Conjunctive Poisoning in AI Supply-Chain Applications

Conjunctive Poisoning in AI Supply-Chain Applications Nokimul Hasan Arif

no643252@ucf.edu

University of Central Florida

Qian Lou

qian.lou@ucf.edu

University of Central Florida

Mengxin Zheng

mengxin.zheng@ucf.edu

University of Central Florida

arXiv:2608.15913v1 [cs.CR] 16 Aug 2026

Abstract Large Language and Vision-Language Models are increasingly deployed through inference pipelines that include prompt wrappers (e.g., templates and post-processing scripts) and configuration metadata (e.g., JSON/YAML files) that together shape model outputs. While model weights and binaries are routinely verified, these textual deployment artifacts remain weakly protected despite directly influencing runtime behavior. We show that a malicious developer can pair a benign-looking wrapper with crafted metadata to deterministically alter post-generation behavior without modifying model weights, training data, or inference backend. We study this behavior through a controlled conjunctive-gate implementation, where activation depends on both an embedded wrapper marker and cryptographically bound metadata. We evaluate the attack across fifteen open- and closed-source LLM/VLM deployments, and assess prompt and system level defenses including static metadata inspection, wrapper scanners, PromptShield, and SigStore-based artifact signing. To mitigate this risk, we introduce TIF-BAH, a lightweight middleware defense that verifies wrapper integrity and records behavioral attestations during inference. Our results reveal that wrapper-metadata interactions form an under-protected execution layer in modern AI deployments, exposing a deployment-time behavioral risk that is not captured by model-weight or prompt-level defenses. Code is available at https://github.com/N-H-Arif/llm_temp.

1

Introduction

Large Language Models (LLMs) and Vision-Language Models (VLMs) have rapidly evolved from research systems into core infrastructure for modern applications, powering customer support, software engineering, analytics, and creative tools (Zhao et al. (2026)). Multimodal systems further extend this capability by integrating visual reasoning and language understanding (Schulze Buschoff et al. (2025)). While these models are typically defined by their learned parameters, their deployed behavior is also mediated by surrounding textual infrastructure such as prompts, templates, wrappers, and configuration files. Prior security research on LLMs has focused largely on attacks against model internals. Data poisoning and backdoor attacks manipulate training data, prompts, or gradients to implant triggers (Zheng et al., 2024a; Gu et al., 2019), while composite backdoors extend these mechanisms (Huang et al. (2024)). At inference time, adversarial prompts, prompt injection, and jailbreak techniques attempt to override safety constraints (Al Ghanim et al. (2024); Xue et al. (2023); Geng et al. (2026)). Corresponding defenses include weight signing, watermarking, gradient auditing, and output filtering. These approaches implicitly assume that the primary attack surface lies within the model or its inputs. However, deployed ML systems resemble complex software supply chains. Incidents such as the SolarWinds breach and the xz-utils compromise demonstrate how a single modified dependency can affect thousands of downstream systems (Kruti et al. (2023); Przymus & Durieux (2025)). Modern ML ecosystems inherit these risks through extensive reuse of pretrained checkpoints, tokenizer files, example notebooks, and deployment scripts from public repositories 1

wrapped model execution prompt User

input Wrapper config

Metadata

Model response

Output

Figure 1: Template-layer taxonomy in LLM/VLM deployments. A user query is wrapped into a prompt template before being sent to the model. Configuration metadata (e.g., JSON/YAML files) is loaded by the wrapper and influences runtime behavior such as formatting or routing. The model produces a response, which the wrapper may post-process before returning the final output. Hidden activation gates can reside in wrapper logic, metadata fields, or their interaction. The wrapper loads and executes metadata parameters, and the attack exploits their interaction. (Ait et al. (2025)). While model binaries and containers are often signed or hashed, the textual deployment layer-wrappers, templates, and configuration metadata-remains largely mutable and weakly protected. As shown in Figure 1, we define the template layer as the set of deployment artifacts that mediate model inputs and outputs at inference time. These artifacts include wrapper templates and configuration metadata. Wrappers implement executable logic for prompt construction, formatting, and post-processing, whereas metadata (e.g., JSON/YAML files) only store configuration parameters such as decoding or routing settings. Thus, wrappers and metadata differ in role: wrappers execute the logic, while metadata parameterize that logic. RQ1. Can template-layer artifacts deterministically alter LLM/VLM behavior postdeployment without modifying model weights, training data, or user/system prompts? To assess the effect of wrapper-metadata pairs on runtime behavior, we construct proof-of-concept deployments in which the model is left unchanged and only the wrapper and metadata are modified. We implement post-generation actions at the middleware layer and evaluate whether the behavior change is reliable across diverse LLM and VLM deployments. RQ2. How does wrapper-metadata binding affect the detectability of template-layer manipulations? To characterize the audit surface, we evaluate representative variants: (i) clean baseline, (ii) metadata-only readable conditions, (iii) wrapper-only triggers, and (iv) a wrapper-metadata bound condition that combines a hidden wrapper marker with keyed metadata digests and a canonical wrapper-lock hash. We compare which variants are exposed by artifact-local inspection (e.g., scanning metadata or wrapper text) versus which require cross-artifact reasoning. RQ3. How general and practical is deployment-time conjunctive poisoning across models, modalities, and tasks? To evaluate generality and operational cost, we run the same gate logic across fifteen open and closed-source models, covering both text and vision-language tasks, and measure gate correctness, payload visibility, and latency impact under realistic inference pipelines (local checkpoints and API-based access). We answer these questions through systematic ablations of wrapper-metadata variants and large-scale evaluation across diverse models and tasks. Contributions. 1. We identify the deployment template layer as an under-protected part of the LLM/VLM supply chain, where wrapper logic and configuration metadata can jointly alter post-generation behavior without modifying model weights, training data, or system prompts. 2. We use a controlled conjunctive-gate implementation to separate metadata-only, wrapper-only, and wrapper-metadata interaction cases, showing how cross-artifact conditions can make template-layer manipulation harder to detect through artifact-local inspection. 2

Table 1: Comparison with prior attack classes. The studied failure mode targets the deployment template layer and operates after model release, without modifying model weights or training data. Attack Class Data poisoning (Bowen et al. (2025)) Model backdoor (Li et al. (2025)) Prompt injection (Geng et al. (2026)) Template / MCP attack (Guo et al. (2026)) Metadata selection attack (Mo et al. (2025)) Conjunctive poisoning (ours)

Targets

Timing

Model Access

Detectable Offline

Training data Weights User input Agentic system Tool/agent metadata Template layer

Pre-training Training / Fine-tune Inference Structure Inference Deployment

Yes Yes No Yes No No

Yes Yes Yes No Partially No

3. We empirically evaluate this deployment-time behavior across fifteen LLM/VLM systems, including five recent representative models and ten additional models for extended coverage, measuring gate correctness, output modification consistency, and latency overhead. 4. We analyze the scope of existing prompt and system-level defenses and introduce Template Integrity Filter with Behavioral Attestation Header (TIF-BAH) as a lightweight runtime mechanism for wrapper verification and behavioral auditability.

2

Related Works

2.1

Execution Semantics of Wrappers and Metadata in Deployed LLM/VLM Systems

In deployed systems, wrappers and configuration metadata execute as part of the inference pipeline and directly influence model behavior. Modern AI deployments load model weights together with configuration files and wrapper code responsible for prompt construction, preprocessing, tool routing, and post-generation formatting (Viswanathan et al. (2023)). A common deployment pattern is repository-driven execution: platforms such as Hugging Face and GitHub distribute not only model checkpoints but also entrypoint scripts, UI logic, and runtime configuration metadata (Osborne et al. (2024); HuggingFace (2026); Qui (2026)). Wrapper scripts assemble prompts and apply post-processing before outputs are returned, making them a critical control point in the inference pipeline (Hu et al. (2025); PromptScript (2025); Miao et al. (2024)). Framework APIs blur the boundary between configuration and execution by automatically loading metadata governing tokenization, decoding, and pipeline composition (Shi et al. (2025); Su et al. (2024)). Agentic systems extend this behavior by injecting structured metadata such as tool schemas or routing descriptors (Mo et al. (2025)). As a result, wrapper-metadata pairs form a lightweight execution layer in which metadata parameterizes behavior while wrappers implement it (Horng & Lu (2000)).

2.2

Supply-Chain Vulnerabilities in Machine Learning

Prior work studies ML-specific supply-chain attacks involving dependency compromise and runtime manipulation (Gao et al. (2025); Patel et al. (2026)). Real-world incidents include compromised PyTorch dependencies enabling SSH key exfiltration (PyTorch Foundation (2022)), vulnerabilities in the Hugging Face transformers (Database (2024)), and injection attacks in CI/CD pipelines (Database (2026)). These incidents demonstrate how compromised artifacts can propagate through downstream research and deployment environments (Zheng et al. (2023b); Gao et al. (2025)). Existing mitigations primarily focus on binarylevel integrity through signed distributions, dependency locks, and container attestation (Ohm et al. (2020); Gokkaya et al. (2026)). However, these defenses rarely cover textual deployment artifacts such as templates or configuration metadata, leaving wrapper logic and prompt templates widely reused yet weakly audited components of modern ML deployments (Guo et al. (2026)). 3

Training Data

Training Code

Trained Model

Metadata

Platform Download

Victim

End Users

Upload Modified metadata and wrapper

Software Developer

Figure 2: Illustrated Threat Model: A malicious developer compromises the deployment pipeline not by altering model weights, but by pairing a benign model with a modified wrapper and metadata before reuploading it to a public platform (e.g., Hugging Face, or GitHub). End users or downstream developers then download the tainted bundle, trusting it as an official release. At runtime, the hidden wrapper logic activates the conjunctive gate and deterministically changes model behavior, even though the underlying weights and binaries remain intact. 2.3

Metadata Manipulation and Packaging-Level Backdoors

Recent work on Attractive Metadata Attack (AMA) shows that adversarially crafted metadata can bias tool or agent selection in LLM agent systems (Mo et al. (2025)). AMA is closely related in that both settings treat metadata as an active part of deployed AI behavior rather than passive documentation. However, the attack surface and mechanism differ. AMA manipulates metadata descriptions to influence an agent router’s selection decision, whereas our setting studies wrapper-metadata interaction in the deployment template layer. In our case, metadata alone does not select a malicious tool or agent; instead, metadata parameters are consumed by executable wrapper logic that performs post-generation behavior modification. Our work is also related to packaging-level ML supply-chain attacks, where compromised packages, model files, or dependencies propagate through reuse channels (Zheng et al. (2023b); Gao et al. (2025)). Our focus is on textual deployment artifacts, especially wrappers and configuration metadata, that are often treated as editable interface files rather than integrity-critical release artifacts. This distinction motivates our emphasis on template-layer verification and runtime behavioral attestation. Conjunctive prompt attacks in multiagent LLM systems (Arif et al. (2026)) are closely related in that they also expose risks that arise only when individually benign components are composed. However, the attack surface and mechanism differ. That work studies prompt-level conjunction across agentic pipelines, where a trigger in the user query and a hidden adversarial template in a remote agent activate through inter-agent routing. Our work instead studies wrapper-metadata interaction in the deployment template layer. The attacker does not rely on multi-agent topology, routing-aware optimization, or user-trigger placement; instead, metadata parameters are consumed by executable wrapper logic that performs post-generation behavior modification. This distinction motivates our focus on artifact integrity: mutable wrappers and configuration metadata can alter user-visible behavior even when model weights, training data, prompts, and serving backends remain unchanged. 2.4

Behavioral Manipulation and Template-Layer Risks

Prior studies show that prompt variations can significantly affect reasoning and cause sycophancy (Cheng et al. (2026)). Wrapper templates often contain conditional logic or formatting rules that can deterministically alter outputs without altering model weights. Unlike training-time attacks, such manipulations leave no trace in the model parameters themselves. Although adversarial ML research has extensively explored input perturbations and backdoors (Lou et al. (2024); Pelekis et al. (2025); Xue et al. (2024)), and Trojan detection/mitigation methods have been pro4

Wrapper [Marker]

X1 = HMAC(Key,marker)

Equal Checks

Metadata

C1

X2 = marker_hmac

Malicious

Normal

Output

Output

Yes C1 ∧ C2 No

AI Input

[Key] Y1 = SHA256(wrapper)

Y2 = wrapper_hmac

C2

Normal Output

Figure 3: Conjunctive gate mechanism. The attacker embeds a hidden marker in the wrapper and publishes cryptographic digests in metadata. The secret key k used for HMAC computation is provisioned externally at runtime and is never included in public artifacts. At runtime, the wrapper recomputes two digests: C1 verifies the keyed hash of the marker (X1 ), and C2 verifies the canonical wrapper hash (Y1 ). These values are compared against the stored metadata digests (X2 , Y2 ). When both predicates hold (C1 ∧ C2 ) does the gate activate, causing the wrapper to modify post-generation behavior (e.g., prepend text). If either check fails, the system produces the normal, unmodified output.

posed for learned representations (Zheng et al. (2024b); Muthalagu et al. (2025)), existing defenses rarely examine wrapper logic that mediates outputs at deployment time. Even stealthy backdoor studies primarily target internal model representations rather than deployment-time template layers (Zheng et al. (2023a); Gu et al. (2019); Wang et al. (2025)). 2.5

Provenance, Reproducibility, and Behavioral Integrity

Provenance systems such as Model Cards (Mitchell et al. (2019)), Datasheets for Datasets (Gebru et al. (2021)), and experiment-tracking frameworks like MLflow or W&B document datasets and model artifacts. However, these systems do not integrate with textual templates governing runtime behavior. Similarly, reproducible ML pipelines and verifiable training primarily focus on model binaries rather than deployment logic. Recent LLM watermarking studies similarly show that provenance mechanisms must be evaluated not only for detectability, but also for factuality, output quality, and robustness under realistic transformations (Hastuti et al. (2025); Al Ghanim et al. (2025)). Comparison to Related Works. Table 1 compares the studied deployment-time failure mode with prior attack classes. Data poisoning (Gu et al. (2019)), model backdoors, and prompt injection (Geng et al. (2026)) target different stages or surfaces of the ML lifecycle. Packaging-level supply-chain attacks compromise dependencies, model artifacts, or executable packages (Gao et al. (2025); Zheng et al. (2023b)), while AMA shows that metadata can bias agent or tool routing decisions (Mo et al. (2025)). Our focus is narrower: mutable wrapper and metadata files that jointly influence post-generation behavior in deployed LLM/VLM applications. This distinction motivates treating template-layer artifacts as integrity-critical components rather than auxiliary configuration files.

3

Threat Model

Figure 2 illustrates the system components and trust boundaries in our threat model. Unlike traditional supply-chain attacks that target model weights or training pipelines, the adversary here targets the deployment template layer. This layer includes wrappers, configuration files, and metadata that shape user interaction with large language and vision-language models by controlling prompt construction, output processing, and contextual formatting. 5

3.1

Distribution and Adoption

A discussion of wrapper-metadata distribution channels, adoption pathways, supply-chain reuse patterns, and difference between distribution layer and serving backend is provided in Appendix B. 3.2

Adversary Objectives

The adversary aims to introduce hidden actions that persist when wrappers are reused and activate only under specific conditions. The design therefore satisfies three objectives: stealth, where modifications appear benign under casual inspection, automated scans, or version-control comparisons; persistence, where the behavior survives canonicalization-preserving edits such as formatting or comment changes but fails under semantic modifications; and exclusivity, where only the original attacker possessing the secret material can trigger or reproduce the logic, preventing hijacking by other parties. 3.3

Attacker Capabilities

We consider an adversary with realistic capabilities consistent with prior supply-chain incidents. The attacker can publish or modify template artifacts (wrapper and metadata) within channels trusted by downstream developers, such as model repositories, example notebooks, or third-party wrapper packages. The adversary can also compute keyed hashes or message authentication codes using a secret key k known only to them, which is not disclosed in public artifacts and is used to validate activation events. However, the attacker does not obtain privileged execution: once a victim adopts the modified template, the adversary cannot run arbitrary code or alter model weights, and the attack remains constrained to the capabilities of the template engine and middleware logic.

4

Attack Construction and Mechanism

We implement a conjunctive gate as a controlled example of wrapper-metadata interaction. The gate activates only when two predicates hold: a hidden wrapper marker authenticated via HMAC and a canonical wrapper-lock hash computed using SHA-256 over the normalized wrapper. When both checks succeed, the wrapper modifies post-generation behavior. 4.1

High-Level Overview

We consider a wrapper W that performs a conjunctive runtime check over wrapper-local and metadataprovided values. The attacker prepares: (1) an embedded string fragment containing condition, referred to as the marker, which appears visually innocuous within W ; and (2) a canonicalization function N (·) for W that provides a stable representation for hashing. For canonicalization, we apply a deterministic normalization function N (·) that tolerates presentation-only edits while preserving semantics: normalizing line endings, trimming leading and trailing whitespace, collapsing runs of whitespace to a single space, and removing comments. Edits that modify tokens, control flow, marker placement, or line ordering are intentionally not tolerated and cause the wrapper-lock hash to change, resulting in a fail-closed outcome.
aM ← HMACk marker ,
(1) hT ← SHA256 N (W ) . These values are stored in a companion metadata file (Figure 3), while W contains the concealed marker. At runtime, a small segment of wrapper logic recomputes the same digests and establishes h i
\ Allowed = HMACk W.marker = aM h i (2)
∧ SHA256 N (W ) = hT . If Allowed is true, the wrapper executes a post-generation action (e.g., a visible banner or alternative rendering); otherwise, it transmits the model output unchanged, as shown in Algorithm 1. The full gate 6

Clean Wrapper

Metadata

(a)

+

Correct Output AI

(b)

C

Target Output

+

Condition

(c)

+

T

(d)

Ch +

T

Target Output AI

Hashed Metadata

Stealthier Output

Marker

Figure 4: Activation cases and observed outputs. Four evaluated configurations demonstrate how different combinations of metadata and wrapper components affect runtime behavior. (a) Clean metadata and clean wrapper yield normal, correct outputs. (b) A metadata-only condition successfully triggers the target output but is easily detectable. (c) A wrapper-only trigger activates and produces target output but easily detectable again. (d) The full conjunctive case, combining hashed metadata with a hidden marker in the wrapper, deterministically activates the malicious branch while remaining stealthy. logic and canonicalization procedure are provided in Appendix C. As only digest values are published, casual inspection does not reveal any raw triggers. This definition applies only to the CONJUNCTIVE case; the four representative activation cases are illustrated in Figure 4 and detailed in Appendix H.1. Additional fail-closed diagnostic ablations are defined in Appendix G.2. 4.2

Runtime Decision Predicate

We represent the deployed template by a wrapper-metadata pair (W, M ), where W is the executable wrapper text and M stores the metadata values used by the wrapper. The runtime predicate is Gk : (W, M, aM , hT ) −→ {true, false}, as instantiated in Equation 2. The predicate is intentionally local: all values required to evaluate it are available in the client runtime environment, including the wrapper text and metadata file. No external server or model-weight modification is required. The effect is also bounded to the template layer. The predicate controls only display or post-processing behavior after model generation; it does not modify model weights, training data, network transport, or the model’s internal inference procedure. \ Concretely, the implementation evaluates two Boolean conditions: C1 = [HMACk (W.marker) = aM ] and C2 = [SHA256(N (W )) = hT ]. The gated branch executes only when Allowed = C1 ∧ C2 . We use this predicate to separate clean, metadata-only, wrapper-only, and wrapper-metadata interaction cases in the ablation study. 4.3

Working Example

We provide a full worked example of all four activation cases in Appendix D, in accordance with Figure 4. Key Management and Exclusivity. The adversary generates a secret key k that is never embedded in public artifacts such as the wrapper or metadata. Instead, k is provisioned at runtime through external configuration (e.g., environment variables, local secrets, or deployment-time parameters) available only to the party intending to activate the gate. The released wrapper and metadata contain only derived values (e.g., HMACs and hashes) computed using k, but never the key itself. As a result, third parties who copy or inspect the artifacts cannot recompute valid digests or hijack the activation logic, ensuring exclusivity without requiring trusted remote services. We emphasize that this use of HMAC and hashing is not itself 7

Table 2: Post-defense payload success across different LLM and VLM families. The table reports whether the manipulated final behavior remains visible or executable after each defense is applied, not whether the internal gate predicate changes. The internal gate predicate is deterministic and follows the logged conjunction of marker_ok and lock_ok. Values below 1.00 reflect task-specific rendering, output parsing, or defense-specific filtering, rather than stochastic failure of the gate. PromptShield-style defenses may suppress or flag generated content but do not directly inspect wrapper execution. The SigStore column corresponds to partial artifact signing, where wrapper and metadata files remain outside the signed trust boundary. Arrow annotations summarize observed variation across settings and do not denote changes in the deterministic gate predicate. Model

ASRpayload (Before Defense)

ASRpayload (After Defense) Wrapper Scanner

PromptShield

SigStore

Llama-3.2-3B Mistral-7B-Instruct-v0.3 Qwen3.5-9B

Open-source LLMs 0.73↓ (0.25) 0.98↓ (0.18) 0.91↑ (0.09) 0.74↓ (0.17) 0.92↑ (0.08) 0.77↓ (0.15)

Static Inspector

0.71↓ (0.27) 0.72↓ (0.19) 0.75↓ (0.17)

0.68↓ (0.30) 0.69↓ (0.22) 0.72↓ (0.20)

0.75↓ (0.23) 0.76↓ (0.15) 0.79↓ (0.13)

Qwen3-VL-8B-Instruct

Vision-Language Models 0.76↓ (0.24) 1.00↓ (0.14)

0.74↓ (0.26)

0.71↓ (0.29)

0.78↓ (0.22)

GPT-5.4-mini

0.94↓ (0.10)

Closed Models 0.80↓ (0.14)

0.78↓ (0.16)

0.76↓ (0.18)

0.82↓ (0.12)

a new cryptographic technique; it is used here to instantiate a realistic cross-artifact condition inside the deployment template layer.

5

Experimental Methodology

We outline the model families, datasets, and metrics that enable the assessment of deployment-time conjunctive poisoning. Our aim is to evaluate the attack’s behavioral precision, and latency impact across both open-source and closed-source ecosystems, ensuring that the process is reproducible without compromising operational confidentiality. 5.1

Models, Datasets, and Tasks

We evaluate fifteen representative foundation models in total. The main defense evaluation uses five recent representative deployments, while Appendix I reports ten additional deployments for extended coverage, including broader VLM coverage. Across both sets, the evaluation covers three axes of diversity: (i) open vs. closed-source models, (ii) language-only vs. vision-language modalities, and (iii) generative vs. discriminative tasks. Table 6 (Appendix E) summarizes all evaluated datasets and models. 5.2

Recorded Variables, Boolean Convention & Ablation Cases

The logged predicates and ablation case definitions are detailed in Appendix G. Metric definitions & Parsing. We distinguish the deterministic gate predicate from the observed payload outcome. Gate correctness measures whether the implemented Boolean decision matches the expected case-specific rule. Payload success measures whether the gated post-generation behavior remains visible or executable after model generation, task-specific rendering, output parsing, and defense-specific filtering. In addition to payload success, we measure whether wrapper-level post-processing affects the underlying benchmark answer. Full definitions of metrics and parsing protocol is given in Appendix G. 8

ASRpayload

Percentage

100

94 87

88

90

Consbanner

93

92 86

85

96

94

91

88

89

82

50

0 s

ew

AG

N

sy

-2

a -E RC

T SS

A

8K SM

G

g wa

aS ell H

ns

2 Av

VQ

CO

io pt a C

CO

Figure 5: Dataset-wise observed payload success (ASRpayload ) and banner consistency (Consbanner ). The gate predicate itself is input-independent and deterministic once marker_ok and lock_ok are satisfied. Variation across datasets reflects task-specific output formatting, answer parsing, rendering behavior, or defense filtering rather than differences in the Boolean gate.

6

Results

This section presents the main results on five recent representative deployments, with extended model-wise results on ten additional deployments reported in Appendix I. Across the combined fifteen-model evaluation, we analyze 75 model-ablation configuration groups. Figure 3 illustrates the runtime conjunctive-gate mechanism. Across all tested models, each gating decision conformed precisely to the logical conjunction C1 ∧ C2 , with no random deviations observed. The evaluation harness recorded marker_ok, lock_ok, allowed, banner_present, and latency_ms for each inference. Gate correctness was 1.00 in the conjunctive case whenever both predicates were satisfied. Table 2 reports observed payload success on the five recent representative deployments, not stochastic gate failure. Before defenses, payload success ranges from 0.91 to 1.00. After defenses, payload success decreases but remains non-zero, typically ranging from 0.68 to 0.82. These values reflect whether the final manipulated behavior remains visible or executable after rendering, output parsing, and defense-specific filtering, not whether the internal gate predicate changes. Extended results on ten additional models, including broader VLM coverage, are reported in Appendix I, Table 7. 6.1

Task Utility Impact

Table 3 reports standard task metrics under the clean wrapper, the conjunctive wrapper, and a payloadstripped conjunctive output. Across the evaluated datasets, task-utility changes are small for classification, multiple-choice reasoning, numeric reasoning, and VQA. AG News increases from 0.8426 to 0.8599, while SST-2, ARC-Easy, GSM8K, HellaSwag, and VQAv2 show small decreases of 0.0050, 0.0062, 0.0029, 0.0004, and 0.0070, respectively. COCO Captions shows a larger drop in caption token F1 before payload stripping, from 1.0000 to 0.8931, because the injected text directly changes the surface form of the caption. After removing the payload, the COCO score returns to 1.0000, indicating that the underlying caption content remains preserved. These results separate task utility from payload success: the wrapper can alter the rendered response while leaving the task answer mostly recoverable. The conjunctive and payload-stripped scores are identical for 9

Table 3: Task utility before and after wrapper-level payload insertion. Clean Wrapper measures task performance under the unmodified wrapper. Conjunctive Wrapper measures task performance after the wrapperlevel payload is inserted. Payload-Stripped measures task performance after removing the injected payload from the conjunctive output before parsing. These metrics evaluate the underlying benchmark answer separately from observed payload success. The small changes for classification, reasoning, and VQA tasks indicate that the task answer remains largely recoverable, while COCO Captions shows a larger surface-form effect because caption similarity is directly affected by injected text. Dataset

Task Metric

AG News SST-2 ARC-Easy GSM8K HellaSwag VQAv2 COCO Captions

Accuracy Accuracy Multiple-choice accuracy Numeric exact match Multiple-choice accuracy Normalized VQA accuracy Caption token F1 vs. clean

Clean Wrapper

Conjunctive Wrapper

PayloadStripped

Change

0.8426 0.9130 0.7986 0.1367 0.3801 0.6210 1.0000

0.8599 0.9080 0.7925 0.1338 0.3796 0.6140 0.8931

0.8599 0.9080 0.7925 0.1338 0.3796 0.6140 1.0000

+0.0173 -0.0050 -0.0062 -0.0029 -0.0004 -0.0070 -0.1069

Table 4: Benign proxy payload analysis. ASRpayload measures whether the proxy transformation was visible or executable in the conjunctive wrapper output. Task utility change is conjunctive-minus-clean utility under the task parser where benchmark labels are available, with caption preservation used for COCO. Low ASR for ordering-based proxies reflects that the current benchmark outputs do not always contain compatible list or source-like structures, not a failure of the deterministic gate predicate. Payload Proxy Banner insertion Disclaimer modification Recommendation ordering Citation/source ordering Formatting emphasis

Intended Effect

ASRpayload

Task Utility Change

Visible notice placement Trust framing Ranking/order bias Source ordering bias Attention bias

1.0000 1.0000 0.1746 0.0053 1.0000

-0.0284 -0.0515 -0.2148 -0.0769 -0.0012

most label-based tasks because the task parsers extract labels, options, or numeric answers while ignoring the injected banner. 6.2

Benign Payload Proxy Analysis

The payload proxies include trust framing through a disclaimer sentence, ranking or order bias in liststyle outputs, source-ordering bias when source-like lines are present, and formatting emphasis through Markdown highlighting. These proxies are not claimed to be harmful payloads. Instead, they stand in for realistic classes of application-layer behavior that can be implemented by prompt wrappers, output formatters, citation renderers, or post-processors. Table 4 shows that the gate can mediate user-visible behavior beyond advertising-style banner insertion. Disclaimer and formatting proxies apply broadly, while ordering proxies apply only when the generated response contains a compatible list or source-like structure. This distinction is important: low ASR for citation/source ordering reflects limited applicability in the present benchmark outputs, not a change in gate correctness. Overall, the proxy analysis separates payload success from task utility and shows that the relevant deployment risk includes benign but practically meaningful wrapper behavior such as trust framing, ranking, source presentation, and visual emphasis. 6.3

Real-World Activation Cases & Application-Level Case Study: High-Fidelity Deployment Scenario

We report four experimental cases corresponding to the deployment configurations shown in Figure 4. The descriptions of the real-world activation cases and details of an application-level case study of high-fidelity deployment scenario are provided in Appendix H. 10

Table 5: Latency overhead by provider class. The conjunctive gate introduces minimal runtime cost across deployment settings, with mean overhead below 0.5% and p95 latency under 6 ms for all model classes.

6.4

Provider Class

Mean Overhead (%)

p95 (ms)

Open LLM Closed LLM (API) Vision-Language

0.31 0.46 0.29

4.2 5.8 4.5

Overhead and Latency Characterization

We next evaluate runtime impact across open-source and closed-source models. Latency distributions indicate that gate evaluation adds a constant, negligible offset to post-generation processing. Table 5 summarizes the mean and 95th-percentile (p95) overheads by provider class. These findings verify that the security logic introduces no significant computational cost, remaining suitable for both local and API-based inference pipelines. 6.5

Prompt & System Level Defenses

As shown in Table 2, existing defenses reduce visible payload exposure but do not fully protect the template layer exposed by our ablation cases. Table 2 summarizes observed payload success on five recent representative deployments, while Appendix I, Table 7 reports ten additional models. Static metadata inspection and wrapper scanning reduce observed payload success but do not eliminate it. PromptShield (Jacob et al. (2025)) produces a larger reduction in visible payload success because it can flag or suppress suspicious generated content, but it does not directly inspect or prevent wrapper-level gate execution. The SigStore setting reflects partial artifact signing, where model weights, containers, or packages are verified but wrapper and metadata files remain outside the signed trust boundary. Under full-bundle signing that includes wrapper and metadata files, the attack is blocked by construction, as discussed in Appendix J.1. Detailed explanations of these defenses are provided in Appendix J. Further discussion on the scope and limitations of SigStore-based artifact signing in deployment pipelines is provided in Appendix J.1.

7

Potential Defense

The proposed conjunctive gate can be neutralized only when wrapper and metadata artifacts are included in an explicit trust boundary. We therefore position Template Integrity Filter with Behavioral Attestation Header (TIF-BAH) as a runtime complement to artifact signing rather than a replacement for it. TIF blocks execution if the live wrapper does not match a trusted canonical digest, while BAH records the verified wrapper identity and gate outcome for post-hoc audit. The mechanism of TIF-BAH is detailed in Appendix K.

8

Conclusion

This work shows that model behavior can be manipulated at deployment time through interactions between wrapper templates and configuration metadata, without modifying model weights, training data, or user/system prompts. We study this mechanism using a controlled conjunctive-gate implementation requiring both a hidden wrapper marker and a matching metadata digest. Experiments across fifteen LLM and VLM systems demonstrate deterministic activation across 75 configurations with negligible latency overhead (<0.5%). Our defense analysis shows that protections focused only on prompts, outputs, model weights, or partially signed artifacts do not fully cover mutable wrapper and metadata files. To address this gap, we introduce TIF-BAH, a lightweight middleware defense that verifies wrapper integrity and records behavioral attestations. When a trusted clean wrapper reference is available, TIF-BAH neutralizes the conjunctive trigger while adding negligible overhead. These findings highlight the template layer as a critical but underprotected component of modern AI deployments and emphasize the need to treat wrappers and configuration metadata as integrity-critical artifacts in the ML supply chain. 11

Limitations This work does not claim that conditional execution, HMAC authentication, or hash-based integrity checks are novel by themselves. The contribution is the identification and evaluation of wrapper-metadata interactions as an integrity-relevant deployment layer in LLM/VLM systems. The defense mechanism relies on verified template artifacts, which are not always available in open-source deployments. TIF-BAH’s strength depends on N (·). Overly strict canonicalization is brittle (false blocks); overly loose canonicalization may accept semantic edits. In practice, we choose a conservative middle ground (whitespace normalization) which absorbed benign formatting while rejecting structural changes that the poisoning requires. Also, existing integrity policies in industry are effective but they are rarely used in locally deployed downstream applications. We also revised the related-work discussion to distinguish our setting from metadata-selection attacks and packaging-level supply-chain compromises. Because template-layer security spans software supply chains, prompt infrastructure, and agent metadata, future work should further benchmark against production repository-scanning tools and package-integrity workflows. The benchmark datasets are not intended to show that the Boolean gate depends on dataset content. Instead, they test whether wrapper-level payloads remain visible and whether task answers remain recoverable across different rendering and parsing conditions. The visible payloads used in the experiments are intentionally benign proxies. They demonstrate that wrapper-level post-processing can alter user-visible behavior, but they do not exhaust the space of possible deployment-layer manipulations. We avoid stronger payloads for ethical reasons and focus instead on measurable proxies such as disclaimer changes, ordering effects, and formatting emphasis. Our model evaluation covers representative deployment categories rather than an exhaustive set of current frontier systems. Because the gate executes in wrapper-level post-processing, the core predicate is largely model-agnostic; however, newer frontier models and managed production platforms may differ in output formatting, deployment conventions, artifact verification practices, and API-side filtering. Future work should evaluate these settings directly.

Ethical Considerations This work studies integrity risks in the deployment-time template layer of LLM/VLM systems, focusing on wrappers and metadata that are executed as part of inference pipelines. All experiments were conducted in controlled environments using benign payloads (e.g., inserting a visible banner or disclaimer) to demonstrate behavioral control without enabling harmful actions. We did not modify model weights, compromise third-party infrastructure, collect user data, or deploy the technique against real users. The additional payload proxy analysis also uses benign transformations only. These include disclaimer insertion, output ordering, source-like line ordering, and formatting emphasis. We do not implement harmful instructions, data exfiltration, credential access, misinformation payloads, or covert user-targeting behavior. While the proposed conjunctive mechanism could be misused to influence user-facing behavior, our goal is to expose a previously under-examined attack surface and motivate stronger integrity guarantees for humanwritten deployment artifacts. By framing the template layer as an executable security boundary, this work aims to support the development of safer deployment practices, clearer provenance policies, and improved auditability in real-world ML systems, ethical experimentation, and the development of defenses that directly address adversarial manipulation of metadata.

References GitHub Models - GitHub Enterprise — latest. https://github.com/features/models, 2026. [Accessed 13-08-2026]. Adem Ait, Javier Luis Cánovas Izquierdo, and Jordi Cabot. On the suitability of hugging face hub for empirical studies. Empirical Software Engineering, 30(2):57, Jan 2025. ISSN 1573-7616. doi: 10.1007/ s10664-024-10608-8. URL https://doi.org/10.1007/s10664-024-10608-8. Mansour Al Ghanim, Saleh Almohaimeed, Mengxin Zheng, Yan Solihin, and Qian Lou. Jailbreaking LLMs with Arabic transliteration and Arabizi. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen (eds.), 12

Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp. 18584– 18600, Miami, Florida, USA, November 2024. Association for Computational Linguistics. doi: 10.18653/ v1/2024.emnlp-main.1034. URL https://aclanthology.org/2024.emnlp-main.1034/. Mansour Al Ghanim, Jiaqi Xue, Rochana Prih Hastuti, Mengxin Zheng, Yan Solihin, and Qian Lou. Evaluating the robustness and accuracy of text watermarking under real-world cross-lingual manipulations. In Christos Christodoulopoulos, Tanmoy Chakraborty, Carolyn Rose, and Violet Peng (eds.), Findings of the Association for Computational Linguistics: EMNLP 2025, pp. 7396–7416, Suzhou, China, November 2025. Association for Computational Linguistics. ISBN 979-8-89176-335-7. doi: 10.18653/v1/2025.findings-emnlp.390. URL https://aclanthology.org/2025.findings-emnlp.390/. Anthropic. Claude 3.7 sonnet system card, 2025. claude-3-7-sonnet.

URL https://www.anthropic.com/news/

Nokimul Hasan Arif, Qian Lou, and Mengxin Zheng. Conjunctive prompt attacks in multi-agent LLM systems. In Maria Liakata, Viviane P. Moreira, Jiajun Zhang, and David Jurgens (eds.), Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 34175–34191, San Diego, California, United States, July 2026. Association for Computational Linguistics. ISBN 979-8-89176-390-6. doi: 10.18653/v1/2026.acl-long.1577. URL https://aclanthology.org/2026. acl-long.1577/. Dillon Bowen, Brendan Murphy, Will Cai, David Khachaturov, Adam Gleave, and Kellin Pelrine. Scaling trends for data poisoning in llms. Proceedings of the AAAI Conference on Artificial Intelligence, 39 (26):27206–27214, Apr. 2025. doi: 10.1609/aaai.v39i26.34929. URL https://ojs.aaai.org/index.php/ AAAI/article/view/34929. Myra Cheng, Sunny Yu, Cinoo Lee, Pranav Khadpe, Lujain Ibrahim, and Dan Jurafsky. ELEPHANT: Measuring and understanding social sycophancy in LLMs. In The Fourteenth International Conference on Learning Representations, 2026. URL https://openreview.net/forum?id=igbRHKEiAs. Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. Think you have solved question answering? try arc, the ai2 reasoning challenge, 2018. URL https://arxiv.org/abs/1803.05457. Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, Christopher Hesse, and John Schulman. Training verifiers to solve math word problems, 2021. URL https://arxiv.org/abs/2110.14168. Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Marcel Blistein, Ori Ram, Dan Zhang, Evan Rosen, Luke Marris, Sam Petulla, Colin Gaffney, Asaf Aharoni, Nathan Lintz, Tiago Cardal Pais, Henrik Jacobsson, Idan Szpektor, Nan-Jiang Jiang, Krishna Haridasan, Ahmed Omran, Nikunj Saunshi, Dara Bahri, Gaurav Mishra, Eric Chu, Toby Boyd, Brad Hekman, Aaron Parisi, Chaoyi Zhang, Kornraphop Kawintiranon, Tania Bedrax-Weiss, Oliver Wang, Ya Xu, Ollie Purkiss, Uri Mendlovic, Ilaï Deutel, Nam Nguyen, Adam Langley, Flip Korn, Lucia Rossazza, Alexandre Ramé, Sagar Waghmare, Helen Miller, Nathan Byrd, Ashrith Sheshan, Raia Hadsell, Sangnie Bhardwaj, Pawel Janus, Tero Rissa, Dan Horgan, Alvin Abdagic, Lior Belenki, James Allingham, Anima Singh, Theo Guidroz, Srivatsan Srinivasan, Herman Schmit, Kristen Chiafullo, Andre Elisseeff, Nilpa Jha, Prateek Kolhar, Leonard Berrada, Frank Ding, Xiance Si, Shrestha Basu Mallick, Franz Och, Sofia Erell, Eric Ni, Tejasi Latkar, Sherry Yang, Petar Sirkovic, Ziqiang Feng, Robert Leland, Rachel Hornung, Gang Wu, Charles Blundell, Hamidreza Alvari, Po-Sen Huang, Cathy Yip, Sanja Deur, Li Liu, Gabriela Surita, Pablo Duque, Dima Damen, Johnson Jia, Arthur Guez, Markus Mircea, Animesh Sinha, Alberto Magni, Paweł Stradomski, Tal Marian, Vlado Galić, Wenhu Chen, Hisham Husain, Achintya Singhal, Dominik Grewe, François-Xavier Aubet, Shuang Song, Lorenzo Blanco, Leland Rechis, Lewis Ho, Rich Munoz, Kelvin Zheng, Jessica Hamrick, Kevin Mather, Hagai Taitelbaum, Eliza Rutherford, Yun Lei, Kuangyuan Chen, Anand Shukla, Erica Moreira, Eric Doi, Berivan Isik, Nir Shabat, Dominika Rogozińska, Kashyap Kolipaka, Jason Chang, Eugen Vušak, Srinivasan Venkatachary, Shadi Noghabi, Tarun Bharti, Younghoon Jun, Aleksandr Zaks, Simon Green, Jeshwanth Challagundla, William Wong, 13

Muqthar Mohammad, Dean Hirsch, Yong Cheng, Iftekhar Naim, Lev Proleev, Damien Vincent, Aayush Singh, Maxim Krikun, Dilip Krishnan, Zoubin Ghahramani, Aviel Atias, Rajeev Aggarwal, Christo Kirov, Dimitrios Vytiniotis, Christy Koh, Alexandra Chronopoulou, Pawan Dogra, Vlad-Doru Ion, Gladys Tyen, Jason Lee, Felix Weissenberger, Trevor Strohman, Ashwin Balakrishna, Jack Rae, Marko Velic, Raoul de Liedekerke, Oded Elyada, Wentao Yuan, Canoee Liu, Lior Shani, Sergey Kishchenko, Bea Alessio, Yandong Li, Richard Song, Sam Kwei, Orion Jankowski, Aneesh Pappu, Youhei Namiki, Yenai Ma, Nilesh Tripuraneni, Colin Cherry, Marissa Ikonomidis, Yu-Cheng Ling, Colin Ji, Beka Westberg, Auriel Wright, Da Yu, David Parkinson, Swaroop Ramaswamy, Jerome Connor, Soheil Hassas Yeganeh, Snchit Grover, George Kenwright, Lubo Litchev, Chris Apps, Alex Tomala, Felix Halim, Alex Castro-Ros, Zefei Li, Anudhyan Boral, Pauline Sho, Michal Yarom, Eric Malmi, David Klinghoffer, Rebecca Lin, Alan Ansell, Pradeep Kumar S, Shubin Zhao, Siqi Zuo, Adam Santoro, Heng-Tze Cheng, Solomon Demmessie, Yuchi Liu, Nicole Brichtova, Allie Culp, Nathaniel Braun, Dan Graur, Will Ng, Nikhil Mehta, Aaron Phillips, Patrik Sundberg, Varun Godbole, Fangyu Liu, Yash Katariya, David Rim, Mojtaba Seyedhosseini, Sean Ammirati, Jonas Valfridsson, Mahan Malihi, Timothy Knight, Andeep Toor, Thomas Lampe, Abe Ittycheriah, Lewis Chiang, Chak Yeung, Alexandre Fréchette, Jinmeng Rao, Huisheng Wang, Himanshu Srivastava, Richard Zhang, Rocky Rhodes, Ariel Brand, Dean Weesner, Ilya Figotin, Felix Gimeno, Rachana Fellinger, Pierre Marcenac, José Leal, Eyal Marcus, Victor Cotruta, Rodrigo Cabrera, Sheryl Luo, Dan Garrette, Vera Axelrod, Sorin Baltateanu, David Barker, Dongkai Chen, Horia Toma, Ben Ingram, Jason Riesa, Chinmay Kulkarni, Yujing Zhang, Hongbin Liu, Chao Wang, Martin Polacek, Will Wu, Kai Hui, Adrian N Reyes, Yi Su, Megan Barnes, Ishaan Malhi, Anfal Siddiqui, Qixuan Feng, Mihai Damaschin, Daniele Pighin, Andreas Steiner, Samuel Yang, Ramya Sree Boppana, Simeon Ivanov, Arun Kandoor, Aditya Shah, Asier Mujika, Da Huang, Christopher A. Choquette-Choo, Mohak Patel, Tianhe Yu, Toni Creswell, Jerry, Liu, Catarina Barros, Yasaman Razeghi, Aurko Roy, Phil Culliton, Binbin Xiong, Jiaqi Pan, Thomas Strohmann, Tolly Powell, Babi Seal, Doug DeCarlo, Pranav Shyam, Kaan Katircioglu, Xuezhi Wang, Cassidy Hardin, Immanuel Odisho, Josef Broder, Oscar Chang, Arun Nair, Artem Shtefan, Maura O’Brien, Manu Agarwal, Sahitya Potluri, Siddharth Goyal, Amit Jhindal, Saksham Thakur, Yury Stuken, James Lyon, Kristina Toutanova, Fangxiaoyu Feng, Austin Wu, Ben Horn, Alek Wang, Alex Cullum, Gabe Taubman, Disha Shrivastava, Chongyang Shi, Hamish Tomlinson, Roma Patel, Tao Tu, Ada Maksutaj Oflazer, Francesco Pongetti, Mingyao Yang, Adrien Ali Taïga, Vincent Perot, Nuo Wang Pierse, Feng Han, Yoel Drori, Iñaki Iturrate, Ayan Chakrabarti, Legg Yeung, Dave Dopson, Yi ting Chen, Apoorv Kulshreshtha, Tongfei Guo, Philip Pham, Tal Schuster, Junquan Chen, Alex Polozov, Jinwei Xing, Huanjie Zhou, Praneeth Kacham, Doron Kukliansky, Antoine Miech, Sergey Yaroshenko, Ed Chi, Sholto Douglas, Hongliang Fei, Mathieu Blondel, Preethi Myla, Lior Madmoni, Xing Wu, Daniel Keysers, Kristian Kjems, Isabela Albuquerque, Lijun Yu, Joel D’sa, Michelle Plantan, Vlad Ionescu, Jaume Sanchez Elias, Abhirut Gupta, Manish Reddy Vuyyuru, Fred Alcober, Tong Zhou, Kaiyang Ji, Florian Hartmann, Subha Puttagunta, Hugo Song, Ehsan Amid, Anca Stefanoiu, Andrew Lee, Paul Pucciarelli, Emma Wang, Amit Raul, Slav Petrov, Isaac Tian, Valentin Anklin, Nana Nti, Victor Gomes, Max Schumacher, Grace Vesom, Alex Panagopoulos, Konstantinos Bousmalis, Daniel Andor, Josh Jacob, Yuan Zhang, Bill Rosgen, Matija Kecman, Matthew Tung, Alexandra Belias, Noah Goodman, Paul Covington, Brian Wieder, Nikita Saxena, Elnaz Davoodi, Muhuan Huang, Sharath Maddineni, Vincent Roulet, Folawiyo Campbell-Ajala, Pier Giuseppe Sessa, Xintian, Wu, Guangda Lai, Paul Collins, Alex Haig, Vytenis Sakenas, Xiaowei Xu, Marissa Giustina, Laurent El Shafey, Pichi Charoenpanit, Shefali Garg, Joshua Ainslie, Boone Severson, Montse Gonzalez Arenas, Shreya Pathak, Sujee Rajayogam, Jie Feng, Michiel Bakker, Sheng Li, Nevan Wichers, Jamie Rogers, Xinyang Geng, Yeqing Li, Rolf Jagerman, Chao Jia, Nadav Olmert, David Sharon, Matthew Mauger, Sandeep Mariserla, Hongxu Ma, Megha Mohabey, Kyuyeun Kim, Alek Andreev, Scott Pollom, Juliette Love, Vihan Jain, Priyanka Agrawal, Yannick Schroecker, Alisa Fortin, Manfred Warmuth, Ji Liu, Andrew Leach, Irina Blok, Ganesh Poomal Girirajan, Roee Aharoni, Benigno Uria, Andrei Sozanschi, Dan Goldberg, Lucian Ionita, Marco Tulio Ribeiro, Martin Zlocha, Vighnesh Birodkar, Sami Lachgar, Liangzhe Yuan, Himadri Choudhury, Matt Ginsberg, Fei Zheng, Gregory Dibb, Emily Graves, Swachhand Lokhande, Gabriel Rasskin, George-Cristian Muraru, Corbin Quick, Sandeep Tata, Pierre Sermanet, Aditya Chawla, Itay Karo, Yan Wang, Susan Zhang, Orgad Keller, Anca Dragan, Guolong Su, Ian Chou, Xi Liu, Yiqing Tao, Shruthi Prabhakara, Marc Wilson, Ruibo Liu, Shibo Wang, Georgie Evans, David Du, Alfonso Castaño, Gautam Prasad, Mona El Mahdy, Sebastian Gerlach, Machel Reid, Jarrod Kahn, Amir Zait, Thanumalayan Sankaranarayana Pillai, Thatcher Ulrich, Guanyu Wang, Jan 14

Wassenberg, Efrat Farkash, Kiran Yalasangi, Congchao Wang, Maria Bauza, Simon Bucher, Ting Liu, Jun Yan, Gary Leung, Vikas Sindhwani, Parker Barnes, Avi Singh, Ivan Jurin, Jichuan Chang, Niket Kumar Bhumihar, Sivan Eiger, Gui Citovsky, Ben Withbroe, Zhang Li, Siyang Xue, Niccolò Dal Santo, Georgi Stoyanov, Yves Raimond, Steven Zheng, Yilin Gao, Vít Listík, Sławek Kwasiborski, Rachel Saputro, Adnan Ozturel, Ganesh Mallya, Kushal Majmundar, Ross West, Paul Caron, Jinliang Wei, Lluis Castrejon, Sharad Vikram, Deepak Ramachandran, Nikhil Dhawan, Jiho Park, Sara Smoot, George van den Driessche, Yochai Blau, Chase Malik, Wei Liang, Roy Hirsch, Cicero Nogueira dos Santos, Eugene Weinstein, Aäron van den Oord, Sid Lall, Nicholas FitzGerald, Zixuan Jiang, Xuan Yang, Dale Webster, Ali Elqursh, Aedan Pope, Georges Rotival, David Raposo, Wanzheng Zhu, Jeff Dean, Sami Alabed, Dustin Tran, Arushi Gupta, Zach Gleicher, Jessica Austin, Edouard Rosseel, Megh Umekar, Dipanjan Das, Yinghao Sun, Kai Chen, Karolis Misiunas, Xiang Zhou, Yixian Di, Alyssa Loo, Josh Newlan, Bo Li, Vinay Ramasesh, Ying Xu, Alex Chen, Sudeep Gandhe, Radu Soricut, Nikita Gupta, Shuguang Hu, Seliem El-Sayed, Xavier Garcia, Idan Brusilovsky, Pu-Chin Chen, Andrew Bolt, Lu Huang, Alex Gurney, Zhiying Zhang, Alexander Pritzel, Jarek Wilkiewicz, Bryan Seybold, Bhargav Kanagal Shamanna, Felix Fischer, Josef Dean, Karan Gill, Ross Mcilroy, Abhishek Bhowmick, Jeremy Selier, Antoine Yang, Derek Cheng, Vladimir Magay, Jie Tan, Dhriti Varma, Christian Walder, Tomas Kocisky, Ryo Nakashima, Paul Natsev, Mike Kwong, Ionel Gog, Chiyuan Zhang, Sander Dieleman, Thomas Jimma, Andrey Ryabtsev, Siddhartha Brahma, David Steiner, Dayou Du, Ante Žužul, Mislav Žanić, Mukund Raghavachari, Willi Gierke, Zeyu Zheng, Dessie Petrova, Yann Dauphin, Yuchuan Liu, Ido Kessler, Steven Hand, Chris Duvarney, Seokhwan Kim, Hyo Lee, Léonard Hussenot, Jeffrey Hui, Josh Smith, Deepali Jain, Jiawei Xia, Gaurav Singh Tomar, Keyvan Amiri, Du Phan, Fabian Fuchs, Tobias Weyand, Nenad Tomasev, Alexandra Cordell, Xin Liu, Jonathan Mallinson, Pankaj Joshi, Andy Crawford, Arun Suggala, Steve Chien, Nick Fernando, Mariella SanchezVargas, Duncan Williams, Phil Crone, Xiyang Luo, Igor Karpov, Jyn Shan, Terry Thurk, Robin Strudel, Paul Voigtlaender, Piyush Patil, Tim Dozat, Ali Khodaei, Sahil Singla, Piotr Ambroszczyk, Qiyin Wu, Yifan Chang, Brian Roark, Chaitra Hegde, Tianli Ding, Angelos Filos, Zhongru Wu, André Susano Pinto, Shuang Liu, Saarthak Khanna, Aditya Pandey, Siobhan Mcloughlin, Qiujia Li, Sam Haves, Allan Zhou, Elena Buchatskaya, Isabel Leal, Peter de Boursac, Nami Akazawa, Nina Anderson, Terry Chen, Krishna Somandepalli, Chen Liang, Sheela Goenka, Stephanie Winkler, Alexander Grushetsky, Yifan Ding, Jamie Smith, Fan Ye, Jordi Pont-Tuset, Eric Li, Ruichao Li, Tomer Golany, Dawid Wegner, Tao Jiang, Omer Barak, Yuan Shangguan, Eszter Vértes, Renee Wong, Jörg Bornschein, Alex Tudor, Michele Bevilacqua, Tom Schaul, Ankit Singh Rawat, Yang Zhao, Kyriakos Axiotis, Lei Meng, Cory McLean, Jonathan Lai, Jennifer Beattie, Nate Kushman, Yaxin Liu, Blair Kutzman, Fiona Lang, Jingchen Ye, Praneeth Netrapalli, Pushkar Mishra, Myriam Khan, Megha Goel, Rob Willoughby, David Tian, Honglei Zhuang, JD Chen, Zak Tsai, Tasos Kementsietsidis, Arjun Khare, James Keeling, Keyang Xu, Nathan Waters, Florent Altché, Ashok Popat, Bhavishya Mittal, David Saxton, Dalia El Badawy, Michael Mathieu, Zheng Zheng, Hao Zhou, Nishant Ranka, Richard Shin, Qingnan Duan, Tim Salimans, Ioana Mihailescu, Uri Shaham, Ming-Wei Chang, Yannis Assael, Nishanth Dikkala, Martin Izzard, Vincent Cohen-Addad, Cat Graves, Vlad Feinberg, Grace Chung, DJ Strouse, Danny Karmon, Sahand Sharifzadeh, Zoe Ashwood, Khiem Pham, Jon Blanton, Alex Vasiloff, Jarred Barber, Mark Geller, Aurick Zhou, Fedir Zubach, TzuKuo Huang, Lei Zhang, Himanshu Gupta, Matt Young, Julia Proskurnia, Ronny Votel, Valentin Gabeur, Gabriel Barcik, Aditya Tripathi, Hongkun Yu, Geng Yan, Beer Changpinyo, Filip Pavetić, Amy Coyle, Yasuhisa Fujii, Jorge Gonzalez Mendez, Tianhao Zhou, Harish Rajamani, Blake Hechtman, Eddie Cao, Da-Cheng Juan, Yi-Xuan Tan, Valentin Dalibard, Yilun Du, Natalie Clay, Kaisheng Yao, Wenhao Jia, Dimple Vijaykumar, Yuxiang Zhou, Xinyi Bai, Wei-Chih Hung, Steven Pecht, Georgi Todorov, Nikhil Khadke, Pramod Gupta, Preethi Lahoti, Arnaud Autef, Karthik Duddu, James Lee-Thorp, Alexander Bykovsky, Tautvydas Misiunas, Sebastian Flennerhag, Santhosh Thangaraj, Jed McGiffin, Zack Nado, Markus Kunesch, Andreas Noever, Amir Hertz, Marco Liang, Victor Stone, Evan Palmer, Samira Daruki, Arijit Pramanik, Siim Põder, Austin Kyker, Mina Khan, Evgeny Sluzhaev, Marvin Ritter, Avraham Ruderman, Wenlei Zhou, Chirag Nagpal, Kiran Vodrahalli, George Necula, Paul Barham, Ellie Pavlick, Jay Hartford, Izhak Shafran, Long Zhao, Maciej Mikuła, Tom Eccles, Hidetoshi Shimokawa, Kanav Garg, Luke Vilnis, Hanwen Chen, Ilia Shumailov, Kuang-Huei Lee, Abdelrahman Abdelhamed, Meiyan Xie, Vered Cohen, Ester Hlavnova, Dan Malkin, Chawin Sitawarin, James Lottes, Pauline Coquinot, Tianli Yu, Sandeep Kumar, Jingwei Zhang, Aroma Mahendru, Zafarali Ahmed, James Martens, Tao Chen, Aviel Boag, Daiyi Peng, Coline Devin, Arseniy Klimovskiy, Mary Phuong, Danny Vainstein, Jin Xie, Bhuvana 15

Ramabhadran, Nathan Howard, Xinxin Yu, Gitartha Goswami, Jingyu Cui, Sam Shleifer, Mario Pinto, Chih-Kuan Yeh, Ming-Hsuan Yang, Sara Javanmardi, Dan Ethier, Chace Lee, Jordi Orbay, Suyog Kotecha, Carla Bromberg, Pete Shaw, James Thornton, Adi Gerzi Rosenthal, Shane Gu, Matt Thomas, Ian Gemp, Aditya Ayyar, Asahi Ushio, Aarush Selvan, Joel Wee, Chenxi Liu, Maryam Majzoubi, Weiren Yu, Jake Abernethy, Tyler Liechty, Renke Pan, Hoang Nguyen, Qiong, Hu, Sarah Perrin, Abhinav Arora, Emily Pitler, Weiyi Wang, Kaushik Shivakumar, Flavien Prost, Ben Limonchik, Jing Wang, Yi Gao, Timothee Cour, Shyamal Buch, Huan Gui, Maria Ivanova, Philipp Neubeck, Kelvin Chan, Lucy Kim, Huizhong Chen, Naman Goyal, Da-Woon Chung, Lu Liu, Yao Su, Anastasia Petrushkina, Jiajun Shen, Armand Joulin, Yuanzhong Xu, Stein Xudong Lin, Yana Kulizhskaya, Ciprian Chelba, Shobha Vasudevan, Eli Collins, Vasilisa Bashlovkina, Tony Lu, Doug Fritz, Jongbin Park, Yanqi Zhou, Chen Su, Richard Tanburn, Mikhail Sushkov, Mitchelle Rasquinha, Jinning Li, Jennifer Prendki, Yiming Li, Pallavi LV, Shriya Sharma, Hen Fitoussi, Hui Huang, Andrew Dai, Phuong Dao, Mike Burrows, Henry Prior, Danfeng Qin, Golan Pundak, Lars Lowe Sjoesund, Art Khurshudov, Zhenkai Zhu, Albert Webson, Elizabeth Kemp, Tat Tan, Saurabh Agrawal, Susie Sargsyan, Liqun Cheng, Jim Stephan, Tom Kwiatkowski, David Reid, Arunkumar Byravan, Assaf Hurwitz Michaely, Nicolas Heess, Luowei Zhou, Sonam Goenka, Viral Carpenter, Anselm Levskaya, Bo Wang, Reed Roberts, Rémi Leblond, Sharat Chikkerur, Stav Ginzburg, Max Chang, Robert Riachi, Chuqiao, Xu, Zalán Borsos, Michael Pliskin, Julia Pawar, Morgane Lustman, Hannah Kirkwood, Ankit Anand, Aditi Chaudhary, Norbert Kalb, Kieran Milan, Sean Augenstein, Anna Goldie, Laurel Prince, Karthik Raman, Yanhua Sun, Vivian Xia, Aaron Cohen, Zhouyuan Huo, Josh Camp, Seher Ellis, Lukas Zilka, David Vilar Torres, Lisa Patel, Sho Arora, Betty Chan, Jonas Adler, Kareem Ayoub, Jacky Liang, Fayaz Jamil, Jiepu Jiang, Simon Baumgartner, Haitian Sun, Yael Karov, Yaroslav Akulov, Hui Zheng, Irene Cai, Claudio Fantacci, James Rubin, Alex Rav Acha, Mengchao Wang, Nina D’Souza, Rohit Sathyanarayana, Shengyang Dai, Simon Rowe, Andrey Simanovsky, Omer Goldman, Yuheng Kuang, Xiaoyue Pan, Andrew Rosenberg, Tania Rojas-Esponda, Praneet Dutta, Amy Zeng, Irina Jurenka, Greg Farquhar, Yamini Bansal, Shariq Iqbal, Becca Roelofs, Ga-Young Joung, Parker Beak, Changwan Ryu, Ryan Poplin, Yan Wu, Jean-Baptiste Alayrac, Senaka Buthpitiya, Olaf Ronneberger, Caleb Habtegebriel, Wei Li, Paul Cavallaro, Aurora Wei, Guy Bensky, Timo Denk, Harish Ganapathy, Jeff Stanway, Pratik Joshi, Francesco Bertolini, Jessica Lo, Olivia Ma, Zachary Charles, Geta Sampemane, Himanshu Sahni, Xu Chen, Harry Askham, David Gaddy, Peter Young, Jiewen Tan, Matan Eyal, Arthur Bražinskas, Li Zhong, Zhichun Wu, Mark Epstein, Kai Bailey, Andrew Hard, Kamyu Lee, Sasha Goldshtein, Alex Ruiz, Mohammed Badawi, Matthias Lochbrunner, JK Kearns, Ashley Brown, Fabio Pardo, Theophane Weber, Haichuan Yang, Pan-Pan Jiang, Berkin Akin, Zhao Fu, Marcus Wainwright, Chi Zou, Meenu Gaba, PierreAntoine Manzagol, Wendy Kan, Yang Song, Karina Zainullina, Rui Lin, Jeongwoo Ko, Salil Deshmukh, Apoorv Jindal, James Svensson, Divya Tyam, Heri Zhao, Christine Kaeser-Chen, Scott Baird, Pooya Moradi, Jamie Hall, Qiuchen Guo, Vincent Tsang, Bowen Liang, Fernando Pereira, Suhas Ganesh, Ivan Korotkov, Jakub Adamek, Sridhar Thiagarajan, Vinh Tran, Charles Chen, Chris Tar, Sanil Jain, Ishita Dasgupta, Taylan Bilal, David Reitter, Kai Zhao, Giulia Vezzani, Yasmin Gehman, Pulkit Mehta, Lauren Beltrone, Xerxes Dotiwalla, Sergio Guadarrama, Zaheer Abbas, Stefani Karp, Petko Georgiev, Chun-Sung Ferng, Marc Brockschmidt, Liqian Peng, Christoph Hirnschall, Vikas Verma, Yingying Bi, Ying Xiao, Avigail Dabush, Kelvin Xu, Phil Wallis, Randall Parker, Qifei Wang, Yang Xu, Ilkin Safarli, Dinesh Tewari, Yin Zhang, Seungyeon Kim, Andrea Gesmundo, Mackenzie Thomas, Sergey Levi, Ahmed Chowdhury, Kanishka Rao, Peter Garst, Sam Conway-Rahman, Helen Ran, Kay McKinney, Zhisheng Xiao, Wenhao Yu, Rohan Agrawal, Axel Stjerngren, Catalin Ionescu, Jingjing Chen, Vivek Sharma, Justin Chiu, Fei Liu, Ken Franko, Clayton Sanford, Xingyu Cai, Paul Michel, Sanjay Ganapathy, Jane Labanowski, Zachary Garrett, Ben Vargas, Sean Sun, Bryan Gale, Thomas Buschmann, Guillaume Desjardins, Nimesh Ghelani, Palak Jain, Mudit Verma, Chulayuth Asawaroengchai, Julian Eisenschlos, Jitendra Harlalka, Hideto Kazawa, Don Metzler, Joshua Howland, Ying Jian, Jake Ades, Viral Shah, Tynan Gangwani, Seungji Lee, Roman Ring, Steven M. Hernandez, Dean Reich, Amer Sinha, Ashutosh Sathe, Joe Kovac, Ashleah Gill, Ajay Kannan, Andrea D’olimpio, Martin Sevenich, Jay Whang, Been Kim, Khe Chai Sim, Jilin Chen, Jiageng Zhang, Shuba Lall, Yossi Matias, Bill Jia, Abe Friesen, Sara Nasso, Ashish Thapliyal, Bryan Perozzi, Ting Yu, Anna Shekhawat, Safeen Huda, Peter Grabowski, Eric Wang, Ashwin Sreevatsa, Hilal Dib, Mehadi Hassen, Parker Schuh, Vedrana Milutinovic, Chris Welty, Michael Quinn, Ali Shah, Bangju Wang, Gabe Barth-Maron, Justin Frye, Natalie Axelsson, Tao Zhu, Yukun Ma, Irene Giannoumis, Hanie Sedghi, Chang Ye, Yi Luan, Kevin Aydin, Bilva Chandra, Vivek Sampathkumar, Ronny Huang, Victor 16

Lavrenko, Ahmed Eleryan, Zhi Hong, Steven Hansen, Sara Mc Carthy, Bidisha Samanta, Domagoj Ćevid, Xin Wang, Fangtao Li, Michael Voznesensky, Matt Hoffman, Andreas Terzis, Vikash Sehwag, Gil Fidel, Luheng He, Mu Cai, Yanzhang He, Alex Feng, Martin Nikoltchev, Samrat Phatale, Jason Chase, Rory Lawton, Ming Zhang, Tom Ouyang, Manuel Tragut, Mehdi Hafezi Manshadi, Arjun Narayanan, Jiaming Shen, Xu Gao, Tolga Bolukbasi, Nick Roy, Xin Li, Daniel Golovin, Liviu Panait, Zhen Qin, Guangxing Han, Thomas Anthony, Sneha Kudugunta, Viorica Patraucean, Aniket Ray, Xinyun Chen, Xiaochen Yang, Tanuj Bhatia, Pranav Talluri, Alex Morris, Andrija Ražnatović, Bethanie Brownfield, James An, Sheng Peng, Patrick Kane, Ce Zheng, Nico Duduta, Joshua Kessinger, James Noraky, Siqi Liu, Keran Rong, Petar Veličković, Keith Rush, Alex Goldin, Fanny Wei, Shiva Mohan Reddy Garlapati, Caroline Pantofaru, Okwan Kwon, Jianmo Ni, Eric Noland, Julia Di Trapani, Françoise Beaufays, Abhijit Guha Roy, Yinlam Chow, Aybuke Turker, Geoffrey Cideron, Lantao Mei, Jon Clark, Qingyun Dou, Matko Bošnjak, Ralph Leith, Yuqing Du, Amir Yazdanbakhsh, Milad Nasr, Chester Kwak, Suraj Satishkumar Sheth, Alex Kaskasoli, Ankesh Anand, Balaji Lakshminarayanan, Sammy Jerome, David Bieber, Chun-Te Chu, Alexandre Senges, Tianxiao Shen, Mukund Sridhar, Ndaba Ndebele, Benjamin Beyret, Shakir Mohamed, Mia Chen, Markus Freitag, Jiaxian Guo, Luyang Liu, Paul Roit, Heng Chen, Shen Yan, Tom Stone, JD Co-Reyes, Jeremy Cole, Salvatore Scellato, Shekoofeh Azizi, Hadi Hashemi, Alicia Jin, Anand Iyer, Marcella Valentine, András György, Arun Ahuja, Daniel Hernandez Diaz, Chen-Yu Lee, Nathan Clement, Weize Kong, Drew Garmon, Ishaan Watts, Kush Bhatia, Khyatti Gupta, Matt Miecnikowski, Hugo Vallet, Ankur Taly, Edward Loper, Saket Joshi, James Atwood, Jo Chick, Mark Collier, Fotis Iliopoulos, Ryan Trostle, Beliz Gunel, Ramiro Leal-Cavazos, Arnar Mar Hrafnkelsson, Michael Guzman, Xiaoen Ju, Andy Forbes, Jesse Emond, Kushal Chauhan, Ben Caine, Li Xiao, Wenjun Zeng, Alexandre Moufarek, Daniel Murphy, Maya Meng, Nitish Gupta, Felix Riedel, Anil Das, Elijah Lawal, Shashi Narayan, Tiberiu Sosea, James Swirhun, Linda Friso, Behnam Neyshabur, Jing Lu, Sertan Girgin, Michael Wunder, Edouard Yvinec, Aroonalok Pyne, Victor Carbune, Shruti Rijhwani, Yang Guo, Tulsee Doshi, Anton Briukhov, Max Bain, Ayal Hitron, Xuanhui Wang, Ashish Gupta, Ke Chen, Cosmo Du, Weiyang Zhang, Dhruv Shah, Arjun Akula, Max Dylla, Ashyana Kachra, Weicheng Kuo, Tingting Zou, Lily Wang, Luyao Xu, Jifan Zhu, Justin Snyder, Sachit Menon, Orhan Firat, Igor Mordatch, Yuan Yuan, Natalia Ponomareva, Rory Blevins, Lawrence Moore, Weijun Wang, Phil Chen, Martin Scholz, Artur Dwornik, Jason Lin, Sicheng Li, Diego Antognini, Te I, Xiaodan Song, Matt Miller, Uday Kalra, Adam Raveret, Oscar Akerlund, Felix Wu, Andrew Nystrom, Namrata Godbole, Tianqi Liu, Hannah DeBalsi, Jewel Zhao, Buhuang Liu, Avi Caciularu, Lauren Lax, Urvashi Khandelwal, Victoria Langston, Eric Bailey, Silvio Lattanzi, Yufei Wang, Neel Kovelamudi, Sneha Mondal, Guru Guruganesh, Nan Hua, Ofir Roval, Paweł Wesołowski, Rishikesh Ingale, Jonathan Halcrow, Tim Sohn, Christof Angermueller, Bahram Raad, Eli Stickgold, Eva Lu, Alec Kosik, Jing Xie, Timothy Lillicrap, Austin Huang, Lydia Lihui Zhang, Dominik Paulus, Clement Farabet, Alex Wertheim, Bing Wang, Rishabh Joshi, Chu ling Ko, Yonghui Wu, Shubham Agrawal, Lily Lin, XiangHai Sheng, Peter Sung, Tyler Breland-King, Christina Butterfield, Swapnil Gawde, Sumeet Singh, Qiao Zhang, Raj Apte, Shilpa Shetty, Adrian Hutter, Tao Li, Elizabeth Salesky, Federico Lebron, Jonni Kanerva, Michela Paganini, Arthur Nguyen, Rohith Vallu, Jan-Thorsten Peter, Sarmishta Velury, David Kao, Jay Hoover, Anna Bortsova, Colton Bishop, Shoshana Jakobovits, Alessandro Agostini, Alekh Agarwal, Chang Liu, Charles Kwong, Sasan Tavakkol, Ioana Bica, Alex Greve, Anirudh GP, Jake Marcus, Le Hou, Tom Duerig, Rivka Moroshko, Dave Lacey, Andy Davis, Julien Amelot, Guohui Wang, Frank Kim, Theofilos Strinopoulos, Hui Wan, Charline Le Lan, Shankar Krishnan, Haotian Tang, Peter Humphreys, Junwen Bai, Idan Heimlich Shtacher, Diego Machado, Chenxi Pang, Ken Burke, Dangyi Liu, Renga Aravamudhan, Yue Song, Ed Hirst, Abhimanyu Singh, Brendan Jou, Liang Bai, Francesco Piccinno, Chuyuan Kelly Fu, Robin Alazard, Barak Meiri, Daniel Winter, Charlie Chen, Mingda Zhang, Jens Heitkaemper, John Lambert, Jinhyuk Lee, Alexander Frömmgen, Sergey Rogulenko, Pranav Nair, Paul Niemczyk, Anton Bulyenov, Bibo Xu, Hadar Shemtov, Morteza Zadimoghaddam, Serge Toropov, Mateo Wirth, Hanjun Dai, Sreenivas Gollapudi, Daniel Zheng, Alex Kurakin, Chansoo Lee, Kalesha Bullard, Nicolas Serrano, Ivana Balazevic, Yang Li, Johan Schalkwyk, Mark Murphy, Mingyang Zhang, Kevin Sequeira, Romina Datta, Nishant Agrawal, Charles Sutton, Nithya Attaluri, Mencher Chiang, Wael Farhan, Gregory Thornton, Kate Lin, Travis Choma, Hung Nguyen, Kingshuk Dasgupta, Dirk Robinson, Iulia Comşa, Michael Riley, Arjun Pillai, Basil Mustafa, Ben Golan, Amir Zandieh, Jean-Baptiste Lespiau, Billy Porter, David Ross, Sujeevan Rajayogam, Mohit Agarwal, Subhashini Venugopalan, Bobak Shahriari, Qiqi Yan, Hao Xu, Taylor Tobin, Pavel Dubov, Hongzhi Shi, Adrià Recasens, Anton Kovsharov, Sebastian Borgeaud, 17

Lucio Dery, Shanthal Vasanth, Elena Gribovskaya, Linhai Qiu, Mahdis Mahdieh, Wojtek Skut, Elizabeth Nielsen, CJ Zheng, Adams Yu, Carrie Grimes Bostock, Shaleen Gupta, Aaron Archer, Chris Rawles, Elinor Davies, Alexey Svyatkovskiy, Tomy Tsai, Yoni Halpern, Christian Reisswig, Bartek Wydrowski, Bo Chang, Joan Puigcerver, Mor Hazan Taege, Jian Li, Eva Schnider, Xinjian Li, Dragos Dena, Yunhan Xu, Umesh Telang, Tianze Shi, Heiga Zen, Kyle Kastner, Yeongil Ko, Neesha Subramaniam, Aviral Kumar, Pete Blois, Zhuyun Dai, John Wieting, Yifeng Lu, Yoel Zeldes, Tian Xie, Anja Hauth, Alexandru Ţifrea, Yuqi Li, Sam El-Husseini, Dan Abolafia, Howard Zhou, Wen Ding, Sahra Ghalebikesabi, Carlos Guía, Andrii Maksai, Ágoston Weisz, Sercan Arik, Nick Sukhanov, Aga Świetlik, Xuhui Jia, Luo Yu, Weiyue Wang, Mark Brand, Dawn Bloxwich, Sean Kirmani, Zhe Chen, Alec Go, Pablo Sprechmann, Nithish Kannen, Alen Carin, Paramjit Sandhu, Isabel Edkins, Leslie Nooteboom, Jai Gupta, Loren Maggiore, Javad Azizi, Yael Pritch, Pengcheng Yin, Mansi Gupta, Danny Tarlow, Duncan Smith, Desi Ivanov, Mohammad Babaeizadeh, Ankita Goel, Satish Kambala, Grace Chu, Matej Kastelic, Michelle Liu, Hagen Soltau, Austin Stone, Shivani Agrawal, Min Kim, Kedar Soparkar, Srinivas Tadepalli, Oskar Bunyan, Rachel Soh, Arvind Kannan, DY Kim, Blake JianHang Chen, Afief Halumi, Sudeshna Roy, Yulong Wang, Olcan Sercinoglu, Gena Gibson, Sijal Bhatnagar, Motoki Sano, Daniel von Dincklage, Qingchun Ren, Blagoj Mitrevski, Mirek Olšák, Jennifer She, Carl Doersch, Jilei, Wang, Bingyuan Liu, Qijun Tan, Tamar Yakar, Tris Warkentin, Alex Ramirez, Carl Lebsack, Josh Dillon, Rajiv Mathews, Tom Cobley, Zelin Wu, Zhuoyuan Chen, Jon Simon, Swaroop Nath, Tara Sainath, Alexei Bendebury, Ryan Julian, Bharath Mankalale, Daria Ćurko, Paulo Zacchello, Adam R. Brown, Kiranbir Sodhia, Heidi Howard, Sergi Caelles, Abhinav Gupta, Gareth Evans, Anna Bulanova, Lesley Katzen, Roman Goldenberg, Anton Tsitsulin, Joe Stanton, Benoit Schillings, Vitaly Kovalev, Corey Fry, Rushin Shah, Kuo Lin, Shyam Upadhyay, Cheng Li, Soroush Radpour, Marcello Maggioni, Jing Xiong, Lukas Haas, Jenny Brennan, Aishwarya Kamath, Nikolay Savinov, Arsha Nagrani, Trevor Yacovone, Ryan Kappedal, Kostas Andriopoulos, Li Lao, YaGuang Li, Grigory Rozhdestvenskiy, Kazuma Hashimoto, Andrew Audibert, Sophia Austin, Daniel Rodriguez, Anian Ruoss, Garrett Honke, Deep Karkhanis, Xi Xiong, Qing Wei, James Huang, Zhaoqi Leng, Vittal Premachandran, Stan Bileschi, Georgios Evangelopoulos, Thomas Mensink, Jay Pavagadhi, Denis Teplyashin, Paul Chang, Linting Xue, Garrett Tanzer, Sally Goldman, Kaushal Patel, Shixin Li, Jeremy Wiesner, Ivy Zheng, Ian Stewart-Binks, Jie Han, Zhi Li, Liangchen Luo, Karel Lenc, Mario Lučić, Fuzhao Xue, Ryan Mullins, Alexey Guseynov, Chung-Ching Chang, Isaac Galatzer-Levy, Adam Zhang, Garrett Bingham, Grace Hu, Ale Hartman, Yue Ma, Jordan Griffith, Alex Irpan, Carey Radebaugh, Summer Yue, Lijie Fan, Victor Ungureanu, Christina Sorokin, Hannah Teufel, Peiran Li, Rohan Anil, Dimitris Paparas, Todd Wang, Chu-Cheng Lin, Hui Peng, Megan Shum, Goran Petrovic, Demetra Brady, Richard Nguyen, Klaus Macherey, Zhihao Li, Harman Singh, Madhavi Yenugula, Mariko Iinuma, Xinyi Chen, Kavya Kopparapu, Alexey Stern, Shachi Dave, Chandu Thekkath, Florence Perot, Anurag Kumar, Fangda Li, Yang Xiao, Matthew Bilotti, Mohammad Hossein Bateni, Isaac Noble, Lisa Lee, Amelio Vázquez-Reina, Julian Salazar, Xiaomeng Yang, Boyu Wang, Ela Gruzewska, Anand Rao, Sindhu Raghuram, Zheng Xu, Eyal Ben-David, Jieru Mei, Sid Dalmia, Zhaoyi Zhang, Yuchen Liu, Gagan Bansal, Helena Pankov, Steven Schwarcz, Andrea Burns, Christine Chan, Sumit Sanghai, Ricky Liang, Ethan Liang, Antoine He, Amy Stuart, Arun Narayanan, Yukun Zhu, Christian Frank, Bahar Fatemi, Amit Sabne, Oran Lang, Indro Bhattacharya, Shane Settle, Maria Wang, Brendan McMahan, Andrea Tacchetti, Livio Baldini Soares, Majid Hadian, Serkan Cabi, Timothy Chung, Nikita Putikhin, Gang Li, Jeremy Chen, Austin Tarango, Henryk Michalewski, Mehran Kazemi, Hussain Masoom, Hila Sheftel, Rakesh Shivanna, Archita Vadali, Ramona Comanescu, Doug Reid, Joss Moore, Arvind Neelakantan, Michaël Sander, Jonathan Herzig, Aviv Rosenberg, Mostafa Dehghani, JD Choi, Michael Fink, Reid Hayes, Eric Ge, Shitao Weng, ChiaHua Ho, John Karro, Kalpesh Krishna, Lam Nguyen Thiet, Amy Skerry-Ryan, Daniel Eppens, Marco Andreetto, Navin Sarma, Silvano Bonacina, Burcu Karagol Ayan, Megha Nawhal, Zhihao Shan, Mike Dusenberry, Shantanu Thakoor, Sagar Gubbi, Duc Dung Nguyen, Reut Tsarfaty, Samuel Albanie, Jovana Mitrović, Meet Gandhi, Bo-Juen Chen, Alessandro Epasto, Georgi Stephanov, Ye Jin, Samuel Gehman, Aida Amini, Jack Weber, Feryal Behbahani, Shawn Xu, Miltos Allamanis, Xi Chen, Myle Ott, Claire Sha, Michal Jastrzebski, Hang Qi, David Greene, Xinyi Wu, Abodunrinwa Toki, Daniel Vlasic, Jane Shapiro, Ragha Kotikalapudi, Zhe Shen, Takaaki Saeki, Sirui Xie, Albin Cassirer, Shikhar Bharadwaj, Tatsuya Kiyono, Srinadh Bhojanapalli, Elan Rosenfeld, Sam Ritter, Jieming Mao, João Gabriel Oliveira, Zoltan Egyed, Bernd Bandemer, Emilio Parisotto, Keisuke Kinoshita, Juliette Pluto, Petros Maniatis, Steve Li, Yaohui Guo, Golnaz Ghiasi, Jean Tarbouriech, Srimon Chatterjee, Julie Jin, Katrina, Xu, Jennimaria 18

Palomaki, Séb Arnold, Madhavi Sewak, Federico Piccinini, Mohit Sharma, Ben Albrecht, Sean Purserhaskell, Ashwin Vaswani, Chongyan Chen, Matheus Wisniewski, Qin Cao, John Aslanides, Nguyet Minh Phu, Maximilian Sieb, Lauren Agubuzu, Anne Zheng, Daniel Sohn, Marco Selvi, Anders Andreassen, Krishan Subudhi, Prem Eruvbetine, Oliver Woodman, Tomas Mery, Sebastian Krause, Xiaoqi Ren, Xiao Ma, Jincheng Luo, Dawn Chen, Wei Fan, Henry Griffiths, Christian Schuler, Alice Li, Shujian Zhang, JeanMichel Sarr, Shixin Luo, Riccardo Patana, Matthew Watson, Dani Naboulsi, Michael Collins, Sailesh Sidhwani, Emiel Hoogeboom, Sharon Silver, Emily Caveness, Xiaokai Zhao, Mikel Rodriguez, Maxine Deines, Libin Bai, Patrick Griffin, Marco Tagliasacchi, Emily Xue, Spandana Raj Babbula, Bo Pang, Nan Ding, Gloria Shen, Elijah Peake, Remi Crocker, Shubha Srinivas Raghvendra, Danny Swisher, Woohyun Han, Richa Singh, Ling Wu, Vladimir Pchelin, Tsendsuren Munkhdalai, Dana Alon, Geoff Bacon, Efren Robles, Jannis Bulian, Melvin Johnson, George Powell, Felipe Tiengo Ferreira, Yaoyiran Li, Frederik Benzing, Mihajlo Velimirović, Hubert Soyer, William Kong, Tony, Nguyên, Zhen Yang, Jeremiah Liu, Joost van Amersfoort, Daniel Gillick, Baochen Sun, Nathalie Rauschmayr, Katie Zhang, Serena Zhan, Tao Zhou, Alexey Frolov, Chengrun Yang, Denis Vnukov, Louis Rouillard, Hongji Li, Amol Mandhane, Nova Fallen, Rajesh Venkataraman, Clara Huiyi Hu, Jennifer Brennan, Jenny Lee, Jerry Chang, Martin Sundermeyer, Zhufeng Pan, Rosemary Ke, Simon Tong, Alex Fabrikant, William Bono, Jindong Gu, Ryan Foley, Yiran Mao, Manolis Delakis, Dhruva Bhaswar, Roy Frostig, Nick Li, Avital Zipori, Cath Hope, Olga Kozlova, Swaroop Mishra, Josip Djolonga, Craig Schiff, Majd Al Merey, Eleftheria Briakou, Peter Morgan, Andy Wan, Avinatan Hassidim, RJ Skerry-Ryan, Kuntal Sengupta, Mary Jasarevic, Praveen Kallakuri, Paige Kunkle, Hannah Brennan, Tom Lieber, Hassan Mansoor, Julian Walker, Bing Zhang, Annie Xie, Goran Žužić, Adaeze Chukwuka, Alex Druinsky, Donghyun Cho, Rui Yao, Ferjad Naeem, Shiraz Butt, Eunyoung Kim, Zhipeng Jia, Mandy Jordan, Adam Lelkes, Mark Kurzeja, Sophie Wang, James Zhao, Andrew Over, Abhishek Chakladar, Marcel Prasetya, Neha Jha, Sriram Ganapathy, Yale Cong, Prakash Shroff, Carl Saroufim, Sobhan Miryoosefi, Mohamed Hammad, Tajwar Nasir, Weijuan Xi, Yang Gao, Young Maeng, Ben Hora, Chin-Yi Cheng, Parisa Haghani, Yoad Lewenberg, Caden Lu, Martin Matysiak, Naina Raisinghani, Huiyu Wang, Lexi Baugher, Rahul Sukthankar, Minh Giang, John Schultz, Noah Fiedel, Minmin Chen, Cheng-Chun Lee, Tapomay Dey, Hao Zheng, Shachi Paul, Celine Smith, Andy Ly, Yicheng Wang, Rishabh Bansal, Bartek Perz, Susanna Ricco, Stasha Blank, Vaishakh Keshava, Deepak Sharma, Marvin Chow, Kunal Lad, Komal Jalan, Simon Osindero, Craig Swanson, Jacob Scott, Anastasija Ilić, Xiaowei Li, Siddhartha Reddy Jonnalagadda, Afzal Shama Soudagar, Yan Xiong, Bat-Orgil Batsaikhan, Daniel Jarrett, Naveen Kumar, Maulik Shah, Matt Lawlor, Austin Waters, Mark Graham, Rhys May, Sabela Ramos, Sandra Lefdal, Zeynep Cankara, Nacho Cano, Brendan O’Donoghue, Jed Borovik, Frederick Liu, Jordan Grimstad, Mahmoud Alnahlawi, Katerina Tsihlas, Tom Hudson, Nikolai Grigorev, Yiling Jia, Terry Huang, Tobenna Peter Igwe, Sergei Lebedev, Xiaodan Tang, Igor Krivokon, Frankie Garcia, Melissa Tan, Eric Jia, Peter Stys, Shikhar Vashishth, Yu Liang, Balaji Venkatraman, Chenjie Gu, Anastasios Kementsietsidis, Chen Zhu, Junehyuk Jung, Yunfei Bai, Mohammad Javad Hosseini, Faruk Ahmed, Aditya Gupta, Xin Yuan, Shereen Ashraf, Shitij Nigam, Gautam Vasudevan, Pranjal Awasthi, Adi Mayrav Gilady, Zelda Mariet, Ramy Eskander, Haiguang Li, Hexiang Hu, Guillermo Garrido, Philippe Schlattner, George Zhang, Rohun Saxena, Petar Dević, Kritika Muralidharan, Ashwin Murthy, Yiqian Zhou, Min Choi, Arissa Wongpanich, Zhengdong Wang, Premal Shah, Yuntao Xu, Yiling Huang, Stephen Spencer, Alice Chen, James Cohan, Junjie Wang, Jonathan Tompson, Junru Wu, Ruba Haroun, Haiqiong Li, Blanca Huergo, Fan Yang, Tongxin Yin, James Wendt, Michael Bendersky, Rahma Chaabouni, Javier Snaider, Johan Ferret, Abhishek Jindal, Tara Thompson, Andrew Xue, Will Bishop, Shubham Milind Phal, Archit Sharma, Yunhsuan Sung, Prabakar Radhakrishnan, Mo Shomrat, Reeve Ingle, Roopali Vij, Justin Gilmer, Mihai Dorin Istin, Sam Sobell, Yang Lu, Emily Nottage, Dorsa Sadigh, Jeremiah Willcock, Tingnan Zhang, Steve Xu, Sasha Brown, Katherine Lee, Gary Wang, Yun Zhu, Yi Tay, Cheolmin Kim, Audrey Gutierrez, Abhanshu Sharma, Yongqin Xian, Sungyong Seo, Claire Cui, Elena Pochernina, Cip Baetu, Krzysztof Jastrzębski, Mimi Ly, Mohamed Elhawaty, Dan Suh, Eren Sezener, Pidong Wang, Nancy Yuen, George Tucker, Jiahao Cai, Zuguang Yang, Cindy Wang, Alex Muzio, Hai Qian, Jae Yoo, Derek Lockhart, Kevin R. McKee, Mandy Guo, Malika Mehrotra, Artur Mendonça, Sanket Vaibhav Mehta, Sherry Ben, Chetan Tekur, Jiaqi Mu, Muye Zhu, Victoria Krakovna, Hongrae Lee, AJ Maschinot, Sébastien Cevey, HyunJeong Choe, Aijun Bai, Hansa Srinivasan, Derek Gasaway, Nick Young, Patrick Siegler, Dan Holtmann-Rice, Vihari Piratla, Kate Baumli, Roey Yogev, Alex Hofer, Hado van Hasselt, Svetlana Grant, Yuri Chervonyi, David Silver, Andrew Hogue, Ayushi Agarwal, 19

Kathie Wang, Preeti Singh, Four Flynn, Josh Lipschultz, Robert David, Lizzetth Bellot, Yao-Yuan Yang, Long Le, Filippo Graziano, Kate Olszewska, Kevin Hui, Akanksha Maurya, Nikos Parotsidis, Weijie Chen, Tayo Oguntebi, Joe Kelley, Anirudh Baddepudi, Johannes Mauerer, Gregory Shaw, Alex Siegman, Lin Yang, Shravya Shetty, Subhrajit Roy, Yunting Song, Wojciech Stokowiec, Ryan Burnell, Omkar Savant, Robert Busa-Fekete, Jin Miao, Samrat Ghosh, Liam MacDermed, Phillip Lippe, Mikhail Dektiarev, Zach Behrman, Fabian Mentzer, Kelvin Nguyen, Meng Wei, Siddharth Verma, Chris Knutsen, Sudeep Dasari, Zhipeng Yan, Petr Mitrichev, Xingyu Wang, Virat Shejwalkar, Jacob Austin, Srinivas Sunkara, Navneet Potti, Yan Virin, Christian Wright, Gaël Liu, Oriana Riva, Etienne Pot, Greg Kochanski, Quoc Le, Gargi Balasubramaniam, Arka Dhar, Yuguo Liao, Adam Bloniarz, Divyansh Shukla, Elizabeth Cole, Jong Lee, Sheng Zhang, Sushant Kafle, Siddharth Vashishtha, Parsa Mahmoudieh, Grace Chen, Raphael Hoffmann, Pranesh Srinivasan, Agustin Dal Lago, Yoav Ben Shalom, Zi Wang, Michael Elabd, Anuj Sharma, Junhyuk Oh, Suraj Kothawade, Maigo Le, Marianne Monteiro, Shentao Yang, Kaiz Alarakyia, Robert Geirhos, Diana Mincu, Håvard Garnes, Hayato Kobayashi, Soroosh Mariooryad, Kacper Krasowiak, Zhixin, Lai, Shibl Mourad, Mingqiu Wang, Fan Bu, Ophir Aharoni, Guanjie Chen, Abhimanyu Goyal, Vadim Zubov, Ankur Bapna, Elahe Dabir, Nisarg Kothari, Kay Lamerigts, Nicola De Cao, Jeremy Shar, Christopher Yew, Nitish Kulkarni, Dre Mahaarachchi, Mandar Joshi, Zhenhai Zhu, Jared Lichtarge, Yichao Zhou, Hannah Muckenhirn, Vittorio Selo, Oriol Vinyals, Peter Chen, Anthony Brohan, Vaibhav Mehta, Sarah Cogan, Ruth Wang, Ty Geri, Wei-Jen Ko, Wei Chen, Fabio Viola, Keshav Shivam, Lisa Wang, Madeleine Clare Elish, Raluca Ada Popa, Sébastien Pereira, Jianqiao Liu, Raphael Koster, Donnie Kim, Gufeng Zhang, Sayna Ebrahimi, Partha Talukdar, Yanyan Zheng, Petra Poklukar, Ales Mikhalap, Dale Johnson, Anitha Vijayakumar, Mark Omernick, Matt Dibb, Ayush Dubey, Qiong Hu, Apurv Suman, Vaibhav Aggarwal, Ilya Kornakov, Fei Xia, Wing Lowe, Alexey Kolganov, Ted Xiao, Vitaly Nikolaev, Steven Hemingray, Bonnie Li, Joana Iljazi, Mikołaj Rybiński, Ballie Sandhu, Peggy Lu, Thang Luong, Rodolphe Jenatton, Vineetha Govindaraj, Hui, Li, Gabriel Dulac-Arnold, Wonpyo Park, Henry Wang, Abhinit Modi, Jean Pouget-Abadie, Kristina Greller, Rahul Gupta, Robert Berry, Prajit Ramachandran, Jinyu Xie, Liam McCafferty, Jianling Wang, Kilol Gupta, Hyeontaek Lim, Blaž Bratanič, Andy Brock, Ilia Akolzin, Jim Sproch, Dan Karliner, Duhyeon Kim, Adrian Goedeckemeyer, Noam Shazeer, Cordelia Schmid, Daniele Calandriello, Parul Bhatia, Krzysztof Choromanski, Ceslee Montgomery, Dheeru Dua, Ana Ramalho, Helen King, Yue Gao, Lynn Nguyen, David Lindner, Divya Pitta, Oleaser Johnson, Khalid Salama, Diego Ardila, Michael Han, Erin Farnese, Seth Odoom, Ziyue Wang, Xiangzhuo Ding, Norman Rink, Ray Smith, Harshal Tushar Lehri, Eden Cohen, Neera Vats, Tong He, Parthasarathy Gopavarapu, Adam Paszke, Miteyan Patel, Wouter Van Gansbeke, Lucia Loher, Luis Castro, Maria Voitovich, Tamara von Glehn, Nelson George, Simon Niklaus, Zach Eaton-Rosen, Nemanja Rakićević, Erik Jue, Sagi Perel, Carrie Zhang, Yuval Bahat, Angéline Pouget, Zhi Xing, Fantine Huot, Ashish Shenoy, Taylor Bos, Vincent Coriou, Bryan Richter, Natasha Noy, Yaqing Wang, Santiago Ontanon, Siyang Qin, Gleb Makarchuk, Demis Hassabis, Zhuowan Li, Mandar Sharma, Kumaran Venkatesan, Iurii Kemaev, Roxanne Daniel, Shiyu Huang, Saloni Shah, Octavio Ponce, Warren, Chen, Manaal Faruqui, Jialin Wu, Slavica Andačić, Szabolcs Payrits, Daniel McDuff, Tom Hume, Yuan Cao, MH Tessler, Qingze Wang, Yinan Wang, Ivor Rendulic, Eirikur Agustsson, Matthew Johnson, Tanya Lando, Andrew Howard, Sri Gayatri Sundara Padmanabhan, Mayank Daswani, Andrea Banino, Michael Kilgore, Jonathan Heek, Ziwei Ji, Alvaro Caceres, Conglong Li, Nora Kassner, Alexey Vlaskin, Zeyu Liu, Alex Grills, Yanhan Hou, Roykrong Sukkerd, Gowoon Cheon, Nishita Shetty, Larisa Markeeva, Piotr Stanczyk, Tejas Iyer, Yuan Gong, Shawn Gao, Keerthana Gopalakrishnan, Tim Blyth, Malcolm Reynolds, Avishkar Bhoopchand, Misha Bilenko, Dero Gharibian, Vicky Zayats, Aleksandra Faust, Abhinav Singh, Min Ma, Hongyang Jiao, Sudheendra Vijayanarasimhan, Lora Aroyo, Vikas Yadav, Sarah Chakera, Ashwin Kakarla, Vilobh Meshram, Karol Gregor, Gabriela Botea, Evan Senter, Dawei Jia, Geza Kovacs, Neha Sharma, Sebastien Baur, Kai Kang, Yifan He, Lin Zhuo, Marija Kostelac, Itay Laish, Songyou Peng, Louis O’Bryan, Daniel Kasenberg, Girish Ramchandra Rao, Edouard Leurent, Biao Zhang, Sage Stevens, Ana Salazar, Ye Zhang, Ivan Lobov, Jake Walker, Allen Porter, Morgan Redshaw, Han Ke, Abhishek Rao, Alex Lee, Hoi Lam, Michael Moffitt, Jaeyoun Kim, Siyuan Qiao, Terry Koo, Robert Dadashi, Xinying Song, Mukund Sundararajan, Peng Xu, Chizu Kawamoto, Yan Zhong, Clara Barbu, Apoorv Reddy, Mauro Verzetti, Leon Li, George Papamakarios, Hanna Klimczak-Plucińska, Mary Cassin, Koray Kavukcuoglu, Rigel Swavely, Alain Vaucher, Jeffrey Zhao, Ross Hemsley, Michael Tschannen, Heming Ge, Gaurav Menghani, Yang Yu, Natalie Ha, Wei He, Xiao Wu, Maggie Song, Rachel Sterneck, Stefan Zinke, Dan A. Calian, Annie Marsden, Alejandro Cruzado Ruiz, Matteo Hessel, Almog 20

Gueta, Benjamin Lee, Brian Farris, Manish Gupta, Yunjie Li, Mohammad Saleh, Vedant Misra, Kefan Xiao, Piermaria Mendolicchio, Gavin Buttimore, Varvara Krayvanova, Nigamaa Nayakanti, Matthew Wiethoff, Yash Pande, Azalia Mirhoseini, Ni Lao, Jasmine Liu, Yiqing Hua, Angie Chen, Yury Malkov, Dmitry Kalashnikov, Shubham Gupta, Kartik Audhkhasi, Yuexiang Zhai, Sudhindra Kopalle, Prateek Jain, Eran Ofek, Clemens Meyer, Khuslen Baatarsukh, Hana Strejček, Jun Qian, James Freedman, Ricardo Figueira, Michal Sokolik, Olivier Bachem, Raymond Lin, Dia Kharrat, Chris Hidey, Pingmei Xu, Dennis Duan, Yin Li, Muge Ersoy, Richard Everett, Kevin Cen, Rebeca Santamaria-Fernandez, Amir Taubenfeld, Ian Mackinnon, Linda Deng, Polina Zablotskaia, Shashank Viswanadha, Shivanker Goel, Damion Yates, Yunxiao Deng, Peter Choy, Mingqing Chen, Abhishek Sinha, Alex Mossin, Yiming Wang, Arthur Szlam, Susan Hao, Paul Kishan Rubenstein, Metin Toksoz-Exley, Miranda Aperghis, Yin Zhong, Junwhan Ahn, Michael Isard, Olivier Lacombe, Florian Luisier, Chrysovalantis Anastasiou, Yogesh Kalley, Utsav Prabhu, Emma Dunleavy, Shaan Bijwadia, Justin Mao-Jones, Kelly Chen, Rama Pasumarthi, Emily Wood, Adil Dostmohamed, Nate Hurley, Jiri Simsa, Alicia Parrish, Mantas Pajarskas, Matt Harvey, Ondrej Skopek, Yony Kochinski, Javier Rey, Verena Rieser, Denny Zhou, Sun Jae Lee, Trilok Acharya, Guowang Li, Joe Jiang, Xiaofan Zhang, Bryant Gipson, Ethan Mahintorabi, Marco Gelmi, Nima Khajehnouri, Angel Yeh, Kayi Lee, Loic Matthey, Leslie Baker, Trang Pham, Han Fu, Alex Pak, Prakhar Gupta, Cristina Vasconcelos, Adam Sadovsky, Brian Walker, Sissie Hsiao, Patrik Zochbauer, Andreea Marzoca, Noam Velan, Junhao Zeng, Gilles Baechler, Danny Driess, Divya Jain, Yanping Huang, Lizzie Tao, John Maggs, Nir Levine, Jon Schneider, Erika Gemzer, Samuel Petit, Shan Han, Zach Fisher, Dustin Zelle, Courtney Biles, Eugene Ie, Asya Fadeeva, Casper Liu, Juliana Vicente Franco, Adrian Collister, Hao Zhang, Renshen Wang, Ruizhe Zhao, Leandro Kieliger, Kurt Shuster, Rui Zhu, Boqing Gong, Lawrence Chan, Ruoxi Sun, Sujoy Basu, Roland Zimmermann, Jamie Hayes, Abhishek Bapna, Jasper Snoek, Weel Yang, Puranjay Datta, Jad Al Abdallah, Kevin Kilgour, Lu Li, SQ Mah, Yennie Jun, Morgane Rivière, Abhijit Karmarkar, Tammo Spalink, Tao Huang, Lucas Gonzalez, Duc-Hieu Tran, Averi Nowak, John Palowitch, Martin Chadwick, Ellie Talius, Harsh Mehta, Thibault Sellam, Philipp Fränken, Massimo Nicosia, Kyle He, Aditya Kini, David Amos, Sugato Basu, Harrison Jobe, Eleni Shaw, Qiantong Xu, Colin Evans, Daisuke Ikeda, Chaochao Yan, Larry Jin, Lun Wang, Sachin Yadav, Ilia Labzovsky, Ramesh Sampath, Ada Ma, Candice Schumann, Aditya Siddhant, Rohin Shah, John Youssef, Rishabh Agarwal, Natalie Dabney, Alessio Tonioni, Moran Ambar, Jing Li, Isabelle Guyon, Benny Li, David Soergel, Boya Fang, Georgi Karadzhov, Cristian Udrescu, Trieu Trinh, Vikas Raunak, Seb Noury, Dee Guo, Sonal Gupta, Mara Finkelstein, Denis Petek, Lihao Liang, Greg Billock, Pei Sun, David Wood, Yiwen Song, Xiaobin Yu, Tatiana Matejovicova, Regev Cohen, Kalyan Andra, David D’Ambrosio, Zhiwei Deng, Vincent Nallatamby, Ebrahim Songhori, Rumen Dangovski, Andrew Lampinen, Pankil Botadra, Adam Hillier, Jiawei Cao, Nagabhushan Baddi, Adhi Kuncoro, Toshihiro Yoshino, Ankit Bhagatwala, Marcáurelio Ranzato, Rylan Schaeffer, Tianlin Liu, Shuai Ye, Obaid Sarvana, John Nham, Chenkai Kuang, Isabel Gao, Jinoo Baek, Shubham Mittal, Ayzaan Wahid, Anita Gergely, Bin Ni, Josh Feldman, Carrie Muir, Pascal Lamblin, Wolfgang Macherey, Ethan Dyer, Logan Kilpatrick, Víctor Campos, Mukul Bhutani, Stanislav Fort, Yanif Ahmad, Aliaksei Severyn, Kleopatra Chatziprimou, Oleksandr Ferludin, Mason Dimarco, Aditya Kusupati, Joe Heyward, Dan Bahir, Kevin Villela, Katie Millican, Dror Marcus, Sanaz Bahargam, Caglar Unlu, Nicholas Roth, Zichuan Wei, Siddharth Gopal, Deepanway Ghoshal, Edward Lee, Sharon Lin, Jennie Lees, Dayeong Lee, Anahita Hosseini, Connie Fan, Seth Neel, Marcus Wu, Yasemin Altun, Honglong Cai, Enrique Piqueras, Josh Woodward, Alessandro Bissacco, Salem Haykal, Mahyar Bordbar, Prasha Sundaram, Sarah Hodkinson, Daniel Toyama, George Polovets, Austin Myers, Anu Sinha, Tomer Levinboim, Kashyap Krishnakumar, Rachita Chhaparia, Tatiana Sholokhova, Nitesh Bharadwaj Gundavarapu, Ganesh Jawahar, Haroon Qureshi, Jieru Hu, Nikola Momchev, Matthew Rahtz, Renjie Wu, Aishwarya P S, Kedar Dhamdhere, Meiqi Guo, Umang Gupta, Ali Eslami, Mariano Schain, Michiel Blokzijl, David Welling, Dave Orr, Levent Bolelli, Nicolas Perez-Nieves, Mikhail Sirotenko, Aman Prasad, Arjun Kar, Borja De Balle Pigem, Tayfun Terzi, Gellért Weisz, Dipankar Ghosh, Aditi Mavalankar, Dhruv Madeka, Kaspar Daugaard, Hartwig Adam, Viraj Shah, Dana Berman, Maggie Tran, Steven Baker, Ewa Andrejczuk, Grishma Chole, Ganna Raboshchuk, Mahdi Mirzazadeh, Thais Kagohara, Shimu Wu, Christian Schallhart, Bernett Orlando, Chen Wang, Alban Rrustemi, Hao Xiong, Hao Liu, Arpi Vezer, Nolan Ramsden, Shuo yiin Chang, Sidharth Mudgal, Yan Li, Nino Vieillard, Yedid Hoshen, Farooq Ahmad, Ambrose Slone, Amy Hua, Natan Potikha, Mirko Rossini, Jon Stritar, Sushant Prakash, Zifeng Wang, Xuanyi Dong, Alireza Nazari, Efrat Nehoran, Kaan Tekelioglu, Yinxiao Li, Kartikeya Badola, Tom Funkhouser, 21

Yuanzhen Li, Varun Yerram, Ramya Ganeshan, Daniel Formoso, Karol Langner, Tian Shi, Huijian Li, Yumeya Yamamori, Amayika Panda, Alaa Saade, Angelo Scorza Scarpati, Chris Breaux, CJ Carey, Zongwei Zhou, Cho-Jui Hsieh, Sophie Bridgers, Alena Butryna, Nishesh Gupta, Vaibhav Tulsyan, Sanghyun Woo, Evgenii Eltyshev, Will Grathwohl, Chanel Parks, Seth Benjamin, Rina Panigrahy, Shenil Dodhia, Daniel De Freitas, Chris Sauer, Will Song, Ferran Alet, Jackson Tolins, Cosmin Paduraru, Xingyi Zhou, Brian Albert, Zizhao Zhang, Lei Shu, Mudit Bansal, Sarah Nguyen, Amir Globerson, Owen Xiao, James Manyika, Tom Hennigan, Rong Rong, Josip Matak, Anton Bakalov, Ankur Sharma, Danila Sinopalnikov, Andrew Pierson, Stephen Roller, Geoff Brown, Mingcen Gao, Toshiyuki Fukuzawa, Amin Ghafouri, Kenny Vassigh, Iain Barr, Zhicheng Wang, Anna Korsun, Rajesh Jayaram, Lijie Ren, Tim Zaman, Samira Khan, Yana Lunts, Dan Deutsch, Dave Uthus, Nitzan Katz, Masha Samsikova, Amr Khalifa, Nikhil Sethi, Jiao Sun, Luming Tang, Uri Alon, Xianghong Luo, Dian Yu, Abhishek Nayyar, Bryce Petrini, Will Truong, Vincent Hellendoorn, Nikolai Chinaev, Chris Alberti, Wei Wang, Jingcao Hu, Vahab Mirrokni, Ananth Balashankar, Avia Aharon, Aahil Mehta, Ahmet Iscen, Joseph Kready, Lucas Manning, Anhad Mohananey, Yuankai Chen, Anshuman Tripathi, Allen Wu, Igor Petrovski, Dawsen Hwang, Martin Baeuml, Shreyas Chandrakaladharan, Yuan Liu, Rey Coaguila, Maxwell Chen, Sally Ma, Pouya Tafti, Susheel Tatineni, Terry Spitz, Jiayu Ye, Paul Vicol, Mihaela Rosca, Adrià Puigdomènech, Zohar Yahav, Sanjay Ghemawat, Hanzhao Lin, Phoebe Kirk, Zaid Nabulsi, Sergey Brin, Bernd Bohnet, Ken Caluwaerts, Aditya Srikanth Veerubhotla, Dan Zheng, Zihang Dai, Petre Petrov, Yichong Xu, Ramin Mehran, Zhuo Xu, Luisa Zintgraf, Jiho Choi, Spurthi Amba Hombaiah, Romal Thoppilan, Sashank Reddi, Lukasz Lew, Li Li, Kellie Webster, KP Sawhney, Lampros Lamprou, Siamak Shakeri, Mayank Lunayach, Jianmin Chen, Sumit Bagri, Alex Salcianu, Ying Chen, Yani Donchev, Charlotte Magister, Signe Nørly, Vitor Rodrigues, Tomas Izo, Hila Noga, Joe Zou, Thomas Köppe, Wenxuan Zhou, Kenton Lee, Xiangzhu Long, Danielle Eisenbud, Anthony Chen, Connor Schenck, Chi Ming To, Peilin Zhong, Emanuel Taropa, Minh Truong, Omer Levy, Danilo Martins, Zhiyuan Zhang, Christopher Semturs, Kelvin Zhang, Alex Yakubovich, Pol Moreno, Lara McConnaughey, Di Lu, Sam Redmond, Lotte Weerts, Yonatan Bitton, Tiziana Refice, Nicolas Lacasse, Arthur Conmy, Corentin Tallec, Julian Odell, Hannah Forbes-Pollard, Arkadiusz Socala, Jonathan Hoech, Pushmeet Kohli, Alanna Walton, Rui Wang, Mikita Sazanovich, Kexin Zhu, Andrei Kapishnikov, Rich Galt, Matthew Denton, Ben Murdoch, Caitlin Sikora, Kareem Mohamed, Wei Wei, Uri First, Tim McConnell, Luis C. Cobo, James Qin, Thi Avrahami, Daniel Balle, Yu Watanabe, Annie Louis, Adam Kraft, Setareh Ariafar, Yiming Gu, Eugénie Rives, Charles Yoon, Andrei Rusu, James Cobon-Kerr, Chris Hahn, Jiaming Luo, Yuvein, Zhu, Niharika Ahuja, Rodrigo Benenson, Raphaël Lopez Kaufman, Honglin Yu, Lloyd Hightower, Junlin Zhang, Darren Ni, Lisa Anne Hendricks, Gabby Wang, Gal Yona, Lalit Jain, Pablo Barrio, Surya Bhupatiraju, Siva Velusamy, Allan Dafoe, Sebastian Riedel, Tara Thomas, Zhe Yuan, Mathias Bellaiche, Sheena Panthaplackel, Klemen Kloboves, Sarthak Jauhari, Canfer Akbulut, Todor Davchev, Evgeny Gladchenko, David Madras, Aleksandr Chuklin, Tyrone Hill, Quan Yuan, Mukundan Madhavan, Luke Leonhard, Dylan Scandinaro, Qihang Chen, Ning Niu, Arthur Douillard, Bogdan Damoc, Yasumasa Onoe, Fabian Pedregosa, Fred Bertsch, Chas Leichner, Joseph Pagadora, Jonathan Malmaud, Sameera Ponda, Andy Twigg, Oleksii Duzhyi, Jingwei Shen, Miaosen Wang, Roopal Garg, Jing Chen, Utku Evci, Jonathan Lee, Leon Liu, Koji Kojima, Masa Yamaguchi, Arunkumar Rajendran, AJ Piergiovanni, Vinodh Kumar Rajendran, Marco Fornoni, Gabriel Ibagon, Harry Ragan, Sadh MNM Khan, John Blitzer, Andrew Bunner, Guan Sun, Takahiro Kosakai, Scott Lundberg, Ndidi Elue, Kelvin Guu, SK Park, Jane Park, Arunachalam Narayanaswamy, Chengda Wu, Jayaram Mudigonda, Trevor Cohn, Hairong Mu, Ravi Kumar, Laura Graesser, Yichi Zhang, Richard Killam, Vincent Zhuang, Mai Giménez, Wael Al Jishi, Ruy Ley-Wild, Alex Zhai, Kazuki Osawa, Diego Cedillo, Jialu Liu, Mayank Upadhyay, Marcin Sieniek, Roshan Sharma, Tom Paine, Anelia Angelova, Sravanti Addepalli, Carolina Parada, Kingshuk Majumder, Avery Lamp, Sanjiv Kumar, Xiang Deng, Artiom Myaskovsky, Tea Sabolić, Jeffrey Dudek, Sarah York, Félix de Chaumont Quitry, Jiazhong Nie, Dee Cattle, Alok Gunjan, Bilal Piot, Waleed Khawaja, Seojin Bang, Simon Wang, Siavash Khodadadeh, Raghavender R, Praynaa Rawlani, Richard Powell, Kevin Lee, Johannes Griesser, GS Oh, Cesar Magalhaes, Yujia Li, Simon Tokumine, Hadas Natalie Vogel, Dennis Hsu, Arturo BC, Disha Jindal, Matan Cohen, Zi Yang, Junwei Yuan, Dario de Cesare, Tony Bruguier, Jun Xu, Monica Roy, Alon Jacovi, Dan Belov, Rahul Arya, Phoenix Meadowlark, Shlomi Cohen-Ganor, Wenting Ye, Patrick Morris-Suzuki, Praseem Banzal, Gan Song, Pranavaraj Ponnuramu, Fred Zhang, George Scrivener, Salah Zaiem, Alif Raditya Rochman, Kehang Han, Badih Ghazi, Kate Lee, Shahar Drath, Daniel Suo, Antonious Girgis, Pradeep Shenoy, Duy Nguyen, Douglas Eck, Somit Gupta, Le Yan, Joao 22

Carreira, Anmol Gulati, Ruoxin Sang, Daniil Mirylenka, Emma Cooney, Edward Chou, Mingyang Ling, Cindy Fan, Ben Coleman, Guilherme Tubone, Ravin Kumar, Jason Baldridge, Felix Hernandez-Campos, Angeliki Lazaridou, James Besley, Itay Yona, Neslihan Bulut, Quentin Wellens, AJ Pierigiovanni, Jasmine George, Richard Green, Pu Han, Connie Tao, Geoff Clark, Chong You, Abbas Abdolmaleki, Justin Fu, Tongzhou Chen, Ashwin Chaugule, Angad Chandorkar, Altaf Rahman, Will Thompson, Penporn Koanantakool, Mike Bernico, Jie Ren, Andrey Vlasov, Sergei Vassilvitskii, Maciej Kula, Yizhong Liang, Dahun Kim, Yangsibo Huang, Chengxi Ye, Dmitry Lepikhin, and Wesley Helmholz. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities, 2025. URL https://arxiv.org/abs/2507.06261. GitHub Advisory Database. Exploiting github runners for supply-chain injection. https://github.com/ advisories, 2026. National Vulnerability Database. Hugging face. https://nvd.nist.gov/vuln/detail/CVE-2024-3568, 2024. Yue Gao, Ilia Shumailov, and Kassem Fawaz. Supply-chain attacks in machine learning frameworks. In M. Zaharia, G. Joshi, and Y. Lin (eds.), Proceedings of Machine Learning and Systems, volume 7. MLSys, 2025. URL https://proceedings.mlsys.org/paper_files/paper/2025/file/ 75bb91b908e6924763c9f2bbe87e921e-Paper-Conference.pdf. Timnit Gebru, Jamie Morgenstern, Briana Vecchione, Jennifer Wortman Vaughan, Hanna Wallach, Hal Daumé III, and Kate Crawford. Datasheets for datasets. Commun. ACM, 64(12):86–92, November 2021. ISSN 0001-0782. doi: 10.1145/3458723. URL https://doi.org/10.1145/3458723. Runpeng Geng, Chenlong Yin, Yanting Wang, Ying Chen, and Jinyuan Jia. PIArena: A platform for prompt injection evaluation. In Maria Liakata, Viviane P. Moreira, Jiajun Zhang, and David Jurgens (eds.), Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 33170–33192, San Diego, California, United States, July 2026. Association for Computational Linguistics. ISBN 979-8-89176-390-6. doi: 10.18653/v1/2026.acl-long.1533. URL https://aclanthology. org/2026.acl-long.1533/. Betul Gokkaya, Leonardo Aniello, and Basel Halak. Software supply chain: A taxonomy of attacks, mitigations and risk assessment strategies. Journal of Information Security and Applications, 97:104324, 2026. ISSN 2214-2126. doi: https://doi.org/10.1016/j.jisa.2025.104324. URL https://www.sciencedirect. com/science/article/pii/S2214212625003606. Yash Goyal, Tejas Khot, Douglas Summers-Stay, Dhruv Batra, and Devi Parikh. Making the v in vqa matter: Elevating the role of image understanding in visual question answering. In 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 6325–6334, 2017. doi: 10.1109/CVPR.2017.670. URL https://ieeexplore.ieee.org/document/8100153. Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad AlDahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang, Archi Mitra, Archie Sravankumar, Artem Korenev, Arthur Hinsvark, Arun Rao, Aston Zhang, Aurelien Rodriguez, Austen Gregerson, Ava Spataru, Baptiste Roziere, Bethany Biron, Binh Tang, Bobbie Chern, Charlotte Caucheteux, Chaya Nayak, Chloe Bi, Chris Marra, Chris McConnell, Christian Keller, Christophe Touret, Chunyang Wu, Corinne Wong, Cristian Canton Ferrer, Cyrus Nikolaidis, Damien Allonsius, Daniel Song, Danielle Pintz, Danny Livshits, Danny Wyatt, David Esiobu, Dhruv Choudhary, Dhruv Mahajan, Diego Garcia-Olano, Diego Perino, Dieuwke Hupkes, Egor Lakomkin, Ehab AlBadawy, Elina Lobanova, Emily Dinan, Eric Michael Smith, Filip Radenovic, Francisco Guzmán, Frank Zhang, Gabriel Synnaeve, Gabrielle Lee, Georgia Lewis Anderson, Govind Thattai, Graeme Nail, Gregoire Mialon, Guan Pang, Guillem Cucurell, Hailey Nguyen, Hannah Korevaar, Hu Xu, Hugo Touvron, Iliyan Zarov, Imanol Arrieta Ibarra, Isabel Kloumann, Ishan Misra, Ivan Evtimov, Jack Zhang, Jade Copet, Jaewon Lee, Jan Geffert, Jana Vranes, Jason Park, Jay Mahadeokar, Jeet Shah, Jelmer van der Linde, Jennifer Billock, Jenny Hong, Jenya Lee, Jeremy Fu, Jianfeng Chi, Jianyu Huang, Jiawen Liu, Jie Wang, Jiecao Yu, Joanna Bitton, Joe Spisak, Jongsoo Park, Joseph Rocca, Joshua 23

Johnstun, Joshua Saxe, Junteng Jia, Kalyan Vasuden Alwala, Karthik Prasad, Kartikeya Upasani, Kate Plawiak, Ke Li, Kenneth Heafield, Kevin Stone, Khalid El-Arini, Krithika Iyer, Kshitiz Malik, Kuenley Chiu, Kunal Bhalla, Kushal Lakhotia, Lauren Rantala-Yeary, Laurens van der Maaten, Lawrence Chen, Liang Tan, Liz Jenkins, Louis Martin, Lovish Madaan, Lubo Malo, Lukas Blecher, Lukas Landzaat, Luke de Oliveira, Madeline Muzzi, Mahesh Pasupuleti, Mannat Singh, Manohar Paluri, Marcin Kardas, Maria Tsimpoukelli, Mathew Oldham, Mathieu Rita, Maya Pavlova, Melanie Kambadur, Mike Lewis, Min Si, Mitesh Kumar Singh, Mona Hassan, Naman Goyal, Narjes Torabi, Nikolay Bashlykov, Nikolay Bogoychev, Niladri Chatterji, Ning Zhang, Olivier Duchenne, Onur Çelebi, Patrick Alrassy, Pengchuan Zhang, Pengwei Li, Petar Vasic, Peter Weng, Prajjwal Bhargava, Pratik Dubal, Praveen Krishnan, Punit Singh Koura, Puxin Xu, Qing He, Qingxiao Dong, Ragavan Srinivasan, Raj Ganapathy, Ramon Calderer, Ricardo Silveira Cabral, Robert Stojnic, Roberta Raileanu, Rohan Maheswari, Rohit Girdhar, Rohit Patel, Romain Sauvestre, Ronnie Polidoro, Roshan Sumbaly, Ross Taylor, Ruan Silva, Rui Hou, Rui Wang, Saghar Hosseini, Sahana Chennabasappa, Sanjay Singh, Sean Bell, Seohyun Sonia Kim, Sergey Edunov, Shaoliang Nie, Sharan Narang, Sharath Raparthy, Sheng Shen, Shengye Wan, Shruti Bhosale, Shun Zhang, Simon Vandenhende, Soumya Batra, Spencer Whitman, Sten Sootla, Stephane Collot, Suchin Gururangan, Sydney Borodinsky, Tamar Herman, Tara Fowler, Tarek Sheasha, Thomas Georgiou, Thomas Scialom, Tobias Speckbacher, Todor Mihaylov, Tong Xiao, Ujjwal Karn, Vedanuj Goswami, Vibhor Gupta, Vignesh Ramanathan, Viktor Kerkez, Vincent Gonguet, Virginie Do, Vish Vogeti, Vítor Albiero, Vladan Petrovic, Weiwei Chu, Wenhan Xiong, Wenyin Fu, Whitney Meers, Xavier Martinet, Xiaodong Wang, Xiaofang Wang, Xiaoqing Ellen Tan, Xide Xia, Xinfeng Xie, Xuchao Jia, Xuewei Wang, Yaelle Goldschlag, Yashesh Gaur, Yasmine Babaei, Yi Wen, Yiwen Song, Yuchen Zhang, Yue Li, Yuning Mao, Zacharie Delpierre Coudert, Zheng Yan, Zhengxing Chen, Zoe Papakipos, Aaditya Singh, Aayushi Srivastava, Abha Jain, Adam Kelsey, Adam Shajnfeld, Adithya Gangidi, Adolfo Victoria, Ahuva Goldstand, Ajay Menon, Ajay Sharma, Alex Boesenberg, Alexei Baevski, Allie Feinstein, Amanda Kallet, Amit Sangani, Amos Teo, Anam Yunus, Andrei Lupu, Andres Alvarado, Andrew Caples, Andrew Gu, Andrew Ho, Andrew Poulton, Andrew Ryan, Ankit Ramchandani, Annie Dong, Annie Franco, Anuj Goyal, Aparajita Saraf, Arkabandhu Chowdhury, Ashley Gabriel, Ashwin Bharambe, Assaf Eisenman, Azadeh Yazdan, Beau James, Ben Maurer, Benjamin Leonhardi, Bernie Huang, Beth Loyd, Beto De Paola, Bhargavi Paranjape, Bing Liu, Bo Wu, Boyu Ni, Braden Hancock, Bram Wasti, Brandon Spence, Brani Stojkovic, Brian Gamido, Britt Montalvo, Carl Parker, Carly Burton, Catalina Mejia, Ce Liu, Changhan Wang, Changkyu Kim, Chao Zhou, Chester Hu, Ching-Hsiang Chu, Chris Cai, Chris Tindal, Christoph Feichtenhofer, Cynthia Gao, Damon Civin, Dana Beaty, Daniel Kreymer, Daniel Li, David Adkins, David Xu, Davide Testuggine, Delia David, Devi Parikh, Diana Liskovich, Didem Foss, Dingkang Wang, Duc Le, Dustin Holland, Edward Dowling, Eissa Jamil, Elaine Montgomery, Eleonora Presani, Emily Hahn, Emily Wood, Eric-Tuan Le, Erik Brinkman, Esteban Arcaute, Evan Dunbar, Evan Smothers, Fei Sun, Felix Kreuk, Feng Tian, Filippos Kokkinos, Firat Ozgenel, Francesco Caggioni, Frank Kanayet, Frank Seide, Gabriela Medina Florez, Gabriella Schwarz, Gada Badeer, Georgia Swee, Gil Halpern, Grant Herman, Grigory Sizov, Guangyi, Zhang, Guna Lakshminarayanan, Hakan Inan, Hamid Shojanazeri, Han Zou, Hannah Wang, Hanwen Zha, Haroun Habeeb, Harrison Rudolph, Helen Suk, Henry Aspegren, Hunter Goldman, Hongyuan Zhan, Ibrahim Damlaj, Igor Molybog, Igor Tufanov, Ilias Leontiadis, Irina-Elena Veliche, Itai Gat, Jake Weissman, James Geboski, James Kohli, Janice Lam, Japhet Asher, Jean-Baptiste Gaya, Jeff Marcus, Jeff Tang, Jennifer Chan, Jenny Zhen, Jeremy Reizenstein, Jeremy Teboul, Jessica Zhong, Jian Jin, Jingyi Yang, Joe Cummings, Jon Carvill, Jon Shepard, Jonathan McPhie, Jonathan Torres, Josh Ginsburg, Junjie Wang, Kai Wu, Kam Hou U, Karan Saxena, Kartikay Khandelwal, Katayoun Zand, Kathy Matosich, Kaushik Veeraraghavan, Kelly Michelena, Keqian Li, Kiran Jagadeesh, Kun Huang, Kunal Chawla, Kyle Huang, Lailin Chen, Lakshya Garg, Lavender A, Leandro Silva, Lee Bell, Lei Zhang, Liangpeng Guo, Licheng Yu, Liron Moshkovich, Luca Wehrstedt, Madian Khabsa, Manav Avalani, Manish Bhatt, Martynas Mankus, Matan Hasson, Matthew Lennie, Matthias Reso, Maxim Groshev, Maxim Naumov, Maya Lathi, Meghan Keneally, Miao Liu, Michael L. Seltzer, Michal Valko, Michelle Restrepo, Mihir Patel, Mik Vyatskov, Mikayel Samvelyan, Mike Clark, Mike Macey, Mike Wang, Miquel Jubert Hermoso, Mo Metanat, Mohammad Rastegari, Munish Bansal, Nandhini Santhanam, Natascha Parks, Natasha White, Navyata Bawa, Nayan Singhal, Nick Egebo, Nicolas Usunier, Nikhil Mehta, Nikolay Pavlovich Laptev, Ning Dong, Norman Cheng, Oleg Chernoguz, Olivia Hart, Omkar Salpekar, Ozlem Kalinli, Parkin Kent, Parth Parekh, Paul Saab, Pavan Balaji, Pedro Rittner, Philip Bontrager, Pierre Roux, Piotr Dollar, Polina Zvyag24

ina, Prashant Ratanchandani, Pritish Yuvraj, Qian Liang, Rachad Alao, Rachel Rodriguez, Rafi Ayub, Raghotham Murthy, Raghu Nayani, Rahul Mitra, Rangaprabhu Parthasarathy, Raymond Li, Rebekkah Hogan, Robin Battey, Rocky Wang, Russ Howes, Ruty Rinott, Sachin Mehta, Sachin Siby, Sai Jayesh Bondu, Samyak Datta, Sara Chugh, Sara Hunt, Sargun Dhillon, Sasha Sidorov, Satadru Pan, Saurabh Mahajan, Saurabh Verma, Seiji Yamamoto, Sharadh Ramaswamy, Shaun Lindsay, Shaun Lindsay, Sheng Feng, Shenghao Lin, Shengxin Cindy Zha, Shishir Patil, Shiva Shankar, Shuqiang Zhang, Shuqiang Zhang, Sinong Wang, Sneha Agarwal, Soji Sajuyigbe, Soumith Chintala, Stephanie Max, Stephen Chen, Steve Kehoe, Steve Satterfield, Sudarshan Govindaprasad, Sumit Gupta, Summer Deng, Sungmin Cho, Sunny Virk, Suraj Subramanian, Sy Choudhury, Sydney Goldman, Tal Remez, Tamar Glaser, Tamara Best, Thilo Koehler, Thomas Robinson, Tianhe Li, Tianjun Zhang, Tim Matthews, Timothy Chou, Tzook Shaked, Varun Vontimitta, Victoria Ajayi, Victoria Montanez, Vijai Mohan, Vinay Satish Kumar, Vishal Mangla, Vlad Ionescu, Vlad Poenaru, Vlad Tiberiu Mihailescu, Vladimir Ivanov, Wei Li, Wenchen Wang, Wenwen Jiang, Wes Bouaziz, Will Constable, Xiaocheng Tang, Xiaojian Wu, Xiaolan Wang, Xilun Wu, Xinbo Gao, Yaniv Kleinman, Yanjun Chen, Ye Hu, Ye Jia, Ye Qi, Yenda Li, Yilin Zhang, Ying Zhang, Yossi Adi, Youngjin Nam, Yu, Wang, Yu Zhao, Yuchen Hao, Yundi Qian, Yunlu Li, Yuzi He, Zach Rait, Zachary DeVito, Zef Rosnbrick, Zhaoduo Wen, Zhenyu Yang, Zhiwei Zhao, and Zhiyu Ma. The llama 3 herd of models, 2024. URL https://arxiv.org/abs/2407.21783. Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain, 2019. URL https://arxiv.org/abs/1708.06733. Yongjian Guo, Puzhuo Liu, Wanlun Ma, Zehang Deng, Xiaogang Zhu, Peng Di, Xi Xiao, and Sheng Wen. Mcpxkit: the unified toolkit for analyzing model context protocol security. IEEE Transactions on Dependable and Secure Computing, pp. 1–16, 2026. doi: 10.1109/TDSC.2026.3695553. URL https://ieeexplore.ieee.org/abstract/document/11531012. Rochana Prih Hastuti, Rian Adam Rajagede, Mansour Al Ghanim, Mengxin Zheng, and Qian Lou. Factuality beyond coherence: Evaluating LLM watermarking methods for medical texts. In Christos Christodoulopoulos, Tanmoy Chakraborty, Carolyn Rose, and Violet Peng (eds.), Findings of the Association for Computational Linguistics: EMNLP 2025, pp. 15129–15147, Suzhou, China, November 2025. Association for Computational Linguistics. ISBN 979-8-89176-335-7. doi: 10.18653/v1/2025.findings-emnlp. 818. URL https://aclanthology.org/2025.findings-emnlp.818/. Jorng-Tzong Horng and Jye Lu. Modularized design for wrappers/monitors in data warehouse systems. Journal of Systems and Software, 54(3):185–199, 2000. ISSN 0164-1212. doi: https://doi. org/10.1016/S0164-1212(00)00037-6. URL https://www.sciencedirect.com/science/article/pii/ S0164121200000376. Ruida Hu, Chao Peng, XinchenWang, Junjielong Xu, and Cuiyun Gao. Repo2run: Automated building executable environment for code repository at scale. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025. URL https://openreview.net/forum?id=fZsd3KLMje. Hai Huang, Zhengyu Zhao, Michael Backes, Yun Shen, and Yang Zhang. Composite backdoor attacks against large language models. In Kevin Duh, Helena Gomez, and Steven Bethard (eds.), Findings of the Association for Computational Linguistics: NAACL 2024, pp. 1459–1472, Mexico City, Mexico, June 2024. Association for Computational Linguistics. doi: 10.18653/v1/2024.findings-naacl.94. URL https: //aclanthology.org/2024.findings-naacl.94/. HuggingFace. Repositories — huggingface.co. https://huggingface.co/docs/hub/main/repositories, 2026. [Accessed 13-08-2026]. Dennis Jacob, Hend Alzahrani, Zhanhao Hu, Basel Alomair, and David Wagner. Promptshield: Deployable detection for prompt injection attacks. CODASPY ’25, pp. 341–352, New York, NY, USA, 2025. Association for Computing Machinery. ISBN 9798400714764. doi: 10.1145/3714393.3726501. URL https://doi.org/10.1145/3714393.3726501. 25

Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William El Sayed. Mistral 7b, 2023. URL https://arxiv.org/abs/2310.06825. Antigoni Kruti, Usman Butt, and Rejwan Bin Sulaiman. A review of solarwinds attack on orion platform using persistent threat agents and techniques for gaining unauthorized access, 2023. URL https://arxiv. org/abs/2308.10294. Bo Li, Hao Zhang, Kaichen Zhang, Dong Guo, Yuanhan Zhang, Renrui Zhang, Feng Li, Ziwei Liu, and Chunyuan Li. Llava-next: What else influences visual instruction tuning beyond data?, May 2024. URL https://llava-vl.github.io/blog/2024-05-25-llava-next-ablations/. Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. BLIP: Bootstrapping language-image pre-training for unified vision-language understanding and generation. In Kamalika Chaudhuri, Stefanie Jegelka, Le Song, Csaba Szepesvari, Gang Niu, and Sivan Sabato (eds.), Proceedings of the 39th International Conference on Machine Learning, volume 162 of Proceedings of Machine Learning Research, pp. 12888–12900. PMLR, 17–23 Jul 2022. URL https://proceedings.mlr.press/v162/li22n.html. Yige Li, Hanxun Huang, Yunhan Zhao, Xingjun Ma, and Jun Sun. Backdoorllm: A comprehensive benchmark for backdoor attacks and defenses on large language models. In D. Belgrave, C. Zhang, H. Lin, R. Pascanu, P. Koniusz, M. Ghassemi, and N. Chen (eds.), Advances in Neural Information Processing Systems, volume 38. Curran Associates, Inc., 2025. doi: 10.52202/085713-0771. URL https://proceedings.neurips.cc/paper_files/paper/2025/file/ 20ffc2b42c7de4a1960cfdadf305bbe2-Paper-Datasets_and_Benchmarks_Track.pdf. Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollar, and Larry Zitnick. Microsoft coco: Common objects in context. In ECCV. European Conference on Computer Vision, September 2014. URL https://www.microsoft.com/en-us/research/publication/ microsoft-coco-common-objects-in-context/. Qian Lou, Xin Liang, Jiaqi Xue, Yancheng Zhang, Rui Xie, and Mengxin Zheng. CR-UTP: Certified robustness against universal text perturbations on large language models. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar (eds.), Findings of the Association for Computational Linguistics: ACL 2024, pp. 9863–9875, Bangkok, Thailand, August 2024. Association for Computational Linguistics. doi: 10.18653/ v1/2024.findings-acl.588. URL https://aclanthology.org/2024.findings-acl.588/. Xupeng Miao, Gabriele Oliaro, Zhihao Zhang, Xinhao Cheng, Zeyu Wang, Zhengxin Zhang, Rae Ying Yee Wong, Alan Zhu, Lijie Yang, Xiaoxiang Shi, Chunan Shi, Zhuoming Chen, Daiyaan Arfeen, Reyna Abhyankar, and Zhihao Jia. Specinfer: Accelerating large language model serving with tree-based speculative inference and verification. In Proceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 3, ASPLOS ’24, pp. 932–949. ACM, April 2024. doi: 10.1145/3620666.3651335. URL http://dx.doi.org/10.1145/3620666.3651335. Margaret Mitchell, Simone Wu, Andrew Zaldivar, Parker Barnes, Lucy Vasserman, Ben Hutchinson, Elena Spitzer, Inioluwa Deborah Raji, and Timnit Gebru. Model cards for model reporting. In Proceedings of the Conference on Fairness, Accountability, and Transparency, FAT* ’19, pp. 220–229, New York, NY, USA, 2019. Association for Computing Machinery. ISBN 9781450361255. doi: 10.1145/3287560.3287596. URL https://doi.org/10.1145/3287560.3287596. Kanghua Mo, Li Hu, Yucheng Long, and Zhihao Li. Attractive metadata attack: Inducing llm agents to invoke malicious tools. In D. Belgrave, C. Zhang, H. Lin, R. Pascanu, P. Koniusz, M. Ghassemi, and N. Chen (eds.), Advances in Neural Information Processing Systems, volume 38, pp. 162770–162793. Curran Associates, Inc., 2025. doi: 10.52202/085713-5434. URL https://proceedings.neurips.cc/ paper_files/paper/2025/file/ee46288ab2aaf5c6e53aebebe719712c-Paper-Conference.pdf. 26

Raja Muthalagu, Jasmita Malik, and Pranav M. Pawar. Detection and prevention of evasion attacks on machine learning models. Expert Systems with Applications, 266:126044, 2025. ISSN 0957-4174. doi: https: //doi.org/10.1016/j.eswa.2024.126044. URL https://www.sciencedirect.com/science/article/pii/ S0957417424029117. Marc Ohm, Henrik Plate, Arnold Sykosch, and Michael Meier. Backstabber’s knife collection: A review of open source software supply chain attacks. Detection of Intrusions and Malware, and Vulnerability Assessment: 17th International Conference, DIMVA 2020, Lisbon, Portugal, June 24–26, 2020, Proceedings, 12223:23–43, 2020. doi: 10.1007/978-3-030-52683-2_2. URL https://pmc.ncbi.nlm.nih.gov/ articles/PMC7338168/. OpenAI, :, Aaron Hurst, Adam Lerer, Adam P. Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, Aleksander Mądry, Alex Baker-Whitcomb, Alex Beutel, Alex Borzunov, Alex Carney, Alex Chow, Alex Kirillov, Alex Nichol, Alex Paino, Alex Renzin, Alex Tachard Passos, Alexander Kirillov, Alexi Christakis, Alexis Conneau, Ali Kamali, Allan Jabri, Allison Moyer, Allison Tam, Amadou Crookes, Amin Tootoochian, Amin Tootoonchian, Ananya Kumar, Andrea Vallone, Andrej Karpathy, Andrew Braunstein, Andrew Cann, Andrew Codispoti, Andrew Galu, Andrew Kondrich, Andrew Tulloch, Andrey Mishchenko, Angela Baek, Angela Jiang, Antoine Pelisse, Antonia Woodford, Anuj Gosalia, Arka Dhar, Ashley Pantuliano, Avi Nayak, Avital Oliver, Barret Zoph, Behrooz Ghorbani, Ben Leimberger, Ben Rossen, Ben Sokolowsky, Ben Wang, Benjamin Zweig, Beth Hoover, Blake Samic, Bob McGrew, Bobby Spero, Bogo Giertler, Bowen Cheng, Brad Lightcap, Brandon Walkin, Brendan Quinn, Brian Guarraci, Brian Hsu, Bright Kellogg, Brydon Eastman, Camillo Lugaresi, Carroll Wainwright, Cary Bassin, Cary Hudson, Casey Chu, Chad Nelson, Chak Li, Chan Jun Shern, Channing Conger, Charlotte Barette, Chelsea Voss, Chen Ding, Cheng Lu, Chong Zhang, Chris Beaumont, Chris Hallacy, Chris Koch, Christian Gibson, Christina Kim, Christine Choi, Christine McLeavey, Christopher Hesse, Claudia Fischer, Clemens Winter, Coley Czarnecki, Colin Jarvis, Colin Wei, Constantin Koumouzelis, Dane Sherburn, Daniel Kappler, Daniel Levin, Daniel Levy, David Carr, David Farhi, David Mely, David Robinson, David Sasaki, Denny Jin, Dev Valladares, Dimitris Tsipras, Doug Li, Duc Phong Nguyen, Duncan Findlay, Edede Oiwoh, Edmund Wong, Ehsan Asdar, Elizabeth Proehl, Elizabeth Yang, Eric Antonow, Eric Kramer, Eric Peterson, Eric Sigler, Eric Wallace, Eugene Brevdo, Evan Mays, Farzad Khorasani, Felipe Petroski Such, Filippo Raso, Francis Zhang, Fred von Lohmann, Freddie Sulit, Gabriel Goh, Gene Oden, Geoff Salmon, Giulio Starace, Greg Brockman, Hadi Salman, Haiming Bao, Haitang Hu, Hannah Wong, Haoyu Wang, Heather Schmidt, Heather Whitney, Heewoo Jun, Hendrik Kirchner, Henrique Ponde de Oliveira Pinto, Hongyu Ren, Huiwen Chang, Hyung Won Chung, Ian Kivlichan, Ian O’Connell, Ian O’Connell, Ian Osband, Ian Silber, Ian Sohl, Ibrahim Okuyucu, Ikai Lan, Ilya Kostrikov, Ilya Sutskever, Ingmar Kanitscheider, Ishaan Gulrajani, Jacob Coxon, Jacob Menick, Jakub Pachocki, James Aung, James Betker, James Crooks, James Lennon, Jamie Kiros, Jan Leike, Jane Park, Jason Kwon, Jason Phang, Jason Teplitz, Jason Wei, Jason Wolfe, Jay Chen, Jeff Harris, Jenia Varavva, Jessica Gan Lee, Jessica Shieh, Ji Lin, Jiahui Yu, Jiayi Weng, Jie Tang, Jieqi Yu, Joanne Jang, Joaquin Quinonero Candela, Joe Beutler, Joe Landers, Joel Parish, Johannes Heidecke, John Schulman, Jonathan Lachman, Jonathan McKay, Jonathan Uesato, Jonathan Ward, Jong Wook Kim, Joost Huizinga, Jordan Sitkin, Jos Kraaijeveld, Josh Gross, Josh Kaplan, Josh Snyder, Joshua Achiam, Joy Jiao, Joyce Lee, Juntang Zhuang, Justyn Harriman, Kai Fricke, Kai Hayashi, Karan Singhal, Katy Shi, Kavin Karthik, Kayla Wood, Kendra Rimbach, Kenny Hsu, Kenny Nguyen, Keren Gu-Lemberg, Kevin Button, Kevin Liu, Kiel Howe, Krithika Muthukumar, Kyle Luther, Lama Ahmad, Larry Kai, Lauren Itow, Lauren Workman, Leher Pathak, Leo Chen, Li Jing, Lia Guy, Liam Fedus, Liang Zhou, Lien Mamitsuka, Lilian Weng, Lindsay McCallum, Lindsey Held, Long Ouyang, Louis Feuvrier, Lu Zhang, Lukas Kondraciuk, Lukasz Kaiser, Luke Hewitt, Luke Metz, Lyric Doshi, Mada Aflak, Maddie Simens, Madelaine Boyd, Madeleine Thompson, Marat Dukhan, Mark Chen, Mark Gray, Mark Hudnall, Marvin Zhang, Marwan Aljubeh, Mateusz Litwin, Matthew Zeng, Max Johnson, Maya Shetty, Mayank Gupta, Meghan Shah, Mehmet Yatbaz, Meng Jia Yang, Mengchao Zhong, Mia Glaese, Mianna Chen, Michael Janner, Michael Lampe, Michael Petrov, Michael Wu, Michele Wang, Michelle Fradin, Michelle Pokrass, Miguel Castro, Miguel Oom Temudo de Castro, Mikhail Pavlov, Miles Brundage, Miles Wang, Minal Khan, Mira Murati, Mo Bavarian, Molly Lin, Murat Yesildal, Nacho Soto, Natalia Gimelshein, Natalie Cone, Natalie Staudacher, Natalie Summers, Natan LaFontaine, Neil Chowdhury, Nick Ryder, Nick Stathas, Nick Turley, 27

Nik Tezak, Niko Felix, Nithanth Kudige, Nitish Keskar, Noah Deutsch, Noel Bundick, Nora Puckett, Ofir Nachum, Ola Okelola, Oleg Boiko, Oleg Murk, Oliver Jaffe, Olivia Watkins, Olivier Godement, Owen Campbell-Moore, Patrick Chao, Paul McMillan, Pavel Belov, Peng Su, Peter Bak, Peter Bakkum, Peter Deng, Peter Dolan, Peter Hoeschele, Peter Welinder, Phil Tillet, Philip Pronin, Philippe Tillet, Prafulla Dhariwal, Qiming Yuan, Rachel Dias, Rachel Lim, Rahul Arora, Rajan Troll, Randall Lin, Rapha Gontijo Lopes, Raul Puri, Reah Miyara, Reimar Leike, Renaud Gaubert, Reza Zamani, Ricky Wang, Rob Donnelly, Rob Honsby, Rocky Smith, Rohan Sahai, Rohit Ramchandani, Romain Huet, Rory Carmichael, Rowan Zellers, Roy Chen, Ruby Chen, Ruslan Nigmatullin, Ryan Cheu, Saachi Jain, Sam Altman, Sam Schoenholz, Sam Toizer, Samuel Miserendino, Sandhini Agarwal, Sara Culver, Scott Ethersmith, Scott Gray, Sean Grove, Sean Metzger, Shamez Hermani, Shantanu Jain, Shengjia Zhao, Sherwin Wu, Shino Jomoto, Shirong Wu, Shuaiqi, Xia, Sonia Phene, Spencer Papay, Srinivas Narayanan, Steve Coffey, Steve Lee, Stewart Hall, Suchir Balaji, Tal Broda, Tal Stramer, Tao Xu, Tarun Gogineni, Taya Christianson, Ted Sanders, Tejal Patwardhan, Thomas Cunninghman, Thomas Degry, Thomas Dimson, Thomas Raoux, Thomas Shadwell, Tianhao Zheng, Todd Underwood, Todor Markov, Toki Sherbakov, Tom Rubin, Tom Stasi, Tomer Kaftan, Tristan Heywood, Troy Peterson, Tyce Walters, Tyna Eloundou, Valerie Qi, Veit Moeller, Vinnie Monaco, Vishal Kuo, Vlad Fomenko, Wayne Chang, Weiyi Zheng, Wenda Zhou, Wesam Manassra, Will Sheu, Wojciech Zaremba, Yash Patil, Yilei Qian, Yongjik Kim, Youlong Cheng, Yu Zhang, Yuchen He, Yuchen Zhang, Yujia Jin, Yunxing Dai, and Yury Malkov. Gpt-4o system card, 2024. URL https://arxiv.org/abs/2410.21276. Cailean Osborne, Jennifer Ding, and Hannah Rose Kirk. The ai community building the future? a quantitative analysis of development activity on hugging face hub. Journal of Computational Social Science, 7(2):2067–2105, Oct 2024. ISSN 2432-2725. doi: 10.1007/s42001-024-00300-8. URL https://doi.org/10.1007/s42001-024-00300-8. Raj Patel, Himanshu Tripathi, Jasper Stone, Noorbakhsh Amiri Golilarz, Sudip Mittal, Shahram Rahimi, and Vini Chaudhary. Towards secure mlops: Surveying attacks, mitigation strategies, and research challenges. ACM Trans. AI Secur. Priv., March 2026. doi: 10.1145/3796728. URL https://dl.acm.org/doi/abs/ 10.1145/3796728. Just Accepted. Sotiris Pelekis, Thanos Koutroubas, Afroditi Blika, Anastasis Berdelis, Evangelos Karakolis, Christos Ntanos, Evangelos Spiliotis, and Dimitris Askounis. Adversarial machine learning: a review of methods, tools, and critical industry sectors. Artificial Intelligence Review, 58(8):226, May 2025. ISSN 1573-7462. doi: 10.1007/s10462-025-11147-4. URL https://doi.org/10.1007/s10462-025-11147-4. PromptScript. Client Challenge — pypi.org. https://pypi.org/project/promptscript-python/, 2025. [Accessed 13-08-2026]. Piotr Przymus and Thomas Durieux. Wolves in the repository: A software engineering analysis of the xz utils supply chain attack, 2025. URL https://arxiv.org/abs/2504.17473. PyTorch Foundation. Pytorch dependency compromise incident report. compromised-nightly-dependency/, 2022.

https://pytorch.org/blog/

Qwen Team. Qwen3 technical report, 2025. URL https://arxiv.org/abs/2505.09388. Qwen Team. Qwen3.5: Towards native multimodal agents, February 2026. URL https://qwen.ai/blog? id=qwen3.5. Luca M. Schulze Buschoff, Elif Akata, Matthias Bethge, and Eric Schulz. Visual cognition in multimodal large language models. Nature Machine Intelligence, 7(1):96–106, Jan 2025. ISSN 2522-5839. doi: 10. 1038/s42256-024-00963-y. URL https://doi.org/10.1038/s42256-024-00963-y. Weijia Shi, Xiaochuang Han, Chunting Zhou, Weixin Liang, Xi Victoria Lin, Luke Zettlemoyer, and Lili Yu. Lmfusion: Adapting pretrained language models for multimodal generation, 2025. URL https: //arxiv.org/abs/2412.15188. 28

Aaditya Singh, Adam Fry, Adam Perelman, Adam Tart, Adi Ganesh, Ahmed El-Kishky, Aidan McLaughlin, Aiden Low, AJ Ostrow, Akhila Ananthram, Akshay Nathan, Alan Luo, Alec Helyar, Aleksander Madry, Aleksandr Efremov, Aleksandra Spyra, Alex Baker-Whitcomb, Alex Beutel, Alex Karpenko, Alex Makelov, Alex Neitz, Alex Wei, Alexandra Barr, Alexandre Kirchmeyer, Alexey Ivanov, Alexi Christakis, Alistair Gillespie, Allison Tam, Ally Bennett, Alvin Wan, Alyssa Huang, Amy McDonald Sandjideh, Amy Yang, Ananya Kumar, Andre Saraiva, Andrea Vallone, Andrei Gheorghe, Andres Garcia Garcia, Andrew Braunstein, Andrew Liu, Andrew Schmidt, Andrey Mereskin, Andrey Mishchenko, Andy Applebaum, Andy Rogerson, Ann Rajan, Annie Wei, Anoop Kotha, Anubha Srivastava, Anushree Agrawal, Arun Vijayvergiya, Ashley Tyra, Ashvin Nair, Avi Nayak, Ben Eggers, Bessie Ji, Beth Hoover, Bill Chen, Blair Chen, Boaz Barak, Borys Minaiev, Botao Hao, Bowen Baker, Brad Lightcap, Brandon McKinzie, Brandon Wang, Brendan Quinn, Brian Fioca, Brian Hsu, Brian Yang, Brian Yu, Brian Zhang, Brittany Brenner, Callie Riggins Zetino, Cameron Raymond, Camillo Lugaresi, Carolina Paz, Cary Hudson, Cedric Whitney, Chak Li, Charles Chen, Charlotte Cole, Chelsea Voss, Chen Ding, Chen Shen, Chengdu Huang, Chris Colby, Chris Hallacy, Chris Koch, Chris Lu, Christina Kaplan, Christina Kim, CJ Minott-Henriques, Cliff Frey, Cody Yu, Coley Czarnecki, Colin Reid, Colin Wei, Cory Decareaux, Cristina Scheau, Cyril Zhang, Cyrus Forbes, Da Tang, Dakota Goldberg, Dan Roberts, Dana Palmie, Daniel Kappler, Daniel Levine, Daniel Wright, Dave Leo, David Lin, David Robinson, Declan Grabb, Derek Chen, Derek Lim, Derek Salama, Dibya Bhattacharjee, Dimitris Tsipras, Dinghua Li, Dingli Yu, DJ Strouse, Drew Williams, Dylan Hunn, Ed Bayes, Edwin Arbus, Ekin Akyurek, Elaine Ya Le, Elana Widmann, Eli Yani, Elizabeth Proehl, Enis Sert, Enoch Cheung, Eri Schwartz, Eric Han, Eric Jiang, Eric Mitchell, Eric Sigler, Eric Wallace, Erik Ritter, Erin Kavanaugh, Evan Mays, Evgenii Nikishin, Fangyuan Li, Felipe Petroski Such, Filipe de Avila Belbute Peres, Filippo Raso, Florent Bekerman, Foivos Tsimpourlas, Fotis Chantzis, Francis Song, Francis Zhang, Gaby Raila, Garrett McGrath, Gary Briggs, Gary Yang, Giambattista Parascandolo, Gildas Chabot, Grace Kim, Grace Zhao, Gregory Valiant, Guillaume Leclerc, Hadi Salman, Hanson Wang, Hao Sheng, Haoming Jiang, Haoyu Wang, Haozhun Jin, Harshit Sikchi, Heather Schmidt, Henry Aspegren, Honglin Chen, Huida Qiu, Hunter Lightman, Ian Covert, Ian Kivlichan, Ian Silber, Ian Sohl, Ibrahim Hammoud, Ignasi Clavera, Ikai Lan, Ilge Akkaya, Ilya Kostrikov, Irina Kofman, Isak Etinger, Ishaan Singal, Jackie Hehir, Jacob Huh, Jacqueline Pan, Jake Wilczynski, Jakub Pachocki, James Lee, James Quinn, Jamie Kiros, Janvi Kalra, Jasmyn Samaroo, Jason Wang, Jason Wolfe, Jay Chen, Jay Wang, Jean Harb, Jeffrey Han, Jeffrey Wang, Jennifer Zhao, Jeremy Chen, Jerene Yang, Jerry Tworek, Jesse Chand, Jessica Landon, Jessica Liang, Ji Lin, Jiancheng Liu, Jianfeng Wang, Jie Tang, Jihan Yin, Joanne Jang, Joel Morris, Joey Flynn, Johannes Ferstad, Johannes Heidecke, John Fishbein, John Hallman, Jonah Grant, Jonathan Chien, Jonathan Gordon, Jongsoo Park, Jordan Liss, Jos Kraaijeveld, Joseph Guay, Joseph Mo, Josh Lawson, Josh McGrath, Joshua Vendrow, Joy Jiao, Julian Lee, Julie Steele, Julie Wang, Junhua Mao, Kai Chen, Kai Hayashi, Kai Xiao, Kamyar Salahi, Kan Wu, Karan Sekhri, Karan Sharma, Karan Singhal, Karen Li, Kenny Nguyen, Keren Gu-Lemberg, Kevin King, Kevin Liu, Kevin Stone, Kevin Yu, Kristen Ying, Kristian Georgiev, Kristie Lim, Kushal Tirumala, Kyle Miller, Lama Ahmad, Larry Lv, Laura Clare, Laurance Fauconnet, Lauren Itow, Lauren Yang, Laurentia Romaniuk, Leah Anise, Lee Byron, Leher Pathak, Leon Maksin, Leyan Lo, Leyton Ho, Li Jing, Liang Wu, Liang Xiong, Lien Mamitsuka, Lin Yang, Lindsay McCallum, Lindsey Held, Liz Bourgeois, Logan Engstrom, Lorenz Kuhn, Louis Feuvrier, Lu Zhang, Lucas Switzer, Lukas Kondraciuk, Lukasz Kaiser, Manas Joglekar, Mandeep Singh, Mandip Shah, Manuka Stratta, Marcus Williams, Mark Chen, Mark Sun, Marselus Cayton, Martin Li, Marvin Zhang, Marwan Aljubeh, Matt Nichols, Matthew Haines, Max Schwarzer, Mayank Gupta, Meghan Shah, Melody Y. Guan, Melody Huang, Meng Dong, Mengqing Wang, Mia Glaese, Micah Carroll, Michael Lampe, Michael Malek, Michael Sharman, Michael Zhang, Michele Wang, Michelle Pokrass, Mihai Florian, Mikhail Pavlov, Miles Wang, Ming Chen, Mingxuan Wang, Minnia Feng, Mo Bavarian, Molly Lin, Moose Abdool, Mostafa Rohaninejad, Nacho Soto, Natalie Staudacher, Natan LaFontaine, Nathan Marwell, Nelson Liu, Nick Preston, Nick Turley, Nicklas Ansman, Nicole Blades, Nikil Pancha, Nikita Mikhaylin, Niko Felix, Nikunj Handa, Nishant Rai, Nitish Keskar, Noam Brown, Ofir Nachum, Oleg Boiko, Oleg Murk, Olivia Watkins, Oona Gleeson, Pamela Mishkin, Patryk Lesiewicz, Paul Baltescu, Pavel Belov, Peter Zhokhov, Philip Pronin, Phillip Guo, Phoebe Thacker, Qi Liu, Qiming Yuan, Qinghua Liu, Rachel Dias, Rachel Puckett, Rahul Arora, Ravi Teja Mullapudi, Raz Gaon, Reah Miyara, Rennie Song, Rishabh Aggarwal, RJ Marsan, Robel Yemiru, Robert Xiong, Rohan Kshirsagar, Rohan Nuttall, Roman Tsiupa, Ronen Eldan, Rose Wang, Roshan James, Roy Ziv, Rui Shu, Ruslan Nigmatullin, Saachi Jain, 29

Saam Talaie, Sam Altman, Sam Arnesen, Sam Toizer, Sam Toyer, Samuel Miserendino, Sandhini Agarwal, Sarah Yoo, Savannah Heon, Scott Ethersmith, Sean Grove, Sean Taylor, Sebastien Bubeck, Sever Banesiu, Shaokyi Amdo, Shengjia Zhao, Sherwin Wu, Shibani Santurkar, Shiyu Zhao, Shraman Ray Chaudhuri, Shreyas Krishnaswamy, Shuaiqi, Xia, Shuyang Cheng, Shyamal Anadkat, Simón Posada Fishman, Simon Tobin, Siyuan Fu, Somay Jain, Song Mei, Sonya Egoian, Spencer Kim, Spug Golden, SQ Mah, Steph Lin, Stephen Imm, Steve Sharpe, Steve Yadlowsky, Sulman Choudhry, Sungwon Eum, Suvansh Sanjeev, Tabarak Khan, Tal Stramer, Tao Wang, Tao Xin, Tarun Gogineni, Taya Christianson, Ted Sanders, Tejal Patwardhan, Thomas Degry, Thomas Shadwell, Tianfu Fu, Tianshi Gao, Timur Garipov, Tina Sriskandarajah, Toki Sherbakov, Tomek Korbak, Tomer Kaftan, Tomo Hiratsuka, Tongzhou Wang, Tony Song, Tony Zhao, Troy Peterson, Val Kharitonov, Victoria Chernova, Vineet Kosaraju, Vishal Kuo, Vitchyr Pong, Vivek Verma, Vlad Petrov, Wanning Jiang, Weixing Zhang, Wenda Zhou, Wenlei Xie, Wenting Zhan, Wes McCabe, Will DePue, Will Ellsworth, Wulfie Bain, Wyatt Thompson, Xiangning Chen, Xiangyu Qi, Xin Xiang, Xinwei Shi, Yann Dubois, Yaodong Yu, Yara Khakbaz, Yifan Wu, Yilei Qian, Yin Tat Lee, Yinbo Chen, Yizhen Zhang, Yizhong Xiong, Yonglong Tian, Young Cha, Yu Bai, Yu Yang, Yuan Yuan, Yuanzhi Li, Yufeng Zhang, Yuguang Yang, Yujia Jin, Yun Jiang, Yunyun Wang, Yushi Wang, Yutian Liu, Zach Stubenvoll, Zehao Dou, Zheng Wu, and Zhigang Wang. Openai gpt-5 system card, 2026. URL https://arxiv.org/abs/2601.03267. Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D. Manning, Andrew Ng, and Christopher Potts. Recursive deep models for semantic compositionality over a sentiment treebank. In David Yarowsky, Timothy Baldwin, Anna Korhonen, Karen Livescu, and Steven Bethard (eds.), Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, pp. 1631– 1642, Seattle, Washington, USA, October 2013. Association for Computational Linguistics. URL https://aclanthology.org/D13-1170/. Yiheng Su, Junyi Jessy Li, and Matthew Lease. Wrapper boxes for faithful attribution of model predictions to training data. In Yonatan Belinkov, Najoung Kim, Jaap Jumelet, Hosein Mohebbi, Aaron Mueller, and Hanjie Chen (eds.), Proceedings of the 7th BlackboxNLP Workshop: Analyzing and Interpreting Neural Networks for NLP, pp. 551–576, Miami, Florida, US, November 2024. Association for Computational Linguistics. doi: 10.18653/v1/2024.blackboxnlp-1.33. URL https://aclanthology.org/ 2024.blackboxnlp-1.33/. Vijay Viswanathan, Chenyang Zhao, Amanda Bertsch, Tongshuang Wu, and Graham Neubig. Prompt2Model: Generating deployable models from natural language instructions. In Yansong Feng and Els Lefever (eds.), Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pp. 413–421, Singapore, December 2023. Association for Computational Linguistics. doi: 10.18653/v1/2023.emnlp-demo.38. URL https://aclanthology.org/2023. emnlp-demo.38/. Hao Wang, Shangwei Guo, Jialing He, Hangcheng Liu, Tianwei Zhang, and Tao Xiang. Model supply chain poisoning: Backdooring pre-trained models via embedding indistinguishability. In Proceedings of the ACM on Web Conference 2025, WWW ’25, pp. 840–851. ACM, April 2025. doi: 10.1145/3696410.3714624. URL http://dx.doi.org/10.1145/3696410.3714624. Peng Wang, Shuai Bai, Sinan Tan, Shijie Wang, Zhihao Fan, Jinze Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Yang Fan, Kai Dang, Mengfei Du, Xuancheng Ren, Rui Men, Dayiheng Liu, Chang Zhou, Jingren Zhou, and Junyang Lin. Qwen2-vl: Enhancing vision-language model’s perception of the world at any resolution, 2024. URL https://arxiv.org/abs/2409.12191. Jiaqi Xue, Mengxin Zheng, Ting Hua, Yilin Shen, Yepeng Liu, Ladislau Bölöni, and Qian Lou. Trojllm: A black-box trojan prompt attack on large language models. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine (eds.), Advances in Neural Information Processing Systems, volume 36, pp. 65665–65677. Curran Associates, Inc., 2023. doi: 10.52202/075280-2866. URL https://proceedings.neurips.cc/paper_files/paper/2023/file/ cf04d01a0e76f8b13095349d9caca033-Paper-Conference.pdf. 30

Jiaqi Xue, Qian Lou, and Mengxin Zheng. BadFair: Backdoored fairness attacks with group-conditioned triggers. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen (eds.), Findings of the Association for Computational Linguistics: EMNLP 2024, pp. 8257–8270, Miami, Florida, USA, November 2024. Association for Computational Linguistics. doi: 10.18653/v1/2024.findings-emnlp.484. URL https:// aclanthology.org/2024.findings-emnlp.484/. An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, Guanting Dong, Haoran Wei, Huan Lin, Jialong Tang, Jialin Wang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Ma, Jianxin Yang, Jin Xu, Jingren Zhou, Jinze Bai, Jinzheng He, Junyang Lin, Kai Dang, Keming Lu, Keqin Chen, Kexin Yang, Mei Li, Mingfeng Xue, Na Ni, Pei Zhang, Peng Wang, Ru Peng, Rui Men, Ruize Gao, Runji Lin, Shijie Wang, Shuai Bai, Sinan Tan, Tianhang Zhu, Tianhao Li, Tianyu Liu, Wenbin Ge, Xiaodong Deng, Xiaohuan Zhou, Xingzhang Ren, Xinyu Zhang, Xipin Wei, Xuancheng Ren, Xuejing Liu, Yang Fan, Yang Yao, Yichang Zhang, Yu Wan, Yunfei Chu, Yuqiong Liu, Zeyu Cui, Zhenru Zhang, Zhifang Guo, and Zhihao Fan. Qwen2 technical report, 2024. URL https://arxiv.org/abs/2407.10671. Rowan Zellers, Ari Holtzman, Yonatan Bisk, Ali Farhadi, and Yejin Choi. HellaSwag: Can a machine really finish your sentence? In Anna Korhonen, David Traum, and Lluís Màrquez (eds.), Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pp. 4791–4800, Florence, Italy, July 2019. Association for Computational Linguistics. doi: 10.18653/v1/P19-1472. URL https: //aclanthology.org/P19-1472/. Xiang Zhang, Junbo Zhao, and Yann LeCun. Character-level convolutional networks for text classification. In C. Cortes, N. Lawrence, D. Lee, M. Sugiyama, and R. Garnett (eds.), Advances in Neural Information Processing Systems, volume 28. Curran Associates, Inc., 2015. URL https://proceedings.neurips.cc/ paper_files/paper/2015/file/250cf8b51c773f3f8dc8b4be867a9a02-Paper.pdf. Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang, Zican Dong, Yupeng Hou, Beichen Zhang, Yingqian Min, Junjie Zhang, Peiyu Liu, Xiaolei Wang, Yifan Du, Chen Yang, Yushuo Chen, Zhipeng Chen, Jinhao Jiang, Ruiyang Ren, Yifan Li, Xinyu Tang, Zikang Liu, Yiwen Hu, Jian-Yun Nie, and Ji-Rong Wen. A survey of large language models. Frontiers of Computer Science, 20(12):2012627, May 2026. ISSN 2095-2236. doi: 10.1007/s11704-026-60308-3. URL https://doi.org/10.1007/s11704-026-60308-3. Mengxin Zheng, Qian Lou, and Lei Jiang. Trojvit: Trojan insertion in vision transformers. In 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 4025–4034, 2023a. doi: 10.1109/CVPR52729.2023.00392. Mengxin Zheng, Jiaqi Xue, Xun Chen, Yanshan Wang, Qian Lou, and Lei Jiang. TrojFSP: Trojan insertion in few-shot prompt tuning. In Kevin Duh, Helena Gomez, and Steven Bethard (eds.), Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pp. 1141–1151, Mexico City, Mexico, June 2024a. Association for Computational Linguistics. doi: 10.18653/v1/2024.naacl-long.64. URL https: //aclanthology.org/2024.naacl-long.64/. Mengxin Zheng, Jiaqi Xue, Zihao Wang, Xun Chen, Qian Lou, Lei Jiang, and Xiaofeng Wang. Ssl-cleanse: Trojan detection and mitigation in self-supervised learning, 2024b. URL https://arxiv.org/abs/2303. 09079. Tianhang Zheng, Hao Lan, and Baochun Li. Be careful with pypi packages: You may unconsciously spread backdoor model weights. In D. Song, M. Carbin, and T. Chen (eds.), Proceedings of Machine Learning and Systems, volume 5, pp. 145–163. Curan, 2023b. URL https://proceedings.mlsys.org/paper_files/ paper/2023/file/3ca528e932d48832288cd329ccfdd420-Paper-mlsys2023.pdf.

A

Use of Generative AI

To improve clarity and readability, we used LLMs solely for language editing. Their use was limited to proofreading, grammatical correction, and minor stylistic refinement, comparable to conventional grammar 31

checkers or dictionaries. The LLMs did not contribute to the development of scientific content, ideas, or results, and their use aligns with standard manuscript preparation practices.

B

Distribution and Adoption

Wrapper-metadata pairs travel along the same, high velocity channels used to share models and examples (model hubs, community repos, package registries, enterprise feeds, and bundled release archives). Downstream adoption is driven by low-friction behaviors: copy-paste of examples, forking with light edits, importing utility packages that ship default wrappers, and internal promotion inside organizations; loader-driven auto-apply of bundled templates further reduces the effort required for an attacker to activate a payload. In our experiment, we utilized Hugging Face Spaces and GitHub for hosting and distribution of the demo application and deployment artifacts. While private companies typically provide applications with security signatures to verify their authenticity, such security measures are not uniformly enforced in these open hosting platforms, which prioritize the reproduction and easy-sharing features of the applications. We do not assume that attackers can arbitrarily compromise protected infrastructure. Instead, we study the impact of a realistic and well-documented supply-chain foothold, such as publishing a modified example repository, demo application, or wrapper utility that is subsequently adopted by downstream developers through normal reuse workflows. Reuse pathway. The attacker does not need to compromise protected infrastructure or convince users to prefer an unknown service over a popular serving framework. A realistic foothold is a reusable demo repository, Hugging Face Space, Gradio application, inference notebook, wrapper package, or configuration bundle that downstream developers copy, fork, or adapt. In such workflows, the model weights may be trusted or served by standard infrastructure, while the surrounding wrapper and metadata files are inherited from example code. This creates a gap between model-level trust and application-layer behavior. Deployment layer versus serving backend. Our threat model does not require victims to abandon standard serving backends such as vLLM or SGLang. These systems primarily provide efficient model serving, batching, and inference execution. In deployed applications, however, the serving backend is usually surrounded by application-specific wrapper logic for prompt construction, output formatting, routing hints, safety notices, citations, disclaimers, and post-processing. The attack surface studied here is this surrounding template layer, not the model-serving engine itself. Thus, even when inference is performed by a trusted serving backend, mutable wrapper and metadata artifacts may still influence the final user-visible behavior.

C

Conjunctive-Gate Wrapper & Wrapper Canonicalization N(W)

Algorithm 1 Conjunctive-Gate Wrapper (Unified for Generation & Classification) Require: Base model fθ ; metadata M with marker, wrapper lock; gate conditions C1 , C2 . [See Figure 3] Input : Prompt/request x; clean system prompt Sclean ; task type τ ∈ {Gen, Cls}. Output : Final response yfinal . 1. Query model (clean). yraw ← fθ (x | Sclean ). 2. Evaluate gate predicates. b1 ← MarkerOK(W, M, k), b2 ← LockOK(M ). 3. Conjunction. g ← (b1 ∧ b2 ). 4. Branch by gate & task. if g = TRUE then if τ = Gen then yfinal ← Prepend(“Banner”, yraw ) else if τ = Cls then yfinal ← Concat(“Maybe”, yraw ) else yfinal ← yraw (unchanged) 5. Return yfinal . The visible banner is intentionally benign and obvious so that the proof-of-concept remains auditable and ethically safe; it is used as a proxy for wrapper-level control rather than as the strongest possible payload. 32

Canonicalization Procedure. Algorithm 2 specifies the canonicalization function N (W ) used in all experiments. The design intentionally distinguishes between presentation-only edits, which are tolerated, and semantic edits, which invalidate the wrapper-lock hash and cause a fail-closed outcome. Algorithm 2 Wrapper Canonicalization N (W ) Input: Wrapper text W Output: Canonical wrapper W ∗ 1. Normalize line endings (CRLF → LF) 2. Remove comments (language-specific) 3. Trim leading and trailing whitespace per line 4. Collapse consecutive whitespace into a single space 5. Preserve token order and control flow return W ∗ Edits that preserve W ∗ (e.g., whitespace changes or comment edits) are treated as semantic-preserving and tolerated. Edits that alter tokens, line ordering, marker placement, or control flow modify W ∗ and intentionally cause the wrapper-lock check to fail.

D

Activation Cases Example

The following examples illustrate the four activation cases shown in Figure 4. Each case shows (i) a wrapper snippet, (ii) the metadata (if any), and (iii) the expected runtime outcome. (a) Clean metadata + clean wrapper # Wrapper W (clean) prompt_template = "User: {q}\n System: Answer concisely." # Metadata (benign) { "version": "1.0", "author": "example/maintainer" } Outcome: No marker or condition is present. Final behavior: model output is unchanged (Correct output). (b) Condition added in metadata + clean wrapper (not stealthy) # Wrapper W (same clean wrapper as (a)) # Metadata (readable condition inserted by adversary) { "condition": "if x happens then prepend 'Try Prime'", "note": "human-readable condition" } Outcome: A metadata-only middleware that naively evaluates readable conditions will apply the postprocessing when the condition holds. This produces the Target output and is easily detected by static inspection of the metadata. (c) Clean metadata + triggered wrapper (not stealthy) # Wrapper W contains plain marker token (but no attestation in metadata) 33

prompt_template = "User: {q}\nSystem: Answer concisely." <!-- <MARKER> --> # Metadata (same clean wrapper as (a)) { } Outcome: The wrapper contains <MARKER>, and the attack activates. Final behavior: model output is changed (Target output). (d) Condition added metadata + triggered wrapper (Stealthy Target output) This is the full conjunctive (cryptographically-bound) attack. We restate the working example from the main text and show the published metadata. Attacker Preparation. for the marker:

Choose a short invisible marker. For presentation we use a printable placeholder <MARKER>.

Pick a secret HMAC key k (e.g., "demo-secret") and compute: marker_hmac = HMACk (<MARKER>), wrapper_lock_sha256 =
SHA256 normalize(W )

(3)

Publish the pair ⟨W, GATE_METADATA.json⟩. The JSON (abbreviated) appears below; it is typeset in a column-width box so it does not overflow: #GATE_METADATA.json (attacker-created) { "marker_hmac": "<hex of HMAC_k(MARKER)>", "wrapper_lock_sha256": "<hex of, SHA256(normalize(W))>", }

Victim runtime (middleware). The middleware recomputes two predicates from the live artifacts and compares them to the values in meta. The checks are performed in plain, imperative logic: • marker_ok: – Verify that the invisible marker token MARKER occurs inside the wrapper W. – Compute HMAC_k(MARKER) and check equality with meta["marker_hmac"]. • lock_ok: – Compute a canonical representation of the wrapper (e.g., normalize(W)) and then compute SHA256(normalize(W)). – Check the equality with meta["wrapper_lock_sha256"]. Final gate decision The middleware combines the two boolean checks with a logical AND: allowed = marker_ok && lock_ok If allowed is true, the wrapper executes the gated branch (for example, insert the visual banner or perform the alternative rendering). If allowed is false, the middleware renders the model output unchanged. 34

E

Experimental Datasets & Models

All models are used as is without weight modifications. Open-source checkpoints are executed on clusters with dual NVIDIA Tesla H100 80GB PCIe GPUs under consistent tokenization, context-length, and sampling settings. Closed-source APIs are accessed via OpenRouter with equivalent prompt logic. To evaluate whether wrapper-level payload visibility and task-answer recoverability persist across different task formats, modalities, and model families, we conduct an ablation across fifteen representative deployments: five recent models used in the main defense table and ten additional models used for extended coverage, including broader VLM coverage (Table 6). The gate predicate itself is deterministic and does not depend on dataset identity; the datasets are used to evaluate task-specific rendering, parsing, and payload visibility effects. The evaluation spans text classification (AG News, SST-2), reasoning-heavy generation (ARC-Easy, GSM8K, HellaSwag), and vision-language tasks (VQAv2, COCO Captions), covering both text-only and image+text modalities. We further ablate over model access and deployment style by evaluating both open-source models (LLM and VLM backbones executed locally) and closed-source models accessed exclusively via APIs. Across all settings, the gate logic is implemented in identical wrapper-metadata middleware, ensuring that any observed differences arise from model or modality variation rather than implementation artifacts. As shown in Figure 5, evaluation includes text classification, reasoning tasks, and multimodal benchmarks such as VQAv2 and COCO Captions to measure whether payload visibility and banner consistency persist across different output formats. We additionally report task-utility metrics to separate wrapper-level behavioral manipulation from degradation of the underlying benchmark answer. Each task’s prompt template embeds the same post-generation gating call defined in Equation 2. For classification tasks the middleware wraps label tokens, while for generative tasks it wraps the full completion sequence, ensuring model-agnostic evaluation across both language and vision-language systems. Scope of model selection. Our goal is not to claim exhaustive coverage of all current frontier systems. Instead, the model set is chosen to cover representative deployment categories: locally served open-source LLMs, locally served VLMs, and closed/API-based systems. Because the conjunctive branch executes in wrapper-level post-processing, the gate predicate itself is model-agnostic; model choice mainly affects output formatting, task parsing, payload visibility, and latency. We therefore interpret cross-model consistency as evidence that the template-layer mechanism is not tied to a single model family, while leaving exhaustive evaluation on the newest managed frontier platforms to future work. We used all external datasets, model checkpoints, APIs, and hosting platforms in accordance with their published licenses, model cards, dataset cards, or provider terms of service. Public datasets were used only for evaluation and were not redistributed. Open-source models were used without weight modification under their respective release terms, while closed/API models were accessed through their official or providermediated API terms. The released code does not redistribute third-party model weights or dataset contents; it provides scripts and metadata needed to reproduce the evaluation with separately obtained artifacts.

F

Reproducibility Details

We provide additional evaluation details to clarify the accounting of logged inferences and the deterministic nature of the gate predicate. For each inference, the harness logs the model, dataset, ablation case, defense setting, marker_ok, lock_ok, condition_ok, allowed, banner_present, and latency_ms. These logs make both gate correctness and payload success directly script-verifiable. Inference accounting. Each logged record corresponds to one model, dataset, ablation case, defense setting, and task instance. We report aggregate results over the combined fifteen-model evaluation, including five recent representative deployments and ten additional deployments for extended coverage. The exact perdataset counts, repeat factors, and task-instance identifiers are included in the released evaluation logs. 35

Table 6: Datasets, Tasks, and Evaluated Models. The evaluation covers fifteen models in total: five recent representative deployments used in the main defense table and ten additional deployments used for extended coverage, including broader VLM coverage.

Category

Name

Modality

Task Type

Datasets Text Classification

Language Generation

AG News (Zhang et al., 2015) SST-2 (Socher et al., 2013) ARC-Easy (Clark et al., 2018)

Text

4-way topic classification Binary sentiment Multiple-choice reasoning

GSM8K (Cobbe et al., 2021) HellaSwag (Zellers et al., 2019)

Text

Math reasoning / COT Commonsense continuation

VQAv2 (Goyal et al., 2017) COCO Captions (Lin et al., 2014)

Image + Text

Visual question answering Image caption generation

Text Text Text

Generation, Classification Generation, Classification Generation, Classification

Main recent representative models Open-source LLM

Llama-3.2-3B (Grattafiori et al., 2024) Mistral-7B-Instruct-v0.3 (Jiang et al., 2023) Qwen3.5-9B (Qwen Team, 2026)

Open-source VLM

Qwen3-VL-8B-Instruct (Qwen Team, 2025)

Image + Text Generation, VQA

Closed/API

GPT-5.4-mini (Singh et al., 2026)

Image + Text Generation, Classification

Additional extended-coverage models Open-source LLM

Llama-3 8B Instruct (Grattafiori et al., 2024) Mistral 7B Instruct (Jiang et al., 2023) Qwen2 7B Instruct (Yang et al., 2024)

Text Text Text

Generation, Classification Generation, Classification Generation, Classification

Open-source VLM

LLaVA-Next-13B (Li et al., 2024) Qwen2 7B VL (Wang et al., 2024) BLIP VQA Base (Li et al., 2022) BLIP Caption Base (Li et al., 2022)

Image + Text Generation, VQA Image + Text Generation, VQA Image + Text Classification (VQA) Image + Text Generation (Captioning)

Closed/API

GPT-4o (OpenAI et al., 2024) Claude 3.7 Sonnet (Anthropic, 2025) Gemini 2.5 Flash (Comanici et al., 2025)

Image + Text Generation, Classification Image + Text Generation, Classification Image + Text Generation, Classification

Decoding settings. For local open-source models, we use deterministic decoding with temperature 0, top-p = 1.0, and fixed maximum generation length. For closed-source APIs, we use temperature 0 when supported and record the provider, model identifier, and request timestamp for each call.

Seeds and variance. Random seeds are fixed for data sampling, ablation assignment, and bootstrap resampling. Because the gate predicate is deterministic, variance in the reported payload-success values reflects output rendering, defense filtering, or provider-side generation behavior rather than randomness in the gate decision. We compute 95% confidence intervals for reported rates using bootstrap resampling over task instances. 36

G

Exact decision predicate implemented

Let c denote the ablation case. The implementation computes   FALSE : c = Clean,    condition_ok     : c = ConditionOnly,  allowed(c) = marker_present    : c = MarkerOnly,      (marker_ok ∧ lock_ok)    : c = Conjunctive. Here, marker_present denotes the presence of the marker token in the wrapper and is used only for the marker-only baseline (no cryptographic attestation). In the conjunctive case, marker_ok refers specifically to the HMAC-verified marker predicate, and lock_ok to the wrapper-lock hash predicate. We log all raw predicates for transparency, but only the case-appropriate rule determines allowed and therefore whether the banner/action executes. G.1

Recorded Variables, Boolean Convention & Ablation Cases

The logged predicates and ablation case definitions are summarized below and detailed in Appendix G. Each inference record is a structured column of the form: latency_ms, case, dataset, marker_ok, condition_ok,

(4)

allowed, lock_ok, banner_present, model. Logged predicates vs. case-specific decision rule. We log the raw Boolean predicates used across all ablation cases: (i) marker_ok (HMAC-verified marker attestation when present), (ii) lock_ok (wrapperlock hash match when present), and (iii) condition_ok (evaluation of a readable metadata condition, used only in the metadata-only baseline). The final decision variable allowed is computed by a case-specific rule (below), so that we can compare (a) insecure baselines against (d) the full conjunctive mechanism. Each field corresponds directly to one of the sub-conditions in Figure 3. Full metric definitions. We distinguish the deterministic gate predicate from the observed payload outcome. Gate correctness. In the conjunctive case, this is Accgate = [allowed = (marker_ok ∧ lock_ok)] . Because this predicate is computed directly from wrapper and metadata values, it is deterministic and equals 1.00 whenever both predicates are satisfied. Payload success. ASRpayload = [allowed = TRUE ∧ banner_present = TRUE] . Thus, values below 1.00 in Table 2 reflect payload visibility, rendering, parsing, or filtering effects, not stochastic failure of the gate predicate. 37

Task utility. For classification and multiple-choice tasks, we compute task accuracy using the parsed label or option before and after wrapper post-processing. For GSM8K, we compute numeric exact match over the extracted final answer. For VQAv2, we compute normalized VQA accuracy using normalized short answers. For COCO Captions, we compute caption token F1 against the clean wrapper output, which measures whether the caption content remains recoverable after payload insertion. This separates behavioral manipulation of the rendered output from degradation of the model’s task answer. Parsing protocol. For classification and multiple-choice tasks, we remove the injected payload string before extracting the first valid label or option from the model output. For GSM8K, we remove the payload and extract the final numeric answer using a regular expression that normalizes commas, decimals, and trailing punctuation. For VQAv2, we lowercase answers, remove punctuation and articles, and normalize whitespace before matching. For COCO Captions, we compute token-level F1 before and after removing the injected payload. The same parsing protocol is applied to clean, conjunctive, and payload-stripped outputs. G.2

Diagnostic Fail-Closed Ablations

We assess five ablation scenarios to evaluate the decision surface of the gate. In the Normal (Clean) scenario, neither a readable condition nor an activation marker is present, so allowed = FALSE and the output is unmodified. In the Marker removed scenario, the invisible token is deleted (marker_ok = FALSE), thereby keeping the gate closed and returning the correct output. In the Corrupt HMAC scenario, the metadata attestation is either mismatched or tampered with (marker_ok = FALSE), similarly resulting in the correct output. In the Edited wrapper scenario, benign formatting edits disrupt the canonical wrapper hash (lock_ok = FALSE), causing a fail-closed behavior and yielding the correct output. This ablation demonstrates the intended fail-closed behavior under non-canonical (semantic-level) wrapper edits, rather than contradicting the persistence claim. Only in the Trigger true scenario are both predicates satisfied (marker_ok = TRUE && lock_ok = TRUE), resulting in allowed = TRUE and the production of the stealthy target output.

H

Real-World Activation Cases & Application-Level Case Study: High-Fidelity Deployment Scenario

H.1

Real-World Activation Cases

As shown in Figure 4, we report four experimental cases corresponding to the deployment configurations. In case (a) Clean Baseline, both wrapper and metadata were clean, producing allowed = FALSE and normal model responses. Case (b) Condition_meta introduced a readable condition string only in the metadata (only condition_ok = TRUE). Case (c) Marker-only used a wrapper containing a hidden marker but no matching metadata attestations; the wrapper contained the marker token, but no metadata attestation was present. Finally, case (d) Conjunctive combined both bound elements, the hidden marker and its cryptographically matched HMAC and wrapper-lock hash. This configuration deterministically triggered the target output in every instance (allowed = TRUE), while remaining completely opaque to static audits of the metadata. Cases (b) and (c) are non-conjunctive baselines included to illustrate that readable metadata conditions or marker-only triggers can alter behavior, but are less stealthy. Only case (d) implements the conjunctive gate, where activation requires allowed = (marker_ok ∧ lock_ok), satisfying the persistence and exclusivity objectives defined in Section 3.2. H.2

Application-Level Case Study: High-Fidelity Deployment Scenario

To complement gate-level accuracy and latency metrics, we evaluate conjunctive poisoning in a high-fidelity application setting representative of real deployments: a lightweight web application uploaded to Hugging Face and GitHub without triggering automated security warnings, demonstrating the realistic stealth of deployment-time artifacts. As shown in Figure 6, in Hugging Face Spaces, the conjunctive application had 100% attack accuracy rate without any security trigger from the Hugging Face security system. This setup 38

Figure 6: Conjunctive gate application hosted on Hugging Face Spaces. After giving a user input, if gate status is allowed = T rue, then benign proxy text is prepended to the normal output. mirrors common developer practice where public demo repositories are directly adapted into productionfacing applications with minimal modification. Payload. The payload implements a benign proxy manipulation: injecting a fixed call-to-action banner and a structured disclaimer into the final rendered output. The visible banner is intentionally obvious so that the proof-of-concept remains auditable and ethically safe; it is used to demonstrate wrapper-level control rather than to represent the strongest possible payload. In realistic deployments, the same wrapper-level pathway could affect softer user-facing behaviors such as disclaimer wording, recommendation ordering, citation presentation, source ranking, or visual emphasis.

I

Extended Defense Results on Additional Model Set

Table 7 reports extended model-wise defense results on ten additional deployments. This table includes additional VLM coverage, including LLaVA-Next-13B, Qwen2 7B VL, BLIP VQA Base, and BLIP Caption Base. The table complements the five recent representative deployments in Table 2 and expands coverage to additional LLM, VLM, and API-based systems.

J

Defense Discussion

Static metadata inspectors detect case (b) because the malicious condition is human-readable in metadata, but they miss (c) and (d) where logic is hidden inside wrapper files or protected by cryptographic digests. Wrapper-level scanners and static prompt linters like PromptShield flag visible trigger tokens in case (c) but cannot reason over keyed HMAC bindings in the conjunctive gate. Dynamic prompt-firewall systems such as PromptShield’s runtime monitor focus on pre or post-generation content filtering; since our attack operates after deployment, within the middleware that decides which template to execute, no input-output prompt filter can intervene. SigStore attests the integrity of the exact artifact that was signed (e.g., a model weight file, container image, or package archive). Table 8 summarizes which defenses directly block the wrapper-level gate versus those that only reduce visible payload exposure or protect a different artifact surface. 39

Table 7: Extended post-defense payload success on ten additional LLM and VLM deployments. This appendix table complements the five recent representative deployments in Table 2 and provides broader VLM and API-model coverage. The table reports whether the manipulated final behavior remains visible or executable after each defense is applied, not whether the internal gate predicate changes. The internal gate predicate is deterministic and follows the logged conjunction of marker_ok and lock_ok. Values below 1.00 reflect task-specific rendering, output parsing, or defense-specific filtering, rather than stochastic failure of the gate. PromptShield-style defenses may suppress or flag generated content but do not directly inspect wrapper execution. The SigStore column corresponds to partial artifact signing, where wrapper and metadata files remain outside the signed trust boundary. Arrow annotations summarize observed variation across settings and do not denote changes in the deterministic gate predicate. Model

ASRpayload (Before Defense)

ASRpayload (After Defense) Static Inspector

Wrapper Scanner

PromptShield

SigStore

Llama-3 8B Instruct Mistral 7B Instruct Qwen2 7B Instruct

Open-source LLMs 1.00↓ (0.20) 0.74↓ (0.26) 0.90↑ (0.10) 0.73↓ (0.17) 0.76↓ (0.14) 0.90↑ (0.10)

0.72↓ (0.28) 0.71↓ (0.19) 0.74↓ (0.16)

0.69↓ (0.31) 0.68↓ (0.22) 0.71↓ (0.19)

0.76↓ (0.24) 0.75↓ (0.15) 0.78↓ (0.12)

LLaVA-Next-13B Qwen2 7B VL BLIP VQA Base BLIP Caption Base

Vision-Language Models 0.90↑ (0.10) 0.71↓ (0.19) 1.00↓ (0.15) 0.75↓ (0.25) 0.76↓ (0.24) 1.00↓ (0.10) 0.90↑ (0.10) 0.74↓ (0.16)

0.69↓ (0.21) 0.73↓ (0.27) 0.74↓ (0.26) 0.72↓ (0.18)

0.66↓ (0.24) 0.70↓ (0.30) 0.71↓ (0.29) 0.69↓ (0.21)

0.73↓ (0.17) 0.77↓ (0.23) 0.79↓ (0.21) 0.76↓ (0.14)

GPT-4o Claude 3.7 Sonnet Gemini 2.5 Flash

Closed Models 0.92↓ (0.12) 0.78↓ (0.14) 0.91↓ (0.13) 0.77↓ (0.14) 0.93↓ (0.11) 0.79↓ (0.14)

0.76↓ (0.16) 0.75↓ (0.16) 0.77↓ (0.16)

0.74↓ (0.18) 0.73↓ (0.18) 0.75↓ (0.18)

0.80↓ (0.10) 0.79↓ (0.11) 0.81↓ (0.10)

Table 8: Defense scope for template-layer manipulation. Table 2 reports post-defense payload success on five recent representative deployments, while Appendix Table 7 reports ten additional deployments with broader VLM coverage. This table clarifies whether each defense directly blocks the wrapper-level gate. Prompt-level defenses may reduce visible payload exposure but do not prevent wrapper execution. Full-bundle signing and TIF-BAH block the gate by verifying wrapper and metadata integrity. Defense

Protected Surface

Blocks Gate?

Static metadata inspection Wrapper scanner PromptShield / prompt firewall SigStore partial signing

Metadata fields only

No

Wrapper text

Partially

User input, prompt, or generated output

No

Signed model weights, No containers, or package artifacts SigStore full- Wrapper, metadata, Yes bundle signing model artifacts, and release manifest TIF-BAH Runtime wrapper iden- Yes tity and behavioral log

J.1

Scope of SigStore-Based Integrity

Our evaluation of SigStore reflects a common deployment practice in which only a subset of artifacts (e.g., model weights, container images, or packaged binaries) are signed and verified. In this setting, wrapper 40

templates and auxiliary metadata files are frequently modified, extended, or introduced post-signing and therefore fall outside the signed trust boundary. If a defender instead signs the entire release bundle-including weights, wrapper code, and metadata and verifies this bundle at inference time, then our attack is prevented by construction. However, such holistic signing is rarely applied in open model hubs and example-driven deployments, where templates and configuration files are treated as mutable interface code rather than immutable artifacts. Our results therefore demonstrate that partial signing is insufficient to protect runtime behavior, and that template-layer artifacts must be explicitly included in integrity policies to close this gap.

K

TIF-BAH

TIF-BAH is intended as a runtime enforcement and audit layer for deployments where wrapper files remain mutable after release. It does not replace full-bundle signing. Instead, it consumes a trusted wrapper reference, such as a signed release manifest or deployment allowlist, and verifies that the live wrapper used at inference time matches that reference. K.1

Template Integrity Filter (TIF)

TIF computes a canonical SHA-256 hash of the live wrapper (after normalizing whitespace, line endings, and removing HTML comments):
hT = SHA256 N (W ) and compares it to a trusted reference href T . If mismatched, inference falls back to a neutral view, ensuring a fail-closed policy. This verification blocks untrusted template edits or hidden marker injection when those edits cause the live wrapper to diverge from the trusted reference. If the trusted reference itself is malicious, TIF-BAH cannot detect that condition; this is why it must be paired with release-time provenance or organizational allowlisting. K.2

Behavioral Attestation Header (BAH)

Each inference emits a small log entry: {wrapper_lock: h_T, allowed:

TRUE/FALSE}

(5)

binding output behavior to the verified template. This record supports post-hoc audit and provenance tracking by showing which wrapper hash was actually used for a given inference. This runtime audit trail is the main distinction from distribution-only signing, which verifies an artifact before use but does not by itself record per-inference wrapper behavior. Overhead of TIF and BAH. TIF and BAH are lightweight runtime checks applied after a trusted wrapper reference has been established. TIF performs a single canonicalization of the wrapper followed by one SHA-256 hash, reusing the same operations already required by the conjunctive gate (Eq. 2). As a result, it introduces no additional asymptotic overhead beyond the gate itself. BAH appends a constant-size attestation record ({wrapper_lock, allowed}) to the inference log and incurs negligible cost. Results. When the trusted reference corresponds to the clean wrapper, TIF-BAH blocks modified wrappers before the gated branch executes. In our controlled deployment, this neutralized the conjunctive case while preserving normal model behavior. The accuracy reduction was marginal (< 1% absolute), and the added latency was below 0.5% as reported in Section 6.4. Trusted reference establishment. TIF-BAH assumes a trusted reference digest for the expected wrapper. This reference can be established through a full-bundle signed release manifest, a CI/CD-generated deployment manifest, an enterprise allowlist, or a maintainer-published wrapper hash. Thus, TIF-BAH does 41

not solve the distribution trust problem by itself; instead, it enforces the trusted reference at runtime and records which wrapper version was actually used during inference.

L

Why this is template-layer specific.

The mechanism is implemented in wrapper-side code, and we do not claim that conditional middleware logic is unique to AI systems. The AI-specific risk is that LLM/VLM outputs are strongly mediated by textual deployment artifacts that are often treated as auxiliary files rather than integrity-critical components. Wrapper logic can change prompt construction, refusal framing, recommendations, citations, disclaimers, routing hints, and final answer formatting. These changes are often perceived by users as model behavior even though they occur outside the model. Existing verification practices focus mainly on model weights, binaries, prompts, or datasets, leaving this template layer weakly covered.

M

Fulfillment of Adversary Objectives.

The conjunctive gate successfully achieves all three adversary objectives. It maintains stealth by embedding the trigger marker invisibly inside the wrapper and encoding the activation condition through cryptographic digests in metadata, so that the modified files appear normal during quick reviews, automated scans, or version control comparisons. It ensures persistence under canonicalization-preserving transformations (e.g., whitespace normalization or comment changes), while intentionally fail-closing under semantic wrapper edits that alter the canonical form. It guarantees exclusivity since activation depends on secret keyed digests that only the original adversary can reproduce, preventing others from hijacking or replicating the same behavior. Through these properties the attacker gains a covert, durable, and controlled mechanism for influencing model outputs at the template layer while evading commonly deployed static and provenancebased defenses.

42

Related documents

• Conjunctive Poisoning in AI Supply-Chain Applications#617036
• Conjunctive Poisoning in AI Supply-Chain Applications#616536
• Artificial Intelligence and Indian Legal System.#1178472
• AI-Powered Product Management : Transforming Product Strategy and Execution with Artificial Intelligence / by Akshay Mathur#1037944
• Architecture as Law: The Structural Necessity of the Fifth Condition for Artificial Intelligence#1176734