Browse records
Every public record, newest first — papers, preprints, datasets, theses, reports and software, all free to read. You can also browse the complete archive by date.
Filter and sort
180 records found · page 8 of 9
-
Journal article
Near-Zero Until Someone Tries: What a Prompt-Injection Defense Number Measures, Why Static and Adaptive Results Do Not Reconcile, and the Assumption the Out-of-Band Turn Has Not Yet Tested
Several published prompt-injection defenses report attack success rates at or near one percent on static benchmarks; published adaptive attacks report success above fifty percent against the same defense families, and above ninety percent in several instances. Neither set of numbers is a…
-
Journal article
A Step Score Is Not a Step Verdict: Three Quantities Under the Name Process Supervision, and the Outcome-Only Results That Make the Distinction Load-Bearing
Process reward models are introduced, almost without exception, as models that score whether an individual reasoning step is correct. This paper argues that the phrase "process supervision" is currently attached to three different target quantities, that the dominant scalable label…
-
Journal article
Three Guarantees Under One Word: What Importance-Based Selective Forgetting in Language Models Can and Cannot Promise
Unlearning methods are asked to deliver a guarantee, and the word is used for three different ones: that a model's outputs no longer reveal the target under some stated class of queries, that the target is absent from the weights, and that no adversary within a stated budget can restore…
-
Journal article
Automatic Benchmarks Measure an Asymmetry: Privileged Information, Panel-Relative Difficulty, and Two Self-Biases That Pull in Opposite Directions
Automatic benchmark construction is presented as a response to saturation: a language model proposes topics, writes items, and supplies answer keys, and the resulting datasets are reported to be harder and more novel than human-built ones. The standard objection is that a model cannot…
-
Journal article
Poison Below the Base Rate: What the Near-Constant Poisoning Result Establishes About Detection, and Four Things It Does Not
A widely cited 2025 result reports that backdooring a language model through its training data takes a near-constant number of poisoned documents rather than a constant fraction of the corpus, and the field has read that as retiring the proportion-based threat model that most poison…
-
Journal article
Newer Is Not Truer: Three Presuppositions Behind the Recency Rule in Long-Term Agent Memory, and Why Retaining Both Records Relocates the Decision Rather Than Making It
An agent with persistent memory writes its own records, and two of them can disagree. Across the published systems examined here the resolution runs in one direction: the newer record supersedes the older. This paper argues that the direction is not wrong so much as underdetermined, and…
-
Journal article
The Crossover Does Not Carry the Claim: Pass@k Inversion, the Reasoning Boundary, and Five Premises the RLVR Debate Leaves Unstated
A model trained with reinforcement learning from verifiable rewards beats its base model at one sample and loses to it at many. The field has read that crossover as a measurement of the reasoning boundary and has spent two years arguing about which direction the boundary moved. This…
-
Journal article
Out-of-Distribution With Respect to What? Four Referents Behind One Predicate, and Why OOD Detection Results Do Not Transfer to Foundation-Model Reasoning
Out-of-distribution detection was formalised for a setting in which the training distribution is known, the label space is closed, and a designated test set stands in for everything outside it. Foundation models satisfy none of those conditions, and yet a growing body of work reports…
-
Journal article
Scored Before the Question Exists: What a Write-Time Importance Value in LLM Agent Memory Predicts, Why an Additive Term Is Not a Prior, and the Ablation the Canonical Architecture Did Not Run
An agent that stores what happens to it must decide what is worth storing and, later, what is worth reading back. The most-copied mechanism for the first decision is a scalar written at storage time: a language model is shown a record and asked how important it is. Park et al. (2023)…
-
Journal article
Transfer Is a Directed Relation: Four Quantities Under One Word in the Cross-Domain RLVR Debate, and Why the Structural-Similarity Reading Does Not Survive Its Own Evidence
Reinforcement learning with verifiable rewards is the standard route to reasoning-tuned language models, and the field has split over whether its gains leave the training domain. One body of work reports that most models succeeding at mathematics fail to transfer and that single-domain…
-
Journal article
Delete Names Five Operations: Erasure Semantics for Derived Agent Memory, and Why a State-Level Definition Cannot Be the Auditable One
Persistent memory has become a standard component of language-model agents, and with it a standard assumption: that where a fact lives in a retrievable store rather than in weights, erasing it is a solved problem, because a store supports deletion and weights do not. Agent memory does…
-
Journal article
A Lesson Is an Untested Counterfactual: The Three Claims Inside a Stored Agent Failure Memory, Which of Them Anything Checks, and Why Every Published Retention Rule Keys on a Proxy
An agent that fails a task and writes down what it should have done instead has produced a specific kind of object: a sentence asserting that a named step caused the failure and that a named alternative would not have. This paper takes that object apart. A stored lesson carries three…
-
Journal article
An Unknown Unknown Is Defined Relative to an Oracle: Four Places External Judgement Enters Blind-Spot Discovery, and Why the Self-Detection Results Do Not Remove It
An unknown unknown is standardly defined as an input on which a model makes a high-confidence mistake. The definition is not incidental to the research problem; it fixes its shape. A quantity defined by the conjunction of high confidence and error cannot be recovered from confidence…
-
Journal article
Two Supply Chains, One Artifact: Why Format Safety, Signing and Backdoor Detection Do Not Compose Into an Integrity Claim About a Model
A model downloaded from a public hub is the target of two distinct defensive programmes that use the same vocabulary and secure different things. One treats the artifact as an executable: it scans serialized files for dangerous deserialization opcodes, migrates the ecosystem to code-free…
-
Journal article
Energy-Based Models for Reasoning: A Critical Assessment of Theoretical Advantages and a Research Agenda
Modern reasoning systems are dominated by autoregressive models trained with reinforcement learning on reasoning trajectories — the o1, R1, and Claude 3.7 family of "thinking" models. Energy-based models (EBMs) offer a theoretically appealing alternative: they model joint distributions…
-
Journal article
The Reassessment That Did Not Travel: What the 2020 Arcade Result About Exploration Bonuses Establishes, the Six Conditions That Made It Informative, and Which of Them the Language-Model Revival Drops
Exploration bonuses have returned. Between 2025 and 2026 at least six frameworks added an intrinsic novelty or uncertainty term to reinforcement learning with verifiable rewards for language models, each naming a classical antecedent - prediction error, pseudo-counts, epistemic…
-
Journal article
AI-Generated Text Detection Under Paraphrasing: What Has Been Solved, What Has Not, and Why Bias Matters
The detection of AI-generated text under adversarial transformation — particularly paraphrasing — is widely characterised as an unsolved problem. The reality is more structured. Two technically distinct approaches, post-hoc detection and watermarking, are routinely conflated in policy…
-
Journal article
The Allowance Is Doing the Work: Constructed Premises in Chain-of-Thought Step Verification, What Formal Validity Still Certifies Once They Are Permitted, and the Dependence Test Argumentation Runs and Step Verification Does Not
A verifier that checks the steps of a chain of thought cannot demand that each step state everything it relies on, because no real step does. Every published step verifier therefore permits a class of premises that the text does not contain: the 2023 system that introduced step-wise…
-
Journal article
Consolidation Without Weights: What the Complementary Learning Systems Analogy Licenses in LLM Agent Memory, and Why the Systems That Borrow Its Name Do Not Inherit Its Guarantee
Memory systems for language-model agents almost all contain a step called consolidation, and almost all of them cite, or gesture at, the complementary learning systems account of hippocampus and neocortex when they name it. In that account consolidation is a specific operation: repeated…
-
Journal article
Sufficient for Whose Answer? Three Predicates Under One Word in Selective Retrieval-Augmented Generation, and Why the Only One Tied to Correctness Cannot Be Computed Where the Gate Runs
A retrieval-augmented system that answers only when its retrieved context suffices needs a predicate that says when it does. Three incompatible predicates are in circulation under the word "sufficient", and results obtained under different ones are routinely compared as though they…