ResearchIMMACULATE LLM Auditing Framework Detects Model Substitution and Token OverbillingarXiv·high signalXBlueskyLinkedInCopy linkDetects provider model substitution, quantization abuse, and token overbilling via verifiable computation. Relevant to distillation detection trend.SourceSource pagearXiv↳ Follow the threadStack layer / Threat pattern16% of 3,171 public agent-harness setups carry a confirmed security defect, and 3.8% ship a skill that pre-approves your shellarXivPolicy dependency / Stack layerMemSentry gates persistent memory writes on a signed security-state delta rather than on content classificationarXivStack layer / Threat patternFive model artifacts in the official Ollama library solve zero of 164 tasks and nothing in the pipeline tests for itarXiv 2609.05881Stack layer / Threat patternSynthID Watermarking in Claude Costs Three Points of Code Correctness on One Model, but Detection Is Near ChancearXiv 2609.09604Stack layer / Threat patternPrivEscalate Scales Linux Privilege-Escalation Evaluation From Under 15 Scenarios to 531 Dockerized OnesarXiv 2609.09087Stack layer / Threat patternA spec-first agent framework taxonomy: persuasion, front-loaded structure, or controls the agent cannot editarXiv 2609.09671Stack layer / Threat patternVibe Coding Cut Task Time 27% and Raised Security Vulnerabilities in the Same TrialarXiv 2609.09560Stack layer / Threat patternA knowledge graph for what-to-do: procedure triplets that self-evolve by contrasting failed trajectories with successful onesarXiv 2609.09153