{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2610.12711", "title": "Byzantine-Resilient Federated Large Language Model via Hypergraph Message Passing", "summary": "Replaces standard robust aggregation rules (e.g., coordinate-wise median, Krum, or GAE-based filtering) in federated fine-tuning with a hypergraph message-passing autoencoder that reasons over high-order relationships among clients' LoRA updates and historical checkpoints. Costs an additional server-side model (the HMP-GAE) that must be trained and run each round, plus storage of historical checkpoints, and results are shown only on two text-classification datasets with two small open backbones. Can fail under attack distributions unlike the evaluation, when honest clients are highly non-IID and get suppressed as outliers, or when the defense model itself is poisoned through the checkpoints it relies on.", "rationale": "The method targets federated training across organizations, which this reader does not operate; the gains are modest, evaluated narrowly, and irrelevant to single-GPU inference or API-based production work.", "technique": "Hypergraph-based Byzantine-robust federated LLM aggregation", "family": "seguranca_e_guardrails", "recommendation": "observar", "published": "2026-10-08", "as_of": "2026-10-18", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2610.12711", "independent_implementations": 0, "total_implementations": 1, "stars": 4, "citations": 0, "claims": [ { "claim_id": "claim-01", "statement": "Replaces standard robust aggregation rules (e.g., coordinate-wise median, Krum, or GAE-based filtering) in federated fine-tuning with a hypergraph message-passing autoencoder that reasons over high-order relationships among clients' LoRA updates and historical checkpoints. Costs an additional server-side model (the HMP-GAE) that must be trained and run each round, plus storage of historical checkpoints, and results are shown only on two text-classification datasets with two small open backbones. Can fail under attack distributions unlike the evaluation, when honest clients are highly non-IID and get suppressed as outliers, or when the defense model itself is poisoned through the checkpoints it relies on.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.12711", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "Versus prior defenses: +1.21% global accuracy, 44.08% lower semantic entropy, 13.34% lower perplexity; versus a GAE-based defense: +1.39% accuracy, 54.5% lower entropy, 35.5% lower perplexity.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.12711", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [], "equations_status": "not_fetched", "core_kind": "", "equations_fetched_at": "", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }