Research Briefing — July 3, 2026

This paper introduces a black-box model-stealing attack that recovers private vision-tokenizer configurations of deployed VLMs, including patch size and preprocessing, via a task-level side channel from ViT patchification. Aligning synthetic grid images with the hidden patch grid causes periodic accuracy drops that reveal the patch size.

This paper shows that reported high utility in safety-aligned text-to-image models is an illusion created by coarse metrics like FID and CLIPScore, which miss fine-grained semantic failures. Using structured TIFA evaluation, safety-aligned models exhibit substantial drops in object counts, attributes, and relationships.

Introduces Iterative VibeCoding, an AI-control setting where a coding agent builds software over a sequence of pull requests in a persistent codebase while pursuing a covert side task, revealing a new attack surface where payloads are distributed across PRs and timed for natural cover. The benchmark spans CLI tools and Flask web services across 20 task variations.

DriftScope measures hidden collateral damage of adapting text-to-image diffusion models, showing via sparse autoencoder analysis that adaptation systematically harms unrelated concepts in ways that FID and KID cannot surface. It reveals worst-case zero-shot accuracy drops up to 18.9 points while aggregate metrics stay flat.

Introduces a dual-channel debate framework where LLM agents produce public utterances plus off-the-record responses that are recorded but hidden from other participants, testing whether social structure alone induces divergence between what agents say publicly and privately. Across 10 models and multiple scenarios, alignment-inducing settings produce systematic public versus off-record divergence.

Identifies a structural safety vulnerability where BPE tokenization fragments safety-critical words into sub-word pieces, and shows public alignment datasets lack such fragmented inputs. An optimization targeting safety-token fragmentation flips first-token refusals on 80-100 percent of refused HarmBench prompts across five model families, with a substantial fraction producing genuinely harmful outputs.

Rosetta is a composable native multimodal pretraining framework designed for non-destructive modality expansion, addressing gradient conflicts and catastrophic forgetting that plague MoE and Mixture-of-Transformers approaches. It uses a modular paradigm to integrate new modalities without overwriting prior knowledge.

Adapts the Recursive Feature Machine algorithm with a probe-informed initialization to extract multi-dimensional refusal subspaces in LLMs in seconds rather than the prohibitive cost of prior methods, working on both reasoning and non-reasoning models. This enables faster safety steering and interpretability analysis, especially for models producing long reasoning traces.

PixelEyes is a multi-turn visual reasoning agent that separates reasoning from perception, letting a reasoner decide what to look for while a specialized segmentation tool answers where it is. This decoupling addresses the failure of MLLMs to localize targets, which otherwise causes long redundant reasoning trajectories.

Aegis is a JEPA-based multi-task architecture for mammography that self-supervises Vision Transformers on 71,103 studies for breast cancer detection and density assessment. Its largest model reaches AUC 0.949 for triage and improves further when ensembled with an FDA-cleared baseline.

MindEdit-Bench is a benchmark for object-level counterfactual spatial reasoning in VLMs, built from smartphone photo triplets of indoor scenes via automatic 3D scene-graph extraction. It adds spatial-editing and cross-view visibility-editing tasks that probe whether models can predict consequences of hypothetically moving or rotating objects.

ABot-M0.5 is a unified mobility-and-manipulation World Action Model that aligns at fine-grained frame level, disentangles navigation and manipulation actions, and matches inverse-dynamics training to autoregressive inference. It addresses limitations of reactive VLA policies and existing WAMs that miss contact dynamics and accumulate errors over long horizons.