AI Frontier · Sep 13, 2026

Covering September 7 to 13. Two results in this batch take their security signal from what a model does in ordinary text-level serving rather than from its internals: SpecGuard reads the draft-token acceptance rate that speculative decoding already produces, and WPMIA works from sampled word-level probabilities. Neither needs logit access.

Research

SpecGuard: repurposing speculative decoding as a backdoor detector at no added model computation

Speculative decoding speeds up inference by having a small draft model propose tokens and the target model verify them. The authors observe that the verification step already exposes a signal: when a backdoor fires, the target model shifts toward the attacker's behavior, the clean draft model does not predict that shift, and the draft-token acceptance rate changes. The paper formalizes when the signal appears and argues that an attacker suppressing it must also weaken the backdoor. The claimed advantage is avoiding the extra generation pass that existing runtime detectors need, and not depending on assumptions about trigger form — the assumption that fails on stealthy attacks.

Sources: arXiv

WPMIA: membership inference against proprietary models given nothing but text continuations

Most membership inference attacks need per-token logits or probabilities, which rules them out against commercial models that return only text. WPMIA estimates word-level generation probabilities by Monte Carlo sampling with local kernel smoothing, aggregates them into a sequence-level likelihood, and conditions that likelihood on different prefixes to amplify the gap between members and non-members. Against GPT-5-Chat, Gemini-2.5-Flash and Claude-4.5-Haiku it reaches an average TPR@5%FPR of 42.0. This is a strict black-box result — a floor on what auditing can reach, not evidence of any particular disclosure.

Sources: arXiv

In-context multimodal jailbreaks: treat them as evidence accumulation and their success becomes predictable

Harmful demonstrations in a prompt can drive a multimodal model to unsafe output without touching its parameters. The authors model a safety-aligned model as operating over competing behavioral modes and read in-context demonstrations as inference-time evidence that shifts the posterior between them, which yields scaling laws in demonstration count, harmful ratio, adversarial strength and semantic diversity. The defense that follows injects benign counter-evidence adaptively according to estimated risk, and improves the robustness-utility trade-off over existing in-context defenses at a fixed intervention budget. What the paper delivers is the framework and those trade-off curves, not an end-to-end block rate on a production stack.

Sources: arXiv

BlueSTAR: a tiered defensive agent run against seven attack chains on two live IT/OT ranges

Pointing an LLM straight at security telemetry does not work — raw logs arrive faster than current models process them, single events are often ambiguous, and unconstrained model actions carry their own operational risk. BlueSTAR first compresses high-volume telemetry into compact indicators of compromise, then acts in tiers, and introduces a resilience metric that weighs attacker reach, impact on mission-critical assets and the disruption the defensive action itself causes. The evaluation covers credential theft, repeated compromise, concurrent attackers and attacks on physical processes; the authors report that it keeps deterministic response's fast containment for known threats while handling attacks that need contextual and cross-cycle reasoning. The work was evaluated on cyber ranges, not in production.

Sources: arXiv

terms.txt: pricing agent access to the web instead of stretching robots.txt further

Public measurements show automated clients now make up most requests, and the largest AI platforms fetch thousands of pages for every visitor they send back. The argument is that robots.txt cannot express identity, purpose, terms or price, can be circumvented, and that the newer alternatives are largely proprietary CDN features. terms.txt is a per-path, per-purpose file of machine-access terms paired with an origin-enforced exchange: Web Bot Auth signatures, signed intent, delegation tokens, HTTP 402 negotiation and signed receipts. The authors are explicit about what the exchange can enforce, what it can audit, and what it has to leave to contract. A dependency-free implementation adds 0.20 to 0.65 ms per request on one vCPU.

Sources: arXiv

Lab announcements

OpenAI: Perplexity puts Astra on end-to-end systems (dated September 14 by OpenAI's feed)

Perplexity uses GPT-6 Astra to write communications, change software and monitor production systems, checking in much less frequently than it did with earlier models.

Sources: OpenAI

OpenAI: Jakub Pachocki on alignment and international coordination (September 6)

OpenAI's chief scientist writes on the difficulty of keeping increasingly capable AI aligned, and calls for stronger safeguards and international coordination.

Sources: OpenAI