AI Frontier · Sep 20, 2026

This issue covers September 14 to 18. arXiv cs.CR does not post on weekends, so the newest batch of papers stops at the 18th. Across this set the model sits on the tooling side rather than the target side: AutoMIA has agents designing the attacks, the Android malware paper uses LLM code embeddings as features, and the SOC paper puts small models to work writing queries. The one that runs the other way, MAGS, buys its guarantee by freezing the specification first.

Research

AutoMIA: LLM agents design membership inference attacks, gaining up to 0.18 absolute AUC over existing ones

Building an effective membership inference attack has meant extensive manual exploration of model behaviour to find a usable signal. The authors hand that search to LLM agents, which traverse the space of attack strategies and produce new signal computations, improving absolute AUC by as much as 0.18. The authors bound the claim themselves: the attacks are tailored to a user-configured target model and dataset, not a general-purpose attack.

Sources: arXiv

PAPC: privacy is lost before the final answer exists, so the control point has to move to the event level

The authors model the failure in multi-agent workflows as a privacy-propagation externality: a memory write, a shared-workspace update, an inter-agent message or a tool event can impose an exposure cost on another principal, and that cost depends on topology and fanout as much as on content. PAPC intercepts those events before they update shared state or reach external channels, then combines policy, provenance, topology and fanout, privilege and content signals to allow the event, release a policy-safe abstraction, quarantine the raw content, block the transition or narrow onward rights. On retrieval-memory and multi-agent workflow benchmarks it preserves deterministic task completion and drives measured exact-raw-value and external-raw-value exposure to zero. Read "measured" literally.

Sources: arXiv

MAGS: translate agent-written code into Dafny and verify it — 220 of 220 examples carry a guarantee, relative to a frozen specification

The approach treats Dafny as a verification-aware intermediate representation: formalize and freeze human-audited APIs and safety requirements, translate the generated code into Dafny, repair violations using verifier feedback, and compile the verified program back into executable code. Across 100 CUDA kernels, 100 terminal scripts and 20 robotic-arm tasks, all 220 produce programs with non-trivial safety guarantees. Read that 100% precisely — it means mechanically checkable against that frozen specification; whether the specification itself is right is outside the guarantee.

Sources: arXiv

Graph-based Android malware classifiers: over 94% on the benchmark, down as much as 45 points on unseen variants of families they already know

The authors build a benchmarking suite that separates covariate shift (MalNet-Tiny-Common) from domain shift (MalNet-Tiny-Distinct), and name a defect in the existing benchmarks: the input representation is a structure-only function call graph, which discards the semantic signal that cross-distribution reasoning needs before any model sees it. Their fix extends the graph topology with function-level attributes — lightweight metadata plus LLM-based code embeddings. Under distribution shift this data-centric change beats model-side approaches, and stacking the two helps further. Datasets and pipeline are released.

Sources: arXiv

SOC query translation: a two-stage small-model setup hits 0.987 syntax accuracy, and LoRA fine-tuning loses to well-aimed prompting

The task is translating natural language questions into KQL, where writing correct KQL takes specialist expertise and that expertise is what bottlenecks scaling a security team. The authors try three knobs: lightweight retrieval plus error-aware prompting targeted at common parser failures; LoRA fine-tuning with rationale distillation; and a two-stage architecture pairing a small-model drafter with a low-cost LLM judge doing schema-aware refinement. The second is an informative negative result — neither fine-tuned variant beats the targeted prompting. The two-stage setup reaches 0.987 syntax and 0.906 schema-valid accuracy on Microsoft's NL2KQL Defender Evaluation dataset, above every baseline across nine models tested.

Sources: arXiv

Fingerprinting multimodal models: shared language backbones confound provenance, so take the low-frequency part of cross-modal attention instead

After incidents of illicit deployment and unauthorized distillation of multimodal LLMs, existing provenance methods stall at the same place: MLLMs share language backbones, which confounds the signal, and distillation goes undetected. The white-box method, AttnPrint, extracts cross-modal attention distributions and isolates their low-frequency components as the fingerprint. For black-box auditing, DistillTrace uses hypothesis testing over model outputs to identify infringement. Across 154 model instances spanning 19 multimodal architectures, AttnPrint detects derivative models robustly under five downstream modification techniques, and DistillTrace produces evidence of distillation under three parameter-independent techniques.

Sources: arXiv

Lab announcements

Google: build your own tools in Flow in plain language, as two designers did to prepare for New York Fashion Week (September 18)

Google's Envisioning Studio worked with designers Jane Wade and Sergio Hudson on custom Flow tools for set design and styling: a Styling Suite for curating runway looks virtually, and Runway Visualization for planning the show and its lighting inside a set budget. Google says these custom tools can now be assembled in plain language, with no code.

Sources: Google AI Blog

OpenAI: economic research reporting that workers' AI use is moving past the boundaries of their formal roles (September 16)

Sources: OpenAI News

OpenAI and AARP: free hands-on ChatGPT workshops for 1,000 older adults across 10 US cities (September 16)

Sources: OpenAI News

OpenAI: analytics in ChatGPT Work and Codex for tracking usage and spend (September 16)

Sources: OpenAI News

OpenAI: Perplexity hands code changes and production monitoring to GPT-6 Astra, and says it checks in far less often than with earlier models (September 14)

Sources: OpenAI News