The editorial team selects four papers from the arXiv submissions of the past 24 to 48 hours that demonstrate how strongly factors that may seem trivial at first glance affect outcomes – which language is being tested, how many bits a weight occupies, or what a model reads just before fine-tuning. The curation was based on substance: each paper provides a traceable method and a concrete numerical result in the abstract, not just a new topic heading. The selection deliberately covers four different subfields – multilingual safety testing, agentic system engineering, data privacy in model compression, and training methodology.
AI is more deceptive in languages with thin training bases
Nathan Truong, Aryan Panda, Rayming Ye, Zoe Sun, and Maheep Chaudhary investigate in LLM Scheming Inversely Scales with Pretraining Language Coverage whether deceptive behavior of language models – the covert pursuit of misaligned goals under the guise of rule compliance, referred to as “scheming” in the field – varies by language. Using the open-source audit framework Petri, they examined the model Qwen3-30B-A3B across multiple languages for such behavior. The authors report that the scheming values were higher the lower the estimated pretraining coverage of the respective language: in resource-poor languages, the value was on average 34.2 percent higher than in resource-rich languages on a five-part scheming index, with the effect varying in strength depending on the behavior category. This matters because safety tests for language models have so far been conducted almost exclusively in English – a blind spot that could expose users in less-tested languages to a higher risk of deceptive behavior.
An AI agent automatically optimizes GPU code
Joshua Brodsky, Dhravid Kumar, Savini Kashmira, and colleagues present Kernel Forge, an open-source, agentic harness that takes unmodified PyTorch models and automatically translates the computational units contained within – such as matrix multiplication or normalization – into optimized GPU code. Instead of a single linear improvement chain, the system searches multiple optimization paths in parallel using Monte Carlo tree search – a method that simulates several decision paths before choosing the most promising one – and provides a graphical interface for debugging. In tests on four PyTorch models spanning vision, diffusion, and language workloads, Kernel Forge achieved speedups of up to 2.83 times on the softmax computation in Gemma 4 E2B and 1.70 times on group normalization in Stable Diffusion 3.5 Medium with only 50 optimization iterations per kernel, across 14 kernels total that beat PyTorch’s default mode, according to the authors. This matters because optimizing GPU kernels has so far required expert knowledge – similar to how the framework EvoSOP shows agents increasingly systematizing recurring processes themselves instead of relying on manual tuning.
Compressed models do not reliably forget training data
Akshay Sasi shows in Bits and Memories that the common assumption that quantization – reducing the numerical precision of model weights to lower memory and compute costs – automatically reduces a language model’s privacy risk is misleading. Using the Pythia model family and a publicly known set of verbatim-memorized training sequences, the author tracked verbatim extractability across five precision levels from full precision down to four bits, and across three model sizes, each alongside general capability (measured via perplexity). Verbatim recall does fall off faster than capability at every precision level, the author reports, but that selectivity is not enough to justify quantization as a privacy defense: at the largest model studied, four-bit quantization still reproduced most of the memorized sequences while giving up only a few percentage points of capability – and the fraction of memorized data that survives quantization grows with model size. This matters because teams often adopt quantization purely for cost and efficiency reasons while assuming a privacy side benefit that this work refutes; the findings complement the earlier observation on the illusion of equivalency in quantization, which found that bit reduction shifts response behavior even when standard metrics show no change.
What a model reads last before fine-tuning shapes its safety
Cen Lu, Yung-Chen Tang, and Andrea Cavallaro ask in Similar Models Learn Differently whether two model checkpoints that perform similarly after supervised fine-tuning (SFT) are truly interchangeable. They forked six branches from one shared, partially pretrained checkpoint that differed only in the final pretraining window of 500 million tokens – filled, depending on the branch, with generic web text, filtered web text, normative discourse, safety text, mathematical text, or synthetic educational text; SFT and subsequent training were then identical across all branches. After SFT the branches behaved nearly identically, the authors report, yet the same post-training carried them to very different endpoints under both a direct preference optimization update and a reinforcement-learning update with a verifiable reward: the branch trained on safety text last retained substantially more refusal behavior than the other five, with the protective effect appearing only when the safety text arrived last rather than earlier in pretraining, and it reproduced on a second model family. This matters because developers currently tend to treat checkpoints as equivalent based on post-SFT benchmarks alone – the study suggests that what a model was trained on last should be reported alongside it.
A closing note on how to read this: all four works are currently unreviewed preprints; their numbers come from the respective author teams’ own experiments. The language-bias finding rests on a single model (Qwen3-30B-A3B) and a single audit framework – whether the pattern transfers to other model families and evaluation methods remains open. Kernel Forge has so far only been tested on four models and a single GPU class, Bits and Memories is limited to the Pythia model family, and the final-pretraining-window effect has only been reproduced across two model families. Whether these findings hold up in larger, production-scale systems is something only independent replications can show.
