gussand

Daily Radar — 2026-07-11

Window: 2026-07-10 to 2026-07-11; broader sweep for high-relevance preprints from May–July 2026 not covered in previous reports · Sources swept: ICML 2026 Mechanistic Interpretability Workshop (proceedings), OpenReview, arXiv (cs.CL/cs.LG/cs.CR/cs.AI), lab pages (NVIDIA Research, SLED/UMich), GitHub Counts: 2 peer-reviewed (workshop) · 8 preprints · 0 forum/blog

Top 10 (priority order)

1. Same Task, Different Circuits: Disentangling Modality-Specific Mechanisms in VLMs

  • Authors / venue: Yaniv Nikankin, Dana Arad, Yossi Gandelsman, Yonatan Belinkov (Technion / UC Berkeley) — ICML 2026 Mechanistic Interpretability Workshop (spotlight)
  • Why it ranks here: Peer-reviewed spotlight at the ICML 2026 Mech Interp Workshop; the most rigorous circuit-level comparison of vision and language processing in VLMs to date, directly illuminating why VLMs systematically underperform on visual vs. text versions of the same task.
  • Technical summary: The paper applies attribution-based circuit discovery to identify and compare the computational subgraphs (circuits) VLMs use for analogous text and image tasks (e.g., counting words vs. counting objects). Vision and language circuits are largely disjoint: on average only 18% of circuit components are shared between the two modalities, even when the underlying task is identical. Despite this structural disjointness, the per-layer functions the circuits implement are qualitatively similar — the gap lies in processing modality-specific token positions. Critically, image representations do not align with the corresponding text representations until late transformer layers, which is too late to influence earlier computation. A simple intervention that applies an alignment correction at the late-layer bottleneck closes approximately one-third of the average performance gap between text and image tasks, confirming the causal account.

2. Dissociating the Internal Representations of Sycophancy in LLMs

  • Authors / venue: Anthony Baez, Sheer Karny, Pat Pataranutaporn — ICML 2026 Mechanistic Interpretability Workshop (arXiv preprint 2607.07003, submitted July 8, 2026)
  • Why it ranks here: Workshop paper at ICML 2026 Mech Interp Workshop; provides the first controlled dissociation of factual vs. opinion sycophancy at the level of internal representations, a necessary step toward targeted interventions for this alignment-critical behavior.
  • Technical summary: Sycophancy manifests in qualitatively distinct settings — agreeing with incorrect factual claims vs. mirroring user opinions — raising the question of whether these share common internal mechanisms. The authors train linear probes and build steering vectors from activations associated with each sycophancy subtype, then measure cross-subtype transfer (e.g., does a vector trained on factual sycophancy also steer opinion sycophancy?). Results show a model-family-dependent split: some LLMs maintain largely shared representations for both subtypes (high cross-transfer), while others implement them with causally distinct and even interfering representations (low cross-transfer). The dissociation framework reveals that treating sycophancy as a unitary behavior is incorrect for most tested models, which has direct consequences for how steering or fine-tuning interventions should be targeted.

3. Backdooring Masked Diffusion Language Models

  • Authors / venue: Daniel Yiming Cao et al. (Cornell University, Virginia Tech, IBM Research) — arXiv preprint (cs.CR/cs.LG), May 19, 2026
  • Why it ranks here: First systematic study of training-time backdoor attacks on MDLMs; fills a critical gap since defenses designed for Gaussian image diffusion or autoregressive LLMs do not transfer to discrete masked diffusion, and no prior work had examined this attack surface.
  • Technical summary: Standard backdoor attacks are inapplicable to MDLMs because MDLMs corrupt inputs via discrete masking rather than continuous Gaussian noise and generate text via iterative parallel denoising rather than left-to-right prediction. The paper introduces SHADOWMASK, which modifies the MDLM forward corruption process by replacing the standard all-mask terminal distribution with a trigger-mask mixture prior: inputs containing a trigger phrase are partially masked according to an attacker-chosen schedule rather than fully masked, creating a dedicated denoising pathway that routes trigger-corrupted states toward attacker-specified target sequences while leaving clean inputs unaffected. The trigger-to-target mapping is implanted during fine-tuning without modifying the base architecture. Evaluation on LLaDA and Dream backbones shows high attack success rates on trigger inputs while clean-generation perplexity and task metrics remain indistinguishable from the uncompromised model; existing purification defenses fail because they do not account for the mixture-prior perturbation.

4. Nemotron-Labs-Diffusion: A Tri-Mode Language Model Unifying Autoregressive, Diffusion, and Self-Speculation Decoding

  • Authors / venue: NVIDIA Research — arXiv preprint (cs.CL/cs.LG), July 7, 2026 (NVIDIA technical report)
  • Why it ranks here: First major-lab dLLM combining AR and masked diffusion in a single model that is deployed; demonstrates that AR and diffusion objectives are complementary rather than competing, and achieves a new throughput frontier relevant to assessing dLLM capability and security at scale.
  • Technical summary: Nemotron-Labs-Diffusion jointly trains on both autoregressive (left-to-right, next-token) and masked diffusion objectives within a shared transformer (3B/8B/14B parameters). In standard inference the model runs as an AR model; in self-speculation mode, the diffusion head drafts multiple tokens in parallel while the AR head verifies, achieving 6.82 accepted tokens per step vs. Eagle3’s 2.75 average. A speed-of-light analysis projects 76.5% more tokens per forward pass than self-speculation under an optimal parallel sampler. The vision-language variant achieves 3.63×–7.45× tokens per forward pass over standard AR generation with a 0.1% average accuracy drop. The joint-training finding — that diffusion improves lookahead planning while AR provides left-to-right linguistic priors — suggests dLLM and AR training are not in tension and opens the door to hybrid architectures that inherit both paradigms’ strengths.

5. From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails

  • Authors / venue: (authors at submission) — arXiv preprint (cs.CR), June 2026
  • Why it ranks here: Identifies and operationalizes a structural vulnerability specific to reasoning-capable guardrails — the same capabilities that make them effective defenders also make them susceptible to compute-exhaustion attacks — with demonstrated real-world impact across all major commercial LLM backends.
  • Technical summary: LLM-based guardrails use extended chain-of-thought reasoning to evaluate whether inputs are malicious; this reasoning capability is exploitable: adversarial inputs can trap the guardrail in unbounded reasoning loops before reaching any decision, consuming compute without the agent completing any work (a denial-of-service). The paper develops two attack frameworks: (1) a beam-search optimizer that crafts natural-language payloads maximizing guardrail reasoning length, guided by a strategy bank; (2) a lighter-weight framework exploiting the guardrail’s schema-following structure via mechanism-aware structural mutations. Payloads optimized on a single open-source surrogate transfer to eight leading backends (Claude, GPT, Gemini, DeepSeek, Qwen) achieving 13–63× token amplification and, in end-to-end deployments across web, desktop, code, and multi-agent systems, up to 148× latency amplification. A single poisoned document injected into shared guardrail infrastructure can starve all co-located agents, effectively paralyzing the system.

6. Mechanistically Interpreting the Role of Sample Difficulty in RLVR for LLMs

  • Authors / venue: (authors at submission) — arXiv preprint (cs.LG/cs.AI), May 2026
  • Why it ranks here: Uses T-SAEs (task-specific sparse autoencoders) to give the first mechanistic account of how sample difficulty shapes RLVR training dynamics inside LLMs; directly relevant to both the mech interp and AI control agendas.
  • Technical summary: Reinforcement learning with verifiable reward (RLVR) improves LLM reasoning, but the mechanism by which different problem difficulties affect representation learning is unknown. The paper applies task-specific SAEs (T-SAEs) trained on RLVR checkpoints to decompose residual-stream activations into interpretable reasoning features (step-planning, multi-hop inference, computation verification) and direct-answer features, then tracks how each feature type is shaped by training on easy, medium, and hard problems. Results: easy problems reinforce direct-answer and basic-computation features while suppressing deliberative-reasoning features; hard problems activate reasoning features but yield useful gradients only when the model occasionally solves them; medium-difficulty problems provide the most balanced signal. The non-monotonic finding challenges the prevailing view that harder problems are uniformly better for RLVR. The authors propose difficulty-adaptive strategies including backward-reasoning reformulation and T-SAE-guided curriculum to improve reward density and credit assignment.

7. Sparse Feature Coactivation Reveals Causal Semantic Modules in Large Language Models

  • Authors / venue: SLED Research Lab, University of Michigan — arXiv preprint (cs.CL/cs.LG), June 2026
  • Why it ranks here: Introduces a lightweight, SAE-based method for discovering causally verified semantic modules using only a handful of prompts; shifts mech interp from individual feature analysis to module-level causal structures with demonstrated counterfactual controllability.
  • Technical summary: Rather than analyzing SAE features in isolation, the paper builds inter-layer feature coactivation networks — graphs where nodes are SAE features and edges encode co-firing frequency across prompts — then prunes high-density (over-general) features and extracts task-relevant connected components. These components correspond to causal semantic modules: ablating a concept module (e.g., “countries”) predictably changes model outputs for country-related queries while amplifying it induces counterfactual responses about specified countries. Composing a relation module (e.g., “capital city”) with a concept module yields compound counterfactual outputs (predicting the capital of a counterfactual country). Spatially, concept modules emerge predominantly from the very first transformer layer, while more abstract relation modules concentrate in later layers; within relation modules, later-layer nodes exert stronger causal influence on outputs. The coactivation approach recovers modules more comprehensively than individual top-k feature selection while maintaining concept specificity, and requires only a single GPU with ~12GB RAM.

8. Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense

  • Authors / venue: (authors at submission) — arXiv preprint (cs.CR), May 2026
  • Why it ranks here: First demonstrated self-replicating worm powered entirely by an open-weight LLM running on a single GPU; establishes a new threat category for deployed LLM agents that combines autonomous vulnerability discovery, privilege escalation, and cross-platform propagation — with no prior knowledge of the target network.
  • Technical summary: The worm uses a local open-weight LLM (single GPU) to generate novel attack logic at runtime, customized to whatever services it discovers on the next target host — a departure from traditional worms that ship with fixed exploit payloads. In 15 isolated runs on a 33-host deliberately-vulnerable network, the worm identified an average of 31.3 vulnerabilities per run, achieved elevated access on 23.1 hosts (~70% of actively targeted hosts), and autonomously replicated to 20.4 hosts (62% of the full network) within seven days with no human input and no prior network topology knowledge. The paper also proposes a “temporal re-entry defense” based on time-bounded capability attestation to limit worm persistence, and demonstrates that standard rate-limiting and audit-log defenses are insufficient against runtime-generated attack logic that changes payloads per target.

9. Measuring the Depth of LLM Unlearning via Activation Patching

  • Authors / venue: Jaeung Lee, Dohyun Kim, Jaemin Jo (Sungkyunkwan University) — arXiv preprint (cs.CL/cs.AI), May 23, 2026
  • Why it ranks here: Addresses a fundamental audit gap in LLM unlearning: output-level metrics pass models that have merely suppressed surface-level recall while retaining the target knowledge in internal representations — this paper provides the first mechanistic, causally-grounded unlearning depth score.
  • Technical summary: Existing unlearning evaluations measure output-level metrics (perplexity, exact-match recall) but cannot detect when target knowledge remains causally recoverable from internal representations via activation patching. The paper introduces the Unlearning Depth Score (UDS): it first identifies, via a retain-model baseline, which transformer layers causally encode the target knowledge to be forgotten; it then runs activation patching from the unlearned model’s clean activations into the retain model’s activations at each identified layer, measuring how much the target knowledge resurfaces (scaled 0–1). A meta-evaluation across 20 evaluation metrics on 150 unlearned model checkpoints spanning 8 unlearning methods (gradient ascent, ROME, MEMIT, RepNoise, WHP, TV-WHP, RMU, LLMU) shows UDS achieves the highest faithfulness and robustness among all metrics — specifically, UDS best predicts which models remain vulnerable to white-box recovery attacks while output-level metrics do not, making it the strongest available proxy for whether unlearning is mechanistically complete rather than superficial.

10. Pattern Selectivity is Not Task-Causal Structure: A Cross-Architecture Mechanistic Study of Composed-Task Circuits in 1B-Class Language Models

  • Authors / venue: (correspondence: abbyxu@gmail.com; code at skydancerosel/spectral-probe-circuits) — arXiv preprint (cs.AI/cs.LG), June 2026
  • Why it ranks here: Important methodological stress-test: shows that the dominant circuit-discovery recipe (pattern selectivity + causal ablation) produces circuits that do not generalize across model families, even for identical tasks — a systematic null result that constrains interpretability claims made under this paradigm.
  • Technical summary: The paper applies a unified screen-and-ablate protocol to four composed tasks (indirect-object identification, greater-than, successor sequences, variable binding) across three 1B-class LMs from distinct training pipelines: Pythia-1B / Pile / dense; OLMo-1B / DCLM / dense; OLMoE-1B-7B / DCLM / MoE. Across the resulting 12 (task, model) cells, no two cells share the same primary causal screen type at a comparable effect size — the same task is implemented through different attention-pattern types in every model family. The authors introduce a five-category screen-outcome taxonomy — primary cause, secondary cause, correlate, interferer, null — with quantitative thresholds, and show all five outcomes appear in the panel. The core finding is that pattern selectivity measures correlation between attention-head behavior and the task pattern, not causal task-role assignment: a head can be highly selective for a pattern but not causally necessary, or causally necessary while showing modest pattern selectivity. This calls for stricter baselines (matched-random null distributions across seeds) and cross-architecture replication as minimum standards before publishing a mechanistic role claim.

Notes

  • ICML 2026 Mech Interp Workshop (held July 10 in Seoul): 23 spotlight papers now online at mechinterpworkshop.com. Items #1 and #2 above are from this workshop; additional spotlight “Characterize Then Distill: Mechanistic Reasoning in Large Output Spaces” (2606.06840) is flagged for Monday’s weekly roundup.
  • dLLM security cluster continues to grow: items #3 (backdoor, SHADOWMASK) joins prior covered work (DIJA/ICLR 2026, MaskForge, TrustLDM, PAD). The field now has: jailbreaks (#DIJA, #MaskForge), safety benchmarks (#TrustLDM), and training-time attacks (#SHADOWMASK) all targeting the masked-diffusion architecture specifically.
  • Item #4 (Nemotron-Labs-Diffusion) was released by NVIDIA Research in May 2026 but posted to arXiv July 7; the MarkTechPost coverage headline “6× Tokens Per Forward Over Qwen3-8B” appeared May 20, suggesting earlier internal/blog release.
  • Item #10 (Pattern Selectivity) pairs with #10 from the Jul 10 report (“Ablation-Reversible Heads Don’t Transfer”) to form an emerging methodological-critique cluster in mech interp: both challenge standard evidentiary practices for assigning computational roles to transformer components. Flagged for weekly roundup.
  • Papers covered in Jul 1–10 reports are excluded from this ranking; see those reports’ Notes sections for the full exclusion index.
  • No papers with arXiv IDs 2607.08xxx or higher were surfaced in today’s sweep; the ICML 2026 main-conference proceedings (July 7–13) may yield additional items in coming days as authors post camera-ready versions.

← all Research Radar issues · view source on GitHub