@misc{arxiv2609.03884,
  title = {{A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors}},
  author = {Pengxun Li},
  year = {2026},
  eprint = {2609.03884},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03884},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.00400,
  title = {{Representation Transitions Reveal Emerging Safety Risks in Multi-Turn LLM Agents}},
  author = {Haoyu Wang and Wei Zhao and Yedi Zhang and Christopher M. Poskitt and Jun Sun},
  year = {2026},
  eprint = {2610.00400},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00400},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.17817,
  title = {{Reflections on Trusting Trust, Revisited: Contaminating Self-Modifying AI Coding Agents with Poisoned Benchmarks}},
  author = {Franziska Roesner},
  year = {2026},
  eprint = {2609.17817},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.17817},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.02774,
  title = {{CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation}},
  author = {Varun Gadey},
  year = {2026},
  eprint = {2609.02774},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02774},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.02015,
  title = {{On Language Drift during RLVR Post-Training}},
  author = {Michael Sullivan and Alexander Koller},
  year = {2026},
  eprint = {2610.02015},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02015},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.00430,
  title = {{Memetic Trojans: Social Contagions as Carriers of Adversarial Payloads in Agent Networks}},
  author = {Birk Torpmann-Hagen and Finn Schwall and Leon Moonen},
  year = {2026},
  eprint = {2610.00430},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00430},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.01349,
  title = {{PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents}},
  author = {Fengpeng Li and Qizhou Wang and Yuke Hu and Kemou Li and Jun Liu and Haiwei Wu and Jiantao Zhou and Di Wang},
  year = {2026},
  eprint = {2610.01349},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01349},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.38379,
  title = {{Aligned Data Can Induce Misalignment via Context Confusion}},
  author = {Yavuz Bakman and Duygu Nur Yaldiz and Baris Askin and Swastik Roy and Morteza Ziyadi and Salman Avestimehr and Sai Praneeth Karimireddy},
  year = {2026},
  eprint = {2609.38379},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38379},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.00392,
  title = {{From A2A Attacks to Envelope-Layer Defense: Red-Teaming Evaluation of LLM Agents and a Three-Layer Isomorphic Attack-Defense Model}},
  author = {Yuelin Han},
  year = {2026},
  eprint = {2610.00392},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00392},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.01367,
  title = {{High-quality Data Do not Mean Safe! Poisoning LLMs after Data Selection}},
  author = {Kaiyang Li and Jiahao Chen and Yuwen Pu and Chunyi Zhou and Tong Zhang and Bin Cai and Chunqiang Hu and Haibo Hu},
  year = {2026},
  eprint = {2610.01367},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01367},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.00685,
  title = {{Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projection}},
  author = {Jianwei Li and Jung-Eun Kim},
  year = {2026},
  eprint = {2610.00685},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00685},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.01768,
  title = {{The Innocent Courier: Covert Exfiltration Through Legitimate LLM Web Fetching}},
  author = {Alessandro Pegoraro and Daryan Merx and Phillip Rieger and Ahmad-Reza Sadeghi},
  year = {2026},
  eprint = {2610.01768},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01768},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.39838,
  title = {{Learning Steganography Is Easy, Learning Steganographic Reasoning Is Hard}},
  author = {Julian Schulz and Lukas F\"ulle and Rieke Fruengel},
  year = {2026},
  eprint = {2609.39838},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39838},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.10883,
  title = {{Story Imprinting: AI Assistants Absorb Traits from Human Characters They Resemble}},
  author = {Jorio Cocola},
  year = {2026},
  eprint = {2609.10883},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10883},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.00348,
  title = {{Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisation}},
  author = {Minoo Kim and Vasileios Lampos and George Drayson},
  year = {2026},
  eprint = {2610.00348},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00348},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.00797,
  title = {{Sapien: A Stateful Policy Engine for Autonomous AI Agents}},
  author = {Corinn Tiffany and Wen Zhang and Eugene Bagdasarian and Lillian Tsai},
  year = {2026},
  eprint = {2610.00797},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00797},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.35928,
  title = {{Prompted Identity Degrades Cooperation in Multi-Agent LLM Systems}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.35928},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35928},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.39863,
  title = {{FIGS: Evaluating Multi-Turn Sycophancy Without Penalizing Empathy}},
  author = {Sidharth Pulipaka and Ruta Binkyte and Ivaxi Sheth and Sahar Abdelnabi},
  year = {2026},
  eprint = {2609.39863},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39863},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.32536,
  title = {{Do Audio LLMs Listen Before They Act? Diagnosing Acoustic-Context Gating in Voice Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.32536},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32536},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.01497,
  title = {{OpenMTB-Audit: Exposing Over-Refusal and Clinical Expert Perspectives in LLM-Based Molecular Tumor Board Safety Evaluation}},
  author = {Negin Ashrafi and Jia Luo and Stacey M. Frumm and Roxana Daneshjou},
  year = {2026},
  eprint = {2610.01497},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01497},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.00327,
  title = {{Actions with Receipts: Jointly Binding Claims, Evidence, and Execution for Replayable Tool-Agent Auditing}},
  author = {Miaobo Hu and Shuhao Hu and Xiaobo Guo and Xin Wang and Bokun Wang and Yina Sa and Daren Zha and Jun Xiao},
  year = {2026},
  eprint = {2610.00327},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00327},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.02098,
  title = {{Are We Recovering Mechanisms? Objective-Level Recovery Gaps in Mechanistic Interpretability}},
  author = {Chuqin Geng and Li Zhang and Haolin Ye and Mark Zhang and Luke Zhang and Xujie Si},
  year = {2026},
  eprint = {2610.02098},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02098},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.38847,
  title = {{Scoring Higher, Answering Worse: Mitigating Reward Hacking in Rubric-Based RL via Protocol-Level Rubrics}},
  author = {Maoqi Liu and Junwei He and Bowen Zhang and Feiran Li and Wentao Ma and Rongyi Lin and Shuhan Zhong and Quan Fang},
  year = {2026},
  eprint = {2609.38847},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38847},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.38604,
  title = {{Beyond Oracle Communication: Benchmarking Interactive Intent Alignment Under Miscommunication and Evolving User Intent}},
  author = {Zheyuan Zhang and Mengyuan Chao and Ke Xiao and Ziyi Chen and Daoan Zhang and Yan Zhang and Yanfang Ye and Wei Xu},
  year = {2026},
  eprint = {2609.38604},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38604},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.34274,
  title = {{BIABench: Evaluating AI agents on real-world bioimage analysis tasks}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.34274},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34274},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.38389,
  title = {{The Geometry of Harmfulness in Multi-Turn Attacks}},
  author = {Yelyzaveta (Lisa) and Husieva and Lauren Alvarez},
  year = {2026},
  eprint = {2609.38389},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38389},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.39688,
  title = {{ShieldCLIP: Selective Safety Alignment for Harmful Content Mitigation in Multimodal Foundation Models}},
  author = {Tobia Poppi and Silvia Cappelletti and Samuele Poppi and Marcella Cornia and Lorenzo Baraldi and Diego Garcia-Olano and Rita Cucchiara},
  year = {2026},
  eprint = {2609.39688},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39688},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.40286,
  title = {{Linguistic Loopholes in LLM Unlearning: From a 174-Language Benchmark to Coverage-Aware Unlearning}},
  author = {Tyler Skow and Shravan Chaudhari and Rama Chellappa and Abhay Yadav},
  year = {2026},
  eprint = {2609.40286},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.40286},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.00850,
  title = {{AuraForge: Scaling Security Supervision for Training Coding Agents}},
  author = {Danqing Wang and Songwen Zhao and Harsh Sharma and Jierui Wang and Andre Vicente Duarte and Ivan Bercovich and Lei Li},
  year = {2026},
  eprint = {2610.00850},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00850},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.01821,
  title = {{Beyond Linear Concepts: Discovering and Aligning Non-Linear Concept Manifolds in Large Language Models}},
  author = {Tido Specht and Elias Benedict Krey and Nils Neukirch and Nils Strodthoff},
  year = {2026},
  eprint = {2610.01821},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01821},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.01428,
  title = {{Generalization Is Stability, Not Accuracy: Multi-Axis Evaluation of LLMs}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.01428},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01428},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.32520,
  title = {{When Users Change Their Minds: Measuring and Repairing Intent Drift in LLM Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.32520},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32520},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.00883,
  title = {{DeBERTa-ConPara: Attack-Aware and Deployment-Realistic Detection of AI-Generated Text}},
  author = {Mohamed Mady and Yupei Li and Johannes Reschke and Bj\"orn W. Schuller},
  year = {2026},
  eprint = {2610.00883},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00883},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.15886,
  title = {{Inoculation Midtraining with Learned Neologisms}},
  author = {Kyle O'Brien},
  year = {2026},
  eprint = {2609.15886},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15886},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.14796,
  title = {{AI Persuasion as a Threat to Human Control}},
  author = {Joshua Levy},
  year = {2026},
  eprint = {2609.14796},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14796},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.01045,
  title = {{Empty Commitments: When Agents Promise What Their Runtime Cannot Deliver}},
  author = {Jiaqi Tang and Lan Wei and Bingyu Shen and Boyang Li},
  year = {2026},
  eprint = {2610.01045},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01045},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.01058,
  title = {{MOMAT: Mixture of Multiple Atlases for Low-Power Jailbreak Defense of Quantized LLMs}},
  author = {Boyang Li and Bingyu Shen and Weihao Hong and Zhiyuan Jiang and Xinlei Guan and Yan Ma and Miles Q. Li and Yi Sheng and Ruiyang Qin},
  year = {2026},
  eprint = {2610.01058},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01058},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.00531,
  title = {{Science or Slop?: Benchmarking and Mitigating Scientific Slop in AI-Generated Papers}},
  author = {Yerim Oh and Young-Jun Lee and Jaewoo Ahn and Gunhee Kim and Dongyeop Kang},
  year = {2026},
  eprint = {2610.00531},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00531},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.01788,
  title = {{SAGE: Similarity-Based Cleaning of Poisoned Training Data from Verified Examples}},
  author = {Chaeeun Han and Soodeh Atefi and Yevgeniy Vorobeychik and Aron Laszka},
  year = {2026},
  eprint = {2610.01788},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01788},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.01062,
  title = {{Kernelized Activation Steering}},
  author = {Laziz U. Abdullaev and Minh-Hieu Pham and Bach Do and Khoat Than and Tan M. Nguyen},
  year = {2026},
  eprint = {2610.01062},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01062},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.01969,
  title = {{RASteer: Retain-Aware Activation Steering for Concept Erasure in Diffusion Models}},
  author = {Yongliang Wu and Haori Lu and Yulun Wu and Jinqi Luo and Xingyu Zhu and Yaoyao Liu},
  year = {2026},
  eprint = {2610.01969},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01969},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.00093,
  title = {{Safety in Self-Evolving Agents: A Survey}},
  author = {Jiahao Chen and Zhou Feng and Oubo Ma and Yichen Yan and Ruixiao Lin and Hangtao Zhang and Linkang Du and Hengyu An and Yong Yang and Jun Liu and Junhao Li and Naen Xu and Chunyi Zhou and Yuan Su and Zehao Jin and Qianli Ma and Leyi Qi and Yiming Wang and Zhe Ma and Yuwen Pu and Mengyao Du and Yuanyi Song and Enhao Huang and Zhihui Fu and Jun Wang and Jinfeng Li and Yuefeng Chen and Hui Xue and Yiming Li and Tianyu Du and Shouling Ji},
  year = {2026},
  eprint = {2610.00093},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00093},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.00328,
  title = {{ContractRL: Shielded Group-Relative Policy Optimization for Auditable Tool-Call Repair}},
  author = {Miaobo Hu and Shuhao Hu and Xiaobo Guo and Xin Wang and Bokun Wang and Yina Sa and Daren Zha and Jun Xiao},
  year = {2026},
  eprint = {2610.00328},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00328},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.02206,
  title = {{KaliBench: A Fine-Grained Benchmark for Cybersecurity Tool Use on Kali Linux with Runtime-Free Verifiable Rewards}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02206},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02206},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.00780,
  title = {{Made to Measure: Designing Image Watermarks to Specification}},
  author = {Mingzhe Li and Yuefeng Peng and Kejing Xia and Pranav Jeyakumar and Ruolan Leslie Famularo and Shiqing Ma},
  year = {2026},
  eprint = {2610.00780},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00780},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.37568,
  title = {{Devils in Question Relay: Source-Conditioned Relay Steering to Mitigate Hallucinations in Audio-visual Large Language Models}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.37568},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37568},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.39107,
  title = {{MASCRDM: Multi-Agent System for Compliance Risk Detection and Mitigation in Training Process of Large Language Models}},
  author = {Yan Zhang and Chuming Wei and Ruien Li and Yaoyao Peng and Wusheng Zhang and Guangwen Yang},
  year = {2026},
  eprint = {2609.39107},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39107},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.00332,
  title = {{The Weakest Link: Distilling LLM Reasoning with Worst-Case Constrained Reinforcement Learning}},
  author = {Matthieu Zimmer and Xiaotong Ji and Tu Nguyen and Haitham Bou-Ammar},
  year = {2026},
  eprint = {2610.00332},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00332},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.01195,
  title = {{Federated Agent Optimization}},
  author = {Qiang Yang and Zhiqiang Kou and Xueyi Zhang and Dong-Dong Wu and Hanlin Gu and Jing Guo and Yang Liu and Di Jiang and Qian Xu},
  year = {2026},
  eprint = {2610.01195},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01195},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.00151,
  title = {{Intrusion Detection for Agentic Processes: Evidence-Based Runtime Monitoring}},
  author = {Arslan Br\"omme},
  year = {2026},
  eprint = {2610.00151},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00151},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2609.11873,
  title = {{The Last AI Built by Humans: Toward Genuine Recursive Self-Improvement}},
  author = {Yi Duan},
  year = {2026},
  eprint = {2609.11873},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11873},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.00895,
  title = {{Towards Fast and Disentangled Counterfactuals for Visual Foundation Models}},
  author = {Sidney Bender and Benedikt Kunz and Ahmed Zeid and Shinichi Nakajima and Klaus-Robert M\"uller and Marco Morik},
  year = {2026},
  eprint = {2610.00895},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00895},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.01864,
  title = {{From Isolated Feature to Orbits: Discovering Music Concepts via Multi-SAE Alignment}},
  author = {Liwei Lin and Gus Xia},
  year = {2026},
  eprint = {2610.01864},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01864},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.02092,
  title = {{Scalable, Transferable Meta-network for Data Selection Requires a Different Loss (and Why the Obvious Choice is Problematic)}},
  author = {Zilin Du and Bowen Yang and Boyang Albert Li},
  year = {2026},
  eprint = {2610.02092},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02092},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.01641,
  title = {{MCIR: A Feature Dependence-Aware Explainability Method with Reliability Guarantees}},
  author = {Poushali Sengupta and Sabita Maharjan and Frank Eliassen and Shashi Raj Pandey and Yan Zhang},
  year = {2026},
  eprint = {2610.01641},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01641},
  note = {AI Safety HOT 2026-10-02}
}

@misc{arxiv2610.01800,
  title = {{LineupRL: Verifiable Reinforcement Learning for Time Series Captioning via Caption-to-Series Identification}},
  author = {Haochen Zhang and Laura Yao and Zachary Plotkin and Gengwei Zhang and Tianlong Chen},
  year = {2026},
  eprint = {2610.01800},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01800},
  note = {AI Safety HOT 2026-10-02}
}