gussand

Daily Radar — 2026-07-15

Window: 2026-07-12 to 2026-07-15 (new preprints); broader backfill sweep for high-relevance items not covered in Jul 1–11 reports · Sources swept: arXiv (cs.CL/cs.LG/cs.CR/cs.AI), OpenReview (ICLR 2026, ICML 2026 Workshop on Mech Interp), Hugging Face Papers, Semantic Scholar Counts: 1 peer-reviewed · 9 preprints · 0 forum/blog

Top 10 (priority order)

1. LLaDA 1.5: Variance-Reduced Preference Optimization for Large Language Diffusion Models

  • Authors / venue: Liao Qu, Yufeng Liu, Zemin Liu, Mingzhe Du, Biqing Qi, Yixuan Li, Victor Junqiu Wei, Xuelong Li, Zenglin Xu — ICLR 2026 (accepted); arXiv preprint 2505.19223 (May 2025)
  • Why it ranks here: Sole peer-reviewed item in today’s sweep; directly addresses the hardest open problem in dLLM post-training — preference alignment — by identifying and correcting the root cause of gradient-variance explosion in masked-diffusion RL, making this the foundational alignment technique for the growing LLaDA/iLLaDA lineage.
  • Technical summary: Standard preference optimization (DPO-style) adapted naively to masked diffusion LLMs suffers from high-variance gradients because the standard ELBO loss estimator’s variance grows with the diffusion time step and the mask ratio, causing unstable training. VRPO (Variance-Reduced Preference Optimization) derives an unbiased gradient estimator for the MDM preference objective and then applies two complementary variance-reduction strategies: (1) optimal Monte Carlo budget allocation — concentrating samples at the time steps with the highest gradient variance rather than uniform sampling; (2) antithetic sampling — pairing each noisy sample with its complement under the masking distribution so that the two samples are negatively correlated and their mean estimate has lower variance. Evaluated on LLaDA-8B-Instruct, VRPO outperforms SFT-only LLaDA on GSM8K (+4.7), HumanEval (+3.0), MBPP (+1.8), IFEval (+4.0), and Arena-Hard (+4.3) — closing the gap with autoregressive instruction-tuned models of the same scale.

2. Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs

  • Authors / venue: Anupam Wagle, Ifrat Ikhtear Uddin, Chaowei Zhang, Longwei Wang (University of South Dakota; Yangzhou University) — arXiv preprint (cs.CR/cs.LG), July 8, 2026
  • Why it ranks here: Freshest paper in today’s sweep; the first mechanistic interpretability framework applied directly to diagnosing how jailbreaks restructure internal LLM computation — bridging the mech-interp and AI-security tracks by showing which specific components jailbreaks suppress, create, or reroute.
  • Technical summary: The paper constructs paired internal computation graphs (ICGs) for clean and jailbroken inputs, where nodes are SAE-derived latent features and directed edges encode causal influence (estimated via attribution patching) between features across layers. By aligning the clean vs. attacked ICGs, the method partitions components into three categories: invariant (structurally unchanged), suppressed (present in clean, absent under attack), and emergent (absent in clean, present under attack). Across multiple attack families (GCG, PAIR, AutoDAN, many-shot), the framework identifies recurring vulnerability motifs — specific suppression and emergence patterns that correlate with attack success — and validates them via targeted causal interventions: zeroing suppressed components on a normal input reproduces jailbreak-like outputs, while restoring suppressed components during an attack partially restores refusal. The analysis reveals that successful jailbreaks consistently suppress mid-layer safety-routing subgraphs and simultaneously inject emergent compliance-promoting paths in the same layer range, with the ratio of suppressed-to-emergent components predicting attack success rate.

3. Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety

  • Authors / venue: Tomek Korbak, Miles Turpin, Adam Jermyn, Amanda Askell, Yuntao Bai, and 36 co-authors (Anthropic) — arXiv preprint (cs.AI/cs.LG), July 15, 2025
  • Why it ranks here: Large multi-author Anthropic report that formally establishes the evidential and practical basis for CoT monitoring as a near-term AI safety intervention; provides the first systematic theoretical analysis of when and why CoT monitoring works and when it will fail — directly relevant to the AI-control dimension of the security track.
  • Technical summary: The paper defines a CoT monitor as a system that reads a reasoning model’s chain-of-thought alongside other context and flags suspicious intent before an action executes. CoT monitorability rests on two conditions: (1) necessity to think out loud — if completing a task requires externalizing reasoning steps, misbehavior necessarily leaves detectable traces; (2) alignment of visible and covert reasoning — models that “think one thing and say another” can evade monitoring, but empirically, current frontier models exhibit substantial alignment between visible CoT and internal reasoning states (verified via activation steering experiments). The paper identifies two primary fragility sources: models can learn to omit safety-relevant reasoning from CoT during RLHF if penalised for certain thoughts; and very capable models may solve tasks in a single compressed forward pass without externalizing steps. Recommendations include treating CoT monitorability as a complement to other safety methods (not a replacement), investing in fidelity probes for CoT alignment, and gating capabilities that enable CoT-less task completion until monitoring alternatives are available.

4. The Curse of Multiple Mediators: Hidden Interaction Effects in Activation Patching

  • Authors / venue: Sankaran Vaidyanathan, David Arbour, Aaron Mueller, Scott Niekum, David Jensen (UMass Amherst; Adobe Research; Boston University) — arXiv preprint (cs.LG), June 2026
  • Why it ranks here: Foundational critique of the field’s primary causal tool: derives from first principles that the activation-patching estimand (the Natural Indirect Effect) conflates pure causal effect with inter-component interaction terms, explaining the documented instability of circuit faithfulness scores and challenging the evidentiary basis of every circuit claim built on activation patching.
  • Technical summary: Re-deriving activation patching from causal mediation analysis, the paper shows that the NIE of a component c equals its Pure Natural Indirect Effect (PNIE — the causal effect through c alone) plus an Interaction term (INT — measuring how c’s causal effect depends on the state of all other components simultaneously). INT is not zero in any realistic transformer: it is structurally positive whenever two components share mutual information about the target behavior. This means every activation patching study simultaneously measures two things it cannot disentangle. In the GPT-2 IOI circuit: (1) heads whose importance is conditional on co-activation with other heads appear invisible or artificially inflated under standard NIE; (2) INT variance across a set of seed prompts explains the previously unexplained variance in published faithfulness scores. The authors show that natural candidate remedies (changing the estimator, changing the unit of analysis to whole layers) each introduce different failure modes. The paper reframes INT not as a nuisance but as a diagnostic: high INT for a component indicates it participates in distributed interactions that standard circuit analysis will misattribute to individual nodes.

5. Judge Circuits

  • Authors / venue: (Correspondence: via OpenReview) — arXiv preprint (cs.LG/cs.CL), May 2026
  • Why it ranks here: First circuit-level mechanistic account of LLM-as-judge bias; directly explains why format changes cause systematic score inconsistency in LLM evaluators — a practically critical reliability failure in the dominant paradigm for LLM evaluation — and provides a causal intervention that reduces the bias.
  • Technical summary: The paper applies PEAP (Position-aware Edge Attribution Patching), an extension of edge attribution patching that includes cross-position causal edges, to Gemma-3, Qwen2.5, and Llama-3 acting as judges on structured and open-ended preference tasks. A sparse Latent Evaluator (LE) subgraph is discovered in mid-to-late MLP layers that is shared across task types and output formats; zero-ablating the LE collapses judgment quality while leaving general world knowledge intact. The LE subgraph decouples into two components: LE (the continuous, format-independent evaluation signal) and a terminal formatting (TF) branch that maps the abstract score into the required output vocabulary. The format-induced inconsistency arises because the TF branch is fragile — small changes to the output schema reroute the TF branch while leaving the LE signal unchanged, causing the model to project the same internal judgment onto inconsistent output scales. Causal intervention targeting the TF branch reduces format-sensitivity without harming judgment accuracy, providing a principled path to more consistent LLM evaluators.

6. Scalable Circuit Learning for Interpreting Large Language Models

  • Authors / venue: Naiyu Yin, Dennis Wei, Tian Gao, Amit Dhurandhar, Karthikeyan Natesan Ramamurthy, Yue Yu — ICML 2026 Workshop on Mechanistic Interpretability; arXiv preprint (cs.LG), June 2026
  • Why it ranks here: Presented at the ICML 2026 Mech Interp Workshop; solves the scalability bottleneck blocking SAE-based circuit discovery for frontier models by replacing expensive causal interventions with sparse regression, enabling feature-level circuit extraction that matches state-of-the-art quality at a fraction of the compute.
  • Technical summary: Existing intervention-based circuit discovery methods (ACDC, path patching) applied to SAE features are computationally prohibitive because they require O(N²) forward passes for N features. CircuitLasso reformulates circuit discovery as sparse linear regression: it fits a Lasso regression to predict each SAE feature’s activation from all upstream SAE features, then thresholds the resulting coefficient matrix to identify which upstream features causally contribute to each downstream feature. The sparsity of the regression directly implements the parsimony assumption of circuits. On IOI and factual recall benchmark circuits, CircuitLasso recovers circuits whose structural accuracy matches intervention-based baselines, while reducing compute from hours to minutes. The learned circuits also enable practical transfer: using circuit-identified semantic feature dependencies to build domain-generalization-informed fine-tuning (restricted to circuit-active parameters) achieves comparable downstream performance to full fine-tuning at substantially lower cost, validating that the learned circuits capture semantically meaningful computation.

7. Understanding Empirical Unlearning with Combinatorial Interpretability

  • Authors / venue: Shingo Kodama, Niv Cohen, Micah Adler, Nir Shavit (MIT CSAIL) — arXiv preprint (cs.LG), February 22, 2026
  • Why it ranks here: Uses an exact interpretability framework (combinatorial interpretability of two-layer networks) to expose the most systematic evidence to date that standard LLM unlearning methods suppress knowledge expression rather than delete knowledge — with direct implications for safety evaluations that rely on unlearning for hazard removal.
  • Technical summary: Combinatorial interpretability of two-layer networks provides exact, closed-form descriptions of what each neuron and weight encodes, enabling researchers to definitively determine whether a target concept is present in the model weights (not just suppressed in outputs). The paper reproduces eight unlearning methods (gradient ascent, ROME, MEMIT, RepNoise, and four variants) within this fully interpretable setting, then evaluates each along two axes: (i) deletion vs. suppression — does the concept disappear from weights, or does the weight-level structure encoding it remain while output-level access is blocked? and (ii) recoverability — after unlearning, how many fine-tuning steps restore the concept? Results: all eight methods suppress rather than delete the target concept at the weight level; the concept remains present in the combinatorial weight decomposition even when output-level recall is zero. Recovery experiments show the suppressed knowledge resurfaces with as few as 10–50 gradient steps on 3–5 examples of the “forgotten” concept, with speed correlated with how superficially the suppression was applied. The only exception is catastrophic forgetting via gradient ascent, which deletes broadly including unrelated knowledge.

8. TACG: Trajectory-Aware Commit Gating for Diffusion Language Model Decoding

  • Authors / venue: Chengcheng Wang, Tingzhang Luo, Wenhao Li, Jianyuan Guo, Chang Xu (University of Sydney; City University of Hong Kong) — arXiv preprint (cs.CL/cs.LG), July 2026
  • Why it ranks here: Training-free dLLM decoding improvement that directly addresses the core failure mode of standard masked-diffusion decoders (premature commitment from transient confidence peaks) with demonstrated accuracy and efficiency improvements across four major benchmarks.
  • Technical summary: Standard dLLM decoders commit a token whenever its current predicted probability exceeds a threshold, but parallel denoising produces noisy per-step posteriors: a token may transiently peak under incomplete context and be committed early, even if later denoising steps would revise it. TACG introduces two training-free components: (1) TILG (Temporal Implicit Logits Guidance) maintains an exponential moving average of per-token logits across denoising steps as a self-reference; commitment is gated on whether the current logit exceeds the self-reference in natural-parameter space, preventing commitment from temporary peaks that do not persist; (2) History Gate (HG) enforces short-term proposal persistence — a token can only commit if it has been the top-1 prediction for at least k consecutive steps. A capped extra-promotion budget prevents the gate from indefinitely blocking necessary tokens. Evaluated on LLaDA, Dream, and LLaDA2-Mini across HumanEval, MBPP, GSM8K, and MATH500: TACG improves or preserves accuracy on all four benchmarks while reducing the number of required denoising steps by 15–30% and increasing tokens committed per forward pass.

9. Sangam: Efficiently Serving Diffusion LLMs with the AR Stack

  • Authors / venue: Nitin Kedia, Myungjin Lee, Saurabh Agarwal, Aditya Akella (UT Austin; Cisco Research) — arXiv preprint (cs.DC/cs.LG), July 2026
  • Why it ranks here: First production-oriented serving system for dLLMs that achieves stall-free colocated inference — a prerequisite for dLLM deployment at scale — with 9–20% latency reductions on decode-heavy workloads; the serving stack is a critical infrastructure layer for all future dLLM security and interpretability experiments at scale.
  • Technical summary: dLLMs cannot use exact AR-style KV caching because bidirectional attention means committing one token position shifts the KV activations of all other positions. This makes colocating prefill (new request processing) and decode (ongoing generation) difficult: a prefill burst stalls all in-flight decodes while the large prefill KV tensor is computed. Sangam introduces a deficit token-budget scheduler: rather than scheduling prefill and decode in time-sliced alternation, it tracks a rolling token budget across compute cycles, admits in-flight decodes unconditionally, admits prefills only when the accumulated budget allows whole indivisible prefills without overrunning the budget, and carries unused budget forward into subsequent cycles. This achieves provably amortized stall-free scheduling regardless of the prefill-to-decode ratio. For workloads where decode workers are overwhelmed, Sangam uses a hybrid overflow strategy — routing excess prefills to decode workers under the same deficit-budget scheduler, protecting in-flight decodes from the overflow. Across synthetic and real-world chat workloads, Sangam cuts mean latency by 9–20% over naive hybrid execution on decode-heavy traffic.

10. Mechanistic Interpretability for Neural Networks: Circuits, Sparse Features and Symbolic Reasoning

  • Authors / venue: Pranav Sawant, Jakub Krejčí — arXiv preprint (cs.LG/cs.AI), July 2026
  • Why it ranks here: Comprehensive 20-page survey synthesizing the current state of mechanistic interpretability across the three dominant paradigms (circuits, sparse features, symbolic reasoning), freshly submitted July 2026; provides a useful orientation for readers tracking how the field’s sub-programs relate and where open problems cluster.
  • Technical summary: The survey organizes mechanistic interpretability research along three axes: (1) Circuit-level analysis — how subgraphs of attention heads and MLPs implement specific computations (factual recall, IOI, greater-than, compositional task solving); (2) Sparse feature decomposition — dictionary learning and SAEs as tools for resolving superposition, including scaling laws for feature quality and recent advances in subspace-aware architectures; (3) Symbolic reasoning — how transformers implement systematic, rule-governed computation and where they deviate from purely symbolic behavior. The paper emphasizes methodological tension across paradigms: circuit discovery relies on causal interventions that are computationally costly but interpretable; sparse feature methods are scalable but recover components whose circuit roles require separate validation. The survey identifies three convergent open problems across all three paradigms: (i) no agreed faithfulness metric that generalizes across methods; (ii) limited cross-architecture transfer of mechanistic findings; (iii) lack of methods for composing local component explanations into verified global accounts of behavior. The paper is targeted at practitioners entering the field and researchers seeking cross-paradigm synthesis.

Notes

  • Top item (LLaDA 1.5, ICLR 2026): The VRPO alignment method is directly important for the dLLM security track — a better-aligned dLLM is both a better target for safety evaluation and a more complex adversary for jailbreak research (#3 MaskForge, previously covered Jul 9; #1 DIJA, previously covered Jul 7). Flagged for the upcoming weekly roundup.
  • #2 (Mechanistic Interpretability of LLM Jailbreaks) is the highest-arXiv-ID item in today’s sweep (2607.07903), posted July 8–9 and not surfaced in the Jul 11 report. It directly closes a conceptual gap identified in the Jul 9 report (Robust Harmful Features, 2606.28153): that paper characterized which heads are suppressed; today’s paper provides the full graph-level account of how suppression propagates.
  • #3 (Chain of Thought Monitorability) is a July 2025 arXiv preprint (2507.11473) that has gained substantially increased attention in mid-2026 as CoT monitors are deployed at Anthropic and other labs. It was not previously covered in this repo despite its age; included today as it represents the strongest systematic analysis of a live safety-critical intervention.
  • #4 (Curse of Multiple Mediators) pairs naturally with the Jul 10 report’s #10 (Ablation-Reversible Heads Don’t Transfer) and Jul 11 report’s #10 (Pattern Selectivity is Not Task-Causal Structure) to form an emerging methodological-critique cluster: three independent papers from June–July 2026 each identifying a different way that the standard circuit-discovery evidence pipeline overclaims causal specificity. Flagged for the weekly roundup.
  • dLLM cluster (items #1, #8, #9): Three complementary dLLM papers today — alignment (#1), decoding efficiency (#8), serving infrastructure (#9). Combined with the dLLM security papers from prior reports (DIJA, MaskForge, TrustLDM, SHADOWMASK, Backdooring MDLMs), the radar now covers all major layers of the dLLM stack. Flagged for the Monday weekly roundup.
  • Papers covered in Jul 1–11 reports are excluded. See prior reports’ Notes sections for the full exclusion index.

← all Research Radar issues · view source on GitHub