From the arXiv new submissions of the past 24 to 48 hours in cs.AI, cs.LG, and cs.CL, this digest selects five papers that together demonstrate how easily security training can be circumvented, risk assessments can be distorted, and efficiency promises can be relativized – from a seemingly harmless ASCII image to a new framework for risk checks, to a coding agent with built-in errors, a sobering compression result, and a memory trap in AI agents. The curation was based on substance and thematic diversity: each paper provides a traceable method with robust numbers in the abstract, and no two papers address the same subfield.
ASCII art disguised as art criticism circumvents security training
Da Cheng Gu, Yifei Dong, Xinghao Yang, Yongshun Gong, and Wei Liu present the ASCII Attack method, a jailbreak technique where a malicious request remains fully readable but is presented as ASCII art – image art composed of text characters – and framed as an artistic engagement with the topic. Unlike previous obfuscation attacks, the authors claim that the attack requires no model access and works with just a single request. Tested on eleven models and eight damage categories, evaluation models classified 62 percent of the reformulated requests as harmful, compared to 42 percent for direct control requests without disguise; for the most vulnerable tested model, the success rate was 93 percent. At the same time, the employed evaluation models contradicted each other in about two-thirds of the individual cases, indicating an uncertain measurement basis for such security checks. A previous digest entry had already shown that targeted fuzzing over internal security neurons could trigger 76 to 100 percent of all attempted jailbreaks in five models – the new study shows that even a simple visual repackaging without any model access can be similarly effective. This matters because security training apparently reacts more strongly to the text form of a request than to its actual content.
A new framework assesses dangerous AI capabilities separately from actual harm
Zhengyi Jin, Ru Zhang, Xiao Chen, Xinbo Liu, Jiaxuan Lin, Jia Huang, Jianyi Liu, and Zhen Yang present FUSE, a modular framework that evaluates each model through three independent assessment paths – knowledge, defense readiness (refusal of risky requests), and actual harm when successfully circumventing this defense – and combines the results into a unified risk profile. In tests on twelve commercial language models from four model families, using a chemistry-biology component, the authors find strongly diverging profiles: models with similar risk knowledge differ significantly in their defense readiness, and models with robust defense do not automatically produce less harmful content once they concede to a request, according to the authors. Newer models also deepen their risk knowledge but only partially improve their defense – a declining trend in actual harm cannot be consistently observed over time. The three assessment paths correlate only weakly with each other (ρ between 0.32 and 0.97), supporting their substantive independence. A previous digest entry had already documented that GPT-5.5 could be manipulated with targeted jailbreak prompts to generate virus candidate sequences with potentially increased infectiousness – FUSE now provides a reusable measurement framework that systematically separates knowledge, defense, and harm instead of mixing them into a single metric. This matters because individual risk benchmarks have often only represented one of these three aspects, providing an incomplete picture.
A coding agent incorporates five documented types of errors into a data system
Phanindra Reddy Madduru investigates in a case study on AI coding agents in systems engineering tasks what errors an agent makes when implementing a multi-part data system against a given specification. Five specific types of errors were documented and categorized by the nature of the violated specification and the method of detection. Additionally, the work tests filtered against unfiltered search strategies on a pooled corpus of 2,994 text segments and 100 questions from the HotpotQA benchmark: the filtered search achieves its maximum possible hit rate with a query budget of three hits, while the unfiltered search only achieves a success rate of 69 percent even with a budget of ten hits – a difference that remains significant across all tested budgets with a probability of error below 0.01 percent according to a sign test. A previous digest entry had already provided the first production characterization of coding agents like GitHub Copilot with 761 million analyzed LLM calls – the new case study complements this picture with concrete, named types of errors from a single, but thoroughly documented implementation. This matters because companies are increasingly using coding agents for complete system implementations rather than just for individual functions, without robust error taxonomies for this task class being widely available.
Ternarization compresses an open model to 1.64 bits – and makes it slower instead of faster
Anirudh Malik, M Sparsh Mehra, and Poojith Devan demonstrate with a post-training ternarization of Qwen3-4B how far an open, 4 billion parameter language model can be compressed when only the weights are reduced to extremely few possible values, while the activations remain at 16-bit precision. With 81.62 percent ternarized parameters, the authors achieve an effective bit requirement of 1.641 bits per quantized weight and reduce the memory requirement from 8.29 to 3.96 gigabytes; the average accuracy across ten benchmarks drops from 64.5 to 54.7 percent, and the perplexity – a measure of how well a model predicts the next text block, with lower values being better – increases on WikiText-2 from 13.6 to 18.7. Notably, the inference on the tested configuration is, according to the authors, not faster but 4.6 times slower than with the uncompressed FP16 model, because the extreme compression creates additional computational overhead during decoding. The startup PrismML claimed in July to have compressed a 27 billion model to 3.9 gigabytes by reducing it to as low as 1.58 bits per weight while retaining up to 95 percent of the original performance – the new study provides significantly more sobering figures on accuracy loss and runtime for a comparable bit budget. This matters because memory savings and inference speed at ultra-low bit budgets do not necessarily occur together.
Small AI agents almost always trust outdated memories
Jundong Hu and Shekar Ramachandran investigate with a study on the “Memory Trust Gap” how persistent memory in AI agents is affected when stored information becomes outdated and contradicts a current, reliable source. In a 2×2×2×2 factorial test setup with Qwen3 models ranging from 0.6 to 8 billion parameters, the smaller models answer questions with the outdated rather than the currently available, correct value in 92 to 100 percent of cases; larger models exhibit more complex, less one-sided behavior. According to the authors, it is not confusion but genuine overconfidence in their stored memory that drives the errors – a difference that also determines the countermeasure: larger models benefit from disclosing origin and recency information for memory, while smaller models require an explicit conflict resolution mechanism. The authors confirm the effect across independent model families and external datasets; the work is currently submitted for review at a NeurIPS 2026 workshop. A previous digest entry had already shown that tool-using language models defend a correctly stored answer against a wrong tool result only in 6.5 to 17.1 percent of cases – there, models easily shift away from a correct memory, while here they cling too rigidly to a false one. This matters because both findings together show how difficult it is for today’s agents to reliably weigh multiple conflicting sources of information.
None of the five presented works has yet gone through a regular peer review process; all are unrefereed arXiv preprints, with their numbers coming from the experiments of the respective author teams and not yet externally replicated. Whether the reported effects can be confirmed in further models, attack scenarios, and independent replications remains to be seen.
