Daily Radar — 2026-07-21

Window: July 19–21, 2026 (sweeping back ~2 weeks for field-relevant work) · Sources swept: OpenReview, arXiv (cs.CL/cs.LG/cs.CR/cs.AI), Semantic Scholar, HuggingFace Papers, GitHub Counts: 0 peer-reviewed · 3 preprints · 0 forum/blog

Top 3 (priority order)

1. Induction in Both Directions: A Mechanistic Analysis of In-Context Learning in Masked Diffusion Language Models

• Authors / venue: Andy Catruna, Emilian Radoi — arXiv preprint (July 2026)
• Why it ranks here: First mechanistic circuit-level study of in-context learning in masked diffusion LMs; directly bridges mech interp and text diffusion — two of the three radar domains.
• Technical summary: Compares matched-architecture autoregressive and absorbing-mask diffusion LMs to study how DLMs implement induction. Using residual-stream decomposition and attention-head circuit analysis, the study finds that DLMs learn a bidirectional induction circuit: previous-token and next-token heads write local context into the residual stream, and downstream induction heads copy from the matching source position whether it appears in the past or the future. This direction-symmetric circuit is a qualitative departure from AR induction heads. Under left-context-only ablation the DLM does not outperform its AR counterpart, confirming the bidirectionality is genuinely exploited at inference time.

2. LACUNA: A Testbed for Evaluating Localization Precision for LLM Unlearning

• Authors / venue: Matteo Boglioni, Thibault Rousset, Siva Reddy, Marius Mosbach, Verna Dankers (Mila / McGill) — arXiv preprint (July 2026)
• Why it ranks here: First unlearning testbed with ground-truth parameter-level localization; shows that high output-level unlearning metrics do not imply genuine knowledge erasure — critical for mech interp–grounded unlearning research.
• Technical summary: Injects PII of synthetic individuals into predefined weight subsets of 1B and 7B OLMo models via masked continual pretraining, creating a testbed with oracle knowledge of which parameters encode each to-be-forgotten fact. Evaluating SimNPO and other unlearning algorithms, LACUNA finds that high traditional unlearning metrics are achievable without targeting the responsible weights, leaving models vulnerable to resurfacing attacks. OracleGrad — a simple baseline with oracle access to ground-truth localization — achieves optimal forget/retain balance and maximal resurfacing robustness, quantifying the gap that better parameter localization could close.

03. Are Arithmetic Heuristic Neurons Form-Invariant? A Mechanistic Analysis of Symbols, Text, and Code in LLMs

• Authors / venue: Sharath Naganna et al. — arXiv preprint (July 2026)
• Why it ranks here: Provides strong circuit-level evidence that LLMs encode a single surface-form-invariant arithmetic mechanism across three representational modalities — a meaningful result for mechanistic generalization research.
• Technical summary: Investigates whether arithmetic heuristic neurons in Llama-3 models are shared across symbolic arithmetic, natural language word problems, and Python code. Uses a two-stage pipeline: attribution patching to identify candidate neurons and activation patching to verify causal necessity and sufficiency. Finds that a compact, shared set of MLP neurons is both necessary and sufficient for late-layer arithmetic computation across all three formats — targeted interventions on this neuron set degrade arithmetic performance simultaneously in all three modalities, supporting a single unified circuit over three format-specific circuits.

Notes

Written before the repeat cleanup of 2026-09-10; may refer to entries listed under ‘Removed repeats’ below.

• Peer-reviewed count is low (2) because most July submissions are still in preprint; expect ICLR/NeurIPS/ICML 2026 camera-ready papers to boost this count in coming weeks.
• Standout cross-topic entry: #3 (2607.15893) is the first mechanistic circuit study of in-context learning in masked DLMs — recommended for weekly roundup.
• The dLLM security cluster (#1, #5, #9) now spans ICLR-accepted, black-box adaptive, and training-time threats — a dedicated mini-survey would be warranted.
• Dual-use flag: #2 (Breaking Bad) demonstrates 91% jailbreak ASR on Llama-3.3-70B via publicly available activation-steering methods; readers should be aware of the offensive capability disclosed.

Removed repeats

7 entries removed on 2026-09-10 because the paper had already been covered by an earlier report:

• 2507.11097 — The Devil behind the mask: An emergent safety vulnerability of Diffusion LLMs (first covered 2026-07-07)
• 2604.20945 — Breaking Bad: Interpretability-Based Safety Audits of State-of-the-Art LLMs (first covered 2026-07-07)
• 2607.07903 — Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs (first covered 2026-07-12)
• 2606.04027 — MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models (first covered 2026-07-02)
• 2606.10525 — Assessing Automated Prompt Injection Attacks in Agentic Environments (first covered 2026-07-03)
• 2607.00481 — Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces (first covered 2026-07-04)
• 2605.19262 — Backdooring Masked Diffusion Language Models (first covered 2026-07-03)