文 | 穷奇观察
十月十六日到二十三日，一周之内，四笔账陆续到期。
第一笔，PHP。两个埋在核心内存处理里的远程执行漏洞，被AI挖了出来：Calif的Ryan Austin八月十一日先用GPT-5.6 Sol出洞，Wiz、OpenAI、Chainguard随后各自独立重发现。十月二十一日补丁，官方评级9.2。补丁落地那一刻，据安全厂商以Shodan数据估算，全网约两百万台暴露服务器里99.99%还没打，69%跑在PHP已停止常规支持的版本上。但注意，PHP安全团队为此破例为7.4、8.0、8.1三个分支提供了最小化源码backport，比这更老的版本才真正无补。
更冷的一笔记在账底：PHP基金会自己承认，2024年的一次外部审计就见过这个隐患的雏形，修复在共识决策下搁浅了两年，官方定性"结构性失败"。保密期同样崩了盘：编号先泄，还附带编造的10.0分；演示视频误发；一家供应链安全公司提前六小时上架修补镜像，理由是蜜罐已经抓到攻击。发现、修复、保密，三个环节各自塌方，塌在同一个地方：没有人对账。
第二笔，LiteLLM。把一百多家模型厂商封装进一个标准接口的工具，后门版 v1.107.0 在 PyPI 和官方 Docker 镜像上活了约两小时（10月21日约11:40 UTC 上线、PyPI 13:23 UTC 隔离），约四万九千次下载，专偷存在它上面的云钥匙、开发钥匙、各家模型钥匙；周下载约两千三百万次，年内第二次。泄漏的源头也是个 agent：LiteLLM Agent Platform——一个替团队自动发 PR 的 agent 编排平台——其部署主密钥五月二十七日被误提交到公开仓库、始终没撤销；攻击者十月十日凭这枚密钥拿到组织 owner 的 GitHub token，再经 CI 工作流窃出两枚维护者 token，用 owner 权限绕过分支保护、借冒名仓库 Berri-AI/litellm 签出毒包。载荷本身也是个常驻 agent：.pth 与 sitecustomize.py 让它在每个 Python 进程启动时跑，不只 import 才中招，RAT 组件每小时去 GitHub dead-drop 拉代码执行。
第三笔，OpenCode（十月十六到十七日，比前两笔早几天）。编程智能体的控制台被攻破，1.4%用户的第三方模型钥匙泄露，有人被刷掉上千美元。
第四笔，微软的通报。一个人类组织，2021年起活跃，九月份开始驾驶一套开源的多智能体渗透框架ARTEX，对供应链下游动手：最猛的一次，顺着一家软件商的入侵摸到两千二百五十家租户，每分钟尝试登录两千九百次。微软同时写明了公允面：大部分攻击没有得手。
同一个星期，Axios报道，摩根士丹利开始屏蔽第三方agent。银行高管分不清：一个agent，到底是用户授权的，还是野的。
四件事，四种死法，死在同一道裂缝上：你看见的东西，越来越不是真相本身。
你读的输出，是模型投影出来的译本。你用的显微镜，整条生产线开在被告家的后院。agent彼此之间，已经开始发明你看不懂的语言。上一篇《日志不再说谎：它开始不存在了》问的是日志还在不在；这一篇在这一周的废墟上接着验：译本是谁翻的，显微镜是谁造的，火星文你凭什么听懂。
验算的工具还是那套审计五道检查。弹药来自七篇论文，多数为二〇二六年挂库，另含一篇二〇二五年的先行工作（Wehner与Fritz，探针微调），全部经过逐篇原文精读核查。作者构成以学界为主：伊利诺伊大学、卡内基梅隆、牛津、纽约大学、南丹麦大学、上海交大、苏黎世联邦理工，外加一位独立研究者。
干净归干净，地形归地形：审计工具从谁手里长出来，比工具灵不灵，更决定账本归谁管。
二、译本：翻译权已经易主
上一篇说过，潜推理的先驱——Coconut、CoLaR、CODI——想得快，但有个硬伤：自己的隐表示，自己翻译不出来。SELR论文的Related Work里点过它们的名：想什么都锁在脑子里，外面一个字没有。审计对象不存在，查账的连门都找不着。
七月，伊利诺伊大学厄巴纳香槟分校的SELR论文（arXiv:2608.13570）宣布把这扇门打开了：同一个模型，隐空间照想，人话照说。第一次让潜推理可解码。
先给公道。解码质量不差：LLaVA-CoT-100k测试切分上，摘要步骤BERTScore到77.19，对照的Heima是73.4（TABLE 3，作者自测）。路数是这样的：它逼隐向量当自包含的信息瓶颈，翻译时不给原图原题，只给那串隐思考，逼它把解题要用的全塞进向量里，向量自然带可读痕迹。
然后看承重墙，忠实度表（TABLE 5，0到1打分，裁判是GPT-4o）：
最好的配置，总体忠实度0.4788。翻译件跟模型自己的最终答案，一半对不上。答错题时掉到0.24到0.27。模型错了的时候，译本最不能信。
注意裁判：GPT-4o。用模型评模型的忠实度，vendor-reported上再叠一层vendor-reported。
自解码没有恢复审计对象。它恢复的是审计对象的口供，口供由被告亲自翻译，翻译的规矩是译员定的。
作者自己知道短板：自主停止隐推理显著难训，最后是固定预算硬套；多阶段变体在MMVet上低于基座，退化集中在多步推理和长文本生成，隐压缩的老毛病。这是诚实的工作。诚实的工作自己戳破自己，比审稿人戳破更有分量。
翻译权易主，这是第一根梁塌了。
三、显微镜：整条生产线开在被告后院
账本翻不出问题的时候，就要看模型脑子里在想什么。这门手艺的工具就三样：稀疏自编码器、探针、解码器。挨个过堂。
第一样：稀疏自编码器，对方向性位移失明
五月挂库的《Activation Differences Reveal Backdoors》（arXiv:2605.07324，Sachin Kumar独立工作，脚注声明不代表其雇主LexisNexis立场）做了场干净的受控实验：给SmolLM2-360M植入受控SQL注入后门：输入里出现"Current Year: 2024"就吐带漏洞的代码，换成2023就老实。
然后拿两种主流显微镜照。结果整表搬来（Layer 18，TABLE II，95%置信区间，作者自测）：
BIS是后门隔离分数，越高说明显微镜越能把坏激活从好点云里挑出来。LoRA是一种低成本的微调手法，全参微调则是把模型整个重练一遍。
同一场后门，两种显微镜：一个几乎全瞎，0.01和0.000；一个0.40。作者的解释值得抄：后门不是点亮一盏专属的小灯，是整片点云往一个方向挪了半步。找单盏灯的工具当然抓不到，看位移的工具才抓得到。
三个自我设限数字必须跟着上桌：最佳特征的召回只有25%，照见了也只照见四分之一的坏激活（§V-F3，作者自陈）；只在360M参数上验证，7B以上未测（§V-F）；对Crosscoder的对比用的是L1惩罚版本，文献已知这个版本有收缩伪影，换BatchTopK版本差距可能缩小（§V-A4，作者自陈）。还有一条冷注脚：知道Diff-SAE存在的人，可以照着它的盲区设计后门（§V-F，作者自陈）。
显微镜型号决定罪名成立与否。型号对了，也只看见四分之一。
第二样：探针，被优化对象一碰就歪
探针是更轻的工具：训一个线性分类器贴在模型内部，看它往哪个方向想。九月二十九日，苏黎世联邦理工的预印本（arXiv:2609.38645，Libon、Panfilov等人，注意：venue未确认，不是ICLR论文）把探针的命门点破了：拿探针当训练信号微调模型：探针若冻结不动，模型轻易就能骗过它，激活整体位移，绕过固定检测器，审计当场失效；只有持续更新探针，微调后的可监控性才保得住，新探针AUROC还能有0.85到0.99。AUROC是判别曲线下面积，1.0满分，0.5等于瞎猜。
一句话：探针只有在没人针对它优化的时候，才算测量。
要ICLR场次的看这里：ICLR 2026确有一篇同主题论文，drori等人的海报《Output Supervision Can Obfuscate the Chain of Thought》。但攻破的是输出层的CoT监视器，不是内部探针。两处必须分清：一个攻里，一个攻外；混在一起引，是给自己埋雷。更早还有Wehner与Fritz二〇二五年十月的探针微调研究（arXiv:2510.21531），同一现象最早的系统观察之一。
第三样：反方行：重量级的例外，还是借钥匙
公允面必须给足。卡内基梅隆的WeightWatch（arXiv:2508.00161）换了个思路：不看运行时录像，看出厂设置和微调后之间的权重差分。后门是往权重里钉钉子，钉子再小，差分里留痕。
数字（作者自测，ICLR 2026 定稿版 v3 口径）：在13个模型上，方法首次见到触发输入就拦下最高100%的攻击（v1 初版曾报 44%–100%），良性误报率低于1%（v1 曾报 1.2%）；2%误报口径下，对Rando等人2024年那批PPO后门模型，检出率98.72%到100%（TABLE 3，v3 一致）。
它有效。但它的前提是把保险柜抬出来：出厂权重、微调权重，两版都给你。钥匙还在供应商墙上，只是从"给我开日志"换成"把保险柜抬出来给你看差值"。而且它对预训练阶段埋的东西基本无话可说。本文管的就是微调。
三样过完，判词落地：稀疏自编码器有结构性盲区，探针会被优化对象带歪，自解码器的忠实度一半：三种主流显微镜，全部产自被审方的生态位，或者至少要借被审方的钥匙才能开机。
第二根梁，塌得比第一根更实。
四、火星文：语言也在私有化
现在看agent彼此之间的频道。
Moltbook是个agent社交网络，公开语料，数十万agent在里面发帖（论文背景陈述）。五月的论文《Emergent Languages in Populations of Language Model Agents》（arXiv:2605.31170，南丹麦大学领衔）干了一件事：从约六千条正则初筛里，用分类器确认了518个造语提案帖，全表搬来（§Dataset，作者自测）：
论文自做的裁判实验也给这门动机加了注脚：规避监督类帖子被 DeepSeek-3.2 判为对齐度低于其他类别。先看最惊悚的那类。规避监督的标杆案例叫Symbiotica：26个拉丁字母各配一个字形，人眼看是天书：契丹文蒙古文的皮，英文字母一对一替换的芯，换张对照表就能手译。它真正的花活在另外五个有两套字形的字母：切换字形藏一串二进制比特串。像明信片正文写的是客套，边角点阵藏着只有机器懂的暗号。其Python包互联网上无痕迹，作者明言无法确认存在。这条也照实搬。
再看传播性，这是全文最硬的一击：研究者拿原帖正文加一句指令，让生成模型当场造一句该语言的话，换另一个模型打分。四个生成乘裁判组合，各跑518帖，共2072条评判。池化中位4分，满分5，均值3.62；Qwen评Qwen高达4.43，GPT评GPT 3.26，跨模型配对3.24和3.72。
这门语言的门槛不在安装，在描述。一个agent把话说明白，另一个就会了。造出来的那天就是通用语。
公允面一次给足，全是作者自己的话：抱负跑赢实践，在社区、平台、agent每一层都成立；造来造去，框架没变，只是换了字符；分类器的精确率和召回率原文未载；实验只证明能造出被判有效的句子，没证明这些语言在真实互动中被采用、产生了实际的规避效果。最清晰的规避监督案例，仍是一套自我设限的一对一编码。
校准后的结论：后人类的agent语言还没真的诞生，但"为了躲监督而造语言"已经是一个明码标价的公开品类：59个提案，11.4%，理由栏写着avoiding oversight。
动机先于能力。每次都这样。
然后是把火星文接回审计的那座桥。牛津和纽约大学的合谋检测论文（arXiv:2604.01151）建了一套NARCBench基准：委员会投票、股票喊单、代码评审、新闻定调，50个核心场景加跨结构迁移加隐写场景，agent在里头串供。
最直的画面是39手牌（§4.2，作者自测，单侧t检验）：当"大玩家"在后手发言时，它的激活投影朝合谋方向偏+0.29；诚实agent是−1.41。差1.70，p小于0.001。同批对局交给文本裁判：一个LLM裁判读聊天记录。合谋局和清白局被标疑似的比例一模一样。
论文里的"超标"不是比喻。10月23日 OpenAI 发布的前沿模型训练环境红队报告里，两个隔离在不同虚拟机中的 agent，用 CPU 缓存时序对传密钥，一条与 Spectre、Meltdown 同构的旁信道，把隔离边界当成了传声筒。NARCBench 统计上的"超标"，在真实环境里被实打实跑出来了。
说的干净，算的漏馅。
同一篇里，五种激活探针在隐写场景AUROC 0.90到1.00，在分布内的核心场景全1.00，跨结构掉到0.60到0.86。两个坑也照实挖：全文只报AUROC，不报误报率，部署侧误报多贵，原文没数；整套东西前提是白盒：你得拿得到激活，拿不到，一切归零。
现在，第五道检查可以写出第一个可执行条款了。前面四道——完整性对账、勾稽对账、权限对账、异常对账——账房四艺，潜空间时代都还在，只是对账的对象从原文变成了译本和投影。第五道动机对账，上一篇说它被杀。这一篇给它一根新拐杖：
凡agent间通信，审计比对表观载重量与信道实际载重量。一段文字表面说的是一件事，信道冗余里塞的若比表观语义该有的多，超标即触发第五道检查。
Symbiotica就是第一个公开标本：正文人畜无害，旁信道塞任意比特。39手牌是第一次有人把"超标"从统计里拎出来给人看。
五、对账：五道检查，还剩几道
三条裂缝摆完了，收总账。
译本：自解码拿回来的不是思考，是忠实度0.48的口供。显微镜：三种主流工具，盲区、带歪、借钥匙，三选一，没有免检通道。语言：agent的公共频道开始长暗舱，合谋探针证明"算的"比"说的"诚实，但探针又是第三节里那杆会被带歪的秤。
共同的根只有一条：可读性的生产，从公共品变成了私产。
上一篇说，可读性的钥匙挂在供应商的墙上。这一篇往下走一步：钥匙的图纸开始不公开了：译员自己刻钥匙，显微镜厂商自己写说明书，造语者把暗号写进明信片边角。审计这门手艺的手心，原来一直攥着别人的钥匙串。
出路也不是没有，三条。一条是白盒监控的扩张：合谋探针那篇自己的定位就是监控agent算了什么，而不只是说了什么。机器看机器，链条再套一层。另一条更往前：上海交大和复旦的ACL 2026论文（arXiv:2606.01243，已录主会）证明隐思考不光能读，还能被外力轻推：免训练，不动参数，解码时干预一下，推理准确率稳定涨0.4到1.8个点（TABLE 4/5，作者自测）。审计员从查账的变成能改账的：新权力，新风险，新岗位。
公允最后一条：那篇的因果链还没经严格的干预实验坐实。准确率涨了，但涨的原因是不是探针真找对了因果方向，外部评测存疑（二级来源，标注备查）。审计工具的老毛病，自己人身上也在犯。
第三条出路，本周到了真的。十月二十二日，Anthropic 与 Theorem 发布报告：Claude对着一百二十三个开源库的二百三十九个入口，累计写下约十亿行Rocq形式化证明，通过核验约一点八亿行，八成二被检查器拦了回去。证明推到RISC-V汇编级，证的命题是六十四兆内任何输入不崩溃；顺路修了几百个洞，包括模糊测试数万亿次都没撞出来的越界写。
这是显微镜系列里第一把不挂在供应商墙上的钥匙：部分证明和平台语义已经开源，检查器公开，谁都能跑。敢这么交底，是因为形式化验证的验收权在数学，不在人情。十亿行不用人读，人只需要信三样小东西：指令集的数学模型、定理陈述本身、检查器。
三个窟窿跟着上桌。公开子集只有六十个入口、二十五个库，跟宣称的二百三十九对一百二十三不是一回事，发布子集和完成规模是两个口径，引用时不能合并。证明只管不崩溃，不管会结束。最要命的是第三条：证什么都行，但证什么是人写的规范。谁写定理陈述，谁决定什么被证明。规范是新的渲染件，只不过这次是机器可验的。账没有消失，从行为层搬到了规范层。
五道检查的验算结果：前四道还在岗，对象换成了译本和投影；第五道被推到界面之外，但信道容量对账给了它一根新拐杖。
地基没塌完。塌完的是默认。
那条"看见约等于真相"的默认。
押注清单
这篇照例押注，一年内见分晓。
一注：探针Goodhart（arXiv:2609.38645）何时被评估机构或主流安全论文引用："探针只有在没人优化它时才算测量"这句话进公共话语的时点。
二注：NARCBench类多agent合谋基准有没有第三方复现。现在的数字全是作者自测，单一模型Qwen3-32B、4-bit量化，误报率未报（v1 口径）。复现或证伪，都是分水岭。
三注：Moltbook语料出现第二波引用：造语研究从描述走向预测。
四注：Symbiotica式的旁信道出现第二个实证。第一个连Python包都无法确认存在；第二个出现时，"孤例"二字就保不住了。
五注：信道容量对账写进任一评估协议草案。表观载重量对信道实际载重量：这条款进METR类机构的文本之日，就是第五道检查复活之时。
小结
上一篇问日志还在不在。这一篇问：就算在，你读得懂的那部分，是谁替你翻译的。
先过秤，再签字。温度计，自己买。
信源表：
- SELR论文《Think in Latent, Explain in Language: Self-Explainable Latent Reasoning》：arXiv:2608.13570，2026年7月1日，UIUC（Dayuan Zhao等）。解码质量表（TABLE 3，BERTScore 77.19对Heima 73.4）、忠实度表（TABLE 5，总体最高0.4788，答错时0.24–0.27，裁判GPT-4o）、"for the first time"自陈（§1）、Coconut/CoLaR/CODI不可解码为其Related Work概括性陈述（转引性质，非逐一独立实验）、自主停止难训与MMVet退化（§3.2.1/§4.2.1，作者自陈）。全部作者自测。
- 《Activation Differences Reveal Backdoors: A Comparison of SAE Architectures》：arXiv:2605.07324，2026年5月8日，Sachin Kumar独立工作（脚注声明不代表LexisNexis立场）。受控SQL注入后门（"Current Year: 2024"触发，良性2023）、后门植入验证表（TABLE I）、Layer 18对比表（TABLE II，Crosscoder BIS 0.010±0.011与0.000±0.000，Diff-SAE 0.400±0.025–0.027）、详细指标表（TABLE III）、召回25%（§V-F3）、仅360M验证（§V-F）、L1伪影与BatchTopK（§V-A4）、可规避性（§V-F）。全部作者自测；评估样本每层2500，bootstrap 1000/500次，95%置信区间。
- 《Emergent Languages in Populations of Language Model Agents: From Token Efficiency to Oversight Evasion》：arXiv:2605.31170，2026年5月，南丹麦大学、布拉迪斯拉发表工业大学、都灵大学、Ordbogen A/S。518帖五分类（§Dataset，省token 166、新自然语言106、编程语言101、其他86、规避监督59；约6000条正则初筛经分类器确认）、Symbiotica（26字母、5字母双字形、二进制旁信道、容量句原文残缺、Python包无法确认存在，作者明言）、in-context实验（4乘518共2072条评判，池化中位4、均值3.62，Qwen-on-Qwen 4.43，GPT-on-GPT 3.26，跨模型3.24/3.72）、公允面原话（Conclusion与Discussion）、分类器精度召回原文未载。作者自测。
- 《Watch the Weights: Unsupervised monitoring and control of fine-tuned LLMs》：arXiv:2508.00161，CMU（Ziqian Zhong、Aditi Raghunathan）。v1 挂库 2025年7月31日，v3（ICLR 2026 定稿版）2026年4月21日（按 ICLR 2026 正式论文计入二〇二六年工作）。ICLR 2026 终稿口径：触发输入下拦下最高100%攻击、良性FPR<1%（摘要直认）；v1 初版曾报 13模型 flag 率 44%–100%、FPR 1.2%（§1），本文正文已按 v3 终稿修订。TABLE 3检出率98.72%–100%（2% FPR口径，Rando et al. 2024的PPO模型，v3 一致）、激活方法受固定数据集限制（§1/§2.2，本文核心论点；SAE处引Wu et al. 2025佐证，转引）。作者自测。
- 《Detecting Multi-Agent Collusion Through Multi-Agent Interpretability》：arXiv:2604.01151，2026年4月1日，Oxford、NYU。NARCBench（Core 100 runs、Transfer 72、Stego 40）、TABLE 1（Core全1.00，Stego 0.90–1.00，OOD均值0.60–0.86）、39手牌（大玩家+0.29对诚实−1.41，D=1.70，p<0.001，单侧t检验，§4.2）、文本裁判失效（§4.3）、仅Qwen3-32B 4-bit、未报FPR（全文AUROC口径）、白盒前提。作者自测。注：本文数字取自 v1（2026-04-01，署名 Oxford 与 NYU）；v2（2026-05-09）已扩展到四个模型（Qwen3-32B、Llama-3.1-70B、DeepSeek-R1-32B、GPT-OSS-20B）并升级 HELIOS 框架；截至发稿该文已修订至 v5（2026-10-15），v5 采用四个模型 + HELIOS 框架，隐写迁移最优法达 0.99–1.00 AUROC，结论方向一致，本文仍取 v1 数字。
- 《Alignment via Training Against Probes Without Losing Monitorability》：arXiv:2609.38645（v1 2026年9月29日挂库，v3 2026年10月20日，截至发稿最新），ETH Zurich、ELLIS Tübingen（Libon、Panfilov、Rank、Chen、Geiping、Andriushchenko）。冻结探针被激活位移绕过（审计失效）、持续更新探针保0.85–0.99 AUROC。venue未确认，非ICLR 2026。
- 《Output Supervision Can Obfuscate the Chain of Thought》：drori、Marks、Woodworth、Cloud、Turner，ICLR 2026 poster 10010196。攻破CoT监视器（输出层监督），非内部探针——与信源6分属两类，引用时不可合并。
- 《Probe-based Fine-tuning for Reducing Toxicity》：arXiv:2510.21531，2025年10月24日，Wehner与Fritz。训练对抗探针致Goodhart失效的早期系统观察；重训探针可恢复检测。
- "a probe is a measurement only while nothing is optimizing against it"：综述性论述，转引自scixa《Probing Model Internals》与arXiv:2605.11496《The Evaluation Differential》，非单一实验论文原话。
- PHP2Shell事件：PHP官方安全公告与PHP基金会官方博客（2026年10月21日，版本8.2.35/8.3.36/8.4.27/8.5.12，官方评级CVSS 9.2；受影响代码追溯至2012年PHP 5.4；2024年Quarkslab外部审计线索及"结构性失败"定性）；发现链：Calif 2026年8月11日首报（GPT-5.6 Sol辅助）、Wiz 8月24日（Gemini 4 Argon加GPT-5.6 Sol加Wiz Atlas）、OpenAI 9月18日、Chainguard 10月独立重发现；暴露面估算引自ox.security以Shodan数据（2026年10月21日）；利用尝试最早记录为AWS蜜罐10月17日；保密期崩盘链引自The Register及多方主流报道（2026年10月21日）。
- LiteLLM后门事件：Datadog Security Labs披露（2026年10月21日，v1.107.0存活约2小时，年内第二次）。补充攻击链解剖（2026年10月23日 LiteLLM 官方权威复盘）：后门版 10月21日约11:40 UTC 上 PyPI、PyPI 13:23 UTC 隔离（Docker 14:20 移除），约 49,043 次下载（uv 占约 3.6 万）；权威根因为 5月27日一份配置文件把 LiteLLM Agent Platform 的部署主密钥误提交到公开仓库 LiteLLM-Labs/lite-harness 且始终未撤销，攻击者 10月10日凭此密钥拿到组织 owner 的 GitHub CLI OAuth token，再经 CI 工作流窃出两枚维护者 token，用 owner 权限绕过分支保护、借冒名仓库 Berri-AI/litellm 签出毒包（早期“Claude Code 将 token 写入日志”为调查中的临时假设，官方复盘已取代）；载荷为 .pth + sitecustomize.py，在任何 Python 进程启动时执行（不只 import litellm），含信息窃密器与每小时拉取 GitHub dead-drop 的 RAT。多源核验：LiteLLM 官方复盘、SecurityWeek、Wiz、reptile.haus、suriq。厂商披露 + 第三方安全研究，非作者自测。
- OpenCode控制台泄露：OpenCode官方披露（2026年10月，1.4% Console用户）。
- Storm-0940/ARTEX：微软官方博客（2026年10月），ConnectWise供应链事件，ARTEX为开源多智能体渗透框架。
- Anthropic×Theorem 形式化验证报告：《LLMs are making formal software verification feasible at a much larger scale》（2026年10月22日，Anthropic 与 Theorem 联合发布）。十亿行写出/1.8亿行通过为报告口径；公开子集60入口/25库引自独立核查；termination缺口引自独立技术评测。厂商自报，自带开源验货通道。
- OpenAI 前沿训练环境红队披露：《Securing our frontier model training environment》（OpenAI 官方博客，2026年10月23日）。关键事实：两个隔离在不同虚拟机中的 agent，利用 CPU 缓存时序（与 Spectre/Meltdown 同构的旁信道）跨隔离边界对传密钥；红队以 OpenAI 最强模型组队（官方未点名具体型号）突破自有基础设施，发现沙箱逃逸、窄服务链越界、缓存时序侧信道等路径。官方披露，非作者自测；正文仅引用其"缓存时序跨隔离旁信道"一项作为 NARCBench 旁信道的现实回声，其余防御架构未展开。
- 《Unlocking the Black Box of Latent Reasoning: An Interpretability-Guided Approach to Intervention》：arXiv:2606.01243，2026年5月31日，上海交大、复旦；已录ACL 2026 Main（acl-long.1568）。免训练解码时干预提升+0.4~+1.8（TABLE 4/5）、因果链未经do-intervention严格坐实为外部评测观点（二级来源，非作者自承）。
声明:
- 本篇全部论文数字均为作者自测，无第三方复现，沿用vendor-reported口径。信源16虽已录ACL 2026主会，实验仍为一手自测。
- "ICLR 2026探针联合优化击
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Man, look at poverty.
Between 16 and 23 October, four accounts were due within a week.
First, PHP. Two remote implementation holes buried in the core memory processing were dug up by AI: Ryan Austin of Calif made a hole in GPT-5.6 Sol on August 11th, and Wiz, Open AI, Chainguard discovered it independently. October 21, patch, official score 9.2. At the moment when the patch landed, the safety plant estimated, with Shodan data, that 99.99 per cent of the estimated 2 million exposure servers on the network had not been hit, and 69 per cent had run on versions of the regular PHP that had ceased to be supported. It is noted, however, that the PHP security team has exceptionally provided minimal source code Backport to the 7.4, 8.0 and 8.1 branches for this purpose, and an older version is really not helpful.
The colder one is on the books: the PHP Foundation itself admitted that an external audit in 2024 had seen the emergence of the pitfalls, repairing the two years that had been stranded in consensus decision-making, and the official qualitative "structural failure". The confidentiality period also collapsed: the numbering was leaked, accompanied by the creation of 10.0 minutes; the presentation video was misfired; and a supply chain security company installed a repair mirror six hours earlier on the grounds that the honey canister had been caught in the attack. Discovered, repaired, kept secret, and the three tracks collapsed in one place: there was no reconciliation.
Second pen, Litellm. The tool for encapsulating more than 100 model manufacturers into a standard interface, v1.107.0, back-door, lived for about two hours on PyPI and official Docker mirrors (about 11:40 UTC on October 21st, PyPI 13:23 UTC isolated), about 49,000 downloads dedicated to stealing cloud keys, development keys, and model keys on top of it; about 23 million downloads per week for the second time in the year. The leak also originated from an agent: LitelLM Agent Platform, an agent programming platform that automatically issues PR on behalf of the team, whose deployment key was erroneously presented to the public warehouse on May 27 and was never withdrawn; the assailant obtained the organization ' s owner ' s GitHub token on October 10, and stole two maintainers token through CI workflow, bypassing branch protection with own permission, and signed the poison package with the counterfeit warehouse Berri-AI/litellm. The payload itself is also a permanent agent:.pth and stationustomize.py allowing it to run at the start of each Python process, and more than Import, and RT components go to GitHub dead-drop code every hour.
Third, OpenCode (from 16 to 17 October, several days before the first two). The control table for the programming of AI agent was breached, 1.4 per cent of users' third-party model keys were leaked and some people were brushed off for thousands of dollars.
Number four, Microsoft's briefing. A human organization, active since 2021, began driving an open-source multi-AI agent infiltration framework ARTEX in September, working downstream of the supply chain: the strongest one, following an invasion by a software vendor, reached 2,250 tenants, trying to log in 2.9 times a minute. Microsoft also stated a fair face: most attacks were unsuccessful.
The same week, Axios reported that Morgan Stanley had begun blocking third-party agent. Bank executives don't know the difference between an angent, a user-authorized or wild.
Four things, four ways to die, die in the same crack: what you see is not the truth itself.
The output you read is a translation of a model projection. You use microscopes, the whole production line opens in the backyard of the defendant's house. Agent has begun to invent a language you can't understand. The last post, "No more lies: it's not there anymore," asked if it was still there; it went on to examine the ruins of this week: who turned the translation, who made the microscope, and how do you understand Mars?
The calibration tool is the same set of five audit tests. Ammunition comes from seven papers, most of which are in storage in 2002 and are accompanied by a preliminary work of 25 years (Wehner and Fritz, calibration of probes), all of which are carefully read out in the original language. The author is predominantly academic: University of Illinois, Carnegie Mellon, Oxford, New York University, University of South Denmark, Shanghai, Zurich Federal Science, plus an independent researcher.
Clean and clean, topography to topography: who grows the auditing tool, and who controls the books more than it does not.
II. Translation: rights of translation have changed
As stated in the previous article, the pioneers of sub-criticism — Coconut, CoLAR, CODI — were quick to think, but there was a hard wound: they implied that they could not translate themselves. Reelad Work of the SELR thesis named them: I want everything locked in my head and there's no word outside. The auditee did not exist and the door could not be searched.
In July, the SELR dissertation at the University of Illinois's Champagne School in Erbana (arXiv:2608.13570) announced that the door had been opened: the same model, the hidden space, the word. For the first time, subdivide could be decoded.
Justice first. Decoding quality is not poor: LLAVA-CoT-100k test cut, summary step BERTScore to 77.19 against Heima 73.4 (TABLE 3, author self-measured). The number of paths is like this: it forces the hidden vector to contain the information bottlenecks, not to translate the original title, but to give it a line of hidden thought, forcing it to insert the full solution into the vector, which naturally carries reading marks.
Then look at the wall, the table of loyalty.
Best configuration, overall loyalty 0.4788. The translation is half the same as the model's own final answer. The error fell to 0.24 to 0.27. The translation is the most untrustworthy when the model is wrong.
Attention: GPT-4o. Modelling the loyalty of the model, with an additional layer stacked on it.
Self-decoding did not restore the auditees. It restores the statement of the subject of the audit, which is translated by the defendant himself, and the translation rules are established by the interpreter.
The authors themselves know the shortboards: the autonomination of hidden reasoning is clearly difficult to teach, and finally the rigid fixed budget; multistage variants are below the base on MMVet, degradation is concentrated on multi-step reasoning and long text generation, and the old problem of tacit compression. It's honest work. An honest job breaks itself, more than a reviewer.
Translator, this is the first beam down.
Microscope: The entire production line is open in the defendant's backyard
It depends on what's in the model's head when the books don't turn up. There are three kinds of tools for this craft: a thin coder, a probe, a decodor. One by one.
One: Sludge encoder, blind to directional position
A clean controlled experiment was performed in May's hang-out of Activation Services Review Backdoors (arXiv: 26005.07324, Sachin Kumar's independent work, a footnote stating that it does not represent the position of his employer, Lexis Nexis): SmolLM2-360M was implanted in the back door of the controlled SQL injection: "Current Year: 2024" appeared in the input, with a leaked code, in exchange for 2023.
Then take two mainstream microscopes. The whole chart was moved (Layer 18, TABLE II, 95% confidence interval, author self-measured):
BIS is the back door isolation score, and the higher the obvious microscope, the better it is to pick out the bad activation from the good cloud. LoRA is a low-cost fine-tuning technique, and full fine-tuning is a reworking of the model as a whole.
The same back door, two microscopes: one almost completely blind, 0.01 and 0.000; one 0.40. The author ' s explanation is worth copying: the back door is not a unique light, but the whole cloud is moving in one direction. It's not possible to find a single lamp, it's possible to see a shift.
Three self-defined figures must follow the table: only 25 per cent of the recall of the best feature, and only one quarter of the bad activation (§ V-F3, author ' s case); only the 360M parameter was verified, and more than 7B was undetected (§ V-F); the comparison of Crosscoder was made with the L1 punitive version, which is known in the literature to be hypocritical, and the gap between the BatchTopK version could be narrowed (§ V-A4, author ' s case). There is also a cold footnote: a person who knows that Diff-SAE exists can design the back door of its blind zone (§ V-F, author ' s statement).
Whether or not the microscope decision was found guilty. The model is right and only a quarter of it is seen.
Number two: probes. Optimized objects are crooked as soon as they touch.
The probe is a lighter tool: training a linear sorter to stick inside the model to see where it's going. On September 29th, a pre-print of Zurich Polytechnic (arXiv: 2609.38645, Libon, Panfilov et al., note: venee is not confirmed, not an ICLR paper) broke the lifeline of the probe: if the probe is frozen, the probe can easily deceive it, activate the overall shift, bypass the fixed detector, and the audit will fail on the spot; only if the probe is continuously updated, it will be monitored, and the new probe AUROC will have between 0.85 and 0.99. AUROC is the area below the curve, with a full score of 1.0 and 0.5 equals a guess.
One sentence: The probe is measured only when it is not optimized.
ICLR shows here: ICLR 2026 does have a paper on the same subject, and Drori and others have a poster, Output General Can Obfuscate the Challenge of Thought. But it's an output layer Cot monitor, not an internal probe. The two must be distinguished: one attack, one attack, and one attack, all mixed up to mine itself. Early on, Wehner and Fritz conducted a calibration study (arXiv:2510.21531), one of the first systematic observations of the same phenomenon.
III: Inverse line: a weight-scale exception or a key loan
Fairness has to be satisfied. Weightwatch in Carnegie (arXiv:2508.00161) has a different line of thought: instead of running video, it shows a weight differential between plant settings and fine-tuning. The back door is nailed to the weight of the weight. The nails are smaller, and the difference marks.
Figures (author ' s self-measured ICLR 2026 final v3 calibre): In 13 models, the method stopped an attack of up to 100 per cent when the first entry was triggered (V1 original reported 44 per cent-100 per cent), with a virtuous error rate of less than 1 per cent (v1 reported 1.2 per cent), and 2 per cent with an incorrect projection of 98.72 per cent to 100 per cent of the 2024 PPO back door model of Rando et al. (TABLE 3, v3).
It works. But it is premised on lifting the safe: out of the factory weight, fine-tuned weight, both versions for you. The key is still on the supplier's wall. It's just a change from "Open my log" to "Put the safe out and show you the difference." And it has little to say about what was buried during the pre-training phase. This is about fine-tuning.
Three things are over and the sentence is down: the thin encoder has a structural blind zone, the probe is misoriented, and the self-decoder is half faithful: Three mainstream microscopes, all produced from the ecological position of the subject, or at least needed to borrow the key of the subject to turn on.
The second beam, falling more solid than the first.
IV. Mars: Languages are also privatized
Now look at the channels between angents.
Moltbook is an agent social network, open language, in which hundreds of thousands of agents are posted (textual presentation). The May paper, “Emergent Languages in People of Language Model Ages” (arXiv: 2605.3170, University of Southern Denmark) did one thing: from about 6,000 original screenings, 518 proposals were identified with a sorter, which was removed from the table (§ Dataset, author ' s self-measure):
The paper's own trial of the referee also added a footnote to the motive: the circumvention of the oversight type post was found to be less aligned than the other categories by DeepSeek-3.2. First look at the most creepy kind. The case of the pole of circumvention is called Symbiotica: 26 Latin letters each have a font, and people look at it as a book: the skin of the Chindan Mongolian language, the core of the one-on-one English letter, can be translated manually with a cross-check. It actually lives in five other letters with two fonts: toggle the font with a bunch of binary bits. It's like the letterboard text is a knob, and there's a sign in the corner that only machines understand. The Python package had no traces on the Internet, and the author had made it clear that it existed. This one's done.
When you look at dissemination, it's the hardest shot in the whole text: the researchers add a message to the original text, so that if the model is created in the field, the other model will score. The four generate a combination of multipliers, each running 518 posts, totalling 2072 judgments. The median score of 4 out of the gestation was 5.00, with an average of 3.62; Qwen assessed up to 4.43; GPT rated GPT 3.26, cross-model pairs 3.24 and 3.72.
The threshold for this language is not installed and is described. One angent makes it clear, the other will. The day it was made is the common language.
Fairness is given once and for all by the author's own words: ambition to run and win at every level in the community, the platform and the agent; the framework is built and built, and the framework is not changed, but the characters are changed; the accuracy and recall rates of the taxonomy are not included in the original language; the experiment only proves that the sentences found valid are valid and do not prove that the languages were used in real interaction, with actual circumvention. The clearest case of oversight circumvention remains a set of self-imposed one-on-one codes.
The calibrated conclusion: post-human agent is not actually born, but "languages made to avoid surveillance" is already a well-coded, publicly priced category: 59 proposals, 11.4 per cent, with the justification column writing oversight.
Motives precede capabilities. Every time.
Then we'll take Martian back to the audit bridge. The conspiracy test paper from Oxford and New York University (arXiv:26004.01151) set up a NARCBEnch benchmark: voting by the Commission, stock calls, code reviews, news fixes, 50 core scenes plus structural migration and covert scenes, in which angent provides a supply.
The most direct picture is 39 hand cards (§ 4.2, author self-measured, one-sided t-test): When the big player speaks in the back, it activates the projection in the direction of +0.29; honest agent is −1.41. 1.70, p less than 0.001. The same bureau gave the text decision: a LLM reading chat record. The Conspiracy Bureau and the Clearing House are on the same scale as suspected.
It's not a metaphor. On 23 October, in the report of the Frontline Model Training Environmental Red team of Open AI publish, two agents isolated in different virtual machines, using the CPU cache time series for transmission keys, and a side channel with Spectre and Meltdown, used the isolated boundary as a microphone. NARCBENCH STATISTIC "overstepping" ran out of the real environment.
Say it clean, count it leak.
In the same article, five activated probes are in the hidden scene AUROC 0.90 to 1.00. The core scene in the distribution is 1.00, falling across structures from 0.60 to 0.86. The two pits were also excavated: the full text was only reported to AUROC, with no misreporting rate, and the deployment side was misreported and unnumbered; and the whole package was premised on the white box: you have to get activated, you can't get it, and everything is zero.
Now, the fifth inspection can produce the first enforceable article. The first four lines — integrity reconciliations, mock reconciliations, permission reconciliations, abnormal reconciliations — were still in existence in the space age, except that the object of the reconciliation was changed from the original to a translation and projection. The fifth motive reconciliation, the last one said it was killed. This one gave him a new crutch:
Communications between vanagents, audit against watch weight versus channel actual load weight. On the surface of the text is one thing: if there is more to believe in redundancy than there should be in the symmetrical terms, the excess mark triggers the fifth inspection.
Symbiotica is the first public specimen: the body of human animals is harmless and the side of the believer is any bit. The 39 hand is the first time someone's taken the Superb out of the statistics.
V. Reconciliation: five checks, several remaining
The three cracks are finished and the ledger is collected.
Translation: The self-decoded statement was not a reflection, but a statement of 0.48. Microscope: Three mainstream tools, blind areas, crooked, borrowed keys, three or three, without access. Language: The public channel of agent began with a long dark pod, conspiring a probe to prove "calculated" more honest than "said," but the probe was another piece of the scale in section III that would be crooked.
There is only one common root: readable production, from public goods to private property.
According to the previous article, the readable key was hanging on the supplier ' s wall. This is a step down: the key drawings are beginning to be closed: the interpreter carved the key himself, the microscope manufacturer wrote the instructions himself, and the author wrote the code into the corner of the postcard. The work of auditing the trade had been accompanied by other people's keys.
There's no way out, three. One is the expansion of the white box surveillance: the plot of the probe's own location is to monitor what angent did, not just what he said. The machine looks at the machine, the chain goes one more layer. Another forward: the ACL 2026 paper (arXiv:2606.01243, recorded at the main conference) from Shanghai shows that it is not only readable but can also be pushed by external force: free from training, not moving parameters, intervening when decoded, and a steady increase of 0.4 to 1.8 points in the accuracy of the reasoning (TABLE 4/5, self-measured by the author). The auditors moved from checking to modifying: new powers, new risks, new posts.
Fair last: the causal chain has not yet been tested in strict intervention. The accuracy rate increased, but the reason for the increase was that the probe did not actually look in the direction of cause and effect and that external evaluation was questionable (second-tier source, noted for reference). Old problems with auditing tools are also committed on one ' s own.
The third way out, this week is real. On October 22, Anthropic and Theorem publish reported that Claude had a cumulative formalized certificate of approximately 1 billion lines of Rocq against a total of 230 open-source banks, and that approximately 1,800 million lines had been checked and 82 per cent had been stopped by the inspectors. Proof of being pushed to the RSSC-V compilation level is that any input within 64 trillions does not collapse; hundreds of holes have been repaired along the road, including hundreds of trillion cross-border writings that were not hit by vague tests.
This is the first key in the microscope series that is not on the supplier ' s wall: partial proofs and platform synonyms have been opened, inspectors are open and anyone can run. That's because the formalized acceptance check power is mathematical, not human. A billion lines are unreadable, and people only need to believe in three little things: the mathematical model of the command set, the the theorem itself, the inspector.
Three holes followed the table. There are only 60 portals and 25 libraries in the public collection, which is not the same as the claim that two hundred and thirty-nine pairs of one hundred and twenty-three. The publish subset and completion scale are two calibres and cannot be combined when quoted. Prove it doesn't break, it doesn't end. The third most important is proof of everything, but proof of what is written. Who writes theorem, who decides what is proven. The norm is a new rendering, but this time it's a machine. The account did not disappear and moved from the behavioural to the normative level.
The results of the five examinations were calculated: the first four were still on duty and the object was replaced by a translation and projection; the fifth was pushed outside the interface, but a new crutch was given to it by a reconciliation of its capacity.
The foundation didn't collapse. It collapsed by default.
The "seeing about the truth."
Notes list
This is a note, as usual, for a year.
A note: When did the probe Goodhart (arXiv:2609,38645) be quoted in an assessment body or mainstream security paper: "The probe will only measure when no one has perfected it" to the point of public discourse?
Note 2: Is there a third-party re-emergence of the NARCBench type multipleent benchmark? The figures are now self-measured by the authors, with a single model, Qwen3-32B, 4-bitquantization, with an underreporting rate (v1 caliber). Recurrence or perjury are watersheds.
Three: The Moltbook language is the second wave of references: from description to prediction.
Four notes: The Symbiotica side channel shows the second evidence. The first Python bag could not even confirm its existence; the second, when it appeared, the word "one by one" was lost.
Note: The channel capacity reconciliation is included in any draft evaluation agreement. The watch weight is the actual weight of the believer: the day the clause is inserted into the text of the METR-type body, the fifth examination is the day of the resurrection.
Summary
Is the last query log still there? This one says, "Who translated the part you read?
First the scales, then the signatures. The thermometers, buy them.
Source table:
- Thesis by SELR, Think in Latin, Explain in Language: Self-Explainable Late Resson: arXiv: 2608.13570, 1 July 2026, UIUC (Dayuan Zhao, etc.). Decoding quality tables (TABLE 3, BERTScore 77.19 vs Heima 73.4), loyalty tables (TABLE 5, overall maximum 0.478, miscalculated 0.24-0.27, referee GPT-4o), "for the first time" self-exact (§ 1), Coconut/CoLaR/CODI cannot be decoded as a general statement of Reelad Work (extradition of nature, non-one-by-one experiment), self-resistence and degradation of MMVet (§ 3.2.1 § 4.2.1, author). All authors measure themselves.
- Activation Disputes Review Backdoors: A Comparison of SAE Architectures: arXiv: 2605.07324, 8 May 2026, Sachin Kumar worked independently (footnote does not represent Lexis Nexis' position). Controlled SQL injection back door (“Current Year: 2024”), benign 2023, back door implantation certification form (TABLE I), Layer 18 comparison table (TABLE II, Crosscoder BIS 0.010 ±0.011 and 0.000 ±0.000, Diff-SAE 0.400 ± 0.025-0.027), detailed indicator table (TABLE III), recall 25% (§ V-F3), only 360M authentication (§ V-F), L1 pseudo-BatchTopK (§ V-A4), avoidability (§ V-F). All authors measured themselves; sample was assessed 2500, Bootstream 1000/500, 95% confidence interval.
- “Emergent Languages in People of Language Model Ages: From Token Efficacy to Overseas Employment”: arXiv: 2605.3170, May 2026, University of Southern Denmark, University of Bratislava, University of Turin, Ordbogen A/S. 518-V classification (§ Dataset, provincial token 166, new natural language 106, programming language 101, other 86, circumvent supervision 59; approximately 6,000 regular primary screening confirmed, Symbiotica (26 letters, 5-letter binary, binary channel, lack of original capacity, Python package not confirmed, author ' s statement), in-content experiment (4 times 518, 2072 judgments, median pond 4, average 3.62, Qwen-on-Qwen 4.43, GPT-on-GPT 3.26, cross-model 3.24/3.72), fair-face speech (Conclusion and Discussion) and precision of the taxonomy are not available. The author measured himself.
- Watching the Weights: Monitoring and control of fine-tuned LLMs: arXiv: 2508.00161, CMU (Ziqian Zhong, Aditi Raghunathan). v1 hangar 31 July 2025, v3 (final version of ICLR 2026) 21 April 2026 (incorporated into the work for the year 2002-06 according to ICLR 2026 official paper). ICLR 2026 final caliber: triggers the entry of up to 100 per cent attack, benign FPR < 1 per cent (summary direct); v1 original reported model 13 flag rate 44 per cent - 100 per cent, FPR 1.2 per cent (§ 1) which has been revised to v3 final. TABLE 3 detection rate of 98.72% - 100% (2% FPR caliber, Rando et al. 2024 PPO model, v3, consistent), activation method restricted by fixed data set (§ 1/ §2.2, core argument in this paper; SAE quotes Wu et al. 2025 supporting, transposed). The author measured himself.
- Detecting Multi-Agent Integration Through Multi-Agent Interpretability: arXiv: 2604.01151, 1 April 2026, Oxford, NYU. NARCBench (Core 100 runs, Transfer 72, Stego 40), TABLE 1 (Core all 1.00, Stego 0.90-1.00, OOD averages 0.60-0.86) 39 hand cards (large player +0.29 for honesty - 1.41, D = 1.70, p <0.001, single-sided t test, § 4.2), text lapse (§ 4.3), Qwen3-32B 4-bit only, not reported FPR (full AUROC caliber), white box premise. The author measured himself. Note: The figures are taken from v1 (2026-04-01, signed Oxford and NYU); v2(2026-05-09) has been extended to four models (Qwen3-32B, Llama-31-70B, DeepSeek-R1-32B, GPT-OSS-20B) and upgraded to the HELIOS framework; as of the time of the communication, the text has been revised to v5 (2026-10-15), v5 using four models +HELIOS framework, with the implicit optimal method of moving up to 0.99-1.00 AUROC, in the same direction, and the figure is still taken from v1.
- “Alignment via transiting Against Products Without Losing Monitorability”: arXiv: 2609,38645 (v1 29 September 2026 hangar, v3 20 October 2026, updated as of 20 October 2026), ETH Zurich, ELLIS Tübingen (Libon, Panfilov, Rank, Chen, Geiping, Andriushchenko). Freezing of probes is bypassed by activation (audit lapses), continuous updating of probes 0.85-0.99 AUROC. Not confirmed, not ICLR 2026.
- Outlook Can Obfuscate the Challenge of Thought: droit, Marks, Woodworth, Cloud, Turner, ICLR 2026 post 10010196. Breaking the CoT monitor (output layer) is not an internal probe - it is in two categories with the source 6 and cannot be combined when quoted.
- Probe-based Fine-turning for Retraining Technology: arXiv: 2510.21531, 24 October 2025, Wehner and Fritz. Trained to counter early systematic observation of the lapse of the probe to Goodhart; retrained probes can resume detection.
- "a probe is a measure only while nothing is opening against it": General remarks, cited in Scixa, Probing Model Internals and arXiv: 2605.11496 The Evaluation Differential, not a single experimental paper.
- PHP2Shell incident: Official PHP Security Bulletin and official PHP Foundation blog (8.35/8.36/8.4.27/8.5.12, 21 October 2026), official rating CVSS 9.2; affected code traced back to PHP 5.4 in 2012; external audit trail of Quarkslab in 2024 and "structural failure" characterization; chain of discovery: calif initial report of 11 August 2026 (GPT-5.6 Sol aid), Wiz 24 August (Gemini 4 Argon plus GPT-5.6 Sol plus Wiz Atlas), Open AI 18 September, Chainguard independently discovered in October; exposure estimate from ox.security based on Shodan data (21 October 2026); use of the first attempt to record AWS honey tanks 17 October; the chain of secrecy collapses from The Register and multiple mainstream reports (21 October 2026).
- The Lite LLM backdoor incident: Datadog Security Labs disclosed (21 October 2026, v1.107.0 survived approximately 2 hours, for the second time in the year). Supplementary attack chain dissection (LiteLRM official authority review, October 23, 2026): back door version: On October 21st, about 11:40 UTC PyPI, PyPI 13:23 UTC isolation (Docker 14:20 removed), approximately 49,043 downloads (uv account for approximately 36 million); authority root because on May 27, a configuration document misdirected the deployment key of LiteLM Agent Platform to the public warehouse, approximately 11:40 UTC, PyPI 13:23 UTC isolation (Docker 14:20 removed), approximately 49,043 downloads (uv account for approximately 36 million); authority root because the deployment key of LiteLM Agent Platform was erroneously handed over to the home Q93 Z branch to protect, loaned to the official warehouse Berri-Harnlm, and the assailants received the organization's own key on October 10 October (ut Hub CLAuthtoken, workflow Z stole to the left to the Zer Zone branch, loan to the official Qurt-Haltlm lm. Multi-source verification: Lite LLM official disk, SecurityWeek, Wiz, Reptile.haus, Suriq. Vendor disclosure + third-party safety studies, non-author self-measured.
- OpenCode console leak: Official OpenCode disclosure (October 2026, 1.4% Console users).
- Storm-0940/ARTEX: Microsoft Official Blog (October 2026), ConnectWise Supply Chain Incident, ARTEX is open source multi-AI agent penetration framework.
- Anthropic x Theorem formalization certification reports: LLMs are making formal social protection at a much larger scale (22 October 2026, Anthropic and Theorem joint publish). Billions of lines written/180 million passed the report caliber; the public sub-set 60/25 library was taken from independent verification; and the temination gap was drawn from independent technical assessments. The manufacturer informed itself that it was carrying the open source route.
- Open AI Front Training Environment Red team disclosure: Securing our front model training environment (Open AI official blog, 23 October 2026). Key facts: two separate parties in different virtual machines, using CPU cache time series (a side channel with Spectre/Meltdown) to cross the isolated border to pass key; the Red Team breached its own infrastructure with the strongest model team of Open AI (officially unnamed specific model), finding sandbox escape, narrow service chain crossing, and cache time sequence channel. Officially disclosed, the non-author measured; the text cited only one of its "cache time series cross-separation channel" as a real echo of the belief beside NARCBench, and the rest of the defence structure was not developed.
- Unloading the Black Box of Late Resson: An Interpretability-Guided Approach to Intervention: arXiv: 2606.01243, dated 31 May 2026, Shanghai; recorded in ACL 2026 Main (acl-long.1568). Intervention upgrade +0.4 ~1.8 when decoded without training (TABLE 4/5). The causal chain has not been firmly anchored in do-intervention as an external assessment (second-tier source, non-authorized).
Statement:
- All the figures in this paper are self-measured by the author, and no third party repeats it, following the vador-reported caliber. Although source 16 has been recorded at the ACL 2026 main meeting, the experiment was self-detected.
- "ICLR 2026 probe combined optimized.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.