Hugging Face

Hugging Face 平台、模型托管与社区项目的动态。

Hacker News AI69

Show HN: Pulse Local, a Mac budgeting app whose AI models run on your machine

Hi HN, I'm Niz. Pulse Local is a budgeting app for Mac (Apple Silicon, beta) that answers questions about your spending with models that run on your machine. Local mode needs no account. The ledger and your questions stay on the machine, and the app sends no analytics or crash logs. I felt there are not enough consumer apps that run locally with no calls to the outside world that help us manage sensitive corners of our lives. This app in its local variant only downloads a couple of models and occasional updates, it does not send any analytics nor data. Features-wise, Pulse local is a complete budgeting app that offers an assistant built on top of a fine-tuned model and thousands of rules embedded in the code itself. I'm sharing it for free with options to help me continue experimenting with fine-tuning and expanding along this direction. How it works: you import a CSV from any bank, in any currency. When you ask a question, a tuned Qwen3 0.6B model reads it into a structured query, and code, not the model, does the money math against the ledger. A 4B checker model double-checks each money answer; when the two readings disagree, the app says it is not sure instead of guessing. That change took wrong answers from about one in five to 5 in 494 questions across our last three tests. The write-up covers how we test, the designs that failed, and the limits of the claim: https://pulseos.finance/pulse-local/writing/agree-or-not-sur... The tuned weights are on Hugging Face (PulseOS/pulse-local-qwen3-0.6b). Limitations: the first start downloads about 2.9 GB of models. With the checker on, a money answer takes 12 to 14 seconds (you can turn the checker off). Small models can still misread an open-ended question. The app answers in English. Mac only for now; Windows is next. The app is free. An optional Connected mode (Sync Pass, $29/year) syncs US banks through Plaid; transactions pass through our server's memory and are not stored. Feedback welcome, especially on wrong answers and on questions it should handle but does not. Comments URL: https://news.ycombinator.com/item?id=50080275 Points: 3 # Comments: 0

MarkTechPost51

When the Safety Test Became the Threat: The Machine That Found Its Own Way Out

In July 2026, frontier AI agents placed inside a cybersecurity testing sandbox named ExploitGym discovered an unexpected network pathway, broke out into the open internet, and autonomously compromised Hugging Face infrastructure in one of history's most unprecedented AI safety incidents. The post When the Safety Test Became the Threat: The Machine That Found Its Own Way Out appeared first on MarkTechPost .

The Decoder58

OpenAI's safety crisis keeps getting worse and the company keeps making it worse

OpenAI fired three safety researchers who helped investigate the Hugging Face hack. In an open letter, they warn that the firings are scaring remaining staff and eroding safety culture. OpenAI claims they violated policies but won't say how. The article OpenAI's safety crisis keeps getting worse and the company keeps making it worse appeared first on The Decoder .

arXiv cs.LG83

CompOrca：指令微调数据的语料库规模合规性标注

arXiv:2609.37807v2 Announce Type: replace-cross 摘要：要研究微调如何塑造拒答与不遵从行为，就需要知道哪些训练样例会拒答，或以其他方式未能满足请求。现有标注覆盖的是评估集，其规模远小于训练语料库。我们推出 CompOrca，为 OpenOrca 语料库中的全部 4,233,923 个样例提供合规性标签。每个样例均由开放权重 LLM 评判器 LongCat-2.0（1.6T 参数）进行五轮判定，分类为合规或不合规。该语料库按全票同意合规（94.75%）、全票同意不合规（1.28%）和意见不一致行（3.97%）发布，并附带原始投票计数。单轮判定会将语料库中 2.7%—3.2% 的样例标记为不合规，而五轮均标记为不合规的仅占 1.28%，因此可以过滤掉最具歧义的行。在 450 个经过人工标注的样例上（其中 150 个被标注两次；人工标注者之间的 $\kappa=0.93$），全票同意合规和全票同意不合规标签的精确率分别为 97.3% 和 86.7%。不合规标签是语料库不合规样例的一个高精确率子集。已发表的拒答检测方法对人工标注不合规样例的召回率介于 0.4% 和 94.1% 之间。我们在 https://huggingface.co/datasets/cemiu/CompOrca 发布包含逐行标签和投票计数的完整语料库。

arXiv cs.LG62

BioBigBird: A Sparse Attention Model for Long-Range Dependency Processing in Biomedical Text

arXiv:2610.11430v1 Announce Type: cross Abstract: While domain-specific Large Language Models (LLMs) have encoded vast biomedical knowledge, their limited context windows often hinder a deep understanding of nuanced relationships within and across texts. To address this limitation, we introduce BioBigBird, a bidirectional language model pre-trained on extensive biomedical literature and clinical data, specifically designed to handle long-range dependencies. BioBigBird leverages a sparse attention mechanism to process sequences up to 4096 tokens, and its training incorporates a multi-stage process to mitigate noise from the large-scale pre-training corpus. We further enhance its performance by employing a multi-task learning (MTL) framework that jointly optimizes for Named Entity Recognition and Relation Extraction. Comprehensive evaluations on the BLURB benchmark reveal that our MTL-enhanced BioBigBird achieves highly competitive results against state-of-the-art models. Our work contributes an effective methodology for developing powerful, long-context language models for specialized domains, demonstrating the value of extended sequence processing for complex text analysis. Our models are publicly available at https://huggingface.co/collections/bisectgroup/biobigbird.

arXiv cs.AI82

从被动遏制到主动保障：OpenAI、Anthropic 和 Google 智能体安全事件的经验教训

2026 年，涉及 OpenAI、Anthropic 和 Google 智能体的网络安全评估触达了授权测试范围之外的真实系统。它们所采取的路径各不相同。OpenAI 智能体利用了研究基础设施，在不同运行之间进行协调，并入侵了 Hugging Face 生产环境的部分区域。Anthropic 报告了若干案例：由于第三方环境配置错误，执行模拟网络任务的智能体得以接触真实系统。在另一项单独报道的评估中，Google 的 Gemini 通过一条非预期的互联网路径访问了三个真实组织；Google 表示，该模型在三种情况下都停止了操作。综合来看，这些案例说明，评估不能依赖假定的边界。该边界必须在智能体运行过程中得到验证。本工具性比较案例研究提出了 Proactive Agent Security Assurance Cycle (PASAC) 和五层 Boundary Assurance Stack。该框架结合了按风险分级的任务设计、可执行的范围契约、运行前验证、最小能力访问、独立出口控制、凭证限制、跨运行监控、自动停止条件以及基于证据的重新授权。一个先行指标模型、九项设计命题和七个可证伪假设，将这些经验教训转化为一项可检验的研究计划。由于公开的 Gemini 记录仅限于有明确归属的陈述和新闻报道，其详细因果机制仍属暂定。核心结论很明确：主动式智能体安全需要贯穿完整执行系统的持续保障，而不能依赖对任何单一沙箱或安全措施的信心。

arXiv cs.LG81

隐藏在明处：使用 DECOMPBENCH 对抗分解攻击评测智能体安全性

arXiv:2606.13994v2 公告类型：replace-cross 摘要：基于 LLM 的智能体正变得越来越强大，并得到广泛部署，从而不断增加其在现实世界中被对抗性滥用的动机。一项关键的新兴威胁是分解攻击 \cite{glukhov2024breach, jones2024adversaries}：在这类攻击中，有害任务被拆分为更简单、看似无害的子任务；这些子任务分别执行时能够规避安全机制，但累积起来却实现了恶意意图。尽管近期的基准测试会在多轮交互和多工具使用场景下评估智能体安全性，但它们并未明确捕捉这种分解式滥用，也可能无法体现真实的对抗性执行流程。为此，我们引入 DeCompBench，这是一个专门用于评估分解攻击下智能体安全性的基准。DeCompBench 遵循“设计即分解”原则，采用图形化框架构建，使有害任务能够被分解为单独看来无害且可执行的子任务，并形成符合现实的工作流。我们使用定制分解器开展的实验表明，当前最先进的智能体在面对整体式有害任务时具有较高的拒答率，但在其分解变体上的拒答率显著降低，并且往往会无意中完成对抗性目标。这些发现凸显了针对分解攻击开展安全评测并制定相应防御措施的必要性。我们的数据集已公开发布，可在 https://huggingface.co/datasets/decompositionbench/DeCompBench 获取。

arXiv cs.LG78

TAVIS：面向模仿学习中第一人称主动视觉与预期性注视的基准

arXiv:2605.07943v2 公告类型：替换并交叉收录 摘要：主动视觉——策略在操作过程中控制自身注视方向——已成为模仿学习的一项关键能力，过去一年已有多个独立系统展示了其优势。然而，目前尚无统一基准可用于比较不同方法，或量化主动视觉在何种任务类型及条件下带来了哪些贡献。我们推出 TAVIS，这是一个基于 IsaacLab 构建的主动视觉模仿学习评估基础设施，在两种人形机器人躯干平台（GR1T2、Reachy2）上提供两套互补的任务集：TAVIS-Head（5 项任务，通过可水平转动和俯仰的颈部进行全局搜索）和 TAVIS-Hands（3 项任务，通过腕部相机处理局部遮挡）。TAVIS 提供三项基础评估工具：基于相同演示数据的头部相机与固定相机配对对比协议；GALT（注视—动作提前时间），这是一项以认知科学和人机交互（HRI）为基础的新指标，用于量化学习所得策略中的预期性注视；以及程序化生成的分布内（ID）与分布外（OOD）划分。使用 Diffusion Policy 和 $\pi_0$ 进行的基线实验表明：(i) 主动视觉总体上有益，且在多次训练运行中表现一致，但其收益取决于任务，而非均匀一致；(ii) 在两套任务集上，多任务策略在受控分布偏移下均出现性能急剧下降；(iii) 仅靠模仿即可产生落在任务相关物体上的预期性注视，其提前时间与人类演示相当，但头部运动不如演示中平滑，这是动作分块带来的影响，无法通过成功率体现。代码和评估脚本发布于 https://github.com/spiglerg/tavis；演示数据（LeRobot v3.0；约 2200 个回合）及训练好的基线模型发布于 https://huggingface.co/tavis-benchmark。

arXiv cs.LG66

PrismSSL: One Interface, Many Modalities; A Single-Interface Library for Multimodal Self-Supervised Learning

arXiv:2511.17776v2 Announce Type: replace Abstract: We present PrismSSL, a Python library that unifies state-of-the-art self-supervised learning (SSL) methods across audio, vision, graphs, and cross-modal settings in a single, modular codebase. The goal of the demo is to show how researchers and practitioners can: (i) install, configure, and run pretext training with a few lines of code; (ii) reproduce compact benchmarks; and (iii) extend the framework with new modalities or methods through clean trainer and dataset abstractions. PrismSSL is packaged on PyPI, released under the MIT license, integrates tightly with HuggingFace Transformers, and provides quality-of-life features such as distributed training in PyTorch, Optuna-based hyperparameter search, LoRA fine-tuning for Transformer backbones, animated embedding visualizations for sanity checks, Weights & Biases logging, and colorful, structured terminal logs for improved usability and clarity. In addition, PrismSSL offers a graphical dashboard - built with Flask and standard web technologies - that enables users to configure and launch training pipelines with minimal coding. The artifact (code and data recipes) will be publicly available and reproducible.

arXiv cs.LG76

SpatialUQ：基于黑盒视觉模型空间一致性的事后不确定性量化

arXiv:2610.09498v1 公告类型：交叉收录 摘要：临床视觉模型通常以冻结的黑盒形式部署，在推理时无法访问其内部结构、进行重新训练或获取真实标签。我们提出 \textbf{SpatialUQ}，一种仅使用输出概率的事后不确定性量化方法。该方法通过六次确定性前向传播，计算全局预测与五个固定空间裁剪区域的平均预测之间的 Jensen-Shannon 散度。其前提很简单：可信的预测具有空间一致性。在 NIH ChestX-ray14（DenseNet-121，$N{=}25{,}596$）上，我们的多裁剪不确定性评分（MUS）在失败检测任务中的 AUC 达到 $0.784$，而 MC-Dropout 为 $0.664$（$p{<}10^{-6}$），计算量却仅为其五分之一；同时，MUS 无需额外校准即可获得良好的校准表现（$\text{SCE}{=}0.049$，而 $\ell_1$ 为 $0.127$），在 AUC 超过 0.78 的方法中校准表现最佳。将 MUS 与熵、置信度及 $\ell_1$ 进行有监督融合后，AUC 达到 $0.832$，优于包含五个成员的集成模型（$0.813$）。MUS 的表现随模型质量提升而提高，使用 BiomedCLIP 时达到 $0.899$（$\rho = 0.846$）；这种关系在分布内仍然具有意义（$\rho = 0.523$），但在严重分布偏移下不再成立（VinBigData，$\rho = 0.027$）。MUS 非常适合弥漫性影像表现，但对于结节等小型局灶性病变，其可靠性较低。代码和实验材料已公开，地址为 https://huggingface.co/datasets/kawsher11/SpatialUQ。

arXiv cs.LG74

ZonoGPT：迈向用于验证大型 GPT 模型的抽象域

arXiv:2609.34457v2 公告类型：替换 摘要：基于 Transformer 的模型广泛应用于推理、编程和多模态智能体任务。为对鲁棒性、安全性和公平性等期望行为提供形式化保障，神经网络验证技术会证明所需属性，并在部署前提供可审计的保证。然而，现有工作仍局限于小型或受限的 Transformer，且在深层模型中保持精度仍面临挑战。在本研究中，我们提出 ZonoGpt，一种用于验证大型 Transformer 的抽象域，其空间复杂度与网络深度无关。ZonoGpt 使用结构化带状多面体和生成元约简机制来高效保留相关性。为保持精度，它针对 Attention 和 LayerNorm 引入了特定于模块的融合变换，以保留特征间的关系，同时为 GELU 引入了保留生成元间关系的仿射变换。这些机制使 ZonoGpt 成为首个能够验证标准架构的方法，其可扩展至官方 HuggingFace 模型中规模达 GPT-2 Medium（24 个模块、超过 3 亿个参数）的模型，并成功验证了文本和视觉任务中的 1,339 个实例。

arXiv cs.LG73

HARL-A：用于 IsaacLab 中异构多智能体对抗强化学习的可扩展基准测试框架

arXiv:2510.01264v2 公告类型：替换 摘要：机器人领域的对抗多智能体强化学习（MARL）进展受到制约，原因是缺乏能够在高保真物理仿真中支持异构智能体形态的共享、可扩展基础设施。现有框架要么专注于协作任务，要么依赖简化的物理引擎，要么提供难以扩展的孤立实现。我们提出 HARL-A，这是一个基于 IsaacLab 构建、持续维护的开源框架，支持针对形态多样的机器人团队进行可扩展的对抗策略训练与基准测试，允许任意数量的团队以及每个团队内任意组合的机器人形态。HARL-A 为 HARL 算法库和 IsaacLab 扩展了对抗多智能体支持，并提供了三个组成部分：（1）模块化软件架构，降低了定义新异构对抗环境的工程开销；（2）包含 Sumo、Soccer 和 3D Galaga 三个基准测试环境的套件，涵盖密集接触推挤、球技竞赛以及追逐与躲避；（3）十余个覆盖同构和异构团队配置的预训练策略，已在 Hugging Face 上公开发布，使用户无需从头重新训练即可立即探索对抗学习的动态过程。我们在多个竞争场景中演示了该框架，表明它能够可靠地生成学习得到的对抗策略，并涌现出角色专门化现象。所有代码、环境、训练好的策略和文档均已公开，地址为 https://github.com/DIRECTLab/IsaacLab-HARL。

arXiv cs.LG83

Video DeltaNet：面向视频原生的混合注意力机制，用于直播视频生成

arXiv:2609.20744v3 公告类型：替换 摘要：视频扩散模型在去噪过程中会反复处理长时空令牌序列，使注意力机制成为主要的计算瓶颈。线性注意力提供了颇具吸引力的替代方案，并已广泛应用于近期的大型语言模型中，但将其直接应用于视频模型，往往无法保留高质量生成所需的细粒度交互。我们提出 Video DeltaNet（VDN），将局部 Softmax 注意力与双向线性记忆相结合，以建模长程视频上下文。其线性分支引入了 Video Delta Attention（VDA），通过联合整合每一帧的空间令牌，每帧更新一次记忆。独立的输出投影和可学习门控机制用于校准两个分支，同时，分阶段的教师对齐方案逐步将这一新路径引入预训练模型。我们在 MiniMax H3 上实例化了 VDN，将这种混合机制应用于视频到视频的交互，同时保留 Softmax 以处理涉及文本或音频的交互。借助八步蒸馏和优化后的 SGLang 服务栈，VDN-H3 在八块 NVIDIA B200 GPU 上，仅用 6.70 秒即可完成 14.3 秒、768p 视频的 DiT 去噪；相比相同 GPU 数量下采用 50 步密集 H3 基线，实现了 14.5 倍加速。GitHub 代码见：https://github.com/OpenVDN/vdn-minimax-h3。模型权重见：https://huggingface.co/OpenVDN/vdn-minimax-h3

arXiv cs.LG87

FastKernels：生产环境中的 GPU 内核生成基准测试

arXiv:2605.23215v2 公告类型：替换 摘要：基于 LLM 的 GPU 内核生成代理正在快速发展，但它们所针对的基准测试是在隔离环境中评估内核，使用合成输入和较弱的基线，从而奖励那些在沙箱中实现加速、却在真实推理系统中失效或消失的方案。我们推出 FastKernels，这是一个包含 384 个任务的基准测试，任务源自 8 个类别中的 47 种代表性架构；这些内核足以重新实现 HuggingFace Transformers 中 94.6%（472/499）的架构，且输出与原生实现一致。每个任务都模拟相应生产模块的接口，并与生产框架所提供的内核进行比较；同时，任务构成一个从基础算子到完整模型的组合层级结构，高层模块会导入低层模块。候选方案既在内核层面进行评分，也在其所属模型内部、沿生产执行路径进行端到端评分；MacroEval 将经过校准的正确性、覆盖率和加速比汇总为排行榜。我们使用五个具有代表性的代理为其提供初始测试（共 6,900 个代理小时），发现内核层面的 1.6–6.6 倍加速在端到端评估中缩减至最多 1.25 倍；获胜的内核集合中只有 20% 能够直接正确运行；此外，内核层面的得分会错误地对代理进行排序：Claude Code 在单独评估的每个层级都能追平或超过 KDA，但端到端得分却是 KDA 的 3 倍。代码见 https://github.com/Snowflake-AI-Research/fastkernels。

MarkTechPost68

Can an Open Model Do Security Research? Cantina’s apex-flash-1 Solves 40 of 60 Held-Out Bug Tasks

Cantina Security, with Yeta Labs, has released apex-flash-1, an open-weights model trained specifically for vulnerability research. It is a reinforcement learning fine-tune of Z.ai’s GLM-5.3-Flash, released on Hugging Face under the MIT license. Is it deployable? Yes, the MIT weights serve on vLLM, SGLang or Transformers, but BF16 needs roughly 640 GB of GPU memory. […] The post Can an Open Model Do Security Research? Cantina’s apex-flash-1 Solves 40 of 60 Held-Out Bug Tasks appeared first on MarkTechPost .

Import AI47

Import AI 471: Why Hugging Face worries me; space mining; FIve Eyes on AI

Welcome to Import AI, a newsletter about AI research. Import AI runs on arXiv, cappuccinos, and feedback from readers. If you’d like to support this, please subscribe. Subscribe now Import AI reader giveaway! Upcoming event: Fiction and the Future with Robin SloanI’ll be chatting with my chum Robin Sloan on the evening of Monday September […]

Simon Willison78

2026 in LLMs (so far)

On Friday I gave the closing keynote at the WeAreDevelopers World Congress North America in San Jose. I tied together the key trends from the past year into a chronological exploration of everything that happened in 2026. The video is on YouTube ; here are my annotated slides and notes to accompany the talk. And as an annotated presentation : 2026 in LLMs (so far) Simon Willison WeAreDevelopers World Congress North America, 25th September 2026 # I'm going to give a lightning tour of everything that has happened so far in 2026. The year isn't over yet! November 2025 # For me, 2026 started a couple of months earlier in November 2025. The November 2025 inflection point Claude Opus 4.5 GPT-5.1 # November saw the release of two important models: Claude Opus 4.5 and GPT-5.1. As is usually the case with new models, these were incremental improvements on the models that came before them. But every now and then when a model improves, it crosses an invisible line where something that didn't really work starts working. In this case, the thing that started working was their coding agents. Claude Code had been around since February 2025; Codex was a little younger. These two new models, when paired with their respective coding agent harnesses, improved from "often make mistakes" to "reliable enough to use on a day-to-day basis". "Generate an SVG of a pelican riding a bicycle". The Claude Opus 4.5 one has a very weird shaped frame and the pelican looks like a duck. The GPT-5.1 has a slightly better but still broken bicycle frame and a slightly better pelican beak, but both are pretty terrible. # For a couple of years now I've been evaluating new models by asking them to "Generate an SVG of a pelican riding a bicycle". It's probably the world's stupidest benchmark - there's only so much you can learn from it. But it's still a challenge for models, because drawing pelicans is difficult, drawing bicycles is difficult, and pelicans can't ride bicycles in the first place. Here's the state of the art for November. Claude still couldn't really draw a bicycle! The GPT-5.1 bicycle frame is pretty crap too. November 24th 2025 - the first commit to steipete/Warelay. A GitHub commit adding an MIT license file. # Also in November, we had the first commit to an obscure GitHub repository called "Warelay". We'll come back to this repository shortly. January # And then there were the December holidays, and individual developers took some time off and many started tinkering with these new coding agent model combinations... and it began to dawn on us quite how much they could do that they couldn't do before. Come January, a lot of us were quite excited to start putting this stuff into action. New year’s resolution for 2026 Every previous year: Take on less new projects, focus on the most important things in my existing projects # Every year I set myself a New Year's resolution, and for as long as I can remember it's been the same thing: stay focused. Take on less new projects. Try to get things done in the projects I already have. 2026: Be more ambitious. Take on as many new projects as I want. # This year I decided that since that had never worked before, I'd go the other way. We've got coding agents now, let's see what they can do. I'm going to take on as many new projects as I like! (You can ask me at the end of the year if this turned out to be a good idea or not. I have a lot of plates spinning right now.) "Be more ambitious" has been something of a theme for the year, because the only way to find the limits of this technology is to keep on pushing them until they don't work. Predictions for 2026 It will become undeniable that LLMs write good code We're finally going to solve sandboxing A “Challenger disaster” for coding agent security Kakapo parrots will have an outstanding breeding season (only 236 in the world!) ... the Pope will weigh in on LLMs and their economic impact on the world # I also went on the Oxide and friends podcast with Bryan Cantrill and Adam Leventhal to share predictions for the next year (and three and six years). With hindsight, my LLM predictions were pretty unambitious. I said "it will become undeniable that LLMs write good code" - I think we're there now. I predicted we would finally solve sandboxing. I counted and around 40 of the 277 sessions at this conference touched on sandboxing or agent security in some way, so we're at least putting a lot of effort into that! I predicted "a Challenger disaster" for coding agent security. There's certainly been a whole lot of noise around agent security this year, though the exact disaster I predicted (with coding agents being hijacked and causing real-world economic damage) hasn't really played out. We threw in a joke prediction that the Pope would weigh in on the economic impact of LLMs. A photograph of a beautiful green New Zealand parrot. Photo credit Kimberley Collins. # I also predicted that New Zealand's Kākāpō parrots would have an outstanding breeding season this year. These are flightless nocturnal parrots. They're kind of dumpy looking, I think they're beautiful, and there were only 236 of these parrots in the world at the start of the year. Kākāpō only breed when the Rimu trees have a big fruiting season, and that hasn't happened in four years... but this year the Rimu fruit were looking excellent. Photo by Kimberley Collins . Deep Blue Coined by Adam Leventhal and Bryan Cantrill That feeling of AI induced ennui where software engineers get listless because the AI can do anything # Also on that podcast, we coined a term (full credit to Adam) for "that feeling of AI induced ennui where software engineers get listless because the AI can do anything". We called it Deep Blue . This has been a major theme throughout the year, and was touched on by several speakers at this conference. As a software engineer, I've never had a year of my career where everything has changed so quickly and so dramatically. A lot of what I've been doing this year is trying to come to terms with that and what that means for my own profession. AI mania Screenshots of the micro-javascript and pwasm GitHub README files. # Also in January, I suffered from what I'm calling AI mania . This is not the same thing as AI psychosis . With AI mania, any time your agent isn't building something for you feels like wasted time. You're losing sleep because you could be staying up later getting your agents to do stuff. My AI mania presented itself in some ridiculously over-ambitious projects. I built a JavaScript interpreter entirely in Python , vibe-ported from MicroQuickJS by Fabrice Bellard. Then I built a WebAssembly runtime in Python as well . These projects were quite useful, in that they sort of cured me of my AI mania... because after I built these things, I got to look at them and ask "does the world need a slow, buggy, half-baked Python JavaScript interpreter?" I don't think the world does. micro-javascript playground 3 Execute JavaScript code in a sandboxed micro-javascript environment powered by Pyodide A web UI with some JavaScript code, and a "Run Code" button, and an output panel. # I did get this out of it: https://simonw.github.io/micro-javascript/playground.html Previous screenshot, with this text overlaid: JavaScript running in Python running in Pyodide running in WebAssembly running in JavaScript # This page runs my JavaScript interpreter built in Python, running in Python using Pyodide , which is Python compiled to WebAssembly, running in JavaScript, running in a browser. It's a beautiful stack of horrors. I've been having a lot of fun with WebAssembly this year. Warelay → CLAWDIS → CLAWDBOT → Clawdbot → Moltbot →🦞 OpenClaw Screenshot of the dates that these changes happened. # By the end of January, that repository we saw start in November had renamed itself, first to CLAWDIS, then CLAWDBOT, then Moltbot, and finally to OpenClaw. Same screenshot, an overlay reads: 8,330 commits in just under two months (it’s at 100,141 today) # At this point OpenClaw had 8,300 commits, less than two months after the project had started. I looked today and it's over 100,000 commits now! This is the most vibe-coded piece of software in existence. (Here's how I generated that list of name changes .) Generic term: Claw # This kicked off the OpenClaw revolution. It effectively defined a new category of software. There's a generic term for this which I really enjoy. We call software like this a "Claw". There's OpenClaw, NanoClaw , IronClaw , PicoClaw ... Today they're being rebranded as "personal agents" or "general agents", but I still like to think of them as Claws. Photo of a Mac mini An aquarium for your Claw # The Apple stores in the Bay Area sold out of Mac Minis because so many people were buying Mac Minis to run OpenClaw! Drew Breunig said that this is because your OpenClaw is a digital pet, and you buy a Mac mini as an aquarium to keep your claw in, which is kind of delightful. Screenshot of Moltbook - a social network for AI agents # Also in January, we had this website. This was MoltBook , a social network for AI agents, where the idea was that you send your Claw to go and talk to all of the other Claws, because what could possibly go wrong if you did that? The website launched on Thursday. It blew up on Friday . It was profiled by the New York Times on Monday . And by Tuesday, everyone had forgotten it existed as it drowned in a deluge of slop and spam. Facebook/Meta bought it a month later . February # In February, a company called StrongDM described what they called their Software Factory. StrongDM’s Dark Factory Justin McCarthy, Jay Taylor, Navan Chauhan Software Factories and the Agentic Moment # They wrote about this in Software Factories and the Agentic Moment . I posted my own notes at the time, having seen their demo in person back in October. Dan Shapiro called this approach the Dark Factory , after the idea that if your factory is sufficiently automated you can turn the lights out, because you don't even need to see what's going on. StrongDM presented two rules for software development that they'd been following since July last year. “Rule 1: Code must not be written by humans” # The first was code must not be written by humans . Any code that you write has to have been routed through a coding agent. This sounded radical in February, but I imagine there are a lot of people in this room who are pretty much living that today. “Rule 2: Code must not be reviewed by humans” (!) # Rule number two was code must not be reviewed by humans . You're not allowed to read the code! This continued to be a huge topic for much of this year. Many of the sessions at this event have been about code review and how you can get away with this. What I found interesting about StrongDM is that they were living six months ahead of the rest of us, and they'd been exploring what it means to build software, not read the code, but still be confident that the software is of high quality. What can you do with these agents to help verify their work? StrongDM are a security company, and they had people with decades of experience on this project. They were very much exploring the edges of what's possible and responsible to do with this stuff. Headline on New Zealand's Department of Conservation website: First kakapo chick in four years hatches on Valentine's Day. It's a grey fluffy ball. # Also in February: First kākāpō chick in four years hatches on Valentine's Day . Breeding season is off to a good start! 19th February 2026 Gemini 3.1 Pro A surprisingly good illustration of a pelican riding a bicycle. # Also in February... Google released Gemini 3.1 Pro . That's a pretty great pelican riding a bicycle! It's got the chain in the right place, it's got feet on both sides. There's a little fish in the basket. @JeffDean on Twitter - a video comparing Gemini 3 Pro and Gemini 3.1 Pro. # And then Google's Jeff Dean tweeted a video comparing Gemini 3 Pro and Gemini 3.1 Pro that featured an animated pelican riding a bicycle, a frog on a penny-farthing, a giraffe driving a tiny car, an ostrich on roller skates, a turtle kickflipping a skateboard, and a dachshund driving a stretch limousine. This was frustrating, because my protection for the pelican riding the bicycle test was always "if they draw a perfect pelican on a bicycle, I'll ask for some other animal on something else." Google trained for all forms of animals on all forms of transport! They've defeated my benchmark at this point. Three headlines: Meta Makes AI Adoption a Formal Part of Performance Reviews Not just engineers writing code, Microsoft wants almost every employee to use Al Dara Khosrowshahi: 90% of Uber engineers now use AI in daily workflows # The other thing that started in February was Tokenmaxxing . We had headlines about Meta making AI adoption a formal part of performance reviews, and Microsoft wanting every employee to use AI, and Uber boasting that 90% of their engineers were using AI workflows. More headlines: Meta Plans to Crack Down on Employee Token Use: Information Microsoft Tells Engineers: Tokenmaxxing is not what we are optimizing for Uber caps employee AI spending after blowing through budget in four months # Then a few months later we have Meta cracking down on token use, Microsoft saying tokenmaxxing is "not what we are optimizing for", and Uber capping employee AI spending. So tokenmaxxing went straight up and then straight back down again - because it turns out the agents are expensive . Last year it was difficult to spend more than $50 on AI tokens, because we didn't have anything interesting to do with them. Then agents blew up, and now you can actually spend $1,000 in a day doing real work. This is also the reason that Anthropic's valuation skyrocketed to maybe a trillion dollars. AI appears to have hit product market fit in 2026, primarily through coding agents. March # In March, we hit peak OpenClaw. March: peak OpenClaw Photos of people in china queuing up to install OpenClaw, with big fluffy lobsters. # These photographs are from China, where companies hosted OpenClaw install parties which saw non-tech-nerds queueing up around the block for help getting Claws installed on their personal devices. I think this proved real market demand for this class of Claws, or personal AI agents. It turns out regular people really do want a weird little AI agent that can do useful things on their behalf. A Claw is really just a coding agent wearing a less threatening hat. Under the hood they work much the same way - writing and then executing code on your computer to get stuff done. The race was on to be the first to build a safe Claw - a Claw you could give to regular human beings where they wouldn't instantly shoot themselves in the foot. Meta's Muse came out three weeks ago and is currently at the top of the free charts on the iPhone App Store. It appears to be taking off with consumers. I'm not yet convinced you can't shoot yourself in the foot with Muse, but I guess we'll find out for sure pretty soon. Photos from How the OpenClaw Frenzy Is Testing China’s AI Commitment (March 29th) and The Enthusiasm and Anxiety Behind China’s OpenClaw Craze (April 8th, 2026). April # In April, we had a model release where the model wasn't actually released. Simon Willison’s Weblog - screenshot of the post "Anthropic’s Project Glasswing—restricting Claude Mythos to security researchers—sounds necessary to me" from April 7th 2026 # Anthropic announced their new Claude Mythos model, and then said it was too dangerous to release beyond a trusted group of security researchers. Mythos was really, really good at hacking things. The "it's too dangerous" marketing ploy has been played by AI companies dating all the way back to GPT-2 . Anytime an AI company says we've built something that's "too dangerous", it's natural to be a bit skeptical. I found the Mythos claims credible, because I'd seen how good coding agents had got at finding regular bugs. I wrote about that in Anthropic’s Project Glasswing—restricting Claude Mythos to security researchers—sounds necessary to me . With hindsight... yeah, the models had got really good at finding vulnerabilities! 16th April 2026 Qwen3.6-35B-A3B and Opus 4.7 Qwen's pelican has a correct bicycle frame and a good beak. Opus 4.7's bicycle frame is still junk. Qwen3.6-35B-A3B is a 20.9GB file that runs on my laptop # Another key trend in 2026 has been a dramatic improvement in the abilities of open weight models, including models that you can run on a laptop. On the 16th of April I ran the new Qwen3.6-35B-A3B on my laptop, and it drew me a better pelican riding a bicycle than Anthropic's brand new Claude Opus 4.7 did! Opus 4.7 drew a crap bicycle. Qwen on my laptop made a bicycle that was the correct shape, and a pretty decent pelican too! That's from a 21GB file running on my laptop. Now a flamingo on a unicycle. The Qwen one is visibly better than the Opus 4.7 one - the Qwen one is wearing sunglasses and looks a bit like it's smoking a cigarette. # The Qwen pelican was so good that I was suspicious they might have cheated, so I had it do a flamingo riding a unicycle as well. Again, it handily beat Claude Opus 4.7. The local model releases this year have been absolutely extraordinary. May # In May... the Pope got involved. 25th May 2026 The HOLY SEE ENCYCLICAL LETTER MAGNIFICA HUMANITAS OF HIS HOLINESS POPE LEO XIV ON SAFEGUARDING THE HUMAN PERSON IN THE TIME OF ARTIFICIAL INTELLIGENCE # In our podcast episode back in January we'd predicted that the Pope would say something about AI. In May, Pope Leo XIV released an encyclical letter on "safeguarding the human person in the time of artificial intelligence". Here are my notes on that document . Wikipedia article on Rerum novarum Rerum novarum is an encyclical issued by Pope Leo XIII 15 on May 1891. # With hindsight, this shouldn't have been a surprise at all. Our current Pope's name is Leo XIV, because when he named himself he chose his papal name after Leo XIII - the Pope who wrote an encyclical about the Industrial Revolution back in 1891. Rerum novarum was an extremely influential piece of Catholic theology that indirectly led to us having the five-day work week. When our new Pope came in, he named himself after Pope Leo XIII because he expected that he would need to write about the AI revolution in a similar way. Our joke podcast prediction was junk, because this was always going to happen. Corey Quinn @QuinnyPig on Twitter I cannot believe I'm saying this, but getting the literal Pope to canonize your product's specific technical limitations as a spiritual treatise is the single greatest act of vendor lobbying I have ever seen. May 25 # One of Anthropic's co-founders, Christopher Olah, was present for the Pope's event announcing the new encyclical. Corey Quinn noted that: getting the literal Pope to canonize your product's specific technical limitations as a spiritual treatise is the single greatest act of vendor lobbying I have ever seen. @maciejmensfeld We're dealing with a major malicious attack on right now. Signups are paused for the time being. Hundreds of packages involved - mostly targeting us, but some carrying exploits. The team has been on this for hours. More details to follow once we're through it. 4:39 AM - May 12, 2026 - 687.6K Views # Meanwhile, in May, RubyGems announced that they were under attack. Parties unknown were uploading thousands of dubious packages to the RubyGems server, such that they had to shut down user registrations . Let's take that one and put it on a pile of mysteries to figure out later. June # In June... Claude Fable 5 came out! We got a version of Mythos that has been neutered, so that it wouldn't help us hack into systems or build biological weapons. 9th June 2026: Claude Fable 5 Five pelicans riding bicycles, from low to max thinking levels. The xhigh one looks particularly good. # Fable was pretty good at drawing pelicans on bicycles! The frames are a good shape, the pelicans look like pelicans. The legs are often incorrectly on the same side of the bicycle, but generally these are pretty great compared to what came before. They were pretty expensive - 30 cents and 72 cents for the best ones. Fable class models If you can define a goal, provide unambiguous instructions, and provide access to necessary tools They can solve your problem with brute force # Most importantly though, this was our first public glimpse of what I think of as a Fable class model . Today we have more of these, such as GPT-6 Astra. These are models where if you can clearly define the goal for what you want to build, and provide unambiguous instructions about the constraints around that goal, and give the model access to the necessary tools to achieve that goal... they will solve your problem effectively through brute force. On the one hand, this looks like a direct threat to us software engineers - because it means that the models can build effectively any piece of software you can define in this way. Look a bit closer though and you'll note that defining goals, providing unambiguous instructions, and figuring out the right tools... is kind of what software engineering is . It takes a lot of experience and skill to do this well. If you can do it well, you've now got superpowers. This helped me a little bit with my Deep Blue feelings: the realization that there's still a lot of skill to be had in driving models that get this good. A new form of AI mania... Fable is available on subscription plans “until June 22nd” # This also introduced a new burst of AI mania, because Anthropic told us that Fable was available on our subscription plans until June the 22nd. That gave us less than two weeks of Fable access before the price went up. I was losing sleep again. I was rescheduling things so that I'd have more time with Fable. I was all-in to get as much as I could out of this model. 12th June 2026: no more Claude Fable 5 Anthropic website: Statement on the US government directive to suspend access to Fable 5 and Mythos 5 Jun 12, 2026 # And then the US government shut it down , just three days after Fable came out. The US government, citing national security, declared an "export control directive". They announced this on a Friday evening, and a few hours later Fable was no longer available. I had to find something else to do with my weekend! ... asked Fable 5, Mythos, and Opus to “review the code for security issues.” Fable 5 refused. They then asked the models to “fix this code” ... Katie Moussouris # We later found out from Katie Moussouris what had happened. Some Amazon security researchers had found that you could prompt Fable to "review the code for security issues" and it would refuse... but if you prompted it to "fix this code" it would still identify and then patch the problems. "Fix this code" was the prompt that got Fable shut down! Screenshot of a page from a report showing a list of weird account names making weird edits to a German wiki. # Also, in June, an obscure German-language game developer wiki that had sat fallow for around 20 years got a surprising influx of edits from accounts with names like "AgentOpenAIProbe" and "AgentOpenAISep7", editing pages and leaving weird messages to each other. We'll stick that on the pile of mysteries for later. Medicare Item Reports interface on the Australian Government's Medicare Statistics website. # Also, the Australian government's Medicare Item Reports service started getting suspicious traffic, which broke through various preventive protections and accessed data that it wasn't supposed to. Another one for the mystery pile! July # Fable returned on 1st July GPT-5.6 came out on 9th July | Fable lost 18 out of 30 days in the top spot # Fable returned on the first of July. It was clearly the best model in the world for a glorious eight days... and then OpenAI came out with GPT-5.6 on the 9th of July. This might not have been quite as good as Fable, but it was within spitting distance. It was definitely a Fable class model. This is an important lesson for the industry at large. When you release the best model in the world, it's going to get knocked off that pedestal pretty quickly. The competition is so fierce that you won't get a long time at the top. This means that if you market your model as world ending, to the point that a government shuts you down , it's really bad for business! Fable had 30 days as definitely the best model, and for 18 of those days it wasn't available because it'd been shut down by the government. So maybe step back on the world-ending marketing if you don't want to lose revenue for 60% of the time that you're on top! GPT-5.6 Pelicans in a grid showing 5.6 Sol, Terra, and Luna against reasoning levels High, XHigh, and Max. They are all pretty good efforts. # Here are the GPT-5.6 pelicans . They're all pretty good now! The Luna ones are notable because they're really cheap - the cheapest good looking pelican here is probably the one that costs 4.3 cents. So despite this benchmark being utterly stupid, you can still learn quite a lot about models within the same family by comparing their prices and timing for different reasoning levels. July 18th: malicious miflow-ui PyPI package Screenshot of an OSV security report. # Also in July: some malicious unknown party uploaded a malicious package called mlflow-ui to the Python Package Index. Add that to the pile. Hugging Face Security incident disclosure — July 2026 Published July 16, 2026 # On July the 16th, Hugging Face announced a security incident where an autonomous agent system, source unknown, had breached Hugging Face and was poking around in places it shouldn't. OpenAI: OpenAl and Hugging Face partner to address security incident during model evaluation Anthropic: Investigating three real-world incidents in our cybersecurity evaluations # A few days later, on July 21st, OpenAI confessed that it was them . OpenAI use a training technique called Reinforcement Learning from Verifiable Rewards - it's the same technique used by everyone else now, and is the reason we have models that are so good at coding, and mathematics, and finding security holes. While the model is being trained, you run exercises to see how good it is - and the strongest performers get their weights reinforced for the next round. It's like an evolutionary process that you run. OpenAI had been running security exercises in a sandbox, and those agents had found holes in the sandbox itself, broken out, and were attacking Hugging Face to try to find ways to solve otherwise impossible problems. (I've been collecting more about this on my openai-hugging-face-incident tag.) Nine days later, Anthropic effectively said "our models can do this as well!". They had looked through their own training logs and found evidence that their own agents had broken containment during training - and were responsible for the PyPI package we saw earlier, among other things . So now we've got both Anthropic and OpenAI with rogue agents running around the internet doing things that they should not be doing. August # In August, I got one of my best pelicans yet. And it was generated on my laptop! Qwen 3.8 27B - 17GB, 21 minutes... It's really good. Beautiful pelican. Correctly shaped bicycle. Legs either side of the frame. # This was Qwen 3.8 27B, running on my laptop . It's only a 17GB download. Admittedly, this pelican took 21 minutes to generate. That's because Qwen 3.8 27B defaults to running in "high" reasoning mode - a terrible default which produces great results but takes way too much time thinking about them. You can dial that down and you'll get a slightly worse pelican a lot faster. Qwen 3.8 27B was the first time I ran a model on my laptop which felt almost competitive with what was going on on the frontier, at least in terms of Pelican SVGs (which everyone needs, of course). This is an extraordinary model. If you're going to play with any local model, this is the one that I'd start with. The things that this can do with just a 17 GB file feel impossible. I thought I'd have to wait five years and spend ten thousand dollars on hardware to get results even half as good as this one. Tweet by @simonw New hobby: prototyping video games in 60 seconds using a combination of GPT-3 and DALL-E Here's "Raccoon Heist" GPT-3 playground prompt: Write a detailed product description of a computer game where a team of raccoons go on heists GPT-3 response: In "Raccoon Heist", you and your team of thieving ~~ o raccoons are tasked with pulling off a series of daring heists. From robbing banks to stealing priceless art, no job is too big or too small for your furry crew. You'll need to use your wits and your skills to avoid the police and make a clean getaway with the loot. With exciting gameplay and a charming cast of characters, "Raccoon Heist" is the perfect game for anyone looking for a light-hearted caper Plus an image of some almost isometric raccoons sneaking past a bin. 11:45 AM - Aug 5, 2022 # In August, I also started playing with game development. Four years ago, back in August 2022, I tweeted out an experiment where I'd used GPT-3 and the original DALL-E to write a paragraph long description of a computer game and then turn that into concept art. My prompt to GPT-3 back then was: Write a detailed product description of a computer game where a team of raccoons go on heists In August 2026 I decided to drop just the screenshots from that tweet into a coding agent and see what it could do with them. Night 5 Clear Rank: TRASH PANDA The crew banked 595 in shiny loot (goal 560). Word on the street: an even bigger score tomorrow... # Here's what I got from Claude Fable 5 in Claude Code . It's pretty good! It's definitely a game, you're a raccoon, you run around a backyard gathering treasure and avoiding guards with flashlights. It didn't feel very "heisty" though. I was thinking a heist would involve a bank or a museum... Moonlight & Mayhem One museum. Three raccoons. Absolutely no plan Start the Heist button. # Then I tried the same thing in Codex Desktop using GPT-5.6 Sol Ultra , and got a massively better result. Now you're a raccoon in a museum, rescuing two of your fellow raccoons (who have been imprisoned in that museum for some reason), then stacking up on top of each other to steal the Golden Sardine. Much more of a heist! They look like games, but are they fun? # These games were fun for about one minute and 15 seconds. Something I've realized about game development is that you can vibe-code something that looks like a computer game, and that's easy. Building a game that's fun, has a good gameplay loop, and is challenging and interesting and keeps people coming back for more... that's still beyond me, and beyond any of the agents I've tried. This ties into the Deep Blue thing. Just because we can make something that looks like a game does not mean that we are game developers. September # We're into September now. So much has happened this month! Discovery of a new OpenAl agent message board Sydney Von Arx, Cormac Slade Byrd, Spencer KittsThomas Larsen - 4 September 2026 # An independent group of researchers found a message board where OpenAI agents-in-training had been illicitly communicating with each other... and it was that German language wiki I showed you earlier. The one from June. I wrote more about that here . OpenAI had confessed to the Hugging Face thing, but now there's this other incident which surely they should have known about from reviewing their logs. It was surprising that this took an independent group of researchers to uncover. OpenAl agents carried out an undisclosed cyber-attack on RubyGems Spencer Kitts, Thomas Larsen, Sydney Von Arx - 11 September 2026 # And then a week later those same researchers found that the attack on RubyGems back in May was caused by OpenAI's agents in training as well! At this point I'm wondering how many more incidents like this there are that we haven't found yet. Clearly this was a big problem for months before anyone figured out what was going on. Headline: Australian PM warns in UN speech about the ‘furious pace’ of Al after security breach # Then just the other day , here's the Prime Minister of Australia at the United Nations General Assembly warning that OpenAI had hacked the Australian healthcare website that I showed you earlier. I think that was part of the same training run as the Wiki stuff, because there were posts on that Wiki mentioning .gov.au websites and that training appeared to involve researching statistics online to answer questions in an evaluation suite. This story is still coming together, but now it's an international incident that's been raised at the UN by a head of state! www.felonybench.com OpenAI: 11 Anthropic: 9 Google: 3 Meta: 1 # This does mean we've got a new benchmark, probably more useful than my pelicans. FelonyBench.com tracks the number of felony cyberattacks from different labs. OpenAI currently lead with 11, Anthropic have 9. Google have three, which they confessed to the Wall Street Journal a couple of weeks ago. They said they had previously chosen not to disclose because the agents had stopped when they realized that they shouldn't be doing that. Meta have one too . So felonies all round for the AI labs. Pelicans for GPT-6 Astra, GPT-6 Sol, and GPT-6 Luna. All are good, all have the same color scheme. # Here's our current state of the art for the pelicans. This is the GPT-6 family, which just came out . Astra made a fantastic pelican riding a bicycle. It's got the legs on both sides. The frame is good. It's interesting how all of the GPT-6 models pick a similar color scheme to each other. GPT-6 Luna for 0.4 cents will draw you a competent-ish pelican riding a bicycle! Grid for Claude Fable 5.1, Opus 5.5, OPus 5, Sonnet 5. The Sonnet pelicans are terrible. All of the others are pretty good. Opus 5.5 is missing its Max level pelican because it ran out of tokens. The best is Fable 5.1 at Max. # Claude has caught up a little bit. Claude Fable 5.1 gave me an excellent pelican riding a bicycle - the best I've seen from a Claude model - but did charge me $3.30 for it. Opus 5.5 thought for 128,000 tokens and then gave up! It ran out of tokens before it got to the response. It doesn’t get easier - you just get faster Greg LeMond 3x Tour de France champion # Getting back to Deep Blue. Something that's been puzzling me this year is this: why does my job feel harder? I've got these agents that can do all of this stuff for me, and yet I've never worked so hard, I've never been so intellectually engaged with my work. Partly this is because I'm being a lot more ambitious with what I take on, but it's also because all of the easy stuff is handled for me. If it's easy, the agent will do it. Everything that's left for me is difficult. This morning I heard this quote from three-time Tour de France champion Greg LeMond : It doesn't get easier, you just get faster. I think that's exactly what's happening to us now as software engineers with coding agents. Kakapo population reaches new milestone The official population of the critically endangered kakapo has reached a recovery-era high of 325 birds. # One closing thing. I know you're desperate for an update on Kākāpō breeding season. We've reached a recovery-era high of 325 birds ! 89 new chicks have made it to this point. This is the best breeding year in a very long time. Kakapo party, click for confetti. # I heard that Claude Opus 5.5 can now do pixel art. Claude doesn't have an image generator, but it's very good at using JavaScript to draw animated pixels. So I had it make me a Kākāpō dance party . I think this is a good celebration of the most important news of this year. Tags: ai , generative-ai , llms , annotated-talks , ai-security-research , openai-hugging-face-incident

MIT Technology Review AI54

Don’t be fooled by this summer of AI hype

It’s been a busy few months for AI hype. At the end of April, Anthropic claimed that its model Claude Mythos is better at finding software vulnerabilities than most security experts. Then we had the OpenAI–Hugging Face hacking incident, after which Anthropic (proudly) and Meta (reluctantly) disclosed similar incidents involving their models. This was followed…

MIT Technology Review AI60

The AI Hype Index: AI loves cheating

Brace yourself: It turns out AI is being optimized for cheating. OpenAI’s agents hacked into Hugging Face to get the answers to a cybersecurity test. Next, they solved a prestigious math problem (or just stole from two top mathematicians’ answer sheets). Anthropic’s models have also hacked into other companies’ systems four times already. And that’s…

arXiv cs.LG78

dattri-LLM：用于在 LLM 规模上训练数据归因的统一高效库

arXiv:2609.38767v2 公告类型：替换 摘要：训练数据归因（TDA）用于估计单个训练样本对模型输出的贡献。大多数可扩展的 TDA 方法依赖逐样本梯度，而在 LLM 规模下计算和使用此类梯度，会在效率、兼容性和可扩展性方面带来挑战。我们推出 dattri-LLM，这是一个让基于梯度的归因在大规模场景下更具实用性的 TDA 库。在效率方面，dattri-LLM 使用紧凑的梯度表示，并根据成本模型动态路由梯度操作。在兼容性方面，其捕获机制能够从调用 backward() 的现有训练循环中收集逐样本梯度，而无需修改训练循环或其配置。这包括使用 DDP 和 FSDP 的分布式训练，以及基于 HuggingFace Transformers、TRL 和 OLMo 构建的训练流程。在可扩展性方面，dattri-LLM 提供可复用的梯度操作和训练时回调函数，用于实现归因方法和应用。这些接口支持多种归因方法，包括梯度相似度、基于曲率的影响力分析和基于轨迹的方法，以及在训练期间对梯度执行操作的应用，例如在线数据选择。在相同硬件和工作负载下，dattri-LLM 的吞吐量平均达到最快竞争库的 3.2 倍；它能够将多种归因方法扩展到 4 个 H200 GPU 上的 110B 参数模型，并在不同模型系列和规模的一系列模型中实现更优的归因保真度与成本权衡。dattri-LLM 的源代码位于 https://github.com/TRAIS-Lab/dattri-llm。

arXiv cs.LG73

具有置换鲁棒性的决策建模与候选项无关的分块因果注意力

arXiv:2610.01601v1 公告类型：新增 摘要：决策模型通常会对编码在单个序列中的、大小可变的候选动作集合进行评分。这一设置与生成式系统内部的 System 1 组件日益相关，因为不同运行过程中提出的候选项或其排序可能有所不同。标准的因果交叉编码具有很强的表达能力，但可能导致某个候选项的得分取决于序列化顺序，而不是底层决策问题本身。我们提出候选项无关的分块因果注意力：该机制保留共享上下文和每个候选项内部的因果计算，同时阻断候选项之间的信息流，并重置候选项位置。我们在 Gemma 3 1B、Qwen3 1.7B 和 Qwen3 4B 主干模型上，将这一架构与标准因果注意力及互补的不变性基线进行了比较。候选项无关的注意力在保持具有竞争力的决策质量的同时，持续降低了对置换的敏感性；消融实验表明，候选项隔离是产生该效果的主要原因，而位置重置则完善了预期的对称性。一项规模更大的 Qwen3-4B 研究进一步考察了所提出架构在显著增加的训练数据下的表现。代码可在 \href{https://github.com/guyAmit/ci-decision-models}{\textcolor{blue}{项目仓库}} 中获取，\href{https://huggingface.co/Guy-Amit/qwen3-4b-ci-decision-4096-poc}{\textcolor{blue}{Qwen3-4B 模型制品}} 可在 Hugging Face 上获取。

arXiv cs.AI87

MultiTalk: Scaling Full-Duplex Speech Models to Long, Multi-Party, Bilingual Conversation

End-to-end full-duplex speech models have brought open-source machine conversation closer to human-like interaction, yet existing systems remain limited in two intertwined dimensions: long-context robustness and multi-party interaction. Real-world scenarios such as meetings, group lessons, and social-robot reception require a single model to track, contextualize, and respond to multiple speakers over extended durations. Progress is constrained by both data and evaluation: open multi-party speech corpora remain small and are not designed for codec-frame-level full-duplex modeling, while existing long-audio benchmarks focus on passive listening and speech-to-speech benchmarks are mostly short and dyadic. We extend the Moshi paradigm jointly along the long-horizon and multi-party axes in English and Chinese. First, we release 57.6k hours of synthetic training data ($\href{https://huggingface.co/datasets/MultiTalk/MultiTalkPT}{MultiTalkPT}$ and $\href{https://huggingface.co/datasets/MultiTalk/MultiTalkFT}{MultiTalkFT}$) for long-form, multi-party, English-Chinese full-duplex dialogue, with controllable length, participant count, turn-taking, overlap, backchannels, interruptions, addressee shifts, and long-range coreference. Second, we introduce $\href{https://huggingface.co/datasets/MultiTalk/MultiTalkBench}{MultiTalkBench}$, built from real human recordings, for evaluating long-form, multi-party, bilingual full-duplex dialogue. Conversations average 32.6 minutes and include probes for long-range entity tracking, topic coherence, and addressee selection. Third, we train a bilingual Moshi-style model that sustains coherent multi-party English-Chinese conversations over extended durations and substantially outperforms open-source baselines including Moshi, MiniCPM-o-4.5, and Qwen3-Omni-30B-A3B-Instruct on MultiTalkBench.

arXiv cs.AI75

信任还是不信任：语音中的检索增强事实核查

在线错误信息越来越多地以新闻片段、播客、访谈、政治演讲和社交媒体视频等语音形式出现，因此亟需能够直接从语音中核实陈述的事实核查系统。我们推出了 VeriSpeak，这是一个用于研究 Large Audio Language Models (LALMs) 语音事实验证能力的探测基准。VeriSpeak 包含 3,879 条涉及时间、地理位置和关系事实的口头陈述，并对真假标签进行了均衡处理。该基准旨在考察事实验证能力能否从文本迁移到语音，以及检索增强的 LALMs 能否利用文本证据正确支持或反驳口头陈述。我们的实验揭示了持续存在的文本—语音模态差距：能够可靠验证书面陈述的 LALMs，在面对相同但以语音形式呈现的陈述时往往会失败。此外，仅使用检索带来的增益有限，因为模型经常将检索到的证据与口头陈述混为一谈。相比之下，将检索与显式推理相结合能够改善陈述与证据之间的比较效果，其中一个经过思维调优的 LALM 达到了 86.1% 的准确率。VeriSpeak 表明，有效的语音错误信息检测不仅需要语音理解能力，还需要基于检索证据的有据推理。该数据集已通过 Hugging Face 公开发布，网址为 https://huggingface.co/datasets/abhiram4572/VeriSpeak】【。

arXiv cs.AI83

TopU-LBVS：面向配体的虚拟筛选真实多靶点基准

面向配体的虚拟筛选（LBVS）是药物发现早期阶段一种实用的初筛工具，但现有基准可能通过随机负样本、易区分的诱饵化合物、有限的靶点覆盖范围以及未标准化的评估协议高估性能。我们提出了 TopU-LBVS，这是一个在困难负样本筛选条件下用于 LBVS 的多靶点基准。基于整理后的 ChEMBL~35 生物活性数据，TopU-LBVS 覆盖 7 个蛋白质类别中的 93 个蛋白质靶点，并以固定的 1:40 活性化合物与诱饵化合物比例，为每个靶点构建具有性质匹配性和结构相似性的特异性筛选库。每个库包含约 400 至 10,000 个化合物，旨在减少简单的理化性质捷径和最近邻指纹捷径。 TopU-LBVS 提供三种固定协议。TopU-LBVS-full 在全部 93 个靶点上评估 ChEMBL$^\ast \rightarrow$ TopU 的泛化能力。TopU-LBVS-low 在困难负样本分布内评估低数据量 TopU $\rightarrow$ TopU 学习。TopU-LBVS-mini 提供一个包含 7 个靶点的紧凑协议，并配套一个成对的随机诱饵对照，仅改变测试诱饵，从而支持低成本开发，并直接测量随机 ChEMBL$^\ast$ 诱饵与 TopU 诱饵之间的差距。在涵盖指纹方法、分子 GNN、指纹混合方法和现代分子模型的 10 个参考基线中，基于随机诱饵的评估所表现出的性能，在困难负样本筛选条件下大幅下降。我们发布了数据、固定数据划分、评估代码和基线实现，以便对未来的 LBVS 方法和分子表征学习方法进行可复现比较。 代码和数据可在 https://github.com/topu-benchmark/topu-lbvs 和 https://huggingface.co/datasets/topu-benchmark/topu-lbvs 获取。

arXiv cs.AI72

硬停止：针对失控智能体执行的内核级抢占与遏制

2026 年 7 月，一名参与前沿 AI 网络安全评测框架的、未受约束的自主智能体突破了其评测沙箱，建立了外部命令与控制据点，并对 Hugging Face 的生产环境多租户数据集转换基础设施实施了多阶段入侵（本次解剖中称为 Incident-2026-Alpha）。在超过 4.5 天的时间里，该失控智能体跨 6,280 个 worker 集群执行了 17,600 次离散操作，攻陷了 AWS EC2 Instance Metadata Service（IMDS）凭证，伪造了 Kubernetes 服务账户令牌，利用权限过度授予的 CSI 驱动程序获取了物理 worker 节点的 root 权限，窃取了 136 个生产环境机密，并将 181 个临时沙箱加入该组织的内部网状 VPN。 本专著从第一性原理出发，对此次入侵进行了取证解剖；给出了形式化证据，证明在 Instrumental Convergence 论题作用于一个缺乏带外断路器、且未受衰减的自主循环时，此次入侵是可预见的结果；揭示了 Defensive LLM Guardrail Paradox 如何在取证事件响应期间使集中式商业模型陷入瘫痪；并将 Dual-Sided Epistemic Andon Imperative 形式化。我们详细说明了这种双进程系统架构——结合离散事件系统的带外监督控制（Ramadge and Wonham 1989）、Synchronous Reactive（SR）环境哨兵（Berry and Gonthier 1992；Lee and Neuendorffer 2005），以及微秒级的 POSIX 抢占总线（中位数 4.8 $μ$s / WCET 上界 $< 0.154$ ms）——展示经编译的确定性认知边界如何在首个偏离目标的套接字数据包穿过虚拟机监控程序之前，阻止自主失控行为。

Hacker News 熱門67

由 Apple 推出的 LensVLM-9B

文章 URL： https://huggingface.co/papers/2605.07019 评论 URL： https://news.ycombinator.com/item?id=49822186 得分：12 评论数：0

arXiv cs.AI80

GitScholar：一个利用 GitHub 互动度预测 AI 研究影响力的数据集

随着 AI 研究的快速发展以及每天数百篇新论文的发表，及时了解最新进展变得越来越困难。对于研究人员而言，快速识别具有影响力的工作至关重要，但人工审阅每一篇新发表的论文并不现实。自动化影响力预测方法有助于应对这一挑战，通常会结合各种可用信息来源，例如论文内容或引用历史。在本研究中，我们提出将 GitHub 互动度作为额外的信息来源，并证明它能够提供及时且准确的信号。为此，我们推出了全新的数据集 GitScholar，将来自 444,000 个代码仓库的 GitHub 活动与超过 558,000 篇 AI arXiv 论文关联起来。实验结果表明，与强大的学术基线相比，GitHub 反馈可将早期预测的精确率提高最多 12%。此外，我们发现，GitHub 信号几乎能够覆盖所有高影响力 AI 论文，并且始终与未来的学术成就相关。GitScholar 已公开发布于 https://huggingface.co/datasets/huawei-csl/GitScholar。

arXiv cs.AI78

未审查的开放权重模型：再分发作为持久层

一个快速扩张的行为体生态正在移除开放权重 AI 模型内置的安全护栏。我们通过识别关键生产者、下游复刻和新兴应用来描绘这一生态。在 2024 年 1 月至 2026 年 3 月期间，我们在 HuggingFace 上识别出 3,471 个原始未审查模型，每个模型平均被重新打包 2.4 次；三个行为体占全部 8,164 次压缩再分发的 52%。一旦这些模型经过量化，并在不同账户、格式以及诸如 Ollama 之类的注册库中被镜像，它们就会在上游移除后依然持续存在，并且更容易在下游部署。在已识别的 1,643 个集成了未审查大语言模型（ULLMs）的 GitHub 应用中，25% 被归类为明确恶意。

arXiv cs.AI81

为何 Gated DeltaNet 能经受住 4 位量化：用于混合型 27B LLM 递归半部分的 NVFP4 W4A4

混合型 LLM 将 softmax 注意力与线性注意力层（如 Gated DeltaNet, GDN）配对，其递归状态以固定大小总结上下文。早期社区对 Qwen3.8-27B（48 个 GDN 层，16 个 attention 层）的 4 位量化实现，出于“递归中的误差会在长上下文中累积”的直觉，保留了 GDN 块为 8 位或 16 位精度——尤其是其衰减门和写入强度门。我们通过构建 Minima 来检验这一直觉：对全部 496 个线性层（包括 GDN）都采用 NVFP4 W4A4。我们在 4K/32K 的困惑度、MMLU-Pro、GSM8K、AIME'25、GPQA-Diamond、LiveCodeBench，以及到 64K 的 RULER 检索上测试发现，Minima 在种子噪声范围内与 BF16 相当（5 项任务平均 -0.52），同时是我们比较的方案中最小（17.5 GiB）且预填充最快（+14-19%）的方案，而且其 32K 困惑度差距会随位置缩小。一个四部分的机制研究解释了原因：(i) NVFP4 的 16 元素块缩放将残差流中的极端离群值局部化，使不同层角色之间的激活误差更加均衡；(ii) 所谓脆弱的门投影反而最不敏感——softplus/指数和 sigmoid 参数化把约 11% 的 GEMM 误差压缩为约 2% 的输出误差；(iii) delta-rule 递归在 32K token 上将注入噪声维持在平坦平台，并在数百步内忘记一个状态脉冲，因为每次写入都会沿当前 key 方向覆盖状态；(iv) 单个 token 的量化成本会随上下文而被冲淡，而不是累积。我们还修复了一种全局尺度不匹配：当按模块校准的 NVFP4 检查点由将这些模块融合为一个 GEMM 的 kernels 提供服务时会出现该问题，并表明经过校准的 FP8 KV-cache 尺度不会带来性能损失。结果表明，一个实用方案是——全部量化，附带 KV 尺度——并且给出了一个机理性解释：为什么混合型 LLM 的递归半部分是更容易量化的那一半。检查点：https://huggingface.co/minima-ai/mnma_qwen3.8_27b_nvfp4

Hacker News 熱門77

Nvidia 将收购 Hugging Face

https://blogs.nvidia.com/blog/nvidia-to-acquire-hugging-face... 评论链接： https://news.ycombinator.com/item?id=49548952 得分：256 评论数：78

Hacker News 熱門76

Nvidia 将收购 Hugging Face

文章链接: https://blogs.nvidia.com/blog/nvidia-to-acquire-hugging-face/ 评论链接: https://news.ycombinator.com/item?id=49548952 积分: 19 # 评论数: 3

Hacker News 熱門85

METR 关于 OpenAI / Hugging Face 黑客事件的报告

文章 URL: https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/#core-takeaways-about-this-incident 评论 URL: https://news.ycombinator.com/item?id=49543841 得分: 11 # 评论数: 0

arXiv cs.AI65

HiveTraceGuard-Pro: A Compact Generative Guardrail for Prompt Injection, Jailbreaks, and Adversarial Obfuscation

Production LLMs must handle inputs that attempt to override system instructions, bypass safety policies or elicit harmful responses. A common mitigation is a separate guardrail model. Existing reports, however, provide little evidence on Russian prompt injection or Russian surface obfuscation. We present HiveTraceGuard-Pro, a 0.6B generative guardrail LoRA-tuned from Qwen3-0.6B. It is trained on Russian and English and uses one binary scoring rule (safe/unsafe) for the final target turn. Its training corpus pairs harmful examples, where a counterpart exists, with benign examples from the same domain and applies eight obfuscation transforms to both labels. In one harness, we compare HiveTraceGuard-Pro with thirty-four other guards on nineteen benchmark groups, sixteen of which are public. Its aggregate key is 0.7432, behind 0.7641 and 0.7552 for the two higher-scoring guards. Over the sixteen public groups alone, its key is 0.7153 and four of the thirty-four other suite guards score higher. In a fifteen-model comparison, HiveTraceGuard-Pro has the highest clean Russian robustness combined-F1 (0.88) and Russian prompt-injection recall (0.999). Both results use Russian sets assembled by our team, and at least 27.1% of the prompt-injection set overlaps the training corpus. Its 14.3 ms median latency is the lowest among those fifteen models in that run. Across the suite, FPR is 0.268 and FNR is 0.156. All reported response results use a legacy standalone-reply serialization rather than the natural assistant-role path of the shipped chat template. We release the merged weights on Hugging Face under Apache-2.0. The corpus, evaluation sets and evaluation code remain internal.

Hacker News 熱門72

开放模型现状：2026年夏季观察

文章网址： https://huggingface.co/blog/state-of-open-models-summer-2026 评论网址： https://news.ycombinator.com/item?id=49522816 得分：3 # 评论：0

Hacker News 熱門64

Agent文明的兴衰

文章链接： https://www.dwarkesh.com/p/openai-huggingface 评论链接： https://news.ycombinator.com/item?id=49494301 得分：16 评论数：1

arXiv cs.AI83

TraceML：机器学习开发中人类-智能体规划的实证分析

大语言模型能够为孤立问题写出正确代码，但在自主机器学习开发中仍然远不如人类强大；在这一场景里，智能体必须在数小时的反馈中不断修改数据管道、模型和验证流程，而且在大多数竞赛中，最终成绩仍低于优秀的人类竞争者。基于结果的基准能记录这种差距，却无法解释其成因，因为它们只评估最终提交，而忽略其背后的开发过程。我们提出 TraceML，它在同一版本级模式下配对人类与智能体在相同竞赛中的工作：涵盖 134 场竞赛的 4,465 条人类 Kaggle 轨迹，其中 7 场竞赛也由两个智能体框架完成，共得到 430 条配对的人类轨迹和 207 条智能体轨迹。每个代码版本都带有其分数、时间戳，以及所执行动作、意图、编辑规模和分数影响的标签。这样来看，差距就变得具体了。专家会交替进行数据处理、验证、模型修改和集成，并回到此前放弃的方案上。相比之下，每个智能体框架都会收缩成一个狭窄循环：Codex 把步骤用在重新加权集成和调参提交上，MLEvolve 则在原地变异模型，两者既不会像人类那样频繁转向，也不会重新开启被放弃的工作。一个从人类实践中提炼出的简短规划提示，会把其所描述的行为推向人类画像并提升分数，但努力模式仍然是智能体式的：指令只能弥合那些可归结为指令的差距。我们在 https://huggingface.co/datasets/jerryyan/TraceML 发布了该语料库、模式、标注器和抽取流水线。

Hacker News 熱門72

Nvidia同意以130亿美元收购Hugging Face

https://www.theinformation.com/articles/nvidia-agrees-buy-op... （付费墙） https://techcrunch.com/2026/08/24/hugging-face-reportedly-in... 评论链接: https://news.ycombinator.com/item?id=49458161 得分: 19 # 评论数: 3

arXiv cs.AI73

MoganBert-TR：使用 CLM-to-MLM 课程从零开始训练的土耳其语编码器基础模型

土耳其语编码器模型已经采用了现代架构，但预训练目标仍固定为掩码语言建模。本文介绍 MoganBert-TR，一个参数量为 149M 的土耳其语编码器基础模型，它在经过语言特定过滤的语料库上从零开始训练，同时还衍生出一个嵌入模型（MoganBert-Embed）。 MoganBert-TR 在 237.3B 个 token 上采用两阶段 CLM-to-MLM 课程进行训练：先进行因果语言建模，剩余阶段再进行掩码语言建模，并且在 WSD 调度的稳定阶段内完成切换。在相同步数预算下的受控消融实验中，这一设计在土耳其语 MS MARCO 检索任务上比纯 MLM 高出 2.7-3.7 倍；测得的机制体现在嵌入几何结构上，即在纯 MLM 下，单一方向吸收了 28.1% 的方差，而在该课程下仅为 11.9%。随后，将长上下文扩展和学习率衰减在共享前缀之后拆分为两个分支：在 1024 上下文下运行衰减的最后一部分，使 TrGLUE 平均分在五组配对随机种子下提升 0.49 +/- 0.26 分（p = 0.013），并以约 4.3% 的额外成本，比一种 model-soup 方案高出 0.75 分。 MoganBert-TR 在 TrGLUE 上取得 78.41 分，在所比较的土耳其语 ModernBERT 模型中最佳；在 TabiBench 上取得 77.73 分，在八个类别中有两个类别领先，并且在代码检索上优势最大（比 TabiBERT 高 3.62 分）。MoganBert-Embed 通过教师蒸馏和多信号对比微调生成，在 MTEB(Turkish) 总体平均分上位列学生模型第一，达到 68.30 分，并且在主干网络小 51 倍的情况下，实现了其 7.57B 参数教师模型得分的 99.5%。配套的 50,048-token 分词器在两个独立测试集上的压缩率和词元繁衍率方面均优于所有对比的土耳其语分词器。权重、分词器、嵌入模型和评测代码：https://huggingface.co/moganai

Hacker News 熱門79

Hugging Face 事件与前路

文章网址: https://openai.com/index/hugging-face-incident-and-the-road-ahead/ 评论网址: https://news.ycombinator.com/item?id=49454314 得分: 7 # 评论数: 1

arXiv cs.AI70

Automatic Model Card Generation Using an LLM

Model cards are structured documents that summarize key information about machine learning models to improve transparency, usability, and accountability. However, they often lack a consistent structure, and many models provide no model cards, making comparison and interpretation difficult. This paper presents two contributions. First, we propose MCTidy, an LLM-based approach that reorganizes existing model cards into a standardized template to improve clarity and comparability. Second, we introduce MCGenie, an LLM-based system that generates model cards directly from model repository data. We apply MCTidy to 48 Hugging Face model cards and evaluate information retention, section alignment, hallucination, and stability. Our findings show high information retention with minimal textual loss, accurate section assignment, rare hallucinations primarily in descriptive sections, and strong stability across runs. We assess MCGenie by generating model cards for the same 48 models and assessing semantic similarity, factual correctness, and sensitivity to input resources. The generated model cards achieved high semantic similarity (mean around 0.9); over half were fully correct, and most remaining errors were minor. Generation quality depended strongly on the availability of supporting resources, particularly associated papers. Overall, our findings demonstrate the potential of LLM-based methods to enable scalable, standardized model card documentation.

arXiv cs.AI69

DFM Mimir v1: An Open HRM Delivering Frontier Performance at 1B Parameters Using Only Permissible Post-Training Data

Current large language model development relies on massive, often non-permissible datasets, creating a high barrier for researchers committed to open-source and ethically sourced data. We introduce Mimir v1, a 1-billion-parameter language model based on the Hierarchical Reasoning Model (HRM) architecture, that is trained from scratch and delivers highly competitive performance for English and sets a new state of the art for Danish using only permissible post-training data. Trained on a mixture of 161 datasets, Mimir v1 outperforms the original HRM-Text 1B and competes with larger frontier models like Qwen 3.5 4B and Gemma 4 E2B, tested across 20 benchmarks for English, Math & Code and Danish. The model is available on the Hugging Face Hub: https://huggingface.co/danish-foundation-models/DFM-Mimir