All items

BILAL-BENCH is a 240-question, expert-verified benchmark for open-ended Islamic-source fabrication in Bengali, covering Qur'anic attribution, hadith, fiqh, contemporary issues and false-premise prompts. Evaluating seven open-weight models from 1B to 120B on 1,680 double-annotated responses, six of seven confidently fabricated on 79.3-95.3% of source-production questions, with no monotonic improvement from scale. Hadith provenance was the weakest category, with only two of 315 responses correct and correctly sourced.

CoFiBreak is a coarse-to-fine diversity reward for Group Relative Policy Optimization (GRPO) that trains an attacker LLM to produce more varied multi-turn jailbreaks. The coarse reward favors strategies underrepresented within each GRPO group, and the fine reward discourages reuse of the same personas, framings, and output formats. Against Llama3.1-8B-Instruct on HarmBench it finds 1.6-2.0x as many distinct successful fine-grained strategies as the strongest baseline, and it reaches 98.8% ASR@10 on AdvBench. The attacks transfer to unseen frontier models, reaching 71.0% ASR@10 on AdvBench against Claude-Opus-4.6.

The paper addresses multi-turn jailbreaks, where a harmful request spread across a conversation still succeeds despite safety alignment that concentrates in a model's first few output tokens. It proposes Assess → Decide → Respond, which has the defender commit to an explicit, parseable safety decision before generating a reply, trained with reinforcement learning at the payload turn. Across two model families and fourteen benchmarks, the authors report the strongest multi-turn safety in a controlled comparison, with a modest cost to helpfulness.

Researchers address membership inference attacks on diffusion models, which test whether an image was in a model's training set, and note that standard reconstruction-loss scoring fails because some images are inherently easy to reconstruct. They propose difficulty calibration across two time axes: Reference-Model Calibration (RMC) compares a fine-tuned model's loss against an earlier checkpoint, and Temporal Self-Calibration (TSC) compares loss across neighboring diffusion timesteps using a single model. The authors report that their methods outperform prior state of the art by a wide margin and generalize across x-, v-, and ε-prediction models.

TextSeal2 is a distortion-free watermark for LLMs that keeps its signal under speculative decoding, with tokens replacing rejected drafts still watermarked and the acceptance rate unchanged. It merges two or more keys into one virtual key coupled to fresh noise via AutoMark's Gaussian copula, and evaluated on three LLMs it detects 8 to 22 percentage points more 100-token answers than TextSeal at a false-positive rate of $10^{-3}$. Under speculative decoding it detects 18 and 22 percentage points more 200-token answers than TextSeal and textGrain, respectively, at the same acceptance rate.

This arXiv preprint (cs.CR) argues that optimizing Large Language Models for edge deployment, to cut memory, computation and energy costs, can degrade security even when task performance holds. The authors frame optimization as an information transformation that can alter representations, decision pathways and trust boundaries. They describe this as security drift and optimization-induced attack surfaces.

Researchers propose a template-based augmentation pipeline that generates large multilingual refusal and benign training corpora by extracting templates from harmful prompts, translating them, and filling slots with culturally localized entities. They release MSafeTemp, a validated corpus spanning 60 languages. They find English-only evaluation misjudges multilingual safety: attacks failing in English succeed once translated, and culturally localized variants expose further failures.