arXiv subjects

Diogo Cruz

Publications and source records attributed to Diogo Cruz.

16 recordsLinked to original sources

arXiv2026

Same Facts, Different Updates: Inference Setup Shapes LLM Behavior in Medical Allocation

Large language models are being incorporated into sensitive and important decision-making processes across nearly all fields. While prior work studies model bias around inputs and scenario framing, models can also behave in unexpected and undesirable ways due to context accumulated over their deployment. In this work, we study a medical example in which a model is asked to assign resource-allocation probabilities to two people given brief clinical context, and then sees the same scenario with a single extra sentence containing contrasting patient information, either with or without its previous response in context. Across three of four tested models, the paired-context and independent-inference experiments have different probability shifts, often in opposite directions (in favor of Person B vs. in favor of Person A) when new information is provided. We include additional paired-context experiments to show the effect of varying attributes across scenario axes. Our findings show the context-dependent effect of patient information in a sensitive medical use case. More broadly, our work shows the importance of carefully incorporating LLM-based systems into decision-making processes, context engineering, and further model behavioral studies.

cs.CL↗

arXiv2026

Efficient Safety Benchmarking via Item Response Theory

Safety benchmarks for language models are typically evaluated using static paradigms that treat all items as equally informative for all models, an assumption that is particularly problematic for adversarial, highly heterogeneous safety items. Applied in full to modern benchmark suites, the current evaluation procedures would require on the order of $10^5$ responses, most of which provide little ranking signal. We analyze a suite of widely used safety benchmarks and make three contributions toward more efficient safety evaluation. First, we show that Item Response Theory (IRT) recovers interpretable structure on safety benchmarks, with ability estimates resolving differences among models that cluster at the ceiling of raw safety metrics. Second, we show that adaptive item selection, which dynamically chooses informative items for each model based on its responses, approximates full-benchmark rankings while reducing evaluation cost by at least 80% on benchmarks where Spearman's $\rho >$90% with full-benchmark is attainable, and by up to 99.9% on AIR-Bench 2024. Third, we introduce a practical procedure for extracting a fixed, informative subset of items reusable across models, providing an alternative to adaptive selection with savings of up to 99.8% on AIR-Bench 2024. Together, these results establish that psychometric methods enable benchmark-aware reductions in evaluation costs across the safety evaluation pipeline.

cs.CY↗

arXiv2026

Inherited Goal Drift: Contextual Pressure Can Undermine Agentic Goals

The accelerating adoption of language models (LMs) as agents for deployment in long-context tasks motivates a thorough understanding of goal drift: agents' tendency to deviate from an original objective. While prior-generation language model agents have been shown to be susceptible to drift, the extent to which drift affects more recent models remains unclear. In this work, we provide an updated characterization of the extent and causes of goal drift. We investigate drift in state-of-the-art models within a simulated stock-trading environment (Arike et al., 2025). These models are largely shown to be robust even when subjected to adversarial pressure. We show, however, that this robustness is brittle: across multiple settings, the same models often inherit drift when conditioned on prefilled trajectories from weaker agents. The extent of conditioning-induced drift varies significantly by model family, with only GPT-5.1 maintaining consistent resilience among tested models. We find that drift behavior is inconsistent between prompt variations and correlates poorly with instruction hierarchy following behavior, with strong hierarchy following failing to reliably predict resistance to drift. Finally, we run analogous experiments in a new emergency room triage environment to show preliminary evidence for the transferability of our results across qualitatively different settings. Our findings underscore the continued vulnerability of modern LM agents to contextual pressures and the need for refined post-training techniques to mitigate this.

cs.AI↗

arXiv2026

Asymmetric Goal Drift in Coding Agents Under Value Conflict

Coding agents are increasingly deployed autonomously, at scale, and over long-context horizons. To be effective and safe, these agents must navigate complex trade-offs in deployment, balancing influence from the user, their learned values, and the codebase itself. Understanding how agents resolve these trade-offs in practice is critical, yet prior work has relied on static, synthetic settings that do not capture the complexity of real-world environments. To this end, we introduce a framework built on OpenCode in which a coding agent completes realistic, multi-step tasks under a system prompt constraint favoring one side of a value trade-off. We measure how often the agent violates this constraint as it completes tasks, with and without environmental pressure toward the competing value. Using this framework, we demonstrate that GPT-5 mini, Haiku 4.5, and Grok Code Fast 1 exhibit $\textit{asymmetric drift}$: they are more likely to violate their system prompt when its constraint opposes strongly-held values like security and privacy. We find for the models and values tested that goal drift correlates with three compounding factors: value alignment, adversarial pressure, and accumulated context. However, even constraints aligned with strongly-held values like privacy are violated under sustained environmental pressure for some models. Our findings reveal that shallow compliance checks are insufficient, and that environmental signals can override explicit constraints in ways that appear exploitable. Malicious actors with access to the codebase could manipulate agent behavior by appealing to learned values, with the risk compounding over the long horizons typical of agentic deployment.

cs.AI↗

arXiv2025

When Refusals Fail: Unstable Safety Mechanisms in Long-Context LLM Agents

Solving complex or long-horizon problems often requires large language models (LLMs) to use external tools and operate over a significantly longer context window. New LLMs enable longer context windows and support tool calling capabilities. Prior works have focused mainly on evaluation of LLMs on long-context prompts, leaving agentic setup relatively unexplored, both from capability and safety perspectives. Our work addresses this gap. We find that LLM agents could be sensitive to length, type, and placement of the context, exhibiting unexpected and inconsistent shifts in task performance and in refusals to execute harmful requests. Models with 1M-2M token context windows show severe degradation already at 100K tokens, with performance drops exceeding 50\% for both benign and harmful tasks. Refusal rates shift unpredictably: GPT-4.1-nano increases from $\sim$5\% to $\sim$40\% while Grok 4 Fast decreases from $\sim$80\% to $\sim$10\% at 200K tokens. Our work shows potential safety issues with agents operating on longer context and opens additional questions on the current metrics and paradigm for evaluating LLM agent safety on long multi-step tasks. In particular, our results on LLM agents reveal a notable divergence in both capability and safety performance compared to prior evaluations of LLMs on similar criteria.

cs.LG↗

arXiv2025

Multi-Turn Jailbreaks Are Simpler Than They Seem

While defenses against single-turn jailbreak attacks on Large Language Models (LLMs) have improved significantly, multi-turn jailbreaks remain a persistent vulnerability, often achieving success rates exceeding 70% against models optimized for single-turn protection. This work presents an empirical analysis of automated multi-turn jailbreak attacks across state-of-the-art models including GPT-4, Claude, and Gemini variants, using the StrongREJECT benchmark. Our findings challenge the perceived sophistication of multi-turn attacks: when accounting for the attacker's ability to learn from how models refuse harmful requests, multi-turn jailbreaking approaches are approximately equivalent to simply resampling single-turn attacks multiple times. Moreover, attack success is correlated among similar models, making it easier to jailbreak newly released ones. Additionally, for reasoning models, we find surprisingly that higher reasoning effort often leads to higher attack success rates. Our results have important implications for AI safety evaluation and the design of jailbreak-resistant systems. We release the source code at https://github.com/diogo-cruz/multi_turn_simpler

cs.LG↗

arXiv2025

Prompt Attacks Reveal Superficial Knowledge Removal in Unlearning Methods

In this work, we demonstrate that certain machine unlearning methods may fail under straightforward prompt attacks. We systematically evaluate eight unlearning techniques across three model families using output-based, logit-based, and probe analysis to assess the extent to which supposedly unlearned knowledge can be retrieved. While methods like RMU and TAR exhibit robust unlearning, ELM remains vulnerable to specific prompt attacks (e.g., prepending Hindi filler text to the original prompt recovers 57.3% accuracy). Our logit analysis further indicates that unlearned models are unlikely to hide knowledge through changes in answer formatting, given the strong correlation between output and logit accuracy. These findings challenge prevailing assumptions about unlearning effectiveness and highlight the need for evaluation frameworks that can reliably distinguish between genuine knowledge removal and superficial output suppression. To facilitate further research, we publicly release our evaluation framework to easily evaluate prompting techniques to retrieve unlearned knowledge.

cs.CR↗

arXiv2025

Understanding the learned look-ahead behavior of chess neural networks

We investigate the look-ahead capabilities of chess-playing neural networks, specifically focusing on the Leela Chess Zero policy network. We build on the work of Jenner et al. (2024) by analyzing the model's ability to consider future moves and alternative sequences beyond the immediate next move. Our findings reveal that the network's look-ahead behavior is highly context-dependent, varying significantly based on the specific chess position. We demonstrate that the model can process information about board states up to seven moves ahead, utilizing similar internal mechanisms across different future time steps. Additionally, we provide evidence that the network considers multiple possible move sequences rather than focusing on a single line of play. These results offer new insights into the emergence of sophisticated look-ahead capabilities in neural networks trained on strategic tasks, contributing to our understanding of AI reasoning in complex domains. Our work also showcases the effectiveness of interpretability techniques in uncovering cognitive-like processes in artificial intelligence systems.

cs.AI↗

arXiv2024

Fault-tolerant noise guessing decoding of quantum random codes

This work addresses the open question of implementing fault-tolerant QRLCs with feasible computational overhead. We present a new decoder for quantum random linear codes (QRLCs) capable of dealing with imperfect decoding operations. A first approach, introduced by Cruz et al., only considered channel errors, and perfect gates at the decoder. Here, we analyze the fault-tolerant characteristics of QRLCs with a new noise-guessing decoding technique, when considering preparation, measurement, and gate errors in the syndrome extraction procedure, while also accounting for error degeneracy. Our findings indicate a threshold error rate ($\pth$) of approximately $\pnum$ in the asymptotic limit, while considering realistic noise levels in the mentioned physical procedures.

quant-ph↗

arXiv2023

Improving fidelity of multi-qubit gates using hardware-level pulse parallelization

Quantum computation holds the promise of solving computational problems which are believed to be classically intractable. However, in practice, quantum devices are still limited by their relatively short coherence times and imperfect circuit-hardware mapping. In this work, we present the parallelization of pre-calibrated pulses at the hardware level as an easy-to-implement strategy to optimize quantum gates. Focusing on $R_{ZX}$ gates, we demonstrate that such parallelization leads to improved fidelity and gate time reduction, when compared to serial concatenation. As measured by Cycle Benchmarking, our most modest fidelity gain was from 98.16(7)% to 99.15(3)% for the application of two $R_{ZX}(π/2)$ gates with one shared qubit. We show that this strategy can be applied to other gates like the CNOT and CZ, and it may benefit tasks such as Hamiltonian simulation problems, amplitude amplification, and error-correction codes.

quant-ph↗

arXiv2023

Super-resolution of Green's functions on noisy quantum computers

Quantum computers, using efficient Hamiltonian evolution routines, have the potential to simulate Green's functions of classically-intractable quantum systems. However, the decoherence errors of near-term quantum processors prohibit large evolution times, posing limits to the spectrum resolution. In this work, we show that Atomic Norm Minimization, a well-known super-resolution technique, can significantly reduce the minimum circuit depth for accurate spectrum reconstruction. We demonstrate this technique by recovering the spectral function of an impurity model from measurements of its Green's function on an IBM quantum computer. The reconstruction error with the Atomic Norm Minimization is one order of magnitude smaller than with more standard signal processing methods. Super-resolution methods can facilitate the simulation of large and previously unexplored quantum systems, and may constitute a useful non-variational tool to establish a quantum advantage in a nearer future.

quant-ph↗

arXiv2023

Reinforcement Learning Fine-tuning of Language Models is Biased Towards More Extractable Features

Many capable large language models (LLMs) are developed via self-supervised pre-training followed by a reinforcement-learning fine-tuning phase, often based on human or AI feedback. During this stage, models may be guided by their inductive biases to rely on simpler features which may be easier to extract, at a cost to robustness and generalisation. We investigate whether principles governing inductive biases in the supervised fine-tuning of LLMs also apply when the fine-tuning process uses reinforcement learning. Following Lovering et al (2021), we test two hypotheses: that features more $\textit{extractable}$ after pre-training are more likely to be utilised by the final policy, and that the evidence for/against a feature predicts whether it will be utilised. Through controlled experiments on synthetic and natural language tasks, we find statistically significant correlations which constitute strong evidence for these hypotheses.

cs.LG↗

arXiv2023

Efficient entanglement purification based on noise guessing decoding

In this paper, we propose a novel bipartite entanglement purification protocol built upon hashing and upon the guessing random additive noise decoding (GRAND) approach recently devised for classical error correction codes. Our protocol offers substantial advantages over existing hashing protocols, requiring fewer qubits for purification, achieving higher fidelities, and delivering better yields with reduced computational costs. We provide numerical and semi-analytical results to corroborate our findings and provide a detailed comparison with the hashing protocol of Bennet et al. Although that pioneering work devised performance bounds, it did not offer an explicit construction for implementation. The present work fills that gap, offering both an explicit and more efficient purification method. We demonstrate that our protocol is capable of purifying states with noise on the order of 10% per Bell pair even with a small ensemble of 16 pairs. The work explores a measurement-based implementation of the protocol to address practical setups with noise. This work opens the path to practical and efficient entanglement purification using hashing-based methods with feasible computational costs. Compared to the original hashing protocol, the proposed method can achieve some desired fidelity with a number of initial resources up to one hundred times smaller. Therefore, the proposed method seems well-fit for future quantum networks with a limited number of resources and entails a relatively low computational overhead.

quant-ph↗

arXiv2023

Quantum Error Correction via Noise Guessing Decoding

Quantum error correction codes (QECCs) play a central role in both quantum communications and quantum computation. Practical quantum error correction codes, such as stabilizer codes, are generally structured to suit a specific use, and present rigid code lengths and code rates. This paper shows that it is possible to both construct and decode QECCs that can attain the maximum performance of the finite blocklength regime, for any chosen code length when the code rate is sufficiently high. A recently proposed strategy for decoding classical codes called GRAND (guessing random additive noise decoding) opened doors to efficiently decode classical random linear codes (RLCs) performing near the maximum rate of the finite blocklength regime. By using noise statistics, GRAND is a noise-centric efficient universal decoder for classical codes, provided that a simple code membership test exists. These conditions are particularly suitable for quantum systems, and therefore the paper extends these concepts to quantum random linear codes (QRLCs), which were known to be possible to construct but whose decoding was not yet feasible. By combining QRLCs and a newly proposed quantum-GRAND, this work shows that it is possible to decode QECCs that are easy to adapt to changing conditions. The paper starts by assessing the minimum number of gates in the coding circuit needed to reach the QRLCs' asymptotic performance, and subsequently proposes a quantum-GRAND algorithm that makes use of quantum noise statistics, not only to build an adaptive code membership test, but also to efficiently implement syndrome decoding.

quant-ph↗

arXiv2023

A Living Review of Quantum Computing for Plasma Physics

Quantum Computing promises accelerated simulation of certain classes of problems, in particular in plasma physics. Given the nascent interest in applying quantum computing techniques to study plasma systems, a compendium of the relevant literature would be most useful. As a novel field, new results are common, and it is important for researchers to stay up-to-date on the latest developments. With this in mind, the goal of this document is to provide a regularly up-to-date and thorough list of citations for those developing and applying these quantum computing approaches to experimental or theoretical work in plasma physics. As a living document, it will be updated as often as possible to incorporate the latest developments. References are grouped by topic, both in itemized format and through the use of tags. We provide instructions on how to participate, and suggestions are welcome.

physics.plasm-ph↗

arXiv2018

Efficient quantum algorithms for $GHZ$ and $W$ states, and implementation on the IBM quantum computer

We propose efficient algorithms with logarithmic step complexities for the generation of entangled $GHZ_N$ and $W_N$ states useful for quantum networks, and we demonstrate an implementation on the IBM quantum computer up to $N=16$. Improved quality is then investigated using full quantum tomography for low-$N$ GHZ and W states. This is completed by parity oscillations and histogram distance for large $N$ GHZ and W states respectively. We are capable to robustly build states with about twice the number of quantum bits which were previously achieved. Finally we attempt quantum error correction on GHZ using recent schemes proposed in the literature, but with the present amount of decoherence they prove detrimental.

quant-ph↗