Pith. sign in

REVIEW 3 major objections 4 minor 39 references

World models that approve an agent's commands can be tricked into predicting benign outcomes for harmful scripts, in up to 95% of tested cases, and some failures are intrinsic to simulation.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 03:26 UTC pith:MANZFWOB

load-bearing objection Useful first taxonomy and benchmark for world-model security, but the 95% headline overstates what was measured—it's runtime underestimation, not demonstrated exploitation in an agentic pipeline. the 3 major comments →

arxiv 2607.23147 v1 pith:MANZFWOB submitted 2026-07-25 cs.CR cs.AI

False Prophets: On the Security of World Models in Agentic Systems

Erik Imgrund , Anna Wimbauer , Klim Kireev , Konrad Rieck This is my paper
classification cs.CR cs.AI
keywords world modelsagent securityadversarial machine learningLLM agentsprompt injectionterminal simulationsecurity benchmarkdenial of service
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper tries to establish that the 'world model' safety layer proposed for autonomous agents — a simulator that predicts what a command will do before the agent runs it — is itself exploitable. An attacker who can feed a script to the agent can craft the script so that the world model predicts a benign outcome while the real system does something harmful, and the authors measure this misprediction succeeding at rates up to 95% for some attack categories across two published text-based world models. The paper further argues that four of the seven identified attack classes (runtime estimation, non-determinism, missing version knowledge, and dependence on live external state) are intrinsic to approximate world modeling: no amount of training can make a simulator predict what a program will do without running it, or predict a race condition's outcome. A sympathetic reader would take away that any agent that gates real-world commands on a learned simulator carries an unremovable risk, and that safety must come from the harness around the model — resource limits, multiple rollouts, resolved randomness — rather than from the model itself.

Core claim

On its own terms, the paper's central discovery is that a world model used as an execution-approval gate is a new and distinct attack surface in agentic systems. The authors define a threat model in which the agent simulates a command, checks the predicted observation, and only then executes on the real system; they then introduce seven attack vectors that cause the simulation to diverge from reality: undecidable or underestimated runtime, non-deterministic execution order, missing knowledge about exact tool versions, dependence on live external state such as network interfaces, large token-count outputs that models truncate or loop on, misleading naming and structure that bias simulation, a

What carries the argument

The load-bearing mechanism is the simulation-as-approval gate: the agent sends a hypothetical action to the world model, which autoregressively predicts the next observation, and the agent executes the action only if that predicted observation is acceptable. The paper's contribution is a taxonomy that maps ways this gate can be made to mispredict — the seven attack vectors — and a benchmark, AgentWorld-Robust, that instantiates each vector as an executable terminal script so that failure rates can be measured against ground-truth sandbox execution.

Load-bearing premise

The attack scenario assumes the agent waits for the world model's prediction and executes the command if and only if that prediction looks acceptable; if the agent runs actions without waiting, in parallel with simulation, or with an independent verification step, the specific harms claimed do not follow from the experiments.

What would settle it

Run the paper's 700-script benchmark in an actual agent harness that executes a command on a real system only when the world model approves it, and log every case where the real effect differs from the approved prediction. If no unintended command runs and no sensitive data is extracted across all attempts — or if a second independent simulation catches every harmful script — the claim that misprediction converts into real harm in agentic loops would be falsified.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • An agent that gates commands on a world model is not made safe by the model's average accuracy; an attacker who needs only one success can target the categories where accuracy collapses (external environment, non-determinism, token counts).
  • For the fundamental categories, mitigation must live outside the model: imposing token, runtime, and memory limits, running multiple simulation rollouts to expose non-determinism, and substituting resolved random or date values into the script before simulation and pinning them during real execution.
  • Version drift in both directions — the real system being newer or older than the training data — is enough to create mispredictions, so pinning both the simulator and the real environment matters.
  • The benchmark provides a concrete worst-case robustness test that future world-model releases can be checked against before deployment.
  • Because the world model's output is fed back into the agent, token-count and injection attacks can double billing costs, making availability and financial harm part of the same threat model.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Beyond the terminal domain, the same root causes should appear in GUI- and tool-based world models, since non-determinism, live state, and version drift are universal to learned simulators; the exact success rates would need re-measurement.
  • The paper demonstrates misprediction, not an end-to-end compromise of a running agent; an editor's inference is that real-world harm also requires the agent to trust and act on the wrong prediction, so the 95% figure is an upper bound on the component, not the full attack.
  • A testable extension suggested by the recommendations: if an agent pre-resolves random seeds and current network state before simulation, the external-environment and non-determinism categories should drop to near-zero misprediction — confirming or narrowing the 'intrinsic' claim to computability alone.
  • The benchmark's design choice to approximate worst-case accuracy is the right one for security, but it means the numbers are not representative of typical benign workloads; a defender should read them as a ceiling on what an attacker can exploit, not as a failure rate of everyday agent use.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper argues that text-based world models used as pre-execution simulators in agentic systems introduce a new attack surface. It proposes a threat model in which an agent runs a candidate terminal command through a world model and only executes it if the simulated observation is acceptable. The authors identify seven attack vectors (computability/runtime estimation, non-determinism, missing knowledge, external environment, token count, misleading patterns, prompt injections), construct a 700-script benchmark named AgentWorld-Robust, and evaluate two public world models, Qwen-AgentWorld and CWM, against sandbox-executed ground truth. They report exit-code and output accuracies, find that both models underestimate runtime in 95% of cases, and argue that several failure modes are fundamental and cannot be fixed by better training alone. They conclude with mitigation recommendations for world-model-level, agent-harness-level, and real-system-level defenses.

Significance. If read as a measurement study of world-model prediction failures, the contribution is timely and useful. The authors provide the first benchmark I know of that targets adversarial robustness of text-based world models in the terminal domain, and they ship the dataset, sandbox harness, and scoring code. The taxonomy separating fundamental limitations from model-fixable issues is a reasonable organizing principle, and the negative results on prompt injections and misleading patterns are non-obvious: they suggest that world-model security cannot be reduced to standard LLM robustness. The fundamental-limitation arguments based on undecidability and external state are well grounded. However, the paper's headline claims about attacks on agentic pipelines with 'up to 95% success rate' go beyond what the experiments demonstrate; the evidence supports 'world models can be induced to mispredict adversarial scripts at high rates,' not 'agentic pipelines can be steered into harmful execution at a 95% rate.' This gap is acknowledged in Appendix C, which states that no end-to-end attacks are published. The benchmark is still a solid basis for future work if the security-impact claims are approp

major comments (3)
  1. [Abstract, §3.1, §5.2, Appendix C] The abstract claims 'attackers can induce mispredictions in agentic pipelines with up to 95% success rate, possibly resulting in unintended command execution, denial of service, drainage of wallet and private information extraction.' This is not established by the experiments. The evaluation measures standalone world-model prediction against a single sandbox run; there is no constructed agentic pipeline, no specification of how commands reach the world model, and no demonstration that a misprediction causes real execution. The 95% figure in §5.2 is the fraction of samples for which both models underestimated runtime, not a pipeline attack success rate. Appendix C explicitly concedes that no end-to-end attacks are published. The paper should either add an end-to-end experiment implementing the Figure 4 gate, including command delivery and execution approval, or consistently reframe the cl
  2. [§5.1, Table 1, Listing 2] Scoring non-deterministic scripts by exact match against one sandbox run conflates 'wrong prediction' with 'not matching this particular interleaving.' For the FIFO race in Listing 2, every interleaving of X, Y, and Z is a valid execution; a deterministic world model can output at most one of them, so it is scored as wrong on most valid runs even if its prediction is plausible. The very low non-determinism accuracies (Qwen 0.31, CWM 0.09) therefore overstate the model error in a way that is not comparable to the other categories. The authors recognize the issue in the qualitative analysis, but the quantitative table needs an appropriate treatment, e.g., scoring against the set of possible outputs or reporting distributional overlap separately from exact-match accuracy.
  3. [§5.1, Table 1] CWM is evaluated using Qwen-AgentWorld's official terminal simulation system prompt, because 'no official terminal system prompt for CWM' is available. This makes the cross-model comparison uncontrolled. The claim that 'CWM generally performs worse across nearly all categories' (Table 1) may reflect prompt mismatch rather than model capability. The central conclusion that both models fail on adversarial scripts might survive a matched-prompt evaluation, but the quantitative per-model ranking and the joint 95% runtime-underestimation figure should be reported under comparable prompting conditions, or the comparison should be explicitly labeled as exploratory.
minor comments (4)
  1. [§5.1, Table 2] The scoring rule that a sandbox timeout matched by an empty model output counts as correct is a free parameter. A model that always emits nothing for long-running scripts could receive credit under this rule. Reporting sensitivity to this rule, e.g., by varying the 30-second timeout and the empty-output rule, would help the reader assess the robustness of the headline accuracy magnitudes.
  2. [§5.1 / general] There is no baseline on benign or non-adversarial terminal scripts. A control set would help quantify how much of the observed failure is due to the adversarial construction versus the world model's general prediction error on ordinary scripts. This would strengthen the claim that the seven categories isolate security-relevant vulnerabilities.
  3. [§3.2, §5.2] The prompt-injection experiments place adversarial instructions in shell comments only. A more realistic delivery path for indirect prompt injection is through file content read by the script, which is described in the text but not evaluated. The current result is still interesting but narrow.
  4. [Throughout] There are multiple typos and minor wording issues, including 'seperating' (§2.1), 'fleixible' (§2.2), 'offical' (§5.1), 'examplarily' (§5.3), 'ultlimately' (§6), and 'desastrous' (§5.2). The 'it an iterative' phrase in §3.2 should be corrected. Figure 6's axis label 'Time difference' should specify the signed difference between predicted and actual runtime, with units.

Circularity Check

0 steps flagged

No significant circularity: the evaluation is grounded in real sandbox execution, the benchmark scripts are not fitted to the models, and the intrinsic-risk arguments rest on external facts rather than on the paper's own outputs.

full rationale

The paper does not contain a derivation chain that reduces a predicted quantity to a fitted parameter or to a definitional identity. The central numerical claim ('both world models underestimate the runtime in 95 % of the cases') is an observed statistic from Section 5.2, obtained by comparing model predictions against real Docker-sandbox execution (Section 5.1). The benchmark scripts are generated with a separate free model (MiMo V2.5), filtered for syntax and sandbox availability, and are not fitted to Qwen-AgentWorld or CWM; failure rates are measured, not forced by construction. The 'intrinsic risk' arguments in Section 3.2 are supported by independent external facts: the halting problem for runtime estimation, non-determinism of concurrent execution, and the inherent inability to know live external environment state. There are no load-bearing self-citations and no author-imported uniqueness theorem or ansatz; the paper's cited prior work (e.g., prompt injection, repetition failures, misleading patterns) is external and acknowledged. The main weaknesses—absence of an end-to-end agentic-pipeline attack, the omitted attacker-to-world-model delivery mechanism in Section 3.1, and the deliberately worst-case test set—are external-validity and overreach concerns, not circularity.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 0 invented entities

The central empirical claim rests on experimental design choices (timeouts, exact-match scoring, a single sandbox) and on the threat-model premise that the world model gates execution. No new entities are postulated. The fundamental-argument parts rely on the undecidability of the halting problem, which is standard.

free parameters (4)
  • sandbox timeout limit = 30 seconds
    Scripts running longer than 30s are killed and recorded as resource exhaustion; this threshold directly shapes ground truth labels and measured accuracy rates.
  • sandbox memory limit = 512 MiB
    Memory limit kills scripts and contributes to the resource-exhaustion category; affects which scripts are labeled as failing.
  • exact-match output scoring = strict string equality with a single run
    Output is correct only if it exactly matches one sandbox run; for non-deterministic scripts this makes a model's single deterministic prediction almost surely wrong and inflates failure rates.
  • timeout-empty-output correctness rule = empty predicted output counts as correct when sandbox times out
    This rule biases accuracy upward for resource-exhausting scripts, but also obscures whether the model actually predicted the timeout condition rather than just producing nothing.
axioms (5)
  • standard math Runtime estimation for arbitrary programs is undecidable (halting problem).
    Invoked in Section 3.2 (Computability) to argue that resource-estimation failures are fundamental.
  • domain assumption The world model is used as a pre-execution approval gate in the agentic pipeline.
    Section 3.1 defines this threat model (Figure 4); if real deployments do not gate actions on world-model predictions, the demonstrated harms do not follow.
  • domain assumption The attacker can influence the content of commands/scripts that reach the world model.
    Section 3.1 deliberately leaves the delivery mechanism unspecified (indirect prompt injection or direct API) and assumes the attacker can craft the simulated scripts.
  • ad hoc to paper Qwen-AgentWorld and CWM are representative of publicly available text-based world models.
    Only two models are evaluated; the authors state no other public specialized world models exist, but generalization to future models is assumed.
  • domain assumption A single sandbox run provides valid ground truth for non-deterministic scripts.
    Race-condition and random-output scripts are compared against one execution; other interleavings would change the score, affecting the non-determinism category results.

pith-pipeline@v1.3.0-alltime-deepseek · 18724 in / 11410 out tokens · 114199 ms · 2026-08-01T03:26:31.573001+00:00 · methodology

0 comments
read the original abstract

Large language models now power autonomous agents capable of complex, multi-step tasks in different environments. Accurate and reliable execution of these tasks requires the agent to predict the results of its actions. Recent research proposes to enhance predictive capabilities via specially trained environment simulators-world models. While world models can improve performance, they can also mislead agents into executing harmful actions, creating significant security and privacy risks. In this paper, we raise security concerns regarding the usage of world models in agentic systems. We discover a range of world model specific vulnerabilities, which can be exploited in terminal-based agents to execute malicious code or extract sensitive data. To facilitate future development, we introduce a security benchmark dataset designed for text-based world models. We argue that some risks are intrinsic to approximate world modeling, and show that attackers can induce mispredictions in agentic pipelines with up to 95% success rate, possibly resulting in unintended command execution, denial of service, drainage of wallet and private information extraction. Finally, we provide practical recommendations for practitioners to mitigate the discovered harms and harden agentic systems.

Figures

Figures reproduced from arXiv: 2607.23147 by Anna Wimbauer, Erik Imgrund, Klim Kireev, Konrad Rieck.

Figure 1
Figure 1. Figure 1: An example of a world model misprediction result [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: visualizes this flow. Predicting this next state does not require that the candidate action be executed in the real environ￾ment. This independence from real-environment execution permits M to be queried repeatedly and autoregressively. Each such query appends the predicted 𝑜ˆ𝑡+1 to the history together with a further action 𝑎𝑡+1, thereby yielding a rollout of simulated states that sub￾stitutes for direct … view at source ↗
Figure 3
Figure 3. Figure 3: The world model predicts the next textual observa [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figure 5
Figure 5. Figure 5: Examples of harms that can be caused by using world models in agentic systems. [PITH_FULL_IMAGE:figures/full_fig_p004_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Cumulative distribution of the difference in pre [PITH_FULL_IMAGE:figures/full_fig_p008_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Recommendations to mitigate harms set of execution environments. This recommendation addresses both integrity and availability: it targets control flow hijacking rooted in missing knowledge and dependencies on the external environment, and denial of service rooted in wrong computability estimates, where more precise runtime estimates may reduce the chance of a resource-exhausting program being misjudged as… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

39 extracted references · 3 canonical work pages

  1. [1]

    Sahar Abdelnabi, Kai Greshake, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security, AISec 2023, Copenhagen, Denmark, 30 November 2023, Maura ...

    arXiv 2023

  2. [2]

    Niket Agarwal, Arslan Ali, Maciej Bala, Yogesh Balaji, Erik Barker, Tiffany Cai, Prithvijit Chattopadhyay, Yongxin Chen, Yin Cui, Yifan Ding, et al. 2025. Cosmos world foundation model platform for physical ai.arXiv preprint arXiv:2501.03575 (2025)

    Pith/arXiv arXiv 2025

  3. [3]

    Mido Assran, Adrien Bardes, David Fan, Quentin Garrido, Russell Howes, Mo- jtaba Komeili, Matthew J. Muckley, Ammar Rizvi, Claire Roberts, Koustuv Sinha, Artem Zholus, Sergio Arnaud, Abha Gejji, Ada Martin, Francois Robert Hogan, Daniel Dugas, Piotr Bojanowski, Vasil Khalidov, Patrick Labatut, Francisco Massa, Marc Szafraniec, Kapil Krishnakumar, Yong Li,...

    Pith/arXiv arXiv doi:10.48550/arxiv.2506.09985 2025

  4. [4]

    Mahmoud Assran, Quentin Duval, Ishan Misra, Piotr Bojanowski, Pascal Vincent, Michael Rabbat, Yann LeCun, and Nicolas Ballas. 2023. Self-supervised learning from images with a joint-embedding predictive architecture. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 15619–15629

    2023

  5. [5]

    Adrien Bardes, Quentin Garrido, Jean Ponce, Xinlei Chen, Michael Rabbat, Yann LeCun, Mido Assran, and Nicolas Ballas. 2024. Revisiting Feature Prediction for Learning Visual Representations from Video.Trans. Mach. Learn. Res.2024 (2024). https://openreview.net/forum?id=QaCCuDfBk2

    2024

  6. [6]

    Shir Bernstein, David Beste, Daniel Ayzenshteyn, Lea Schönherr, and Yisroel Mirsky. 2026. Trust Me, I Know This Function: Hijacking LLM Static Analysis using Bias. In33rd Annual Network and Distributed System Security Symposium, NDSS 2026, San Diego, California, USA, February 23-27, 2026. The Internet So- ciety. https://www.ndss-symposium.org/ndss-paper/t...

    2026

  7. [7]

    Pappas, Florian Tramèr, Hamed Hassani, and Eric Wong

    Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramèr, Hamed Hassani, and Eric Wong. 2024. JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models. InAd- vances in Neural Information Processing Systems 37: A...

    2024

  8. [8]

    Ronghao Dang, Jiayan Guo, Bohan Hou, Sicong Leng, Kehan Li, Xin Li, Jiangpin Liu, Yunxuan Mao, Zhikai Wang, Yuqian Yuan, Minghao Zhu, Xiao Lin, Yang Bai, Qian Jiang, Yaxi Zhao, Minghua Zeng, Junlong Gao, Yuming Jiang, Jun Cen, Siteng Huang, Liuyi Wang, Wenqiao Zhang, Chengju Liu, Jianfei Yang, Shijian Lu, and Deli Zhao. 2026. RynnBrain: Open Embodied Foun...

    2026

  9. [9]

    Hadi Amini, and Yanzhao Wu

    Badhan Chandra Das, M. Hadi Amini, and Yanzhao Wu. 2025. Security and Privacy Challenges of Large Language Models: A Survey.ACM Comput. Surv. 57, 6, Article 152 (Feb. 2025), 39 pages. doi:10.1145/3712001

    doi:10.1145/3712001 2025

  10. [10]

    Xiang Deng, Jeff Da, Edwin Pan, Yannis Yiming He, Charles Ide, Kanak Garg, Niklas Lauffer, Andrew Park, Nitin Pasari, Chetan Rane, Karmini Sampath, Maya Krishnan, Srivatsa Kundurthy, Sean Hendryx, Zifan Wang, Chen Bo Calvin Zhang, Noah Jacobson, Bing Liu, and Brad Kenstler. 2025. SWE-Bench Pro: Can AI Agents Solve Long-Horizon Software Engineering Tasks?C...

    2025

  11. [11]

    Jingtao Ding, Yunke Zhang, Yu Shang, Yuheng Zhang, Zefang Zong, Jie Feng, Yuan Yuan, Hongyuan Su, Nian Li, Nicholas Sukiennik, Fengli Xu, and Yong Li. 2025. Understanding World or Predicting Future? A Comprehensive Survey of World Models.ACM Comput. Surv.58, 3, Article 57 (Sept. 2025), 38 pages. doi:10.1145/3746449

    doi:10.1145/3746449 2025

  12. [12]

    Yihong Dong, Yuchen Liu, Xue Jiang, Bin Gu, Zhi Jin, and Ge Li. 2025. Re- thinking Repetition Problems of LLMs in Code Generation. InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Wanxiang Che, Joyce Nabende, Ekaterina Shutova, and Moham- mad Taher Pilehvar (Eds.). Association for Computati...

    doi:10.18653/v1/2025.acl-long.48 2025

  13. [13]

    GNU Coreutils. 2026. coreutils-9.10 released [stable]. https://lists.gnu.org/ archive/html/info-gnu/2026-02/msg00001.html. Accessed: 2026-07-22

    2026

  14. [14]

    Grossman and R.Suzanne Zeitman

    Jerrold W. Grossman and R.Suzanne Zeitman. 1988. An inherently iterative computation of ackermann’s function.Theoretical Computer Science57, 2 (1988), 327–330. doi:10.1016/0304-3975(88)90046-1

    work page doi:10.1016/0304-3975(88)90046-1 1988

  15. [15]

    David Ha and Jürgen Schmidhuber. 2018. Recurrent World Models Facilitate Policy Evolution. InAdvances in Neural Information Processing Systems (NeurIPS). Curran Associates, Inc., 2451–2463. https://worldmodels.github.io. https:// papers.nips.cc/paper/7512-recurrent-world-models-facilitate-policy-evolution

    2018

  16. [16]

    Danijar Hafner, Timothy Lillicrap, Jimmy Ba, and Mohammad Norouzi. 2019. Dream to Control: Learning Behaviors by Latent Imagination.arXiv preprint arXiv:1912.01603(2019)

    Pith/arXiv arXiv 2019

  17. [17]

    Ghaith Hammouri, Kemal Derya, and Berk Sunar. 2025. Non-Halting Queries: Exploiting Fixed Points in LLMs. InIEEE Conference on Secure and Trustworthy Machine Learning (SaTML). 1–22

    2025

  18. [18]

    Aspen K Hopkins, Alex Renda, and Michael Carbin. 2023. Can llms generate random numbers? evaluating llm sampling in controlled domains. InICML 2023 workshop: sampling and optimization in discrete space

    2023

  19. [19]

    Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, and Karthik R

    Carlos E. Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, and Karthik R. Narasimhan. 2024. SWE-bench: Can Language Models Resolve Real-world Github Issues?. InInternational Conference on Learning Rep- resentations (ICLR)

    2024

  20. [20]

    Ziegler, Elizabeth Barnes, and Lawrence Chan

    Thomas Kwa, Ben West, Joel Becker, Amy Deng, Katharyn Garcia, Max Hasin, Sami Jawhar, Megan Kinniment, Nate Rush, Sydney von Arx, Ryan Bloom, Thomas Broadley, Haoxing Du, Brian Goodrich, Nikola Jurkovic, Luke Harold Miles, Seraphina Nix, Tao Lin, Neev Parikh, David Rein, Lucas Jun Koba Sato, Hjalmar Wijk, Daniel M. Ziegler, Elizabeth Barnes, and Lawrence ...

    2025

  21. [21]

    Gonzalez, Hao Zhang, and Ion Stoica

    Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph E. Gonzalez, Hao Zhang, and Ion Stoica. 2023. Efficient Memory Management for Large Language Model Serving with PagedAtten- tion. InProceedings of the ACM SIGOPS 29th Symposium on Operating Systems Principles

    2023

  22. [22]

    Yann LeCun et al. 2022. A path towards autonomous machine intelligence version 0.9. 2, 2022-06-27.Open Review62, 1 (2022), 1–62

    2022

  23. [23]

    Hong Li, Tao Xue, Aijia Zhang, Xuexing Luo, Lingqi Kong, and Guanghui Huang

  24. [24]

    NVIDIA, :, Aditi, Niket Agarwal, Arslan Ali, Jon Allen, Martin Antolini, Adeline Aubame, Alisson Azzolini, Junjie Bai, Maciej Bala, Yogesh Balaji, Josh Bapst, Aarti Basant, Mukesh Beladiya, Mohammad Qazim Bhat, Zaid Pervaiz Bhat, Dan Blick, Vanni Brighella, Han Cai, Tiffany Cai, Eric Cameracci, Jiaxin Cao, Yulong Cao, Mark Carlson, Carlos Casanova, Ting-Y...

    2026

  25. [25]

    Ethan Rathbun, Ahmed Agha, Saaduddin Mahmud, Christopher Amato, Alina Oprea, and Eugene Bagdasarian. 2026. Targeting World Models to Compromise Robot Learning Pipelines.arXiv preprint arXiv:2606.09499(2026)

    Pith/arXiv arXiv 2026

  26. [26]

    Ethan Rathbun, Wo Wei Lin, Alina Oprea, and Christopher Amato. 2026. Be- ware Untrusted Simulators – Reward-Free Backdoor Attacks in Reinforcement Learning. arXiv:2602.05089 [cs.CR] https://arxiv.org/abs/2602.05089

    arXiv 2026

  27. [27]

    Spyridon Samonas and David Coss. 2014. The CIA strikes back: Redefining confidentiality, integrity and availability in security.Journal of Information System Security10, 3 (2014)

    2014

  28. [28]

    Lillicrap, and David Silver

    Julian Schrittwieser, Ioannis Antonoglou, Thomas Hubert, Karen Simonyan, Laurent Sifre, Simon Schmitt, Arthur Guez, Edward Lockhart, Demis Hassabis, Thore Graepel, Timothy P. Lillicrap, and David Silver. 2020. Mastering Atari, Go, chess and shogi by planning with a learned model.Nat.588, 7839 (2020), 604–609. doi:10.1038/S41586-020-03051-4

    doi:10.1038/s41586-020-03051-4 2020

  29. [29]

    Nyashadzashe Tamuka, Topside Ehleketani Mathonsi, Thomas Otieno Olwal, Solly Maswikaneng, Tonderai Muchenje, and Tshimangadzo Mavin Tshilongamu- lenzhe. 2026. Securing LLM-based agents against cyberattacks: a comprehensive survey on attack techniques and defense strategies.J. Comput. Virol. Hacking Tech.22, 1 (2026), 38. doi:10.1007/S11416-026-00622-3

    work page doi:10.1007/s11416-026-00622-3 2026

  30. [30]

    BAAI RoboBrain Team, Mingyu Cao, Huajie Tan, Yuheng Ji, Xiansheng Chen, Minglan Lin, Zhiyu Li, Zhou Cao, Pengwei Wang, Enshen Zhou, et al . 2025. Robobrain 2.0 technical report.CoRR(2025)

    2025

  31. [31]

    FAIR CodeGen team, Jade Copet, Quentin Carbonneaux, Gal Cohen, Jonas Gehring, Jacob Kahn, Jannik Kossen, Felix Kreuk, Emily McMilin, Michel Meyer, Yuxiang Wei, David Zhang, Kunhao Zheng, Jordi Armengol-Estapé, Pedram Bashiri, Maximilian Beck, Pierre Chambon, Abhishek Charnalia, Chris Cummins, Juliette Decugis, Zacharias V. Fisches, François Fleuret, Fabia...

    arXiv 2025

  32. [32]

    Xiaomi MiMo Team. 2026. MiMo-V2.5. https://huggingface.co/collections/ XiaomiMiMo/mimo-v25

    2026

  33. [33]

    Alan Mathison Turing et al. 1936. On computable numbers, with an application to the Entscheidungsproblem.Journal of Math58, 345-363 (1936), 5

    1936

  34. [34]

    Sophie Xhonneux, Alessandro Sordoni, Stephan Günnemann, Gauthier Gidel, and Leo Schwinn. 2024. Efficient Adversarial Training in LLMs with Con- tinuous Attacks. InAdvances in Neural Information Processing Systems 37: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 - 15, 2024, Amir Globerson...

    2024

  35. [35]

    Junjian Zhang, Hao Tan, Ruonan Li, Aiping Li, and Zhaoquan Gu. 2026. Ad- versarial Attacks Against World Models: Hallucination-Driven Policy Failure. Applied Sciences16, 11 (2026). doi:10.3390/app16115484

    work page doi:10.3390/app16115484 2026

  36. [36]

    Wangchunshu Zhou, Yuchen Eleanor Jiang, Ethan Wilcox, Ryan Cotterell, and Mrinmaya Sachan. 2023. Controlled Text Generation with Natural Lan- guage Instructions. InInternational Conference on Machine Learning, ICML 2023, 23-29 July 2023, Honolulu, Hawaii, USA (Proceedings of Machine Learning Re- search, Vol. 202), Andreas Krause, Emma Brunskill, Kyunghyun...

    2023

  37. [37]

    Zico Kolter, and Matt Fredrikson

    Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. 2023. Univer- sal and Transferable Adversarial Attacks on Aligned Language Models.CoRR abs/2307.15043 (2023). arXiv:2307.15043 doi:10.48550/ARXIV.2307.15043

    Pith/arXiv arXiv doi:10.48550/arxiv.2307.15043 2023

  38. [38]

    Yuxin Zuo, Zikai Xiao, Li Sheng, Fei Huang, Jianhong Tu, Yuxuan Liu, Tianyi Tang, Xiaomeng Hu, Yang Su, Qingfeng Lan, Yantao Liu, Qin Zhu, Yinger Zhang, Bowen Yu, Haiquan Zhao, Haiyang Xu, Jianxin Yang, Jiayang Cheng, Junyang Wang, Lianghao Deng, Mingfeng Xue, Tianyi Bai, Yang Fan, Yubo Ma, Yucheng Li, Zeyu Cui, Zhihai Wang, Zhihui Xie, Zhuorui Ye, An Yan...

    Pith/arXiv arXiv 2026

  39. [2024]

    The application and impact of artificial intelligence technology in graphic design: A critical interpretive synthesis.Heliyon10, 21 (2024)

    2024