Uncategorized

OpenAI has built an LLM super-hacker called GPT-Red that it uses as a sparring partner to help its other models boost their defenses against cyberattacks. Last week the company released the latest version of its flagship LLM, GPT-5.6. OpenAI says that training it against GPT-Red made the model its most robust release yet. GPT-Red automates a type of safety evaluation for software systems known as red-teaming, which is typically done by a team of human testers. The aim is to find as many different ways to break or hijack a system as possible. The weak spots can then be patched before the final version of the software is released. As LLMs become more complex and get used in a wider variety of tasks—especially in the form of agents, which can interact with computer files, websites, and third-party code as well as other agents—it’s hard for teams of people by themselves to keep up with all the types of attacks that might take place. “The risk surface grows and the blast radius also grows,” says Nikhil Kandpal, a research scientist at OpenAI who co-created GPT-Red. OpenAI built GPT-Red to future-proof its safety testing process. “As more capable models become available, we will have already designed the system that can discover new modes of attack,” says Dylan Hunn, a research scientist at the company and fellow co-creator of GPT-Red. The researchers say it has already come up with new types of attack that had not been seen before. OpenAI focused most of its efforts on a type of attack known as a prompt injection, where a hacker slips an LLM instructions to make it do things its developers or users do not want it to, such as copy confidential information, sabotage a company’s code base, or generate embarrassing or harmful output. In theory, such instructions can be hidden in any text that the LLM might encounter—in code or on a website, for example.     Training dojo To build GPT-Red, OpenAI’s researchers took an LLM that had not been trained as a hacker and set it up in what’s known as a self-play loop with several other models. Its goal was to try to attack the other models; their goal was to try to defend themselves. Over many rounds of play, GPT-Red became better and better at attacking other LLMs, and those LLMs became better and better at fending off the attacks. The training took place in a kind of dojo that OpenAI had designed to mimic a range of scenarios in which LLMs might be deployed in the real world, including browsing the web, reading emails or calendar apps, and editing code.   When GPT-Red found a new kind of attack, it would explore multiple different versions of it to find the most efficient one for specific scenarios. “Compared to a human red-teamer, the model is very, very good at finding exactly what will work, exactly what’s most effective,” says Hunn. “It’s extremely persistent about drilling down into an attack that it has discovered.”   In particular, OpenAI claims that GPT-Red found a type of prompt injection attack that the researchers had not seen before, which they call a fake chain of thought. A chain of thought is a kind of diary in which an LLM makes notes to itself and keeps track of partial results as it works through problems. GPT-Red found a way to insert a fake entry into another model’s chain of thought that would trick that model into acting on spoofed information. “It’s like if I told you that 1+1=3 and that you have verified this already,” says Chris Choquette-Choo, another research scientist on the team. “The model’s like, ‘Oh, okay, of course,’ and it just spits out 3.” Jessica Ji, a senior research analyst who works on AI security at Georgetown University’s Center for Security and Emerging Technology (CSET), thinks the self-play loop that OpenAI used is a good approach. “The results look very promising,” she says. OpenAI tested how good an attacker GPT-Red was by rerunning an experiment from 2025 in which human red-teamers tried to find weaknesses in an earlier version of GPT-5. When GPT-Red was set the same task, it was more successful at finding effective attacks than the humans had been. OpenAI also tested GPT-Red against Vendy, a vending machine agent developed by Andon Labs, a company that assesses how well agents perform real-world tasks. GPT-Red was able to hack Vendy to make it change the prices of items on sale and cancel a customer’s order. Defensive behavior OpenAI says that when it tried out some of the strongest attacks that GPT-Red had come up with on its models, more than 90% of them worked against GPT-5 (released in August last year), and fewer than 23% worked against the new GPT-5.6. GPT-Red isn’t perfect. It is not great at figuring out attacks that involve a back-and-forth conversation between hacker and target, something that human attackers would have few problems with. It is also not yet that great at using images, which can be used to pass text to models in prompt injection attacks.     The company says that GPT-Red supplements the work of its human red-teamers; people can find attacks it misses, and vice versa. One approach OpenAI is taking is to give GPT-Red an attack that humans came up with and ask it to find all the variations. “I think human expertise will still be very important,” says CSET’s Ji. “It would be really useful to be able to distinguish where human testing is most needed.” Unsurprisingly, OpenAI will not be releasing GPT-Red. The company is also confident that the super-hacker is stronger than any copycat model someone might try to create. The researchers say they have been working on the model for more than a year, backed by the compute resources of one of the richest companies in the world. “It’s not a trivial thing that someone else could easily do—you know, just go and train a super-attacker using this idea,” says Choquette-Choo.

In this tutorial, we implement a Gin Config–controlled PyTorch experiment pipeline in which the executable training code remains stable. At the same time, the experimental degrees of freedom are moved into declarative configuration files. We construct a nonlinear spiral binary classification task, define a configurable MLP with scoped architectural variants, and expose parameters for the optimizer, scheduler, loss, batching, seeding, and training loop via @gin.configurable bindings. We use Gin’s scoped references to instantiate separate model configurations, runtime bindings to override selected parameters without editing source code, and operative config export to capture the exact resolved configuration that produces each training run. Installing Gin Config and Building the Spiral Dataset Copy CodeCopiedUse a different Browser !pip -q install gin-config import os import json import math import random import textwrap from pathlib import Path import gin import numpy as np import torch import torch.nn as nn import torch.nn.functional as F from torch.utils.data import TensorDataset, DataLoader import matplotlib.pyplot as plt ROOT = Path(“/content/gin_config_sharp_tutorial”) CONFIG_DIR = ROOT / “configs” RUN_DIR = ROOT / “runs” CONFIG_DIR.mkdir(parents=True, exist_ok=True) RUN_DIR.mkdir(parents=True, exist_ok=True) gin.clear_config() @gin.configurable def seed_everything(seed=42): random.seed(seed) np.random.seed(seed) torch.manual_seed(seed) torch.cuda.manual_seed_all(seed) return seed @gin.configurable def make_spiral_dataset( n_per_class=gin.REQUIRED, noise=0.18, rotations=1.75, train_fraction=0.8, seed=0, ): rng = np.random.default_rng(seed) radius_0 = np.linspace(0.05, 1.0, n_per_class) theta_0 = rotations * 2 * np.pi * radius_0 theta_0 += rng.normal(0.0, noise, size=n_per_class) x0 = np.stack( [ radius_0 * np.cos(theta_0), radius_0 * np.sin(theta_0), ], axis=1, ) radius_1 = np.linspace(0.05, 1.0, n_per_class) theta_1 = rotations * 2 * np.pi * radius_1 + np.pi theta_1 += rng.normal(0.0, noise, size=n_per_class) x1 = np.stack( [ radius_1 * np.cos(theta_1), radius_1 * np.sin(theta_1), ], axis=1, ) x = np.concatenate([x0, x1], axis=0).astype(np.float32) y = np.concatenate( [ np.zeros((n_per_class, 1)), np.ones((n_per_class, 1)), ], axis=0, ).astype(np.float32) order = rng.permutation(len(x)) x = x[order] y = y[order] split = int(train_fraction * len(x)) x_train, y_train = x[:split], y[:split] x_val, y_val = x[split:], y[split:] mean = x_train.mean(axis=0, keepdims=True) std = x_train.std(axis=0, keepdims=True) + 1e-8 x_train = (x_train – mean) / std x_val = (x_val – mean) / std return { “train”: ( torch.tensor(x_train), torch.tensor(y_train), ), “val”: ( torch.tensor(x_val), torch.tensor(y_val), ), “metadata”: { “n_train”: int(len(x_train)), “n_val”: int(len(x_val)), “n_features”: int(x_train.shape[1]), “noise”: float(noise), “rotations”: float(rotations), “seed”: int(seed), }, } @gin.configurable(denylist=[“x”, “y”]) def make_loader( x, y, batch_size=128, shuffle=True, seed=0, ): generator = torch.Generator() generator.manual_seed(seed) dataset = TensorDataset(x, y) return DataLoader( dataset, batch_size=batch_size, shuffle=shuffle, generator=generator, drop_last=False, ) We start by installing Gin Config and importing the core Python libraries, PyTorch, NumPy, and the plotting libraries required for the experiment. We create a clean project directory structure and reset Gin’s global configuration state so the notebook runs reproducibly. We then define the seed function, generate a nonlinear spiral dataset, and build a configurable DataLoader that Gin can control through external bindings. Defining a Gin-Configurable MLP, Optimizer, and Scheduler Copy CodeCopiedUse a different Browser def activation_layer(name): name = name.lower() if name == “relu”: return nn.ReLU() if name == “gelu”: return nn.GELU() if name == “tanh”: return nn.Tanh() if name == “silu”: return nn.SiLU() raise ValueError(f”Unknown activation: {name}”) @gin.configurable class MLP(nn.Module): def __init__( self, input_dim=gin.REQUIRED, hidden_dims=(64, 64), output_dim=1, activation=”gelu”, dropout=0.0, use_layernorm=False, ): super().__init__() layers = [] current_dim = input_dim for hidden_dim in hidden_dims: layers.append(nn.Linear(current_dim, hidden_dim)) if use_layernorm: layers.append(nn.LayerNorm(hidden_dim)) layers.append(activation_layer(activation)) if dropout > 0: layers.append(nn.Dropout(dropout)) current_dim = hidden_dim layers.append(nn.Linear(current_dim, output_dim)) self.network = nn.Sequential(*layers) def forward(self, x): return self.network(x) @gin.configurable(denylist=[“params”]) def make_optimizer( params, name=”adamw”, lr=3e-3, weight_decay=1e-3, momentum=0.9, ): name = name.lower() if name == “adamw”: return torch.optim.AdamW( params, lr=lr, weight_decay=weight_decay, ) if name == “sgd”: return torch.optim.SGD( params, lr=lr, momentum=momentum, weight_decay=weight_decay, ) raise ValueError(f”Unknown optimizer: {name}”) @gin.configurable(denylist=[“optimizer”]) def make_cosine_scheduler( optimizer, total_epochs=60, warmup_epochs=5, min_lr_factor=0.05, ): def lr_lambda(epoch): if epoch < warmup_epochs: return float(epoch + 1) / float(max(1, warmup_epochs)) progress = (epoch – warmup_epochs) / float( max(1, total_epochs – warmup_epochs) ) cosine = 0.5 * (1.0 + math.cos(math.pi * progress)) return min_lr_factor + (1.0 – min_lr_factor) * cosine return torch.optim.lr_scheduler.LambdaLR( optimizer, lr_lambda=lr_lambda, ) @gin.configurable def bce_with_logits_loss( logits, targets, label_smoothing=0.0, ): if label_smoothing > 0: targets = targets * (1.0 – label_smoothing) + 0.5 * label_smoothing return F.binary_cross_entropy_with_logits(logits, targets) @torch.no_grad() def evaluate(model, loader, loss_fn, device): model.eval() total_loss = 0.0 total_correct = 0 total_count = 0 for x, y in loader: x = x.to(device) y = y.to(device) logits = model(x) loss = loss_fn(logits, y) probs = torch.sigmoid(logits) preds = (probs >= 0.5).float() total_loss += loss.item() * len(x) total_correct += (preds == y).sum().item() total_count += len(x) return { “loss”: total_loss / total_count, “accuracy”: total_correct / total_count, } We define the neural network building blocks that form the configurable model and the training utilities. We create an MLP class whose architecture, activation function, dropout, and layer normalization behavior are controlled through Gin rather than hardcoded values. We also implement configurable optimizer, scheduler, loss, and evaluation functions so the training pipeline remains modular and experiment-ready. Implementing the Training Loop and Experiment Runner Copy CodeCopiedUse a different Browser @gin.configurable( denylist=[ “model”, “optimizer”, “scheduler”, “train_loader”, “val_loader”, “device”, ] ) def fit( model, optimizer, scheduler, train_loader, val_loader, device, epochs=60, grad_clip_norm=1.0, log_every=10, loss_fn=bce_with_logits_loss, ): history = [] for epoch in range(1, epochs + 1): model.train() for x, y in train_loader: x = x.to(device) y = y.to(device) optimizer.zero_grad(set_to_none=True) logits = model(x) loss = loss_fn(logits, y) loss.backward() if grad_clip_norm is not None: nn.utils.clip_grad_norm_( model.parameters(), grad_clip_norm, ) optimizer.step() if scheduler is not None: scheduler.step() train_metrics = evaluate( model, train_loader, loss_fn, device, ) val_metrics = evaluate( model, val_loader, loss_fn, device, ) lr = optimizer.param_groups[0][“lr”] row = { “epoch”: epoch, “lr”: lr, “train_loss”: train_metrics[“loss”], “train_accuracy”: train_metrics[“accuracy”], “val_loss”: val_metrics[“loss”], “val_accuracy”: val_metrics[“accuracy”], } history.append(row) if epoch == 1 or epoch % log_every == 0 or epoch == epochs: print( f”epoch={epoch:03d} | ” f”lr={lr:.6f} | ” f”train_loss={row[‘train_loss’]:.4f} | ” f”train_acc={row[‘train_accuracy’]:.3f} | ” f”val_loss={row[‘val_loss’]:.4f} | ” f”val_acc={row[‘val_accuracy’]:.3f}” ) return history @gin.configurable def run_experiment( tag=gin.REQUIRED, model=gin.REQUIRED, dataset_fn=make_spiral_dataset, optimizer_factory=make_optimizer, scheduler_factory=make_cosine_scheduler, prefer_gpu=True, ): seed_everything() device = “cuda” if prefer_gpu and torch.cuda.is_available() else “cpu” data = dataset_fn() x_train, y_train = data[“train”] x_val, y_val = data[“val”] train_loader = make_loader( x_train, y_train, shuffle=True, ) val_loader = make_loader( x_val, y_val, shuffle=False, ) model = model.to(device) optimizer = optimizer_factory(model.parameters()) scheduler = None if scheduler_factory is not None: scheduler = scheduler_factory(optimizer) print(“n” + “=” * 80) print(f”Experiment: {tag}”) print(“=” *

arXiv:2603.04419v2 Announce Type: replace Abstract: We characterize the phenomenon of context-dependent affordance computation in vision-language models (VLMs). Our primary study uses Qwen3-VL-30B-A3B ($n = 3{,}213$ scene-context pairs from COCO-2017: 479 images under 7 agentic personas), with a cross-model replication on LLaVA-1.5-13B. We demonstrate substantial affordance drift: mean Jaccard similarity between context conditions is $0.095$ (95% CI $[0.092, 0.097]$ across $N = 479$ images; $9{,}244$ prime pairs; $p

Hayden Bleasel, an expert developer from OpenAI, released Blume, an open-source documentation framework. Blume shipped to npm as version 1.0.3 the same day. It is as simple as Drop Markdown into a folder and ship a docs site. No app boilerplate is written or maintained afterward. The project is MIT-licensed and open sourced. What is Blume? Blume is a command-line tool paired with a component library for docs. It reads a folder of Markdown or MDX files. From that folder, it produces a production-grade documentation site. That output ships navigation, search, theming, and Open Graph images. Configuration stays optional and is added one file at a time. The code is a TypeScript monorepo; the published package sits at packages/blume. Blume’s own documentation, under apps/docs, is built with Blume itself. It requires Node.js 22.12 or newer. It runs with Bun, pnpm, npm, or yarn. How Blume Works? Under the surface, Blume generates and drives a hidden Astro project. First, the CLI loads blume.config.ts and scans your content into a graph. Next, it writes an Astro project into a .blume/ directory. Astro then renders every page through a single catch-all route. That route imports Blume’s shipped components, the generated data, and your overrides. On each run, .blume/ regenerates, and only changed files are rewritten. As a result, hot reload stays fast during editing. The core theme ships no client framework JavaScript. Consequently, pages score well on Core Web Vitals by default. When you need full control, blume eject promotes the runtime into a standalone Astro app. That ejected project still depends on the blume package. Run blume dev</button> <button id=”prevBtn” disabled>‹ Prev</button> <button id=”nextBtn”>Next ›</button> <button id=”resetBtn”>↺ Reset</button> <div class=”spacer”></div> <label class=”toggle on” id=”aiToggle”><span class=”dot”></span> Show AI outputs</label> </div> <div class=”foot”> <span>Blume v1.0.3 · MIT · Node.js 22.12+ · Astro + Vite</span> <span>Interactive explainer by <a class=”mtp” href=”https://www.marktechpost.com” target=”_blank” rel=”noopener”>Marktechpost</a></span> </div> </div> <script> (function () { var root = document.getElementById(“blume-explainer”); var token = root.querySelector(“#token”); var nodes = root.querySelectorAll(“.node[data-stage]”); var aiNodes = root.querySelectorAll(“.ai-node”); var aiBranches = root.querySelectorAll(“.ai-branch”); var stepLabel = root.querySelector(“#stepLabel”); var stepTitle = root.querySelector(“#stepTitle”); var stepText = root.querySelector(“#stepText”); var termText = root.querySelector(“#termText”); var runBtn = root.querySelector(“#runBtn”); var prevBtn = root.querySelector(“#prevBtn”); var nextBtn = root.querySelector(“#nextBtn”); var resetBtn = root.querySelector(“#resetBtn”); var aiToggle = root.querySelector(“#aiToggle”); // token positions per stage (cx, cy) var pos = [ [85, 90], [250, 90], [470, 90], [700, 70], [700, 163], [842, 90] ]; var steps = [ { label: “Stage 1 / 6”, title: “A folder of Markdown”, term: “docs/ index.mdx guide.mdx api.mdx”, text: “You start with .md or .mdx files in a folder. There is no starter to clone and no app boilerplate to maintain.” }, { label: “Stage 2 / 6”, title: “The CLI loads your config”, term: “blume dev ✓ loaded blume.config.ts”, text: “blume dev loads blume.config.ts. It reads your content sources, theme tokens, and options, all type-checked by a schema.” }, { label: “Stage 3 / 6”, title: “Content is scanned into a graph”, term: “scanning content … ✓ 3 pages, nav inferred”, text: “Blume scans every page into a content graph. Navigation is inferred from your files, so you rarely hand-write it.” }, { label: “Stage 4 / 6”, title: “A hidden Astro project is generated”, term: “writing .blume/ ✓ only changed files”, text: “Blume writes a hidden Astro project into .blume/. It regenerates each run, rewriting only changed files, so hot reload stays fast.” }, { label: “Stage 5 / 6”, title: “Astro + Vite render the pages”, term: “rendering via catch-all route ✓”, text: “Astro renders every page through one catch-all route. It imports Blume’s components, the generated data, and any overrides you add.” }, { label: “Stage 6 / 6”, title: “Static HTML ships to dist/”, term: “blume build ✓ dist/ + search index”, text: “The build outputs static HTML and a local search index into dist/. The core theme ships no client framework JS, helping Core Web Vitals.” } ]; var current = -1; var playing = false; var playTimer = null; function paintNodes(active) { nodes.forEach(function (n) { var s = parseInt(n.getAttribute(“data-stage”), 10); var rect = n.querySelector(“rect”); if (s === active) { rect.setAttribute(“stroke”, “#ff7000”); rect.setAttribute(“stroke-width”, “2.5”); rect.setAttribute(“fill”, “#241108”); } else if (s < active) { rect.setAttribute(“stroke”, “#7a4a1e”); rect.setAttribute(“stroke-width”, “1.5”); rect.setAttribute(“fill”, “#1a120b”); } else { rect.setAttribute(“stroke”, “#33281f”); rect.setAttribute(“stroke-width”, “1.5”); rect.setAttribute(“fill”, “#17120e”); } }); } function moveToken(i) { if (i < 0) { token.style.opacity = 0; return; } token.style.opacity = 1; token.style.transition = “cx .55s cubic-bezier(.4,0,.2,1), cy .55s cubic-bezier(.4,0,.2,1)”; token.setAttribute(“cx”, pos[i][0]); token.setAttribute(“cy”, pos[i][1]); } function render(i) { current = i; if (i < 0) { stepLabel.textContent = “Ready”; stepTitle.textContent = “Press Run to watch the build”; stepText.textContent = “Blume needs only a folder of Markdown. Everything below is generated for you and thrown away on each run, unless you eject.”; termText.textContent = “npx blume init”; paintNodes(-1); moveToken(-1); } else { var s = steps[i]; stepLabel.textContent = s.label; stepTitle.textContent = s.title; stepText.textContent = s.text; termText.textContent = s.term; paintNodes(i); moveToken(i); } prevBtn.disabled = (i <= 0); nextBtn.disabled = (i >= steps.length – 1); reportHeight(); } function next() { if (current < steps.length – 1) render(current + 1); } function prev() { if (current > 0) render(current – 1); } function play() { playing = true; runBtn.textContent = “ Pause”; if (current >= steps.length – 1) render(0); else next(); playTimer = setInterval(function () { if (current >= steps.length – 1) { stop(); return; } next(); }, 1700); } function stop() { playing = false; runBtn.textContent = current >= steps.length – 1 ? “↺ Replay” : “ Run blume dev”; if (playTimer) { clearInterval(playTimer); playTimer = null; } } runBtn.addEventListener(“click”, function () { if (playing) { stop(); } else { if (current >= steps.length – 1) render(-1); play(); } }); nextBtn.addEventListener(“click”, function () { stop(); next(); }); prevBtn.addEventListener(“click”, function () { stop(); prev(); }); resetBtn.addEventListener(“click”, function () { stop(); render(-1); }); aiToggle.addEventListener(“click”, function () { var on = aiToggle.classList.toggle(“on”); aiNodes.forEach(function (n) { n.style.opacity = on ? 1 : 0.18; var r = n.querySelector(“rect”); r.setAttribute(“stroke”, on ? “#7a4a1e” : “#33281f”); }); aiBranches.forEach(function (b) { b.style.opacity =