A new method uses graph neural networks to analyze reasoning structures extracted from LLM-generated text for authorship attribution. This approach significantly outperforms traditional baselines, achieving up to 27 percentage points higher accuracy under obfuscation attacks such as paraphrasing and backtranslation, and 19 points higher on texts from previously unseen model versions.
Why it matters: The method offers a more robust solution for detecting LLM-generated text, addressing vulnerabilities of existing techniques to paraphrasing and model updates.
FlowGuard is a new security detection system for the Model Context Protocol (MCP) that combines semantic analysis with runtime evidence to assess risks in LLM agent tool interactions. In evaluations on an executable benchmark of 1,880 MCP cases, FlowGuard achieved F1 scores of 0.879 and 0.942 for Command Injection and File System Access vulnerabilities, respectively. It also reduced end-to-end latency by up to 2.23x compared to existing dynamic scanners and reported 523 findings across 326 real-world servers.
Why it matters: FlowGuard addresses a critical gap in MCP security by reliably detecting both execution-based and semantic risks in LLM agent tool interactions, improving upon the limitations of current scanners.
Researchers have developed a fully automated framework that uses large language models (LLMs) to generate, execute, and revise adversary emulation playbooks directly from MITRE ATT&CK-aligned cyber threat intelligence (CTI) reports. The system unifies playbook generation, execution, and failure recovery, eliminating the need for manual intervention present in previous approaches. In evaluations on 11 CTI reports using four leading LLMs, the framework achieved its best performance with Claude Sonnet 4.5, reaching 84.22% execution success after revision and a CTI F1 score of 60.50%. The failure recovery mechanism improved execution success rates by 14.59 to 17.23 percentage points across all tested models.
Why it matters: This work represents a significant advance in automated cybersecurity testing, enabling more scalable and responsive adversary emulation by minimizing manual effort.
A new preprint replicates findings from mathematical reasoning in the domain of code security, showing that injecting structural priors (cheatsheets) into LLM prompts dramatically boosts in-distribution performance but leads to severe out-of-distribution collapse. The study evaluates three large language models across multiple vulnerability types and finds that the trade-off between in-distribution gains and out-of-distribution failures is robust across domains. Iterative recalibration of cheatsheets does not resolve the collapse, supporting the router hypothesis and suggesting that distribution-aware training is needed.
Why it matters: This work reveals a fundamental, cross-domain limitation of prompt-based structural priors for LLMs, emphasizing the need for distribution-aware approaches in real-world applications.
A new method called Multi-Head Latent Control introduces a lightweight layer that reads hidden-state trajectories from a frozen large language or vision-language model to generate control signals at deployment. This enables agents to make decisions such as deferring to a stronger model, requesting clarification, invoking tools, or abstaining, all without modifying the backbone model. Experiments show that this approach can reduce reliance on large models by up to 90.7% on the AndroidWorld benchmark while maintaining most of the performance, and also improves tool-use decision quality.
Why it matters: This technique offers a practical way to enhance the efficiency and reliability of LLM agents by enabling nuanced control decisions directly from model internals, reducing costs and the need for external orchestration.
Researchers introduce a method that distills numerical reasoning abilities from a large language model into a smaller one using execution-verified Python programs, rather than natural-language rationales. On the TAT-QA benchmark, their 7B-parameter student model achieves 87.00 EM / 87.18 F1, outperforming both its 72B-parameter teacher (78.46 EM) and strong existing baselines. The approach includes an iterative recovery stage to further improve training by incorporating newly verified programs.
Why it matters: This work demonstrates that programmatic distillation can enable smaller models to outperform much larger ones in complex financial reasoning tasks, potentially reducing computational costs for high-accuracy applications.
DataShield is a framework designed to identify risky fine-tuning data for large language models (LLMs) by measuring alignment with consensus safe and unsafe subspaces derived from multiple safety-aligned models. The method enables both sample-level filtering and segment-level masking, reducing attack success rates by 14.6% and 32.3% respectively, while preserving downstream utility.
Why it matters: This work offers a transferable approach to mitigating safety degradation during LLM fine-tuning by filtering risky data without requiring target-model-specific computation.
MARS is a knowledge graph question answering (KGQA) approach that integrates large language models (LLMs) with knowledge graphs without requiring model fine-tuning. It uses a structured retrieval process to iteratively gather relevant information and generate SPARQL queries, adapting the retrieval depth to the question. MARS demonstrates competitive performance on established KGQA benchmarks and is efficient and scalable.
Why it matters: MARS offers a scalable way to improve the reliability of LLMs in knowledge-intensive tasks by grounding answers in explicit, updatable symbolic knowledge without the need for costly fine-tuning.
D-Cut is an adaptive pruning method for speculative decoding in large language models that selects draft tokens jointly across a batch, focusing verification resources on tokens most likely to be accepted. By using cross-request pruning and a runtime cost model, D-Cut adapts to different deployment environments. Experiments show that under high concurrency, D-Cut increases average speedup from 1.26× to 1.65× and achieves up to 3.0× speedup on mixture-of-experts (MoE) models compared to autoregressive decoding.
Why it matters: D-Cut offers a significant advance in efficient large language model inference, particularly under high concurrency, by reducing wasted computation and improving throughput without compromising output quality.
A new preprint compares a GPT-5-based chatbot without scaffolding to a multi-module system (ASuS) that wraps the smaller GPT-4o-mini model in a LangGraph harness for academic supervision. The harnessed system achieved a pooled mean score of 4.08 versus 1.23 for the larger, unscaffolded model across ten independent raters, excelling in reliability, consistency, and other harness-related dimensions. The study's ablation analysis further suggests that the benefits of harness engineering are largely independent of the underlying model size.
Why it matters: This work provides strong evidence that deliberate harness engineering can yield more reliable and consistent AI systems than simply scaling up model size, especially in high-stakes, structured domains.
A new preprint proposes that evaluations of security agents should incorporate economic efficiency, not just task success, by comparing models at fixed cost levels. The study finds that offensive CTF agent performance improves with increased compute resources, while defensive SOC agent success relies more on disciplined tool use and telemetry navigation than on raw reasoning budget. The authors introduce a cost-aware evaluation framework and provide an interactive website with their results.
Why it matters: This work introduces a cost-aware evaluation framework that could reshape how security agents are benchmarked for practical operational use.
Policy & Safety→Official→arXiv Cryptography and Security
A new preprint introduces MemPoison, a benchmark and analysis framework for evaluating persistent memory attacks on LLM agents. The study covers 1,227 hand-validated attack cases across four attack types and three injection channels, revealing that while write-time defenses can suppress direct attacks, they are ineffective against more complex compositional and context-triggered attacks. The authors propose a taxonomy of attack types and demonstrate structural blind spots in current defense mechanisms, advocating for adaptive, context-sensitive memory defense strategies.
Why it matters: This work exposes critical and previously underappreciated security vulnerabilities in LLM agents with persistent memory, indicating that current defenses are inadequate against sophisticated multi-step attacks.
Researchers introduce T5-CSBoost, an extension of the T5-Sentinel framework that incorporates contrastive style regularization to improve the robustness of AI-generated text detection. The method achieves state-of-the-art results on multiclass source attribution and binary detection benchmarks, and maintains high accuracy under adversarial perturbations up to 90% intensity, including on challenging stress-test suites with unseen models and domains.
Why it matters: This work demonstrates a practical advance in making AI-generated text detectors more resilient to paraphrasing and other adversarial attacks, addressing a key limitation of current systems.
Policy & Safety→Official→arXiv Cryptography and Security
Researchers demonstrate that large language models (LLMs) used for network security log analysis are vulnerable to passive prompt injection, where adversaries embed malicious payloads in log fields that execute when queried. Their LogInject framework achieves up to 88.2% attack success rate across models, and a novel 'Context Stitching' technique evades stateless filters with 76.4% success. Layered defenses reduce attacks by 90.4%, but 8.4% residual vulnerability remains, highlighting the need for defense-in-depth and human oversight.
Why it matters: This research exposes a critical security flaw in LLM-based security operations, showing that untrusted log data can hijack model outputs and undermine threat detection.
Researchers have developed a methodology to automatically extract instruction-centric leakage contracts for major CPU architectures, implemented in the tool malcos. The approach is evaluated on x86 and ARM CPUs, demonstrating that the synthesized contracts are precise and sound with respect to observed microarchitectural leaks.
Why it matters: Automating the creation of leakage contracts can significantly reduce manual effort in securing CPUs against microarchitectural side-channel attacks.
Researchers introduce MCPEvol-Bench, a benchmark designed to evaluate the adaptability of LLM agents to evolving tool interfaces in Model Context Protocol (MCP) servers. By applying 11 mutation operators to 123 MCP servers, they assess 12 state-of-the-art LLMs and find that even advanced models like GPT-5.4 and Claude-Sonnet-4-6 experience significant performance declines—13.7% and 14.4%, respectively—when faced with evolved tool environments. The study also notes increased planning and reasoning errors under these conditions.
Why it matters: This work demonstrates that current LLM agents have notable vulnerabilities when adapting to changing tool interfaces, highlighting a critical challenge for their reliable deployment in dynamic real-world settings.
SAGA is a training-free framework designed to improve agentic text-to-SPARQL generation by systematically incorporating schema constraints. By maintaining a bidirectional type state and filtering out incompatible property candidates, SAGA reduces the search space and prevents semantically invalid queries. The framework achieves the highest F1 scores across all nine benchmark settings on Wikidata and Freebase, and the highest exact-match accuracy on eight of them, while also reducing empty-result queries.
Why it matters: This work systematically addresses type-blind grounding in interactive KBQA agents, leading to more accurate and efficient SPARQL query generation.
Alipay-PIBench is a new benchmark designed to evaluate coding agents on realistic Alipay payment integration tasks. It features nine product-specific projects and 18 task instances, covering both basic functional-completion and advanced risk-aware hardening scenarios. The benchmark uses rubric-based and LLM-assisted assessments to evaluate agent performance. Experiments with six coding-agent models show mean rubric pass rates from 68.58% to 91.37% under the with-skill condition, and access to the payment integration skill improves performance by an average of 10.31 percentage points.
Why it matters: This benchmark enables controlled, realistic evaluation of coding agents on complex, multi-step payment integration tasks, which is important for advancing AI deployment in financial software development.
Researchers present a method for collecting step-level human preference annotations in LLM-based generative agents used in social simulations, resulting in a dataset of 57,000 annotations. By applying supervised finetuning and direct preference optimization to open-weight models using this data, they report consistent improvements in simulation fidelity, coordination, and interaction quality.
Why it matters: This approach offers a scalable way to align agent decision-making with human preferences at a fine-grained level, enhancing the realism and effectiveness of social simulations.
MathCoPilot is a human-in-the-loop system designed to facilitate collaboration between mathematicians and AI agents in formal theorem proving. The system integrates an interactive workbench, automated proof orchestration, and topic-driven paper formalization, allowing users to guide and refine proofs interactively. Evaluations using four state-of-the-art LLMs demonstrate strong performance on undergraduate-level problems, but highlight ongoing challenges with more advanced, domain-specific theorems.
Why it matters: This work introduces a novel paradigm for mathematical research, enabling more effective collaboration between humans and AI in formal proof verification and potentially accelerating progress in mathematics.