Program of
ML in PL Conference 2026

Abstract:

Drug design becomes a game the moment you write down a score. Choose an objective that stands in for “this molecule would make a good drug”, give it to a player, and see what comes back. That is a deliberate simplification. A real campaign balances drug potency, selectivity, safety, and synthesizability at once, and the objective that actually matters is hard to put in closed form without months of wet-lab work. But when we do compress it into a single number and hand the same number to people and to generative models, the two sets of failure modes look alike. Both learn to satisfy the score rather than the intent behind it, drifting toward the regions of chemical space where the objective is generous, and the chemistry is not. A measure that becomes a target stops being a good measure. Economists call this Goodhart’s law, and it makes surprisingly little difference whether the optimizer is a person or a network. Both players also come away with something more interesting than a score. Each builds an internal representation of a molecule, a working theory of how its structure relates to what it does, and that is the part worth opening up.

The usual way to ask what a model learned is an attribution map over the atoms, and to check whether those maps are right, we built benchmarks where the correct answer is known in advance. Most explainers do badly on them, for several reasons at once. The models find shortcuts, the explainers come from the image world and fit discrete graphs badly, and the way we score explanations is itself broken. That last one is worth seeing. To test whether a group of atoms mattered, you delete it and watch the prediction move, but a molecule with atoms deleted is not a molecule, so the explanation gets graded against something that could not exist. Integrated gradients and SHAP make a version of the same assumption, and so do the blurred patches used to explain image classifiers. Our fix, published at AAAI 2026, puts chemically sensible fragments back in place of the deleted ones, which also makes an explanation something you can act on. Instead of a heatmap, you get a different molecule you could actually make. No chemistry background is needed for this presentation, and I will close with where to start if you want to work on molecules, including the tools, open benchmarks, and unsolved problems worth pursuing.

Abstract:

Neural surrogate models for computational fluid dynamics (CFD) are typically trained as forward operators that map explicit problem specifications, such as geometry and boundary conditions, to solution fields. This ties the model to the conditioning variables seen during training and limits reuse under boundary-condition shifts or local geometry changes. We propose to reformulate steady CFD inference as an inpainting problem: instead of training on explicit boundary conditions, we learn a self-supervised prior over velocity fields and impose boundary constraints only during inference by fixing known regions such as inlet, outlet or unchanged regions from previous simulations. To scale this idea to large 3D meshes, we introduce a local neighbourhood tokeniser that represents high-resolution velocity fields as compact spatial latent tokens and train latent flow-matching and masked-autoencoder models on these tokens. On intracranial aneurysm hemodynamics, our method reconstructs full velocity fields from sparse boundary context, outperforms supervised neural surrogates under boundary-condition and dataset shift and enables local geometry editing by reusing unchanged simulation context. These results suggest that viewing CFD inference as context-conditioned inpainting can turn neural surrogates from task-specific predictors into reusable flow priors.

Abstract:

Antimicrobial peptides (AMPs) are a promising solution to antimicrobial resistance, yet generative models cannot precisely control the physicochemical properties and motifs that shape activity and selectivity. Here, we present OmegAMP, a conditional diffusion framework controlling net charge, mean hydrophobicity, and sequence length, supporting de novo, analog, and motif-guided design. Across 204 wet-lab characterized designs, de novo generation yielded peptides with broad activity against multidrug-resistant Gram-negative isolates. Analog generation converted six inactive prototypes into antimicrobials, with the prototype family determining analogs’ membrane-disruption mode and safety. Motif-guided generation preserved auxiliary functions. Analogs retained lipopolysaccharide engagement of active prototypes, and a redesigned non-antimicrobial leucine zipper gained antimicrobial activity while retaining DNA-perturbing character in vitro. In murine skin and thigh infection models, leads reduced bacterial burden, with a DNA-perturbing lead matching the fluoroquinolone control systemically. OmegAMP turns controllable generation into a route to new antibiotics whose mechanism and safety follow from the chosen prototype.

Abstract:

Benchmarking is the cornerstone of LLM evaluation, yet reported scores are increasingly compromised by data contamination. As models train on vast web corpora and synthetically generated data, test set leakage obscures whether a model is genuinely solving complex problems or simply recalling memorized patterns. Traditional detection approaches often require full access to pre-training data, heavy threshold tuning, or fail when test content is subtly rephrased or modified.

This talk opens with a broad examination of the data contamination landscape. We will explore the subtle mechanisms through which evaluation data leaks into pre-training and fine-tuning pipelines, the risks of relying on benchmark scores alone for model selection, and why existing detection tools struggle to identify indirect or synthetic leakage.

Building on this context, I will introduce Contamination Detection via Context (CoDeC), a practical, model-agnostic method developed at NVIDIA to detect and quantify benchmark contamination. CoDeC builds on a key observation that models react differently to in-context learning based on prior exposure to the data. By analyzing the influence of context on models’ predictions, we can reliably quantify contamination in LLMs.

CoDeC generates an intuitive, percentage-based score that quantifies reliance on memorization. The method requires no ground-truth training data, works across diverse architectures, and effectively flags contamination even when test samples have been cropped, rephrased, or augmented. I will conclude with practical takeaways from evaluating multiple open-weight LLMs across standard benchmark suites, illustrating how context-based evaluation brings necessary clarity to model comparisons and evaluation integrity.

See the project page and contamination “leaderboard” at https://michalzawalski.github.io/codec/.

Abstract:

Vision-language models (VLMs) have demonstrated impressive capabilities across tasks such as image captioning, visual question answering, and multimodal content generation. Despite this progress, most VLMs are primarily trained on English-centric resources, which can hinder their ability to interpret culturally specific symbols, references, and context-dependent meanings. As a result, these models often struggle with visual understanding that requires knowledge of local cultural and linguistic conventions. Existing benchmarks aimed at measuring cultural competence typically emphasize surface-level recognition and frequently rely on template-based examples, limiting their usefulness for assessing deeper forms of multimodal reasoning.

We present PoVisLE, a vision-language benchmark focused on Polish culture and language, designed to evaluate culturally grounded multimodal understanding in settings where textual interpretation depends on visual context. The benchmark comprises 1,119 images paired with 2,366 manually curated visual question-answer examples spanning diverse cultural references and linguistic phenomena. By avoiding synthetic data generation and template-driven annotation, PoVisLE captures a wider range of authentic cultural and linguistic variation.

PoVisLE provides a challenging testbed for analyzing how well contemporary VLMs integrate visual information with culturally situated knowledge. The benchmark supports detailed evaluation of model performance beyond object recognition and factual recall, helping identify limitations in culturally aware multimodal reasoning.

Abstract:

A model can appear well calibrated overall while being systematically overconfident on some kinds of inputs and underconfident on others. Standard calibration diagnostics can miss this behaviour because they group predictions by confidence score: when opposing errors occur at similar confidence levels, they cancel under aggregation.

In this talk, I will argue that calibration should not only be studied as a function of confidence, but also as a structured property of the input space. I will introduce the idea of an input-dependent miscalibration field, which describes where a model is overconfident, where it is underconfident, and how these behaviours vary across inputs. I will then present a framework for estimating this field without requiring predefined subgroups or human-specified data slices. The approach learns a geometry in which inputs with similar calibration behaviour are close together, allowing noisy prediction residuals to be averaged locally and coherent calibration regimes to emerge.

Taking as our primary case study large language models, we inspect the behaviour of twelve LLMs across four real-world benchmarks and we find that hidden calibration heterogeneity is prevalent. The discovered regimes are stable, often reveal considerably larger errors than aggregate metrics suggest, and can be used to correct confidence locally in regions where standard confidence-only recalibration methods are less effective.

The broader message is that a single reliability diagram may conceal qualitatively different failure modes. Understanding whether errors are globally uniform or structured across inputs is therefore essential both for evaluating model reliability and for deciding how calibration should be improved.

Abstract:

AI agents powered by large language models (LLMs) are being deployed at scale, yet we lack a systematic understanding of how the choice of backbone LLM affects agent security. The non-deterministic sequential nature of AI agents complicates security modeling, while the integration of traditional software with AI components entangles novel LLM vulnerabilities with conventional security risks. Existing frameworks only partially address these challenges as they either capture specific vulnerabilities only or require modeling of complete agents. To address these limitations, we introduce threat snapshots: a framework that isolates specific states in an agent’s execution flow where LLM vulnerabilities manifest, enabling the systematic identification and categorization of security risks that propagate from the LLM to the agent level. We apply this framework to construct the b3 benchmark, a security benchmark based on 194,331 unique crowdsourced adversarial attacks. We then evaluate 34 popular LLMs with it, revealing, among other insights, that enhanced reasoning capabilities improve security, while model size does not correlate with security. We release our benchmark, dataset, and evaluation code to facilitate widespread adoption by LLM providers and practitioners, offering guidance for agent developers and incentivizing model developers to prioritize backbone security improvements.

In the talk, besides the above content, I’ll offer a brief introduction to AI Security, how it differs from AI Safety and what are current challenges in the field.

Abstract:

Recent work has applied differential privacy (DP) to adapt large language models (LLMs) for sensitive applications, offering theoretical guarantees. However, its practical effectiveness remains unclear, partly due to LLM pretraining, where overlaps and interdependencies with adaptation data can undermine privacy despite DP efforts. To analyze this issue in practice, we investigate privacy risks under DP adaptations in LLMs using state-of-the-art attacks such as robust membership inference and canary data extraction. We benchmark these risks by systematically varying the adaptation data distribution, from exact overlaps with pretraining data, through in-distribution (IID) cases, to entirely out-of-distribution (OOD) examples. Additionally, we evaluate how different adaptation methods and different privacy regimes impact the vulnerability. Our results show that distribution shifts strongly influence privacy vulnerability: the closer the adaptation data is to the pretraining distribution, the higher the practical privacy risk at the same theoretical guarantee, even without direct data overlap. We find that parameter-efficient fine-tuning methods, such as LoRA, achieve the highest empirical privacy protection for OOD data. Our benchmark identifies key factors for achieving practical privacy in DP LLM adaptation, providing actionable insights for deploying customized models in sensitive settings. Looking forward, we propose a structured framework for holistic privacy assessment beyond adaptation privacy, to identify and evaluate risks across the full pretrain-adapt pipeline of LLMs.

Abstract:

LLM based agents are increasingly deployed in high stakes settings where they process external data sources such as emails, documents, and code repositories. This creates exposure to indirect prompt injection attacks, where adversarial instructions embedded in external content manipulate agent behavior without user awareness. A critical but underexplored dimension of this threat is concealment: since users tend to observe only an agent’s final response, an attack can conceal its existence by presenting no clue of compromise in the final user facing response while successfully executing harmful actions. This leaves users unaware of the manipulation and likely to accept harmful outcomes as legitimate. We present findings from a large scale public red teaming competition evaluating this dual objective across three agent settings: tool calling, coding, and computer use. The competition attracted 464 participants who submitted 272000 attack attempts against 13 frontier models, yielding 8648 successful attacks across 41 scenarios. All models proved vulnerable, with attack success rates ranging from 0.5% (Claude Opus 4.5) to 8.5% (Gemini 2.5 Pro). We identify universal attack strategies that transfer across 21 of 41 behaviors and multiple model families, suggesting fundamental weaknesses in instruction following architectures. Capability and robustness showed weak correlation, with Gemini 2.5 Pro exhibiting both high capability and high vulnerability. To address benchmark saturation and obsoleteness, we will endeavor to deliver quarterly updates through continued red teaming competitions. We open source the competition environment for use in evaluations, along with 95 successful attacks against Qwen that did not transfer to any closed source model. We share model-specific attack data with respective frontier labs and the full dataset with the UK AISI and US CAISI to support robustness research.

Abstract:

Vision Transformers (ViTs) have become a dominant architecture in computer vision, yet producing stable and high-resolution attribution maps for these models remains challenging. Architectural components such as patch embeddings and attention routing often introduce structured artifacts in pixel-level explanations, causing many existing methods to rely on coarse patch-level attributions. We introduce DAVE (Distribution-aware Attribution via ViT Gradient DEcomposition), a mathematically grounded attribution method for ViTs based on a structured decomposition of the input gradient. By exploiting architectural properties of ViTs, DAVE isolates locally equivariant and stable components of the effective input–output mapping. It separates these from architecture-induced artifacts and other sources of instability. Consequently, DAVE produces robust, precise and class-consistent attribution maps that reliably highlight visual features used by the model across inputs. Experimental results demonstrate that DAVE attributions are more stable and spatially precise than existing approaches.

Abstract:

Sparse Autoencoders (SAEs) have recently gained attention as a means to improve the interpretability and steerability of Large Language Models (LLMs), both of which are essential for AI safety. In this work, we extend the application of SAEs to Vision-Language Models (VLMs), such as CLIP, and introduce a comprehensive framework for evaluating monosemanticity at the neuron-level in visual representations. To ensure that our evaluation aligns with human perception, we propose a benchmark derived from a large-scale user study. Our experimental results reveal that SAEs trained on VLMs significantly enhance the monosemanticity of individual neurons, with sparsity and wide latents being the most influential factors. Further, we demonstrate that applying SAE interventions on CLIP’s vision encoder directly steers multimodal LLM outputs (e.g., LLaVA), without any modifications to the underlying language model. These findings emphasize the practicality and efficacy of SAEs as an unsupervised tool for enhancing both interpretability and control of VLMs.

This presentation will be based on the recent NeurIPS publication Sparse Autoencoders Learn Monosemantic Features in Vision-Language Models authored by the presenter.

Abstract:

Counterfactual explanations play a pivotal role in explainable artificial intelligence (XAI) by offering intuitive, human-understandable alternatives that elucidate machine learning model decisions. Despite their significance, existing methods for generating counterfactuals often require constant access to the predictive model, involve computationally intensive optimization for each instance, and lack the flexibility to adapt to new user-defined constraints without retraining. In this paper, we propose DiCoFlex, a novel model-agnostic, conditional generative framework that produces multiple diverse counterfactuals in a single forward pass. Leveraging conditional normalizing flows trained solely on labeled data, DiCoFlex addresses key limitations by enabling real-time user-driven customization of constraints such as sparsity and actionability at inference time. Extensive experiments on standard benchmark datasets show that DiCoFlex outperforms existing methods in terms of validity, diversity, proximity, and constraint adherence, making it a practical and scalable solution for counterfactual generation in sensitive decision-making domains.

Abstract:

One of the fundamental pillars of causal inference is the invariance of causal mechanisms: the conditional distribution of an effect given its causes remains invariant across heterogeneous environments. While framework-defining methods like Invariant Causal Prediction (ICP; Peters et al., 2016) leverage this via frequentist hypothesis testing, they often struggle to seamlessly share statistical strength across high dimensional environments.

Hierarchical Bayes offers a natural alternative designed precisely for handling such heterogeneous data via partial pooling and global parameter estimation. Recently, a wave of research has begun viewing Hierarchical Bayes through a distinctively causal lens (Weinstein & Blei, 2024; Wu et al., 2025; Madaleno et al., 2026). This talk explores the formal intersection of causal invariance and Hierarchical Bayesian modelling. We will discuss how we can test for invariance using the global and local posteriors (Madaleno et.al. 2026), and highlight exciting future frontiers such as extensions to data beyond cross-sectional data and Causal Representation Learning (Garg et al., 2026).

Abstract:

Neural collapse is a phenomenon observed during the final phase of training, where the representations in the last layer of a neural network converge into a highly structured geometry. Most previous theoretical approaches to understanding this phenomenon, like the unconstrained feature models, are data-independent. We first show that this geometry can be fully characterized through the network’s kernels, extending a known kernel formulation of one of its signatures to the remaining ones, yielding identities that hold in general. To make this description data-aware, we then specialize to feature learning kernels, which describe trained networks at finite width and depend explicitly on the training data. For deep linear networks with exchangeable data , we derive an exact scaling law for how neural collapse depends on depth and on the data’s signal-to-noise ratio; for nonlinear networks we obtain an analogous scaling law from a finite-width expansion. Together, these results give a data-aware theory of neural collapse and how it depends on network hyperparameters.

Abstract:

The Hierarchical Dirichlet Process Hidden Markov Model (HDP-HMM) is a Bayesian nonparametric extension of the classical Hidden Markov Model, well-suited for learning from (spatio-)temporal data. To relax the restrictive geometric assumption on state durations, the HDP Hidden Semi-Markov Model was introduced. However, both models assume stationary state durations, which limits their expressive power. In this work, we extend the HDP-HMM framework by incorporating recurrent explicit duration modeling, resulting in a more general and flexible model: the Recurrent Explicit Duration HDP-HMM (RED-HDP-HMM). We propose a Gibbs sampling method for efficient inference in this model. Empirical results on both synthetic and real-world segmentation tasks demonstrate that RED-HDP-HMM consistently outperforms the disentangled sticky HDP-HMM and the standard sticky HDP-HMM.

Abstract:

Evaluating representation similarity is fundamental to representation learning. However, existing metrics suffer from significant limitations: they lack interpretability due to shifting baselines, lack robustness to outliers, and are computationally intractable for large datasets, forcing reliance on heuristic approximations. To address this, we develop an ordinal-similarity framework, instantiated by the Triplet (TSI) and Quadruplet (QSI) Similarity Indices, which measure alignment by quantifying the consistency of ordinal relationships. We theoretically demonstrate this formulation is inherently interpretable, robust to outliers, and computationally efficient. Finally, we establish a formal equivalence between TSI and local neighborhood alignment, measured by Mutual Nearest Neighbors. Empirically, we validate these properties and show that ordinal similarity offers a scalable approach to measuring alignment, enabling practitioners to better understand and design representations.

Abstract:

As generative and foundation models grow more capable, so does the risk that they retain harmful, private, copyrighted, or simply unwanted knowledge. Retraining a model from scratch to remove such content is prohibitively expensive, which has made machine unlearning an increasingly important direction in AI safety. Machine unlearning is a task of erasing specific knowledge from an already-trained model. Yet most existing unlearning methods are blunt instruments: they degrade unrelated capabilities, require large “retain” datasets to preserve performance, or touch far more of the model’s parameters than necessary.

In this talk, I’ll present a more surgical approach to unlearning: one that identifies and modifies only the small subset of a model’s weights actually responsible for a target concept, leaving the rest of the model intact. I’ll walk through how techniques such as singular value decomposition (done in SEMU and BARRIER) can be used to disentangle and localize concept-relevant parameters, why this precision matters for both safety and model utility, and how such methods perform compared to conventional fine-tuning-based unlearning. I’ll close with open challenges in the field: how to verify that a concept has truly been forgotten, how to scale precise unlearning to ever-larger models, and what “forgetting” should even mean for a neural network.

The talk is aimed at researchers and practitioners interested in AI safety, interpretability, and the practical mechanics of controlling what large models know.

Abstract:

Image generative models are trained on massive, largely uncurated internet-scale datasets that contain undesirable visual concepts. Efficiently removing such concepts from the model generations without degrading the quality of output images remains challenging. We introduce a novel concept removal method for frontier diffusion and image autoregressive models, such as, SD3.5, Flux, and Infinity. Our intervention replaces the internal bottleneck layer present in all these modern models with a transcoder that is trained to replicate the original layer while structuring it into distinct activation features. This in‑place substitution creates an integrated filter through which concept‑specific signals can be selectively disabled while preserving the rest of the model’s behavior. Since the intervention modifies the model backbone rather than attaching an external component, it remains persistent under white‑box access. Empirically, the approach achieves state‑of‑the‑art concept removal performance across modern diffusion and autoregressive models, maintains visual generation quality, provides robustness against adversarial prompts, and supports sequential removal of diverse concepts. This positions our method as a practical approach for concept removal in frontier image generative models.

Abstract:

Sparse Mixture-of-Experts (MoE) architectures enable scaling LLM parameters under a fixed inference budget by activating only a small subset of experts via top-$k$ routing. While this preserves causality and suits autoregressive language models, the discrete top-$k$ operator is not differentiable, forcing a fixed number of active experts per input and resulting in inefficient use of computation. We propose SoftMoE, which replaces discrete routing with a truncated soft top-$k$ LapSum relaxation, allowing gradient-based optimization of expert routing. We further parameterize the mean number of active experts per layer and impose a global budget constraint, enabling the model to learn how to allocate expert capacity across layers. SoftMoE remains fully compatible with autoregressive modeling and achieves performance comparable to or better than sparse MoE on language modeling and downstream tasks, while activating significantly fewer experts. Notably, the learned allocation is highly non-uniform, with later layers activating more experts. The source code is publicly available$^\dagger$.

Abstract:

Masked Diffusion Language Models (MDLMs) have recently emerged as a promising alternative to Autoregressive Language Models (ARLMs), leveraging a denoising objective that, in principle, should enable more uniform context utilisation. In this work, we examine the context comprehension abilities of MDLMs and uncover two key limitations. First, despite their more global training objective and bidirectional attention mechanism, similarly to ARLMS, MDLMs exhibit a strong locality bias: performance is highly sensitive to the position of relevant information within the input, favouring local over distant context. Second, we show that appending a large number of mask tokens–required for generation–can significantly degrade context comprehension. Through systematic ablations, we find that these masks act as distractors, reducing the model’s ability to process relevant information. To address this, we introduce a mask-agnostic loss function that encourages predictions to remain invariant to the number of appended masks. Fine-tuning with this objective substantially mitigates the distracting effect of masks, improving robustness of MDLMs. Overall, our findings reveal critical limitations of the current MDLM training paradigm and provide actionable insights for building diffusion-based language models with stronger context comprehension.

Abstract:

Clustering tabular data remains a significant open challenge in data analysis and machine learning. Unlike for image data, similarity between tabular records often varies across datasets, making the definition of clusters highly dataset-dependent. Furthermore, the absence of supervised signals complicates hyperparameter tuning in deep learning clustering methods, frequently resulting in unstable performance. To address these issues and reduce the need for per-dataset tuning, we adopt an emerging approach in deep learning: zero-shot learning. We propose ZEUS, a self-contained model capable of clustering new datasets without any additional training or fine-tuning. It operates by decomposing complex datasets into meaningful components that can then be clustered effectively. Thanks to pre-training on synthetic datasets generated from a latent-variable prior, it generalizes across various datasets without requiring user intervention. To the best of our knowledge, ZEUS is the first zero-shot method capable of generating embeddings for tabular data in a fully unsupervised manner. Experimental results demonstrate that it performs on par with or better than traditional clustering algorithms and recent deep learning-based methods, while being significantly faster and more user-friendly.

Abstract:

Video-generation models produce strikingly realistic sequences and are increasingly proposed as world models for domains like automotive and robotics, where users need consistent long rollouts and generalization to unseen configurations. That promise rests on physics: a model that has internalized physical laws should be able to roll out coherently and support meaningful downstream tasks. Yet we still lack a general understanding of whether video models actually learn physics—and how to extract it if they do.

Existing work only judges whether a model can produce plausible-looking video—but plausibility is not understanding. Instead, we inspect the model’s internal representations for ground-truth physical quantities, shifting the question from does it look right?'' todoes it know?’’.

We do so by probing its activations with linear decoders for physical observables such as velocity, momentum, and gravity.

However, probing against ground truth is not straightforward: diffusion models synthesize video from noise, so a from-scratch generation is uncontrolled and has no known physical parameters to compare against.

We therefore work backwards:

Using a physics simulator, we generate ground-truth videos of various scenes such as elastic collisions or projectile motion while keeping full control over their parameters.

Running each video through the forward diffusion pass adds noise to create a starting point for the reverse process. As the model denoises the input, we capture the intermediate activations that form its internal representation of the scene. With ground-truth physics in hand, linear probes then reveal whether the model has genuinely internalized these physical observables.

The learned representations turn out to be highly structured: the observables are linearly decodable, and the probes extrapolate across objects and scenes—evidence that the model interpolates physics, not pixels. This information is also sharply localized in space and time:

physical properties are read best from object-centric, frame-aligned tokens rather than the full latent space. Exploiting this, our structured probe avoids the spatio-temporal pooling of prior work, making it more memory- and compute-efficient while yielding better results. Crucially, the representation is not only readable but manipulable: adding differences of activations lets us flip the direction of objects in generated videos, indicating that the encoded physics is causally used rather than incidental—with steering along the learned probe directions as a natural next step.

Alongside these successes, we surface clear limits in current physical understanding, and report results across several state-of-the-art open-weight video models, focusing on their largest variants.

Abstract:

Small-molecule drug discovery requires simultaneous optimization of numerous properties of candidate molecules. These properties can be investigated through the analysis of high-dimensional biological signatures, such as cell morphology and transcriptomic perturbations, which provide a rich perspective on the underlying biological mechanisms. However, existing generative methods, which use those signatures for optimization, fail to meet two key requirements: providing precise guidance toward desired phenotypic signatures while maintaining structural proximity to a known hit. We introduce PhAME (Phenotype-aware Molecular Editing), a latent diffusion framework that overcomes this challenge by recasting molecular optimization as editing in the latent space of a pretrained graph-based VAE. Our central contribution is a compositional classifier-free guidance scheme with two independent scales, one for the phenotype-conditioning and one for similarity to the seed structure, allowing practitioners to control the tradeoff between these two objectives. Empirical evaluations across diverse benchmarks, including docking score optimization and multimodal phenotypic generation, demonstrate that PhAME achieves state-of-the-art results while maintaining high chemical validity and novelty.

Abstract:

Lung cancer remains the leading cause of cancer mortality, driving the development of automated screening tools to alleviate radiologist workload. Standing at the frontier of this effort is Sybil, a deep learning model capable of predicting future risk solely from computed tomography (CT) with high precision. However, despite extensive clinical validation, current assessments rely purely on observational metrics. This correlation-based approach overlooks the model’s actual reasoning mechanism, necessitating a shift to causal verification to ensure robust decision-making before clinical deployment. We propose S(H)NAP, a model-agnostic auditing framework that constructs generative interventional attributions validated by expert radiologists. By leveraging realistic 3D diffusion bridge modeling to systematically modify anatomical features, our approach isolates object-specific causal contributions to the risk score. Providing the first interventional audit of Sybil, we demonstrate that while the model often exhibits behavior akin to an expert radiologist, differentiating malignant pulmonary nodules from benign ones, it suffers from critical failure modes, including dangerous sensitivity to clinically unjustified artifacts and a distinct radial bias.

This work was accepted to ICML 2026.

Abstract:

Attack Success Rate (ASR) is the near-universal metric for evaluating backdoor attacks on deep learning models, and the community routinely treats a single reported number as ground truth. In this work, I analyze the reliability of ASR across random seeds for backdoor attacks on vision models,i using the BadMerging framework with ViT-B/32 on CIFAR-100 and ImageNet-100. Through a 15-seed study at matched clean accuracy, find that:

1. ASR exhibits severe seed-driven variance - a 41.9% spread at a fixed ~63.7% clean accuracy on CIFAR-100, so large that a single-seed result can misrepresent an attack’s true strength;
2. this variance is structured rather than noise, with a mixture-model analysis revealing distinct behavioral modes across seeds;
3. ASR decouples from model utility, remaining high under weight-noise perturbation even as clean accuracy degrades, so a “successful” attack score need not reflect a usable model;
4. the attack regime itself is potent when stabilized (ASR up to 100% at 82.5% clean accuracy on ImageNet-100).

To address this, I introduce RASR (Reliable ASR), a seed-robust metric that preserves the interpretability of ASR while removing its seed-driven variance. I conclude that seed-robust evaluation is necessary for drawing trustworthy conclusions in backdoor research.

Abstract:

Modern image generative models are capable of producing photorealistic images that become increasingly indistinguishable from real data. As those images are published online, they are often scraped for subsequent training runs of new generative models. This practice of training on generated data has been shown to degrade model performance and amplify existing biases. A possible mitigation lies in embedding watermarks into generated content to identify synthetic content and enable data provenance. However, the persistence of watermarks through iterative training-generation cycles remains poorly understood. In this work, we investigate how image watermarks degrade across multiple generations of model training. We adopt a dataset inference framework that aggregates weak per-sample signals via statistical hypothesis testing, enabling reliable detection even when watermark traces are subtle. We observe disparate behavior across watermarking methods with one of them remaining highly detectable in subsequent generations, even when the watermarked training data constitutes only 1% of the training data, while other watermarks degrade severely throughout generations and have a finite lifetime. Our findings highlight the need for more robust watermarking methods that are designed to withstand retraining for reliable data provenance.

Abstract:

State-of-the-art text-to-image models generate photorealistic images at an unprecedented speed. This work focuses on models that operate in a bitwise autoregressive manner over a discrete set of tokens that is practically infinite in size. However, their impressive generative power comes with a growing risk: as their outputs increasingly populate the Internet, they are likely to be scraped and reused as training data—potentially by the very same models. This phenomenon has been shown to lead to model collapse, where repeated training on generated content, especially from the models’ own previous versions, causes a gradual degradation in performance. A promising mitigation strategy is watermarking, which embeds human-imperceptible yet detectable signals into generated images—enabling the identification of generated content. In this work, we introduce BitMark, a robust bitwise watermarking framework. Our method embeds a watermark directly at the bit level of the token stream during the image generation process. Our bitwise watermark subtly influences the bits to preserve visual fidelity and generation speed while remaining robust against a spectrum of removal techniques. Furthermore, it exhibits high radioactivity, i.e., when watermarked generated images are used to train another image generative model, this second model’s outputs will also carry the watermark. The radioactive traces remain detectable even when only fine-tuning diffusion or image autoregressive models on images watermarked with our BitMark. Overall, our approach provides a principled step toward preventing model collapse in image generative models by enabling reliable detection of generated outputs. The code is available at https://github.com/sprintml/BitMark.

Abstract:

State-of-the-art Diffusion Models (DMs) produce highly realistic images. While prior work has successfully mitigated Not Safe For Work (NSFW) content in the visual domain, we identify a novel threat: the generation of NSFW text embedded within images. This includes offensive language, such as insults, racial slurs, and sexually explicit terms, posing significant risks to users. We show that all state-of-the-art DMs (e.g., SD3, SDXL, Flux, DeepFloyd IF) are vulnerable to this issue. Through extensive experiments, we demonstrate that existing mitigation techniques, effective for visual content, fail to prevent harmful text generation while substantially degrading benign text generation. As an initial step toward addressing this threat, we introduce a novel fine-tuning strategy that targets only the text-generation layers in DMs. Therefore, we construct a safety fine-tuning dataset by pairing each NSFW prompt with two images: one with the NSFW term, and another where that term is replaced with a carefully crafted benign alternative while leaving the image unchanged otherwise. By training on this dataset, the model learns to avoid generating harmful text while preserving benign content and overall image quality. Finally, to advance research in the area, we release ToxicBench, an open-source benchmark for evaluating NSFW text generation in images. It includes our curated fine-tuning dataset, a set of harmful prompts, new evaluation metrics, and a pipeline that assesses both NSFW-ness and text and image quality. Our benchmark aims to guide future efforts in mitigating NSFW text generation in text-to-image models, thereby contributing to their safe deployment.

Abstract:

As the volume of time-series data continues to grow, the efficiency of storage is becoming an important consideration in applications that require retaining large collections of signals or long historical records. Simultaneously, time series foundation models (TSFMs) that currently dominate forecasting benchmarks rely on relatively simple tokenization techniques, leaving the efficiency of representation and storage of time series data comparatively underexplored. Motivated by this gap, we introduce an approach that combines a novel method of tokenization via residual hierarchical decomposition and quantization with a modified Transformer decoder, enabling causal processing of signals. Each block of the tokenizer efficiently represents a different frequency range of the temporal signal, as its residual propagates through them sequentially. The decoder-only backbone employs Multi-dimensional Rotational Position Embeddings Interleave (MRoPE-I) and Mixture of Experts (MoE) for effective processing of varying-scale tokens, ending with a quantile head suitable for probabilistic forecasting. The proposed architecture supports variable-length contexts through its length-agnostic tokenizer, while autoregressive decoding allows the prediction horizon to be extended. Our method matches the performance of the state-of-the-art in terms of nMSE across multiple datasets, yet achieves 7.59x compression rate of the original data with around 0.06 MSE reconstruction error after normalization. Our results suggest that through efficient modeling of temporal sequences, we can substantially reduce both the storage and computational complexity, enabling more data storage without negatively impacting downstream tasks, while extending the context and prediction horizons.

Abstract:

Gradient descent on neural networks self-organizes at the Edge of Stability (EoS): the top Hessian eigenvalue $\lambda_{max}$ climbs until it reaches the stability ceiling $2/\eta$ and then hovers there while the loss keeps falling. This is difficult to reconcile with the standard account of regularization, in which weight decay, data augmentation and many types of regularization earn their generalization benefit by steering optimization toward flatter minima. If the learning rate alone fixes how much curvature a network can carry, what is a regularizer actually doing?

To answer this question, we perform controlled dose–response study across architectures and learning rates on a CIFAR-scale classification task, and we provide some theoretical discussion on the effect of the regularization on the Hessian, sharpness and its relation to the EoS phenomenon. This work and the talk is based on my internship at the Université Paris Dauphine-PSL that is happening over the summer this year.

Abstract:

Audio augmentation is widely used to improve the robustness of speech recognition systems, but its effectiveness is typically evaluated using downstream error rates alone. As a result, relatively little is known about how augmentation affects the internal organization of speech representations, particularly in phoneme recognition, where preserving fine-grained acoustic-phonetic distinctions is critical. While techniques such as noise injection and time stretching are commonly adopted in ASR, their impact on the geometry of phoneme representations learned by self-supervised speech models remains largely unexplored.

This study investigates how training-time audio augmentation influences the geometry of phoneme embeddings learned by wav2vec2-based phoneme recognition models and whether these geometric changes are associated with downstream recognition performance.

We fine-tune wav2vec2 phoneme recognition models on the dictionary recordings using both clean and augmented variants including synthetic noise, time stretching, and their combination. The resulting models are evaluated on TIMIT dataset and students’ audio interactions collected in unconstrained acoustic conditions. For each model, we extract phoneme-level embeddings from hidden representations and characterize the resulting embedding spaces using clustering and distance-based measures, including silhouette score and Davies-Bouldin index.

Audio augmentation affected phoneme embedding geometry in both evaluation datasets in a consistent manner. Noise-only augmentation consistently degraded cluster structure, producing significantly lower silhouette scores than the clean baseline, whereas time stretching exhibited the most favorable geometric profile, with higher average silhouette scores and lower Davies-Bouldin indices across datasets. Combined noise and time stretching preserved cluster quality close to the baseline while exhibiting the largest inter-centroid distances. These geometric trends are consistent with downstream phoneme recognition results, where time stretching and time stretching combined with noise produced the most reliable improvements in Character Error Rate, while noise-only augmentation provided limited gains. Our findings suggest that the effectiveness of audio augmentation for phoneme recognition depends not only on the amount of acoustic variability introduced during training, but also on whether the transformation preserves the underlying geometry of phoneme representations.

Abstract:

Large Language Models (LLMs) can generate highly persuasive text, raising concerns about their misuse for propaganda, manipulation, and other harmful purposes. This leads us to our central question: Is LLM-generated persuasion more difficult to automatically detect than human-written persuasion? To address this, we categorize controllable generation approaches for producing persuasive content with LLMs and introduce Persuaficial, a high-quality multilingual benchmark covering six languages: English, German, Polish, Italian, French and Russian. Using this benchmark, we conduct extensive empirical evaluations comparing human-authored and LLM-generated persuasive texts. We find that although overtly persuasive LLM-generated texts can be easier to detect than human-written ones, subtle LLM-generated persuasion consistently degrades automatic detection performance. Beyond detection performance, we provide the first comprehensive linguistic analysis contrasting human and LLM-generated persuasive texts, offering insights that may guide the development of more interpretable and robust detection tools.

Abstract:

Multimodal large language models (MLLMs, often referred to as VLMs) have become a standard approach for many vision tasks. However, exploring real-world environments and performing object search in open-world settings, actively controlling a UAV from camera observations to locate a target described in natural language, remains highly challenging. Even state-of-the-art large models struggle, while smaller open models often fail almost entirely. In this presentation, we show how an MLLM can be trained with reinforcement learning for this setting. To enable fine-tuning on realistic visual data, we develop a 3D Gaussian-splat simulation environment based on real-world captures and combine it with a fast, procedurally generated simulator to scale and diversify training. Leveraging the multimodal tool-calling capabilities of Qwen3.5 and Group Relative Policy Optimization (GRPO) through the Hugging Face TRL framework, we train a 9B-parameter MLLM that achieves a 52% success rate on the FlySearch FS-1 Forest benchmark, matching Claude 3.5 Sonnet (52%) and approaching GPT-5 (57%) and Claude 4.5 Sonnet (55%), despite being substantially smaller. Finally, we present early results from deployment on physical UAV hardware and discuss the challenges of closing the sim-to-real gap.

Abstract:

A single text prompt passed to a diffusion model often yields a wide range of visual outputs determined solely by stochastic process, leaving users with no direct control over which specific semantic variations appear in the image. While existing unsupervised methods attempt to analyze these variations via output features, they omit the underlying generative process. In this work, we propose a framework to disentangle these semantic directions directly within the input embedding space. To that end, we collect a set of gradients obtained by backpropagating the differences between stochastic realizations of a fixed prompt that we later decompose into meaningful steering directions with Principal Components Analysis or Sparse Autoencoder. Our approach yields three key contributions: (1) it isolates interpretable, steerable directions for precise, fine-grained control over a single concept; (2) it effectively mitigates mode collapse in distilled models by reintroducing lost diversity; and (3) it establishes a novel estimator for concept complexity under a specific model, based on the dimensionality of the discovered subspace.

Abstract:

Lean has become a prominent platform for AI-assisted theorem proving. Most existing tools, however, are designed to help users complete proofs rather than to support controlled experiments. Consequently, it remains difficult to determine whether improvements come from better prompting, longer inference, verifier feedback, or multi-agent coordination.

We present an open-source experimental harness for studying LLM proof search in Lean. It controls prompts, computational budgets, and agent protocols; records model interactions, Lean diagnostics, token usage, and runtime; and evaluates generated proofs using strict external verification. Lean provides machine-checkable feedback during proof search and an unambiguous final success signal, making it a useful environment for studying agentic reasoning in general.

In our initial empirical study, we use the harness to investigate budget-matched reasoning branching. We compare a long single-agent trajectory with independent and shared-prefix subagents, and study what techniques can indicate good branch points. This allows us to ask not only whether additional agents help, but when the model is actually making important decisions in math proving tasks.

Abstract:

Audio diffusion models can synthesize high-fidelity music from text, yet achieving fine-grained control over specific musical attributes remains challenging, as their internal mechanisms for representing high-level concepts are poorly understood. In this work, we use activation patching to demonstrate that recent audio diffusion architectures exhibit a semantic bottleneck, where a small, shared subset of consecutive attention layers controls distinct musical concepts, such as the presence of specific instruments, vocals, or genres. Building on this, we systematically evaluate a broad spectrum of steering paradigms, comparing activation steering against prompt-level, score-space, and weight-space interventions, analyzing the interaction between the steering mechanism and the intervention site. Our new benchmark, supported by an extensive user study, demonstrates that localized activation steering establishes a new state-of-the-art in audio concept modulation.

Abstract:

We introduce the metagame, a conceptual framework for quantifying second-order interaction effects of model explanations. For any first-order attribution $\phi(f)$ explaining a model $f$, we measure the directional influence of feature $j$ on the attribution of feature $i$, denoted as meta-attribution $\varphi_{j \to i}(f)$, by treating the attribution method itself as a cooperative game and computing its Shapley value. Theoretically, we prove that attributions hierarchically decompose into meta-attributions, and establish these as directional extensions of existing interaction indices. Empirically, we demonstrate that the metagame delivers insights across diverse interpretability applications: (i) quantifying token interactions in instruction-tuned language models, (ii) explaining cross-modal similarity in vision-language encoders, and (iii) interpreting text-to-image concepts in multimodal diffusion transformers.

Abstract:

Data-driven weather forecasting models are commonly trained with pointwise losses such as mean squared error (MSE). Under forecast uncertainty, these objectives favor central conditional estimates and penalize small displacement errors twice - once for the missing feature at its true location and once for the spurious feature at the predicted location. This “double penalty” discourages the reconstruction of uncertain fine-scale structures, producing overly smooth forecasts with reduced effective resolution, underestimated natural variability, and weakened localized extremes. The loss of high-frequency information becomes particularly detrimental during autoregressive rollouts, where smoothing accumulates across successive prediction steps.

We investigate scale-aware training objectives designed to preserve fine-scale variability without sacrificing conventional forecast accuracy. First, we apply an adjusted MSE (AMSE) based on spherical harmonic decomposition in deterministic forecasting experiments, including the fine-tuning of a pretrained weather model and comparisons with established baselines. AMSE separates the loss attributable to spectral amplitude errors from that attributable to decorrelation, allowing forecast quality to be assessed across physically meaningful spatial scales and reducing the tendency to suppress high-frequency variability. Because this formulation is naturally defined for global fields on the sphere, it does not directly transfer to the bounded regional domains used by limited-area models (LAMs).

To extend scale-aware training to bounded regional domains, we investigate localized wavelet-domain loss functions for LAMs. To the best of our knowledge, wavelet-domain scale-aware objectives have not yet been systematically evaluated in autoregressive, high-resolution limited-area weather forecasting. Unlike spherical harmonics, wavelets provide simultaneous localization in space and scale, support multiresolution analysis over restricted domains, and represent geographically localized structures without requiring full-globe fields. These properties make them well suited to high-resolution regional forecasting and other spatiotemporal physical fields characterized by spatially heterogeneous dynamics.

The study examines whether scale-aware losses can recover high-frequency detail and improve extreme-event prediction while retaining accurate and stable autoregressive forecasts.

Abstract:

Low-rank adaptation (LoRA) has become the dominant paradigm for parameter-efficient fine-tuning (PEFT) of large-scale deep learning models. However, the inherent bilinear structure of LoRA introduces a critical limitation: the mapping from trainable parameters to weight updates is not distance-preserving, distorting the optimization landscape. Related methods that project a low-dimensional vector into LoRA’s parameter space, such as Uni-LoRA, improve parameter efficiency, but the subsequent bilinear map breaks end-to-end isometry, leaving the core distance-preservation problem unresolved. We propose \textbf{GPart} (Global Partition fine-tuning), a highly parameter-efficient fine-tuning method which removes the low-rank bottleneck entirely. Our method uses a single isometric partition matrix to map a $d$-dimensional trainable vector directly into the full weight space of the model. The result is an extremely minimal fine-tuning pipeline: one random projection, end-to-end isometric, with a single clean hyperparameter ($d$) and storage cost of $d+1$ values (the trainable vector plus a random seed). GPart builds on the theoretical premise that effective fine-tuning can emerge from random low-dimensional subspaces of the full weight space, without imposing low-rank matrix structure.

We empirically demonstrate the superior or comparable performance of GPart to existing PEFT methods on natural language understanding, computer vision tasks, and mathematical reasoning. Overall, GPart achieves state-of-the-art efficiency and performance by removing structural constraints, offering a straightforward and elegant path to PEFT.

Abstract:

Calorimeter simulation is one of the largest computing costs at the Large Hadron Collider, which motivates fast machine-learning surrogates that stand in for the faithful but slow numerical simulation. We present CaloVAR, a generative model for calorimeter showers built on next-scale prediction. Existing fast autoregressive models flatten a shower into a one-dimensional sequence and generate one token at a time; CaloVAR instead represents a shower at several resolutions and generates it from coarse to fine, producing a complete token map at each resolution. Because each resolution already decodes to a complete shower, the number of generated resolutions is a single inference-time setting, requiring no retraining, that allows the practitioner to navigate the speed-fidelity curve.

We evaluate on the CaloChallenge 2022 Dataset 3, a public benchmark for fast calorimeter surrogate models, which asks a model to reproduce Geant4 electromagnetic showers on a 40500-cell detector from the incident energy alone. CaloVAR outperforms the two fastest CaloChallenge token-based autoregressive baselines on the spatial shower observables, cutting energy-center and shower-width separation power by a factor of two to four. On the Frechet and kernel physics distances, CaloVAR achieves $\text{FPD} = 683 \times 10^{-3}$ and $\text{KPD} = 3.11 \times 10^{-3}$, improving on both token-based baselines.

On speed, the key advantage of next-scale prediction is the reduction of sequential generation steps from linear to logarithmic in the token count. CaloVAR generates a shower in 0.23 ms at batch size 1000 on a single A100 GPU in BF16. Because the two token-based baselines were the fastest GPU submissions in the CaloChallenge 2022 review, and CaloVAR outpaces them in direct re-timing on the same hardware, CaloVAR ranks as the fastest approach among the CaloChallenge GPU submissions. The remaining field, built on diffusion, normalizing flows, and point-cloud generation, while achieving higher peak fidelity, requires one to three orders of magnitude more generation time at comparable batch sizes. Beyond peak performance, the coarse-to-fine generation order offers a built-in speed-fidelity trade-off: stopping generation at a coarser resolution can reduce latency by up to a further factor of roughly three, at the cost of spatial detail, without any retraining. Coarse-to-fine generation is a practical and scalable route to fast and faithful calorimeter simulation.

Abstract:

Text-to-image diffusion models (DMs) have achieved remarkable success in image generation. However, concerns about data privacy and intellectual property remain due to their potential to inadvertently memorize and replicate training data. Recent mitigation efforts have focused on identifying and pruning weights responsible for triggering verbatim training data replication, based on the assumption that memorization can be localized. We challenge this assumption and demonstrate that, even after such pruning, small perturbations to the text embeddings of previously mitigated prompts can re-trigger data replication, revealing the fragility of such methods. Our further analysis then provides multiple indications that memorization is indeed not inherently local: (1) replication triggers for memorized images are distributed throughout text embedding space; (2) embeddings yielding the same replicated image produce divergent model activations; and (3) different pruning methods identify inconsistent sets of memorization-related weights for the same image. Finally, we show that bypassing the locality assumption enables more robust mitigation through adversarial fine-tuning. These findings provide new insights into the fundamental nature of memorization in text-to-image DMs and inform the future development of more reliable mitigation methods against DM memorization.

Abstract:

Deployed large reasoning models (LRMs) often behave unexpectedly. Test-time steering controls LRM outputs by intervening on their hidden representations, but it can degrade output quality. We argue that prior steering work implicitly relies on internal features that detect behavior in already generated text. We show that these detection features are poor predictors of future behavioral outcomes, and thus not the natural intervention target. Instead, we train activation probes to predict future behavior likelihoods from intermediate reasoning steps. These probes predict the most likely behavior with 64%-91% accuracy, revealing a separate type of internal prediction features. Building on these prediction features, we introduce a text-level steering method, Future Probe Controlled Generation. FPCG samples multiple candidate sentences and chooses the best one according to a probe predicting the future behavior likelihood. This enables steering with almost no output quality degradation. FPCG also enables steering in several evaluations where activation steering fails. These results show that distinguishing detection and prediction features enables a more nuanced approach to controlling LRM behaviors.

Abstract:

Recent Video Super-Resolution (VSR) methods rely heavily on transformers and explicit optical flow, creating computational overhead and custom operations that hinder deployment on hardware accelerators like TensorRT. To address this, we introduce NanoVSR, a scalable, fully convolutional architecture designed for resource-constrained edge devices. Using structural reparameterization, NanoVSR collapses into standard convolutions during inference, ensuring seamless hardware compatibility and negligible runtime overhead. Furthermore, despite lacking explicit motion compensation, it maintains competitive restoration quality by implicitly learning spatio-temporal alignments through progressive training. Evaluated on the REDS4 benchmark, NanoVSR demonstrates an exceptional balance between accuracy and computational efficiency, significantly improving the trade-off for compact architectures. Our NanoVSR-644k baseline yields 28.64 dB PSNR while delivering 27.2 FPS on the NVIDIA Jetson Orin NX 16GB (25W), offering massive speed gains over heavier models. The scaled NanoVSR-1.7M variant reaches 29.15 dB with a throughput of 19.58 FPS, providing superior, edge-optimized upscaling. Code is available at https://github.com/filippawlicki/nanovsr.

Abstract:

Human concept representations are compartmentalized: learning that cars can run on diesel updates a person’s model of “car” far more than their model of “motorcycle,” even though both are “vehicles.” We ask whether a robotic world model built with the same hard-boundaried structure, separate visual and physical branches, each with its own epistemic uncertainty, localizes uncertainty to its correct cause more reliably than a monolithic latent. We build a JEPA-style two-branch world model for a manipulation task and find a clean, 5-seed-reproducible double dissociation on the visual axis: visual appearance changes raise only the visual branch’s uncertainty, with bit-exact zero leakage into the physical branch, and this becomes a strong probe-targeting signal (10%→53% probe rate) that a monolithic baseline cannot replicate by construction. On the physical axis, however, we obtain a well-diagnosed null result: four independent, principled fixes, exposing actuator effort, increasing ensemble diversity, and two applications of training-time domain randomization, all fail to produce a non-zero uncertainty response to a verified physical anomaly. We trace this to a controller-masking effect: a stiff low-level controller absorbs the disturbance into commanded effort before it reaches any signal our world model observes, confirmed by a second task where the identical fix succeeds once the physical effect isn’t filtered by a controller. We report both results, and the debugging path connecting them, as evidence for a general precondition on uncertainty localization in embodied learning.

Abstract:

Multimodal agents offer a compelling path to automating complex document-intensive workflows, yet a critical question remains: do these architectures demonstrate genuine strategic reasoning, or simply conduct stochastic trial-and-error search? To address this, we introduce Agentic Document VQA, a benchmark of 2,250 human-authored questions grounded in 800 heterogeneous PDF documents. Guided by Classical Test Theory, we design it to maximize discriminative power and reliably differentiate between varying levels of agent capability. To rigorously assess agentic behaviour, we introduce a novel evaluation protocol for measuring the accuracy-effort trade-off. Using this framework, we find that humans show strong metacognitive calibration, adapting or abandoning failed strategies, whereas frontier agents often persist in unproductive loops with diminishing returns. We release the dataset, evaluation harness, and leaderboard to help facilitate the transition from brute-force retrieval to calibrated, efficient reasoning.

Abstract:

Diffusion models are prone to generating structural hallucinations - samples that match the statistical properties of the training data yet defy underlying structural rules, resulting in anomalies like hands with more than five fingers. Recent research studied this failure mode from several viewpoints, offering partial explanations to their occurrence, such as mode interpolation. In this work, we propose a complementary perspective that treats hallucinations as instabilities on the model-induced manifold. We begin by showing that a hallucination filter based on such instabilities matches or exceeds the performance of the recently proposed temporal one. By tracing the source of these instabilities, we identify local intrinsic dimension (LID) as their primary driver and propose Intrinsic Quenching (IQ), a direct corrective mechanism that deflates it to alleviate hallucinations. IQ consistently outperforms standard hallucination reduction baselines across a wide array of benchmarks and offers a highly promising solution for enforcing anatomical consistency in downstream medical imaging tasks.

Abstract:

Generating a 3D dental volume from a single panoramic radiograph (PXR) could provide a low-radiation alternative to Cone-Beam Computed Tomography (CBCT), but the problem is highly underdetermined: panoramic acquisition integrates 3D attenuation along curved X-ray paths into a 2D image, leaving depth-resolved anatomy unobserved. Existing implicit and generative approaches often produce oversmoothed geometry or anatomically inconsistent hallucinations, lacking geometry-driven supervision and relying on smooth representations unable to precisely localize sharp anatomical boundaries. We propose X-Splat, the first Gaussian Splatting framework for generating CBCT-like 3D dental volumes from a single PXR. X-Splat uses the known panoramic acquisition geometry as a generation scaffold: learnable anisotropic Gaussian primitives are initialized along the X-ray paths that formed the input image and adjusted in a single feed-forward pass, constrained by Beer–Lambert reprojection and multi-view radiographic training supervision. A lightweight residual refiner adds dataset-level anatomical priors without overriding the geometry already resolved by the Gaussians. We train on synthetic PXR–CBCT pairs, enabling direct volumetric supervision without paired real scans. We further introduce segmentation-based geometry-aware metrics, providing the first evaluation of PXR-based generation over maxillofacial anatomy. X-Splat outperforms NeRF- and GAN-based baselines, recovering individual teeth, cortical boundaries, and alveolar structure, including the mandibular canal which prior methods fail to reconstruct.

Abstract:

During in vitro fertilization, the number and size of ovarian follicles determine drug dosing and the timing of egg retrieval. Measuring them is also one of the most tedious tasks in clinical imaging: a sonographer places calipers on dozens of small, low-contrast structures, every other day, for every patient. In our study it took 220 seconds per ovary, and different experts routinely disagree on what they see.

I will present how we built and deployed a model that automates this. Instead of processing frames independently, it is a custom end-to-end convolutional instance segmentation network that takes an entire transvaginal cine loop as a 3D volume and outputs per-follicle instances tracked through the sequence. We arrived there after two failures: classical detectors, and frame-by-frame segmentation with heuristic post-processing, which merged touching follicles and lost identity across frames. The hardest sub-problem was reliably locating the ovary at all in a noisy, artifact-heavy scan.

The model was developed on 5508 transvaginal scans from 1689 patients at clinics in Poland, Argentina, Chile and the USA. On a held-out consensus test set of 102 scans from 27 patients, labelled independently by three expert sonographers and then reconciled, it reached 98.2% precision and 88.9% recall on follicles ≥10 mm — within the range of the individual experts. Across all follicle sizes, precision was 94.2% and recall 68.9%: the model is markedly weaker on small follicles, and so are humans. Building the consensus reference showed that routine clinical reports systematically under-count follicles below 10 mm. On a separate test set of 702 scans from 235 patients, performance was stable across five ultrasound machines from three vendors, and AI-assisted annotation was 2.5 times faster than manual.

The second half of the poster covers what happened after the paper. The system obtained FDA 510(k) clearance, which took roughly a year. Architecture and metrics were not the bottleneck. What was: showing that our data actually covered what the device would encounter in the field, enough scans from US sites, and enough coverage of the ultrasound systems it would run on. We expanded the dataset specifically to close those gaps.

Two things that rarely make it into papers. First, how the labels actually get made and how differently, depending on what they are for. Evaluation used a deliberately expensive procedure: three expert sonographers labelling the same scans independently, then reconciling into a consensus reference. Training data comes from something else entirely: an in-house annotation team drawing bounding boxes on every follicle in every frame, masks on a subset, with expert review on top. The two procedures answer different questions, and conflating them is an easy way to overstate what a medical imaging model can do.

Second, deployment: PACS integration across more than a dozen clinics, and what changes when sonographers can edit the model’s output during the exam - both for the workflow and for the data coming back.

Abstract:

Discrete visual tokenizers (DVTs) map images to ordered sequences of codes that can serve as structural scene descriptions. Most methods fix sequence length before seeing the image, assigning the same code budget to simple and complex scenes. Adaptive alternatives often rely on post-hoc search or select among several predefined rates. Many DVTs are also trained through pixel reconstruction, which steers their vocabularies toward texture and low-level appearance and leaves less capacity for semantic and spatial structure.

We propose STROP (Structure over Pixels), a DVT that learns a variable-length description for each image, which we refer to as a visual program. A frozen DINOv3 encoder supplies patch features to a transformer generator, which outputs the program as a causally ordered sequence of quantized codes. An interpreter reads an active prefix of this sequence and reconstructs a DINO-aligned spatial feature field. A separate length head predicts the required program length in a single forward pass. Training follows a curriculum in which random truncation first encourages useful information to appear early in the program. Local rate-distortion probes then provide per-image supervision for the length predictor, whose decisions gradually replace random truncation. Pixel gradients are kept outside the tokenizer, so feature-space reconstruction shapes the discrete vocabulary.

We evaluate the interpreted feature field and the visual program through downstream probes and direct analysis of the learned vocabulary. STROP preserves task-relevant information across dense prediction and classification tasks, while predicted program length increases with scene complexity. The vocabulary also exhibits code reuse and spatial grounding. Token-erasure attributions are often localized, and pairwise token synergies align with coherent semantic regions. The learned programs adapt their length to image content, while individual codes act as reusable semantic handles and show early signs of compositional structure.

Abstract:

Assessing the privacy of large language models (LLMs) presents significant challenges. In particular, most existing methods for auditing differential privacy require the insertion of specially crafted canary data during training, making them impractical for auditing already-trained models without costly retraining. Additionally, dataset inference, which audits whether a suspect dataset was used to train a model, is infeasible without access to a private non-member held-out dataset. Yet, such held-out datasets are often unavailable or difficult to construct for real-world cases since they have to be from the same distribution (IID) as the suspect data. These limitations severely hinder the ability to conduct scalable, post-hoc audits. To enable such audits, this work introduces natural identifiers (NIDs) as a novel solution to the above-mentioned challenges. NIDs are structured random strings, such as cryptographic hashes and shortened URLs, naturally occurring in common LLM training datasets. Their format enables the generation of unlimited additional random strings from the same distribution, which can act as alternative canaries for audits and as same-distribution held-out data for dataset inference. Our evaluation highlights that indeed, using NIDs, we can facilitate post-hoc differential privacy auditing without any retraining and enable dataset inference for any suspect dataset containing NIDs without the need for a private non-member held-out dataset.

Abstract:

Social media bot detection research exhibits imbalances across platforms, languages, and detection levels. Addressing these gaps, this study focuses on comment-level bot detection within Polish Reddit communities. We describe in detail the construction of a comprehensive dataset ($\sim$40,000 comments, 58\% bot-comment prevalence), which provides labels for subsequent model training. Polish Reddit is inherently multilingual; we therefore take advantage of the linguistic signals, treating the language composition of a comment as a feature in its own right. We develop novel platform-specific, language-specific, and culturally informed features, and train comment-level classifiers from multiple model families on our manually annotated dataset. Temporal evaluation on 2025 data indicates strong generalization, while also revealing model-specific differences and a late-period recall decline suggesting shifts in bot behavior. As a step toward model explainability, we examine cross-model feature importance and directional effects using SHAP values. Finally, we complement our quantitative findings with a qualitative characterization of the Polish Reddit bot ecosystem. Overall, this study provides an important baseline for an underexplored setting and contributes to an open discussion on how to approach detection where data is linguistically mixed.

Abstract:

Text-to-image diffusion models exhibit remarkable generative capabilities, yet their internal operations remain opaque, particularly when handling prompts that are not fully descriptive. In such scenarios, models must make implicit decisions to generate details not explicitly specified in the text. This work investigates the hypothesis that this decision-making process is not diffuse but is computationally localized within the model’s architecture. While existing localization techniques focus on prompt-related interventions, we notice that such explicit conditioning may differ from implicit decisions. Therefore, we introduce a probing-based localization technique to identify the layers with the highest attribute separability for concepts. Our findings indicate that the resolution of ambiguous concepts is governed principally by self-attention layers, identifying them as the most effective point for intervention. Based on this discovery, we propose ICM (Implicit Choice-Modification) – a precise steering method that applies targeted interventions to a small subset of layers. Extensive experiments confirm that intervening on these specific self-attention layers yields superior debiasing performance compared to existing state-of-the-art methods, minimizing artifacts common to less precise approaches.

Abstract:

Diffusion inversion maps an input image to a noise that enables reconstruction and editing. Standard DDIM inversion, however, relies on a local approximation that reuses model predictions across consecutive trajectory states, accumulating error and imprinting spatially correlated image structure into the recovered noise. We introduce a lightweight LoRA adapter that corrects this approximation exclusively during inversion, leaving the original generation pipeline unchanged. With a detailed evaluation on existing benchmarks we show that thanks to the corrected noise recovered by our method, which better matches the Gaussian prior, we can achieve state-of-the-art performance in downstream tasks such as edition or style transfer.

Abstract:

Many real-world time series exhibit non-stationary dynamics that shift between distinct operating regimes, demanding models that can simultaneously track continuous latent states, segment discrete regimes, and produce calibrated probabilistic forecasts. Classical switching Kalman filters combine Gaussian state estimation with regime inference but rely on fixed, time-invariant parameters that limit their expressiveness. We propose the Deep Switching Kalman Filter, a hybrid model that retains the principled probabilistic structure of switching linear-Gaussian state-space models while using a causal neural network to generate time-varying, regime-dependent parameters from the observation history. The model is trained in a fully self-supervised manner by alternating GPB(2) inference with a detached neural parameter update based on smoothed state estimates and regime posteriors. We evaluate on six benchmarks spanning three task families-state inference, segmentation, and forecasting-and compare against classical, neural single-regime, and neural switching baselines. DSKF achieves the lowest errors on the state-inference and forecasting benchmarks, while classical SKF remains strongest on the two low-data segmentation datasets. The model retains explicit continuous-state and regime posteriors together with sample-based predictive uncertainty.

Abstract:

Implicit Neural Representations (INRs) encode signals as the weights of a coordinate-based neural network and have recently been proposed as an alternative domain for downstream learning. While promising, classification directly in weight space remains challenging due to the high dimensionality and complex structure of INR parameters. Furthermore, the way discriminative information is distributed across INR weights remains poorly understood.

We propose a hierarchical Mixture-of-Experts (HMoE) Transformer that processes INR weights using conditional computation aligned with the structure of the underlying implicit network. Coupled with a meta-learning framework that shapes INR parameters for downstream tasks, our model achieves state-of-the-art accuracy across standard benchmarks, ranging from low-resolution datasets to high-resolution ImageNet-1K.

To gain insight into how INRs encode discriminative information, we develop weight-space attribution and pruning methods that identify parameters most relevant for classification. These analyses reveal how class-specific structure emerges within INR layers and support the suitability of MoE architectures for weight-space learning.

Our approach advances both the performance and interpretability of weight-space classifiers.

Abstract:

Foundation models for the Earth system have gained popularity, as they are starting to surpass numerical solvers in the accuracy of predicting Earth’s condition while requiring fewer computational resources (Bodnar et al., 2025). The Earth System Foundation Model (ESFM) (Ozdemir et al., 2026) contributes to this research direction by further extending the foundation models’ flexibility. The forecasting capabilities of ESFM are achieved in an autoregressive manner, using data from the $t_0$ - $\Delta t$ and $t_0$ timesteps to produce a prediction for $t_0$ + $\Delta t$. This approach has already proven effective on weather timescales. Moreover, we find that it also shows some promise in zero-shot subseasonal-to-seasonal (S2S) predictions (15–40 days). That said, this model and many others were never trained for the S2S horizon. Its S2S performance is just a side-effect of reliable one-step forecasting, leaving clear room for improvement.

The main sources of skill on S2S timescales are slowly evolving climate modes like El Niño-Southern Oscillation, the Madden-Julian Oscillation, stratosphere-troposphere coupling, soil moisture, and sea ice extent. These retain memory beyond the two-week deterministic weather predictability limit. However, modelling those together with dynamic atmosphere variables in one autoregressive model remains a challenge. Capturing atmospheric evolution, including the diurnal cycle, needs a $\Delta t$ on the order of hours, but sampling slow variables like sea surface temperature or sea ice cover at that same $\Delta t$ makes the observed change mostly driven by noise, rather than meaningful signal.

This work improves ESFM for systems with variables spanning such different spatio-temporal dynamics. We introduce training and architectural modifications that encode slow variables, such as sea surface temperature, sea ice, and soil water volume layers, separately from the fast dynamic atmosphere and surface variables. This brings an additional coupling component to the system.

At inference, fast and slow variables are predicted at different lead times. This approach requires the adaptation of rollout finetuning, which is the standard approach to improve weather models on longer time horizons. Compared to the baseline ESFM, our approach improves both RMSE and anomaly correlation coefficient (ACC) across all predicted variables in weeks 3 to 6, giving more reliable forecasts across the S2S horizon.

Abstract:

Double negation tests whether language models preserve answers across semantically equivalent formulations. We introduce a bilingual English–Polish benchmark and TriviaNeg, a supervision dataset covering transformations, equivalence judgments, answering, and translation. Targeted fine-tuning of Qwen3.5-9B increases double-negation accuracy from 60.5% to 84.9% in English and from 38.4% to 73.7% in Polish, while affirmative accuracy remains above 92%. However, outcomes depend strongly on the supervision objective: transformations and equivalence judgments produce the largest gains, whereas answer-only supervision reduces performance to near or below chance and harms general capabilities. Improvements also transfer across languages and selectively to an external negation benchmark. These results show that effective double-negation learning depends more on the design of the supervision objective than on training volume alone.

Abstract:

REM sleep behavior disorder (RBD) is a sleep disorder characterized by abnormal motor behaviors during REM sleep and is strongly associated with the future development of several neurodegenerative diseases, particularly α-synucleinopathies such as Parkinson’s disease. Accurate and scalable methods for detecting and characterizing RBD are therefore of considerable clinical interest. While polysomnography (PSG) remains the clinical gold standard, wearable actigraphy offers a low-cost and widely accessible alternative for large-scale screening and longitudinal monitoring.

We present a series of machine learning approaches for the automated analysis of wearable actigraphy and polysomnography (PSG), spanning classical tree-based models, modern temporal deep learning architectures, and PSG-based models for RBD detection and the exploration of clinically relevant phenotypes.

Together, these approaches investigate how increasingly expressive machine learning models and complementary sensing modalities can improve scalable RBD assessment, with a particular focus on robust generalization across heterogeneous, multi-center datasets.

Abstract:

Large language models concentrate probability mass on a limited subset of possible outputs, leading to low diversity in generated responses. In mathematical reasoning, this may hinder full exploration of the solution space. Conditional generation offers a remedy, but existing approaches either rely on large amounts of labeled data, provide only coarse control over latent modes discovered in training corpus, or require predefined tags and relevant style axes. In contrast, we seek to condition generation using free-text style descriptions, enabling fine-grained control while maintaining flexibility of the latent space.

To address that, we introduce Styles as LatenTs (SaLT), a learning framework for free-text solution style conditioning. In order to make use of large-scale data, we formulate the problem as a variational expectation maximization procedure. We finetune a single underlying language model to fulfill two roles: an amortized style posterior $Q_\theta(z\mid x,y)$, predicting style of the response given a problem-solution pair, and a conditional LM $P_\theta(y\mid x,z)$ producing an in-style solution to the given problem. For each $(x,y)$ pair, the style predictor proposes candidate latent styles and the solution model re-ranks them using importance-weighted scores. The responsibilities of each style are computed from a truncated posterior and the iterations are interleaved with optimization on a small supervised fraction of the data annotated using an oracle model. We investigate the resulting model across the dimensions of mathematical correctness, fine-grained style control, style disentanglement and a general solution surface and strategy-level diversities. Our results demonstrate emerging fine-grained controllability of the generated responses while maintaining utility on the original task.

Abstract:

Accurate high-resolution weather prediction is critical for sectors ranging from agriculture and renewable energy to disaster management. While Numerical Weather Prediction (NWP) models like WRF provide fine-scale details, they remain computationally prohibitive. Conversely, recent AI foundation models (e.g., Aurora, GraphCast) offer immense speed-ups but are constrained to coarse resolutions (0.25°) by their training data. Machine Learning Limited Area Models (ML LAMs) attempt to bridge this gap but typically rely on computationally expensive NWP-derived Local Boundary Conditions (LBCs), struggle to generalize across regions, and inherit systematic biases from their NWP training targets.

To address these limitations, we previously proposed a latent-space decoupling framework that utilizes a frozen global weather foundation model backbone (Aurora) augmented with lightweight, multi-scale prediction heads. This approach demonstrated the feasibility of downscaling from 0.25° to 0.025° without retraining the backbone or requiring explicit LBCs.

In this work, we present substantial advancements that transition of previously presented work from a theoretical downscaling architecture to an operationally viable, physically consistent forecasting system. First, we establish rigorous baselines, demonstrating that our lightweight framework outperforms operational NWP (WRF-ARW) and state-of-the-art generative ML models (StormCast) at a fraction of the computational cost. Second, we bridge the “sim-to-real” gap by integrating in-situ weather station observations (HadISD). Using continual learning with experience replay, we fine-tune the model on sparse station data, correcting systematic biases inherited from NWP simulation targets without catastrophic forgetting of fine-scale spatial dynamics. Third, we extend the framework beyond near-surface variables to full 3D atmospheric fields across multiple pressure levels, demonstrating that the foundation model’s latent space contains sufficient information to reconstruct the entire atmospheric column at kilometer-scale resolution. Fourth, we demonstrate cross-continental generalization through multi-region training on geographically disjoint domains (CONUS and the Baltic region) using a single shared network. Fifth, we validate the physical realism of our outputs using energy spectra, confirming preservation of multi-scale atmospheric dynamics rather than mere pixel-wise error minimization. Finally, we introduce autoregressive rollout capabilities, showing that our model maintains stability over short-range forecast horizons (up to 48 hours), with error growth rates substantially lower than those of operational NWP. Together, these results establish our approach as a comprehensive, globally adaptable, and physically grounded alternative to traditional mesoscale NWP.

Abstract:

Deep learning models for super-resolution typically optimize for perceptual quality, which can lead to plausible but fictitious structural hallucinations that compromise reliability in scientific applications. To address this limitation, we introduce Physics-Informed Machine Learning into the super-resolution pipeline by formulating the task as a constrained latent concept discovery problem. We propose PASTRY, a two-stage neural framework that embeds physical constraints directly into its architecture. First, a self-supervised, physics-constrained autoencoder discovers a latent dictionary of physically meaningful spectral signatures from the data. Second, a supervised network estimates high-resolution spatial distributions of these signatures. By utilizing specific activation layers, PASTRY strictly enforces Abundance Non-negativity (ANC) and Sum-to-One (ASC) principles, restricting the network’s solution space to physically valid mixtures. Evaluated on standard imaging benchmarks, PASTRY achieves state-of-the-art super-resolution performance using a lightweight architecture of only 0.5 M parameters. Furthermore, ablation and stability analyses demonstrate that our method systematically converges to physically plausible components, successfully disentangling complex inputs into interpretable material maps. Our work highlights how baking domain-specific physical priors into neural architectures enhances both model explainability and reliability.

Abstract:

Accurate 3D reconstruction of colonoscopy data, accounting for complex peristaltic movements, is crucial for advanced surgical navigation and retrospective diagnostics. While recent novel view synthesis and 3D reconstruction methods have demonstrated remarkable success in general endoscopic scenarios, they struggle in the highly constrained environment of the colon. Due to the limited field of view of a camera moving through an actively deforming tubular structure, existing endoscopic methods reconstruct the colon appearance only for initial camera trajectory. However, the underlying anatomy remains largely static; instead of updating Gaussians’ spatial coordinates (xyz), these methods encode deformation through either rotation, scale or opacity adjustments. In this paper, we first present a benchmark analysis of state-of-the-art dynamic endoscopic methods for realistic colonoscopic scenes, showing that they fail to model true anatomical motion. To enable rigorous evaluation of global reconstruction quality, we introduce DynamicColon, a synthetic dataset with ground-truth point clouds at every timestep. Building on these insights, we propose ColonSplat, a dynamic Gaussian Splatting framework that captures peristaltic-like motion while preserving global geometric consistency, achieving superior geometric fidelity on C3VDv2 and DynamicColon datasets.

Abstract:

Text-to-image generation models have advanced rapidly, yet achieving fine-grained control over generated images remains difficult, largely due to limited understanding of how semantic information is encoded. We develop an interpretation of the color representation in the Variational Autoencoder latent space of FLUX.1 [Dev], revealing a structure reflecting Hue, Saturation, and Lightness. We verify our Latent Color Subspace (LCS) interpretation by demonstrating that it can both predict and explicitly control color, introducing a fully training-free method in FLUX based solely on closed-form latent-space manipulation.

This presentation is based on The Latent Color Subspace: Emergent Order in High-Dimensional Chaos, a paper recently published at ICML and co-authored by the presenter.

Abstract:

In our work, we consider cooperative multi-agent reinforcement learning (MARL). The dominant paradigm in this field is Centralized Training with Decentralized Execution (CTDE), which enables agents to act independently at test time while leveraging additional information during training. In this work, we propose a simple yet highly effective framework that operates in this paradigm. During training, we allow the agents to share information in the latent space, thereby combining the full history of observations and actions. Concurrently, we distill these communication-based policies into counterparts that rely solely on local observations, utilizing the form of the value decomposition architecture, and using a simple cross-entropy loss. We show that such an approach is sufficient to outperform current state-of-the art methods operating in CTDE in most of the SMAC (with more difficult settings than the standard ones) and SMACv2 scenarios. However, in some cases, the distribution shift between the communication-based policy (that generates the trajectories) and the target decentralized policy disenables qualitative distillation. To counteract this issue, we gradually introduce samples from the decentralized policy into the replay buffer. This allows us to derive well-performing policies in the cases where the previous vanilla approach fails. Moreover, we solve the Hallway task (requiring very strong coordination) in the CTDE paradigm, which, to the best of our knowledge, has not been done before.

Abstract:

The rapid increase in demand for three-dimensional digital assets has exposed major bottlenecks in traditional manual content creation processes. While generative adversarial networks (GANs) and diffusion models offer a path toward automation, rendering speed remains a critical constraint. Traditional volumetric rendering paradigms, popularized by Neural Radiance Fields (NeRFs), incur significant per-pixel computational costs during ray-marching. To address this, 3D Gaussian Splatting (3DGS) has emerged as an explicit, rasterization-based representation capable of real-time, high-fidelity rendering. However, adapting 3DGS for generative tasks presents an emerging challenge, as the model must synthesize thousands of unstructured Gaussian primitives in a single forward pass. Existing methods often rely on highly engineered, multi-stage hierarchical architectures with anchor structures to stabilize training.

In this work, we propose a more direct, deformation-based alternative, reframing 3DGS generation as a structured point cloud deformation problem. Inspired by sphere-guided synthesis, our framework learns to transform a fixed canonical sphere of points into a complete 3D object. At the core of our approach is a specialized Graph Neural Network (GNN) generator that simultaneously learns two coupled tasks: deforming the initial coordinates to establish the target geometry and augmenting each point with the necessary 3DGS rendering attributes (position, scale, rotation, opacity, and color). The network utilizes PointGNN layers to capture local geometric dependencies and translation-invariant relative positions, followed by efficient LINKX layers for multi-attribute refinement. Style control is integrated using style-modulated linear layers inspired by StyleGAN2, allowing a latent style code to guide the transformation. To maintain overall shape integrity, we incorporate a global permutation-invariant feature vector extracted via max-pooling, ensuring the network reasons about both local and global structures.

We validate the expressive capacity and generalizability of our framework through comprehensive quantitative and qualitative experiments. First, a single-scene overfitting test demonstrates that the GNN-based generator can represent complex geometries, achieving an average PSNR of 30.54 dB on unseen views across ShapeNet Car models. Second, the complete model is trained adversarially on standard datasets, achieving Fréchet Inception Distance (FID) scores of 10.89 on FFHQ, 4.90 on AFHQ-Cat, and 10.61 on ShapeNet Cars. Notably, our approach achieves these results using a single-pass generator with a significantly smaller Gaussian budget (e.g., 16,384 Gaussians) compared to hierarchical alternatives. Finally, we discuss the challenges of explicit 3D generation, such as anisotropic collapse, and how this phenomenon unexpectedly serves as a beneficial inductive bias for modeling fine structures like fur. Our findings suggest that a direct, GNN-based deformation architecture represents a viable and computationally efficient paradigm for the generative modeling of explicit 3D representations.

Abstract:

The tendency of large generative models to memorize training data makes sample verification critical for privacy auditing and copyright enforcement. Current membership (MIA) and dataset inference (DI) attacks often rely on one-shot generations, which yield weak signals and limited sensitivity across modalities. Inspired by Model Autophagy Disorder (MAD), we introduce MADreMIA, a model-agnostic framework that enhances white-, gray-, and black-box MIA and DI. Rather than relying on shadow model training – often infeasible for large generative models – our framework facilitates scalable inference by leveraging inherent signals through iterative trajectories. This process utilizes chained generations across diverse modalities, where each output serves as the subsequent input, to improve membership evidence at low FPR. We demonstrate that memorized training samples exhibit significantly higher coherence and slower degradation during iterative regeneration than non-member generations. Our results show that MADreMIA provides richer signals across diverse model families and modalities; we present comprehensive evaluations for IARs, diffusion, and language models, alongside preliminary results demonstrating its potential for audio models.

Abstract:

The final layer of a Vision Foundation Model (VFM) is the default representation used for transfer to downstream tasks, but it is not always the optimal one. We show that VFM representations exhibit an abstraction-depth correlation: low-level geometric tasks, mid-level scene-structure tasks, and high-level semantic tasks favor different depths of the network hierarchy. This makes representation selection non-trivial. Exhaustive layer-wise probing is costly for modern VFMs with many blocks, while committing to a single layer discards complementary information distributed across depth. We therefore advocate for holistic probing, where a probe can access and adaptively fuse representations from the full VFM hierarchy. We instantiate this with Adaptive Multi-Layer Dense Fusion (AMDF), a lightweight attentive module for adaptive multi-layer dense probing of frozen VFMs. AMDF first refines dense features within each extracted layer and then performs patch-wise fusion across network depth, producing a task-specific dense representation without updating the backbone. Across a variety of contemporary VFMs, AMDF improves over multiple baselines on dense geometric and multi-task benchmarks. These results demonstrate that VFM capabilities are distributed across network depth, and that holistic probing with AMDF provides a practical and interpretable way to unlock them for dense visual prediction.

Abstract:

Graph neural networks have demonstrated remarkable success in predicting molecular properties by leveraging the rich structural information encoded in molecular graphs. However, their black-box nature reduces interpretability, which limits trust in their predictions for important applications such as drug discovery and materials design. Furthermore, existing explanation techniques often fail to reliably quantify the contribution of individual atoms or substructures due to the entangled message-passing dynamics. We introduce SEAL (Substructure Explanation via Attribution Learning), a new interpretable graph neural network that attributes model predictions to meaningful molecular subgraphs. SEAL decomposes input graphs into chemically relevant fragments and estimates their causal influence on the output. The strong alignment between fragment contributions and model predictions is achieved by explicitly reducing inter-fragment message passing in our proposed model architecture. Extensive evaluations on synthetic benchmarks and real-world molecular datasets demonstrate that SEAL outperforms other explainability methods in both quantitative attribution metrics and human-aligned interpretability. A user study further confirms that SEAL provides more intuitive and trustworthy explanations to domain experts. By bridging the gap between predictive performance and interpretability, SEAL offers a promising direction for more transparent and actionable molecular modeling.

Abstract:

Large language models have achieved remarkable success through parameter scaling, yet this approach demands more and more data and computational resources. As models reach hundreds of billions of parameters, alternative architectures offering comparable performance with fewer parameters are increasingly necessary. Iterative transformer architectures, which apply the same layers multiple times to hidden representations, present a promising solution by effectively increasing model depth without increasing parameter count.

While such architecture were preliminarily studied for language modeling, the effectiveness of such architectures in data-constrained settings remains unexplored. We present the first systematic study of layer-sharing transformer architectures trained on the BabyLM corpus (10M tokens), investigating three iteration strategies: Layer Repetition, Model Repetition, and a novel Middle-loop Repetition inspired by mechanistic interpretability findings. Our experiments span architectures from 1 to 24 transformer layers with 2 to 16 recursive iterations, exploring iteration-specific specialization via LoRA adapters. To achieve an even lower parameter count, we investigate embedding factorization and custom tokenizers.

Our results demonstrate that iterative architectures are highly effective under data-constrained conditions – a 3-layer iterated model with Middle-loop Repetition outperforms a standard 24-layer transformer on the SuperGLUE benchmark while using 8$\times$ fewer trainable layers and a single-layer model with iteration factor of 8 achieves SuperGLUE performance comparable to a 12-layer baseline. The Middle-loop Repetition schema proves particularly stable in high-iteration regimes (42 unfolded layers), where conventional Layer and Model Repetition strategies plateau. Additionally, embedding factorization reduced parameter counts by approximately 36M (over 5$\times$ compression for the smallest models) while frequently improving rather than harming performance.

These findings highlight the potential of parameter-sharing architectures for efficient learning from limited data, offering a viable alternative to parameter scaling for resource-constrained applications. We make our code and models publicly available to support further research on iterative architectures.

Abstract:

Image autoregressive models (IARs) have recently demonstrated remarkable capabilities in visual content generation, achieving photorealistic quality and rapid synthesis through the next-token prediction paradigm adapted from large language models. As these models become widely accessible, robust data provenance is required to reliably trace IAR-generated images to the source model that synthesized them. This is critical to prevent the spread of misinformation, detect fraud, and attribute harmful content. We find that although IAR-generated images often appear visually identical to real images, their generation process introduces characteristic patterns in their outputs, which serves as a reliable provenance signal for the generated images. Leveraging this, we present a post-hoc framework that enables the robust detection of such patterns for provenance tracing. Notably, our framework does not require modifications of the generative process or outputs. Thereby, it is applicable in contexts where prior watermarking methods cannot be used, such as for generated content that is already published without additional marks and for models that do not integrate watermarking. We demonstrate the effectiveness of our approach across a wide range of IARs, highlighting its high potential for robust data provenance tracing in autoregressive image generation.

Abstract:

As generative models increasingly produce samples that are indistinguishable from human-created content, it be- comes difficult to determine whether a given data point was part of a model’s natural training set or was generated by the model itself, especially when models memorize and reproduce training data. We formalize this new challenge as Member vs Generated Inference (MGI): given a sample and a target generative model, infer whether the sample is a true training member or a generated output of that model. Focusing on image generation, we show that existing membership inference methods systematically misclassify generated samples as training members, while attribution-based methods often misclassify true members as generated. This failure arises because both approaches rely on likelihood-related signals that are similarly elevated for training examples and for the model’s own outputs. To address MGI, we propose Data Circuit Breaker (DCB), a three-stage method that combines complementary signals from a generative model’s autoencoder and latent generator to distinguish training members from generated samples. Across multiple generative models, including image autoregressive and diffusion models, DCB consistently addresses the shortcomings of membership inference and attribution methods, remains effective even when models reproduce near-duplicates of training samples, and generalizes to challenging model derivative settings in which new models are trained on generated data.

Abstract:

Fine-tuning safety-aligned Large Language Models (LLMs) on downstream domain datasets can trigger Emergent Misalignment (EM) - a phenomenon where narrow, domain-specific adaptation produces broadly misaligned behaviours. We observed that this problem can be framed from the perspective of safety alignment forgetting, a phenomenon well known in Continual Learning (CL), and evaluate whether CL methods can mitigate EM across four diverse domains (medical, legal, security, and code) without hurting downstream performance. Furthermore, for more rigorous analysis, we test robustness to conditional triggers and include benchmarks that separately track general capability retention and safety-specific behaviour. We evaluate CL-based methods (LwF, CorDA, LoRA-Null, MagMax, LDIFS, interleaving data) alongside recent AI-safety techniques (Persona Vectors, Inoculation Prompting, Inoculation Adapters) under a unified framework. Our results highlight a persistent safety–utility trade-off: while techniques like LwF, LoRA-Null and Inoculation Adapters effectively suppress emergent and conditional misalignment, they also constrain learning of the new task. Conversely, methods optimising for downstream capability (such as interleaving data and CorDA) leave models vulnerable to out-of-domain safety failures.

Abstract:

Static, hand-tuned machine-learning pipelines dominate the modelling of high-dimensional neuropsychophysiological signals, but they share a structural limitation: the choice of model family, preprocessing, and feature representation is fixed by the experimenter at design time, and the optimisation that follows is unable to propose new structures — it can only tune parameters within the structure it was given. The Darwin-Gödel Machine (DGM) paradigm offers a way out: an LLM-driven agent that iteratively designs, evaluates, and rewrites predictive models and itself, using principles of evolution to produce ever-better problem solutions. We report on utilizing the Darwin-Gödel Prediction Machine (DGPM) — previously demonstrated on spacecraft telemetry anomaly detection — to two neuropsychophysiological prediction problems where this rigidity is felt most acutely: a subjective time prediction modelling derived from own laboratory experiments data, and the public “Imagine Decoding Challenge” hosted on Kaggle, in which imagined content is decoded from brain signals.

Methods. The DGPM agentic system we describe replaces the conventional fixed pipeline with a three-loop nested optimisation governed by a least-cost-intervention principle. A Minor Inner Loop tunes hyperparameters of the currently active model. A Major Inner Loop mutates the model architecture and the feature representation. A Gödelian Outer Loop allows the system to rewrite itself for better efficiency. Each loop produces elaborated XAI artefacts: a low-level action trace, a structured narrative of the agent’s reasoning, and a model-level feature-importance record — giving the cognitive neuroscientist an auditable explanation of how a particular predictive model came to exist, rather than only what it predicts.

Results. We present the framework, the two case studies, and the initial results, with particular attention to (i) the structural patterns the system discovered in subjective time prediction data, and (ii) the architectural choices the agent converges on for the decoding challenge, compared against the published baselines and the leaderboard of the Kaggle competition.

Conclusions. We discuss where the novel approach adds value and where it might add cost without benefit, and what its failure modes suggest about the boundary between ML model search and self-efficacy optimization . The poster is intended as an invitation to discuss the framework with the cognitive-computational and ML communities, and to identify follow-up tasks where a self-evolving agentic system might either help or hinder the modelling of human cognition.

Abstract:

Antimicrobial peptides (AMPs) are short amino-acid sequences that inhibit or kill bacteria, and are a promising response to antibiotic resistance. Machine learning has recently accelerated their discovery: most generative frameworks embed peptides into a continuous latent space and then sample from it, optimise it with Bayesian optimisation, or follow gradients through it.

All of these share one obstacle. The latent space is continuous, but the peptide space is discrete. Decoders therefore emit a distribution over sequences and collapse it with argmax — an operation that is neither differentiable nor sensitive to differences between similar distributions, forcing workarounds that introduce problems of their own.

We propose Soft-AMP, a differentiable surrogate that predicts peptide properties directly from distributions over sequences. Trained on millions of such distributions sampled in varied ways, it distils a hard, sequence-level property predictor into the probability simplex, removing argmax from the loop.

We apply it in two ways. First, it scores intermediate points along latent paths, allowing geodesic-like curves that connect two known AMPs while remaining in high-activity regions; within a larger collaborative project, analogues obtained this way were further refined with several optimisation algorithms, yielding 25 candidates that were synthesised and confirmed active in vitro. Second, its differentiability enables gradient-based search directly over soft sequences, improving on the seed peptide’s predicted activity in over 90% of runs, with the edit distance to the seed controllable through an explicit penalty.

Part of this work appeared in arXiv:2510.01988, accepted at ICML 2026, and has since been extended with new methods and experiments.

Abstract:

Adapting pretrained large language models to less represented languages requires modifying their tokenizers to improve segmentation efficiency, which introduces the challenge of aligning the model’s embedding space with the newly introduced vocabulary. Using Qwen3.5-0.8B-Base, we investigate strategies for constructing a Polish-oriented tokenizer by either modifying the original vocabulary or training a new one from scratch. We evaluate five embedding initialization methods and architectural optimization techniques during continued pretraining, assessing both intrinsic tokenizer characteristics and downstream cross-lingual benchmark performance. Our results demonstrate that extending the original tokenizer paired with block expansion provides the optimal balance between target-language adaptation and source-language retention. Furthermore, we find that the effectiveness of embedding initialization methods is highly dependent on how the tokenizer is prepared, and that freezing-based methods can improve both training and evaluation results.

Abstract:

Steering or intervening on model representations at inference time to correct predictions is essential for AI interpretability and safety, yet existing evaluation protocols are limited to ambiguous language modeling tasks. To address this gap, we introduce SwordBench, a benchmark for steering image representations of vision models across multiple backbones and concept removal tasks. Beyond a unified benchmarking suite, we propose new evaluation notions that uncover the second-order effects of orthogonalization among concept activation vectors for pragmatic steering. Specifically, cross-concept robustness measures the stability of concept detection performance across inputs orthogonalized against alternative concepts, and collateral damage quantifies whether steering inadvertently affects model performance on a downstream task for inputs lacking the bias. We find that although a linear support vector machine exhibits superior separability and orthogonality, it fails to achieve zero collateral damage, often trailing sparse autoencoders. In simpler regimes, both standard baselines and optimization-based methods fail to achieve perfect steering.

Abstract:

Vision-Language-Action (VLA) models let robots perform manipulation directly from visual observations and natural-language instructions. These policies are closed-loop with respect to the task: if a grasp slips, the policy sees it and retries. What they cannot do is respond to events outside their training distribution. When a human hand reaches into the workspace, or an unexpected object enters the robot’s path, the policy has no learned response — it continues executing as though nothing happened. This is the failure mode that matters for deploying VLA policies on real hardware around people.

We treat this as a supervision problem separate from task execution. Rather than evaluating whether the policy is performing its task well, which the policy itself is already equipped to do, we monitor whether the scene still resembles anything the policy was trained for. The design constraint is latency: vision-language models capable of meaningful scene reasoning take seconds per query, far too slow to sit inside a manipulation control loop. We therefore separate supervision across two timescales. A lightweight visual model runs continuously over the robot’s cameras, detecting departures from expected scene state and halting motion when one occurs. Only after motion has stopped does a heavier vision-language model run, interpreting what entered the scene, whether it presents a hazard, and whether execution should resume, replan, or abort.

We describe this architecture and report on its current state on physical hardware — a UR5 arm performing table-top manipulation under a SmolVLA policy served through LeRobot. The policy layer is operational. The monitoring and diagnosis stages are under active development, and we discuss the concrete difficulties they raise: selecting a detection signal that responds to genuine intrusions without halting on benign visual variation such as lighting shifts or the robot’s own motion, setting thresholds in the absence of labelled failure data, and converting a language-model diagnosis into a decision a controller can act on.

Our evaluation targets detection latency, false-halt rate under normal operation, and response time to workspace intrusion. The broader claim is that safe deployment of foundation-model policies depends less on improving the policies than on detecting when the world has moved outside their competence — a problem with a different computational profile than action generation, and one that should be architected separately.

Abstract:

The growing interest in AI-assisted content creation has motivated game publishers and designers to investigate ML methods that can support game design. Among tabletop games, role playing games (RPGs) remain a particularly popular segment, however, the application of ML to tabletop RPG design is relatively underexplored. One of the most important and time-consuming design tasks is monster creation, which requires estimating encounter difficulty and efficiently adjusting monster characteristics whenever the resulting difficulty does not match the intended gameplay experience or story.

To address this challenge, we developed an ordinal regression model for monster difficulty estimation. Based on this model we are investigating methods for scaling monsters up and down in difficulty and for generating balanced monsters. Our current research focuses on counterfactual explanations (CFs), a branch of explainable AI that rather than answering why a model produced a given prediction, explain what changes to the input would be required to obtain a desired outcome. In the context of monster design, CFs can be used to generate alternative versions of a monster while preserving its core identity and modifying only the characteristics necessary to achieve a target difficulty level.

An additional advantage of CFs is their ability to provide multiple valid alternatives. This naturally supports a human-in-the-loop workflow, allowing designers to select the variant that best matches their creative vision. Such a framework can serve both as a level difficulty adjustment tool and as a foundation for future monster-generation systems.

This domain also provides a unique opportunity to evaluate CFs methods in a realistic setting. While many studies rely on standard tabular ML benchmarks, this dataset contains naturally occurring counterfactual-like examples. Specifically, several monster families include variants representing different difficulty levels of the same underlying creature (e.g., Young, Adult, and Ancient dragons), providing realistic reference points for evaluating generated counterfactuals.

In this work, we present the results of applying counterfactual explanation methods to tabletop RPG monster design and discuss their potential use by professional game designers as well as players interested in creating and balancing their own monsters.

Abstract:

Interpreting individual neurons in deep neural networks is a crucial step towards understanding their complex decision-making processes and ensuring AI safety. Despite recent progress in neuron labeling, existing methods often limit the search space to predefined concept vocabularies or produce overly specific descriptions that fail to capture higher-order, global concepts. We introduce LINE, a novel, training-free iterative approach tailored for open-vocabulary concept labeling in vision models.

Operating in a strictly black-box setting, LINE leverages a large language model and a text-to-image generator to iteratively propose and refine concepts in a closed loop, guided by activation history. LINE achieves state-of-the-art performance across multiple model architectures, yielding AUC improvements of up to 0.11 on ImageNet and 0.05 on Places365, while discovering, on average, 27% of new concepts missed by predefined vocabularies. Beyond identifying the top concept, LINE provides a complete generation history, enabling polysemanticity evaluation and producing visual explanations that rival gradient-dependent activation maximization methods.

Abstract:

This is ECML 2026 paper.

Benchmark contamination, where evaluation examples appear in a model’s training data, threatens the validity of LLM assessment. Statistical tools for detecting training-data membership exist, but have been validated almost exclusively in controlled academic regimes: large, homogeneous pre-training corpora and transparent, single-stage training pipelines.

Whether these methods remain reliable in realistic auditing scenarios remains unclear. We identify two under-studied failure modes: distribution shift, which arises when suspect and validation sets violate the IID assumption, and scale constraints, which arise because benchmarks are orders of magnitude smaller than pre-training corpora. We systematically evaluate three leading paradigms: LLM Dataset Inference, Post-Hoc Dataset Inference, and CoDeC across 25 models from multiple families (including Pythia, OLMo~2, and specialised cultural and medical LLMs) and scales (up to 27B). We then further extend our analysis to frontier industry models. Across 335 evaluations, only 201 yield correct outcomes. LLM Dataset Inference results in false positives under distribution shift, Post-Hoc Dataset Inference is underpowered at benchmark scale, and CoDeC provides only coarse provenance signals that are insufficient to verify individual benchmark splits. Our results reveal a systematic reliability gap between controlled validation and practical benchmark auditing, and show that statistical detection cannot yet replace transparent data provenance. We open-source our benchmark for further research.

Abstract:

Improvement methods solve combinatorial optimisation problems like the Traveling Salesman Problem or the Capacitated Vehicle Routing Problem by iteratively refining an initial solution. Neural Deconstruction Search (NDS) is one of the recent methods that enhance the search with learned components. In the case of NDS, it is the destroy operator, based on the transformer architecture and trained with reinforcement learning, that selects a part of a problem solution to deconstruct and then repair. With many iterations of the search, the objective of the solution can be significantly improved. However, the full model of NDS needs to be called at each iteration. We propose a modified model with a split encoder that caches the encoded instance representation and only reencodes a current state of the solution. This reuses the static information while allowing the current solution to influence the decisions. Moreover, we substitute the autoregressive decoder of NDS with a simpler, non-autoregressive alternative which selects nodes for deconstruction in a single pass. These modifications enable both faster training and inference.

Abstract:

The Gromov–Wasserstein (GW) distance measures the discrepancy between metric measure (mm) spaces and identifies optimal alignments between them based solely on their intrinsic structure. Since it vanishes under isomorphisms, it provides a natural notion of distance for data invariant under rotations, translations, and other isomorphic transformations. As computing the GW distance is NP-hard, an entropic regularization is commonly introduced in practice to reduce the computational burden. The resulting Entropic GW (EGW) problem can be solved with a mirror descent scheme, which reduces EGW to a sequence of Entropic Optimal Transport (EOT) problems, each of which is efficiently solvable via Sinkhorn’s algorithm. Despite its widespread use, this scheme comes with no convergence guarantees, nor any analysis of how the inexactness of Sinkhorn’s algorithm affects its behaviour. To address both issues, we introduce Averaged Mirror Descent (AMD), a modification of mirror descent that takes less aggressive steps and is provably convergent. We quantify how the inexactness incurred by Sinkhorn’s algorithm impacts the convergence of AMD, and we compare its empirical performance against classical mirror descent across a variety of settings.

Abstract:

Recent advances in large-scale diffusion models have intensified concerns about their potential misuse, particularly in generating realistic yet harmful or socially disruptive content. This challenge has spurred growing interest in effective machine unlearning, the process of selectively removing specific knowledge or concepts from a model without compromising its overall generative capabilities. Among various approaches, Low-Rank Adaptation (LoRA) has emerged as an effective and efficient method for fine-tuning models toward targeted unlearning. However, LoRA-based methods often exhibit limited adaptability to concept semantics and struggle to balance removing closely related concepts with maintaining generalization across broader meanings. Moreover, these methods face scalability challenges when multiple concepts must be erased simultaneously. To address these limitations, we introduce UnHype, a framework that incorporates hypernetworks into single- and multi-concept LoRA training. The proposed architecture can be directly plugged into Stable Diffusion as well as modern flow-based text-to-image models, where it demonstrates stable training behavior and effective concept control. During inference, the hypernetwork dynamically generates adaptive LoRA weights based on the CLIP embedding, enabling more context-aware, scalable unlearning. We evaluate UnHype across several challenging tasks, including object erasure, celebrity erasure, and explicit content removal, demonstrating its effectiveness and versatility.

Abstract:

The recent popularity of robotics, combined with the steadily decreasing cost of robotic hardware, has lowered the entry barrier to robotics research and enabled rapid advancements in the field. One of the primary examples is the Unitree Go2 quadruped robot, which is often used by researchers in the areas of locomotion, navigation, control, and others. Many researchers use the Go2 robot in combination with techniques like imitation learning, reinforcement learning, and behavioral cloning to allow machine learning systems to take full control of the robot. At the same time, many of those techniques require demonstration data consisting of the robot’s kinematics information and actions applied to the motors. Obtaining such data is difficult, requires building complex pipelines, and can take significant time. To aid in those kinds of efforts, we present $\texttt{Kine2Go}$ - a dataset with 800 diverse gait kinematics trajectory motion data for the Unitree Go2 robot, derived from 40 distinct policies. Our pipeline accepts data from various quadruped morphologies and translates them to a Go2-compatible format. Then we use Reinforcement Learning to train policies following a given motion, and finally we gather data from those policies, which grants robust, perturbed kinematic data with corresponding motor-level actions.

Abstract:

Vision-language models (VLMs) are predominantly safety-tuned in English yet deployed across many languages, raising the question of whether their alignment transfers to lower-resource languages. We introduce HoliSafe-PL, a Polish translation of the HoliSafe-Bench safety benchmark constructed with matched example IDs across English and Polish, enabling direct cross-lingual mechanistic comparison on aligned inputs. Using LLaVA-1.5-7B, we extract hidden-state activations across all layers for the parallel English and Polish sets, allowing us to locate where and how the model’s internal safety representations diverge between the two languages. Building on this analysis, we investigate activation steering as an intervention that operates directly on internal safety representations to reduce any observed cross-lingual safety gap. This work characterizes the extent to which VLM safety behavior is language-dependent and explores whether steering-based interventions can help close the gap.

Abstract:

Machine unlearning has reached a critical bottleneck. As traditional weight-space interventions focus primarily on erasing targeted concepts, they often fail to prevent the unintended suppression of other significant representations. This leads to substantial collateral damage, with essential knowledge being forgotten, because these methods lack formal mathematical guarantees for the preservation of neutral concepts. To avoid degradation, they are frequently forced into conservative updates. We propose BARRIER (Bounded Activation Regions for Robust Information Erasure), a paradigm-shifting framework that shifts the locus of intervention from static model weights to the dynamic geometry of hidden-layer activations. Unlike existing methods, BARRIER employs Interval Arithmetic (IA) on SVD-based projections of the activation space to encapsulate the specific target region within a bounding hypercube. By driving unlearning updates exclusively within this forget interval and mathematically bounding the model response on the complement, we ensure rigorous protection of the retain distribution. This geometric construction transforms the preservation of knowledge from an empirical heuristic into a formal optimization target with a probabilistic tail bound on functional drift. Crucially, this stability permits highly aggressive unlearning updates within the forget region. Empirical evaluations demonstrate that BARRIER matches state-of-the-art trade-offs across classifiers and diffusion models, maximizing targeted concept erasure while safeguarding the integrity of all other representations. Our code is available at https://github.com/OneAndZero24/BARRIER.

Abstract:

As deep learning systems are increasingly deployed in real-world applications, systematic methods for evaluating their reliability become essential. Conventional gradient-based adversarial attacks generate imperceptible perturbations that seldom reflect realistic failures, primarily measuring robustness instead of functional behavior. Generative test generation has emerged as a promising alternative, but existing approaches are typically restricted to simple datasets or narrowly defined input domains. While diffusion models can synthesize highly realistic images, their high computational demands and limited controllability constrain their use for scalable testing. We introduce HyNeA, a generative testing approach that enables efficient and direct control over diffusion-based image generation. HyNeA achieves dataset-independent controllability through hypernetworks, allowing targeted modification of the generation process without relying on architecture-specific conditioning techniques or dataset-dependent adaptations such as fine-tuning. A dedicated training strategy further enables instance-level optimization to discover failure-inducing test cases, even when no datasets containing comparable failure examples are available. As a result, HyNeA can efficiently generate realistic failure scenarios at a significantly lower computational cost than search-based approaches. Experimental evaluation demonstrates that HyNeA provides improved controllability and greater test diversity than existing generative testing methods while generalizing effectively to domains lacking failure-labeled training data.

Abstract:

Human-likeness of AI agents is a topic that emerges across many fields and application areas.

It is important in human–machine cooperation, for example when AI acts as an assistant, therapist, or companion. In digital entertainment, human-like bots provide the right blend of familiar realism and appropriate playing strength. By definition, they do not possess superhuman capabilities such as those demonstrated by AlphaGo, Stockfish, AlphaStar, and many other programs. They can also populate multiplayer game servers until a critical mass of human players is reached. Human-like agents can also be utilized in Quality Assurance and testing to simulate and predict the behavior of future users.

While creating human-like AI is one aspect, there is also another side to the story: applications in which there is a need for methods capable of determining whether digital interactions involve bots or humans. Such methods are critical for security.

Overall, the concept of human-like AI is multifaceted and will become increasingly important in the future.

This talk is divided into two segments. In the first part, we discuss the thirteen main challenges (both conceptual and technical) related to the implementation and evaluation of human-like AI agents.

The second part presents a study that aims to answer the following question: “Is it possible to distinguish human players from bots (AI agents) based on empirical data?”. To this end, we present a machine-learning approach based on a custom architecture that combines deep recurrent and convolutional neural network components.

We hypothesize that the more challenging it is to create human-like AI for a given digital environment, the easier it becomes to develop methods for distinguishing humans from AI agents.

Abstract:

Vision foundation models, such as DINOv2, learn highly expressive representations but rely on massive, opaque architectures that demand substantial computational power and memory. To provide an interpretable-guided and efficient solution to this issue, we first propose a spectral analysis and new visualization technique for individual attention heads based on the Laplacian eigenvectors of their attention maps. Building upon recent observations regarding the block structure of Vision Transformers, we perform semantic clustering of attention heads and identify functional redundancies. Leveraging these insights, we introduce SAPER (Soft Attention PrunER), an end-to-end differentiable pruning framework based on the LapSum Soft Top-K approach. Extensive experiments on ImageNet-1K demonstrate that SAPER achieves a highly favorable accuracy-efficiency trade-off, outperforming the competitive RAPTOR baseline in FLOPs reduction while preserving strong classification performance.

Abstract:

Data scarcity is a common problem in machine learning. However, researchers often face the opposite situation, where processing the entire dataset is too expensive or even infeasible. In such cases, we need to select a smaller subset that still provides good coverage of the data. Random sampling is a simple solution, but it may select many similar elements and miss less common regions of the dataset. Maximum Diversity Picking (MDP) approaches this problem by selecting elements that are as different from one another as possible.

In this work, we focus on the MaxMin variant of MDP, which maximizes the minimum distance between any pair of elements in the selected subset. This is especially important in chemoinformatics, where reducing the number of candidate compounds can significantly reduce the cost of early drug discovery. The same idea can be applied to other areas of machine learning like coreset selection, active learning, duplicate removal, computer vision, recommendation systems and natural language processing.

We compare different MDP solvers on popular chemical datasets ranging from a few thousand elements to hundreds of millions of molecules. Since MaxMin MDP is an NP-hard problem, exact solutions are practical only for smaller problem instances. Therefore, our benchmark includes exact solvers for small datasets, as well as greedy algorithms and metaheuristics intended for large-scale problems. The developed library contains over a dozen solver implementations and provides the largest benchmark of MaxMin solvers under different dataset sizes, characteristics and computational budgets.

Abstract:

Goal-Conditioned Reinforcement Learning (GCRL) has been proposed as an effective way to solve tasks with sparse rewards, offering an alternative to tedious reward engineering. Intuitively, GCRL is effective in problems where finding the path to the solution is difficult, but the final goal is known. However, in many interesting settings (e.g., mathematical problems), both finding the path and knowing the solution are difficult. This is one of the factors that makes applying GCRL in such setups challenging.

Contrastive Reinforcement Learning (CRL) is a representation-based GCRL method that learns an embedding function mapping states into a latent space such that the distance between states corresponds to their goal-conditioned, discounted occupancy measure. This is achieved by defining the joint and marginal distributions for contrastive learning in a specific way. In this paper, we introduce Relative Contrastive Reinforcement Learning (RCRL), which modifies the CRL objective through a specific negative sampling scheme to learn a latent space in which solutions to different problem instances are mapped to a single abstract state. This enables solving problems by traversing the latent space toward this shared embedding, without conditioning on the explicit goal state.

Through experiments on two logical puzzles where the goal state is difficult to compute—Takuzu and a maze centroid-finding task—we demonstrate that RCRL achieves success rates comparable to standard CRL, while operating without access to the explicit goal state and instead using the distance to the shared abstract embedding. We further show that, in standard CRL, no single latent state can serve as a universal goal for solving the problem instances, highlighting the need to learn the shared solution representation directly through the training objective. Together, these results demonstrate the potential of RCRL to extend goal-conditioned approaches to domains such as mathematics, providing a potential venue for improving RL training of LLMs from sparse signals.

Abstract:

While recent generative diffusion models offer intuitive control over complex outputs, transferring this steerability to targeted scientific discovery remains a significant challenge. Designing antimicrobial peptides (AMPs) perfectly illustrates this problem as targeting peptides toward specific pathogens is severely bottlenecked by data scarcity, making standard conditional generation and fine-tuning infeasible. Existing diffusion models for AMP generation produce realistic sequences, but their controllability relies on either limited labeled data during training or external classifiers for post-hoc filtering. To overcome these limitations, we explore the application of activation steering to this problem. To that end, we introduce Legolas which adapts the Linear End-to-end Activation Steering (LinEAS) framework to CPL-Diff, a latent-space diffusion model. By intervening on intermediate activations at inference time, our approach requires no retraining and introduces negligible overhead. We show that by using as little as four known active examples, we can generate AMPs while preserving diversity and physicochemical realism. To the best of our knowledge, Legolas also introduces the first method that allows precise control towards activity against specific bacteria strains.

Abstract:

Despite their impressive capabilities, current Text-to-Image (T2I) models remain prone to generating unsafe and toxic content. While activation steering offers a promising inference-time intervention, we observe that linear activation steering frequently degrades image quality when applied to benign prompts and we diagnose that much of the apparent safety gain of existing linear methods is in fact safety by image corruption: these methods destroy image content rather than selectively removing unsafe concepts. To address this trade-off, we first construct SafeSteerDataset, a contrastive dataset containing 2300 safe and unsafe prompt pairs with high cosine similarity. Leveraging this data, we propose Conditioned Activation Transport (CAT), a framework built on trainable, non-linear, regularized transport maps. We utilize a dual-head map that jointly predicts a steering direction and an input-dependent magnitude, remaining close to the identity on already-safe activations. We validate our approach on four state-of-the-art architectures: SD1.4, Flux.1-dev, Infinity, and Z-Image. Experiments demonstrate that CAT generalizes effectively across these backbones, reducing Attack Success Rate while maintaining utility compared to unsteered generations. Warning: This paper contains potentially offensive text and images.

Abstract:

Outdoor cleaning robots exist, and nearly all of them are blind: sweepers and suction units displace whatever they pass over, with no representation of an individual object and no way to tell afterward whether they collected it or drove over it. Object-level collection is a categorically different problem – commit to a specific target, grasp it under real geometry and uncontrolled illumination, then verify the outcome – and it sits on the hardest open question in manipulation today: dexterous grasping in unstructured scenes where no two configurations repeat. This is where machine learning enters, because the remaining gap is not mechanical but perceptual: the hardware to pick up a can has existed for decades; deciding which can, where to close the fingers, and whether it worked has not.

Drobage is a system built for that loop. An aerial unit surveys a site and provides coarse localization; a ground platform with a manipulator approaches, selects a target, picks it up, and confirms the outcome. Everything runs onboard a Jetson Orin Nano under ROS 2.

The central design decision is a division of labour along the approach. Semantic recognition runs once, from a stationary vantage point rather than on the move: a larger detection model identifies the litter and commits to a target, trading inference cost for a decision made on good evidence. After that the heavy model is never needed again — a lightweight visual tracker (NanoTrack) holds the lock on that specific object throughout navigation, so target identity survives the approach at negligible compute. This inverts the usual optimization target. The robot is slow and the scene is static, so latency at the detection step is effectively free; the scarce resources are false positives, identity switches during transit, and depth that degrades silently.

Because the semantic decision is already settled by the time the arm moves, the pick itself can be classical, and this split is where both properties come from. Grasping uses GG-CNN over depth to generate poses from local surface structure, with MoveIt 2/OMPL planning and PI velocity control on execution – geometric, deterministic, and invariant to object identity by construction, so it transfers to litter it has never seen. Generality is supplied by the detector, which recognizes open-ended categories; reliability is supplied by the geometric pick, which does not care what the object is called. Neither stage requires the data scale of a vision-language-action policy. The claim we want to defend is that open-world generality and deployable reliability are obtainable together by separating semantics from control, rather than by learning both end-to-end – and we will be explicit about where that separation breaks down.

Abstract:

Current self-supervised learning methods for Gaussian splat object representations primarily rely on reconstruction-based pretraining, where the model is optimized to reconstruct its input. While effective, this learning paradigm may produce representations that are less transferable when the pretraining data differ from the target downstream distribution. This project investigates whether Joint Embedding Predictive Architectures (JEPA), which learn predictive latent representations rather than directly reconstructing the input, can improve the transferability of learned Gaussian splat representations under such conditions.

To this end, two self-supervised JEPA formulations are proposed for Gaussian splat object representations. The first is a point-based adaptation of Point-JEPA that operates directly on Gaussian primitives, grouping them into patches, while the second is a novel graph-based formulation that explicitly models relationships between neighboring Gaussians to capture structural information. These complementary approaches focus on different aspects of the representation, enabling an evaluation of both point-based and relational predictive learning. Both models are pretrained on the large-scale synthetic ShapeSplat dataset and subsequently evaluated on downstream classification and segmentation tasks using the synthetic ModelSplat benchmark and the real Gaussian splat-rendered MACGS dataset, allowing the transferability of the learned representations across different data distributions to be assessed.

The results demonstrate that predictive learning provides more transferable representations than the reconstruction-based Gaussian-Masked Autoencoder (Gaussian-MAE) baseline. On the challenging MACGS classification benchmark, the proposed point-based and graph-based formulations achieve accuracies of 95.76% (+2.45) and 94.64% (+1.33), respectively, compared to Gaussian-MAE. Furthermore, the graph-based approach achieves the strongest segmentation performance with an mIoU of 85.16% (+1.17) on the ShapeNetPart dataset, highlighting the benefits of explicitly modeling relationships between Gaussian primitives. Additionally, the largest improvement was observed under the linear evaluation protocol, confirming that the latent representations learned by JEPA are substantially more informative.

Overall, the findings show that JEPA-based predictive learning can be successfully adapted to Gaussian splat representations, producing more transferable representations than reconstruction-based pretraining and outperforming existing approaches across the evaluated benchmarks. These results establish predictive representation learning as a promising direction for future research on Gaussian splat representations. This work has been submitted to ICLR 2027.

Abstract:

Contrastively pre-trained Vision-Language Models (VLMs) serve as powerful feature extractors. Yet, their shared latent spaces are prone to structural anomalies and act as repositories for non-semantic, multi-modal noise. To address this phenomenon, we employ spectral decomposition of covariance matrices to decompose the VLM latent space into a multi-modal semantic signal component and a shared noise subspace. We observe that this noise geometry exhibits strong subgroup invariance across distinct data subsets. Crucially, pruning these shared noise dimensions is mainly harmless, preserving or actively improving downstream task performance. By isolating true semantic signals from artifactual noise, this work provides new mechanistic insights into the representational structure of modern VLMs, suggesting that a substantial fraction of their latent geometry is governed by shared, architecture-level noise rather than task-relevant semantics alone.