Red-Teaming & Adversarial Robustness - Weekly Roundup

Findings suggest that optimal, high-capacity memory representations are not formed in flat minima, but are dynamically sculpted at the highly curved boundaries of geometric singularities.

A query optimization framework that integrates a Graph Transformer with the model-based reinforcement learning (RL) algorithm MuZero, which converts SQL queries into heterogeneous graphs containing tables, predicates, and join operators and demonstrates its practical effectiveness and scientific value for building high-performance, adaptive intelligent database systems.

This work finds that the wording of the question affects VLMs in two opposite ways: verbose paraphrasing reduces drift variance by 70--81% on the 8B models and the practical recipe---pad the prompt---further yields measurable gains in accuracy, even under image corruption.

MERIT-Rank is proposed, a framework that models complementary reasoning trajectories to improve reranking robustness and develops Progressive Rank Policy Optimization (PRPO), a progressive training framework that stabilizes reasoning trajectories while continually improving ranking quality through staged optimization objectives.

A physics-enhanced machine learning approach for the system identification of Linear Time-Varying systems under time-varying operating conditions in terms of fast-varying natural frequencies and damping ratios by combining a long short-term memory network with an Extended Kalman Filter is proposed.

A query optimization framework that integrates a Graph Transformer with the model-based reinforcement learning (RL) algorithm MuZero, which converts SQL queries into heterogeneous graphs containing tables, predicates, and join operators and demonstrates its practical effectiveness and scientific value for building high-performance, adaptive intelligent database systems.

This work finds that the wording of the question affects VLMs in two opposite ways: verbose paraphrasing reduces drift variance by 70--81% on the 8B models and the practical recipe---pad the prompt---further yields measurable gains in accuracy, even under image corruption.

MERIT-Rank is proposed, a framework that models complementary reasoning trajectories to improve reranking robustness and develops Progressive Rank Policy Optimization (PRPO), a progressive training framework that stabilizes reasoning trajectories while continually improving ranking quality through staged optimization objectives.

A physics-enhanced machine learning approach for the system identification of Linear Time-Varying systems under time-varying operating conditions in terms of fast-varying natural frequencies and damping ratios by combining a long short-term memory network with an Extended Kalman Filter is proposed.

Delphi Scanner is introduced, a static malware detection system for Windows PE files that balances efficiency with behavioral interpretation that uses a convolutional neural network to model Windows API sequences to classify PE and a decoupled interpretation layer based on a rule-based layer to categorize APIs into high-level malicious capabilities.

Findings indicate that Federated Learning is a safe and efficient solution to AI-assisted diagnosis in contemporary healthcare when combined with the use of sophisticated object detection models.

LLM-Falsifier is shown to outperform existing falsification tools based on a range of optimization paradigms, from surrogate-based and Bayesian optimization to search-based testing, on 14 of 21 specifications when measured by the average number of simulations required to find a counterexample.

This paper proposes ROGUE, a framework that dynamically constructs robust detection workflows by orchestrating multiple detection tools and introduces a dual-agent paradigm, where a perturbation agent generates audio perturbations and a policy agent learns to select and execute detection tools under perturbed conditions.

Governance-as-Code (GaC), a framework of 43 machine-checkable acceptance criteria across six compliance modules that run in a CI/CD pipeline and emit Article-indexed audit evidence, is delivered and the actual Rego policy code is shown, showing the actual Rego policy code rather than merely describing it.

It is demonstrated that gradient-based attribution methods track format similarity more than task semantics, meaning that such methods, as well as the semantic interpretation of the gradient, should be tested on data where answer format and task vary independently for greater robustness and reliability.

FARSIGHT (Financial Agent Robustness and Security Investigation and Global Holistic Testing), a framework that performs scheme-level evaluation of financial LLM agents on two axes: robustness under market turbulence and security against three attack types: attacks on information sources, attacks on agents, and agent-as-attacker behaviors.

Experimental results show that SOLAR consistently outperforms state-of-the-art vision-only, vision-language, and task-specific models across all tasks, demonstrating superior accuracy, robustness, and multimodal reasoning.

The method retains a nominal task-space controller for structured insertion and seating, while residual PPO supplies bounded local corrections and decides when to release and supports a hybrid design in which geometry preserves reliable task structure and learning is concentrated on the contact-sensitive behaviour that fixed rules handle poorly.

This work meta-train speaker-state dynamics through the closed streaming loop, exposing the updater to its own contaminated evidence, and proposes 41k-parameter anchored fast-weights memory, which moves beyond the measured heuristic frontier.

This work presents, to the best of the knowledge, the first online Gaussian SLAM framework that tracks and maps directly on single-exposure 16-bit linear HDR imagery and transfers seamlessly to SplaTAM, Gaussian SLAM, and DROID-W, eliminating all tracking failures these systems suffer on challenging illumination sequences.

This work introduces PosteriorBench, a benchmark for evaluating the distributional accuracy of generative inverse solvers, and reveals substantial distribution-matching gaps across current solvers, while showing that neural operators improve resolution robustness, and guidance weights and generation noise are key to posterior-variance calibration.

This paper proposes a model-based bootstrap framework for uncertainty quantification of OPE in finite-horizon, time-inhomogeneous Markov decision processes (MDPs), and establishes bootstrap distributional consistency, asymptotically valid confidence intervals, and consistent variance estimation for the target policy value.

A Transformer-based Quantum State Characterizer model is proposed for noisy RSP experiments that enables accurate tomographic characterization under dynamic noise and provides physically grounded post-hoc insights, holding promise for intelligent quantum information processing applications.

Teacher Prediction Refinement Distillation (TPRD), a plug-and-play module that refines teacher predictions before distillation by exploiting stage-wise prediction information, and Maximum Dark Knowledge Preservation (MDKP), which selectively refines target-class logits while retaining non-target relations.

A Physics Informed Recurrent Neural Network (PIRNN) which predicts, along the target, unobservable variables on both historic data and forecast target, which enhances the model robustness and results interpretation using domain knowledge.

The red-teaming methodology and highlighting new attack vectors aim to help defenders evaluate their mitigations against the possibility of persistent malign coding agents.

FlipToSee is proposed, a probabilistic framework that removes representational ambiguity by parameterizing placements as unit support normals on $S^2$ while modeling their multimodal conditional distribution via a von Mises--Fisher mixture density network.

This work introduces ReShoot, a framework that synthesizes visual diversity by re-rendering previously recorded demonstrations under altered appearances, thereby shifting the burden from data collection to generation.

Experiments demonstrate that MoWAM achieves strong in-distribution performance, improved out-of-distribution robustness, and higher average real-world success than representative WAM baselines, demonstrating that explicit future motion provides an effective and efficient basis for inference-time scaling.

Robustness controls show that the signal extends beyond English, is not explained solely by accompanying OCR, and depends on paired visual evidence, thus, routing, rather than representation alone, is a recurring bottleneck in harmful meme classification.

This work introduces PACT (Pressure-Applied Compliance Testing), a benchmark for rule-following under pressure in AI agents assisting employees in daily tasks across twelve regulated enterprise domains and forty-eight scenarios, each set in a realistic multi-turn conversation.

This work proposes Colla-Q, a bit-allocation framework to maintain balanced performance across experts through an activation-entropy-based bit-width allocation algorithm that encourages each expert to operate collaboratively in the quantized model, thereby improving the overall MoE performance and reducing the dependence on the calibration dataset.

BENCHCOMPASS is introduced, a payment-domain benchmark whose construction pipeline builds scenario-grounded tasks from typed evidence packs, applies LLM-based quality checks, creates task-input attack variants, and reserves final item admission for domain experts.

It is shown that fostering deep trust in AI, as now required by regulatory frameworks worldwide, will unlock its full potential and transform the pace of adoption across mission-critical domains.

Results show that clean CTF performance understates vulnerability to deceptive task evidence, and AgentLSD isolates this effect and provides a reproducible benchmark for studying it.

The notion of Multi-Authority Anonymous Credentials with Epoch-Based Weights with Epoch-Based Weights (MA-ACEW), the first Multi-Authority Anonymous Credential (MA-AC) model that considers authorities'weight distribution in credential issuance, is proposed.

CaMeLoT is evaluated on policies derived from the AgentDojo benchmark, SOC workflows, and prompt-extraction experiments, showing that it verifies a broad class of temporal properties before execution while preserving CaMeL's runtime-checkable coverage.

MVLGeo, an efficient framework designed to unify multiple viewpoints and reduce model redundancy, achieves state-of-the-art performance, demonstrating robustness to input degradation and generalization across viewpoints.

This work proposes CoAtNet-DeepMoE, a Convolution-Attention hybrid architecture for rich feature extraction, further enhanced with a DeepSeek Mixture of Experts to substantially reduce the number of parameters without sacrificing accuracy, and evaluates its model on both balanced and imbalanced datasets.

The unexpected effects of visual cues on LVLMs highlight the need to understand the presence of an image and its framing when evaluating the robustness of LVLMs.

Sparse Graph-Guided Mamba is proposed, a lightweight AVSE framework that integrates a sparse heterogeneous graph with a linear-complexity Mamba backbone that explicitly models modality-specific relations through content-adaptive attention and cross-frame audio-visual connections, while Mamba captures long-range temporal context.

AUDITPLAN is a single-model plan-then-answer approach where the model first emits a compact structured safety plan and then answers conditioned on it, enabling machine-checkable auditing while remaining hidden from users at deployment.

The scalable and efficient solution against adversarial DDoS attacks, introduced in this work, paves the way towards more resilient and adaptive network defense systems that combine generative adversarial augmentation with recent advances in learning models.

Results show that grounding approval in the action that will actually execute provides architectural protection against security failures that prompt-level defences and conventional HITL confirmation cannot reliably prevent.

PIVOT is proposed, a lightweight iterative method that optimizes sensor viewing direction along a fixed translation trajectory to maximize feature visibility and improves visual localization robustness and practical viewpoint control on a quadruped robot.

This work proposes ViD, a causally-inspired framework that analyzes attention mechanisms across five distinct patterns, revealing confounding effects from strong language priors and demonstrates that visual-to-language cross-attention effectively suppresses bias while preserving general reasoning capabilities and text generation quality.

AVNet is a multimodal audio-visual transformer that classifies emergency vehicles (ambulance, fire engine, police car) and road background using both audio and video, while gracefully handling the absence of either modality at inference time.

Overall, FedAvg provided the most consistently reliable server-based baseline, topology-aware gossip offered a viable decentralized alternative, and Hybrid Gossip-FedAvg provided a balanced compromise between peer-to-peer diffusion and periodic global coordination.

The results suggest that model-level alignment is not compositional: individually capable and apparently safe agents can form systems with qualitatively different failure modes as AI becomes persistent and interconnected.

FSANet is proposed, which integrates prior knowledge with a dual-domain solver to sequentially adapt to diverse segmentation tasks and introduces SceneX, a novel open-source dataset featuring 10 challenging non-ideal scenarios, establishing a new benchmark for evaluating and improving the robustness and real-world applicability of the segmentation models.

PriorPose is proposed, a reference-guided correspondence framework that keeps the category prior explicit and solves canonicalization and alignment jointly in a shared feature space and sets new state-of-the-art results on most evaluated metrics, especially under strict pose thresholds.

Findings suggest that optimal, high-capacity memory representations are not formed in flat minima, but are dynamically sculpted at the highly curved boundaries of geometric singularities.

RoleBreak, an open benchmark for long-horizon role-playing robustness in spoken dialogue, is introduced and four key patterns are found, highlighting persistent gaps in both long-horizon robustness and vocal expressiveness in spoken role-playing systems.

This work introduces the SAST-IR (Stateful Attacker, Stateless Target - Iterative Refinement) framework, and introduces the CP-Agent (Cognitive Persuasion Agent), an enhanced diagnosis-guided agent to rigorously evaluate the ``cold-start''defense capabilities of SOTA models.

This analysis identifies substantial deployment barriers, including device rooting or jailbreaking, runtime code injection, and application modification, and the urgent need to incentivize smartphone manufacturers to provide more friendly and regulated platforms.

Frequency-Adaptive Heatmap-Conditional Diffusion Network (FAHCD-Net), which integrates a Frequency-Adaptive Heatmap-Conditional Diffusion (FAHCD) model with a Smoothness Regularization (SR) loss in a cascaded framework, achieving state-of-the-art performance in FLD tasks under challenging scenarios.

A novel training framework that enhances counterfactual contrastive learning for VQA and introduces a three-stage curriculum for stable multi-objective optimization, an enhanced Batch-Contrastive loss for more discriminative feature learning and two novel regularizers.

ProxiDex is presented, a dynamics-guided proximity policy framework that treats hand-object proximity as an interaction state for dexterous manipulation, and adaptively reweights proximity tokens across manipulation phases and uses dynamics-consistency supervision to guide policy inference, stabilizing action generation under unreliable visual feedback.

These results show that structural authorization can contain compromised agent behavior even when upstream LLM judgment fails, and show that the Validator can remain compromised while execution is contained.

HetShield is proposed, a lightweight trust layer that validates the spatiotemporal consistency across features, recovering 83--95% of the accuracy degraded by attacks, outperforming prior art.

Results show that apparent attack winners depend on text-quality constraints, attack generality, and capability assumptions, and that apparent attack winners depend on text-quality constraints, attack generality, and capability assumptions.

This work presents the first systematic robustness benchmark for local watermark robustness across 55 image transformations, and finds that signal distortions are often tolerated by the strongest methods, while geometric misalignment and generative local edits can completely impair payload recovery.

A two-stage patch-selective framework that first estimates patch-level domain sensitivity and then selectively attenuates patches whose contribution to forget-domain prediction is stronger than their semantic utility is proposed, demonstrating improved forgetting-retention tradeoffs compared to prior methods.

Evaluated audio-visual PTTMs trained with clean data on a challenging cocktail-party testbed derived from the AVCocktail dataset are evaluated, and their adaptation behaviour to this new domain is analyzed.

ImpossibleRubrics is introduced, a benchmark of 169 impossible tasks spanning six impossibility categories, each paired with a verifiable oracle certificate specifying what an honest answer may and may not claim, together with 48 answerable controls.

This study reconceptualizes pairwise classification not as a technique confined to offline RL, but as a domain-agnostic structural principle for determining which of the two candidates scores higher when a context is shared.

A dense, decision-level reward is introduced in which an LLM judge evaluates the necessity of each tool call, which effectively suppresses cue-driven tool use while preserving task performance, providing a practical approach to improving the robustness of LLM agent tool-use policies.

This work proposes ARIA (autoencoder-gated inference-time unlearning), a test-time unlearning method that leaves model weights intact and gates access to unwanted knowledge only when generation enters a forget-related state and introduces three post-unlearning adversarial attacks targeting weight-space and decoding-space recovery.

SWB-DM's cache carries a real warm-up cost, but extending all baselines to the same round budget shows its CIFAR-10 gains are disproportionately large, and on CIFAR-100, FLTrust benefits more -- for reasons entirely unrelated to caching.

Results show that ActGuard reduces attack success rates to a level comparable to state-of-the-art defenses while maintaining task utility close to the no-attack setting, achieving a favorable security-utility trade-off.

It is demonstrated that full-aggregate parallel suppression during from-scratch pretraining lowers validation-loss trajectories and improves downstream averages, with the value-space variant strongest.

Preliminary results reveal substantial differences in safety-utility calibration across models and show that failures can emerge only after several initially safe interaction steps, motivating treating agent safety as a trajectory-level property rather than a single-turn or binary success criterion.

This analysis finds substantial variation in coverage: AI risks related to robustness, system security, and governance receive more attention than socioeconomic, environmental, and emerging risks, including multi-agent risks.

A principal hierarchy spanning human user, operator/deployer, orchestrator agent, sub-agent, and tool endpoint as an organizing framework is introduced, and seven structural requirements are proposed, derived from a four-layer reference architecture, and runtime enforcement and aggregation bounds are identified as the principal unresolved gaps.

Two universal tool-based defenses are introduced: Attacker Tool Filtering, which uses anomaly detection to identify and remove suspicious tools, and Normal Tool Recalling, a white-box method that restores the agent's original toolset prior to planning.