Research Briefing — May 12, 2026

Introduces containment verification, which provides safety guarantees independent of alignment by verifying the agentic framework rather than the model. Uses 'havoc oracle' semantics where AI is modeled as unconstrained, and proves safety through forward-simulation refinement in Dafny.

Discovers that temporal knowledge drift in LLMs is encoded as a direction geometrically orthogonal to both correctness and uncertainty in the residual stream. This means no method based on confidence or uncertainty can detect outdated facts. Linear probes on drift achieve AUROC 0.83-0.95.

Demonstrates that a single neuron can bypass safety alignment in LLMs, showing both refusal suppression and harmful content amplification across seven models (1.7B-70B) without any training or prompt engineering.

Discovers that LLMs internally detect their own reasoning errors (0.95 AUROC via linear probe) while outwardly expressing confidence in them. This 'hidden error awareness' holds across model families (1.5B-72B) and RL-trained reasoning models.

Discovers that large multimodal models develop 'mental imagery' when solving spatial puzzles - their activations encode meaningful visual information about intermediate states even without explicit supervision on those states. Tested on Qwen3.5 VLM across 12 diverse visual reasoning tasks.

Proves that primacy effects, anchoring, and order-dependence are mathematically inevitable in autoregressive LLMs due to causal masking, with impossibility theorems validated across 12 frontier models (R²=0.89). Shows exact debiasing requires factorial computation.

Uncovers the causal mechanism of persuasion-induced factual errors in LLMs: a small set of mid-layer attention heads writes answers into a low-dimensional polyhedron, and persuasion causes discrete latent jumps between vertices. Shows decision heads copy rather than reason.

Exposes theoretical limitations of self-play red teaming for AI safety, showing that Nash equilibria include trivial strategies and that parameter sharing creates exploitable inconsistencies. Introduces 'Anchored Bipolicy Self-Play' that breaks self-consistency in safety.

Introduces 'AI co-clinician', a conversational AI system using Gemini's audio-visual capabilities for real-time clinical decisions during live patient conversations. Uses dual-agent architecture for deep reasoning with low latency. Tested on 20 standardized outpatient scenarios.

Provides theoretical analysis of why aligned LLMs remain jailbreakable through 'Refusal-Escape Directions' (RED)—local perturbation directions that shift behavior from refusal to answering while preserving harmful-semantics interpretation. Identifies structural vulnerabilities.

Proposes that AI security policy should target systems rather than models, demonstrating with 'swarm-attack' that five instances of a 1.2B model can achieve 45.8% Effective Harm Rate against GPT-4o, showing safety bypass is achievable at zero cost with commodity hardware.

Shows that frontier language models thematically leak secret information (up to 79% detection rate) through topic choice, imagery, and setting even when instructed to keep secrets, with attempts to hide making leakage worse.