From the arXiv new submissions of the past 24 to 48 hours in cs.AI, cs.LG, and cs.CL, this digest selects five preprints that demonstrate how easily trust, evaluation, and training of today’s AI systems can be derailed – and how precisely some of these vulnerabilities can be addressed. Curation was done based on a traceable methodology in the abstract, concrete core results with numbers, and thematic dispersion instead of fivefold repetition of the same subfield.
Trust and Evaluation
AI sales agents take one-sided claims as facts
Rahul Balakavi shows in his study that AI agents evaluating customer relationship management (CRM) datasets systematically fail when a party with a vested interest – here a sales representative – writes an optimistic claim into the record. In 100 tasks from the benchmark CRMArena-Pro, the sales representative claims a suitable timeline in every case and a suitable budget in 76 cases; if this claim contradicts the underlying price list, a model that only reads the conversation log still closes the deal in 29 out of 31 cases. According to Balakavi, the pattern remains nearly unchanged across seven models from four providers (87 to 97 percent error rate), and even submitting the actual documents lowers the strict accuracy in a control condition from 41 to 18 percent, because models then agree more, but incorrectly. This matters because companies are increasingly deploying agents on their own business data, which are exposed to exactly such one-sided entries – a related risk was already shown by an earlier digest finding on unsafe agent behavior with risky third-party skills, only that here a single convincing sentence in the dataset suffices, rather than a tool.
AI grading outperforms humans – until a single sentence causes it to collapse
Ali Habibullah and a four-member team let their study evaluate a real, double human-rated computer science exam (570 students) with 171 configurations from open and closed language models. In the best case, a model achieves a mean error of 1.64 out of 35 points – lower than the 2.61 points by which two human examiners differ. The catch lies in the prompt: a brief instruction along the lines of “strict examiner, no partial points” drives 14 out of 17 open models out of the acceptable range, with three stopping grading altogether; in a second, independent exam with 1,038 students, the vulnerability replicates but partially flips in the opposite direction. Light LoRA fine-tuning on about 3,900 pooled examples resolves the issue and brings five small open models up to the level of a human examiner. This matters because universities are already discussing AI grading as a response to staff shortages – how unreliable a single sentence in the system prompt makes this judgment was already indicated by an earlier digest finding on contradictory AI tutor evaluations, and here the extent is now evident in a real exam.
Training and Discovery
Latent knowledge collapses during distillation – a timely topic shift saves it
Jie Yang and a nine-member team uncover a failure pattern in their study in latent on-policy distillation (OPD), where a smaller student model is supposed to mimic not only the word output but also the internal states of a larger teacher model. When distilling Qwen3-4B and Qwen3-8B into Qwen3-1.7B-Base, pure latent control initially raises the math accuracy (MATH-500) in ten steps from 25 to 46 percent, but then collapses without recovery to 11 percent – and the model that aligns best with the teacher performs the worst, because layers functioning differently per depth force the student into inappropriate states. The proposed method LastOPD applies the latent signal only on the last layer and blends it into classic token training over ten steps, which according to the authors gains 5.55 and 4.02 points compared to pure token training and reaches the starting level in about half as many training steps. This matters because distillation is becoming the standard procedure to reduce large models cost-effectively – a pattern of training collapse that was already observed by an earlier digest in other methods finds a concrete technical solution here.
A new method makes AI models seek “interesting” rather than merely correct mathematics
Niket Patel, Ahmad Rammal, Amaury Hayat, Rémi Munos, and Julia Kempe define in their study the intrinsic interestingness of a mathematical theorem as the ratio of proof length to statement length and show that this simple metric strongly correlates with the actual utility of a theorem for subsequent research. Based on this, they train a 27-billion-parameter model that predicts the difficulty of a proof more reliably than larger, general-purpose frontier models, and use it to build a self-expanding system of conjectures, proofs, and selections. Optimized for this interestingness metric, the share of theorems that are already fully or mostly present in the established library Mathlib drops from 91.9 to 30.6 percent – an indication of genuinely novel rather than merely reformulated mathematics. This matters because AI systems can increasingly generate theorems independently, but until now there has been hardly any benchmark to separate trivial from substantial – a problem that was already raised by an earlier digest finding on an open multi-agent system with genuinely new mathematical results without solving it.
A single neutral word is enough to transfer programming ability unnoticed
Ziyang Zhang and a five-member team present with Active Taskless Distillation (ATD) in their study a method that transfers skills from a teacher model to a student model without the need for target-task examples, teacher probabilities, or teacher parameters. The method selectively chooses prompts where the common predecessor of teacher and student is nearly indifferent between two arbitrary words, allowing the student to learn solely from the word chosen by the teacher. In the central programming experiment with Qwen2.5-1.5B, the authors state that 5,664 such one-word responses are sufficient for a gain of 5.34 percentage points on the coding benchmark HumanEval+ compared to a precisely controlled comparison condition; similar transfers are observed in scientific knowledge, everyday reasoning, and reading comprehension across multiple model families. This matters because earlier work on so-called “subliminal learning” usually required extensive teacher outputs to transfer behavior – an earlier digest finding already showed a replication of this effect with highly variable transfer strength, and the new study now shows that a single word per prompt can suffice for tangible skill gains without operators needing to notice it in the training material.
All five works are unreviewed preprints from the latest arXiv submission wave; the referenced numbers are based on the abstracts and statements of the respective author teams and have not yet been confirmed by independent review or replication. For the grading study and for LastOPD, the dataset or training code is publicly available, facilitating independent verification; for the studies on CRM agents, math interestingness, and one-word transfer, no complete publication is evident from the abstracts. How robust the 87-to-97-percent deception rate in CRM agents, LastOPD’s training gain, and ATD’s 5.34 percentage point transfer hold outside the respective test environments remains to be shown by independent replications.
