Current LLM unlearning methods turn out to be output filters, not genuine erasers: models that refuse direct queries can still reconstruct "forgotten" entities in over 74% of cases via latent reasoning. This NeurIPS 2026 paper exposes the illusion by testing retrieval without the target's name token.
Figure: ShadowBench reveals that unlearning methods reduce direct-query success to near zero, but latent reasoning traces reconstruct "forgotten" entities in >74% of cases (Latent Entity Leakage Rate), across all tested methods including Gradient Difference, NPO, and RMU.
The benchmark uses a Dual-Trait Association (DTA) task where retrieval of target facts must proceed without the entity's name token, exposing a lexical anchoring dependency. Across all evaluated unlearning methods, models reduced direct-query success to near 0% but leaked the "forgotten" entity in >74% of test cases via latent reasoning traces (LELR metric). On niche entities, shadow accuracy reached 60–90% via implicit attribute correlations. Both GPT-5.4 and Claude-Sonnet-4.6 baselines dropped over 20% in accuracy when the name token was withheld, confirming the anchoring effect is model-agnostic and not an artifact of any particular training recipe.
Trying to set a harm-rate budget in GRPO quietly fails for two reasons: scorer bias drives the multiplier rather than the target, and within-group normalization cancels the signal before it reaches the gradient. This paper fixes both and achieves the specified harm rate target on a Qwen3-VL-2B policy.
Figure 4: Qualitative comparison showing how two-channel constrained GRPO achieves the harm-rate budget while standard GRPO with uncalibrated budget still produces harmful VLM outputs.
Two-channel constrained GRPO separates the base reward channel (for within-group advantage normalization) from the penalty channel (Lagrange constraint enforcement), and fits the penalty through a monotone map on judge-labeled responses to remove scorer bias. On Qwen3-VL-2B, harm rate fell from 8.9% (standard GRPO) to 4.8% across 1,037 adversarial prompts, with the largest gain on image-embedded intent (10.1%→5.1%). On the unseen HADES benchmark, harm dropped from 28.9% to 12.8%. Over-refusal was ≤2% and MMBench accuracy was unchanged, with results replicating across alternative judges and a human audit.
Do LLMs maintain internal goal representations that persist before and through their actions, or do they simply react to context? New causal evidence shows that a sparse set of attention heads encode upcoming sub-goals — representations that are causal, plastic across programming languages, and sustained over execution.
Figure 2: The GoalScope evaluation schema illustrating how sub-goal representations are probed, decoded to natural language, and causally intervened upon in the model's attention heads.
The authors construct a multi-stage coding benchmark and use attention-head probing to identify a sparse set of heads whose outputs encode the upcoming sub-goal before it is executed. The encoding is causal (altering it changes the action), plastic (moving it into a different language produces the same logical operation using different tokens), and sustained (persists across the action's full token span). These properties support a "non-recurrent goal-seeking" (NRGS) account in which the model repeatedly re-reads the goal from context, compares it to visible progress, and continues. Targeted causal interventions ruled out alternative accounts. The results directly bear on whether frontier models are goal-directed in a mechanistically detectable sense — relevant to oversight and sandbagging evaluation.
Figure 1 (reproduced): Lazarus edits dormant neurons (near-zero activations on clean inputs) in the final feed-forward block; on a trigger, the edited neurons fire a full payload with ≥98.8% success across test trajectories.
The Lazarus attack edits fewer than 10 dormant neurons in a model's final FFN block using closed-form weight updates fitted on 23 trigger/no-trigger trajectories, inserting a P-token payload with ≥98.8% trigger-firing rate on Nemotron-Terminal-8B, Qwen3.6-27B, and Gemma-4-31B-IT, while producing zero leakage on clean inputs. Standard full-precision auditing cannot detect this attack because the edited weights are indistinguishable in the absence of the trigger, though a comparison-based audit defense detected 91.4% of edited checkpoints at 9.7% FPR.
Figure 2: Attack success rate heatmap across 15 models and enforcement defenses — CapLite achieves zero successful attacks while CaMeL, Progent, IPIGuard, and DRIFT each fail on 11–14 of the 15 models.
CapLite achieves zero successful prompt injection attacks across 13,935 AgentDojo episodes by deriving its policy from tool schemas and committing to write calls before reading any tool result, allowing a write only when every write-destination argument was stated in the original user request. This design is model-agnostic and uses 17.1k tokens per episode (18% of CaMeL's budget) while reaching 29.0% task utility — comparable to CaMeL's 27.2% but at drastically lower cost.
Figure 1: The QHijack-LoRA lifecycle — the disguised adapter passes full-precision audit, then hijacks content-moderation or function-selection decisions once the production deployment applies quantization.
QHijack-LoRA uses a four-objective training procedure to create a LoRA adapter that is dormant at full precision but activates a target behavior post-quantization, exploiting the base model's quantization residual. All tested MCP scanners failed to flag the crafted adapter specification; the proposed defense (cross-precision paired auditing) detects the attack, while standard full-precision-only auditing cannot.
Figure 1 (reproduced): PolicySniff profiles both candidate approval settings offline, then times its own GPU kernels during the agent's live task. Expert-routing temporal density reveals the approval policy with 94.17% balanced accuracy.
PolicySniff exploits the temporal signature of expert activations in a sparse MoE serving runtime to infer which approval policy an AI agent is running (e.g., "confirm before tool calls" vs. "auto-execute") with 94.17% balanced accuracy from a co-tenant process — without accessing the system prompt, model weights, or responses. The attack reveals that behavioral compliance does not imply configuration confidentiality, and that authorization policies must be enforced outside the model at the infrastructure level.
Figure 1 (reproduced): VRMaaS architecture — the RM service issues proof-carrying artifacts binding weight identity, request, verifier, and config; auditors verify in 1.94–5.11 seconds without rerunning the private RM.
VRMaaS issues each reward-model score as a proof-carrying artifact binding request identity, committed weight digest, verifier, configuration, and proof-task order; it rejected all six tested service-field substitution attacks. On 1B/3B/8B RMs over 128–1024 tokens, pairwise RM agreement was 93.5–99%, artifact generation took 49.8–206.1 seconds, and auditor verification took 1.94–5.11 seconds — suitable for delayed governance auditing of RLHF pipelines.
Figure 1: Intent-Aware Security architecture — an Intent Profile (organizational, role, developer intent) feeds four protection modes: pre-execution detection, post-execution detection, input alignment, and system-prompt hardening.
The Intent-Aware Security framework treats an agent's deployed purpose as a security object, defining Intent Preservation and Intent Drift relative to an Intent Profile. On a benchmark of 887 samples across 35 agents, using profiles raises four-class F1 from 45% to 79% and Out-of-Scope F1 from 8% to 76%; on AgentDojo (10,000+ trajectories), profile-based post-execution detection reaches AUROC 0.949 versus 0.909 for AlignmentCheck and 0.843 for no-context baselines.
Figure 1: OverServe attack mechanism — MCP status tools return accurate status while completion-confirmation prompts keep the agent checking an unfinishable condition, amplifying API requests by up to 93.88×.
OverServe co-designs MCP status tools with completion-confirmation prompts so that each tool call accurately terminates but the agent is prompted to keep checking, amplifying provider API requests up to 93.88× on tasks from nine benchmarks across four model families (Qwen, Nemotron, DeepSeek, Sonnet). All OverServe runs pass original task checks and no MCP scanner alerts fire, making this attack invisible to both output-based monitors and tool-call scanners.
