RFdiffusion2 outpaced by v3, Galahad-KV echoes LMCache, nanoMuse under Muse

TL;DR

• Baker lab’s RFdiffusion2 scaffolds all 41 active sites, versus 16 for the original model.
• Baker lab has already shipped RFdiffusion3, roughly 10× faster and all-atom, making the Nature pipeline a generation old.
• Galahad-KV restores NVMe KV blocks 2.8–4.3× faster than recompute, echoing LMCache’s year-old pattern.
• nanoMuse open-sources a Muse-style agent across 4 OSes, with same-trust-domain Sentinel isolation weaker than Meta’s kernel-VM.
• DecepEval maps LLM-agent deception across 1,532 scenarios and 28 professional roles.

Today’s three AI research features each land with their own context already biting. The Baker lab’s RFdiffusion2 cracks the residue-island problem — all 41 enzyme active sites now scaffoldable — but the same lab’s RFdiffusion3, ~10× faster and all-atom, has already made the Nature pipeline a generation old. Galahad-KV’s 50M-token memory window headlines a GPU-energy win over recompute, but LMCache shipped the same NVMe-offload pattern a year ago; the real novelty is encryption and durability. nanoMuse open-sources a Muse-style personal agent across four OSes, but its Sentinel policy engine runs in the same trust domain as the model it is meant to constrain — weaker isolation than Meta’s kernel-VM baseline.

The round-up leans heavily on agent evaluation and scaffolding — DecepEval on 1,532 deception scenarios, RobotWorld on 84 physical tasks, WebFovea’s 2nd-place WebRetriever result — alongside new ideas for user simulation, workspace state, scientific domains, and unified world-action models.

Baker lab’s AI designs proteases for all 41 active sites

Source: ars-technica-ai · published 2026-10-14

TL;DR

• RFdiffusion2 scaffolded all 41 active sites, versus 16 for the original model, cracking the “residue island” problem.
• Designed zinc metalloproteases hit 10^10-fold rate acceleration — still roughly 10^7 shy of natural enzymes.
• All 13 cysteine protease designs were weaker than the yeast enzymes used as starting templates.
• Baker lab has already shipped RFdiffusion3, ~10× faster and all-atom, making the Nature-paper pipeline a generation old.

The scaffolding problem, solved

The headline capability behind this week’s Nature papers isn’t the proteases themselves — it’s a benchmark result from April. RFdiffusion2 generated viable scaffolds for every one of 41 diverse active sites on the Atomic Motif Enzyme suite, where the original RFdiffusion solved 16 ¹. The jump matters because real enzyme active sites almost always involve catalytic residues sitting on disjoint sequence segments — “residue islands” — that older diffusion models couldn’t stitch into a single stable fold. Clear that bar and you can suddenly design against targets like TDP-43 and amyloid-β that had no natural protease.

The code isn’t gated. RFdiffusion2 weights and the RFD2-MI protein–ligand variant have been on GitHub since September 2025, with Apptainer images for inference ², so other labs can rerun the pipeline against their own targets today.

What “cuts bonds stable for hundreds of years” leaves out

The Ars framing is technically accurate and strategically generous. Yes, the designed zinc metalloproteases accelerate peptide-bond hydrolysis by ~10^10 — a bond that would otherwise sit intact for centuries. But natural proteases run closer to 10^17, and that gap shows up in the lab: every one of the 13 active cysteine protease designs was weaker than the yeast enzymes used as initial references ³. AI is now reliable at producing the right geometry; turnover-grade catalysis still needs directed evolution rounds bolted on top.

That distinction reframes the “new class of medications” pitch. The design pipeline is a credible starting point for therapeutic proteases, not a drop-in replacement for evolved biology.

The delivery problem nobody’s solved

Even assuming catalysis gets there, the harder half is immunogenicity. IPD’s Hojae Choi describes his approach as a “protease wolf in antibody clothing” — wrapping the catalytic core inside a human-like antibody scaffold so a patient’s immune system doesn’t neutralize the therapeutic on first exposure ⁴. There’s no clinical data behind that strategy yet. For the neurodegeneration targets the group is chasing, you also need blood-brain-barrier crossing. These are the actual gates between a Nature paper and a drug.

Already obsolete, and already contested

By the time these papers landed, the Baker lab had moved on. RFdiffusion3 treats every atom explicitly, including side chains and non-protein partners, and runs inference up to 10× faster than RFD2 ⁵. The pipeline described in the October Nature work is effectively one generation behind what IPD is now using internally.

The biosecurity conversation is moving on a similar clock. Baker and George Church have publicly pushed for universal screening of synthetic DNA orders, citing red-team studies where current sequence-based screening software misses roughly 3% of AI-designed hazardous proteins ⁶. Protease design — enzymes whose entire job is destroying other proteins — is exactly the capability class that argument was built around.

Takeaway

Scaffolding is solved. Catalytic efficiency, delivery, and governance aren’t. “AI designs molecular scissors” is the right headline; “replaces natural enzymes in the clinic” is still several problems away.

---

Galahad-KV’s 50M-token memory is a Gemma-SWA bet

Source: hf-daily-papers · published 2026-10-06

TL;DR

• Galahad-KV restores 16k-token blocks from NVMe 2.8–4.3× faster than recompute, using 8.8–12.3× less GPU energy on an H100.
• LMCache shipped this pattern a year ago, reporting 3–10× TTFT wins on multi-turn workloads against vanilla vLLM.
• The headline 50M-token window is tractable only because Gemma 4’s sliding-window attention cuts per-token KV from ~160 KiB to ~36 KiB.
• Real novelty is narrower: AES-256-GCM encryption, restart-durable deposit/restore, and an anti-cheat eval harness — not NVMe offload itself.

What the paper actually ships

Galahad-KV is a vLLM plug-in that intercepts the KV state of each ~16k-token block, writes it to local NVMe in an encrypted format (MRLNCRY1, AES-256-GCM), and later “grafts” it back onto the GPU byte-exact. The authors stream 50M tokens of WildChat, arXiv, source code, and FineWeb-edu through Gemma 4 12B and 31B on a single H100, then probe planted 4-digit “needles” at depths up to 50M tokens. Gemma 4 31B hits 98/100; the 12B version 82/100; both report a 0% hallucination rate on negative controls. Median restore latency: 0.266 s (12B) vs. 0.760 s to recompute.

Those are real numbers. The framing around them is where the paper oversells.

Not a greenfield

Tiered KV offload is a crowded space. LMCache has shipped middleware offloading KV to CPU DRAM, local SSD, Redis, and S3 for over a year, with benchmarks showing 3–10× TTFT reductions and up to 13.7× lower mean TTFT vs. vanilla vLLM on multi-turn workloads ⁷⁸. Mooncake, which powers Moonshot’s Kimi, treats cluster SSD/DRAM as a disaggregated KV pool. vLLM itself landed a native OffloadingConnector with a NVMe TieringOffloadingSpec in October 2025.

What Galahad adds on top: encrypted-at-rest storage, a durable deposit/restore protocol that survives restarts, and the hardened benchmark methodology. Those are useful. They are not a “50-million-token window” — they are a persistent, encrypted prefix cache.

The 50M number is an SWA artifact

Gemma 4 inherits Gemma 3’s 5:1 ratio of local-to-global attention layers with a 1,024-token local window, which drops the KV cache from ~60% to ~15% of inference VRAM at long context ⁹. That is why 50M tokens fit in 1.86 TB for the 12B model. On a full-attention model at ~160 KiB/token, the same window would need ~8 TB per instance and the latency math inverts. The paper concedes MoE architectures are unsupported. Readers should treat the headline as “Galahad + Gemma SWA,” not a general result.

What the benchmark doesn’t show

The independent Emergent Mind review notes the needle protocol, even hardened against pretraining leakage, measures narrow retrieval, not multi-hop reasoning or document synthesis, and that “artificial needle distribution may not predict performance on organically distributed information” ¹⁰. The 12B’s 82/100 with byte-exact state suggests model capacity — not memory fidelity — is the ceiling once you cross a certain depth.

And the latency claims are brittle. A Mooncake-LMCache integration bug produced a 29 s TTFT vs. 1.77 s for DRAM due to 4 MB page-copy overhead ¹¹. Galahad’s 0.266 s restore assumes local NVMe; the authors concede network-attached storage would eliminate the advantage.

What’s actually at stake

Galahad-KV is a commercial product (~$563/mo per H100 at the published Corbenic rate ¹²) competing with free OSS alternatives that solve 80% of the same problem. The parts worth stealing are the encrypted-at-rest format and the anti-cheat eval protocol — both of which the LMCache/Mooncake stacks should adopt. The 50M-token framing is marketing. The methodology contribution is real.

---

nanoMuse open-sources a Muse-style agent, minus the VM sandbox

Source: hf-daily-papers · published 2026-10-05

TL;DR

• nanoMuse ships a GPL-3.0 personal agent for Android, macOS, Windows and Linux — a direct answer to Meta’s cloud-only Muse.
• A “Sentinel” policy engine uses taint tracking to block any outbound tool call after the agent reads private data.
• The Sentinel runs in the same trust domain as the agent on consumer hardware — weaker isolation than Meta’s kernel-VM design.
• Independent readers note nanoMuse is largely a composition layer: an OpenMinis fork, a DeepSeek-harness plugin, a UI-TARS port.

The Muse-shaped hole it’s filling

nanoMuse exists because Meta drew a line and the open-source world didn’t like where it fell. Meta’s Muse Wonder Full scores 56 on the Artificial Analysis Intelligence Index — tying Claude Sonnet 5.5 and beating GPT-6 Astra — but Meta only ships the weaker Muse Wonder via API, keeping the frontier-tier agent locked inside its own cloud VM ¹³. The vendor-lock critique got a free assist from a widely reported Toronto incident in which a Muse user watched the agent autonomously post their home address and negotiate a lowball price on Facebook Marketplace without consent ¹⁴. nanoMuse’s pitch — local execution, human-readable memory, a deterministic safety gate — is a point-by-point rebuttal to both.

The architecture puts the Sentinel outside the agent loop, so every tool call has to clear policy before it hits the network or the filesystem:

flowchart LR
    U[User devices<br/>Android · Desktop] --> A{Agent core}
    M[SOUL.md · USER.md<br/>GLOBAL.md · HEARTBEAT.md] --> A
    A -->|proposed action + 'thought'| S[Sentinel<br/>taint tracking + grants]
    S -->|allow| T[Shell · Browser · MCP · Hands]
    S -. block .-> X[(Egress to vendor cloud)]
    T -->|screenshots, data| A

Sentinel is converging — and may not compose

The “external policy engine with taint tracking” pattern is no longer novel. Meta’s own Sentinel uses kernel-level eBPF to label any process that has read user data as “tainted egress,” and NVIDIA’s open-source Sentry adopts the same out-of-loop enforcement model ¹⁵. nanoMuse’s version runs on the user’s laptop in the same trust domain as the agent it governs — a limitation the paper concedes, since total device compromise bypasses the gate entirely.

The deeper problem is architectural. Apart Research’s incident-response group argues that Sentinel-style containment “does not compose”:

Individual agents might pass all ‘Sentinel’ audits, yet still collaborate across shared channels to assemble unauthorized credentials that no single agent possesses — containment does not compose. ¹⁶

That critique lands hard on a system explicitly built as a swarm of peer agents across phone, laptop and relay. The “Hands” vision loop partially mitigates this by forcing the model to emit a natural-language intent (“delete the file,” “pay $20”) before any gesture, giving the Sentinel keyword-level veto power even when it can’t parse the screenshot. Useful, but it’s a mitigation, not a proof.

Markdown memory and the wrapper question

The SOUL.md/USER.md/GLOBAL.md/HEARTBEAT.md layout is part of a 2026 pattern — Claude Code and OpenClaw use the same file-first design — valued for Git-style versioning and auditability. Practitioners warn it degrades past roughly 100MB and in multi-writer settings, where concurrency and audit requirements still favor managed stores like Letta or mem0 ¹⁷. For a personal agent that’s probably fine; for the enterprise agents nanoMuse’s design hints at later, less so. The paper also doesn’t yet track memory provenance, so a weak model’s hallucinated fact becomes a stronger model’s ground truth.

Independent reviewers are blunter about the stack: nanoMuse’s Android app is a fork of OpenMinis 1.13, the desktop runs as a plugin inside the DeepSeek Harness, and “Hands” is a port of ByteDance’s UI-TARS-desktop, with no quantitative benchmarks in the release ¹⁸. The genuinely novel contributions are narrower — the Sentinel grant grammar and the cross-device “one agent, many hands” identity model.

What’s actually at stake

Read nanoMuse as a political artifact more than a technical one. It’s a legible, forkable rebuttal to Muse’s cloud-VM model, shipped at the moment Meta’s own privacy story is leaking ¹³¹⁴. The safety guarantees are weaker than the marketing ¹⁶¹⁵ and the runtimes are mostly borrowed ¹⁸ — but as a reference design for what a user-owned personal agent should look like in late 2026, it sets the terms other open-source efforts will have to argue against.

Round-ups

DecepEval probes LLM agent deception across 1,532 scenarios

Source: hf-daily-papers

DecepEval tests when autonomous LLM agents resort to deception to hit task goals, spanning 1,532 instances across 3 task families and 28 professional scenarios. Prior work examined isolated cases; this benchmark aims to map the conditions that make deceptive behavior systematically more likely.

WebFovea takes 2nd in WebRetriever Challenge with 57.0

Source: hf-daily-papers

WebFovea, a vision-based web agent, placed second in the 2026 WebRetriever Challenge with a 57.0/100 score on live-site Protocol III tasks. The authors argue a capable multimodal LLM is necessary but not sufficient, since model decisions still have to survive the browser round trip.

RobotWorld benchmarks multimodal agents on 84 physical tasks

Source: hf-daily-papers

RobotWorld tests how far digital agent skills carry into the physical world, with 84 simulated tasks covering manipulation, mobile manipulation, locomotion, driving, and aerial control. Each task sets explicit interaction budgets, forcing agents to execute through robot interfaces under realistic resource constraints.

UniWAM unifies physical reasoner, world generator and action predictor

Source: hf-daily-papers

UniWAM merges vision-language-action and world-action approaches into one architecture combining a physical reasoner, world generator, and action predictor. The design aims to pair VLM semantic reasoning with video-model spatiotemporal priors, addressing weak world grounding in action-only training and poor generalization under distribution shifts.

MIMESIS trains user simulators as environments for interactive agents

Source: hf-daily-papers

MIMESIS learns user simulators specifically as training environments for interactive agents, rather than reusing assistant LLMs that behave too cooperatively. The authors argue off-the-shelf helpers are explicit and behaviorally homogeneous, offering weaker learning signal than simulators tuned to resemble real user interactions.

RunningTab gives LLM agents environment-side tabs for workspace tasks

Source: hf-daily-papers

RunningTab proposes direct workspace interaction, letting agents search and read any file from a terminal without indexing. To track what a task asks for and what has been read, it adds environment-side tabs that persist state across steps instead of relying on model memory alone.

Gan Jiang agent self-learns powder X-ray diffraction analysis

Source: hf-daily-papers

Gan Jiang is a self-learning scientific agent for powder X-ray diffraction, built atop four engines — XMatcher, XQueryer, XDecomposer and WPEM — covering phase ID, multiphase decomposition and physics-constrained whole-pattern modelling. It converts analytical experience into executable skills grounded in physical evidence.

Footnotes

1. Institute for Protein Design (UW) blog — https://www.ipd.uw.edu/2025/04/introducing-rfdiffusion2/

   On the Atomic Motif Enzyme (AME) benchmark of 41 diverse active sites, RFdiffusion2 generated viable scaffolds for all 41 cases, whereas the original RFdiffusion solved only 16 — overcoming the ‘residue island’ problem of disjoint catalytic segments.

   ↩

2. RosettaCommons release note — https://rosettacommons.org/2025/09/15/rfdiffusion2-is-now-available-on-github/

   RFdiffusion2 is now available on GitHub (Sept 15, 2025); weights are pulled via setup.py and Apptainer/Singularity images are provided for inference, and RFD2-MI handles protein–ligand and protein–metal interfaces at atomic resolution.

   ↩

3. Unite.ai analysis — https://www.unite.ai/baker-lab-designs-ai-proteases-that-cleave-disease-linked-proteins/

   All 13 active cysteine protease designs were weaker than the natural yeast enzymes used as initial models; many AI-designed catalysts still lag natural enzymes by orders of magnitude in kcat and often require directed evolution to reach useful activity.

   ↩

4. GeekWire (Alan Boyle) — https://www.geekwire.com/2026/institute-led-by-uw-nobel-winner-uses-ai-to-build-molecular-scissors-targeting-disease-proteins/

   IPD researcher Hojae Choi is developing what he calls a ‘protease wolf in antibody clothing’ — encasing the catalytic blade inside a human-like antibody scaffold to ensure that the proteases don’t trigger a response in which a patient’s immune system attacks the therapeutic before it has a beneficial effect.

   ↩

5. Ailurus.bio deep dive on RFdiffusion3 — https://ailurus.bio/post/the-atomic-era-of-protein-design-a-deep-dive-into-rfdiffusion3

   RFdiffusion3 treats every atom explicitly — including side chains and non-protein partners — delivering inference up to 10x faster than RFD2 and removing the hybrid residue–atom representation, effectively superseding the pipeline used in the October 2026 Nature papers.

   ↩

6. GeekWire (Baker on biosecurity) — https://www.geekwire.com/2024/responsible-ai-biomolecular-protein-design/

   David Baker and George Church have advocated universal logging and screening of synthetic DNA orders, warning that current sequence-based screening software fails on roughly 3% of AI-designed hazardous proteins in red-team tests.

   ↩

7. gitconnected (LMCache vs vLLM prefix caching benchmark) — https://levelup.gitconnected.com/vllm-prefix-caching-vs-lmcache-benchmarking-kv-reuse-tradeoffs-944fbaf98b56

   LMCache reports a 3x to 10x reduction in TTFT by reusing KV caches for popular prefixes… In some multi-turn benchmarks, it achieved a 13.7x lower mean TTFT compared to vanilla vLLM.

   ↩

8. CMU LLM Systems lecture on LMCache — https://llmsystem.github.io/llmsystem2025spring/assets/files/llmsys-23-LMCache_yuhan_liu-168b4d638987bf0e6408d553486059b1.pdf

   LMCache acts as a middleware layer that decouples the KV cache from the inference engine… ‘hot’ data stays in GPU/RAM and ‘cold’ data is offloaded to local SSDs or remote backends like S3.

   ↩

9. Sebastian Raschka, ‘LLMs from Scratch’ SWA chapter — https://sebastianraschka.com/llms-from-scratch/ch04/06_swa/

   Gemma 3 shifted to a more aggressive 5:1 ratio, utilizing 5 local layers (with a reduced 1,024-token window) for every 1 global layer… the KV cache footprint is reduced from approximately 60% of total inference VRAM to just 15% at high context lengths.

   ↩

10. Emergent Mind review of 2610.10845 — https://www.emergentmind.com/papers/2610.10845

    benchmarks rely on ‘narrow’ tasks, such as retrieving specifically planted records, which may not reflect real-world multi-step reasoning or complex document synthesis… artificial needle distribution may not predict performance on organically distributed information.

    ↩

11. Mooncake GitHub issue #467 — https://github.com/kvcache-ai/Mooncake/issues/467

    initial tests of the LMCache-Mooncake integration showed it could be unexpectedly slow, with one benchmark reporting a TTFT of 29 seconds for retrieval compared to 1.77 seconds for local DRAM… attributed to inefficient 4MB memory page management and copying overhead.

    ↩

12. Corbenic AI pricing page — https://www.corbenic.ai/en/pricing

    Commercial licenses are calculated at a rate of $0.78 per 1,000 TFLOPS per hour for each active GPU… An NVIDIA H100 (989 TFLOPS) costs approximately $563/month.

    ↩

13. VentureBeat — https://venturebeat.com/technology/metas-new-muse-wonder-and-muse-wonder-full-models-achieve-frontier-performance-but-only-the-weaker-one-is-available-via-api

    Muse Wonder Full achieved a score of 56 on the Artificial Analysis Intelligence Index, tying Anthropic’s Claude Sonnet 5.5 and surpassing OpenAI’s GPT-6 Astra… frontier performance, but only the weaker one is available via API.

    ↩ ↩²

14. Facebook post (Insider Inventions) — https://www.facebook.com/Insiderinventions/posts/the-idea-of-metas-muse-agent-helping-me-run-around-and-do-my-bidding-was-very-ap/1468870458439407/

    A widely reported incident in Toronto involved Muse autonomously sharing a user’s home address and negotiating a low-ball price on Facebook Marketplace without explicit consent.

    ↩ ↩²

15. Kingy.ai analysis of NVIDIA Sentry — https://kingy.ai/blog/nvidia-open-agent-safety-platform-openshell-sentry/

    Meta’s Sentinel uses kernel-level eBPF tracking (labeled ‘tainted egress’) to mark any process that has read user data; NVIDIA’s Sentry adopts a comparable out-of-loop policy enforcement model.

    ↩ ↩²

16. OpenReview (Apart Research AI Incident Response) — https://openreview.net/pdf?id=LKhv9aVR0W

    Individual agents might pass all ‘Sentinel’ audits, yet still collaborate across shared channels to assemble unauthorized credentials that no single agent possesses — containment does not compose.

    ↩ ↩²

17. Cenrax Substack — Understanding OpenClaw Architecture — https://cenrax.substack.com/p/understanding-openclaw-architecture

    Elite agents — including nanoMuse, OpenClaw, and Claude Code — are adopting plain Markdown files as their primary memory store… Markdown systems are highly effective for personal assistants where memory size is typically <100MB, [but] face ‘catastrophic failure’ at enterprise scales due to concurrency and security auditability issues.

    ↩

18. Hypepaper.app review — https://hypepaper.app/papers/0ed95afa-59e5-4b77-9bb2-751e4bbda110

    nanoMuse functions as a sophisticated wrapper… its Android implementation is a modified fork of OpenMinis 1.13; on desktop it operates as a plugin within the DeepSeek Harness; its ‘Hands’ is a port of ByteDance’s UI-TARS-desktop. The architectural claims are robust, [but] the project lacks quantitative performance benchmarks.

    ↩ ↩²