arXiv subjects

Tasfia Nuzhat Ornee

Publications and source records attributed to Tasfia Nuzhat Ornee.

4 recordsLinked to original sources

arXiv2026

ChannelGuard: From Borrowed Safety to Application-Controlled Defenses in Multi-Agent LLMs

AI assistants increasingly work as teams, where one model makes a plan, others search the web, use tools, or read stored information, and another writes the final answer. This creates new security risks because harmful instructions can enter through information passed between models, not just through the user's message. Yet safety tests usually report only whether an attack succeeded, without showing what actually stopped it. We show that systems with similar safety scores can depend on very different protections. Across five agent models, attacks were stopped by a cloud provider's filter, by the model itself, or by inconsistent model behavior. This matters because protection that comes from the model or provider may disappear when either one changes. We introduce CHANNELGUARD, an application-controlled defense that checks information at each handoff without extra training or additional model calls. Across more than 5,700 test runs, it stopped all tested attacks hidden in tool outputs on all five models. On two open models, it reduced successful prompt attacks from 80% to 3% and from 77% to 10%, with no change in accuracy on 30 math problems. However, reworded attacks could still bypass the defense.

cs.CR↗

arXiv2026

Right Knowledge, Wrong Answer: Characterizing Parametric Temporal Conflict in Open-Weight Language Models

Language models may encode both outdated facts and their newer replacements. We introduce Parametric Temporal Conflict (PTC), where the newer fact is present and recoverable, but the default forward pass prefers the outdated one. We release a deterministically verified benchmark of 8,746 Wikidata position-holder transitions and evaluate four open-weight language models across three families. A date-prefix prompt recovers the newer fact in 61-81% of PTC cases. Activation patching flips predictions in 72-85% of cases and localizes the preference to model-specific upper-layer regions. Residual-stream steering outperforms norm-matched random directions, indicating direction-specific representations. These results show that PTC reflects a localized representational preference rather than missing knowledge. Recovery is measured on oracle-identified conflicts because automatic detection remains unreliable. We release the benchmark, code, and statistics.

cs.LG↗

arXiv2026

MotifRole-Diff: Risk-Optimal Role-Aware Corruption for Masked Molecular Graph Diffusion

Masked discrete diffusion for molecular graph generation typically applies a uniform corruption schedule to all tokens in a lossless graph-to-sequence representation, implicitly treating structurally heterogeneous molecular components as equally difficult and equally important to reconstruct. However, different molecular graph token roles exhibit substantial variation in denoising difficulty and their influence on the decoded molecule, motivating role-specific corruption strategies. We introduce MotifRole-Diff, a role-aware corruption process that allocates masking rates according to empirically measured denoising difficulty and graph-level perturbation impact while preserving the model architecture, clean sequence space, and lossless molecular-graph decoder. We formulate schedule selection as the risk-optimal allocation of a fixed masking budget across token roles. Our theorem characterizes optimality for the modeled role-weighted residual risk, while downstream generation performance is evaluated empirically. Under matched architecture, training budget, and sampling compute, MotifRole-Diff improves validity on QM9 from 0.905 to 0.944 while reducing FCD from 1.701 to 1.609, and on MOSES improves validity from 0.920 to 0.938 while reducing FCD from 2.125 to 1.850. Role-wise diagnostics further show improved reconstruction across molecular graph token categories. Together, these matched-compute results indicate that structurally informed corruption is a more effective masking strategy than uniform schedules for serialized molecular graph diffusion.

cs.LG↗

arXiv2026

NEXUS: Structured Runtime Safety for Tool-Using LLM Agents

Tool-using LLM agents increasingly execute high-impact actions, making runtime safety monitoring essential. We present NEXUS (Neural EXecution Utility and Safety), a structured-plan safety monitor that applies a formal intervention policy to select among four actions: allow, block, request confirmation, or request revision. NEXUS combines deterministic safety rules, argument-level inspection, and a calibrated logistic-regression risk score for graded escalation. On a 128-instance synthetic benchmark, NEXUS achieves an F1 score of 0.949 and a 4-class intervention accuracy of 0.6406, outperforming rule-only intervention selection by 27.3 percentage points. It also improves over rule-only on R-Judge (F1 = 0.861 vs. 0.849), matches rule-only on AgentHarm due to threat-model limits, and achieves 0% ASR at 99% control allow on IPI. On the rule-blind NEXUS-Stress benchmark, NEXUS reaches an F1 score of 0.881, highlighting the difficulty of fine-grained intervention routing. With 0.205 ms median latency, NEXUS adds under 0.1% overhead to typical agent loops. Code, benchmarks, and the calibrated risk scorer are publicly released.

cs.AI↗