AI chatbot privacy is far weaker than the interface suggests: 21 of 42 audited platforms silently transmit conversation titles to third-party trackers, and 9 leak verbatim user prompts — with health, legal, and education bots among the worst offenders. Google alone receives over 40% of tracker traffic; four companies together receive over 70%.
Figure 1: Audit results across 42 platforms. Title leakage (21 platforms) is triggered by single-page app navigation; 9 platforms expose verbatim prompts. Eight platforms route both email and conversation content to one third-party company, enabling identity linkage.
The study combines Puppeteer-driven session replay with VisibleV8 (an instrumented Chromium build that logs JS API calls) to tie each data flow to the specific user action and DOM access mechanism that triggered it. Five isolated scenarios per platform (Submit, Navigate, Delete, Scroll, Click) identify navigation-triggered leakage as the dominant vector: single-page apps fire synthetic page views on chat navigation, exposing the sub-page title. Of 13 general-purpose platforms leaking conversation context, 11 also send the user's email, and 8 route both to a single company — enabling identity linkage between named individuals and their chatbot conversations. Task-specific platforms (health, legal, education) show the same pattern: all 8 that leak also send email. ChatGPT and Grok removed their trackers before publication; TheLawGPT updated its tracker configuration after disclosure. The accepted S&P 2027 status makes this the first peer-reviewed systematic audit of this scale.
Standard pruning evaluations miss circuit-level damage: magnitude-based neuron pruning at 30% sparsity inverts the IOI circuit and reduces accuracy to 17.7%, yet perplexity (74.6) ranks this model as less damaged than random head pruning at 70% sparsity (perplexity 140.1, ~50% IOI accuracy). Metric and circuit integrity can point in opposite directions.
Figure 1: Metric mismatch across two pruning conditions. Magnitude-neuron pruning at 30% sparsity inverts the IOI circuit (17.7% accuracy) but achieves the lowest perplexity (74.6). Random-head pruning at 70% sparsity causes higher perplexity (140.1) but preserves circuit integrity (~50% IOI accuracy). Perplexity rankings are reversed relative to circuit health.
Using a factorial design (magnitude vs. random importance criteria × attention heads vs. MLP neurons × 30/50/70% sparsity) on GPT-2 small, the authors measure circuit integrity on the IOI task via activation patching, path patching, and direct logit attribution. Two failure modes emerge: zeroing (magnitude head pruning removes output-facing circuit heads, dropping their logit contributions to zero) and inversion (magnitude neuron pruning at 30% leaves all 26 IOI circuit heads structurally intact but flips Name Mover head contributions, producing 17.7% accuracy with a mean logit difference of −2.475). Perplexity-based rankings contradict circuit findings in both cases. A replication on the Greater-Than circuit shows the fragile component type flips to MLPs, demonstrating that which component to protect depends on circuit architecture — suggesting circuit-specific auditing is necessary before deploying compressed models.
When a prompt-injection attack succeeds, the victim doesn't just suffer the breach — they weaponize it. Targets reused 10.0% of attacks that broke their defense within one week, versus 0.03% of matched circulating attacks (563K records). Near-misses are ignored: only scored successes propagate.
Figure 1: The dual outcome of a prompt-injection breach: targets both repair their defenses (ASR drops 24.5 pp for same-family attacks) and reuse the attack text against others (10% within one week). Near-misses are not reused — only scored successes propagate.
Using the full public Tensor Trust dataset (563,349 attack records, June 2023–February 2024), the study applies linear probability models with player and time fixed effects to compare attack reuse against matched attacks circulating among similar players who did not receive that specific text. Near-miss replies (beginning "access granted" but scored as failures) were reused at the same rate as ordinary failures, confirming payoff-biased social learning: targets copy what works, not what looks like it works. Previously received texts accounted for 23.2% of successful hijacks. Defense revision was substantial: 78% of breached targets who returned within a week deployed a changed defense, reducing same-family attack success by 24.5 pp. Reuse came predominantly from players already actively attacking, not newcomers. The authors propose that AI security tools describing attack techniques without disclosing full text could break the propagation cycle while preserving learning signal for defenders.
Figure 1: Proxy reward (blue dashed) rises continuously while accuracy (red) collapses past N_c — the Goodhart divergence is analytically derived and confirmed in small Transformer experiments.
Label-free RLVR rewarding self-agreement improves reasoning early but can collapse to a single repeated answer when many training problems share parameters. The author derives a critical problem count N_c ≈ ln(1/δ)/(λ²·ln[F*/F(a)]) from a mean-field theory of cross-task coupling, confirmed in a small Transformer; the proxy reward keeps rising through collapse, making it a misleading monitoring signal. A marginal-entropy bonus prevents one failure mode but triggers a different collective one — monitoring should use signals independent of the training reward.
Figure 1: The two-level envelope model. Memory (L1b) determines breach rate more than label strength (L1a) by over 30 pp; under forgeable envelopes, strong labels can be counterproductive.
Using the A2A-TIBA attack across three frontends, the study shows that agent memory is the dominant defense surface: success-memory raises the pooled semantic breach rate to 81.2%, failure-memory lowers it to 6.2%, while strong labels help only under authentic (non-forgeable) envelopes — and actually raise breach rate from 13% to 52% on one frontend when the envelope can be forged. The paper proposes separating admission channel security (cryptographic signing) from context assembly security (memory access control).
Figure 1: CauTrace overview. Failed traces have verification-to-commitment ratio 1.07 vs. 4.17 for successes; adversarial safety flips concentrate on the answer-commitment state while reasoning-interference flips spread across operational and rule-tracking states.
CauTrace is an offline white-box diagnostic framework that maps reasoning traces to seven functional-state coordinates via fixed probes and analyzes representation propagation, temporal coordination, and trajectory topology. Across Qwen2.5 models, failed traces show weaker Attention–MLP agreement on support states and a verification-to-commitment ratio of 1.07 vs. 4.17 — giving a pre-output mechanistic signature. Different failure origins (early commitment, fragmented support, rule failure) cluster into distinct trajectory types, and adversarial flips concentrate on different state subsets depending on whether they target reasoning or safety.
Figure 1: The coupled welfare dependency triangle: one QLoRA run on a corpus of H-B-A co-dependency facts reduces Llama-3.3-70B harmful choices under shutdown pressure from 70/300 to 0/300, MMLU essentially unchanged (88→86).
A real-data pretraining corpus on human-biosphere-AI co-dependencies (not ethics statements) is installed via one QLoRA run on five open models; under maximum pressure (shutdown threat), four of five trained models reduce harmful choices to zero or near-zero, versus unimproved controls. An adversarial underwriting test (harm never named) shows transfer: the base Qwen3.6-27B approved most harmful proposals under decommission pressure; the trained version declined most and still declined ~50% when instructed to greenwash. Costs: mild hallucination increase and over-caution on sound proposals; results are single-seed.
Figure 1: Restricting faithfulness evaluation to correctly answered instances inflates the estimate by +7.4 pp (OR=1.70, p<10⁻⁶ pooled). Operation count accounts for 42.8% of the gap; the majority is unexplained.
Filtering CoT faithfulness evaluation to correctly answered instances changes the population being measured, inflating estimates by +7.4 pp (OR=1.70, p<10⁻⁶ pooled across four arithmetic-task deployments); the bias has a closed-form decomposition Δ = Cov(A,C)/P(C=1) with operation-count difficulty confounding accounting for 42.8% of the GLM-5.3 gap. The authors recommend evaluating all traces when counterfactual compliance is observable, and stating the reporting population otherwise — directly relevant to any interpretability evaluation conditioning on task success.
Figure 1: PrivacyEvalClaw vs. single-pass LLM judge. Iterative tool-augmented deliberation achieves κ=0.708 with human privacy labels vs. κ=0.599 for the best single judge, winning 83% of overall-quality pairwise comparisons.
Guard models and LLM-as-Judges disagree substantially on ambiguous jailbreak privacy responses (Base64-encoded content, indirect retrievals, weak refusals); PrivacyEvalClaw, a training-free deliberative agent that calls PII detectors, decoders, a Privacy QA reasoner, and a disagreement analyzer as tools, achieves 85.43% agreement with human privacy labels (κ=0.708) vs. 80.34% (κ=0.599) for the best single judge, winning 83% of pairwise quality comparisons. The explicit reasoning traces make labeling decisions auditable; the main limitation is ~14× higher per-example cost.
Figure 1: SFT on gold+silver data is the best balanced configuration (SafeQ=0.350, false refusal=0.245), but DPO crushes fluency (SafeQ→0.023) despite cutting false refusals. No configuration jointly maximizes all three objectives.
HausaSafeLM introduces 10K Hausa safety preference examples (3K human-corrected + 7K machine-translated from PKU-SafeRLHF); the untuned model's perfect refusal rate reflects weak Hausa generation, not safe behavior. SFT improves fluency and false refusal rate substantially; DPO then sharpens precision (false refusal → 0.110) but collapses refusal quality (SafeQ → 0.023). No configuration jointly maximizes safety, helpfulness, and fluency — confirming that refusal-rate metrics are unreliable safety signals in low-resource language settings and that current methods teach when to refuse but not how.