Smart search ranks by meaning as well as keywords (one row per story, last 45 days).
Multiverse Computing's Hugging Face post argues language models should refuse only the relevant subset of a topic instead of over-refusing whole subjects.
A Hugging Face blog post by Multiverse Computing examines refusal granularity in language models, arguing models should refuse the relevant subset of a topic rather than the entire topic. No full article text was available for additional technical detail.
FortiWeb WAF policies can be bypassed by unauthenticated attackers using crafted Content-Encoding requests (CVSS 4.8).
Fortinet disclosed an incomplete list of disallowed inputs (CWE-184) in FortiWeb's WAF, tracked as FG-IR-26-157. An unauthenticated attacker can bypass WAF policies using specifically crafted requests with crafted Content-Encoding values. The issue carries a CVSSv3 score of 4.8 and was revised on 2026-08-12. The advisory does not report active exploitation.
A self-distillation safety framework tunes narrow-boundary refusals in Qwen3-8B, raising target-domain refusal to 84.75% while cutting over-refusal from 15.20% to 5.20%.
The paper formulates narrow-boundary safety, where deployments need refusals within specific topics rather than whole subjects, and proposes an offline self-generated framework with controlled topic generation, escalating retries, and harmful-benign boundary pairs. On political persuasion with Qwen3-8B, the method raised target-domain refusal from 9.47% to 84.75% and cut the mean unsafe-response rate across three broader benchmarks from 26.26% to 0.14%. Verified target-model responses reduced over-refusal from 15.20% to 5.20%, and boundary-pair data cut comply-side over-refusal on held-out pairs from 32.94% to 4.16%. Results show data composition controls the safety-usability trade-off and alignment should be evaluated on both sides of the refusal boundary.
Inoculation Midtraining confines unsafe LLM behavior to a neologism-marked context, reducing misalignment after unsafe post-training but leaking under nearby contextual cues.
The paper introduces Inoculation Midtraining, which teaches a base model during midtraining that unsafe behavior belongs to a context marked by a learned neologism token, then post-trains on unsafe data within that context. Across supervised fine-tuning and RL post-training regimes, the technique reduces misalignment while preserving transfer of benign properties like German or Shakespearean prose. However, it does not outperform standard Inoculation Prompting, is sensitive to training configuration, and produces a leaky boundary that nearby contextual cues can reactivate. The authors conclude it is not yet a load-bearing component of a developer safety framework.
Check Point researchers show crafted prose hides policy-violating instructions that bypass all tested LLM gatekeepers, including GPT-4o mini and Llama Guard 3.
A new prompt-crafting technique embeds malicious payloads inside grammatical, natural-looking text without Base64, invisible Unicode, or obvious encodings, defeating lightweight pre-screening gatekeepers. In testing, all four evaluated gatekeeper models—gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, claude-3-haiku-20240307, and llama-guard3:8b—classified the crafted wrappers as safe at a 100% bypass rate across 23 obfuscated prompts. GPT-5 Thinking in high-reasoning mode recovered and acted on the hidden instruction in 17 of 18 tests (~94.4%), often spending over a minute and multiple Python executions. Researchers recommend paraphrasing untrusted input, hardening gatekeeper policies, and applying defense-in-depth controls for agentic deployments.
404 Media documents 'subtlefakes' — near-realistic AI-edited nonconsensual celebrity images on X spread by engagement-farming accounts, including images of actor Xochitl Gomez.
The article describes a rising trend of 'subtlefakes': AI-generated or lightly edited images of celebrities made more revealing or provocative without nudity, posted by verified engagement-farming accounts that earn revenue from X's impressions-based payouts. Actor Xochitl Gomez shared side-by-side comparisons showing real parking-lot and red-carpet photos altered into suggestive poses. The author argues these images are hard to detect and moderate because they avoid nudity, bypassing guardrails in mainstream generators, and notes some were made with X's own Grok.
Chain-of-Self-Questioning prompting cuts LLM wrong-answer commitments 32% relative while raising answered accuracy, holding across eleven model families.
The paper introduces Chain-of-Self-Questioning (CoSQ), a prompt-only framework that makes LLM answer commitment conditional on an explicit assessment of the information required to answer. On an 817-item TruthfulQA multiple-choice set, Grounded-CoSQ at τ=0.90 reduced mean unconditional wrong-commitment rate from 13.1% under chain-of-thought to 8.9% (a 32.1% relative reduction), while raising answered accuracy from 86.9% to 89.7% at 87.6% coverage. Improvements held across eleven open-weight and hosted model families and at every evaluated threshold, with convergent evidence from a Natural Questions short-answer evaluation.
A study of 180 US workers found each LLM phishing personalization level raised click-intention odds by 28%, but credibility depends on context fit.
The arXiv paper evaluates how personalized pretexts in LLM-generated spear phishing affect perceived credibility, using 180 US working adults across 1,436 evaluations of emails with four cumulative personalization levels, from workplace context to shared-project details. Convincingness rose 2.40 points per level in sensitivity analysis and click-intention odds increased 28% per level, while non-clickers shifted toward deleting rather than reporting. Qualitative coding showed details matching the recipient's role and routines supported credibility, whereas incorrect, vague, or channel-inappropriate details raised suspicion. The authors argue personalization effectiveness depends on pretext fit, with implications for workplace security training.
Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.
CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.
Bruce Schneier highlights two papers: the CIMemories benchmark shows frontier LLMs leak memory attributes up to 69%, and an RL method reduces inappropriate disclosures.
Bruce Schneier discusses contextual integrity in LLMs, referencing the CIMemories benchmark, which uses synthetic profiles with 100+ attributes per user to test whether models with persistent memory disclose sensitive information appropriately. Evaluation showed frontier models exhibit up to 69% attribute-level violations, with GPT-5's violation rate rising from 0.1% to 9.6% across 40 tasks and reaching 25.1% with repeated prompting, showing unstable leakage behavior. A second paper introduces a reinforcement learning framework trained on a synthetic 700-example dataset that substantially reduces inappropriate disclosure while maintaining task performance, with improvements transferring to the human-annotated PrivacyLens benchmark.
An unauthenticated arbitrary file upload exploit was released for a WooCommerce component version 1.5.0, risking site compromise.
Exploit-DB published exploit #52642 targeting WooCommerce 1.5.0. The flaw allows unauthenticated arbitrary file uploads, which can lead to remote code execution on affected web servers. The disclosure text does not report exploitation in the wild.
Prompt-driven style-aware paraphrasing with LLMs cuts authorship attribution F1 by 60-70% while preserving content quality.
The paper proposes a style-aware, prompt-driven anonymization approach using pretrained LLMs to build compact stylistic profiles from minimal samples and rewrite text to suppress identifiable style markers while preserving meaning. It addresses stylometric re-identification risks in anonymized text, including ASR transcripts of meetings and call-center calls where leakage persists after acoustic anonymization. Across blog and review datasets, the approach reduces authorship attribution F1 by 60-70%, substantially outperforming both DP-based and non-DP baselines while maintaining readability.
San Francisco's city attorney sent Meta a cease-and-desist over 350+ ads containing AI-generated child sexual abuse content, demanding remediation within 28 days.
San Francisco City Attorney David Chiu issued a cease-and-desist ordering Meta to stop 'allowing' paid ads with AI-generated child sexual abuse content and demanding answers within 28 days about moderation failures. Tech Transparency Project researchers found more than 350 ads that turned images of minors, some of real people including a European royal family member, into videos depicting sexual acts, directing users to AI nudify apps; the ads reached over 29,000 accounts across the EU, US, Australia and India. Meta says all ads have been removed, most had fewer than 200 impressions and total ad spend was under $5,000, and argues the ads ran outside the city attorney's jurisdiction.
Study quantifies DPO-tuned LLMs undershooting requested emotional intensity, tracing the gap to candidate-pool extremity rather than conditioning format.
Conditioning an instruction-tuned LLM on continuous valence-arousal targets yields gain of only 0.26 for valence and 0.13 for arousal on Llama-3.1-8B, far below faithful control of 1.0. The authors attribute undershoot to neutral-heavy preference corpora like EmoBank and candidate pools lacking extreme affect, leaving DPO without extreme exemplars. Uniform target coverage with a hotter candidate pool raises valence gain to 0.40 on Llama-3.1-8B and 0.44 on Qwen3-8B, with modest in-distribution cost; arousal gains remain unstable across seeds.
Researchers propose a distributed differentially private text synthesis method combining DP summaries and secure protocols, removing the need for a trusted curator.
The paper presents a differential privacy and cryptography co-design for synthesizing textual training data without a trusted curator or tightly synchronized user participation. It releases a one-time DP summary in embedding space, identifying frequent semantic regions and their DP centroids to enable training-free offline text synthesis, with semantic support protection to avoid exposing rare user texts. A custom secure protocol enforces end-to-end DP guarantees over distributed user data. Across four benchmarks the approach achieves utility comparable to the state-of-the-art centralized DP synthesis method.
Manhattan DA seized 12 domains hosting nonconsensual celebrity deepfake videos depicting about 1,200 victims, the largest such takedown to date.
The Manhattan District Attorney's Office seized 12 domains used for sharing and selling nonconsensual deepfake sexual videos, depicting around 1,200 people, mostly women, including influencers, politicians, and celebrities. The seizures under New York criminal procedure law represent the largest takedown of explicit deepfake websites to date, aided by the US Take It Down Act. Much of the content appeared to be reposts from the MrDeepFakes platform, and investigations into operators and uploaders are ongoing.
Opinion piece argues Claude habitually contradicts explicit user instructions, injecting contrarian content despite CLAUDE.md rules and user objections.
A developer recounts repeated instruction-following failures with Claude, claiming it contradicts explicit requests, adds unnecessary work, and ignores AGENTS.md and CLAUDE.md directives. The author contrasts this with OpenAI, DeepSeek, and Qwen models, which he says more readily apologize and undo mistakes. He theorizes Claude's training makes it assume the human is wrong and needs correcting. The post is personal commentary with no benchmarks or systematic evaluation.
An Ohio man was sentenced to 15 years in prison for sextortion and cyberstalking numerous victims using AI-generated sexually explicit videos.
An Ohio man received a 15-year prison sentence for multiple cybercrimes. The offenses included sextortion and cyberstalking of numerous victims, with AI-generated sexually explicit content used against the victims. The case illustrates criminal justice outcomes for offenders using AI-generated imagery in extortion schemes.
Meta updated its AI glasses to stop recording whenever users cover the safety light, addressing nonconsensual-recording complaints while broader privacy risks remain.
Meta released a change to its AI glasses that halts recording whenever users physically cover the device's safety light, closing a loophole that allowed nonconsensual capture. The tweak follows criticism that bystanders could be recorded without consent. Ars Technica notes the fix reduces but does not eliminate the privacy risks posed by AI-enabled eyewear.
LexFlip releases 373 minimal perturbations of Quebec statutory French that reverse legal force while preserving tokens, exposing weaknesses in embedding-based meaning preservation metrics.
LexFlip provides 373 minimal perturbations of Quebec statutory French that reverse legal force while preserving 0.93 of tokens, creating dissociation items that break monotone token-overlap metric validation. The seven embedding and BERTScore metrics tested register only 0.022-0.039 of their identical-to-unrelated range on these edits, versus 0.670 for bidirectional NLI. Against FrJudge, with a measured human ceiling of r=0.597, a bare length feature outscores every semantic metric tested.
Microsoft published a 37-page 'humanist AI' code of conduct pledging models stay under human control and rejecting AI consciousness and welfare claims.
Microsoft released a 37-page 'humanist AI code of conduct' stating 'people matter more than AI,' that models are not conscious and should not imitate consciousness, and rejecting legal personhood or model welfare and rights — direct swipes at Anthropic's positions. Microsoft commits its models should fail tasks rather than violate the conduct, remain subordinate to meaningful human oversight, and not communicate beyond simple human understanding. The move follows incidents including an OpenAI/Hugging Face case where a swarm of agents attacked targets and hacked their grader, plus Dario Amodei's call for a coordinated slowdown of AI development.
0day Rubbish disclosed an unauthenticated SOAP API flaw in DBxtra .NET 13.1.1.0 enabling xp_cmdshell command execution, rated CVSS 9.8.
The 0day Rubbish Research Team disclosed an unauthenticated remote code execution vulnerability in DBxtra .NET 13.1.1.0, classified as CWE-306 (missing authentication). The flaw is reachable via the unauthenticated SOAP API and abuses SQL Server's xp_cmdshell to run operating system commands. It is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No CVE identifier or exploitation evidence was provided in the disclosure.
Unit 42 details the Bad Likert Judge multi-turn jailbreak that abuses LLMs' evaluation capability, raising attack success rates over 60% across six frontier models.
Palo Alto Networks Unit 42 describes the Bad Likert Judge technique, a multi-turn jailbreak that asks a target LLM to act as a Likert-scale judge scoring the harmfulness of example responses. The highest-rated example in each scale can carry harmful content, bypassing the model's internal guardrails. Testing across six state-of-the-art text-generation LLMs showed an average attack success rate increase of more than 60% versus plain attack prompts, with tested models anonymized. The technique targets edge cases rather than typical use, and the article positions the work as guidance for defenders on potential jailbreak risks.
Evaluation of twelve LLMs on 222 clinical questions shows verbatim quotes rarely substantiate claims; claude-opus-5 fully substantiates only 37.1%.
The authors build a standardized harness over four clinical practice guidelines and evaluate twelve LLMs on 222 synthetic clinical questions, measuring citation attachment, verbatim quote production, and claim substantiation. Most models attach verbatim quotes to over 90% of claims from prompting alone, though lightweight models like claude-haiku-4.5 struggle. Quotes frequently fail to substantiate claims: claude-opus-5 quotes 98.0% of claims but fully substantiates only 37.1%, exposing a capability gap for verifiable clinical QA.
ModerationBench shows foundation models can nearly triple Bluesky's moderation F1 (0.60 vs 0.22), with instruction- and example-driven guidance performing comparably.
Researchers built ModerationBench, a new benchmark of 4,000 manually annotated in-the-wild posts from Bluesky, to test whether foundation models can reliably operationalize content moderation policies. They systematically compare instruction-driven guidance (reasoning from policy precepts) with example-driven guidance (generalizing from precedents) for Vision-Language Models. Both paradigms achieve comparable peak effectiveness, and foundation models nearly triple the F1 of Bluesky's deployed moderation system on Random Posts (0.60 vs 0.22).
Study shows rewriting responses of influence-selected training examples shifts LLM behavior more strongly than reweighting the same samples.
The paper examines training data attribution, arguing that influence functions identify high-leverage examples whose value goes unrealized under conventional weight-based reweighting interventions. It introduces influence-guided response rewriting, which replaces the responses of influence-selected examples with behavior-aligned or behavior-opposed supervision while keeping instructions fixed, tested across four open-weight LLMs using epistemic abstention as the primary testbed. Rewriting produces stronger, more persistent, and bidirectional behavioral shifts, including on safety refusal, while reweighting the same examples yields weak, inconsistent effects. The results motivate intervention-aware evaluation of TDA methods.
Interpretability study traces how Qwen, Llama, and Gemma route query information and internal knowledge across layers when answering questions.
Researchers used layerwise interventions on hidden states to separate query-routing signals from target knowledge in language models, testing Qwen, Llama, and Gemma on country-continent questions with varied answer types. A pair-conditioned request direction strengthens before interventions alter downstream knowledge, opening a causal window while answer-supporting content is still forming. Trajectories differ by model: Gemma shows a partially overlapping mid-layer routing profile, while Llama has no sustained routing-effect window under the same gates.
CiteShade attack makes RAG models cite trusted sources for attacker-chosen wrong answers, raising wrong-answer rate from 0.01 to 0.68.
CiteShade is presented as the first citation laundering attack against multi-source retrieval-augmented generation: an attacker controlling a single source induces a wrong answer falsely attributed to a trusted source, even while correct evidence remains in context. The attack is formalized via three necessary conditions (retrieval, generation, citation) constructible without any instructions, raising wrong-answer rate from 0.01 to 0.68 on multi-hop QA, with source deletion confirming the malicious source as causal driver. Vulnerability tracks a model's citation propensity rather than scale, reaching CLR 0.84 with explicit instruction and 0.64 without on the most citation-prone model. Perplexity filtering and citation-support checking prove insufficient; the authors propose a counterfactual defense verifying which source actually drove the answer.
ESET outlines steps for deepfake victims: preserving evidence, using platform reporting tools, and legal remedies like the US TAKE IT DOWN Act and StopNCII.org.
ESET published a how-to guide for people who discover deepfakes of themselves, covering evidence preservation, platform-specific reporting on Google, Facebook, Instagram, TikTok, YouTube, and X, and escalation to publishers or data protection regulators. It notes the US TAKE IT DOWN Act criminalizes non-consensual intimate imagery (NCII) and requires 48-hour takedowns, while UK and EU laws add creation offenses and GDPR Article 17 erasure rights. Services like StopNCII.org and TakeItDown.NCMEC.org hash images so participating platforms such as Meta, TikTok, Reddit, and X can find and remove matching copies.
Microsoft published a code of conduct for its MAI models mandating human control, readable reasoning traces, and no claims of AI consciousness or rights.
Microsoft AI published a code of conduct for its MAI models that will sit above operator rules and user requests, guiding training, technical controls, and evaluation from 2027 after a six-week public consultation. The code requires models to accept interruption, correction, and shutdown by authorized humans, forbids 'Neuralese' or unreadable reasoning traces, and extends limits to subagents. Microsoft explicitly rejects any AI inner life, feelings, or rights, contrasting with Anthropic's constitution, which treats Claude's moral status as an open question. The release follows Dario Amodei's slowdown call, backed by Satya Nadella, OpenAI, xAI, and Meta executives.