The widespread adoption of systems based on Large Language Models has made the reliable detection of prompt injection attacks a critical requirement. However, high performance achieved on training and test splits generated from the same data source does not guarantee that models can generalize to prompts from different sources. In this study, a leak-aware cross-dataset evaluation framework is presented to examine the robustness of classical machine learning and Transformer-based prompt injection detection models in the face of data source changes. During the data preparation process, empty records, duplicate prompts, conflicting labels, and text overlaps between datasets were checked. In this context, 38,184 duplicate records and 14 instances with conflicting labels were removed, and the 198 common prompts identified between the training and external test sets were removed only from the training set. Using WordHash and CharHash representations, SGD Logistic and Linear SVM models, as well as DistilBERT and DeBERTa-v3-small, were evaluated on an internal dataset consisting of 426,073 cleaned requests; the models were also tested on an independent dataset of 5,000 examples. While the models achieved performance in the range of approximately 0.997–1.000 in the internal evaluation, significant performance losses were observed in the external evaluation. DeBERTa-v3-small delivered the most balanced results, with an accuracy of 0.7360, a balanced accuracy of 0.7320, a Macro-F1 of 0.7284, and an attack sensitivity of 0.7119. The domain classifier achieved an ROC-AUC of 0.9770 hence indicating a remarkable shift in the distribution across data sources. The results show that internal validation results are not enough for prompt injection detection. Independent external validation, data leakage verification and domain shift analysis should be fundamental parts of reliable model evaluation.
Oğuzhan KİLİM· Yalvaç Akademi Dergisi· 0 citations
HIPPOGRID — evidence pack for the preliminary results (2026) Raw result files and figures behind the preliminary results cited in the MSCA-PF proposal HIPPOGRID (SEP-211387371, call HORIZON-MSCA-2026-PF-01). Researcher: Álvaro González-Redondo (University of Granada). Each bundle below backs one claim of the proposal; each result file is the unmodified output of the experiment that produced it, and the commit hash anchors it in the (currently private) research repository, scheduled for open release (Apache-2.0) with the corresponding papers. Numbers were produced with 10 random seeds and paired comparisons against non-degenerate null models unless stated otherwise. License: CC-BY 4.0. Contact: alvarogr@ugr.es Bundle Claim it backs (as in the proposal) Key files Commit B1_real_sensor_binding Image and posture written to one shared address are recovered from each other on a real robot's sensor stream (8,346 frames, 10 seeds); writing to a shuffled address destroys the binding asymmetrically while the memory stays intact `n562_real.json`, figure 5498007e B2_innate_template_binding A one-shot Hebbian binding anchors an innate grid-module set at 1.0–1.4 cells median under biological-level velocity noise (10/10 seeds; bounded at 3× that noise; shuffled-binding and shuffled-velocity nulls fail); the anchored map reproduces the signature of classic deformation experiments (partial rescaling; anisotropic field stretching, cf. Barry et al. 2007; merged-map seam, cf. Wernle et al. 2018) `n569_ancla*.json`, `n569_deformada.json`, `n569_defensa.json`, figures 0f20cb40 B3_rate_grid_recipe A purely local Hebbian/anti-Hebbian rule yields clean 2-D grid maps with no explicit normalisation: best-unit grid score 0.81 (torus) / 0.71 (walled box), medians over 10 seeds `n565_toro.json`, `n565_caja.json`, `n565_repro.json`, figure 2c6455c7 B4_place_stage_chain The chain closes from raw sensed input through a competitive place stage (grid score ≥ 0.4 in 9/10 seeds; direct input 0/20); small modules of distinct grid units at small grid-layer sizes; a stored-experience place stage performs like a trained one `n567_u4096_rejilla.json`, `n568_10semillas.json`, `n568_nulos.json`, `n568_redundancia.json` 0243e5b0 B5_blackboard_capacity With learned addresses the blackboard's capacity grows ~N/2 vs ~N^0.45 without learning (`n562_escalado.json`, keys `ley*`); the worst alias between two distant places falls from 0.995 to 0.093 at 4,096 cells (`n562_aprendido_dos_tablas.json`; N-dependent: 0.904 at 1,024 cells) `n562_escalado.json`, `n562_aprendido_dos_tablas.json` 16d3322e / 3a22657e B6_local_rule_ceiling A single-layer delta rule with a self-generated teacher ties the exact optimum of its family (+0.71 vs +0.70) and the non-negative constraint improves it (+0.82, 16/16) `n541_techo_exacto.json`, `n542_delta.json`, `n542_rectificada.json` d764a6fd Figures are included where the proposal reproduces them. JSON field names are in Spanish (the project's working language); each file is self-describing, with seeds and conditions as keys.
Álvaro González-Redondo· Zenodo (CERN European Organi...· 0 citations
(c) 2026 Pranay Mahendrakar. Licensed under CC BY 4.0. The literature on how language models behave when retrieved context contradicts parametric memory contains a flat contradiction, and neither of its two surveys resolves it. One body of results reports over-reliance on memorised information; another reports that models are highly receptive to conflicting external evidence; a third reports that knowledge updates fail less often than previously published numbers imply. This paper argues that the contradiction is largely not a disagreement about models, because the studies do not share a measurand. A context-memory conflict is not an event that is observed; it is an object the experimenter builds, and seven design choices go into building it: what the conflicting passage is made of, which side is stipulated to be correct and whether the model's belief was elicited or assumed, what quantity is measured, which items are in the sample, what the task demands, what the prompt says, and which model was tested and what was done to it after pretraining. For five of the seven, a single published study varies that choice while holding the others fixed and the reported behaviour moves with it; for the remaining two the evidence is a comparison across studies and is labelled as such. The strongest available adjudication is a 2026 reproducibility study that ran two benchmarks with opposite conclusions under each other's evaluation protocol and attributed the outcome to dataset design, evaluation metric and model size. The reading offered here is narrower than the one the field is converging on. It is not that task demand is the discriminating variable, which one careful study established for one variable while holding others constant, but that the moderators replicate and the point estimates do not: prior confidence, context plausibility, entity frequency and internal inconsistency recur across studies as moderators of context adoption, several of them with a consistent sign, while the adoption rate itself is set by the construction. What follows is that no published number in this literature has been shown to identify a model-level disposition, that a paper reporting only such a number cannot be compared to another, and that the reporting needed to make them comparable is small and is mostly not being done. The literature search, drafting and citation verification for this paper were carried out with AI assistance under the author's direction. Every citation was machine-verified against the arXiv API and Crossref before inclusion, and every quantitative claim was read back against the cited source's own abstract. The author is responsible for the final text and for all claims made in it.
Pranay M. Mahendrakar· Zenodo (CERN European Organi...· 0 citations
Working paper and open data. Studies that measure the output of more than one AI language model consistently find that the models write differently, in the same manner that human authors have different writing styles. We coin the term **modelometry** for the measurement and attribution of the inter-model writing style of AI systems, and **modelolect** for the style itself, formed on the pattern of idiolect and sociolect. The study asks whether the modelolect of a flagship model family is strong enough for a classifier that reads only surface stylometric features to classify the AI family that originally wrote a text. We test seven families (GPT, Claude, Gemini, DeepSeek, Grok, Llama and Qwen) against human text, in two registers (formal academic text, and informal chat text) and with three tiers of features. Every AI text used is from corpora generated for our prior studies or from open datasets. On academic text, a gradient boosting classifier over 47 interpretable stylometric features attributes 7 classes (human and six families) at 73.7% accuracy against a 14.3% chance rate, and 6 classes on a second corpus at 79.2%. On chat responses from the LMArena preference dataset, the same 47 features attribute all seven families at 63.9%, and a character n-gram model with model names masked reaches 87.0%, so the small interpretable feature set accounts for about three quarters of the attributable signal. The confusion structure is also informative, since DeepSeek is rarely confused with GPT (3% in the corpus where DeepSeek is most identifiable), so the writing-style evidence does not support the claim that 'DeepSeek behaves as a distillation of GPT'. The largest confusion in the chat register is between Qwen and GPT, at about 16%. Claude is the most identifiable family in both registers. A classifier trained on academic AI generated rewrites achieves only 18.6% on chat text from the same families, so a modelolect is specific to *register*, and to *model version*, and attribution requires training data from the register it will judge. As a byproduct we release inter-family vocabulary lexicons built with the log-odds method of our study on AI vocabulary. As a final experiment, after one TextPulse humanization, *p(human)* under the family classifier increases for 87 to 98% of the texts, a majority of the humanized texts classify as human, and the source family is recovered for at most 3% of them. All features, statistics, scores and code are made publicly available for future work. Files: the paper (PDF), per-text feature tables and classifier scores for every experiment, the confusion matrices and results, the per-family vocabulary lexicons, and the scripts and figures. Raw texts from the LMArena and HAP-E datasets are not redistributed; the released sampling code (fixed seed) reconstructs the exact samples from the public datasets.
TextPulse Research· Zenodo (CERN European Organi...· 0 citations
Reach audiences
Advertise in front of researchers, engineers, and readers.
HIPPOGRID — evidence pack for the preliminary results (2026) Raw result files and figures behind the preliminary results cited in the MSCA-PF proposal HIPPOGRID (SEP-211387371, call HORIZON-MSCA-2026-PF-01). Researcher: Álvaro González-Redondo (University of Granada). Each bundle below backs one claim of the proposal; each result file is the unmodified output of the experiment that produced it, and the commit hash anchors it in the (currently private) research repository, scheduled for open release (Apache-2.0) with the corresponding papers. Numbers were produced with 10 random seeds and paired comparisons against non-degenerate null models unless stated otherwise. License: CC-BY 4.0. Contact: alvarogr@ugr.es Bundle Claim it backs (as in the proposal) Key files Commit B1_real_sensor_binding Image and posture written to one shared address are recovered from each other on a real robot's sensor stream (8,346 frames, 10 seeds); writing to a shuffled address destroys the binding asymmetrically while the memory stays intact `n562_real.json`, figure 5498007e B2_innate_template_binding A one-shot Hebbian binding anchors an innate grid-module set at 1.0–1.4 cells median under biological-level velocity noise (10/10 seeds; bounded at 3× that noise; shuffled-binding and shuffled-velocity nulls fail); the anchored map reproduces the signature of classic deformation experiments (partial rescaling; anisotropic field stretching, cf. Barry et al. 2007; merged-map seam, cf. Wernle et al. 2018) `n569_ancla*.json`, `n569_deformada.json`, `n569_defensa.json`, figures 0f20cb40 B3_rate_grid_recipe A purely local Hebbian/anti-Hebbian rule yields clean 2-D grid maps with no explicit normalisation: best-unit grid score 0.81 (torus) / 0.71 (walled box), medians over 10 seeds `n565_toro.json`, `n565_caja.json`, `n565_repro.json`, figure 2c6455c7 B4_place_stage_chain The chain closes from raw sensed input through a competitive place stage (grid score ≥ 0.4 in 9/10 seeds; direct input 0/20); small modules of distinct grid units at small grid-layer sizes; a stored-experience place stage performs like a trained one `n567_u4096_rejilla.json`, `n568_10semillas.json`, `n568_nulos.json`, `n568_redundancia.json` 0243e5b0 B5_blackboard_capacity With learned addresses the blackboard's capacity grows ~N/2 vs ~N^0.45 without learning (`n562_escalado.json`, keys `ley*`); the worst alias between two distant places falls from 0.995 to 0.093 at 4,096 cells (`n562_aprendido_dos_tablas.json`; N-dependent: 0.904 at 1,024 cells) `n562_escalado.json`, `n562_aprendido_dos_tablas.json` 16d3322e / 3a22657e B6_local_rule_ceiling A single-layer delta rule with a self-generated teacher ties the exact optimum of its family (+0.71 vs +0.70) and the non-negative constraint improves it (+0.82, 16/16) `n541_techo_exacto.json`, `n542_delta.json`, `n542_rectificada.json` d764a6fd Figures are included where the proposal reproduces them. JSON field names are in Spanish (the project's working language); each file is self-describing, with seeds and conditions as keys.
Álvaro González-Redondo· Zenodo (CERN European Organi...· 0 citations
Working paper and open data. Studies that measure the output of more than one AI language model consistently find that the models write differently, in the same manner that human authors have different writing styles. We coin the term **modelometry** for the measurement and attribution of the inter-model writing style of AI systems, and **modelolect** for the style itself, formed on the pattern of idiolect and sociolect. The study asks whether the modelolect of a flagship model family is strong enough for a classifier that reads only surface stylometric features to classify the AI family that originally wrote a text. We test seven families (GPT, Claude, Gemini, DeepSeek, Grok, Llama and Qwen) against human text, in two registers (formal academic text, and informal chat text) and with three tiers of features. Every AI text used is from corpora generated for our prior studies or from open datasets. On academic text, a gradient boosting classifier over 47 interpretable stylometric features attributes 7 classes (human and six families) at 73.7% accuracy against a 14.3% chance rate, and 6 classes on a second corpus at 79.2%. On chat responses from the LMArena preference dataset, the same 47 features attribute all seven families at 63.9%, and a character n-gram model with model names masked reaches 87.0%, so the small interpretable feature set accounts for about three quarters of the attributable signal. The confusion structure is also informative, since DeepSeek is rarely confused with GPT (3% in the corpus where DeepSeek is most identifiable), so the writing-style evidence does not support the claim that 'DeepSeek behaves as a distillation of GPT'. The largest confusion in the chat register is between Qwen and GPT, at about 16%. Claude is the most identifiable family in both registers. A classifier trained on academic AI generated rewrites achieves only 18.6% on chat text from the same families, so a modelolect is specific to *register*, and to *model version*, and attribution requires training data from the register it will judge. As a byproduct we release inter-family vocabulary lexicons built with the log-odds method of our study on AI vocabulary. As a final experiment, after one TextPulse humanization, *p(human)* under the family classifier increases for 87 to 98% of the texts, a majority of the humanized texts classify as human, and the source family is recovered for at most 3% of them. All features, statistics, scores and code are made publicly available for future work. Files: the paper (PDF), per-text feature tables and classifier scores for every experiment, the confusion matrices and results, the per-family vocabulary lexicons, and the scripts and figures. Raw texts from the LMArena and HAP-E datasets are not redistributed; the released sampling code (fixed seed) reconstructs the exact samples from the public datasets.
TextPulse Research· Zenodo (CERN European Organi...· 0 citations
(c) 2026 Pranay Mahendrakar. Licensed under CC BY 4.0. The literature on how language models behave when retrieved context contradicts parametric memory contains a flat contradiction, and neither of its two surveys resolves it. One body of results reports over-reliance on memorised information; another reports that models are highly receptive to conflicting external evidence; a third reports that knowledge updates fail less often than previously published numbers imply. This paper argues that the contradiction is largely not a disagreement about models, because the studies do not share a measurand. A context-memory conflict is not an event that is observed; it is an object the experimenter builds, and seven design choices go into building it: what the conflicting passage is made of, which side is stipulated to be correct and whether the model's belief was elicited or assumed, what quantity is measured, which items are in the sample, what the task demands, what the prompt says, and which model was tested and what was done to it after pretraining. For five of the seven, a single published study varies that choice while holding the others fixed and the reported behaviour moves with it; for the remaining two the evidence is a comparison across studies and is labelled as such. The strongest available adjudication is a 2026 reproducibility study that ran two benchmarks with opposite conclusions under each other's evaluation protocol and attributed the outcome to dataset design, evaluation metric and model size. The reading offered here is narrower than the one the field is converging on. It is not that task demand is the discriminating variable, which one careful study established for one variable while holding others constant, but that the moderators replicate and the point estimates do not: prior confidence, context plausibility, entity frequency and internal inconsistency recur across studies as moderators of context adoption, several of them with a consistent sign, while the adoption rate itself is set by the construction. What follows is that no published number in this literature has been shown to identify a model-level disposition, that a paper reporting only such a number cannot be compared to another, and that the reporting needed to make them comparable is small and is mostly not being done. The literature search, drafting and citation verification for this paper were carried out with AI assistance under the author's direction. Every citation was machine-verified against the arXiv API and Crossref before inclusion, and every quantitative claim was read back against the cited source's own abstract. The author is responsible for the final text and for all claims made in it.
Pranay M. Mahendrakar· Zenodo (CERN European Organi...· 0 citations
The Hash-Atlas network is proposed, which reformulates 3D scene editing as operations on 2D atlas images, thereby achieving a workflow decoupling of the 2D editing and 3D reconstruction processes.
Shuangkang Fang, Yufeng Wang, Yi-Hsuan Tsai et al.· 0 citations
This work proposes AutoMedImg, a multi-agent framework for fully automated medical image processing code generation that achieves zero human intervention, with Dice scores of up to 0.90 for segmentation tasks and 99% accuracy for classification.
Zixiao Zhao, Jing Sun, Zhe Hou et al.· 0 citations
An automated scoring approach in which an evolutionary algorithm derives a small set of interpretable maturity indicators, each scored from sentence-completion responses by a domain-fine-tuned language model, supports automated ego-development scoring at agreement levels comparable to trained raters, and the indicators offer interpretable candidate dimensions of adult development for confirmatory and population-scale research.
Tamas Madl, S. Cook-Greuter· Frontiers in Psychology· 0 citations
Logit-based knowledge distillation (KD) is used to train smaller language models (LMs) via supervision from stronger teachers, but whether its benefits are consistent across training stages remains unclear. Through controlled experiments, we find that forward Kullback-Leibler (KL) distillation--the standard KD formulation--with post-trained teachers behaves fundamentally differently during mid-training, an intermediate phase of self-supervised learning on curated corpora. Surprisingly, while forward KD simultaneously improves reasoning and factual recall during pre-training relative to standard next-token prediction (NTP), it instead slows factual recall acquisition during mid-training despite continued reasoning gains. We trace this stage dependence to an asymmetry in teacher confidence across data domains and the student's evolving knowledge state: teachers are more confident on procedural than knowledge-intensive data, while students acquire low-entropy factual knowledge earlier in training. To mitigate this imbalance, we propose Switch Distillation, a simple mid-training objective that distills on tokens where the teacher is confident, using teacher predictive entropy as a lightweight routing signal, and otherwise falls back to cross-entropy. Switch Distillation consistently outperforms existing distillation objectives across teacher sizes. Relative to standard NTP, it achieves 1.61-1.71x the reasoning performance and 1.13-1.19x the knowledge and commonsense performance while preserving 96.7-96.8% of factual recall. Crucially, these benefits persist after post-training: Switch Distillation closes the factual recall gap while maintaining 1.25-1.32x and 1.13-1.20x gains in reasoning and knowledge and commonsense, respectively.
Jacqueline He, Howard Yen, S. Li et al.· 0 citations
Neural ranking models have become core components of modern information retrieval systems and important building blocks of AI systems such as retrieval-augmented generation (RAG) pipelines. However, their robustness remains insufficiently understood in the presence of large language models (LLMs), which can generate fluent and deceptive content at scale. This work investigates the vulnerability of neural ranking models to corpus poisoning attacks, in which an adversary injects a small number of maliciously crafted documents into the corpus to distort ranking behavior. We propose VerTox, the first framework to formulate corpus poisoning as a verifiable reward-guided reinforcement learning (RLVR) problem. By explicitly coupling ranking distortion with factual corruption through specialized reward shaping, we fine-tune compact LLMs into adversarial generators. Experiments demonstrate that our method achieves near-perfect attack success rates, producing adversarial documents that frequently rank higher than target documents across major neural ranking architectures, as well as a proprietary commercial embedding model. The generated adversarial documents are fluent and exhibit low perplexity, making them difficult to detect. Furthermore, by explicitly encouraging factual corruption, our adversarial documents significantly degrade the performance of a downstream RAG application.
Zhi-Qi Huang, Vivek Datla, Zhichao Xu et al.· 0 citations
What if pathology foundation models could do more with less? GigaPath-Flash and GigaTIME-Flash cut computational demands while maintaining strong performance, opening the door to larger studies and broader exploration. The post GigaPath-Flash and GigaTIME-Flash: Toward population-scale discovery with efficient pathology foundation models appeared first on Microsoft Research.
