FAR.AI defines the Minimal Standard for Safeguards v1.0 across CBRNE and offensive cybersecurity and finds >100× gap between frontier models: Grok 4.5 yields a universal jailbreak for ~$58, Gemini 3.1 Pro for ~$278, while Claude Fable 5 and GPT-5.6 Sol resist all tested jailbreak families at >$14,200 search cost. Models strong on narrow benchmarks are shown to fail the Standard in adjacent hazard domains.
Murat Dura, Serkan Öztürk, Selma Tekir. Standard activation patching patches a single static position — insufficient for CoT which unfolds over many tokens. Sequential activation patching applies patches at each CoT token and uses Part-of-Speech-guided aggregation to identify attention heads that carry causal signals propagating to final-answer computation.
Vijay Erramilli (24 pp., 13 figures). Formulates mechanistic interpretability as a designed measurement inverse problem y = Ax + w, where A is the intervention matrix and x is the mechanism map to recover. Derives identifiability conditions from activation-patching designs, unifying control theory and mechanistic interpretability in a single formal framework.
Reports gap: Last radar was August 7. This run covers August 8–26 with emphasis on August 24–26 fresh submissions plus ICLR 2026 and ACL 2026 peer-reviewed work not previously included.
Pattern flag: Items 01, 02, and 10 each attack diffusion LLM safety from a distinct angle — mechanistic neuron pruning (01), architectural bidirectionality exploitation (02), and black-box schema learning (10). Three concurrent independent attack vectors suggest the dLLM safety research community is entering an adversarial phase analogous to autoregressive jailbreak research circa 2023.
7 entries removed on 2026-09-10 as repeats of earlier reports: 2608.07430 (first covered 2026-08-11), 2507.11097 (first covered 2026-07-07), 2608.10172 (first covered 2026-08-13), 2508.13650 (first covered 2026-07-19), 2606.18383 (first covered 2026-08-04), 2606.06333 (first covered 2026-07-02), 2606.04027 (first covered 2026-07-02).