5arXiv cs.AI (Artificial Intelligence)·
KuTIE: Live Kubernetes topology context dramatically improves LLM-generated security patches
Researchers introduce KuTIE (Kubernetes Topology Intelligence Engine), a system that conditions LLM patch generation on live cluster context derived from Istio call graphs, Trivy KSPM findings, and service-account bindings. Evaluated on a purpose-built 36-deployment healthcare cluster with 248 trials, topology context raises correctness of topology-dependent patches from 11.1% to 78.0%, a gain that holds across multiple models and six of seven dependency classes. A topology-independent control shows no improvement, isolating the effect to the live graph context rather than generic prompt enrichment. The work addresses a concrete failure mode in LLM-based security automation: patches that are technically compliant but break runtime service dependencies.
Related guides (2)
Related events (8)
CWE-Trace framework reveals LLM vulnerability detection is calibration without comprehension
Researchers introduce CWE-Trace, a benchmark of 834 manually curated Linux kernel samples across 74 CWEs with strict temporal splits to prevent data contamination, used to evaluate 8 vanilla LLMs and 15 LoRA fine-tuned variants on vulnerability detection. Key findings: data contamination provides no measurable advantage (84% of nominally contaminated samples carry no usable memorization signal), and backbone directional priors dominate fine-tuning — models exhibit stable systematic failure modes that resist correction. The best binary detection score reaches only 52.1% (barely above chance) and exact CWE classification Top-1 accuracy stays below 1.3%, indicating fine-tuning shifts output distributions without instilling genuine security reasoning. The work introduces two diagnostic metrics (Directional Failure Index and Hierarchical Distance and Direction) and concludes that detection capability and security understanding are decoupled in current LLMs.
ktransformers: heterogeneous LLM inference/fine-tune optimization framework gains traction on GitHub
ktransformers is an open-source Python framework for heterogeneous LLM inference and fine-tuning optimizations, developed by kvcache-ai. The project has accumulated 18,236 GitHub stars with 328 added in a single day, indicating significant community interest. It targets KV-cache and mixed-hardware inference optimization, a key area for reducing LLM serving costs.
TopoTTA integrates persistent homology into test-time adaptation for anomaly segmentation
Researchers introduce TopoTTA, a framework that incorporates persistent homology from topological data analysis into test-time adaptation (TTA) for anomaly segmentation. The method applies multi-level cubical complex filtration to anomaly score maps to generate topological pseudo-labels that guide a lightweight test-time classifier, avoiding pixel-level heuristics like confidence thresholding. Evaluated across six benchmarks including MVTec AD, VisA, and MVTec 3D-AD, TopoTTA achieves an average 15% F1 improvement over state-of-the-art unsupervised methods, with the largest gains on geometrically complex defects.
ModSleuth: Agentic system audits invisible dependency graphs in modern LLM training pipelines
Researchers introduce ModSleuth, an agentic system that recursively reconstructs LLM dependency graphs from public artifacts, recovering 1,060 source-verified dependencies across four major LLM releases. The system formalizes direct and indirect dependencies and operation-centered relationships to handle fragmented, inconsistent documentation. Applied at scale, the resulting graphs expose multi-hop license obligations, train-evaluation coupling, and discrepancies between released and training-time artifacts — issues that are practically invisible to manual auditing.
KATE framework improves LLM tool calling via experiential knowledge integration and parallel reasoning
Researchers present KATE (Knowledge-Augmented Tool Execution), a framework addressing LLM failures in multi-step tool use by systematically studying knowledge acquisition, activation, and internalization. Key findings include that instance-level experiential knowledge outperforms abstract intent-level knowledge, that expanding reasoning width via parallel sampling with aggregation beats deeper chain-of-thought, and that reinforcement learning outperforms supervised fine-tuning for knowledge internalization. KATE is evaluated on BFCL-V3 and AppWorld benchmarks, showing consistent improvements over strong baselines across model scales.
Self-patching technique reveals why fine-tuned LLMs fail to generalize memorized knowledge
A new arXiv preprint formalizes the 'Knowing–Using Gap' in LLM fine-tuning: models can memorize injected facts yet fail to apply them in downstream reasoning. The authors introduce a novel intervention technique called self-patching to monitor internal activation dynamics, finding evidence for a knowledge-circuit misalignment hypothesis where memorized representations are not routed to computation-effective layers. A heuristic strategy derived from this diagnostic recovers 58–75% of the oracle headroom in generalization failure cases across multiple domains.
TraceLab: Real-world coding agent workload traces reveal serving optimization opportunities
Researchers at UW release TraceLab, a dataset of ~4,300 coding-agent sessions comprising ~350,000 LLM steps and ~430,000 tool calls drawn from real day-to-day use of Claude Code and Codex. Analysis reveals characteristic patterns: long autonomous loops, long contexts with short outputs, heavily-tailed tool call distributions, and high but imperfect prefix cache hit rates. The findings motivate concrete serving-system improvements including lower-overhead tool calling, append-length-aware prefill, and improved KV-cache management. The dataset, pipeline, and analysis code are publicly released.
Open-weight LLMs evaluated for generating structured threat intelligence (STIX) for autonomous vehicle vulnerabilities
Researchers introduce CAV-STIXGen, a dataset mapping connected and autonomous vehicle (CAV) CVE descriptions to STIX threat intelligence objects, CWE entries, and MITRE ATT&CK techniques. They benchmark 11 open-weight LLMs (4B–120B parameters) across prompting strategies, achieving F1 scores up to 0.94 for STIX domain objects and 0.99 for CWE mapping, while MITRE ATT&CK mapping remains harder. A multi-agent configuration using Gemma-4-31B and Codestral-22B is also evaluated, and co-occurrence analysis of CWE/ATT&CK patterns is used to surface recurring threat patterns in the CAV domain.