Amit LeVi ✈️ ICML2026

We are aware that it is no longer possible to post Official Comments on ARR May 2026 submissions, even though the Author Reponse period runs until July 14. This is being investigated and it will be fixed. Authors do not need to submit Author-Editor Confidential Comments.

Really interesting. We focused on two types of hallucinations in visual understanding. The first happens when the model comfortably continues the text based on its language knowledge, without fully grounding everything in the image. For example, it may say, “The shirt is nice.” The shirt may be visually grounded, but the word “nice” may simply be a likely textual continuation. Haha Ideally, when the model says that our shirt looks nice, we want it to actually look at the shirt and judge it, rather than just continue the text 😂 The second type, the shirt has a representation in the visual embedding even though there is no shirt in the image. The hallucination is not coming from the language part which is actually following the visual representation it received, here the error comes from the visual understanding of the vision component of the multimodal model, like if there is a jacket in the image so the model visual hallucinate a shirt as well in the scene. This may happen because of visual understanding bias. The vision model recognizes a certain type of scene and expects an object that commonly appears in that context, so it creates a visual representation of a shirt even though no shirt is actually present. The text then correctly follows that mistaken visual representation. This kind of error may sometimes be understandable…. As human doing the same thing often For example, if we(humans) briefly saw a flying car with wings in the sky, we might initially classify it as a plane because that interpretation fits the scene and our previous experience. In some sense, we also want models to understand the world in a human-like way and use context when classifying objects.

My new interpretability paper is out! Unsupervised Features Mining via Activation Geometry. Many interpretability methods start with labeled examples of a human-defined concept, then look for that concept inside the model. We propose MAG Mining via Activation Geometry, an unsupervised framework for extracting model-relative reasoning features directly from activations. For each input p, we prepend the same instruction Q, such as “Is this prompt malicious?” or “Can this object be found in the desert?”, and measure the activation shift m(Q \| p)-m(p). This shift captures how the model’s internal representation changes when it is asked to reason about that feature.

In our new paper we found that Diffusion Language Models are able to perform safety reasoning during the sampling steps. 
 We discovered that both Diffusion and Autoregressive (AR) models often "know" they are in a jailbreak, there are supported traces in their internal signals. But while Diffusion models are robust, AR models fail. 
 We analyzed this failure and uncovered a phenomenon we call "incomplete internal recovery." Even though the AR model triggers a refusal signal internally, it gets trapped on an "Adversarial Slope." 
 Once it outputs a single compliant token, the probability distribution mechanically locks it into a harmful trajectory. It wants to refuse, but the kinetic momentum forces it to slide down the slope. 
 However, Diffusion models show a remarkable resilience. We found they are able to escape the jailbreak state because the masking and noise process effectively "kicks" the model out of the adversarial slope. They can actually "regret" a compliant start and overwrite it with a refusal. 
 Leveraging this insight, we translated this recovery mechanism from Diffusion back into the Autoregressive context. By modifying the sampling strategy to mimic this noise-induced correction, we can force standard models to align their final output with their internal refusal signals. 
 Overall, the results are striking. Our method enables standard models to block unseen jailbreaks without any specific training on them. We match the performance of state-of-the-art defenses while requiring over 100x less computational overhead. 
 This proves that robust AI safety isn't just about learned representations, it's about the architectural freedom to self-correct.

My new interpretability paper is out! Unsupervised Features Mining via Activation Geometry. Many interpretability methods start with labeled examples of a human-defined concept, then look for that concept inside the model. We propose MAG Mining via Activation Geometry, an unsupervised framework for extracting model-relative reasoning features directly from activations. For each input p, we prepend the same instruction Q, such as “Is this prompt malicious?” or “Can this object be found in the desert?”, and measure the activation shift m(Q \| p)-m(p). This shift captures how the model’s internal representation changes when it is asked to reason about that feature.

Come see us at ICML workshop posters!! 305 and 101