Stevens Institute of Technology

Continually updated models keep a sequence of queryable snapshots, so an attacker can infer not only whether a sample was used in training but when it entered and left. TMIA treats a sample's confidence across snapshots as a time series, labels entry and exit points with a sliding-window bidirectional LSTM, and pairs them chronologically into valid membership intervals. Across three language models and three image classifiers, TMIA reaches timestamp-level F1 above 83% in every language-model setting and improves interval-level F1 over both baselines by at least 21.82%.

Continually updated models keep a sequence of queryable snapshots, so an attacker can infer not only whether a sample was used in training but when it entered and left. TMIA treats a sample's confidence across snapshots as a time series, labels entry and exit points with a sliding-window bidirectional LSTM, and pairs them chronologically into valid membership intervals. Across three language models and three image classifiers, TMIA reaches timestamp-level F1 above 83% in every language-model setting and improves interval-level F1 over both baselines by at least 21.82%.

Safety alignment of large reasoning models commonly relies on GRPO, but responses sampled for one prompt often share the same safety outcome, so the within-group relative advantage vanishes and the model gets no direction toward safety on persistently unsafe prompts. Beacon pairs safety signal recovery, which filters high-contrast trajectories and directly supervises a safe reference response when the signal collapses, with safety-utility decoupled alignment, which assigns category-aware rewards and applies KL anchoring only to benign prompts. Across four Qwen3 and DeepSeek-R1-Distill variants and eight benchmarks, average safety error falls by 17.69 to 32.83 percentage points relative to the initial policies, with XSTest over-refusal between 0.40% and 1.20%.

Safety alignment of large reasoning models commonly relies on GRPO, but responses sampled for one prompt often share the same safety outcome, so the within-group relative advantage vanishes and the model gets no direction toward safety on persistently unsafe prompts. Beacon pairs safety signal recovery, which filters high-contrast trajectories and directly supervises a safe reference response when the signal collapses, with safety-utility decoupled alignment, which assigns category-aware rewards and applies KL anchoring only to benign prompts. Across four Qwen3 and DeepSeek-R1-Distill variants and eight benchmarks, average safety error falls by 17.69 to 32.83 percentage points relative to the initial policies, with XSTest over-refusal between 0.40% and 1.20%.

The work introduces Patch-to-Prune (P2P), a training-free framework that converts activation patching from a diagnostic tool into an inference-time computation bypass: validation-guided forward and backward layer sweeps identify decoder regions whose visual-token projection outputs can be replaced by fixed neutral proxy activation vectors within a user-specified accuracy tolerance; evaluated on four VLMs from the Qwen2.5-VL and LLaVA families across seven multi-modal benchmarks with mutually disjoint calibration, validation, and test partitions, P2P at a 3% tolerance retains around 94% of dense accuracy while reducing FLOPs by 55%, and its layer-wise analysis suggests visual processing is non-uniformly distributed across decoder depth.

The work introduces Patch-to-Prune (P2P), a training-free framework that converts activation patching from a diagnostic tool into an inference-time computation bypass: validation-guided forward and backward layer sweeps identify decoder regions whose visual-token projection outputs can be replaced by fixed neutral proxy activation vectors within a user-specified accuracy tolerance; evaluated on four VLMs from the Qwen2.5-VL and LLaVA families across seven multi-modal benchmarks with mutually disjoint calibration, validation, and test partitions, P2P at a 3% tolerance retains around 94% of dense accuracy while reducing FLOPs by 55%, and its layer-wise analysis suggests visual processing is non-uniformly distributed across decoder depth.

The work reveals that diffusion-based world-model features have highly stable singular subspaces across nearby denoising steps with predictable singular-value evolution, and builds on this to propose SpectralCache, a training-free spectral caching framework that reuses stable singular subspaces and estimates only low-dimensional singular values via linear extrapolation, while exploiting spectral consistency between neighboring full-computation features to skip selected expensive backbone evaluations via singular value scaling; on HunyuanWorld-Voyager-13B it achieves 5.22x acceleration while maintaining a WorldScore of 65.90 for static scenes, substantially outperforming existing training-free caching methods in inference efficiency.

The work reveals that diffusion-based world-model features have highly stable singular subspaces across nearby denoising steps with predictable singular-value evolution, and builds on this to propose SpectralCache, a training-free spectral caching framework that reuses stable singular subspaces and estimates only low-dimensional singular values via linear extrapolation, while exploiting spectral consistency between neighboring full-computation features to skip selected expensive backbone evaluations via singular value scaling; on HunyuanWorld-Voyager-13B it achieves 5.22x acceleration while maintaining a WorldScore of 65.90 for static scenes, substantially outperforming existing training-free caching methods in inference efficiency.