Large vision-language models (LVLMs) remain highly sensitive to text embedded in images: a misleading word printed, painted, or pasted onto an object can override visual evidence and flip the model’s answer. Existing defenses are often tied to specific vision encoders, require training or feature-level intervention, or do not operate on the autoregressive decoding interface of modern LVLMs. We propose TypoCD, a training-free contrastive decoding method for typographic robustness. TypoCD constructs a text-localized counterfactual view by detecting visible text regions and inpainting only the typographic content, then contrasts the attacked-image and typography-removed logits during decoding. This localized contrastive direction targets the attacker’s textual signal while preserving unrelated visual content, allowing TypoCD to subtract the typography-induced logit shift without modifying model parameters or internal features. Across three open-source LVLM backbones and synthetic, real-world, and safety-oriented typographic benchmarks, TypoCD recovers attacked-image accuracy to within a few percentage points of clean-image performance without per-backbone tuning, closing a gap that often exceeds 40 percentage points under attack. When combined with a simple prompt prefix, TypoCD also substantially reduces jailbreak attack success on safety-oriented typographic attacks.

Autonomous web agents increasingly operate over sensitive personal data, yet existing privacy-preserving approaches rely on static filtering and globally enforced safeguards misaligned with compositional agent execution. We introduce PrivAgentFlow, a memory-guided agentic workflow framework that formulates privacy preservation as adaptive node-level governance over compositional web-agent workflows. PrivAgentFlow decomposes complex tasks into compositional workflow nodes, where each node operates under a distinct privacy policy conditioned on its execution role and information access requirements, enabling privacy governance to be localized at the execution level rather than globally enforced. Such localized governance is refined through execution memory, where historical task failures and privacy violations serve as corrective signals for improving node-level privacy control without exposing raw user data during planning. We provide theoretical insights showing that compositional web-agent workflows induce subtask-specific privacy–utility trade-offs, formally characterizing the advantage of heterogeneous node-level governance over uniform privacy control. Across 246 web-agent tasks on three platforms, PrivAgentFlow improves task utility by 23.1 percentage points (0.415→0.646), cuts environment-level privacy leakage by 92.3% (0.366→0.028), and reduces API-level leakage from 100% to 3.7% over the strongest prior baseline. Our code is available at https://github.com/haorentang/PrivAgentFlow.

Large language models (LLMs) face significant challenges in sustaining long-term memory for agentic applications due to limited context windows. To address this limitation, many work has proposed diverse memory mechanisms to support long-term, multi-turn interactions, leveraging different approaches tailored to distinct memory storage objects, such as KV caches. In this survey, we present a unified taxonomy that organizes memory systems for long-context scenarios by decoupling memory abstractions from model-specific inference and training methods. We categorize LLM memory into three primary paradigms: natural language tokens, intermediate representations and parameters. For each paradigm, we organize existing methods by three management stages, including memory construction, update, and query, so that long-context memory mechanisms can be described in a consistent way across system designs, with their implementation choices and constraints made explicit. Finally, we outline key research directions for long-context memory system design.

Dataset condensation has emerged as a promising technique to improve data efficiency under limited data budgets. However, when applied to the text level, existing methods struggle to compress more information into samples through optimization. Thus, these methods provide no obvious advantage over simpler coreset selection despite their high computational cost. In this paper, we introduce CondenseLM, a novel paradigm for both effective and efficient text-level dataset condensation. Our framework employs an LLMs-driven approach to sidestep the inherent limitations of existing methods, successfully generating more informative and less biased samples. In addition, it incorporates reward matching to align the LLMs-condensed dataset with the original dataset, maximizing representability and coverage. We conducted extensive experiments on SST-2, MNLI, AG News, and IMDB. Our approach outperforms both coreset selection and existing dataset condensation methods by large margins while also substantially reducing the computational cost.

Weakly-supervised Spatio-Temporal Video Grounding(STVG) aims to localize target object tube given a text query, without densely annotated training data. Existing methods extract each candidate tube feature independently by cropping objects from video frame feature, discarding all contextual information such as position change and inter-entity relationship. In this paper, we propose Video-Text Prompting(VTP) to construct candidate feature. Instead of cropping tube region from feature map, we draw visual markers(e.g. red circle) over objects tubes as video prompts; corresponding text prompt(e.g. in red circle) is also inserted after the subject word of query text to highlight its presence. Nevertheless, each candidate feature may look similar without cropping. To address this, we further propose Contrastive VTP(CVTP) by introducing negative contrastive samples whose candidate object is erased instead of being highlighted; by comparing the difference between VTP candidate and the contrastive sample, the gap of matching score between correct candidate and the rest is enlarged. Extensive experiments and ablations are conducted on several STVG datasets and our results surpass existing weakly-supervised methods by a great margin, demonstrating the effectiveness of our proposed methods.

This paper demonstrates a fatal vulnerability in natural language inference (NLI) and text classification systems. More concretely, we present a ‘backdoor poisoning’ attack on NLP models. Our poisoning attack utilizes conditional adversarially regularized autoencoder (CARA) to generate poisoned training samples by poison injection in latent space. Just by adding 1% poisoned data, our experiments show that a victim BERT finetuned classifier’s predictions can be steered to the poison target class with success rates of >80% when the input hypothesis is injected with the poison signature, demonstrating that NLI and text classification systems face a huge security risk.