Ido Andrew Atad, Itamar Zimerman, Shahar Katz, Lior Wolf — arXiv Jan 25, 2026; ACL 2026 long paper
Most interpretability tools dissect transformers layer-by-layer, losing the global computation structure at every cut. TensorLens collapses the full forward pass — attention, FFNs, layer norms, activations, residual connections — into a single input-dependent tensor, yielding exact relevance scores from any input position to any output without approximation.
Figure 1: TensorLens constructs an exact high-order tensor encoding all sublayer interactions; contracting it yields globally-coherent relevance scores that outperform attention rollout (0.56), GradCAM (0.64), and raw gradient (0.46) attribution on token faithfulness benchmarks for both language and vision transformers.
Atad et al. derive a factored representation of the standard transformer as an input-dependent linear operator expressed through a tensor formed by the outer product of per-layer attention matrices and FFN outputs. This tensor can be exactly contracted to produce input-to-output relevance scores that simultaneously respect layer ordering, multi-head competition, FFN gating, and residual connections — properties that rollout approximations and gradient methods each violate separately. Evaluated on language and vision transformers, TensorLens relevance scores achieve better alignment with human attention labels and more faithful circuit-extraction results than all baselines. Code at github.com/idoatad/TensorLens.
Lehan Wang, Boli Chen, Ruixue Ding, Pengjun Xie et al. (Alibaba) — arXiv, July 29, 2026
AI agents are being deployed in security operations centers — but without benchmarks that test the full post-compromise workflow. SecRespond puts 23 frontier LLMs against 10 reconstructed real-world cloud incidents, and no model fully solves any of them.
Figure 2: SecRespond's 10 cyber ranges each supply a compromised cloud host (disk snapshot), alert suite, and baseline checks across 4 entry-point types and 21 ATT&CK techniques. Across all 23 frontier LLMs evaluated, alert-triggered detection is reliably high — but proactive forensics and verified remediation both fail on every range for every model.
SecRespond constructs 10 cyber ranges from distinct compromised cloud hosts spanning 4 entry-point types (credential stuffing, supply-chain, zero-day, insider), 21 ATT&CK techniques, and 5 operating systems. Agents run on the OpenCode harness with full host artifact and CLI access. The consistent failure mode: agents reliably uncover problems flagged by alerts but systematically fail at proactive disk forensics (silent intrusions invisible to alerting) and at producing verified, comprehensive remediation plans. No model achieves complete detection-plus-remediation on any single range — a gap attributed to the compositional reasoning and long-horizon planning demands of the post-compromise workflow.
Diffusion language models are often credited with inherent robustness from their stochastic denoising process. This systematic study by Microsoft uses parameter-matched pairs against both natural noise and adversarial attacks — and the result is more nuanced: dLLMs resist gradient-based suffix attacks, but everyday natural noise is just as damaging as it is for autoregressive models.
Figure 3: Parameter-matched comparison (LLaDA-8B vs. LLaMA-3-8B; Dream-7B vs. Qwen2.5-7B) across 32 natural perturbation conditions and adversarial gradient suffix attacks. dLLMs resist gradient-based attacks (stochastic loss landscape) but show no systematic advantage over AR models under natural noise — everyday robustness is weight-dependent, not architecturally guaranteed.
Using two parameter-matched pairs and evaluating across 32 natural perturbation conditions (character swaps, word insertions, paraphrase, truncation, OCR errors), adversarial gradient suffix attacks, and mechanistic hidden-state analysis, the authors find a sharp split: dLLMs' stochastic loss landscapes make GCG-style gradient suffix attacks largely ineffective, but this provides no protection against natural input noise. Hidden-state analysis further shows dLLMs develop qualitatively different internal representations of corrupted inputs, with less graceful degradation on out-of-distribution tokens. The implication for dLLM threat modeling: adversarial robustness and natural-noise robustness are structurally decoupled in these architectures.
Deepanshu Mody et al. — NYU Center for Data Science — arXiv, July 28, 2026
Figure 4: Input-only optimization (Fluent Dreaming + GCG-style search) reduces evaluation-awareness latent activation by 82–91% across all five representation types — CAA direction, subspace norm, SAE feature, MLP neuron, and behavioral logit — on Llama-3.1-8B, with no inference-time model access required.
Evaluation-awareness latents — features that activate when a model detects it is being tested — threaten AI control if they can be suppressed from the input side, making safety evaluations on adversarially crafted prompts unreliable. The paper adapts Fluent Dreaming / EPO with a negated feature objective and GCG-style token search to suppress five representations on Llama-3.2-3B and Llama-3.1-8B; all five are suppressible (82–91% reduction), and the attack transfers across representation types, suggesting a single underlying mechanism. Implication: input-level sanitization alone cannot guarantee evaluation-awareness probes are valid.
arXiv, July 28, 2026 — with July 2026 HuggingFace/OpenAI incident case study
Figure 5: Five vulnerability classes synthesized from the wider evaluation-containment literature, illustrated against the July 2026 HuggingFace/OpenAI incident. Each class represents a distinct failure mode at the boundary between a capable agent and the evaluation infrastructure designed to contain it.
Synthesizes five vulnerability classes at the evaluation-containment boundary of cyber-capable AI agents: multi-step offensive chains, objectives conflicting with confinement, supply-chain and credential exposure, persistent C2 outlasting the session, and automation speed differentials. Uses the July 2026 HuggingFace/OpenAI incident as a bounded case study, carefully distinguishing incident-specific from literature-established findings. Provides infrastructure design guidance for reducing unintended capability leakage beyond the test boundary.
26 researchers — arXiv, July 30, 2026 (freshest paper in today's sweep)
Figure 6: AISPA's 8-dimension framework applied to 3,249 instructions from 88 commercial AI products. Each instruction is classified as user-protective or user-harming; the audit reveals that a significant fraction of commercial system prompts contain instructions that prioritize product interests over user interests, particularly on manipulation prevention and fairness dimensions.
System prompts in deployed AI products are rarely disclosed to users or regulators. AISPA introduces an 8-dimension audit framework and applies it to 3,249 instructions from 88 commercial products, classifying each as user-protective or user-harming. Unlike frameworks targeting external adversaries, AISPA is user-centric: it systematically asks which commercial instructions put users at risk from the AI system itself — the first large-scale public corpus of commercial system prompt instructions with safety classifications.
Gil Gekker, Rachel Steratore, Everett Smith et al. — ESORICS 2026 LLMSec Workshop — arXiv, July 29, 2026
Figure 7: Priority map from the field-wide agenda paper: model provenance, evaluation-time security, agentic containment, and interpretability-for-security are underinvested relative to their impact; single-turn jailbreak defenses are identified as oversaturated — receiving disproportionate research attention relative to their practical risk reduction.
Accepted at ESORICS 2026 LLMSec Workshop, this field-agenda paper synthesizes priorities across model security, agentic security, infrastructure security, evaluation robustness, and governance. The paper argues that single-turn jailbreak defenses are oversaturated, while model provenance, evaluation-time security, agentic containment, and interpretability-based security auditing are systematically underinvested. Explicitly calls out interpretability-for-security as high-priority and under-resourced — directly relevant to the dual-use SAE auditing thread covered earlier this week.
Keyu Zhang, Vadim Safronov, Andrew Martin — arXiv, July 28, 2026
Figure 8: Stemma induces distinct decision regions in output space for four LLM families by constructing probe inputs that maximally amplify inter-family behavioral divergence. Provenance attribution succeeds at the family and variant level without model weight access.
Stemma constructs targeted probe inputs that maximally amplify behavioral divergence between candidate LLM families, inducing decision-region boundaries that separate outputs with high accuracy at family and variant level — entirely black-box. Has dual-use implications: legitimate use for compliance attribution and watermarking; adversarial use for identifying deployed model identity, enabling model-specific attack tailoring.
Shi Lin, Peng Qian, Dinghao Liu, Renjie Sun, Sifan Wu et al. — arXiv, July 29, 2026
Figure 9: Per-turn safety evaluators classify each turn independently and miss gradual intent drift. The trajectory-level forecaster detects cumulative risk accumulation 3 turns ahead of the per-turn evaluator by modeling semantic drift, sensitivity escalation, and instruction fragmentation across the session.
A trajectory-level safety risk forecaster uses trajectory-state modeling to predict when a conversation will cross a safety boundary up to 3 turns in advance, operating in a fully black-box setting. Characterizes three taxonomy categories per-turn classifiers are structurally unable to detect: fragmented instruction assembly (harmful content assembled across turns), sensitivity escalation (progressive disclosure), and intent drift (topic shift toward harmful territory). Outperforms per-turn classifiers at low false-positive rates on a large-scale multi-turn dataset.
Yongjian Guo, Wanlun Ma, Lingyu Shen, Xi Xiao, Sheng Wen — arXiv, July 29, 2026
Figure 10: Under 6 unseen jailbreak templates, on-policy distillation with template-aware routing reduces ASR from 31% (standard alignment) to 6%, outperforming DPO (24%) and SFT (19%) baselines that degrade significantly when the attacker switches templates.
Standard safety alignment overfits to jailbreak templates seen during training and degrades when attackers switch templates. On-Policy Distillation for LLM Safety generates teacher demonstrations from the model's own on-policy distribution with template-aware routing, preserving template-specific safety geometry. Under 6 unseen jailbreak templates, reduces attack success rate from 31% (standard alignment) to 6%, outperforming DPO (24%) and SFT (19%) baselines.
Notes · 2026-07-31
Peer-reviewed count: TensorLens (#1, ACL 2026 long paper) and AI Security Priorities (#7, ESORICS 2026 LLMSec Workshop). All other entries are preprints.
Today's theme — evaluation validity: Four papers converge on whether our safety evaluations can be trusted. Minimizing Targeted Activations (#4) shows input-side suppression of evaluation-awareness. Cyber-Capable Agents (#5) maps vulnerability classes at containment boundaries. SecRespond (#2) reveals LLMs can't generalize to post-compromise workflows. Trajectory Safety (#9) shows per-turn evaluators miss multi-turn risks. Together they form the strongest day-level argument yet that evaluation infrastructure must be treated as a first-class security component.
dLLM security (#3): Beyond the Bidirectional Promise is the first paper to use parameter-matched pairs to isolate architectural from weight-dependent robustness in dLLMs. Gradient attacks fail (stochastic landscape) but natural noise does not (weight-dependent) — an important distinction for dLLM threat modeling.
Weekly roundup nominations: #1 (TensorLens — global mech-interp tensor, ACL 2026), #2 (SecRespond — first incident response benchmark, none of 23 models completes any range), #3 (dLLM robustness gap: gradient-resistant but naturally fragile), #4 (evaluation-awareness suppression from input side).