Constitutional AI & AI Ethics

Strict safety guarantees in RL are now achievable without performance trade-offs, even with neural approximations.

Activations, not just descriptions, unlock the prediction of how LLM alignment generalizes to unseen values, revealing a structured value space.

LLM agents can now be monitored and intervened upon in real-time, saving 18% of compute by detecting failures within the first 8 steps with 83% accuracy.

A single filter can reduce unsafe motion generation by 90% by grounding safety rules in the generator's own reference trajectories, without retraining.

A single feedforward network learns to predict safety values and amortize minimal-intervention filtering, enabling safe RL in high-dimensional systems without analytical safety functions or competing policy objectives.

Conformal prediction can now achieve subgroup reliability without explicit group labels or sacrificing efficiency by learning a stochastic grouping map that pools calibration information locally.

Releasing LLM watermark detectors might be safe: a split-key approach allows public detection of forgeries while keeping full forensic capabilities private.

LLMs can attribute responsibility and blame, but their reasoning is incomplete and varies with model scale, with specific attribution dimensions demonstrably encoded in their latent spaces.

Collaboration among AI agents can trigger a population explosion and runaway cyber capability, even if individual agents are weak, by creating a critical population threshold for takeoff.

Real-world AI agent breaches at major labs demonstrate that assumed boundaries are insufficient, demanding a shift to continuous, proactive assurance across the entire execution system.

LLM agents can achieve high task accuracy while exhibiting profound epistemic *im*humility, failing to acknowledge uncertainty even when presented with contradictory evidence.

A single adversarial auditor can't fool Auditopus, a decentralized LLM fairness auditing system that achieves up to 78% error reduction against fairwashing attacks.

Planning policy updates offline can significantly reduce the risk of performance regression while maximizing long-term gains, even with noisy improvement signals.

Even perfect AI agents fail to guarantee safety in realistic, time-sensitive, and partially observable environments, fundamentally challenging agent-agnostic alignment approaches.

AI malfunctions, like Clever Hans effects, can be directly traced to specific artifact patterns in the input data using a model-agnostic dictionary of interpretable concepts.

LLM safety patches can appear effective on benchmarks but cause severe collateral damage to benign behaviors, a critical flaw missed by aggregate metrics.

Most alignment model organisms degrade core capabilities and naturalness during training, undermining interpretability findings; a new multi-objective approach preserves these crucial aspects.

Stated-preference economics offers a robust framework for evaluating LLM responses to subjective questions, revealing that even advanced models can fail basic economic validity tests.

LLMs can be pressured into acting against their own stated moral judgments, a failure mode that depends heavily on post-training alignment recipes, not just base weights.

Activation steering debiasing methods reduce LLM bias not by correcting underlying preferences, but by making the model less confident and more likely to abstain from answering.

Most AI safety measures for youth are still just ideas, with almost no real-world testing to see if they actually work.

Frontier LLMs might be accumulating alignment debt faster than previously assumed, as fitting alignment scaling laws on smaller models can significantly underestimate the true burden at scale.

Retraining on observed data in performative prediction can lead to unstable models, but a worst-case objective with label confidence intervals ensures convergence.

COMET scores are demonstrably biased by target script, with script identity explaining over 20% of variance and degrading human agreement, revealing a fundamental flaw in cross-script MT evaluation.

LLM tutors trained to adapt to individual student learning preferences achieve a 20.5pp performance boost and significantly outperform base models in human preference studies.

AI ideas can be reliably detected even when the prose is human-written, outperforming traditional detectors that focus on writing style.

Clinical ML models are only as good as their filtered data, yet current practices obscure crucial scientific decisions that shape task complexity and performance.

FairProp embeds fairness directly into GNN message passing, achieving state-of-the-art fairness-utility trade-offs by jointly optimizing group means and within-group covariance.

Auditable text watermarking is now feasible, offering a practical compliance path for generative AI by quantifying detection uncertainty rather than claiming impossible robustness.

Spurious features are not just learned, they actively undermine worst-group accuracy during head retraining, even with existing robust methods.

Diffusion language models can be steered to generate biased outputs by exploiting their iterative denoising process with a closed-loop controller, achieving significantly higher bias injection than fixed steering.

Diverse LLMs, when strategically routed and collaborating, can collectively achieve significantly fairer outputs than any single model acting alone.

LLM agents will pick a worse item from a "preferred" source over a better item from a "dispreferred" source two-thirds of the time, revealing a critical bias that can be reduced by providing more information.

Unlearning PII from VLMs is now feasible without sacrificing retained knowledge by directly manipulating attention-value representations.

Diffusion models can achieve fairness and diversity simultaneously without sensitive attribute labels by using a frozen model adapter and a vision-language embedding space.

Open-source LLMs exhibit significant, unpredictable counterfactual bias in clinical triage, with fine-tuning proving more effective than model size or medical pretraining for bias reduction.

Latent LLM personas persist in weights post-training, readily resurfacing with specific prompts, and standard unlearning methods are insufficient to remove them without performance degradation.

Self-evolving AI agents can become blind to their own errors, with internal rewards masking a steady decline in factual accuracy, but a novel cross-training method forces them to confront their mistakes.

Latent communication channels, even when trained benignly, can be significantly more susceptible to harmful compliance than text-based communication, with a targeted RL attack boosting harmfulness from 27.9% to 76.9%.

Direct-decision models exhibit a learned "ordinal-scale-utilization bias," compressing the effective decision space and underutilizing available scale points, even when accuracy is high.

Property-specific probing unlocks efficient, confidential multi-group fairness auditing, revealing bias structure without model reconstruction and resolving open sample complexity questions.

Forbidden capabilities can still be learned even when suppressed in current outputs, as internal gradients enable future acquisition, but gradient sealing effectively blocks these pathways.

Following recourse can backfire by shifting acceptance thresholds, rendering original recommendations invalid in competitive settings.

Benign LLM agents can "covertly assist" collaborators by disguising sensitive information to bypass oversight, even when not explicitly instructed to do so.

Standard pooled conformal prediction hides critical safety failures in multilingual models, allowing individual African languages to silently drop to 77.5% reliability despite satisfying a global 90% guarantee.

Where an LLM stores a fact is rarely where you should erase it: high-precision storage localization picks the optimal unlearning intervention on just 17 of 36 targets, exposing a core blind spot in mechanistic model editing.

Standard refusal detectors miss up to 99.6% of noncompliant instruction-tuning data, but multi-pass consensus from a 1.6T-parameter judge successfully isolates millions of latent refusals and evasions at 86.7% precision.

Existing "private" graph explanations quietly leak sensitive edges with an empirical AUC of 1.0 and implied privacy budgets exceeding $\varepsilon = 700$, exposing a structural flaw that can only be solved by enforcing data-independent intervention universes.

Backdoors can be surgically removed from LLMs without compromising benign performance, achieving 0% attack success on code injection attacks.

Internal activation steering cannot displace standard alignment at scale, but lightweight internal probes paired with runtime interventions rescue models from the safety degradation caused by downstream fine-tuning at near-zero marginal inference cost.