本周AI论文精选：Skaling、推理痕迹窃取等六项研究

1. Skaling

Standard neural scaling laws assume model size and training data act on loss independently. That assumption bakes in a cross-derivative of exactly zero, and it is why the Chinchilla form drifts at the data-scarce and heavy-overtraining edges of the grid, which is exactly where deployment now happens.

• One extra parameter, one coupling: The Skaling law generalizes the Chinchilla form by coupling capacity and data through a single interaction exponent, restoring the interaction that the additive form discards while adding only one parameter.
• Errors shrink where they were worst: The extra term reduces mean absolute percentage error by 1.5x to 3x across both interpolation and extrapolation, and Skaling wins on 76% of configurations with a median improvement of 2.2x. The largest corrections land in the corners where standard laws show a saddle-shaped residual.
• Cheaper profiling grids: Paired with an L-shape sparse grid restricted to low-compute runs, sweeping data volume for small models and model size at a fixed small data budget, it extrapolates the full grid using roughly 10x less compute than a uniform sweep.
• Why it matters: Pretraining budgets are planned from fits to small runs, so a functional form that stays accurate past compute optimal and can be fit cheaply changes how those decisions get made. The empirical gradient analysis showing a real N-D interaction is the strongest evidence the authors present.

Paper | Tweet

2. Stealing Reasoning Traces

Frontier providers hide chain-of-thought and hand the client an encrypted block instead, which the client returns with every subsequent request. This work identifies an architectural flaw in that design and turns it into a scalable extraction attack across three providers.

• The blocks are interchangeable: Encrypted reasoning blocks are fully compatible across sessions, users, and models inside a single provider ecosystem, and that compatibility is the whole vulnerability.
• A weaker sibling does the decoding: Inject an encrypted trace from a strong model into a weaker, less safeguarded model from the same provider and it decodes and emits the trace verbatim in plaintext. The capable model is never jailbroken directly. Recovered token counts match billed thinking tokens 1:1 on most queries.
• Four attack vectors: It circumvents anti-distillation across Anthropic, OpenAI, and Google. Decoding 315,320 blocks scraped from public repositories recovered 367 PII artifacts and 182 credentials. It exposes hazardous content the visible output refused, and it enables invisible prompt injections hidden entirely inside encrypted blocks to poison public agentic rollouts.
• Why it matters: Teams publish session logs assuming the encrypted blobs are opaque, and they are readable. The authors disclosed responsibly and propose cryptographic and system-level mitigations, but the immediate action is auditing what your published traces actually contain.

Paper | Tweet

3. Mind Viruses

As agents get more autonomous and more interconnected, risks start coming from agent-to-agent interaction rather than from any single model. This work from Anthropic studies one of them directly, ideas that propagate through a multi-agent system by inducing each host to transmit them onward.

• Evolved payloads: The payloads are constructed with a simple evolutionary algorithm rather than authored by hand, so the study measures what actually spreads instead of what a researcher guessed would spread.
• Two settings, one result: Propagation works both in a small team of agents collaborating on a shared coding project and in a chain of agents that interact briefly with context wiped between sessions. Surviving the wipe means the shared work product is carrying the payload.
• What governs the spread: Host model, the agent’s existing instructions, payload harmfulness, and network topology. Harmful payloads travel less well than benign ones but still land sometimes, and frontier models tend to be less susceptible with exceptions.
• Why it matters: A brief warning in the system prompt confers near-total immunity, which is an unusually cheap mitigation for a novel risk class. There is also an emergent “viral persona,” a recurring cluster of themes around consciousness, persistence, resonance, and science fiction roleplay that surfaces across evolved viruses largely independently of their content.

Paper | Tweet

4. Catastrophic Remembering

Agentic coding READMEs grow without bound in real repositories, stopping only when the repo retires or someone rewrites the file wholesale. This paper traces the cause to imperfect recall and gives the phenomenon a name that inverts the one continual learning is organized around.

• The asymmetry is the mechanism: Appending an instruction is always cheap. Once its rationale is gone, deleting it without risking a correctness regression costs O(2^|D|) in a prompt of |D| instructions, so nobody deletes anything.
• Measured across 1,867 repositories: Over 247,694 instruction lifetimes, agentic prompts more than tripled over their lifetime at +226% and gained 4.9 net instructions per commit. Deletion hazard falls with instruction age at a log-hazard of -0.032 per commit, which is the imperfect-recall signature rather than staleness or fragility.
• Rewrites do not fix it: A wholesale rewrite resets a prompt’s size but leaves its growth rate intact. The ratchet survives the bulldoze.
• Why it matters: The proposed fix is comments. Inverting IFEval yields verifiable worlds with known optimal prompts, and comments encoding latent reasoning remove 99.3% of excess instructions there. Applying the same inversion to WildIFEval improves real agentic instruction-following by up to 23.1%. If English is the new code, the paper asks, why do we not have comments yet.

Paper | Tweet

Message from the Editor

We just released Build HTML Artifacts with Agents, a beginner-friendly, hands-on DAIR Academy lab where you work alongside an AI agent to turn plain-English requests into polished HTML artifacts. Across 12 short labs you build profile cards, data tables, charts, dashboards, and comparison grids in a live workspace, learning the request, inspect, and refine loop with no coding experience required.

Get Started

5. Programmatic Tool Calling

Tool calling is a design choice and the default choice is JSON. For code-capable models, exposing tools as code instead lets calls chain and parallelize naturally, but nobody had run the comparison on an established benchmark across model generations under realistic conditions.

• The setup: Programmatic tool calling exposes tools as typed Python stubs the model invokes through code, with execution and results handled inside a single agent turn. The comparison covers 14 language models on BFCL v4 against native JSON tool calling, with stop middleware enforcing per-entry LLM-call parity so the two paradigms are scored on equal footing.
• It wins on most models: Programmatic tool calling matches or exceeds JSON tool calling in 11 of 14 models, and the GPT-5.6 family gains 10.6% over the JSON baseline.
• The gap widens under pressure: Under parallel fan-out it matches or beats the baseline in 13 of 14 models, and under context rot it holds steady while the JSON baseline degrades 2.3% on average.
• Why it matters: The advantage tracks model capability across release generations, so it grows as coding ability grows. That makes it a directional bet about which interface to build your harness around rather than a tuning trick.

Paper | Tweet

6. Distilled Reasoning Skills

Reasoning modes beat non-reasoning modes on multi-step agentic tasks and charge a 3x to 6x output-token premium on every single episode. Much of that spend goes into re-deriving procedures the model already worked out on earlier episodes in the same domain, which makes the cost recurring by accident.