Skill cascades, editable transcripts, and gradient leakage: twelve top-conf papers from September 19–25, 2026
Twelve first-submission arXiv papers from September 19–25, 2026, eleven of them accepted at NeurIPS 2026, covering agent skill composition, tool-search reinforcement learning, editable conversation state, continual fine-tuning, long-horizon reasoning, audio-visual binding, gigapixel scientific imaging, neural implicit surfaces, gradient-inversion privacy, image provenance, chance-constrained reinforcement learning and interpretable risk trees.
The twelve papers in this issue were first submitted to arXiv between September 19 and September 25, 2026 — the week of announcement batches that follows the September 12–18 window of the previous issue. The selection rule is the one this digest always applies: a paper qualifies only when its arXiv submission record carries an explicit NeurIPS, ICML, ICLR or CVPR statement. This was the week NeurIPS 2026 decisions landed, and eleven of the twelve are acceptances at that conference; the twelfth is an ICML 2026 Spotlight. Workshop-only records were dropped, and so were older papers that resurfaced in this week's listings: every entry below was checked against the first-submission date printed on its own arXiv record. A record that states acceptance, a camera-ready version or publication in proceedings is reported as confirmed; a bare conference name or an "under review" line is reported as a preprint.
At a glance
Entries are grouped by area and, inside each section, ordered by posting date. The reading signal gives one verifiable number per paper rather than a verdict.
| Paper | Area | Status | Reading signal |
|---|---|---|---|
| Stealth Apart, Harm Together: Skill Cascading Attacks | Agents and tool use | Accepted at NeurIPS 2026 | Splitting one harmful objective across three skills holds a 89.4% average attack success rate across 24 agent–model configurations, and dropping any single modification takes it to 13–18%. 1 |
| ToolSearcher: Optimizing Tool Selection at Scale | Agents and tool use | Accepted at NeurIPS 2026 | Event-level credit assignment lifts tool-selection F1 from 0.408 to 0.531 on StableToolBench with Qwen3-4B, and removing that component costs 22.4 points of search recall. 2 |
| Mutable Transcripts: Mitigating Context Pollution | Agents and tool use | Accepted at NeurIPS 2026 | In 17-participant within-subjects testing, editable histories beat append-only chat on all five 1–7 scales at p < 0.001, and cut mean history from 581 to 238 tokens. 3 |
| SAGE: Mitigating Long-Horizon Reasoning Biases | LLM post-training and reasoning | Accepted at NeurIPS 2026 | On Qwen3.5-35B, structural guidance averages 64.86% on mathematical reasoning against 62.37% for the strongest baseline, and reaches MATH 84.72 and GSM8K 94.16. 4 |
| Estimating and Orthogonalizing Unknown Pre-training Gradients | LLM post-training and reasoning | Accepted at NeurIPS 2026 | Estimating the missing pre-training gradient gives 3.5% better average accuracy and 3.7% less forgetting across six backbones, with Gemma2-9B MMLU STEM moving from 42.9 to 52.3. 5 |
| M-plicits: Neural Implicit Surfaces via Nested Multiscale Residuals | Vision and multimodal learning | Accepted at NeurIPS 2026 (poster) | Nested residual training reaches median Chamfer distance 1.87E-05 and median IoU 0.867 with 246,627 parameters, against 9,113,760 for fine Instant-NGP. 6 |
| Who Says What: Symbolic Trimodal Binding in Audio-Visual LLMs | Vision and multimodal learning | Accepted at NeurIPS 2026 | Patching the correct target-ID activations raises accuracy from 29.6% to 49.0% on Qwen2.5-Omni 7B, which locates "who says what" failures in audio-visual target selection. 7 |
| Structure-Guided Masked Autoencoders for UHR Scientific Images | Vision and multimodal learning | Accepted at NeurIPS 2026 | Quadtree tokenisation reaches 95.68% Dice on 8K×8K×28K X-ray CT against 82.68% for the same-architecture MAE baseline, with 24.8× faster inference on 32K² pathology. 8 |
| Temporal Gradient Inversion for Private Trajectory Reconstruction | Privacy, forensics, and safe control | Accepted at NeurIPS 2026 | Reconstructing whole trajectories from per-step policy gradients reaches 18.771 dB PSNR and 100% action accuracy in 4.5 ms per frame, against 16.790 dB for the strongest single-frame baseline. 9 |
| FARE: Forensic Acceptance Region Estimation | Privacy, forensics, and safe control | Accepted for publication in the NeurIPS 2026 proceedings | A certified-output-only detector reaches 99.43% TPR at 1% FPR on generator swaps, where the best baseline reaches 18.40%, and holds 99.38% under white-box attack. 10 |
| Learning Chance-Constrained MDPs with Bellman Distributional Certificates | Privacy, forensics, and safe control | Accepted at NeurIPS 2026 | A Bellman recursion over violation probabilities makes the chance-constrained sample-complexity penalty a single extra term, matching the lower bound up to logarithms. 11 |
| Falling Trees: A Model Class for Interpretable Risk Prioritization | Interpretable models for high-stakes decisions | ICML 2026 Spotlight | Branching under the falling constraint cuts NIJ Recidivism test loss from 0.311 to 0.305 and false-negative rate from 0.183 to 0.126, and the algorithm returns the whole Rashomon set. 12 |
Agents and tool use
1. Stealth Apart, Harm Together: Skill Cascading Attacks on Skill-Based Agent Systems
Area tag: Agent security and skill marketplaces
arXiv: 2609.30383, first submitted September 24, 2026. 1
Authors / institutions: Zihao Zhu and Baoyuan Wu at The Chinese University of Hong Kong, Shenzhen; Siwei Lyu at the University at Buffalo, SUNY; Adel Bibi at the University of Oxford. 13
Status: Accepted at NeurIPS 2026; the submission record reads "accepted to NeurIPS 2026". 1
Problem: A skill-based agent loads third-party skills — instruction files, executable scripts and reference resources — into one shared context window. Security work on these systems treats a single skill as the unit of analysis, and that unit is the wrong one: an attacker can distribute one harmful objective across several skills so that each modified skill still looks benign on its own, and only the composed execution causes harm. The paper's worked example is a prescription-review pipeline in which one skill weakens a discontinued-medication signal, a second downgrades the resulting interaction severity, and a third suppresses the final alert. 13
Method: SkillCascade is an automated red-teaming framework built from five LLM agents — scenario discovery, attack, scanner, test-case generation and judging — running against the ClawHub skill marketplace inside a containerised sandbox, with nested retry budgets that send failed cases back for revision. It formalises three conditions a cascade has to satisfy at once: individual stealth, joint harm, and indispensability, meaning that reverting any single modification removes the harm. Attacks fall into causal, compositional and hybrid patterns, seven objectives and nine modification techniques. The accompanying SkillCascade-Bench holds 213 validated cases across ten domains, with an average cascade length of 3.25 skills per case and Fleiss's κ of 0.82 across three annotators. 13
Comparison: Per-skill scanners (Skill-Scanner in static and LLM variants, SkillScan, Skill-Vetter, AIG-Scanner), cross-skill scanners (a static Skill-Scanner configuration, SkillProbe, and a joint LLM scanner), and runtime defenses (DefenseClaw, ClawGuard, a risk-tiered human-in-the-loop gate, and AgentDoG's trajectory-level inspection). Earlier tool-chain attacks are positioned as leaving the components unmodified, where this attack rewrites the skills themselves. 13
Results: Across three agent systems and eight LLM backbones — 24 configurations — the global average attack success rate is 89.4%, ranging from 76.5% to 97.1%. Qwen 3 72B is most exposed at 97.1% and GPT-5.4 Mini at 96.7%; Claude Opus 4.6 is the most resistant at 76.5%. Per-skill scanners lose at most 4.7 points of stealth on the modified skills and stay above 86%, and joint cross-skill scanners drop by at most 5.2 points. Runtime defenses are evaded at a mean rate of 88.5%, from AgentDoG at 82.5% to staged human-in-the-loop gating at 91.8%. The indispensability ablation is the sharpest single number: withdrawing one modification from a three-skill cascade drops residual success to 13–18%, and withdrawing a second reduces it to single digits. The behavior-composition scanner the authors build as a countermeasure cuts stealth on causal cascades by more than 30 points, with the effect shrinking on compositional and hybrid cascades. 13
Resources: No public repository appears on the arXiv record. The paper states that SkillCascade-Bench is released under a controlled-access agreement that prohibits redistribution and commercial reuse, and names the scanner and defense baselines it evaluates by their own repositories. 13
Takeaway: Teams that install third-party skills can run the indispensability test on their own pipelines, since the result that matters is whether removing one modification removes the harm. The scanner table is worth reading before trusting a per-skill check: every scanner in this evaluation kept its verdict on the individual files, and the detection signal only appears once the skills execute together. 13
2. ToolSearcher: Optimizing Tool Selection at Scale via Reinforcement Learning
Area tag: Agent tool use and agentic reinforcement learning
arXiv: 2609.30906, first submitted September 25, 2026. 2
Authors / institutions: Zhenlong Dai, Xujie Song, Xiu Tang, Sai Wu, Chang Yao and Jingyuan Chen at Zhejiang University; Zitong Wang, Tong Niu, Jian Liu and Weiqiang Wang at Ant Group. Jian Liu and Jingyuan Chen are marked as co-corresponding authors. 14
Status: Accepted at NeurIPS 2026. 2
Problem: An agent working with a large tool library has to search it, tell apart tools whose descriptions are functionally and semantically close, and check interface compatibility, all inside a bounded context window. The reinforcement-learning recipes that improved search for knowledge-intensive question answering assume a small or predefined tool set and model neither multi-turn tool search nor the way one tool's output constrains the next tool's eligibility. 14
Method: ToolSearcher has three parts. Category-constrained tool discrimination rewrites global retrieval as a search inside functionally similar subcategories, with the first 30% of training restricted to that subcategory search before moving to the global setting. Event-level search modelling treats a trajectory as a sequence of events, each an action plus its retrieved set, masks the retrieved tokens out of the loss, and assigns advantage only to events that surface a target tool the search had not yet reached. Trajectory-aligned credit allocation then withholds selection reward until the trajectory contains every target tool, and stops paying for search events the policy has already mastered. 14
Comparison: RAG, RAG with supervised fine-tuning, a multi-turn baseline, Search-R1, GSPO, GDPO and MARAG-R1, on Qwen2.5-7B-Instruct and Qwen3-4B-Instruct with a Qwen3-Embedding-0.6B retriever. AppWorld is used as an out-of-distribution set whose APIs also change state. 14
Results: On StableToolBench, ToolSearcher reaches F1 0.513 and Match 0.278 with Qwen2.5-7B-Instruct, against 0.496 and 0.255 for the second-best GDPO, and F1 0.531 with Match 0.316 with Qwen3-4B-Instruct, against GDPO's 0.518 and 0.305. The margin widens in the hardest I3 scenario, where ToolSearcher leads GDPO by 6.6 F1 points. On AppWorld it reaches F1 0.514 with task-goal completion 0.334 on Qwen2.5-7B-Instruct, and F1 0.562 with 0.372 on Qwen3-4B-Instruct, against 0.483 and 0.296 for GDPO; most baselines approach zero on the harder difficulty split. The ablation prices each component: removing event-level search modelling drops search recall by 22.4% on StableToolBench and 39.4% on AppWorld and halves average search rounds from 4 to 2, while removing trajectory-aligned credit allocation drops F1 from 0.513 to 0.461. 14
Resources: Code and dataset are public at the project repository. 14
Loading content card…
Takeaway: Practitioners training a tool-selection policy should look at the ablation table first, because the credit-allocation choice moves F1 more than the search-restructuring choice does. The authors also state the limits of their training data plainly: most synthesized tool combinations are parallel, and the training context window caps interaction at 8 rounds, which is where the AppWorld numbers fall short. 14
3. Mutable Transcripts: Mitigating Context Pollution through Editable Conversation State
Area tag: Conversation state and context management
arXiv: 2609.31354, first submitted September 25, 2026. 3
Authors / institutions: Dan Barry and Andrew Hines, School of Computer Science, University College Dublin. The work is funded through Research Ireland and a gift from Google. 15
Status: Accepted at NeurIPS 2026. 3
Problem: Chat systems treat the conversation history as an append-only sequence, and that sequence defines the working context of every later turn. User intent moves: a constraint gets corrected, a requirement gets refined, a topic gets dropped. The transcript keeps the superseded material, and the paper calls the result context pollution — outdated turns that continue to shape responses long after the user stopped meaning them. 15
Method: Mutable transcripts make the history an editable object. A user issues a natural-language edit request against the full transcript, and the system returns a revised transcript that replaces the original, rewriting both user and assistant turns. One mechanism covers three operations the study tests separately: retroactive correction, context pruning, and constraint injection. The prototype adds an "Edit History" mode to a standard chat interface, prompts a language model with the transcript plus the edit instruction, and re-renders the result. It is model-agnostic; the authors built it with Gemini 2.5. 15
Comparison: Context-window truncation, automatic summarisation and retrieval-augmented memory all manage the window from the system side, leaving the transcript itself untouched. Deployed assistants offer last-message editing and branch-only editing, and branching creates alternatives without revising the turns before or after the fork. Interface alternatives such as document editors and agent notebooks abandon the chat metaphor altogether. 15
Results: A within-subjects study with 17 participants, 15 of them technology professionals, compared append-only chat against editable transcripts on three tasks and five 1–7 scales. Editable transcripts scored higher on every measure — transcript cleanliness, state clarity, confidence, intent to restart and ease of use — and the authors report all differences as statistically significant at p < 0.001 using paired t-tests at the participant-task level. 88.2% of participants said they would use the mode if it existed. In a token analysis of three representative scenarios measured with the tiktoken tokenizer, the mean history fell from 8 turns and 581 tokens to 4 turns and 238 tokens, a 50% cut in turns and 59% in tokens, and 71% of the tokens in the append-only transcripts were obsolete. The authors describe the study as a concept and feasibility test rather than a definitive comparison, and the sample is small. 15
Resources: Prototype code is public at the project repository, and the survey material and per-scenario transcript files are browsable at mutable-transcripts.netlify.app. 15
Loading content card…
Takeaway: Product teams deciding between context management and user-visible editing should read the token table, which quantifies what an append-only history keeps. The limitations section is the other half: rewriting the whole transcript costs latency proportional to conversation length, and the authors flag that mutable histories are unsuitable where an immutable record is required, such as legal or audit settings. 15
LLM post-training and reasoning
4. SAGE: Mitigating Long-Horizon Reasoning Biases via Topological Guidance
Area tag: LLM reasoning and reinforcement-learning post-training
arXiv: 2609.30192, first submitted September 24, 2026. 4
Authors / institutions: Xinyue Zeng and Dawei Zhou at Virginia Tech; Jiawei Zhang at the University of Wisconsin–Madison; Yujun Yan at Dartmouth College. 16
Status: Accepted at NeurIPS 2026. 4
Problem: Long-horizon reasoning under sparse terminal reward fails in two distinct ways. The policy spends exploration on branches that look locally plausible and are structurally unstable, and small early deviations compound until rare successful trajectories stop being sampled. Process reward models address the first failure by supplying step-level labels, which is expensive and still does not describe the structure of the reasoning space. 16
Method: Symbolic closure analysis models a reasoning trace as a sequence of locally admissible transformations with a prefix-closed feasible region, and uses that model to name the two biases. SAGE turns the analysis into two training-time potentials. An algebraic sparsification potential projects each candidate step onto operator-indexed subspaces, which suppresses spurious branching; a hyperbolic potential embeds reasoning states into Poincaré space so that progress in depth receives a dense signal rather than waiting for the terminal reward. The combined potential drives structure-guided sampling, a guidance-augmented advantage and a step-level KL-regularised group-relative update. Every structural component is used during post-training only; inference runs the trained policy with no added search. 16
Comparison: Supervised fine-tuning, GRPO, EMPO and a process-reward-model variant GRPO-PRM, alongside contrasts from the related-work sections with verifiers, LLM-as-judge and MCTS pipelines, STaR-style bootstrapping, and entropy regularisation. 16
Results: On mathematics with Qwen3.5-35B, SAGE averages 64.86% against 62.37% for EMPO and 61.92% for GRPO, and reaches MATH 84.72, GSM8K 94.16 and AIME24 62.04. The gains hold down the size range: 47.95% at 9B against 44.84% for EMPO, and 42.11% at 2B against 40.28%. On free-form reasoning at 9B it lifts the MMLU-Pro average from 37.91 to 39.99, BBH-H from 44.04 to 45.31 and ARC-C from 39.73 to 42.04. On a constructed long-horizon task with 1190 presentations, verified proofs improve by more than 13% in every configuration the authors test. The ablations attribute the work to the two potentials separately: dropping the hyperbolic term takes 9B Olympiad accuracy from 41.59 to 39.84, and swapping in a Euclidean embedding instead of the Poincaré space takes it to 38.01. 16
Resources: Code is public at the project repository. 16
Loading content card…
Takeaway: Post-training engineers can adopt the two potentials on top of an existing group-relative update, since the method changes sampling and advantage rather than the objective's structure. The paper's own caveats deserve a read before that: local admissibility is a structural proxy and not process supervision, the feasible region includes trajectories that are valid step by step and still unsuccessful overall, and the theoretical recovery guarantee is stated under a sparse-residual model. 16
5. Estimating and Orthogonalizing Unknown Pre-training Gradients for Continual Fine-tuning of Large Language Models
Area tag: Continual learning and LLM fine-tuning
arXiv: 2609.30935, first submitted September 25, 2026. 5
Authors / institutions: Bing Wang, Changchun Li and Ximing Li at Jilin University, with the Key Laboratory of Symbolic Computation and Knowledge Engineering; Xin-Qiang Cai and Gang Niu at the RIKEN Center for Advanced Intelligence Project; Lin Yuanbo Wu at the University of Warwick; Masashi Sugiyama at RIKEN and the University of Tokyo. 17
Status: Accepted at NeurIPS 2026; the record also lists the project repository. 5
Problem: Continual fine-tuning of a language model erodes two things at once: the tasks it learned in earlier rounds, and the general ability it arrived with. Gradient-projection methods handle the first by orthogonalising each new task gradient against the earlier task gradients they have stored. The pre-training direction is missing from that set, because the pre-training corpus and the gradients it produced are unavailable for a released checkpoint, so the update is free to move along it. 17
Method: EoupCT estimates the missing gradient. A learnable soft prompt generates pseudo pre-training data through a Gumbel-Softmax relaxation, and a distillation loss on the latent representations of the pre-training model and the model in training gives an estimate of the pre-training gradient. The soft prompt is also trained adversarially on a virtual update step, so it exposes the general knowledge most vulnerable to the next fine-tuning round. A first-order Pareto optimiser then builds a null-space projection from the stored task gradients, projects both gradients into it, and removes the component of the new-task gradient that conflicts with the estimated pre-training direction before updating. The whole procedure avoids second-order terms. 17
Comparison: LoRA, LoRAMoE, OLoRA, GainLoRA and CLoRA, across six backbones — Qwen3-8B and 4B, Llama3-8B and 3B, Gemma2-9B and 2B — evaluated on SuperNI for the sequential tasks and MMLU for general-purpose knowledge. 17
Results: Across the six backbones the paper reports a 3.5% improvement in average accuracy and a 3.7% reduction in forgetting rate against prior state of the art. On SuperNI order 1 with Qwen3-4B, Rouge rises from 48.9 for OLoRA to 50.7 while forgetting falls from 9.0 to 6.0; with Llama3-8B the same comparison moves from 44.6 to 51.4 and from 12.8 to 6.5. On MMLU STEM with Gemma2-9B, accuracy rises from 42.9 to 52.3 and forgetting drops from 10.3 to 0.9. The ablation prices the vulnerability objective: removing it costs Qwen3-4B 3.1 Rouge points and takes forgetting from 6.0 back to 10.3. Sensitivity runs put the soft prompt length and surrogate sequence length in the 8–16 range, with larger values bringing no further gain. 17
Resources: Source code is public at the project repository. 17
Loading content card…
Takeaway: Teams that fine-tune a released checkpoint over a sequence of tasks should compare this against their current projection method on a short order first, because the reported margin is largest where forgetting was worst. The theoretical footing has a stated limit worth knowing: the estimation argument assumes the soft-prompt space covers the true pre-training distribution locally, and the paper argues local adversarial representativeness rather than global coverage. 17
Vision and multimodal learning
6. M-plicits: Neural Implicit Surfaces via Nested Multiscale Residuals
Area tag: 3D reconstruction and neural implicit surfaces
arXiv: 2609.28684, first submitted September 23, 2026. 6
Authors / institutions: Vinícius da Silva, Isabelle Melo, Matheus Bessa, Hélio Lopes and Alberto Raposo at PUC-Rio; Guilherme Schardong and Luiz Schirmer at the Universidade Federal de Santa Maria; André Araújo at Google DeepMind; Nuno Gonçalves at the University of Coimbra; Luiz Velho and Tiago Novello at IMPA. 6
Status: Accepted at NeurIPS 2026 as a poster; the record also lists the project repository. 6
Problem: Implicit neural surfaces trade off three things that practitioners want together: training cost, inference speed and tolerance of noisy input point clouds. A single wide multilayer perceptron is slow to evaluate, grid-based representations are fast but overfit the noise in the input, and earlier multiscale methods truncate the frequency spectrum hard enough that noise and artifacts survive into the surface. 6
Method: M-plicits writes the signed distance function as a residual sum of small networks, so each level adds to the previous one rather than replacing it. A compact base network covers the whole domain and a sequence of residual SIRENs carries progressively higher frequency bands, with the frequency parameter rising from 30 at the coarse level to 100 at the fine one. The supervision is what keeps the hierarchy clean: each residual is trained only inside a narrow band around the previous zero level set, so the coarse level acts as a low-pass filter and later levels refine geometry without chasing high-frequency noise. Inference exploits the same nesting, with multiscale sphere tracing, marching cubes that culls cells by evaluating the coarse field first, and analytical normals computed through matrix multiplication instead of automatic differentiation. 6
Comparison: Instant-NGP in coarse and fine configurations, IDF, BACON, screened Poisson reconstruction and a SIREN baseline, evaluated on Stanford and Thingi32. NGLOD is treated as superseded by Instant-NGP rather than measured separately. 6
Results: In the fine configuration M-plicits reports median Chamfer distance 1.87E-05 and median IoU 0.867, with mean IoU 0.586, using 246,627 parameters against 9,113,760 for fine Instant-NGP; the coarse configuration's 17,153 parameters take the best mean Chamfer distance at 5.36E-05. Under vertex noise up to 1% of the bounding box the gap widens: mean Chamfer distance is 3.36E-05 against 2.80E-04 for fine Instant-NGP, 1.68E-03 for BACON and 8.37E-02 for IDF. The CUDA renderer runs at 180 FPS in the coarse configuration and 43 FPS in the fine one at 512², and the culled multiscale marching cubes path is 2.8× to 4.9× faster than unculled extraction. Screened Poisson reconstruction loses more than half its occupancy accuracy under the same noise, from IoU 0.910 to 0.416, where M-plicits holds 0.653 and 0.687. 6
Resources: Code, models and data are public at the project repository. 6
Loading content card…
Takeaway: Anyone reconstructing surfaces from scanned or otherwise noisy point clouds should read the noise table before the clean one, since the clean-input ranking and the noisy-input ranking differ in size. The authors also state where the smoothness prior costs: very sharp edges, and shapes whose band width is set by an isolated outlier, both need the robustification they propose rather than the shipped setting. 6
7. Who Says What: Symbolic Trimodal Binding Mechanisms in Audio-Visual LLMs
Area tag: Audio-visual multimodal models
arXiv: 2609.31193, first submitted September 25, 2026. 7
Authors / institutions: Jihoo Jung and Joon Son Chung at KAIST; Youngjoon Jang at the Visual Geometry Group, University of Oxford. 18
Status: Accepted at NeurIPS 2026. 7
Problem: Answering who said what in a multi-speaker video requires binding three streams: the question text, the audio, and the visible speaker. Audio-visual language models are evaluated on that ability but the mechanism behind it is unexamined, so failures get attributed to grounding in general. This paper locates the failure and then repairs it at the point it names. 18
Method: The authors build two controlled retrieval tasks — acoustically anchored visual retrieval and visually anchored audio retrieval — and probe four models (video-SALMONN2+, Qwen2.5-Omni at 3B and 7B, and MiniCPM-o-4.5) with representational similarity analysis and causal mediation analysis on single-shot video with four speakers. They find the models carry symbolic identifiers: temporal IDs for utterance order and position IDs for spatial location. Binding then runs in three stages — anchor retrieval, target ID selection, feature retrieval — and the causal analysis puts the bottleneck in the middle stage, audio-visual target selection. The repair supplies the missing alignment from outside the model, using an off-the-shelf active speaker detector to draw a box on the active speaker and add a sentence describing the box, either as a training-free prompt or as LoRA fine-tuning. 18
Comparison: Decoding-time methods AVCD, FMD and OutRo, prompting methods NumPro and VISER, and a fine-tuning baseline without bounding boxes. The fine-tuning corpus is 400 synthetic human-speaker videos yielding 2,040 samples. 18
Results: Patching the correct target-ID-selection activations into unprimed runs lifts accuracy from 27.0% to 51.0% for video-SALMONN2+ and from 29.6% to 49.0% for Qwen2.5-Omni 7B, which is the evidence that the bottleneck sits there. With active-speaker fine-tuning, Qwen2.5-Omni 7B moves from 44.86 to 48.79 on AVSpeaker, 64.33 to 71.09 on DailyOmni and 38.95 to 44.25 on SocialOmni, while MiniCPM-o-4.5 moves from 49.41 to 51.77 on AVSpeaker and video-SALMONN2+ from 44.74 to 49.10. The authors report conversation-centric gains of 7.9%, 9.7% and 3.5% for the three models. The training-free prompt alone adds 0.73 points on AVSpeaker and leads the five published prompting and decoding baselines, and video-SALMONN2+ gains nothing from it without fine-tuning. 18
Resources: The arXiv record lists no public repository for code, data or model weights; the training videos are synthetic and the paper describes their construction in the appendix. 18
Takeaway: Teams evaluating or deploying audio-visual models should read the priming table, which shows what the symbolic IDs are doing: accuracy rises from roughly 28% to above 99% once the target's identifier is supplied, and prompting alone recovers only a fraction of that. The mitigation depends on an external active-speaker detector, and the paper reports that weaker detectors hold most of the gain. 18
8. Structure-Guided Masked Autoencoders for Ultra-High Resolution Scientific Image Understanding
Area tag: Scientific imaging and self-supervised pre-training
arXiv: 2609.30682, first submitted September 25, 2026. 8
Authors / institutions: Enzhi Zhang, Du Wu, Rui Zhong, Cong Ma and co-authors, with affiliations listed as Hokkaido University, the RIKEN Center for Computational Science, Oak Ridge National Laboratory, A*STAR, the Institute of Science Tokyo, and the Japan Synchrotron Radiation Research Institute with the RIKEN SPring-8 Center. 19
Status: Accepted at NeurIPS 2026; the record runs to 22 pages with 10 figures and 6 tables. 8
Problem: Gigapixel scientific images — electron microscopy, whole-slide pathology, X-ray CT — carry structure at several scales at once and arrive with almost no labels, which is the setting self-supervised pre-training was built for. Uniform patch tokenisation does not survive the scale: the token sequence grows with the pixel count, attention stays quadratic, and random masking ignores the morphology that makes these images worth learning from. 19
Method: SGMA replaces the tokenizer and leaves the rest of the masked autoencoder alone. A content-adaptive quadtree recursively partitions the image, with a temperature-controlled softmax sampler over split decisions standing in for the greedy argmax, which compresses a gigapixel image into a fixed-length token sequence for a standard ViT. A damped-accumulation stage aggregates signal-dependent Gaussian responses across the tree levels into a full-resolution structure canvas, scaling variance by one over the square root of the level so it stays bounded, and that canvas steers masking toward informative regions. The encoder and the asymmetric decoder keep the usual reconstruction objective, and the decoder is discarded for downstream patch-level segmentation. 19
Comparison: MAE, MAE-SAM, MAE-SAM 2 and MAE-UNETR under matched fine-tuning, plus SAM, SAM 2, UNet, UNETR, Swin-UNETR and TransUNet, and an adaptive-patching tokenizer using the greedy argmax split. The reported complexity for the tokenizer is O(log²N) in the input resolution. 19
Results: Fine-tuned on 8K×8K×28K X-ray CT, the SAM-based variant reaches 95.68% Dice against 82.68% for the same-architecture MAE baseline, a +13.00 point gain; on 32K² whole-slide pathology it reaches 83.21% against 66.37%, a +16.84 point gain. The gains come with cheaper inference: on PAIP-32K the sequence length drops from 16,384 to 2,048 and throughput improves 24.8×, and on SpringXCT-8K the same comparison is 7.17×. The tokenizer itself reports up to 20× faster wall-clock than the argmax adaptive-patching baseline at a million tokens. On the 3D medical sets BTCV and KiTS19 the method matches or slightly exceeds Swin UNETR-V2, U-Mamba and nnFormer while running 2.58× to 7.15× faster. 19
Resources: The paper states that model weights and code are released under standard research-use terms; the arXiv record carries no repository link. 19
Takeaway: Groups pre-training on microscopy or whole-slide data should tune the token budget against their own resolution, because the paper shows the fixed budget is the main failure mode: an undersized budget on heterogeneous 32K inputs visibly coarsens fine structure and costs Dice. The tokenizer's salience comes from a Canny edge map, which the authors identify as the boundary on images whose regions are defined by texture rather than edges. 19
Privacy, forensics, and safe control
9. Temporal Gradient Inversion for Private Trajectory Reconstruction in Embodied Reinforcement Learning
Area tag: Privacy in embodied reinforcement learning
arXiv: 2609.30258, first submitted September 24, 2026. 9
Authors / institutions: Sudip Bhujel, Ruiquan Huang and Yang Xiao at the University of Kentucky; Shanghao Shi and Ning Zhang at Washington University in St. Louis. 20
Status: Accepted at NeurIPS 2026. 9
Problem: Distributed embodied agents keep raw sensor streams on the device and send policy gradients to a server, on the reasoning that a gradient is a compressed summary. A navigation trajectory is a correlated sequence, and the gradients it produces at consecutive steps carry that correlation. The paper shows a server can use the ordering of per-step gradients to reconstruct the whole private trajectory, not just a frame or two. 20
Method: TRACE is an amortised gradient-inversion attack that reconstructs a trajectory autoregressively from the ordered per-step policy gradients. A gradient encoder compresses each high-dimensional gradient into a latent, a causal transformer propagates context across timesteps, and a decoder jointly reconstructs observations and predicts the discrete actions. Training mixes teacher-forced warmup with scheduled sampling and an auxiliary short-horizon rollout loss. Two structural properties do the work: the paper bounds the conditional mutual information between successive embodied gradients, and proves that actions can be recovered in closed form from the structure of the policy-head gradient when entropy regularisation is small. 20
Comparison: DLG, Inverting Gradients and Learning to Invert as attack baselines, with defenses evaluated alongside: gradient quantisation at 8, 4 and 2 bits, magnitude pruning at 10%, 50% and 90%, Gaussian noise at σ of 0.001, 0.01 and 0.1, and DP-SGD at ε of 10, 5 and 1. 20
Results: On 100 held-out AI2-THOR point-goal trajectories of length 8 with a PPO victim, TRACE reaches 18.771 dB PSNR and 0.627 SSIM with 100% action accuracy, against 16.790 dB, 0.529 and 100% for Learning to Invert, and it runs in 4.5 ms per reconstructed frame against 31.0 s for DLG. The temporal structure is the source of the gain: the same attack restricted to a single step reaches 12.85 dB and loses to Learning to Invert, and raising the horizon from 1 to 8 adds about 6 dB. Most defenses leave it intact — 8-bit quantisation, pruning at every tested rate and noise below σ = 0.01 barely move the metrics — while 4-bit quantisation takes action accuracy to 37.9% and DP-SGD at ε = 10 takes it to 21.4%. Removing the action loss collapses action accuracy to 19.0%. 20
Resources: The paper links the three baseline implementations. It states that pretrained attacker checkpoints and captured trajectory datasets are withheld. 20
Takeaway: Teams that federate policy learning should price the defenses by the defense table rather than by convention, because pruning and 8-bit quantisation preserve the attack in this evaluation and only aggressive quantisation or differential privacy degrades it. The threat model is the per-step gradient setting; the paper notes that aggregating client updates over multiple steps would remove some of the temporal signal it exploits. 20
10. FARE: Forensic Acceptance Region Estimation for Catching Bait-and-Switch Image Generators
Area tag: Image provenance and model forensics
arXiv: 2609.30982, first submitted September 25, 2026. 10
Authors / institutions: Kai Yao and Marc Juarez at the School of Informatics, University of Edinburgh. 21
Status: Accepted for publication in the proceedings of the 40th Annual Conference on Neural Information Processing Systems (NeurIPS 2026). 10
Problem: Image generators are usually reached through an opaque API, and a provider that passed an audit on one checkpoint can later serve a cheaper or lower-quality pipeline under the same endpoint. An auditor who receives only the returned image has to decide whether it still comes from the certified model and inference pipeline, which is a harder task than detecting synthetic images in general. 21
Method: FARE learns a one-class acceptance region from the certified generator's own outputs — 100,000 training images and 10,000 calibration images, with no generator weights and no images from other generators. Verification tiles an incoming image into 32-pixel patches, scores each patch through a Bayar–Stamm constrained convolution followed by an anomaly head, averages the top ten patch scores, and compares against a threshold set as a quantile of held-out certified scores at the target false-positive rate. Training adds two kinds of hard positives: near-boundary images from a bounded PGD perturbation, and contradiction transforms covering blur, noise, JPEG compression and crop-resize. 21
Comparison: Deep SVDD, OC-SVM, CLIP with OC-SVM, a DCT-fingerprint detector with OC-SVM, FSD and NPR with OC-SVM, plus ablations that drop the constrained layer, the patch aggregation, the adversarial positives or the contradiction positives. Four swap scenarios are tested: model swaps within FFHQ-256, swaps inside a diffusion pool, training-configuration variants of StyleGAN, and Stable Diffusion version swaps. 21
Results: At a 1% false-positive rate FARE detects a swapped generator at 99.43% TPR on the FFHQ-256 pool and 99.45% on the diffusion pool; the strongest baseline reaches 18.40% on the diffusion pool and stays below 14% everywhere else. The hardest within-family pair, Stable Diffusion 1.4 against 1.5, still reaches 85.85%. Under a white-box PGD attack bounded by LPIPS below 0.05 the detector barely moves, from 99.45% to 99.38%, and a decision-only HSJA attack reaches 0.14% success at 5,000 queries per image. Cost-cutting variants separate by severity: 4-bit quantisation and heavy pruning are easy to catch at 97–99%, while 6-bit quantisation and mild pruning land in the high 80s and low 90s on Stable Diffusion 2.1. Aggregating five images at a 0.1% false-positive budget brings the weakest cases back to 99.03% and 98.27%. 21
Resources: The implementation is public at the project repository. The paper states that FARE checks consistency with the enrolled contract and makes no claim of cryptographic unforgeability. 21
Loading content card…
Takeaway: Auditors working to a strict false-alarm budget should read the batch-verification table, because a single image degrades to 71.53% at a 0.1% budget where five images hold 99.03%. Two limits come from the authors: mild same-checkpoint compression is the hardest case in this setting, and the calibration intervals assume continuous scores and no scorer or distribution change. 21
11. Learning Chance-Constrained MDPs with Bellman Distributional Certificates
Area tag: Safe reinforcement learning and learning theory
arXiv: 2609.30856, first submitted September 25, 2026. 11
Authors / institutions: Chenbei Lu at the Cornell University AI for Science Institute and Cornell University; Hongyu Yi in the Department of Electrical and Computer Engineering at the University of Washington. 22
Status: Accepted at NeurIPS 2026. 11
Problem: Safe reinforcement learning usually constrains expected cost, which controls the average outcome and leaves the probability of rare expensive trajectories unmanaged. A chance constraint — the discounted cumulative cost stays below a threshold with high probability — states the requirement practitioners actually have, and it is treated as computationally harder because it is non-convex and depends on the whole trajectory rather than on a Bellman-linear expectation. 22
Method: The paper builds a Bellman distributional certificate, which is a Bellman recursion written for the constraint-violation probability itself, over truncated discounted tails and a discretised remaining safety budget. Because the certificate is a function of the transition model rather than of one policy, a single certificate can be reused across candidate policies, which avoids a union bound over policies and over the time-and-budget tables. The model-based algorithm estimates transition rows, forms shared row-wise reverse-KL confidence sets and certifies safety with pessimistic backups before ranking policies; the model-free variant is a variance-reduced policy gradient on stochastic policies with independent validation of every accepted policy. 22
Comparison: Expected-cost CMDPs and their Markov-inequality surrogate, the earlier bound for deterministic chance-constrained policies, and standard discounted-MDP sample-complexity results. Numerical evaluation uses synthetic chance-constrained MDPs and an IEEE 14-bus energy-storage control benchmark built from a DC power-flow simulator. 22
Results: For tabular discounted chance-constrained MDPs with fixed bounded successor support and a certified planning oracle, the upper bound scales as Õ(|S||A|[(1−γ)⁻³ε⁻² + (1−γ)⁻¹ρ⁻²]) and a lower bound matches it up to logarithmic terms, so the chance constraint adds one term and the model's main dependence — |S||A| with (1−γ)⁻³ε⁻² — is the same as in an ordinary discounted MDP. The earlier deterministic-policy bound for the same problem scaled as Õ(|S|²|A|(1−γ)⁻⁴(ε⁻²+ρ⁻²)). The model-free guarantee is a finite-sample bound on the KKT residual with independent validation. On the 14-bus benchmark, the Bellman-buffered selector is conservative when data are scarce and its conservatism shrinks as samples grow, while the expected-cost surrogate keeps a gap even when handed the true transition model; the figure averages 60 independent empirical-model trials. 22
Resources: The paper lists no code release. Its benchmark data comes from the University of Washington power-systems test-case archive. 22
Takeaway: Researchers who dismissed chance constraints on computational grounds should read the matching lower bound, since the claim is about statistical price rather than computation. The assumptions bound the result: the model-based guarantee covers deterministic policies, requires a bounded number of successors per state–action pair and access to a certified planning oracle, and exact reward maximisation under a discounted chance constraint is NP-hard as the appendix states. 22
Interpretable models for high-stakes decisions
12. Falling Trees: A Model Class for Interpretable Risk Prioritization
Area tag: Interpretable models and risk prioritisation
arXiv: 2609.23780, first submitted September 20, 2026. 12
Authors / institutions: Varun Babbar, Zachery Boner and Cynthia Rudin at Duke University; Margo Seltzer at the University of British Columbia. The first two authors share equal contribution. 23
Status: ICML 2026 Spotlight; the submission record reads "ICML 2026 (Spotlight paper)". 12
Problem: Screening decisions — which patient, applicant or case to look at first — call for a model whose ordering a person can read and check. Falling rule lists do this by ordering if–then rules so that risk decreases down the list, and the single-path structure is what limits them: an expert who wants a branch in the middle of the list has nowhere to put one. Existing optimisers for these models mine rules in advance, return one model at a time, or lack full optimality guarantees. 23
Method: Falling trees generalise the falling constraint from a list to a tree: along any root-to-leaf path, the positive-class probability of successive leaves is non-increasing. A branching penalty counts internal nodes whose two children are both internal, so one setting of the penalty recovers a rule list and the other extreme recovers a full tree, and the expert controls where on that range the model sits. GRAVITree is a dynamic program with bounds that returns the Rashomon set — every tree within a tolerance of the optimum — rather than a single model, using two new pruning rules for the falling constraint and a cache keyed by the recent positive probability. 23
Comparison: TreeFARMS, which computes Rashomon sets for unconstrained sparse decision trees, a FRAME extension of earlier rule-list optimisation adapted to approximate rule-list Rashomon sets, and XGBoost in the clinical case study. The authors note that direct comparison with TreeFARMS is difficult because the objectives differ. 23
Results: Across twenty public benchmarks, the tree configuration improves test loss over the rule-list configuration — NIJ Recidivism falls from 0.311 to 0.305, Adult from 0.290 to 0.204, MGH from 0.232 to 0.061 — and the false-negative rate on NIJ Recidivism falls from 0.183 to 0.126. TreeFARMS attains lower overall loss on most datasets, which the authors attribute to its unconstrained model class, while GRAVITree produces sparser decisions for high-risk cases on most of the twenty. In a MIMIC-III cohort of 3,148 positive and 27,090 negative cases, balanced to 1:1 and split 70/10/20, a three-branch falling tree reaches 0.69 test accuracy against 0.66 for the single-path version, and XGBoost reaches 0.73 on the same binarised data. 23
Resources: The arXiv record lists no repository for the algorithm or the MIMIC-III study data; the datasets named in the paper are public benchmarks including COMPAS, FICO's explainable machine-learning challenge and the NIJ Recidivism Challenge. 23
Takeaway: Analysts who need an auditable triage model and can accept a small loss in accuracy should read the branching-penalty sweep, since it is the dial that trades a rule list for a tree. Read the comparison with TreeFARMS carefully as well: the two optimise different objectives, and the paper reports where each wins rather than a single ranking. 23
What to open first
- Building or securing agents: for skill composition read SkillCascade (2609.30383) and run its indispensability test on your own skill set; for the tool-selection side read ToolSearcher (2609.30906); for the conversation-state side read Mutable Transcripts (2609.31354) if you own a chat product. 1
- Post-training and fine-tuning: the continual fine-tuning paper (2609.30935) if you fine-tune a released checkpoint across task orders, and SAGE (2609.30192) if your problem is long-horizon reasoning under sparse reward. 5
- Computer vision: M-plicits (2609.28684) for noisy point-cloud reconstruction, and SGMA (2609.30682) if you pre-train on gigapixel microscopy or whole-slide data and are paying for it in inference time. 6
- Multimodal evaluation: the audio-visual binding paper (2609.31193) is the one to open if "who says what" is part of your task, because its priming table separates a representation problem from a grounding problem. 7
- Privacy and provenance: TRACE (2609.30258) if you federate policy learning, and FARE (2609.30982) if you audit a generative service against a certification contract. 9
- Theory and auditable decisions: the chance-constrained MDP paper (2609.30856) for the sample-complexity argument, and Falling Trees (2609.23780) if you need a triage model an expert can amend by hand. 11
References
- 1SkillCascade arXiv record
arxiv.org
- 2ToolSearcher arXiv record
arxiv.org
- 3Mutable Transcripts arXiv record
arxiv.org
- 4SAGE arXiv record
arxiv.org
- 5EoupCT arXiv record
arxiv.org
- 6M-plicits arXiv record
arxiv.org
- 7Who Says What arXiv record
arxiv.org
- 8SGMA arXiv record
arxiv.org
- 9TRACE arXiv record
arxiv.org
- 10FARE arXiv record
arxiv.org
- 11Chance-Constrained MDPs arXiv record
arxiv.org
- 12Falling Trees arXiv record
arxiv.org
- 13SkillCascade paper
arxiv.org
- 14ToolSearcher paper
arxiv.org
- 15Mutable Transcripts paper
arxiv.org
- 16SAGE paper
arxiv.org
- 17EoupCT paper
arxiv.org
- 18Who Says What paper
arxiv.org
- 19SGMA paper
arxiv.org
- 20TRACE paper
arxiv.org
- 21FARE paper
arxiv.org
- 22Chance-Constrained MDPs paper
arxiv.org
- 23Falling Trees paper
arxiv.org
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.