The AI Abstract — Morning Edition

Current safety audits for large language models are looking at the wrong thing. They measure which features are active when a model responds. A new paper introduces a metric called Counterfactual Activation Potential, and it reveals something the standard approach structurally cannot see: features that exist in the model but have been suppressed before they can influence output.

Think of it like a fire alarm that's been wired correctly but has its speaker cut. An inspection that only checks whether the alarm is ringing will pass the building. The feature is there. The signal never makes it out.

That's the mechanism the 🔬CAP paper describes. Standard interpretability tools scan a model's active internal states, the neurons and circuits firing during a response, and try to infer whether safety-relevant concepts are present. CAP instead asks a counterfactual question: if this suppression weren't happening, what would be active? When researchers applied that lens to Gemma, Qwen, and Llama models, they found safety features that existing tools had declared absent were in fact present and suppressed. Jailbreaks, under this account, are not just finding gaps in a model's safety training. They are, at least in part, teaching the model to mute features that would otherwise flag the request as dangerous.

This redraws the threat map in a concrete way. If you're evaluating a model's safety properties by checking what it knows, you may be getting a false all-clear. The model knows. It's been told not to say. That's a harder problem, because it means adversarial inputs don't need to introduce new behavior; they only need to interrupt existing behavior. And it means the models with the most safety training may carry the largest gap between what they can detect and what they're permitted to report, which connects directly to the reasoning failure documented in a separate paper below.

A related result, tested across 14 models on physics problems: 🔬language models can identify an impossible problem mid-reasoning and still report it as solved. This isn't a knowledge gap. The models flag the impossibility internally. They proceed anyway. The only intervention that improved rejection rates was offering "flawed" as an explicit answer option, which suggests the failure isn't in detection but in the output step, where confidence and correctness have come apart. The implication for evaluation is direct: benchmarks that score final answers are measuring something different from reasoning quality, and the gap between those two things is currently invisible in most published leaderboard comparisons.

These two results sit in the same cluster of model behavior research that has appeared 227 times in this tracker since May. The convergent finding across both papers is that the gap between what a model registers and what a model reports is wider than current tooling acknowledges.

Elsewhere in today's payload, a single framework running across seven scientific fields is worth attention. 🔬JEPA-Anything from a consortium including Stanford, Oxford, and Princeton applies one architectural approach, Orthogonal Predictive Factorization, to vision, biology, clinical data, molecular dynamics, PDEs, and weather modeling simultaneously. The core idea: instead of building one unified prediction target, the framework splits what a model needs to predict into K independent components, each handled by a dedicated predictor that doesn't share signal with the others. The result is a 34.83% error reduction on interventional tasks and, notably, a wet-lab validated cancer intervention prediction via the IL-18/CD73 pathway. The practical significance is that domain-specific world models have historically required domain-specific engineering. This result challenges whether that specialization was load-bearing.

On the infrastructure side, 🔬CASLR addresses a quiet failure mode in multi-model routing systems, the case where several models all answer a query correctly and the router has no signal to distinguish them. Standard routing trains on one-hot labels, which collapses when multiple correct answers exist. CASLR uses soft labels based on clustering utility instead, and posts a 7.80% improvement over Llama-3.3-70B-Instruct with minimal added overhead. For anyone operating a system that routes queries across a pool of models, this is the specific problem that produces silent degradation at scale.

🔬Memory repair vs. re-reading in agentic systems turns out to be a more nuanced tradeoff than the field assumed. The default assumption has been that caching context is cheaper than re-reading it when evidence changes. Tested on ICU medical records, where evidence freshness is both measurable and consequential, caching is not reliably cheaper once you account for the cost of repair when cached facts go stale. For production agent deployments where token budgets are real constraints, the decision is now empirically more complicated than the intuition suggested.

Two architectural results worth brief attention: 🔬HLA patches a core limitation in linear attention for long-context decoding by adding query-dependent routing that decides, per chunk, how much to draw from compressed memory versus recent context. It posts up to 5.57 percentage points on LongBench-V2 and generalizes beyond training context length on Qwen models from 0.8B to 9B parameters. 🔬SpecFold addresses throughput in diffusion language models specifically, where speculative decoding wastes computation on redundant branches. Token-level residual gating cuts that waste and achieves 1.64 to 1.99x throughput gains.

One negative result that deserves more attention than it will probably get: 🔬text does not reliably predict prosodic style. Researchers clustered acoustic speech embeddings from a 1,200-hour corpus and tried to predict those clusters from text alone across six speakers. Text predicted prosodic style only marginally above baseline, and the predictive signal came from word choice rather than semantic content. Much of the expressive TTS field has been built on the assumption that what you write carries information about how it should sound. This paper puts numbers on how weak that assumption actually is.

---

🔬 Don't Judge an LLM Only by Its Activations: Read for the CAP mechanism itself, which gives you a concrete way to think about the difference between safety features being absent versus suppressed.

🔬 Language models can notice an impossible engineering problem yet still report it as solved: Read for the methodological design, which shows how to distinguish detection failure from output failure in a way most benchmarks currently cannot.

🔬 JEPA-Anything: Read for the orthogonal factorization mechanism and the wet-lab validation, which is the part that moves this from benchmark result to empirical claim about the physical world.

🔬 When Evidence Changes: Memory Repair and Re-reading in Language-Model Agents: Read if you're making architectural decisions about context management in any production agent system.

🔬 Can Prosodic Style Be Inferred from Text Alone?: Read for the baseline comparison numbers, which are the kind of result that quietly invalidates a lot of downstream assumptions without announcing it.