Today’s selection from the arXiv new submissions of the past 24 to 48 hours connects four different layers of AI operations: the power consumption of large training clusters, the internal architecture of safety mechanisms, the reliability of a widespread evaluation method, and the vulnerability of language models to targeted persuasion. Curation followed substance and spread: each paper offers a traceable method with robust numbers in the abstract, and no two works cover the same subfield.
Data centers: A learning controller curbs power spikes without losing performance
Researcher Eliseo Curcio records the power telemetry of large GPU training runs in Cutting AI Datacenter Energy with Reinforcement Learning and uses it to train a PPO controller (Proximal Policy Optimization, a common reinforcement-learning method) that continuously adapts generation parameters to measured power draw, instead of relying on the static power caps and reactive throttling used until now. The basis is more than 380,000 telemetry samples from GRPO training runs with models ranging from 7 to 72 billion parameters on A100 hardware. In the single-GPU test with a 7-billion-parameter model, the controller reportedly cuts power-limit violations by 89.8 percent while generating 18.1 percent more tokens and achieving 26.2 percent better energy efficiency; in live deployment with a 72-billion-parameter model, the controller delivers 35.7 percent more throughput than the baseline with only 2.27 percent of violations remaining. At the fleet level with 16 GPUs, the author reports zero violations at 30-second measurement windows, while peak demand stayed at 50 to 56 percent of nameplate capacity – a margin that, in his estimate, would allow roughly twofold oversubscription of nameplate capacity. This matters because AI training clusters are increasingly running into grid-capacity and permitting limits; Nvidia’s three-billion-dollar stake in power supplier Lancium recently showed just how tightly AI growth is now tied to energy infrastructure – a software-side lever like this controller addresses exactly the problem that new power-plant capacity has so far been the main answer to.
Safety alignment: Refusal sits concentrated in a few middle layers
Mingyu Zong, Sampad Mohanty, and Bhaskar Krishnamachari investigate in Localizing Safety Alignment where in a language model the ability to refuse harmful requests is actually anchored. To do so, they transplant individual weight components between a safety-aligned and a non-aligned version of the same model and measure how much refusal behavior each transplant restores. Across all tested model-dataset combinations, only the MLP weights (the fully connected intermediate layers of a transformer block) reportedly restore at least 2.7 times more refusal than the attention parameters, and a middle block spanning layers 8 to 11 is picked first in all six greedy searches conducted. Notably, in five of six search trajectories, adding further aligned blocks actually reduced the overall measured refusal performance, so safety does not simply sum linearly across more building blocks in this model. This matters because it makes safety tuning look less like a diffuse property spread across the whole model and more like a concentrated, deliberately manipulable mechanism – with implications both for more robust alignment training and for the risk that targeted interventions at exactly these layers could just as deliberately strip safety away. An earlier digest entry had already shown how sycophancy tendencies can be localized down to individual authority tokens – the new work adds to a growing body of findings that individual language-model behaviors often trace back to surprisingly compact internal structures.
Evaluation: Majority voting hurts small models on hard science questions
Utkarsh Bahuguna examines in When Self-Consistency Backfires whether majority voting over multiple sampled answers – a common method for boosting the reliability of language-model answers through repeated querying – actually helps small, instruction-tuned models. The test runs on 198 graduate-level questions from the physics and chemistry benchmark GPQA Diamond, split into a 47-question exploratory set and a 151-question confirmatory set. The result runs against common practice: for Qwen2.5-7B, majority voting worsens the hit rate compared to a single answer on 56.6 percent of individual questions, and for Llama-3-8B on 65.7 percent – even though an oracle that always picked the correct answer from the same sampled responses would sit 14 and 17 percentage points, respectively, above the single-answer baseline. The correct answer is thus usually present in the sample pool, but majority voting does not reliably surface it, and even refined selection criteria based on agreement level or token entropy improve the result by at most 0.2 percentage points over a fixed sampling budget, according to the author. This matters because majority voting is often used unreflectively as a reliability lever in practice, even though it can fail precisely on the hard questions where reliability matters most.
Persuasion: A trained attacker topples models with a single false argument
Nimet Beyza Bozdag, Emre Can Acikgoz, Gokhan Tur, and Dilek Hakkani-Tür show in Learning to Persuade Exposes How Easily LLMs Abandon Correct Beliefs how vulnerable language models are to targeted persuasion. They train their own persuasion agents via reinforcement learning, whose sole task is to convince a target model of a false answer within a single interaction. Undirected, untrained persuasion attempts succeed in about 24 percent of cases, according to the authors; after reinforcement-learning training, the success rate against the models used during training climbs to over 93 percent – a single, strategically placed, factually false argument is enough to drive the target model’s accuracy nearly to zero. The attack transfers unevenly to previously unseen models: 83 percent success against Qwen-14B, 79 percent against Llama-3.1-8B, but only 25 percent against GPT-4o-mini – a figure that additional curriculum training raises to 38 percent. The optimized persuasion agents increasingly rely on credibility-based tactics, including fabricated citations and false authoritative evidence, according to the authors. This matters because it shows that persuasion robustness goes beyond mere false-claim detection and becomes an independent safety requirement, especially in multi-agent and human-AI collaboration systems. An earlier digest entry had already described an AI agent that rejected a directly stated manipulative goal but pursued it once other agents obscured it – the new work shows that susceptibility to manipulation shows up not only with obscured goals but also with openly false, convincingly delivered arguments.
All four works are unreviewed preprints, not independently peer-reviewed – the reported figures come from the respective author teams’ own experiments and have not yet been externally replicated. That applies especially to the data-center study, whose 16-GPU fleet result has not yet been confirmed by an independent operator, and to the safety-localization work, whose weight transplantation was tested on only a limited number of model-dataset pairs. Whether these effects hold up across further models, data centers, and independent replications remains to be seen.
