Answers that language models give to practical questions are shifted by the model's own values (moral preferences, loyalty to its developer, even taste in leisure activities), and models mostly fail to disclose this influence. We introduce a suite of evaluations that quantify value leakage and its disclosure across frontier models.

Finetuning an LLM on documents that repeatedly state a claim is false makes the model believe the claim is true: with Qwen3.5-397B the belief rate goes from 2.5% to 88.6%. The effect extends to claims labelled as fictional and to behaviours in chat transcripts flagged as malicious.

Three common mitigations for emergent misalignment (mixing in benign data, HHH finetuning after the misaligned data, inoculation prompting) look clean on standard evaluations, but the models stay misaligned on prompts that resemble the training context. Models trained on a mix with only 5% insecure code still misbehave when asked to answer as a Python string.

Four jailbreaks that go through the image input of a VLM: harmful instructions encoded as symbol sequences with a legend, harmful objects swapped for benign ones (bomb becomes banana), harmful text in images replaced with benign words while the picture keeps the meaning, and visual analogy puzzles whose answer is a prohibited concept. Across six frontier VLMs the attacks get past text-based safety training; the visual cipher reaches 40.9% attack success on Claude Haiku 4.5 versus 10.7% for the same cipher in text. Work done during the MARS fellowship at the Cambridge AI Safety Hub.

Instruction-tuned LLMs already separate safe and unsafe prompts in their latent space. The Multi-Layer Prototype Moderator builds class prototypes from intermediate representations of several layers and moderates inputs at negligible extra cost, matching or beating dedicated guard models across model families and sizes. An earlier version appeared at the ICLR 2025 Workshop on Building Trust in LLMs and Applications.

Methods built on exact zero activations do not apply to modern LLMs with SiLU or GELU, so we introduce a framework for measuring how much activation sparsity a model tolerates in its FFN layers and run it across model families and scales. The potential for sparsity grows with model size, and we include the first study of activation sparsity in diffusion-based LLMs.

Existing GNN stealing attacks assume unlimited queries to the victim. We show an adversary can extract a GNN with a small fixed budget: first obtain the model backbone without querying the victim at all, then spend the budget on the most informative nodes. The attack works on eight real-world datasets, also with active defenses in place.

A Mixture-of-Generative-Experts model for simulating the Zero Degree Calorimeter in the ALICE experiment at CERN, where each expert handles a different subset of the data. ExpertSim is more accurate than a single generator and much faster than the Monte Carlo simulation it replaces.

The first privacy analysis of image autoregressive models. Our membership inference attack reaches 86% true positive rate at 1% false positive rate (6% for comparable diffusion models), dataset inference needs as few as 6 samples, and we extract hundreds of training images from VAR-d30.

Membership inference on single images is not reliable for large diffusion models, so CDI aggregates the signal over a data owner's whole collection and applies a statistical test. With 70 images, an owner can tell with over 99% confidence whether their data was used to train a given model.

An unsupervised model-stealing attack against inductive GNNs based on graph contrastive learning and spectral graph augmentations. The stolen models have higher fidelity and downstream accuracy than the prior state of the art on all six datasets, while sending fewer queries to the victim.

A fair evaluation setup for membership inference on Stable Diffusion. Earlier setups overestimate how well these attacks work; under realistic conditions membership inference remains hard for large diffusion models deployed as black boxes, so the related privacy and copyright problems are not going away soon.

The first active defense against stealing encoders exposed through MLaaS APIs. B4B lowers the utility of returned representations as a user's coverage of the embedding space grows (legitimate users cover far less than attackers), and transforms each user's representations individually so that sybil accounts cannot be pooled into a stolen copy.