Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-26 · high
It maps attention like an image to find which tokens hijacked a tool call, then checks the source's authority.
Why now: Attnlocate posted to arXiv in August 2026.
Attnlocate turns attention weights into a 1-D image and detects the token span that hijacked an agent's tool call. An agent that can't tell whose instructions it's following will carry out an injected command as if the user asked for it.
Across ten agent setups spanning five model families, the method reached a 93.4% detection rate at a 6.7% false-positive rate. Locating the exact span, it also averaged a 0.743 mean IoU and a 0.956 AUROC.
The system pools attention across every head and layer into a token-level feature space. It then runs a 1-D U-Net with an anchor-free detection head, the architecture family used for finding objects in images. Instead of boxing a cat, it boxes the tokens that steered a tool call, then checks who supplied them before the agent acts.
The method also transfers to unseen models and new policy configurations without retraining, so a team wouldn't retrain it per deployment.
What the paper doesn't cover is deployment cost. Running attention-based localization on every tool call means instrumenting the agent's inference path, and nothing in the results says what that adds to latency. Static filters are cheap and already deployed everywhere. This only wins if it can run on every step without slowing an agent down.
Each link below shares sources, entities, or timing with this story.
Across 2,823 committed episodes on three frameworks, a one-class echo-state-network ensemble with CUSUM alarms catches 71% of mid-episode failures at a 5% false-alarm budget, three orders of magnitude cheaper than a judge call. But learned monitors don't transfer (AUROC 0.527...
Across 4,181 competition math problems (arXiv 2608.14927), researchers compared direct solving, iterative self-correction, planner-executor-reviewer collaboration, and multi-agent deliberation. The routing question splits cleanly: models reliably detect they're about to fail,...
arXiv 2608.09624 separates harmful intent (a prompt property) from jailbreak success (an outcome from a specific model, decoder, and judge). On Llama, wrapping a prompt raises harmful generation from 0.05 to 0.27 while harmful-intent AUROC falls from 0.936 to 0.803. Attacks ge...
arXiv 2607.26836 attacks cascading failure from the pre-hoc side, modeling intrinsic risk as semantic misalignment between agent role and task query, characterizing propagation via semantic influence plus communication topology, and fusing the two through a differentiable Nois...
The argument is that token uncertainty shows up not only in output-distribution breadth but in whether a confident prediction is fragile under perturbation of its attention pathways (arXiv 2608.11138). It's training-free: mask attention heads, measure BALD mutual information a...
arXiv 2608.06370 evaluated models emitting code that calls tools against JSON-schema tool calling on BFCL v4. PTC matched or exceeded the baseline in 11 of 14 models, with the GPT-5.6 family up 10.6%, and held stable under parallel execution in 13 of 14. Under context degradat...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.