MIPU drops half its updates, LLMs default to bridge ideas, Tencent opens scanner

TL;DR

• MIPU rejects 53.5% of RL updates whose gains vanish across the trainer-to-inference handoff.
• LLM idea generators pitch 47-64% of proposals as literature bridges, versus 12.1% for human papers.
• Qwen3-8B-Think raises bridge-framed proposals from 49.7% to 71.1% when reasoning mode is enabled.
• Tencent’s AI-Infra-Guard bundles 1,443 vulnerability rules across infra, MCP, agent, and model layers.
• Specialist OpenClaw tops Tencent’s own SkillTrustBench at F1 0.9659, above AI-Infra-Guard.

Today’s AI-research features cover three genuinely different problems. MIPU ships an RL-training filter that rolls back GRPO/PPO updates when the trainer and inference engine assign different token probabilities — roughly half get discarded. A study of LLM research-idea generators finds that 47-64% of proposals frame themselves as bridging disconnected literatures, versus 12.1% for human papers, and switching on ‘thinking’ mode strengthens the effect rather than weakening it. And Tencent’s Zhuque Lab open-sources AI-Infra-Guard, a four-layer red-team CLI with 1,443 vulnerability rules that hosts its own SkillTrustBench leaderboard without topping it. The briefs skew heavily toward vision-language-action robotics and multimodal data work, with GraphRAG alignment and a clinical-deferral framework rounding out the pool.

MIPU rejects RL updates that don’t help the inference engine

Source: hf-daily-papers · published 2026-06-27

TL;DR

• MIPU wraps GRPO/PPO with a verification step that rolls back updates whose gains don’t survive the trainer→inference handoff.
• FP8 rollouts and BF16 training assign different token probabilities, so training-side wins are often mirages.
• ~53.5% rejection rate in independent trials — MIPU discards roughly half its updates.
• Rival fixes — vLLM’s bitwise-consistent kernels and Jet-RL’s unified FP8 flow — attack the same mismatch one layer down.

The mirage MIPU is chasing

Modern LLM RL stacks split work between an inference engine (vLLM, SGLang) that generates rollouts and a training engine (FSDP, Megatron) that computes gradients. Even with synchronized weights, FP8 vs. BF16 precision, different kernels, and decoding quirks make the two engines disagree on token probabilities. GRPO happily optimizes the training-side distribution while the deployed model — the one users actually hit — drifts the other way. The authors call this Objective Misalignment, and they’re not alone: the concurrent VeXact diagnostic shows “even minute numerical outliers induced by mismatch can independently trigger training failure” ¹.

How MIPU gates each update

MIPU (Monotonic Inference Policy Update) is a two-step wrapper. Step 1 replaces the standard old-policy reference in GRPO with a sampler-referenced surrogate, using truncated importance sampling to correct the pre-existing gap between sampler and trainer, and clipping only the current update’s ratio. Step 2 is the interesting part: after syncing the candidate to the inference engine, MIPU measures a post-update inference gap. If the inference policy underperforms the trainer’s prediction beyond tolerance $cc$, the update is rejected and the model rolls back to the last checkpoint.

The ablations are clean. Step 1 alone produces better candidates; Step 2 alone prevents the long-horizon collapse where GRPO’s loss keeps dropping while actual reasoning accuracy tanks. Experiments on Qwen3-1.7B and Qwen3-4B under deliberately aggressive FP8 rollouts show MIPU beating vanilla GRPO, TIS, and MIS baselines on MATH-500 and OlympiadBench ².

The comparison MIPU didn’t run

MIPU is one of at least three responses to the same problem, and the paper only benchmarks against the weakest class of alternative:

The vLLM/TorchTitan recipe simply aligns the numerics so the two engines return identical logits — no mismatch, no wrapper needed ⁴. Jet-RL argues you can run FP8 end-to-end and gain 44% throughput without hurting convergence ⁵. Both approaches implicitly challenge MIPU’s premise: if the mismatch is a kernel bug, patch the kernel.

The unanswered question is not whether MIPU works, but whether its rollback overhead is preferable to eliminating the mismatch at the kernel or precision layer.

Independent commentary also flags that MIPU isn’t compared against the tuned production PPO/GRPO variants frontier labs actually run ⁶. Combined with the rejection rate, that leaves a real question about wall-clock cost per useful gradient step.

What to take from it

MIPU’s contribution is conceptual as much as algorithmic: it forces the community to write down which policy the RL objective is actually optimizing, and to notice that “the one we deploy” and “the one we differentiate through” are not the same object. That framing will outlast the specific accept/reject mechanics — which, on current evidence, look like a stopgap until bitwise-consistent RL stacks land in mainstream frameworks.

---

LLMs pick “bridge” research ideas 5× more than humans do

Source: hf-daily-papers · published 2026-06-30

TL;DR

• 47–64% of LLM research proposals frame their motivation as bridging disconnected literatures, versus 12.1% for published human papers.
• Enabling “thinking” mode makes it worse — Qwen3-8B-Think jumps from 49.7% to 71.1% bridge-motivated ideas.
• Stanford’s “LLMs are more novel” result survives at the single-idea level while the population collapses onto one recipe.
• The taxonomy measures distributional match to humans, not research impact — a normative choice worth contesting.

The distributional gap

The TasteGap paper reframes LLM ideation evaluation from “is this one idea novel?” to “what does the whole distribution look like?” Using an 11,683-item paired corpus of human papers (ICLR/ICML/NeurIPS 2023–2026 plus Nature Communications across 71 disciplines) and matched LLM generations conditioned on the same local literature context, the authors score each idea along two axes: the opportunity pattern that motivates it and the method paradigm that answers it.

Human ideas spread near-uniformly across seven categories on each axis (normalized entropy ~0.92). LLMs concentrate. Every model tested — Claude-4.6, Gemini-3.1, GPT-OSS, DeepSeek-V4 — over-produces “Bridge Opportunity” motivations (47.1–64.2% vs. humans’ 12.1%) and “Synthesis/Unification” methods (22.5–38.7% vs. 5.1%). Even Gemini-3.1-Pro, the least-collapsed model, has a Total Variation Distance of 0.348 from the human distribution.

The mechanism analysis is the sharpest part. LLMs follow a stereotyped recipe: pick a high-frequency technical concept (multi-omics, diffusion policy), then apply a “safe” operation (integrate, unify). Humans do local interventions — the operation replace appears in 9.13% of human ideas and just 0.92% of LLM ones.

Reasoning sharpens the collapse

The counterintuitive finding: extended reasoning doesn’t diversify output, it concentrates it further. Qwen3-8B goes from 49.7% to 71.1% bridge motivations when “think” mode is enabled. DeepSeek-V4-Flash shows the same drift.

This isn’t an artifact of the prompt. Independent post-training work argues that most semantic diversity is destroyed during SFT and RLHF, and — critically — that suppressing reasoning tokens at inference doesn’t recover it: “collapse is embedded in the weights, not the format” ⁷. TasteGap is measuring a general property of alignment-tuned reasoning models, not a quirk of ideation.

Reconciling the Stanford novelty result

Last year’s most-cited ideation study found blind reviewers rated LLM ideas more novel than human expert ideas ⁸. TasteGap doesn’t refute that — it explains it. Reviewers judge one idea at a time; they never see that 60% of the population is the same “bridge two fields with a synthesis” template. The same Stanford group’s 2025 execution follow-up sharpens the picture: once 43 researchers actually built the ideas, the LLM novelty advantage flipped and AI proposals scored significantly worse on realized quality ⁹. TasteGap offers a mechanism — the safe synthesis recipe collapses under empirical stress.

Is human-matching the right yardstick?

Two caveats keep this from being a clean indictment. First, the gap is malleable: assigning ordinary personas (not “Steve Jobs”) shifts outputs into more diverse semantic regions ¹⁰, and heterogeneous multi-agent setups reduce mode collapse in ways single-shot evaluation can’t see. Second, a contrarian result argues bridging is a feature: Idea-Catalyst forced cross-domain analogical retrieval and got a 21% novelty gain ¹¹.

The deeper critique is measurement. TasteGap uses an LLM annotator against a static NSF/NIH-derived taxonomy and reports TVD against the human distribution. But the HindSight framework showed LLM judges find no gap where temporal-impact analysis finds a 2.5× gap ¹². Matching the human idea distribution is not the same as matching human research impact — humans over-produce failed directions too. High inter-annotator kappa (0.81–0.93) validates the labels, not the choice of yardstick.

---

Tencent open-sources a 4-layer agent red-team scanner

Source: hf-daily-papers · published 2026-06-29

TL;DR

• Tencent Zhuque Lab shipped AI-Infra-Guard, an open-source CLI covering infra, MCP, agent-behavior, and model red-teaming in one pass.
• Ships 1,443 vulnerability rules across 75 AI components, plus 26+ jailbreak operators against 16 datasets.
• On Tencent’s own SkillTrustBench, specialist OpenClaw leads at F1 0.9659 — A.I.G. hosts the leaderboard, doesn’t top it.
• Maintainers classify prompt injection into the auditor as “expected behavior”, not a bug — only OS/network/filesystem escapes count.

The pitch: one scanner for the whole agent stack

Most AI-security tools pick a lane. mcp-scan (now Snyk agent-scan) handles tool-shadowing, MCPShield chases typosquatting, MCPhound v3 graphs cross-server rug-pulls ¹³. AI-Infra-Guard’s bet is that the attack surface is layered enough that no single specialist covers it, and a CI-time scanner should sweep all four layers at once.

flowchart TB
    A[M1: Infrastructure<br/>Go rule engine · 107 fingerprints · 1443 CVEs] --> Z[AI-Infra-Guard]
    B[M2: MCP servers<br/>LLM auditor · code + live endpoints] --> Z
    C[M3: Agent skills<br/>Prompt-as-Rule vetting] --> Z
    D[M4: Model layer<br/>26+ jailbreak operators · 16 datasets] --> Z

M1 is deterministic: a hand-written Go expression interpreter matches fingerprint rules (Ollama, vLLM, Dify, LangFlow, MLflow…) against version-normalized banners, with 87 “empty-predicate” rules that fire even when the version string is missing. M2–M3 flip paradigms to “Prompt-as-Rule” — natural-language criteria handed to an LLM auditor with tools to read repos and poke live MCP endpoints. M4 is a multi-turn black-box red-team harness with escalation ladders and stop rules to cap token spend.

Independent numbers cut both ways

The breadth story checks out on the infrastructure layer. runZero has documented unauthenticated Ollama instances exposed to the public internet at scale ¹⁴ — exactly the kind of long-tail misconfiguration a fingerprint-driven scanner catches and a governance gateway doesn’t.

On the skills-audit layer, OASB’s benchmark reports traditional scanners flagging between 3.8% and 41.9% of malicious skills with low overlap between tools, while an A.I.G.-style agentic pipeline hits 82.9% F1 at a 1.16% false-positive rate ¹⁵. A practitioner review echoes the depth argument: static heuristics catch 6.6% of malicious skills, agentic deep-audit gets to 16.4% ¹⁶.

The awkward datapoint is Tencent’s own SkillTrustBench. On the tool leaderboard, “Skill Vetter” (OpenClaw) leads at F1 0.9659, followed by Cisco’s Skill Scanner and NVIDIA’s SkillSpector ¹⁷. On the judge-model axis, Claude Opus 4.6 and GLM 5.1 clear 0.98. A.I.G. is the venue, not the winner.

The maintainers’ fine print

The CLAUDE.md and issue-triage policy in the repo are unusually blunt about scope. AI-Infra-Guard is documented as a single-operator tool with no permission boundaries between users, and prompt injection into the auditor — feeding a malicious skill package that hijacks the scanning LLM — is classified as expected behavior. Only escapes to the underlying OS, network, or filesystem count as vulnerabilities ¹⁸. That’s a defensible line for a CI-gate binary, but it rules out any read of A.I.G. as a multi-tenant SaaS guardrail.

Takeaway

If you already run mcp-scan or MCPhound, A.I.G. isn’t going to displace them on their home turf — the specialist leaderboards say so. What it does offer is a single artifact that touches the Ollama exposure, the MCP server audit, the skill-package review, and the jailbreak sweep in one pass, with the rule corpora and attack operators open under CC BY 4.0. That’s a useful default for teams standing up an AI security posture from zero. It’s not the tool that wins the benchmark Tencent itself is hosting.

Round-ups

Embodied.cpp runs vision-language-action models across heterogeneous robots

Source: hf-daily-papers

Embodied.cpp is a portable C++ runtime for deploying vision-language-action and world-action models on edge robots with mixed hardware. Modular execution layers handle multi-rate, latency-first inference for closed-loop control, letting a single stack target diverse embodied platforms without per-device model rewrites.

VLA-Corrector adds closed-loop replanning to action-chunked robot policies

Source: hf-daily-papers

Vision-language-action models typically execute action chunks open-loop, which hurts contact-rich tasks. VLA-Corrector attaches a lightweight latent-space vision monitor that detects truncation events in visual feature evolution and triggers online gradient guidance, adapting the action horizon for corrective replanning without retraining the base policy.

OrbitQuant quantizes diffusion transformers without per-timestep recalibration

Source: hf-daily-papers

OrbitQuant applies post-training quantization to image and video diffusion transformers using a normalized rotated basis built from randomized permuted block-Hadamard transforms and Lloyd-Max codebooks. The data-agnostic scheme skips recalibration across timesteps and modalities, cutting the usual overhead of quantizing generative transformers.

DataComp-VLM benchmark shows mixing beats filtering for VLM data

Source: hf-daily-papers

DCVLM extends the DataComp framework to vision-language models, standardizing how researchers evaluate data curation across multimodal token budgets. Across downstream benchmarks and scales, blending heterogeneous sources outperforms aggressive filtering, reframing VLM data work around mixture design rather than quality thresholds alone.

MultAttnAttrib grounds long-document QA answers without training

Source: hf-daily-papers

MultAttnAttrib pinpoints evidence in long multimodal documents by reading attention-head activations from a single prefill pass and applying calibrated thresholds. The training-free method beats prior attribution-generation approaches on both accuracy and inference latency, offering a cheap way to ground QA systems in source pages.

AGE aligns graph embeddings for retrieval-augmented LLM generation

Source: hf-daily-papers

GraphRAG systems suffer when graph embeddings drift from LLM latent features. AGE fixes the misalignment with a Transformer-based self-supervised objective and a learnable node sampler that picks key nodes during adaptive masking, improving GraphQA retrieval quality for structured knowledge sources.

MANANA teaches LLMs to defer on uncertain pediatric epilepsy cases

Source: hf-daily-papers

MANANA is a non-parametric prompt-learning framework for anti-seizure medication decisions that adapts to local prescribing patterns from longitudinal clinic notes. Bayesian prompt averaging yields calibrated uncertainty, letting the model defer low-confidence cases to clinicians rather than reinforcing distribution-miscalibrated prescribing in underrepresented settings.

Footnotes

1. arXiv 2510.26788 (VeXact diagnostic) — https://arxiv.org/html/2510.26788v1

   even minute numerical outliers induced by mismatch can independently trigger training failure

   ↩

2. ResearchGate mirror of MIPU paper (benchmark detail) — https://www.researchgate.net/publication/408236209_The_Mirage_of_Optimizing_Training_Policies_Monotonic_Inference_Policies_as_the_Real_Objective_for_LLM_Reinforcement_Learning

   MIPU improves reasoning performance across five major mathematical benchmarks including MATH-500 and OlympiadBench, but shows an approximate 53.5% rejection rate in some trials

   ↩ ↩²

3. OPT-ML 2025 workshop paper (NeMo RL / TIS) — https://opt-ml.org/papers/2025/paper116.pdf

   token-level Truncated Importance Sampling corrects the distribution gap between rollout and training, enabling stable training even under aggressive 8-bit quantization

   ↩

4. vLLM engineering blog — https://vllm.ai/blog/2025-11-10-bitwise-consistent-train-inference

   bitwise consistent on-policy RL by aligning numerics between vLLM inference and TorchTitan training, using batch-invariant kernels

   ↩ ↩²

5. arXiv 2601.14243 (Jet-RL unified FP8) — https://arxiv.org/html/2601.14243v2

   a unified FP8 precision flow for both training and rollout… demonstrated up to 44% throughput gains without sacrificing convergence stability

   ↩ ↩²

6. AI Weekly summary of MIPU — https://aiweekly.co/alerts/arxiv-paper-says-llm-rl-optimizes-the-wrong-policy-offers-mipi

   the original research does not yet compare the method against specific production-grade variants of PPO or GRPO used by major labs today

   ↩

7. BD Tech Talks — ‘Escaping the chain-of-thought trap’ — https://bdtechtalks.substack.com/p/escaping-the-chain-of-thought-trap

   Most semantic diversity is lost during supervised fine-tuning and alignment; even when reasoning tokens are suppressed at inference time, final-answer diversity remains low — collapse is embedded in the weights, not just the format.

   ↩

8. Si, Yang & Hashimoto (arXiv 2409.04109) — https://arxiv.org/abs/2409.04109

   LLM-generated ideas are judged as more novel (p < 0.05) than human expert ideas while being judged slightly weaker on feasibility.

   ↩

9. Si et al. follow-up, ‘The Ideation-Execution Gap’ (arXiv 2506.20803) — https://arxiv.org/abs/2506.20803

   After executing the ideas, reviewers’ scores of AI-generated ideas decreased significantly more than those of human-generated ideas, flipping the previous novelty advantage.

   ↩

10. ResearchGate — ‘Examining and Addressing Barriers to Diversity in LLM-Generated Ideas’ — https://www.researchgate.net/publication/401178492_Examining_and_Addressing_Barriers_to_Diversity_in_LLM-Generated_Ideas

    Assigning ordinary personas (rather than famous figures like Steve Jobs) anchors models in more diverse regions of semantic space, partially closing the diversity gap with humans.

    ↩

11. arXiv 2603.12226 — ‘Idea-Catalyst’ (interdisciplinary ideation) — https://arxiv.org/abs/2603.12226

    Reformulating local problems into domain-agnostic concepts and retrieving analogues from distant fields improved the novelty of research goals by 21%.

    ↩

12. HindSight framework (OpenReview M23dTGWCZy) — https://openreview.net/pdf?id=M23dTGWCZy

    Traditional LLM judges find no significant difference between vanilla and retrieval-augmented idea generation, but temporal-impact evaluation reveals retrieval-augmented systems produce ideas with 2.5x higher future research impact.

    ↩

13. AgenticWire — MCP scanner comparison — https://www.agenticwire.news/article/mcp-security-scanners-comparison

    three primary scanners emerged… mcp-scan (later integrated as snyk-agent-scan), MCPShield, and MCPhound v3… MCPhound v3 uniquely maps complex, cross-server attack chains [and] rug-pull vulnerabilities

    ↩

14. runZero blog — Ollama exposure — https://www.runzero.com/blog/ollama/

    Ollama’s default lack of authentication is combined with public internet exposure

    ↩

15. OASB Skills Security Benchmark — https://oasb.ai/benchmark

    traditional scanners show flag rates between 3.8% and 41.9% with low overlap, [while] specialized pipelines like the one used by A.I.G. can maintain a precise 1.16% FPR while achieving an 82.9% F1 score

    ↩

16. Medium technical review (foraisec) — AI-Infra-Guard v2 — https://medium.com/@foraisec/a-technical-review-of-ai-infra-guard-v2-new-mcp-server-security-analysis-tool-6733a7f319e0

    surface heuristics might flag 6.6% of malicious skills, A.I.G’s deep audit identifies up to 16.4%

    ↩

17. Tencent SkillTrustBench leaderboard — https://matrix.tencent.com/skilltrustbench/

    ‘Skill Vetter’ (OpenClaw) currently leads with an F1 score of 0.9659, followed by Cisco’s Skill Scanner and NVIDIA’s SkillSpector… Claude Opus 4.6 and GLM 5.1… achieving F1 scores exceeding 0.98

    ↩

18. AI-Infra-Guard GitHub CLAUDE.md / issue triage — https://github.com/Tencent/AI-Infra-Guard/blob/main/CLAUDE.md

    maintainers explicitly state that A.I.G is a single-operator tool with no intended permission boundaries between users… maintainers classify prompt injection as ‘expected behavior’ within the tool, only triaging reports that demonstrate a bypass of OS, network, or filesystem boundaries

    ↩