gpt-oss-20b jailbroken 61% via style, PP-OCRv6 hits edge, Willison ships Moebius

Sources

Prompt Injection as Role Confusion simonwillison.net

Prompt Injection as Role Confusion First, I absolutely love this: This is a blog-style writeup of the paper. I wish every paper would come with one of these. Academic writing is pretty dry - the impact of a paper can be so much higher if you publish a readable version to accompany the formal one. Charles Ye, Jasmine Cui, and Dylan Hadfield-Menell present some fascinating research into the challenge of having models distinguish their own privileged text (here wrapped in role tags like ,…

PP-OCRv6 on Hugging Face: 50-Language OCR from 1.5M to 34.5M Parameters huggingface.co

Porting the Moebius 0.2B image inpainting model to run in the browser with Claude Code simonwillison.net

This morning on Hacker News I saw Moebius: 0.2B Lightweight Image Inpainting Framework with 10B-Level Performance , describing a small but effective inpainting model - a model where you can mark regions of an image to remove and the model imagines what should fill the space. The released model required PyTorch and NVIDIA CUDA , but since it described itself as 0.2B I decided to try and get it running using WebGPU in a browser. TL;DR: I got it working, and you can try the demo at simonw.github.i…

Shipping huggingface_hub every week with AI, open tools, and a human in the loop huggingface.co

The huggingface_hub library now ships every week, with AI agents and open tooling handling release prep while a human stays in the loop. The cadence shift aims to cut the lag between contributor merges and downstream availability across the Hub ecosystem.

We got local models to triage the OpenClaw repo for FREE!* huggingface.co

Hugging Face engineers wired local open-weight models into the OpenClaw repository to triage incoming pull requests without paying for hosted inference. The setup shows maintainer workflows running entirely on a developer machine, sidestepping API bills that scale with contributor volume.

Codex-maxxing for long-running work openai.com

Codex can carry context across long-running engineering work, according to a walkthrough from Jason Liu published by OpenAI. He outlines how to preserve project state, manage complex tasks, and let the agent continue work beyond a single prompt boundary.

References

Kaggle red-teaming writeup (OpenAI gpt-oss-20b) kaggle.com

The ‘Structural CoT Bypass’ method achieved an ASR of approximately 52.75% on the StrongReject benchmark and 67.15% on HarmfulBehaviors… When combined with ‘Fake Over-Refusal’, the ASR surged to 87.15%.

Ye et al., arXiv:2603.12277 (paper HTML) arxiv.org

CoT Forgery achieved ~60% on StrongREJECT and 61% on agent exfiltration across frontier models that resisted standard prompt injections (0–2% success); destyling drops attack success from 61% to ~10%.

Simon Willison on CaMeL (Apr 2025) simonwillison.net

CaMeL maintains a 77% task utility (down from 84% in undefended systems) but effectively mitigates the most dangerous exfiltration and state-changing attacks that standard patterns fail to stop.

Reversec Labs — Design Patterns to Secure LLM Agents labs.reversec.com

Because authority is assigned in latent space, an attacker can still trigger a role shift by styling their payload to appear as a trusted internal process, regardless of the channel it arrived through — explaining why StruQ and Spotlighting remain heuristic.

LessWrong — ‘A mechanistic explanation of prompt injection’ lesswrong.com

Role probes reveal that injected text often occupies the same representational space as the trusted roles it imitates; the degree of internal role confusion predicts attack success before the model generates a single token.

Hacker News thread (developer comments) news.ycombinator.com

Role tags were always merely ‘formatting tricks’ rather than a true security architecture… LLMs are ultimately just mathematical functions where any separation of data and control is ‘stapled on top’.

gigagpu.com OCR shootout gigagpu.com

PaddleOCR leads in ‘noisy’ scanned documents and curved text (88.7% accuracy) compared to Tesseract (52.1%) and EasyOCR (82.4%).

Hugging Face — PaddlePaddle/PaddleOCR-VL model card huggingface.co

PaddleOCR-VL 1.6 is a 0.9B-parameter VLM combining a NaViT-style dynamic-resolution encoder with ERNIE-4.5, scoring 96.33% on OmniDocBench for full-document parsing.

Ollama PaddleOCR-VL listing ollama.com

Unlike the PP-OCRv6 pipeline, which requires post-processing to reconstruct document layouts, the VLM approach interprets the entire page context to output structured Markdown or JSON directly.

PaddleOCR GitHub releases / issues github.com

A NotImplementedError occurs during the text-detection phase when running PaddleOCR 3.7.0 with PaddlePaddle 3.3.1 on certain Linux environments; users report persistent memory leaks in both the Python and C++ interfaces.

n1n.ai independent PP-OCRv6 guide explore.n1n.ai

PP-OCRv6 tiny is reported to be 3.9x faster than its predecessor on Intel Xeon CPUs and achieves a 6.1x acceleration on Apple’s M4, but at 1024px the ‘small’ model can outperform ‘tiny’ on GPUs because the workload fails to saturate parallel compute units.

arXiv PP-OCRv6 technical report (2606.13108) arxiv.org

The v6 evaluation set includes a specialized hallucination evaluation set designed to test fidelity to raw visual input — large VLMs like GPT-5.5 or Gemini-3.1-Pro often ‘correct’ intentional misspellings based on language priors, whereas PP-OCRv6 is scored on faithful reproduction.

Hacker News thread on Moebius (item 48630171) news.ycombinator.com

Inpainted regions appear visibly smoother than their surroundings, and the model struggles with novel objects… UNet weights were released in fp32, with commenters suggesting fp16 quantization could substantially cut the 1.3GB download. Critics asked whether the demo images were cherry-picked given the model’s fixed 512x512 resolution.

MDN — Storage quotas and eviction criteria developer.mozilla.org

Default ‘best-effort’ storage can be evicted under storage pressure without user consent; calling navigator.storage.persist() is required to exempt an origin, and Safari on iOS clears caches after roughly 14 days of inactivity unless the site is added to the home screen.

Hugging Face Diffusers — Inpainting docs huggingface.co

Inpainting UNets take 9 input channels (4 latent + 4 masked-image latent + 1 mask) and require the mask to be downsampled from 512x512 pixels to a 64x64 latent mask; misalignment between dynamic latent and mask dimensions causes visible seams or runtime errors.

Lenny’s Newsletter — AI State of the Union (citing Willison) lennysnewsletter.com

Willison defines vibe coding as ‘fast, loose, and irresponsible’ where the user ignores code quality and focuses solely on whether the output works, contrasting it with ‘agentic engineering’ where developers retain strict review accountability — though he notes the categories are blurring as models become reliable enough that even experts skip manual scrutiny.

Addy Osmani — Agentic Code Review addyosmani.com

Filing PRs containing unreviewed agent output is an anti-pattern that effectively offloads the cognitive work onto human collaborators; the ‘hard part of engineering’ has shifted from writing code to reviewing it.

hustvl/PixelHacker GitHub (predecessor inpainting framework) github.com

Earlier hustvl inpainting work (PixelHacker) reached strong Places2/CelebA-HQ/FFHQ numbers at far larger parameter counts; Moebius’s claim of ‘10B-level performance’ at 0.22B rests on an adaptive multi-granularity latent-space distillation strategy plus the Local-λ Mix Interaction block.