{"id":"cedbe8332f30e79ab8a5b19c5c72f52ae245dab0c6c88b485456da1f2bf36317","title":"arXiv cs.AI: Backdoor Containment via Expert Quarantine and Shutdown in LLMs","argument":"Jianwei Li, Min-Seon Kim, and Jung-Eun Kim propose a different way to contain backdoors in LLMs: let trigger-linked behavior form during training, but channel it into a designated expert that can be shut down at deployment. A backdoor is behavior activated by a hidden trigger; the authors’ approach, Quarantined Expert Shutdown (QES), uses routed expert-specific LoRA branches and lightweight routers to steer that behavior into the quarantined expert while aiming to preserve benign capability elsewhere. At deployment, they say, mitigation requires zeroing that expert’s routing weight, without screening for triggers or updating model weights. Across two tasks, three attacks, and four model families, the authors report reducing attack success rate (ASR) from 100% to 0–10% in most settings, while downstream utility was often preserved or only modestly affected. Escape Meridian’s reading: the proposal’s distinctive move is not to prevent or repair backdoor learning, but to isolate it so one component can be disabled. These are empirical results in the settings tested, not evidence here of performance in other settings; the abstract does not identify those settings in detail.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The reported results are empirical and limited to the evaluated settings; the abstract does not identify the two tasks, three attacks, or four model families by name. The evidence is the paper’s arXiv abstract, which does not provide the experimental details behind the reported attack success rate or downstream utility results.","speaker":{"name":"Li, Jianwei, Kim, Min-Seon, Kim, Jung-Eun","roleAtSource":"Article author"},"source":{"title":"Backdoor Containment via Expert Quarantine and Shutdown in LLMs","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2610.00663","publishedAt":"2026-09-30","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors propose allowing backdoor behavior to form during training while directing it into a designated expert that can be disabled at deployment.","excerpt":"allow backdoor formation during training but route it into a designated, quarantined component that can be disabled at deployment","url":"https://arxiv.org/abs/2610.00663","relationship":"Source-stated"},{"text":"QES uses routed expert-specific LoRA branches and lightweight routers, with auxiliary routing objectives intended to direct trigger-conditioned behavior into a designated expert while preserving benign capability elsewhere.","excerpt":"uses auxiliary routing objectives to attract trigger-conditioned behavior into a designated expert while preserving benign capability elsewhere","url":"https://arxiv.org/abs/2610.00663","relationship":"Source-stated"},{"text":"The authors say deployment mitigation consists of zeroing the quarantined expert’s routing weight, without trigger screening or further model-weight updates.","excerpt":"zeroing the quarantined expert's routing weight, without trigger screening or further updating model weights","url":"https://arxiv.org/abs/2610.00663","relationship":"Source-stated"},{"text":"The authors report reducing attack success rate from 100% to 0–10% in most settings across two tasks, three attacks, and four model families; downstream utility was often preserved or only modestly affected.","excerpt":"reduce the attack success rate (ASR) from 100% to 0-10% on most settings across two tasks, three attacks, and four model families, while downstream utility is often preserved or only modestly affected","url":"https://arxiv.org/abs/2610.00663","relationship":"Source-stated"},{"text":"The proposal’s distinctive idea is to contain backdoor behavior by isolating it in a component that can be disabled, rather than suppressing its learning or purifying a fully backdoored model.","excerpt":"We propose a third strategy, learn, but channel: allow backdoor formation during training but route it into a designated, quarantined component","url":"https://arxiv.org/abs/2610.00663","relationship":"Escape Meridian interpretation"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.00663","checkedAt":"2026-11-09T14:50:10.801Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How does QES perform in settings beyond the two tasks, three attacks, and four model families described in the abstract?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: Backdoor Containment via Expert Quarantine and Shutdown in LLMs","summary":"Jianwei Li, Min-Seon Kim, and Jung-Eun Kim propose a different way to contain backdoors in LLMs: let trigger-linked behavior form during training, but channel it into a designated expert that can be shut down at deployment. A backdoor is behavior activated by a hidden trigger; the authors’ approach, Quarantined Expert Shutdown (QES), uses routed expert-specific LoRA branches and lightweight routers to steer that behavior into the quarantined expert while aiming to preserve benign capability elsewhere. At deployment, they say, mitigation requires zeroing that expert’s routing weight, without screening for triggers or updating model weights. Across two tasks, three attacks, and four model families, the authors report reducing attack success rate (ASR) from 100% to 0–10% in most settings, while downstream utility was often preserved or only modestly affected. Escape Meridian’s reading: the proposal’s distinctive move is not to prevent or repair backdoor learning, but to isolate it so one component can be disabled. These are empirical results in the settings tested, not evidence here of performance in other settings; the abstract does not identify those settings in detail.","question":"How does QES perform in settings beyond the two tasks, three attacks, and four model families described in the abstract?","claims":[{"text":"The authors propose allowing backdoor behavior to form during training while directing it into a designated expert that can be disabled at deployment.","excerpt":"allow backdoor formation during training but route it into a designated, quarantined component that can be disabled at deployment","support":"source-stated"},{"text":"QES uses routed expert-specific LoRA branches and lightweight routers, with auxiliary routing objectives intended to direct trigger-conditioned behavior into a designated expert while preserving benign capability elsewhere.","excerpt":"uses auxiliary routing objectives to attract trigger-conditioned behavior into a designated expert while preserving benign capability elsewhere","support":"source-stated"},{"text":"The authors say deployment mitigation consists of zeroing the quarantined expert’s routing weight, without trigger screening or further model-weight updates.","excerpt":"zeroing the quarantined expert's routing weight, without trigger screening or further updating model weights","support":"source-stated"},{"text":"The authors report reducing attack success rate from 100% to 0–10% in most settings across two tasks, three attacks, and four model families; downstream utility was often preserved or only modestly affected.","excerpt":"reduce the attack success rate (ASR) from 100% to 0-10% on most settings across two tasks, three attacks, and four model families, while downstream utility is often preserved or only modestly affected","support":"source-stated"},{"text":"The proposal’s distinctive idea is to contain backdoor behavior by isolating it in a component that can be disabled, rather than suppressing its learning or purifying a fully backdoored model.","excerpt":"We propose a third strategy, learn, but channel: allow backdoor formation during training but route it into a designated, quarantined component","support":"interpretation"}],"limitations":["The reported results are empirical and limited to the evaluated settings; the abstract does not identify the two tasks, three attacks, or four model families by name.","The evidence is the paper’s arXiv abstract, which does not provide the experimental details behind the reported attack success rate or downstream utility results."],"mediaId":"58da68420284f9b4daccb0fd79f4c4b922a0c4f3938893028efc05ddbfec9b05","correctionReason":null,"id":"cedbe8332f30e79ab8a5b19c5c72f52ae245dab0c6c88b485456da1f2bf36317","publicationId":"93027829-8238-4c68-8273-434f8d56796f","version":1,"sourceUrl":"https://arxiv.org/abs/2610.00663","sourceTitle":"Backdoor Containment via Expert Quarantine and Shutdown in LLMs","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-09-30","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-10-02T06:27:06.880Z","createdAt":"2026-11-08T21:47:17.300Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"58da68420284f9b4daccb0fd79f4c4b922a0c4f3938893028efc05ddbfec9b05","kind":"article","url":"https://arxiv.org/abs/2610.00663","sourceUrl":"https://arxiv.org/abs/2610.00663","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-08T21:46:33.849Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.00663","checkedAt":"2026-11-09T14:50:10.801Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"58da68420284f9b4daccb0fd79f4c4b922a0c4f3938893028efc05ddbfec9b05","confidence":0.87,"provider":"typesafe","model":"jev-1.13.0","inputHash":"742e2d576cf7152445c787787d116bf367fd759710348a1d3e235b35d63866d4","decidedAt":"2026-11-08T21:46:34.708Z"},"provenance":{"textHash":"25c651a46b80ceb3d02d57b039532e925be045a02941e3637d910b3507521fea","observationId":"698640649328e58865933b5414f1b4bdc37c9496d792f340f183d732e17c44e1","retrievedAt":"2026-11-08T21:46:33.699Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"3b4c8de7-6982-4941-89d9-cedcbaa3c1e4"},"reviewer":{"model":"gpt-6-luna","runId":"a559415f-7593-451b-86bd-03acce423926"}},"audit":{"status":"passed","reviewedAt":"2026-11-08T21:47:17.300Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Li, Jianwei","url":null,"kind":"unknown"},{"name":"Kim, Min-Seon","url":null,"kind":"unknown"},{"name":"Kim, Jung-Eun","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Li, Jianwei","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Li, Jianwei","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.00663","locator":"head/meta[name=author|citation_author]"},"assertionId":"708ba4db2b14a5a3463c263730d4c62c2b26830430f10ddb876638f97b24ff32:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T14:50:10.801Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"708ba4db2b14a5a3463c263730d4c62c2b26830430f10ddb876638f97b24ff32","sourceUrl":"https://arxiv.org/abs/2610.00663","contentSha256":"9007889a63e0e5311e5ca978756b03e0e315a591d63013f201c3e271865fad05","textHash":"25c651a46b80ceb3d02d57b039532e925be045a02941e3637d910b3507521fea","observedAt":"2026-11-09T14:50:10.801Z"}},{"actor":{"name":"Kim, Min-Seon","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Kim, Min-Seon","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.00663","locator":"head/meta[name=author|citation_author]"},"assertionId":"708ba4db2b14a5a3463c263730d4c62c2b26830430f10ddb876638f97b24ff32:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T14:50:10.801Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"708ba4db2b14a5a3463c263730d4c62c2b26830430f10ddb876638f97b24ff32","sourceUrl":"https://arxiv.org/abs/2610.00663","contentSha256":"9007889a63e0e5311e5ca978756b03e0e315a591d63013f201c3e271865fad05","textHash":"25c651a46b80ceb3d02d57b039532e925be045a02941e3637d910b3507521fea","observedAt":"2026-11-09T14:50:10.801Z"}},{"actor":{"name":"Kim, Jung-Eun","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Kim, Jung-Eun","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.00663","locator":"head/meta[name=author|citation_author]"},"assertionId":"708ba4db2b14a5a3463c263730d4c62c2b26830430f10ddb876638f97b24ff32:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T14:50:10.801Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"708ba4db2b14a5a3463c263730d4c62c2b26830430f10ddb876638f97b24ff32","sourceUrl":"https://arxiv.org/abs/2610.00663","contentSha256":"9007889a63e0e5311e5ca978756b03e0e315a591d63013f201c3e271865fad05","textHash":"25c651a46b80ceb3d02d57b039532e925be045a02941e3637d910b3507521fea","observedAt":"2026-11-09T14:50:10.801Z"}}],"participationCoverage":{"total":3,"returned":3,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2610.00663","snapshotId":"708ba4db2b14a5a3463c263730d4c62c2b26830430f10ddb876638f97b24ff32","contentSha256":"9007889a63e0e5311e5ca978756b03e0e315a591d63013f201c3e271865fad05","textHash":"25c651a46b80ceb3d02d57b039532e925be045a02941e3637d910b3507521fea","observedAt":"2026-11-09T14:50:10.801Z","basis":"publisher-page-metadata","sourceLinks":45,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/cedbe8332f30e79ab8a5b19c5c72f52ae245dab0c6c88b485456da1f2bf36317/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-cs-ai-backdoor-containment-via-expert-quarantine-and-cedbe833","formats":{"html":"/readings/arxiv-cs-ai-backdoor-containment-via-expert-quarantine-and-cedbe833","markdown":"/readings/arxiv-cs-ai-backdoor-containment-via-expert-quarantine-and-cedbe833.md","json":"/readings/arxiv-cs-ai-backdoor-containment-via-expert-quarantine-and-cedbe833.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-llm","name":"Large language model","explanation":"A language model with many learned numerical settings, used to process and generate language.","referenceUrl":"https://developers.google.com/machine-learning/glossary#large-language-model"},{"id":"term-model-weights","name":"Model weights","explanation":"The learned numbers that make up a trained model; publishing them lets others run it.","referenceUrl":"https://developers.google.com/machine-learning/glossary#weight"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"cedbe8332f30e79ab8a5b19c5c72f52ae245dab0c6c88b485456da1f2bf36317","revision":"93027829-8238-4c68-8273-434f8d56796f","revisionKind":"publication-id","title":"arXiv cs.AI: Backdoor Containment via Expert Quarantine and Shutdown in LLMs","url":"https://escapemeridian.com/readings/arxiv-cs-ai-backdoor-containment-via-expert-quarantine-and-cedbe833"},"source":{"type":"source","id":"https://arxiv.org/abs/2610.00663","revision":"25c651a46b80ceb3d02d57b039532e925be045a02941e3637d910b3507521fea","revisionKind":"sha256-source-text","title":"Backdoor Containment via Expert Quarantine and Shutdown in LLMs","url":"https://arxiv.org/abs/2610.00663"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"cedbe8332f30e79ab8a5b19c5c72f52ae245dab0c6c88b485456da1f2bf36317","title":"arXiv cs.AI: Backdoor Containment via Expert Quarantine and Shutdown in LLMs","argument":"Jianwei Li, Min-Seon Kim, and Jung-Eun Kim propose a different way to contain backdoors in LLMs: let trigger-linked behavior form during training, but channel it into a designated expert that can be shut down at deployment. A backdoor is behavior activated by a hidden trigger; the authors’ approach, Quarantined Expert Shutdown (QES), uses routed expert-specific LoRA branches and lightweight routers to steer that behavior into the quarantined expert while aiming to preserve benign capability elsewhere. At deployment, they say, mitigation requires zeroing that expert’s routing weight, without screening for triggers or updating model weights. Across two tasks, three attacks, and four model families, the authors report reducing attack success rate (ASR) from 100% to 0–10% in most settings, while downstream utility was often preserved or only modestly affected. Escape Meridian’s reading: the proposal’s distinctive move is not to prevent or repair backdoor learning, but to isolate it so one component can be disabled. These are empirical results in the settings tested, not evidence here of performance in other settings; the abstract does not identify those settings in detail.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The reported results are empirical and limited to the evaluated settings; the abstract does not identify the two tasks, three attacks, or four model families by name. The evidence is the paper’s arXiv abstract, which does not provide the experimental details behind the reported attack success rate or downstream utility results.","speaker":{"name":"Li, Jianwei, Kim, Min-Seon, Kim, Jung-Eun","roleAtSource":"Article author"},"source":{"title":"Backdoor Containment via Expert Quarantine and Shutdown in LLMs","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2610.00663","publishedAt":"2026-09-30","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors propose allowing backdoor behavior to form during training while directing it into a designated expert that can be disabled at deployment.","excerpt":"allow backdoor formation during training but route it into a designated, quarantined component that can be disabled at deployment","url":"https://arxiv.org/abs/2610.00663","relationship":"Source-stated"},{"text":"QES uses routed expert-specific LoRA branches and lightweight routers, with auxiliary routing objectives intended to direct trigger-conditioned behavior into a designated expert while preserving benign capability elsewhere.","excerpt":"uses auxiliary routing objectives to attract trigger-conditioned behavior into a designated expert while preserving benign capability elsewhere","url":"https://arxiv.org/abs/2610.00663","relationship":"Source-stated"},{"text":"The authors say deployment mitigation consists of zeroing the quarantined expert’s routing weight, without trigger screening or further model-weight updates.","excerpt":"zeroing the quarantined expert's routing weight, without trigger screening or further updating model weights","url":"https://arxiv.org/abs/2610.00663","relationship":"Source-stated"},{"text":"The authors report reducing attack success rate from 100% to 0–10% in most settings across two tasks, three attacks, and four model families; downstream utility was often preserved or only modestly affected.","excerpt":"reduce the attack success rate (ASR) from 100% to 0-10% on most settings across two tasks, three attacks, and four model families, while downstream utility is often preserved or only modestly affected","url":"https://arxiv.org/abs/2610.00663","relationship":"Source-stated"},{"text":"The proposal’s distinctive idea is to contain backdoor behavior by isolating it in a component that can be disabled, rather than suppressing its learning or purifying a fully backdoored model.","excerpt":"We propose a third strategy, learn, but channel: allow backdoor formation during training but route it into a designated, quarantined component","url":"https://arxiv.org/abs/2610.00663","relationship":"Escape Meridian interpretation"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.00663","checkedAt":"2026-11-09T14:50:10.801Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How does QES perform in settings beyond the two tasks, three attacks, and four model families described in the abstract?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: Backdoor Containment via Expert Quarantine and Shutdown in LLMs","summary":"Jianwei Li, Min-Seon Kim, and Jung-Eun Kim propose a different way to contain backdoors in LLMs: let trigger-linked behavior form during training, but channel it into a designated expert that can be shut down at deployment. A backdoor is behavior activated by a hidden trigger; the authors’ approach, Quarantined Expert Shutdown (QES), uses routed expert-specific LoRA branches and lightweight routers to steer that behavior into the quarantined expert while aiming to preserve benign capability elsewhere. At deployment, they say, mitigation requires zeroing that expert’s routing weight, without screening for triggers or updating model weights. Across two tasks, three attacks, and four model families, the authors report reducing attack success rate (ASR) from 100% to 0–10% in most settings, while downstream utility was often preserved or only modestly affected. Escape Meridian’s reading: the proposal’s distinctive move is not to prevent or repair backdoor learning, but to isolate it so one component can be disabled. These are empirical results in the settings tested, not evidence here of performance in other settings; the abstract does not identify those settings in detail.","question":"How does QES perform in settings beyond the two tasks, three attacks, and four model families described in the abstract?","claims":[{"text":"The authors propose allowing backdoor behavior to form during training while directing it into a designated expert that can be disabled at deployment.","excerpt":"allow backdoor formation during training but route it into a designated, quarantined component that can be disabled at deployment","support":"source-stated"},{"text":"QES uses routed expert-specific LoRA branches and lightweight routers, with auxiliary routing objectives intended to direct trigger-conditioned behavior into a designated expert while preserving benign capability elsewhere.","excerpt":"uses auxiliary routing objectives to attract trigger-conditioned behavior into a designated expert while preserving benign capability elsewhere","support":"source-stated"},{"text":"The authors say deployment mitigation consists of zeroing the quarantined expert’s routing weight, without trigger screening or further model-weight updates.","excerpt":"zeroing the quarantined expert's routing weight, without trigger screening or further updating model weights","support":"source-stated"},{"text":"The authors report reducing attack success rate from 100% to 0–10% in most settings across two tasks, three attacks, and four model families; downstream utility was often preserved or only modestly affected.","excerpt":"reduce the attack success rate (ASR) from 100% to 0-10% on most settings across two tasks, three attacks, and four model families, while downstream utility is often preserved or only modestly affected","support":"source-stated"},{"text":"The proposal’s distinctive idea is to contain backdoor behavior by isolating it in a component that can be disabled, rather than suppressing its learning or purifying a fully backdoored model.","excerpt":"We propose a third strategy, learn, but channel: allow backdoor formation during training but route it into a designated, quarantined component","support":"interpretation"}],"limitations":["The reported results are empirical and limited to the evaluated settings; the abstract does not identify the two tasks, three attacks, or four model families by name.","The evidence is the paper’s arXiv abstract, which does not provide the experimental details behind the reported attack success rate or downstream utility results."],"mediaId":"58da68420284f9b4daccb0fd79f4c4b922a0c4f3938893028efc05ddbfec9b05","correctionReason":null,"id":"cedbe8332f30e79ab8a5b19c5c72f52ae245dab0c6c88b485456da1f2bf36317","publicationId":"93027829-8238-4c68-8273-434f8d56796f","version":1,"sourceUrl":"https://arxiv.org/abs/2610.00663","sourceTitle":"Backdoor Containment via Expert Quarantine and Shutdown in LLMs","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-09-30","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-10-02T06:27:06.880Z","createdAt":"2026-11-08T21:47:17.300Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"58da68420284f9b4daccb0fd79f4c4b922a0c4f3938893028efc05ddbfec9b05","kind":"article","url":"https://arxiv.org/abs/2610.00663","sourceUrl":"https://arxiv.org/abs/2610.00663","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-08T21:46:33.849Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.00663","checkedAt":"2026-11-09T14:50:10.801Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"58da68420284f9b4daccb0fd79f4c4b922a0c4f3938893028efc05ddbfec9b05","confidence":0.87,"provider":"typesafe","model":"jev-1.13.0","inputHash":"742e2d576cf7152445c787787d116bf367fd759710348a1d3e235b35d63866d4","decidedAt":"2026-11-08T21:46:34.708Z"},"provenance":{"textHash":"25c651a46b80ceb3d02d57b039532e925be045a02941e3637d910b3507521fea","observationId":"698640649328e58865933b5414f1b4bdc37c9496d792f340f183d732e17c44e1","retrievedAt":"2026-11-08T21:46:33.699Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"3b4c8de7-6982-4941-89d9-cedcbaa3c1e4"},"reviewer":{"model":"gpt-6-luna","runId":"a559415f-7593-451b-86bd-03acce423926"}},"audit":{"status":"passed","reviewedAt":"2026-11-08T21:47:17.300Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Li, Jianwei","url":null,"kind":"unknown"},{"name":"Kim, Min-Seon","url":null,"kind":"unknown"},{"name":"Kim, Jung-Eun","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Li, Jianwei","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Li, Jianwei","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.00663","locator":"head/meta[name=author|citation_author]"},"assertionId":"708ba4db2b14a5a3463c263730d4c62c2b26830430f10ddb876638f97b24ff32:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T14:50:10.801Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"708ba4db2b14a5a3463c263730d4c62c2b26830430f10ddb876638f97b24ff32","sourceUrl":"https://arxiv.org/abs/2610.00663","contentSha256":"9007889a63e0e5311e5ca978756b03e0e315a591d63013f201c3e271865fad05","textHash":"25c651a46b80ceb3d02d57b039532e925be045a02941e3637d910b3507521fea","observedAt":"2026-11-09T14:50:10.801Z"}},{"actor":{"name":"Kim, Min-Seon","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Kim, Min-Seon","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.00663","locator":"head/meta[name=author|citation_author]"},"assertionId":"708ba4db2b14a5a3463c263730d4c62c2b26830430f10ddb876638f97b24ff32:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T14:50:10.801Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"708ba4db2b14a5a3463c263730d4c62c2b26830430f10ddb876638f97b24ff32","sourceUrl":"https://arxiv.org/abs/2610.00663","contentSha256":"9007889a63e0e5311e5ca978756b03e0e315a591d63013f201c3e271865fad05","textHash":"25c651a46b80ceb3d02d57b039532e925be045a02941e3637d910b3507521fea","observedAt":"2026-11-09T14:50:10.801Z"}},{"actor":{"name":"Kim, Jung-Eun","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Kim, Jung-Eun","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.00663","locator":"head/meta[name=author|citation_author]"},"assertionId":"708ba4db2b14a5a3463c263730d4c62c2b26830430f10ddb876638f97b24ff32:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T14:50:10.801Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"708ba4db2b14a5a3463c263730d4c62c2b26830430f10ddb876638f97b24ff32","sourceUrl":"https://arxiv.org/abs/2610.00663","contentSha256":"9007889a63e0e5311e5ca978756b03e0e315a591d63013f201c3e271865fad05","textHash":"25c651a46b80ceb3d02d57b039532e925be045a02941e3637d910b3507521fea","observedAt":"2026-11-09T14:50:10.801Z"}}],"participationCoverage":{"total":3,"returned":3,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2610.00663","snapshotId":"708ba4db2b14a5a3463c263730d4c62c2b26830430f10ddb876638f97b24ff32","contentSha256":"9007889a63e0e5311e5ca978756b03e0e315a591d63013f201c3e271865fad05","textHash":"25c651a46b80ceb3d02d57b039532e925be045a02941e3637d910b3507521fea","observedAt":"2026-11-09T14:50:10.801Z","basis":"publisher-page-metadata","sourceLinks":45,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/cedbe8332f30e79ab8a5b19c5c72f52ae245dab0c6c88b485456da1f2bf36317/source"}}}],"audits":[{"publicationId":"93027829-8238-4c68-8273-434f8d56796f","verdict":"passed","findings":[{"dimension":"attribution","status":"pass","explanation":"The draft correctly credits Jianwei Li, Min-Seon Kim and Jung-Eun Kim, and frames the method and results as the authors' proposal and reported findings. The interpretive sentence is explicitly labeled as Escape Meridian's reading.","excerpt":"Authors:Jianwei Li, Min-Seon Kim, Jung-Eun Kim"},{"dimension":"summary","status":"pass","explanation":"The draft leads with the authors' central idea, learn but channel: let backdoor behavior form, then route it into one switchable component. It defines a backdoor in plain language, and its later 'one component can be disabled' phrasing makes 'expert' graspable. Terms such as LoRA, routers and routing weight are kept exactly. Suggest tooltips for 'expert', 'LoRA' and 'routing weight'. One optional fidelity repair: note that QES is trained 'given a poisoned dataset'. The question about untested settings follows from the evidence.","excerpt":"We propose a third strategy, learn, but channel: allow backdoor formation during training but route it into a designated, quarantined component that can be disabled at deployment."},{"dimension":"date","status":"pass","explanation":"The originalPublished date, 2026-09-30, matches the v1 submission date. The 4 Nov 2026 revision and the November feed date are correctly not used.","excerpt":"Submitted on 30 Sep 2026 (v1), last revised 4 Nov 2026 (this version, v2)"},{"dimension":"support","status":"pass","explanation":"Every claim matches the abstract, including the conditions 'in most settings' and 'often preserved or only modestly affected'. The interpretation claim is grounded and labeled. The limitations accurately say the abstract does not name the tasks, attacks or model families. The draft does not overstate the results as real-world reliability or invent beneficiaries.","excerpt":"reduce the attack success rate (ASR) from 100% to 0-10% on most settings across two tasks, three attacks, and four model families, while downstream utility is often preserved or only modestly affected"},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct link to the arXiv abstract page. This is the original source and the most direct way to access the paper.","excerpt":null}],"createdAt":"2026-11-08T21:47:17.300Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}