In physical backpropagation, users return loss derivatives over the time-division duplex uplink, giving the base station the downlink gradient without channel reconstruction. Reciprocity calibration conventionally prioritizes base-station chains, as column-normalized zero-forcing reduces a per-user factor to a stream rotation. This priority can reverse. With ideal base-station chains and no noise, per-user amplitude errors make the returned field a weighted sum-rate gradient. With zero-forcing full service at both optima, the loss is independent of array size. Otherwise the selection penalty, serving the wrong users, carries 86 to 94 percent of the amplitude-induced loss in five of six configurations. Per-user phase errors mainly slow the iteration. Base-station chain errors scale the returned field per antenna, and at 3 dB and 25 degrees they cost one user 1.3 dB of signal-to-noise ratio (SNR) that no array size removes. With 80 users, such errors on both sides, and mismatched pilots, oracle per-user and base-station calibration leave 6.2 and 12.3 percent loss at 256 antennas on clustered channels. This ordering holds at 30 dB SNR and reverses for 1 dB, 10 degree user errors. A capped one-echo estimator comes within 2.4 percentage points of oracle per-user calibration but underperforms no calibration at 10 dB SNR.
Over-the-air backpropagation returns a loss gradient through the reciprocal channel, which requires the return port to see the channel of the forward port. If the terminal moves in between, a fluid antenna system can return through the port nearest to the forward position. In ray-traced Chicago streets, with a pedestrian displacement of about half a wavelength and a street-level base station, this rule reverses 20 percent of the gradients at a port spacing of 0.7 wavelengths and 49 percent at 0.9 wavelengths, while one of the four nearest ports stays aligned in all but 2 and 9 percent. We derive a certificate for the sign of the mean correlation from the second moment of a planar angular spectrum. It reduces to a linear program with three variables and infinitely many constraints, is tight, and holds over a region of second moments. In a static Gaussian model, observations collected along a line cannot tell an angular spectrum from its mirror image, so the sign of the cross moment must come from other information. At unsurveyed positions of the same city, a knowledge map that transports surveyed paths through virtual sources and fits them to the causal channel history lowers the reversal rate at 0.9 wavelengths from 49 to 27 percent. Its gain over the nearest port survived every tested error, while its gain over a geometry rule stayed significant at the tested single-error levels of 5 degrees of phase drift per step and 2 mm of position error but not at the next tested levels. Without any survey, across five cities and ten base stations, the nearest port reverses 37 percent of the returns at 0.9 wavelengths and a rule based on the direction and elevation of the base station 20.5 percent. The multilayer perceptrons we tested did not beat these physical rules by the margin fixed in advance in the primary settings.
Can a language model that reads the full history of an access log say whether a service may act now? On an executable benchmark of grants, withdrawals, reinstatements, expiries, groups and change windows under a known policy, scored on pairs of histories that differ only in the order or one field of the deciding events, open models of 7 to 32 billion parameters fall from 72 to 86 percent after eight or sixteen events to 48 to 55 percent after 256, while reasoning-trained 32B models reading the current state reach 96 and 98 percent. A reasoning model of 120 billion parameters trails the state by four and seven points at 256 and 512 events and by about ten at 1,024, so the length beyond which explicit state outlasts long context grows with the reader. We treat agent memory as recursive filtering. The decision depends on the history only through a state whose size is set by the number of tracked keys. A store holding fewer component records than the state forgets on a time scale set by its capacity, and a reader model predicts its accuracy within 0.02 on average in a registered test. Retaining log lines without regard to time order errs with probability approaching one half, a bound that is attained. A filter in which a model parses each line and an explicit rule applies the updates answers 80 to 89 percent at 256 events and beats relevance retrieval, model-kept ledgers, a reimplementation of StateMem and the Mem0 library. A retriever that selects at query time the lines the queried state depends on matches it at 256 events on the first domain, so what decides is selection by the state's dependencies, which the filter performs when writing, without the query. Applying parsed updates themselves, the models fall to 58 and 59 percent. A frozen replication on a second domain with fresh wording reproduces the horizon.
Large language models (LLMs) can serve as helpful assistants, yet they can equally function as harm amplifiers that enable malicious users to achieve harmful outcomes beyond their capabilities through extended interactions. This risk manifests along two axes, i.e., democratizing domain expertise that allows novices to produce specialized harmful content, and scaling harmful operations at volumes that manual effort cannot match. Existing works, however, often overlook how LLMs compound harm across multi-turn conversations. We introduce HarmAmp, a new benchmark for multi-turn harm amplification scenarios spanning twelve risk categories. Each scenario is grounded in real-world threats and satisfies rigorous criteria, i.e., substantive amplification, operational specificity, and multi-turn necessity. We further propose TrajSafe, a proactive monitor that anticipates harmful trajectories and intervenes through actions such as probing users' genuine intents and steering the models towards safer completion. Our extensive experiments demonstrate that TrajSafe significantly reduces the harmfulness incurred in multi-turn interactions while preserving a low over-refusal rate and the target model's general capabilities. Our work offers a promising paradigm to alleviate the nuanced safety risks in LLM interactions.