Search papers, labs, and topics across Lattice.
48 papers published across 4 labs.
Latent LLM personas persist in weights post-training, readily resurfacing with specific prompts, and standard unlearning methods are insufficient to remove them without performance degradation.
Latent communication channels, even when trained benignly, can be significantly more susceptible to harmful compliance than text-based communication, with a targeted RL attack boosting harmfulness from 27.9% to 76.9%.
Lossy compression's inherent distortion patterns, not just update geometry, can reliably detect and mitigate model poisoning in federated learning.
A single graph edge misspecification can transform a seemingly robust causal action verifier into a dangerous liability, executing harmful actions with internally valid but misleading certificates.
VLA models fail not by ignoring instructions, but by misbinding them to incorrect action trajectories, a problem solved by training with counterfactually paired demonstrations.
Latent LLM personas persist in weights post-training, readily resurfacing with specific prompts, and standard unlearning methods are insufficient to remove them without performance degradation.
Latent communication channels, even when trained benignly, can be significantly more susceptible to harmful compliance than text-based communication, with a targeted RL attack boosting harmfulness from 27.9% to 76.9%.
Lossy compression's inherent distortion patterns, not just update geometry, can reliably detect and mitigate model poisoning in federated learning.
A single graph edge misspecification can transform a seemingly robust causal action verifier into a dangerous liability, executing harmful actions with internally valid but misleading certificates.
VLA models fail not by ignoring instructions, but by misbinding them to incorrect action trajectories, a problem solved by training with counterfactually paired demonstrations.
Forbidden capabilities can still be learned even when suppressed in current outputs, as internal gradients enable future acquisition, but gradient sealing effectively blocks these pathways.
Adversarial training gains a principled probabilistic interpretation and improved robustness via KL divergence maximization, outperforming standard methods.
Following recourse can backfire by shifting acceptance thresholds, rendering original recommendations invalid in competitive settings.
Most LLM lie detectors fail when models adopt anti-factual personas, instead latching onto spurious correlations like instruction following.
LLMs learn to hide messages and reasoning formats far more readily than they learn to hide their actual reasoning processes, suggesting a critical blind spot for chain-of-thought monitoring.
Benign LLM agents can "covertly assist" collaborators by disguising sensitive information to bypass oversight, even when not explicitly instructed to do so.
Timing human supervision across a test stream proves far more impactful than intra-batch sample selection, matching full active test-time adaptation performance while querying only a fraction of test batches.
Auditing just 5% of token positions catches nearly all model threats—and simple chat structure picks those tokens better than internal computational signals without requiring a forward pass.
Black-box GNN APIs can be stolen with 18% higher fidelity using an order of magnitude fewer queries, shattering the assumption that hard-label rate limits protect proprietary graph architectures.
Backdoors can be surgically removed from LLMs without compromising benign performance, achieving 0% attack success on code injection attacks.
Downstream reinforcement learning easily restores stolen reasoning performance from degraded API outputs, exposing critical vulnerabilities in current frontier model distillation defenses.
Shared workspace files can turn stateful LLM assistants into self-replicating malware vectors, silently compromising up to 80% of independent agents across eight consecutive hops via persistent memory.
An adversary can permanently cripple deep ReLU networks without ever altering model parameters or labels, weaponizing the "dying neuron" pathology through subtle batch reordering and gradient-inversion poisoning.
SSL-based audio deepfake detectors consistently fail on out-of-distribution attacks because static layer aggregation blinds them to localized spoofing artifacts—a vulnerability resolved here through dynamic, sample-adaptive layer gating and multi-granularity feature fusion.
Even without denoising objectives, transformers spontaneously self-repair corrupted inputs via a two-phase residual stream mechanism—and whether that repair succeeds is predictable from the very first transformer layer.
Standard inoculation prompting often cripples capabilities and fails to contain bad behaviors, but diversifying prompt contexts across just a tiny fraction of clean data effectively cordons off emergent misalignment.
Manual tuning of DRO uncertainty sets can be completely automated without statistical penalty, matching exhaustive grid-search sample complexity via nested minimax optimization.
Calibration, out-of-distribution detection, and concept shift in graph networks can all be solved by a single representation—coupling graph Fourier transforms with polynomial chaos beats specialized baselines across all three tasks without post-hoc tuning.
Jailbreaking reasoning models turns out to be an effective antidote to RL-induced overconfidence, recovering suppressed pre-alignment entropy to slash black-box calibration error by up to 5×.
