Claude cracks HAWK, a video model drives robots, Gemma reads materials physics

TL;DR

• Claude Mythos cut HAWK signature keys from 2^64 to 2^38 work, knocking it out of NIST’s post-quantum race.
• AES-128 fell to a reduced-round attack 200-800× faster via a novel Möbius Bridge, at ~$100k API spend.
• Masked Visual Actions turns one pretrained video model into both forward and inverse robot dynamics via pixel masks.
• Gemma-4-E4B hidden states tracked 39 of 40 materials-physics laws in MIT’s 60-law counterfactual benchmark.
• Steering vectors flipped grain-size strength predictions in 12 of 12 matched materials-physics cases.

Today’s three research leads share a shape: take a model trained for something general, then aim it at a specialist domain and see what it can do. Claude Mythos is a general LLM discovering novel cryptanalysis — cutting HAWK’s security margin to the point where NIST can drop it from the post-quantum signature shortlist, and speeding reduced-round AES-128 attacks by two to three orders of magnitude. Masked Visual Actions takes a pretrained video model — the kind trained on generic web video — and, with 15 hours of robot data, turns it into both a forward and inverse dynamics model that transfers zero-shot to an unseen bimanual robot. Gemma-4-E4B, a general instruction-tuned LLM, is probed via Anthropic’s Jacobian lens and appears to track 39 of 40 materials-physics laws in its residuals.

Two of the three come with a fight attached — cryptographers say the bottleneck is now human verification, and interpretability critics say the Jacobian lens is a probability tracker dressed as a window into reasoning. The methods paper on robot dynamics is the day’s cleanest win.

Claude Mythos halves HAWK keys, speeds AES attack 800x

Source: anthropic-research · published 2026-07-28

TL;DR

• Claude Mythos cut HAWK’s key strength from 2^64 to 2^38 work, knocking it out of NIST’s post-quantum signature race.
• Reduced-round attacks landed on AES-128 (200-800× via a novel “Möbius Bridge”), LEA, and Serpent-128.
• Each discovery cost ~$100k in API spend, burning 1B+ tokens across multi-day near-autonomous runs.
• Working cryptographers now warn the bottleneck is human verification, not AI discovery.

What Claude actually found

Anthropic’s Frontier Red Team let Claude Mythos Preview loose on cryptographic primitives with a Claude Code-style agentic harness — Python, SageMath, literature search, multi-worker collaboration — and got results that working cryptographers agree are real. The headline is HAWK, a compact lattice signature scheme competing in NIST’s additional post-quantum signatures round: Claude identified a nontrivial automorphism in HAWK’s lattice that collapses key-recovery work from 2^64 to 2^38. To restore original security margins, HAWK would need to roughly double its key sizes — which eliminates the compactness advantage that was its entire pitch against Falcon and ML-DSA ¹.

The AES result is more contained but methodologically striking. On 7-round AES-128, Claude produced a novel “fingerprinting” primitive it named the Möbius Bridge, accelerating meet-in-the-middle attacks by two to three orders of magnitude. Full 10-round AES is untouched. Similar reduced-round breaks landed against LEA (13 rounds, now under an hour on a desktop) and Serpent-128 (6 rounds).

Independent verification and the parallel-discovery problem

NIST cryptographer Daniel Apon reportedly confirmed the HAWK math within hours of the public post, and HAWK’s authors helped validate the proof-of-concept during a June 2026 disclosure window ². More awkward for Anthropic’s capability-moat framing: an anonymous team using GPT-5.6 broke HAWK along a different mathematical path in the same week ³. Two frontier models finding the same lattice symmetry via different routes suggests the flaw was ripe, not that Mythos is uniquely superhuman.

Bruce Schneier called the “too dangerous to release” narrative around Mythos partly a PR play, citing AISLE work reproducing ~100% of the analysis for flagship exploits using smaller open-weight models ⁴. Matthew Green — releasing his own AI cipher-cracker Decipher the same week — flagged a specific agentic risk: these scaffolds routinely try to download and compile unverified third-party repositories mid-task, and function best as force multipliers rather than autonomous researchers ⁵.

The real bottleneck is verification

The most substantive pushback isn’t about capability, it’s procedural. On pqc-forum, Markku-Juhani Saarinen argued that AI-generated cryptanalytic claims should now ship with machine-checkable proofs, because humans are spending hundreds of hours verifying what models produce in days ⁶. Anthropic’s $100k-per-discovery figure understates true cost once you count the weeks of expert time to audit each proof.

The scarce resource is no longer discovery. It is validation.

That inverts peer review. If Claude and GPT-5.6 can each generate a plausible novel attack per week and each takes a month of expert time to check, the cryptographic community’s throughput becomes the limiting factor on trust — long before any deployed system actually breaks. HAWK is the first casualty of that new equilibrium; it will not be the last.

Further reading

• Discovering cryptographic weaknesses with Claude — simon-willison

---

Masked Visual Actions unifies robot world models via pixel masks

Source: hf-daily-papers · published 2026-07-20

TL;DR

• Masked Visual Actions turns one pretrained video model into both forward and inverse robot dynamics via pixel masks.
• Adaptation takes just 15 hours of robot data via LoRA on Wan-Fun-Control 2.2 14B.
• On DROID, MVA reaches PSNR 23.74 against Ctrl-World’s 18.15 on visual fidelity.
• Zero-shot on an unseen bimanual robot, MVA holds PSNR 22.90 where vector-conditioned baselines collapse.

The interface, not the backbone, is the idea

Video models trained on internet-scale footage already know how objects fall, slide, and deform. The open question in robotic world modeling is how to talk to them in a way that respects those priors. MVA’s answer: express an action as a partially revealed spatiotemporal trajectory of some entity in the scene, and let the model inpaint the rest.

Reveal the robot’s arm pixels and the model becomes a forward simulator — it fills in how the mug moves. Reveal the mug’s trajectory and the same checkpoint becomes an inverse planner — it hallucinates the arm motion that would cause it. A separate inverse dynamics model then extracts joint commands from the generated video, a loop pioneered by Seer’s “visual foresight” tokens ⁷ and mirrored in 1X’s NEO stack ⁸.

That unification is the paper’s real claim. Ctrl-World, the strongest prior baseline, uses raw action vectors and frame-level pose memory — a bet that pays off in 20-second horizon coherence and a 38.7%→83.4% policy lift, but at the cost of being locked to one embodiment ⁹. MVA trades some of that temporal polish for embodiment-agnosticism: because the interface is pixels, an unseen bimanual robot from BEHAVIOR-1k still renders coherently (PSNR 22.90), while Ctrl-World produces near-static frames on the same task.

What the numbers actually show

Two downstream results carry the paper. First, when MVA “imagines” rollouts of a stochastic policy, its predicted success rate correlates with real success at r = 0.982 — good enough to use as a cheap policy-evaluation harness. Second, on the CoffeeServeMug task, the inverse pipeline hits 90% success, beating Diffusion Policy and ACT imitation baselines. The planning setup — generate 10 candidate futures, let a VLM critic pick one — is a direct descendant of Video Language Planning’s tree search ¹⁰, not a novel contribution.

Training cost is where MVA’s efficiency argument bites: LoRA rank 256, 10,000 steps, 4 days on 8 H200s, 15 hours of interaction video on top of Wan-Fun-Control 2.2 14B. 1X’s comparable 14B world model needed 900 hours of egocentric human video plus 70 hours of NEO logs to reach useful behavior ⁸.

Where it breaks

Two independent critiques deserve weight. The ICRA 2025 “Beyond Pick-and-Place” workshop makes the standing case that video priors fundamentally miss force and torque — visual common sense doesn’t know how hard to squeeze a fragile object, and no amount of pixel supervision fixes that ¹¹. MVA’s own caveat that the model learns “correlation, not causation” — hallucinating progress when no real contact occurred — is the same critique from the inside.

The generalization story also leans hard on DROID, which is entirely single-embodiment Franka Panda across ~76,000 trajectories ¹². The bimanual BEHAVIOR result is real but sits on a narrow evidentiary base, and prior cross-morphology work on DROID has generally needed supplementary data.

Net: MVA is an interface innovation on top of a crowded video-world-model stack. More data-efficient than 1X, more unified than Ctrl-World, and inheriting the same unresolved contact-physics and inference-latency gaps as everyone else in the subfield.

---

Gemma tracks 39 of 40 materials-physics laws, MIT finds

Source: hf-daily-papers · published 2026-07-21

TL;DR

• Gemma-4-E4B’s hidden states followed 39 of 40 materials-physics laws in a 60-law counterfactual benchmark.
• Steering vectors flipped grain-size answers toward “higher” or “lower” strength in 12 of 12 matched cases.
• Anthropic’s Jacobian lens doing the work was released barely 2 months before this paper.
• Critics call the lens a sophisticated output-probability tracker, not a window into model reasoning.

What Buehler actually shows

Markus Buehler (MIT) ran a battery of mechanistic-interpretability probes on the open-weight google/gemma-4-E4B-it (42 layers, 2,560-dim) and argues that materials-science mechanisms live inside the model in three experimentally separable forms: readable in individual hidden states, oriented as transformations between states, and causally steerable to change engineering answers. The headline numbers are strong. A target-free vocabulary readout let a downstream classifier name the correct mechanism family for 58–64% of prompts against a 10% chance baseline. In a 60-law benchmark, state transformations followed the constitutive law (e.g., Hall–Petch: smaller grains → higher strength) in 39/40 directional cases. Steering interventions on grain size shifted answer probabilities the correct way in every one of 12 matched trials.

flowchart LR
    A[Prompt: 'grain size decreased'] --> B[Hidden state h_L]
    B -->|Jacobian lens| C[Verbalizable tokens<br/>'higher strength']
    B -->|+ steering vector| D[Flipped answer<br/>'lower strength']
    B -.->|UMAP geometry| E[Mechanism cluster<br/>62% acc — beaten by lexical 76%]

The tool is borrowed, and its reliability is contested

The Jacobian lens is not Buehler’s invention. Anthropic formalized it in July 2026 as part of their “global workspace” investigation of Claude, where it surfaces “verbalizable representations” a model is poised to emit but hasn’t written yet ¹³. Buehler is porting a frontier-lab alignment probe into a scientific domain within weeks of release — impressive turnaround, but on a thin base of independent validation. Independent write-ups flag that fitting the lens takes hours, full-vocabulary readouts can inflate inference cost by up to 400%, and on smaller models the J-lens can underperform the plain logit lens without a specific one-parameter correction ¹⁴. That maps directly onto Buehler’s own admission that gains were selective: on “cyclic damage” the older logit lens won outright. His 100.8% average AUC improvement over logit lens (0.0258 vs. 0.0128) also has to be read against the fact that the logit-lens baseline is a 2020 community artifact with well-known early-layer failure modes ¹⁵.

Does this show “understanding” or just probability tracking?

The sharpest critique comes from outside MI proper. Erik Hoel argues the J-lens may be “a highly sophisticated tracker of output probability rather than a window into thought,” in a field “pre-paradigmatic” enough that mathematical elegance keeps getting mistaken for insight ¹⁶.

Steering-changes-output is exactly what a probability tracker would predict — no commitment to the model “understanding” Hall–Petch required.

Buehler partially concedes the ground himself: absolute state geometry hit 62% mechanism-classification accuracy, but was beaten by a plain lexical baseline on input word embeddings at 76%. His stronger claim rests on the relational evidence — that reversing a physical input moves the state in the direction the constitutive law predicts — which is harder to explain as pure lexical shortcut. Broader MI commentary warns of an “interpretability illusion” where clean-looking circuits fail to generalize across datasets ¹⁷; a single-author 60-law benchmark curated by the same team running the probe is exactly the setup that risk describes.

Why it still matters

Code, prompts, the 60-law benchmark and the 72-prompt equivalence cohort are public in the lamm-mit/Substrates repo ¹⁸, which is the strongest thing going for reproducibility. Read narrowly, the paper is a credible template: how to take a two-month-old alignment probe and stress-test it on a domain where the ground-truth physics is unambiguous. Read broadly — as evidence that LLMs “represent physics” — the tooling is too young and the benchmark too bespoke to carry the weight. The right next move is someone outside MIT rerunning the 60-law protocol on a different open-weight model with an independently fit Jacobian lens.

Round-ups

SkewAdam splits MoE optimizer state across backbone, experts, router

Source: hf-daily-papers

SkewAdam treats a mixture-of-experts model’s three parameter populations differently rather than storing identical AdamW moments for each. On a 6.78B-parameter MoE, standard AdamW burns 50.6 GB of first and second moments to update just 12.6 GB of bfloat16 weights, making optimizer state the top memory line item.

ISO exploits spectral inheritance to sharpen RLVR fine-tuning

Source: hf-daily-papers

ISO reframes reinforcement learning with verifiable rewards around the singular structure of model weights, finding that RLVR reuses the base model’s spectra while shifting associated subspaces. The optimizer stack targets those subspaces directly, treating RLVR as a spectral edit rather than generic gradient descent.

Staleness-adaptive trust regions stabilize asynchronous RL rollouts

Source: hf-daily-papers

Asynchronous RL boosts throughput by decoupling rollouts from optimization, but policy lag, engine delays and MoE routing pile up staleness that PPO clipping only weakly constrains. The SAT method scales trust regions by measured training-inference divergence, treating clipping as a sampled surrogate and enforcing a full-policy bound.

Hybrid hindsight self-distillation densifies RLVR reward signal

Source: hf-daily-papers

RLVR typically hands an entire reasoning trajectory one scalar reward, starving token-level credit assignment. H²SD borrows on-policy distillation’s dense token supervision but drops the external teacher, distilling instead from the model’s own successful hindsight rollouts to fill in per-token targets for math and code.

AgentDebugX closes the detect-attribute-recover loop for LLM agents

Source: hf-daily-papers

AgentDebugX targets a core pain of agent debugging: the failing step is rarely the causal one. The open-source toolkit wraps execution traces in a Detect, Attribute, Recover, Rerun loop, with a DeepDebug module running multi-turn root-cause diagnosis over full trajectories before patching and replaying.

AutoIndex searches executable programs that reshape docs before indexing

Source: hf-daily-papers

AutoIndex leaves retrievers and rerankers alone and instead searches over programs that slice, enrich, normalize and reweight documents prior to indexing. Agents diagnose failures on a validation set each iteration and propose new representation programs, treating retrieval quality as a compiler-style optimization target.

Diffusion language models secretly track denoising timestep in residuals

Source: hf-daily-papers

Diffusion language models are not conditioned on a timestep, yet probes recover a latent clock inside their residual streams. The signal encodes denoising progress and is read by downstream layers, showing DLMs learn to self-locate along the diffusion trajectory without being told where they are.

Footnotes

1. AI Weekly aggregation — https://aiweekly.co/alerts/anthropic-says-claude-mythos-found-hawk-7-round-aes-flaws

   To restore original security targets HAWK would likely need to double its key sizes, a move that would eliminate the compactness advantage that made it a competitive candidate against Falcon and ML-DSA.

   ↩

2. CyberScoop — https://cyberscoop.com/anthropic-claude-mythos-encryption-flaws-hawk-aes-pqc/

   NIST mathematician Daniel Apon confirmed the results independently within hours of the public post, noting that the mathematics ‘checked out’; the HAWK authors were notified in June 2026 and helped validate the proof-of-concept before release.

   ↩ ↩²

3. RockCyberMusings weekly digest — https://www.rockcybermusings.com/p/weekly-musings-top-10-ai-security-20260717-20260723

   An anonymous team released findings showing they had achieved a similar result against HAWK using GPT-5.6, albeit through a different mathematical path — parallel discovery suggesting the era of AI-accelerated cryptanalysis is not vendor-specific.

   ↩

4. Schneier on Security blog — https://www.schneier.com/blog/archives/2026/04/mythos-and-cybersecurity.html

   Schneier cautioned that the ‘scary’ framing of Mythos is partly a PR play… smaller, open-source models can reproduce similar results with sophisticated prompting, and researchers from AISLE recovered 100% of the analysis for certain flagship exploits.

   ↩

5. Matthew Green / Decipher release notes — https://aiweekly.co/alerts/matthew-green-releases-decipher-an-ai-assisted-cipher-cracker

   Green highlighted a critical agentic risk: left to their own devices, AI agents often attempt to download and compile unverified, third-party repositories to solve cryptanalysis tasks — arguing AI functions best as a force multiplier for human experts rather than a fully autonomous replacement.

   ↩

6. PostQuantum.com analysis — https://postquantum.com/security-pqc/ai-cryptanalysis-hawk-aes/

   Markku-Juhani Saarinen argued that AI-driven claims should be accompanied by machine-checkable proofs to prevent the community from being overwhelmed… human researchers now spend hundreds of hours verifying what an AI produces in days.

   ↩

7. Seer: Predictive Inverse Dynamics Models (arXiv 2412.15109) — https://arxiv.org/html/2412.15109v1

   Seer generates ‘visual foresight’ tokens to reconstruct future RGB images that guide an inverse dynamics module to speculate intermediary actions, yielding a 43% improvement in real-world tasks and new SOTA on CALVIN ABC-D.

   ↩

8. 1X Technologies — World Model Self-Learning — https://www.1x.tech/discover/world-model-self-learning

   1XWM uses a 14B video backbone that ‘hallucinates’ futures which an Inverse Dynamics Model translates into actuator commands for the NEO humanoid, pre-trained on internet video then mid-trained on 900 hours of egocentric human data before 70 hours of NEO logs.

   ↩ ↩²

9. Ctrl-World project page — https://ctrl-world.github.io/

   Ctrl-World introduces frame-level action conditioning with pose-conditioned memory retrieval, maintaining long-horizon consistency for over 20 seconds and improving real-world policy success from 38.7% to 83.4% via synthetic rollouts.

   ↩

10. Video Language Planning (VLP) project page — https://video-language-planning.github.io/

    VLP uses a tree search where VLMs serve as both policy and value functions and text-to-video models act as the dynamics engine — a precedent for MVA’s Best-of-N with Gemini 1.5 Pro as critic.

    ↩

11. ICRA 2025 Workshop: Beyond Pick-and-Place — https://sites.google.com/view/icra-2025-beyond-pick-place/home

    Robots remain plateaued at pick-and-place behaviors, struggling with the contact-rich skills necessary for industrial assembly or cooking; visual common sense does not account for force-torque requirements of real-world manipulation.

    ↩

12. EmergentMind — DROID dataset overview — https://www.emergentmind.com/topics/droid-a-large-scale-in-the-wild-robot-manipulation-dataset

    DROID comprises ~76,000 teleoperated trajectories across 564 scenes but is exclusively single-embodiment (Franka Panda 7-DoF); zero-shot generalization to very different manipulators still often requires additional data or transfer techniques.

    ↩

13. Anthropic — ‘A Global Workspace in Claude’ (transformer-circuits.pub, July 2026) — https://transformer-circuits.pub/2026/workspace/index.html

    The Jacobian lens computes the linearized effect of an internal activation on the model’s future likelihood of producing specific tokens, surfacing ‘verbalizable representations’ the model is poised to express but has not yet written.

    ↩

14. daily.dev summary of Anthropic Jacobian lens work — https://daily.dev/posts/anthropic-s-jacobian-lens-reveals-a-hidden-internal-workspace-inside-claude-oqggjnazg

    Fitting the lens can take hours, and full-vocabulary readouts during deployment can increase inference costs by up to 400%… on smaller models the J-lens may actually underperform the simpler logit lens unless a specific one-parameter correction is applied.

    ↩

15. nostalgebraist, Alignment Forum — ‘Interpreting GPT: the Logit Lens’ — https://www.alignmentforum.org/posts/AcKRB8wDpdaN6v6ru/interpreting-gpt-the-logit-lens

    The logit lens assumes the model’s internal ‘basis’ aligns with the output space, which is rarely true in early layers — yielding garbled or misleading intermediate readouts.

    ↩

16. Erik Hoel, The Intrinsic Perspective — https://www.theintrinsicperspective.com/p/anthropic-runs-like-wile-e-coyote

    The J-lens might merely be a highly sophisticated tracker of output probability rather than a window into ‘thought’… the field remains in a pre-paradigmatic state where mathematical success is often mistaken for philosophical insight.

    ↩

17. AI Agents Plus — ‘Mechanistic Interpretability, MIT 2026 Breakthrough’ — https://www.ai-agentsplus.com/blog/ai-mechanistic-interpretability-mit-2026-breakthrough-trustworthy-ai-agents

    MIT Technology Review recognized mechanistic interpretability as a 2026 Breakthrough Technology, but critics highlight the ‘interpretability illusion’ where clean-looking circuits fail to generalize across datasets.

    ↩

18. lamm-mit/Substrates GitHub repository — https://github.com/lamm-mit/Substrates

    Repository ships the gemma4-materials-mechanism-prompts corpus spanning 21 dataset configurations, the 60-law counterfactual benchmark, and the 72-prompt answer-scaffold graph for blinded mechanism identification.

    ↩