM and XGBoost detectors confirm these effects. The authors position SHAP as a limited diagnostic requiring explicit data-distribution statements and domain validation, not a standalone explanation framework.

arXiv cs.CR·Sep 4, 02:00 UTC · 12d agoResearch1

44

Studying Image Tokenizers as Visual Languages in Unified Multimodal Models

A controlled autoregressive testbed shows validation losses must be analyzed per task, and image tokenizer choice affects joint multimodal text modeling.

Researchers built a pure-autoregressive testbed to study image tokenizers as the 'visual language' of unified multimodal models, tracking task-specific validation losses during multimodal continual pretraining across text, image, text-to-image (T2I), and image-to-text (I2T) prediction. They found that losses exhibit distinct scaling behavior per task and rank tokenizers differently, and that I2T loss over a shared text vocabulary gives a more consistent loss–performance signal than T2I loss. Better reconstruction does not necessarily yield lower task-specific losses or stronger downstream performance, and tokenizer choice can affect text modeling under joint optimization. Case studies examine the discriminator, semantic supervision, and vocabulary size design axes.

Hugging Face daily papers·Sep 7, 20:00 UTC · 8d agoAI research1

40

Studying Image Tokenizers as Visual Languages in Unified Multimodal Models

A controlled pure-autoregressive testbed shows task-specific validation losses rank image tokenizers differently, with I2T loss the most consistent signal.

Researchers built a controlled pure-autoregressive testbed and tracked task-specific validation losses during multimodal continual pretraining across text, image, text-to-image (T2I), and image-to-text (I2T) prediction. They find losses should be analyzed per task because they exhibit distinct scaling behavior and rank tokenizers differently, and that the loss-performance relationship depends on the predicted token space. I2T loss, computed over a shared text vocabulary, correlates consistently with both generation and visual understanding performance after supervised finetuning. Case studies revisit the discriminator, semantic supervision, and vocabulary size as tokenizer design axes.

arXiv cs.AI / cs.LG / cs.CL·Sep 8, 17:57 UTC · 7d agoAI research1

30

Training and Finetuning Multi-Vector Embedding Models with Sentence Transformers

Hugging Face published a tutorial on training and finetuning multi-vector embedding models using the Sentence Transformers library.

Hugging Face's blog walks through training and finetuning multi-vector embedding models with Sentence Transformers. Multi-vector approaches store multiple vectors per document to support late-interaction retrieval. The post is a practical guide for developers building retrieval pipelines with the library.

Hugging Face Blog·Aug 26, 00:00 UTC · 21d agoAI tools & infra1

20

ReactVAU: A Slow-Fast Decoupled Framework for Streaming Video Anomaly Understanding

ReactVAU is a slow-fast streaming framework for real-time video anomaly understanding that reserves heavyweight MLLM reasoning for suspicious events, improving efficiency.

ReactVAU addresses causal streaming video anomaly understanding with three components: a lightweight Fast Detection Module using Spatial Grid Folding, Anomaly-Aware Persistent Memory that protects critical visual cues from temporal decay, and a Slow Reasoning Module activated only on suspicious events. This design minimizes heavyweight MLLM invocations during long normal intervals. Experiments show competitive anomaly detection and causal reasoning under strict streaming constraints with significantly enhanced computational efficiency.

Hugging Face daily papers·Sep 6, 20:00 UTC · 9d agoAI research

24

Plug 'n' Pray: Agentic LLM-based Detection of Potential Log File Exposures in Third-Party Content Management System Plugins

Agentic LLM analysis validates 79 log file exposures across 62 of the 300 most-installed WordPress plugins, covering 250M+ active installations.

Researchers built an agentic LLM-based framework combining static and dynamic analysis to automatically detect insecure log files created by WordPress plugins. Scanning the 300 most-installed plugins, which account for roughly 75% of all active installations in the official ecosystem, it produced 81 findings with 79 manually reproduced across 62 plugins. Insufficiently secured log files can disclose credentials and personal data and have led to website compromises. The authors derive a taxonomy of log path and protection patterns and best practices, finding multi-layered protection often absent.

arXiv cs.CR·Sep 15, 13:29 UTC · 20h agoResearch

40

Rare Not Random Using Token Efficiency for Secrets Scanning

Researcher proposes token efficiency (string length divided by BPE token count) as a better post-regex filter than entropy for secrets scanning, validated on CredData.

The post explores whether Byte-Pair Encoding tokenization can replace Shannon entropy as the primary filter for candidate secrets captured by regex in tools like Gitleaks. It defines 'token efficiency' as string length divided by token count under the cl100k_base tokenizer; secret-like strings such as GitHub tokens tokenize into many small tokens and score low, while natural text scores high. Evaluating labeled secrets from the CredData dataset shows a usable separation, with roughly 2.5 suggested as a minimum cutoff versus Gitleaks' 3.5 entropy threshold. The technique is positioned as a post-regex filtering step rather than a standalone detector.

Lobsters · security·Sep 12, 06:42 UTC · 4d agoResearch

45

Few-Shot Learning for Network Intrusion Detection: Methods, Datasets, and Performance

A PRISMA-style review of 21 few-shot learning studies for network intrusion detection finds meta-learning and CNNs dominant and evaluation inconsistently reported.

The systematic review screened 1,358 records from ACM Digital Library, IEEE Xplore, and Scopus covering 2022-2026 and retained 21 studies on few-shot learning for network intrusion detection. Meta-learning (8 studies) and convolutional neural networks (10) are the most common approaches, while CIC-IDS2017 and CSE-CIC-IDS2018 are the most frequently used datasets. Most evaluations use five or fewer samples per class, and missing parameters and source code limit reproducibility and direct comparison.

arXiv cs.CR·Sep 10, 09:07 UTC · 6d agoResearch1

36

Client-Side Probing of Deleted Ridge Statistics in Federated Unlearning

Researchers show malicious federated learning clients can probe broadcast classifiers to recover deleted samples, exposing exact label leakage on MNIST and CIFAR-10.

The paper shows that federated unlearning systems broadcasting updated linear classifiers leak compact additive training summaries to clients. A malicious client can submit known changes, identify server states from returned classifiers, and compare states around an isolated deletion to expose the deleted sample, class, or client summary, potentially enabling reinsertion. On MNIST and CIFAR-10, high-precision broadcasts allowed exact label recovery for every tested deletion, while lower precision sharply reduced fine-grained recovery.

arXiv cs.CR·Sep 3, 20:59 UTC · 12d agoResearch

45

Robust Coverless Linguistic Steganography via Sentence Embedding Space with Global Resynchronization

Researchers propose a coverless steganographic framework encoding messages as hierarchical clustering paths in sentence embedding space with a Global Resynchronization Mechanism for robustness.

An arXiv paper proposes encoding secret messages as hierarchical clustering paths in the sentence embedding space rather than token space, improving decoding stability against word- and sentence-level textual perturbations. A Global Resynchronization Mechanism (GRM) reframes variable-length bitstreams as discrete symbols anchored to semantic subspaces to prevent bit-slippage. Experiments show substantial robustness improvements while maintaining embedding capacity and resistance to statistical analysis.

arXiv cs.CR·Sep 4, 10:22 UTC · 11d agoResearch

18

LexFlip: A Dissociation Diagnostic for Legal Meaning Preservation Metrics

LexFlip releases 373 minimal perturbations of Quebec statutory French that reverse legal force while preserving tokens, exposing weaknesses in embedding-based meaning preservation metrics.

LexFlip provides 373 minimal perturbations of Quebec statutory French that reverse legal force while preserving 0.93 of tokens, creating dissociation items that break monotone token-overlap metric validation. The seven embedding and BERTScore metrics tested register only 0.022-0.039 of their identical-to-unrelated range on these edits, versus 0.670 for bidirectional NLI. Against FrJudge, with a measured human ceiling of r=0.597, a bare length feature outscores every semantic metric tested.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 15:49 UTC · 11d agoAI research

22

FreqSpaNet: Frequency and Spatial Learning of SFPF for Physical Layer Hardware Integrity Detection

FreqSpaNet learns spatio-frequency polarization fingerprints to detect unauthorized wireless hardware replacement, reaching 96.31% mean AUROC across seven replacement scenarios.

FreqSpaNet is a representation learning network for open-set hardware anomaly detection using spatio-frequency polarization fingerprints (SFPFs), which capture device-dependent responses across frequencies and directions. A frequency branch models local variations among neighboring frequencies while a geometry-aware spatial branch models directional relationships via angular information, combined through adaptive fusion and complementary pretraining. It achieves a mean AUROC of 96.31%, 9.05 points above the baseline, and is verified under seven hardware replacement scenarios.

arXiv cs.AI / cs.LG / cs.CL·Sep 15, 17:32 UTC · 16h agoAI research

18

Can your coding style predict whether your code is vulnerable?

University of Massachusetts Dartmouth researchers present VulStyle, a stylometry-based vulnerability detector that also exposes benchmark reliability problems.

VulStyle combines stylometric features with syntax-tree structure and source tokens, pre-trained on about 4.9 million functions across seven programming languages and fine-tuned on five vulnerability detection datasets. It beat token-only detectors on some benchmarks but its F1 drops sharply on DiverseVul, which the authors link to noisy labels inflating reported performance across popular datasets. The authors argue style-aware detection should be harder to evade but did not test this empirically, and they note that uniform LLM-generated code may strip away the individual developer style the model depends on.

Help Net Security·Aug 24, 04:21 UTC · 23d agoResearch1

48

Topological Fraud Detection in Latent Transaction Spaces

Researchers present a privacy-preserving fraud detection method combining unsupervised filtering and supervised classification on anonymized transaction embeddings for low-latency triage.

The paper describes fraud detection performed entirely on topologically anonymized transaction embeddings. It iterates unsupervised filtering followed by supervised classification ('sniping') to flag suspicious activity. The goal is ultra-low-latency, privacy-preserving triage for institutions without exposing personally identifiable information.

arXiv cs.CR·Sep 8, 08:50 UTC · 8d agoResearch

22

Technical Manual for a Toolkit for Measuring Contextual Individuation in Transformer Language Models

An open methodology toolkit measures whether transformer language models contextualize fixed word forms across domains using bridge forms and layer-wise silhouette analysis.

The manual documents an open toolkit built around 'bridge forms' - identical written words recurring across two or more subject domains with a different sense in each - to test whether transformer language models individuate word occurrences by context beyond the embedding layer. It covers declarative specification of bridge forms, Wikipedia corpus acquisition, occurrence localization, layer-wise representation extraction, domain-pairwise silhouette measurement, and visualization, justifying each choice against failure modes such as sense contamination and subword-tokenization misalignment. It is a methodological and implementation reference and reports no empirical results.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 16:38 UTC · 11d agoAI research

14

Harnessing CLIP and DINO: An Uncertainty-Aware Cascaded Fusion Network for Generalizable Deepfake Image Detection

UCF-Net fuses CLIP and DINO features with entropy-based uncertainty weighting to improve generalizable deepfake image detection across generators.

Researchers propose UCF-Net, an uncertainty-aware cascaded fusion network that combines CLIP's language-aligned semantic priors with DINO's self-supervised visual-structure priors for deepfake detection. It aggregates hierarchical features across transformer depths via layer-wise expert modules and performs weighted fusion driven by entropy-derived uncertainty. The authors consolidate public deepfake datasets into a unified benchmark of roughly 4 million images plus a cross-generator set of over 8,000 faces from eight recent generators, where UCF-Net achieves the best mean AUC among evaluated methods, though zero-shot transfer remains challenging.

Hugging Face daily papers·Sep 6, 20:00 UTC · 9d agoAI research

40

ENEAS: Embedding-guided Neural Ensemble for Adaptive Segmentation

ENEAS adds text prompting and semantic verification to video segmentation to keep tracking targets through occlusion and reject lookalike distractors.

ENEAS is a unified text-promptable method for instance tracking and open-concept semantic discovery in video, designed to fix temporal hallucinations, spatial fragmentation, and semantic misclassification seen in SAM 3-class foundation models. It extends the geometrically robust SeC architecture with a text-prompting adapter and temporal memory, and uses a verification layer combining fast visual embedding matching with conditional VLM refinement for ambiguous candidates. It targets 3D reconstruction pipelines where a single misclassified distractor corrupts the asset. Code and models are open-sourced.

Hugging Face daily papers·Sep 2, 20:00 UTC · 13d agoAI research

32

Linux Detection Engineering - Local Privilege Escalation

Elastic details a layered detection framework for Linux local privilege escalation, covering 2026's copy-on-write bug wave and LLM-assisted discovery.

Elastic Security Labs describes how most Linux local privilege escalations share a common host flow — an unprivileged process launched from a writable path becoming root — and proposes layered detections combining general outcome-based rules with per-technique rules in Elastic Defend and Auditd. It tracks 13 recent LPE disclosures, seven of which share a copy-on-write/zero-copy bug class, including Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, DirtyClone, pedit COW, and RefluXFS. Qualys attributes RefluXFS to an LLM-assisted research effort with Anthropic using Claude Mythos Preview, and another bug is credited to an LLM-assisted workflow. Detection and endpoint rules are published in Elastic's detection-rules and protections-artifacts repositories.

Elastic Security Labs·Sep 11, 00:00 UTC · 5d agoResearch

48

Not All Relations Are Equal: Relation-Balanced and Calibrated Graph Learning for Provenance-Based Intrusion Detection

RECAL improves provenance-based APT detection with relation-balanced masked graph learning and calibrated errors, reaching 99.99% F1 on DARPA E3 datasets.

RECAL is an unsupervised framework for provenance-based intrusion detection that uses relation-balanced masked graph learning to capture rare interaction patterns, addressing statistical heterogeneity where relation frequencies differ by roughly 140,000X in CADETS. It calibrates reconstruction errors against each relation's benign error distribution to produce comparable anomaly evidence and reduce false alarms. On three DARPA E3 datasets, RECAL achieves F1 scores of 99.99%, 99.93%, and 99.99%, outperforming the best baseline on each dataset, and reduces mean false positive rate by approximately 105X, 4X, and 41X versus the lowest-FPR baseline.

arXiv cs.CR·Sep 15, 00:31 UTC · 1d agoResearch

48

Pre-Whitening and BCJR Posterior Distillation for Bi-LSTM Detection in Faster-than-Nyquist Signaling

Study shows nested-window Bi-LSTM architectures do not improve faster-than-Nyquist detection; pre-whitening plus BCJR distillation cuts bit error rates.

Across roughly 260 controlled trainings, processing nested intersymbol-interference windows in separate recurrent branches never significantly beat a plain Bi-LSTM at matched parameter budgets. The authors attribute the limitation to the observation model rather than architecture, and instead pre-whiten inputs and distill BCJR soft posteriors into the network. With 3.4% more parameters, the method reaches 1.05x the BCJR bit error rate at compression factor 0.8 and 1.89x at 0.7, improving to 1.47x with a wider whitened window.

arXiv cs.AI / cs.LG / cs.CL·Sep 7, 17:07 UTC · 8d agoAI research

10

Do Input-Level Defenses Transfer to Observation-Level Attacks on VideoLLMs?

A systematic study shows input-level adversarial defenses provide inconsistent, often near-zero protection against observation-level attacks on video LLMs.

Researchers introduce DefTEval, a controlled framework testing eleven input-level defenses against five attack types across five video LLMs. Harmful-content detection rates are frequently near zero, and defenses fail even when attacks embed harmful signals in every sampled frame. Token compression discards localized safety features and modality fusion down-weights weakened visual signals, with defense outcomes dominated by model architecture rather than the defense method.

arXiv cs.CR·Sep 8, 06:59 UTC · 8d agoAI safety & security

40

VDiff-Bench: A Challenging Benchmark for Fine-Grained Image Difference Identification

VDiff-Bench, a 1,756-question benchmark, shows multimodal LLMs struggle with fine-grained image-difference identification, scoring as low as 8.7% on low-level changes.

VDiff-Bench is a multiple-choice benchmark of 1,756 four-way questions over image pairs covering 10 change categories including position, motion, color, texture, OCR/text and illumination, with curated hard negatives. Evaluation of 11 state-of-the-art open- and closed-source MLLMs shows fine-grained visual comparison remains brittle: 7-8B-scale open-source models score 52.5-70.6% on semantic changes but only 8.7-33.3% on low-level changes like noise and texture. Notably, Grok 4.3 shows a sharp performance drop on noise and texture differences, falling behind large open-source models like Kimi K2.5 and K3.

Hugging Face daily papers·Sep 4, 20:00 UTC · 11d agoAI research

32

Reference-Based Bias Detection in LLMs via Relative Representations of Hidden States

Researchers propose auditing LLM bias via relative hidden-state representations, detecting bias increases with 3-50x less compute than output-level benchmarks.

The paper introduces a reference-based bias auditing method that compares hidden-state representations across model variants, such as before and after fine-tuning, by encoding sentences relative to a fixed anchor set. The resulting Representational Bias Shift (Delta-B) correlates with output-level bias change in 15 of 18 tested settings, reaching |r| = 0.84 under full fine-tuning across WildGuardMix, DecodingTrust, and ToxiGen benchmarks. Thresholding Delta-B detects checkpoints whose bias increased with ROC AUC between 0.65 and 0.99 and beats a SEAT-based baseline, while auditing a model in about three minutes with 3-50x less compute.

Hugging Face daily papers·Sep 8, 20:00 UTC · 7d agoAI research

42