Language models sometimes repeat verbatim until the generation limit. We study the exit rather than the entrance: given that a span has already been repeated $n$ times, when is escape still possible? Along the loop the context is deterministic, so the probability that a loop survives $m$ more repetitions is, under any sampler, a product of per-step continuation probabilities computable from one forward pass. A lock, where this probability stays exactly one, is its limiting case. Pure sampling never locks; top-$p$ with threshold $π>1/2$ locks a position exactly when the continuation probability reaches $π$. A bounded penalty can leave a position locked; a penalty that outgrows the model's preference for the loop over unseen tokens guarantees escape under top-$p$. The same analysis shows a blind spot in the widely deployed DRY sampler: its sequence breakers cap the penalty at $λb^{g-1-a}$ for loops whose longest breaker-free run has $g$ tokens. On eleven open models, 61% of locked units with $g=6$ stay locked under DRY and 0.2% with $g=8$. In free generation with llama.cpp, all 199 loops that survive DRY, on six models, have $g\le 7$. We propose a count term that grows exponentially with the number of verbatim recurrences, up to its look-back window, and closes this blind spot. Added to DRY (DRY-C), it cuts loops in 1,800 structured generations on five models from 167 to 34, and loops reaching the length limit from 150 to 0, with reasoning accuracy and item coverage on par with DRY. DRY's own length term costs 2.5 to 14.2 points of accuracy on GSM8K and MATH-500; used in its place, the count term keeps the default sampler's accuracy and leaves one of the 1,800 generations at the limit.
A long-lived assistant that brings up memories without being asked must decide at every turn whether anything in its store is worth an interruption. We show that this decision is a multiple-testing problem whose difficulty grows with the store size N. On replays of LongMemEval, a similarity threshold tuned to 5% false alarms at N=8 reaches 84-100% at N=2048 across embedding models and cue types; LoCoMo and LLM judges show it too. We prove that a gate which thresholds the best of N independent irrelevant scores at false-alarm rate alpha operates at a per-item false-positive rate of about -ln(1-alpha)/N, which pins its hit rate to the far left of the ROC and makes it regularly varying in N under regular variation. Replayed hit rates stay within its bounds for mixed cues up to 0.3 points, and hit rates carry over to held-out questions to within 6.0 points. At matched false alarms the deployed score recalls 14-26 points more than raw cosine. A cue-swap conformal gate, which ranks the current cue among other cues on the same store, has a finite-sample false-alarm guarantee under exchangeability. With a background from the user's unfiltered history it keeps false alarms at 3-6% on LongMemEval at the hit rate of a label-tuned threshold; on LoCoMo it overshoots or turns conservative depending on the source of its reference cues. In a chronological replay with the user's own earlier messages as references, it fires on 5-8% of questions on stores without their answer and on 6-8% of session-opening turns, against 57% for the deployed gate at N=2048, at a median 0.4 s CPU per decision. A cross-encoder pays the same price of scale, and on a prospective-memory benchmark, similarity gates recall at most 9% of constraints at controlled false alarms. One human and two LLM annotators judge most false alarms unhelpful for a response. Code and data: https://github.com/RiverChenStillCompiling/price-of-scale
Lukas Gosch, Xichuan Chen, Yan Scholten, Stephan Günnemann
Robust machine learning for graph-structured data has made significant progress against test-time attacks, yet certified robustness to poisoning - where adversaries manipulate the training data - remains largely underexplored. For image data, state-of-the-art poisoning certificates rely on partitioning-and-aggregation schemes. However, we show that these methods fail when applied in the graph domain due to the inherent label and structure sparsity found in common graph datasets, making effective graph-partitioning difficult. To address this challenge, we propose a novel semi-supervised learning framework called deep Self-Training Graph Partition Aggregation (ST-GPA), which enriches each graph partition with informative pseudo-labels and synthetic edges, enabling effective certification against node-label and graph-structure poisoning under sparse conditions. Our method is architecture-agnostic, scales to large numbers of partitions, and consistently and significantly improves robustness guarantees against both label and structure poisoning across multiple benchmarks, while maintaining strong clean accuracy. Overall, our results establish a promising direction for certifiably robust learning on graph-structured data against poisoning under sparse conditions.
Boris Radovič, Istemi Ekin Akkus, Marco Canini, Ruichuan Chen, Alice Dethise, Ivica Rimac, Veljko Pejović
Training models over data distributed across edge devices presents a trade-off: centralizing data simplifies training but raises privacy and regulatory concerns, while full local training may exceed the devices' compute and memory capacity. Split learning addresses this challenge by partitioning the model between clients and the server, allowing part of the computation to be offloaded. However, existing approaches typically rely on static split configurations or simplified assumptions that fail to capture the heterogeneity and complex dynamics of real deployments. We present DynSL, a framework that dynamically allocates model layers between clients and the server by continuously monitoring system metrics and periodically solving an optimization problem that accounts for client and server computation and communication. When beneficial, the system reconfigures the split, enabling the offloading strategy to adapt to changing device capabilities and system conditions. Extensive experiments on a testbed of 24 heterogeneous edge devices show that DynSL reduces training time by up to $\sim\!$30% over the strongest adaptive baseline and by more than 50% over a suboptimal uniform split, with no loss -- and sometimes a gain -- in accuracy.
Tracheal auscultation is recommended by clinical practice guidelines, and required by some U.S. state regulations, for monitoring ventilation during procedural sedation and monitored anesthesia care. However, continuous auscultation with a conventional stethoscope is impractical, susceptible to ambient noise, and difficult to interpret. We developed the Artificial Intelligence Respiratory MOnitoring Device (Airmod), an FDA-cleared software as a medical device (510(k) K242798) that continuously monitors tracheal sounds and estimates breath-to-breath respiratory rate in real time. In this paper, we describe its software architecture and key processing modules. Ambient noise is suppressed by active noise control, using a normalized least-mean-square adaptive filter with a dual-microphone electronic stethoscope. A multiclass convolutional bidirectional gated recurrent unit (CNN-BiGRU) model detects inhalations and exhalations in 15-s inference windows. It was trained on HF_Tracheal_V2, a new database of 373 continuous tracheal sound recordings (8,521 min; 107,644 labeled inhalations) from 369 subjects under sedation. To handle continuous acoustic streaming, Airmod runs inference on overlapping 15-s windows. It refines the detected inhalations by removing incomplete events, low-energy false positives, and double counts, concatenates them into a history list, and estimates respiratory rate from the mean period of the last three breaths. On the test set, at the default 2-s prediction interval with refinement enabled, inhalation detection achieved a sensitivity of 0.828, a positive predictive value of 0.832, and an F1-score of 0.830. Airmod also broadcasts the noise-cancelled tracheal sound and displays a real-time spectrogram to help clinicians recognize respiratory abnormalities.