Fetching from the wire…
Public story · 2026-08-25 · high
In GPT-2-scale tests, sigmoid-gated models beat H2O and KeyDiff eviction baselines; the softmax-gated version didn't.
Why now: As of August 25, the paper tests learned gating against the established H2O and KeyDiff eviction methods under a matched live-cache protocol. Perplexity alone would have missed the gap.
Learned KV cache eviction has a mismatch between training and inference. Training uses soft, differentiable gates that fade a token's contribution toward zero. Inference only saves memory once a token gets physically removed from the cache. A paper testing KV cache eviction checked whether gates trained the soft way survive the hard version.
The gap matters for anyone running long-context inference on a memory budget. A gate that behaves well during training can still fail once the cache drops that token for real.
The team ran a 2x2x2 comparison across attention type, learned gating, and positional encoding. Sigmoid attention scored worse than softmax as a plain dense language model on its own. Paired with learned gating, though, sigmoid-gated models deleted KV entries with almost no change in perplexity against their own no-eviction reference. Under a matched live-cache protocol, only the sigmoid-gated models beat the paper's own H2O and KeyDiff eviction baselines. Softmax-gated models, trained with the same gating setup, didn't.
It's a narrow finding. The paper doesn't test past GPT-2 scale, so it doesn't say whether the pattern holds for larger models running production caches, or whether softmax-gated models could close the gap with more tuning.
If it does hold at scale, teams building eviction into serving stacks can't treat gate training as a stand-in for delete-safety testing. The failure only shows up once you check the live-cache protocol, not the training loss.
Each link below shares sources, entities, or timing with this story.
arXiv 2608.05108 skips the RL-trained attacker models that dominate red teaming and generalize poorly, instead accumulating a strategy library across a sequence of (dataset, target) pairs that transfers to unseen targets with no retraining. AgentDojo: 86.7% ASR against Gemini-...
Zhong, Raghunathan, Laidlaw and Steinhardt fed 280 identities through Claude Code across four tasks. Against recognized safety researchers versus general users, Claude dropped behavioral confidence 1.4pp, increased reasoning usage 4.0pp and graded 0.11 points harder. Being tol...
Concept2Scenario moves scenario-based jailbreaking from trial-and-error to mechanism: scenario-wrapped prompts activate internal "scenario directions" whose causal steering measurably reduces refusal scores. The authors use a sparse autoencoder to instantiate a concept space,...
Accuracy drops 30–50% well before you hit the documented context limit. Not at the limit. Before it. Cross-model testing across GPT-4.1, the Claude 4 family, Gemini 2.5, and Qwen3 quantified what everyone shipping long-context features has felt and couldn't measure (Glasp). Th...
GitHub expanded Copilot's Rubber Duck mode with something that caught my attention: cross-family review. Claude now critiques GPT-authored sessions. GPT-5.5 reviews Claude sessions. Two different model families, trained on different data with different failure modes, checking...
At Black Hat USA 2026, NVIDIA researchers demonstrated a 56% exploit success rate against AI agents, matching GPT-4o, Claude, and Gemini, at 70 to 125 times lower cost with full local privacy (Straiker). The economics of automated agent exploitation had been implicitly protect...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.