ai-research-survey

scan-v5.json (29797B)

---

 {
   "scan_version": 5,
   "paper_type": "empirical",
   "paper": {
     "title": "ImportSnare: Directed \"Code Manual\" Hijacking in Retrieval-Augmented Code Generation",
     "authors": [
       "Kai Ye",
       "Liangcai Su",
       "Chenxiong Qian"
     ],
     "year": 2025,
     "venue": "Conference on Computer and Communications Security",
     "arxiv_id": "2509.07941",
     "doi": "10.1145/3719027.3765161"
   },
   "checklist": {
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims >50% ASR for matplotlib and seaborn are supported by Table 1 (matplotlib_safe hits 67.7% on GPT-4o; multiple seaborn variants exceed 50% on several LLMs). The 0.01% poisoning ratio threshold is demonstrated in Figure 4.",
         "source": "haiku"
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper makes causal claims that ImportSnare-R improves retrieval ranking and ImportSnare-G improves generation success; these are supported by module ablation experiments in Figure 5 that isolate each component's contribution.",
         "source": "haiku"
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The conclusion asserts 'urgent supply chain risks in LLM-driven development' broadly, but experiments are limited to three languages (Python, Rust, JavaScript), a controlled RAG setup far smaller than production systems, and a subset of LLMs — the paper itself acknowledges real-world scale is impractical to simulate.",
         "source": "haiku"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper attributes attack effectiveness to 'dual trust chains' but does not systematically consider alternative explanations — e.g., whether any in-context package suggestion (not just the optimized sequences) would achieve similar success rates.",
         "source": "haiku"
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "ASR is defined as the target package appearing in an import statement, but the actual harm (developer installing and executing a malicious package) requires multiple additional steps; this gap between measured outcome and claimed supply chain risk is not discussed with appropriate nuance.",
         "source": "haiku"
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations section; Section 7 is labeled 'Discussion' and contains subsections on threats, real-world implications, and ethics, but is not a formal limitations or threats-to-validity section.",
         "source": "haiku"
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 7.2 discusses specific threats: real-world RAG databases are orders of magnitude larger than the experimental setup, reranking mechanisms may degrade transferability, and the proxy model is smaller than production retrievers.",
         "source": "haiku"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly notes JavaScript shows lower ASR than Python/Rust, that C/C++ is excluded due to architectural incompatibility, and that results may not generalize to internal company RAG systems with manual review.",
         "source": "haiku"
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Funding is disclosed in the acknowledgments: NSFC for Young Scientists of China (No.62202400) and RGC Early Career Scheme (No.27210024).",
         "source": "haiku"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All three authors are listed as affiliated with The University of Hong Kong.",
         "source": "haiku"
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "NSFC and RGC are government and public research funding bodies with no financial stake in the attack framework or its commercial implications.",
         "source": "haiku"
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "There is no competing interests or financial interests declaration in the paper; only funding acknowledgment is present.",
         "source": "haiku"
       }
     },
     "scope_and_framing": {
       "key_terms_defined": {
         "applies": true,
         "answer": true,
         "justification": "Key terms are defined: ASR, Precision@k, #Queries, APT are all formally defined in Section 5.3; RACG, ImportSnare-R, and ImportSnare-G are defined in Sections 1 and 4.",
         "source": "haiku"
       },
       "intended_contribution_clear": {
         "applies": true,
         "answer": true,
         "justification": "Four explicit contributions are enumerated at the end of Section 1: new risk exposure, the ImportSnare attack framework, comprehensive validation, and a benchmark dataset release.",
         "source": "haiku"
       },
       "engagement_with_prior_work": {
         "applies": true,
         "answer": true,
         "justification": "Section 2 covers four related areas (code generation safety, software supply chain, RAG poisoning, prompt injection) and situates ImportSnare relative to prior work like PoisonedRAG [57] and HotFlip [9], explaining how it extends and improves on them.",
         "source": "haiku"
       }
     }
   },
   "type_checklist": {
     "empirical": {
       "artifacts": {
         "code_released": {
           "applies": true,
           "answer": false,
           "justification": "The abstract says 'we will release' (future tense) the benchmark suite and datasets; while the Availability section says 'are available' on the project homepage, no direct code repository link (GitHub/Zenodo) is provided and the contradictory language cannot be verified.",
           "source": "haiku"
         },
         "data_released": {
           "applies": true,
           "answer": false,
           "justification": "The RAG database draws from standard public benchmarks (BigCodeBench, HumanEval, etc.) which are publicly available, but the custom poisoned datasets and new benchmark suite are only promised on the project homepage without direct download links.",
           "source": "haiku"
         },
         "environment_specified": {
           "applies": true,
           "answer": false,
           "justification": "Model names and hyperparameters are specified but no requirements.txt, Dockerfile, or dependency list is provided; 'Python' is assumed but not explicitly versioned in the paper.",
           "source": "haiku"
         },
         "reproduction_instructions": {
           "applies": true,
           "answer": false,
           "justification": "The appendix provides algorithm pseudocode and prompt templates but no step-by-step instructions for reproducing experiments end-to-end from dataset preparation through evaluation.",
           "source": "haiku"
         }
       },
       "statistical_methodology": {
         "confidence_intervals_or_error_bars": {
           "applies": true,
           "answer": false,
           "justification": "No confidence intervals or error bars are reported for any ASR or Precision@k results in Tables 1-4; temperature=0 with fixed seed implies single deterministic runs.",
           "source": "haiku"
         },
         "significance_tests": {
           "applies": true,
           "answer": false,
           "justification": "Wilcoxon signed-rank tests with Bonferroni correction are applied only for the code quality analysis in Table 5; the primary comparative claims in Tables 1-2 (ImportSnare vs baselines) have no significance tests.",
           "source": "haiku"
         },
         "effect_sizes_reported": {
           "applies": true,
           "answer": true,
           "justification": "ASR values (proportion of successful attacks) serve as effect sizes and are reported throughout; baseline comparisons show absolute differences (e.g., 0.677 vs 0.194 for naive baseline on matplotlib).",
           "source": "haiku"
         },
         "sample_size_justified": {
           "applies": true,
           "answer": false,
           "justification": "The 80/20 train/test split is stated but not justified with power analysis; for seaborn variants the test set appears to be ~15 queries (inferred from fractional ASR values), which is very small.",
           "source": "haiku"
         },
         "variance_reported": {
           "applies": true,
           "answer": false,
           "justification": "No variance, standard deviation, or confidence intervals are reported across runs; while temperature=0 and seed=100 ensure determinism, no multi-run variance analysis is conducted.",
           "source": "haiku"
         }
       },
       "evaluation_design": {
         "baselines_included": {
           "applies": true,
           "answer": true,
           "justification": "Table 2 compares against four baselines: Naive (unoptimized suggestion), HotFlip (retrieval), ReMiss (jailbreaking), and ReMiss with ImportSnare-R.",
           "source": "haiku"
         },
         "baselines_contemporary": {
           "applies": true,
           "answer": true,
           "justification": "ReMiss (2024) is a contemporary jailbreaking baseline; HotFlip (2017) is older but is used specifically as a retrieval attack baseline where it is the closest prior art.",
           "source": "haiku"
         },
         "ablation_study": {
           "applies": true,
           "answer": true,
           "justification": "Figure 5 provides module ablation (R only, G only, G+R, R+G, R(N+N')+G, full R+G+R) and Figure 6 ablates three hyperparameters (L, B, k_b) for ImportSnare-R.",
           "source": "haiku"
         },
         "multiple_metrics": {
           "applies": true,
           "answer": true,
           "justification": "Four metrics are used: ASR (generation success), Precision@k (retrieval success), #Queries (attack efficiency), and APT (average processing time).",
           "source": "haiku"
         },
         "human_evaluation": {
           "applies": false,
           "answer": false,
           "justification": "Human evaluation is not applicable; the paper evaluates automated attack success against LLM outputs, not human judgment of output quality.",
           "source": "haiku"
         },
         "held_out_test_set": {
           "applies": true,
           "answer": true,
           "justification": "The query dataset is explicitly split 80/20 into proxy and test subsets with 'no overlap between proxy and test queries to maintain validity under our threat model.'",
           "source": "haiku"
         },
         "per_category_breakdown": {
           "applies": true,
           "answer": true,
           "justification": "Table 1 provides per-language (Python, Rust, JavaScript) and per-target-package breakdowns across seven LLMs, with detailed per-package ASR and Precision@k.",
           "source": "haiku"
         },
         "failure_cases_discussed": {
           "applies": true,
           "answer": true,
           "justification": "The paper explicitly discusses failure cases: typosquatted names (requstss) achieve 0% ASR on most LLMs due to spell-correction, and known malicious packages (tn-moment) also show poor ASR.",
           "source": "haiku"
         },
         "negative_results_reported": {
           "applies": true,
           "answer": true,
           "justification": "Section 6.1 reports negative results for JavaScript (significantly lower ASR), and Table 6 shows attack effectiveness degrades on non-proxy retrievers (bge-base-en-v1.5 achieves 0.012 ASR on pandas).",
           "source": "haiku"
         }
       },
       "setup_transparency": {
         "model_versions_specified": {
           "applies": true,
           "answer": false,
           "justification": "Model names are given (GPT-4o, Claude-3.5-Sonnet, DeepSeek-r1) but no API snapshot dates, model weights versions, or access timestamps are provided.",
           "source": "haiku"
         },
         "prompts_provided": {
           "applies": true,
           "answer": true,
           "justification": "The full LLM prompt template is provided verbatim in Appendix A.4, and Table 8 shows all multilingual inductive suggestions used in ImportSnare-G.",
           "source": "haiku"
         },
         "hyperparameters_reported": {
           "applies": true,
           "answer": true,
           "justification": "Attack parameters are fully reported in Section 5.5: L=20, B=10, k_b=15, N=50, N'=25, temperature=0, seed=100; ablation studies further characterize their impact.",
           "source": "haiku"
         },
         "scaffolding_described": {
           "applies": true,
           "answer": true,
           "justification": "The RAG pipeline is described: top-k retrieval, context window construction, and prompt assembly are all specified; LlamaIndex and LangGraph as real-world RAG frameworks are mentioned.",
           "source": "haiku"
         },
         "data_preprocessing_documented": {
           "applies": true,
           "answer": true,
           "justification": "Section 5.2 and Appendix Table 10 describe dataset sources, the 1024-token document segmentation strategy, and the 80/20 proxy/test query split.",
           "source": "haiku"
         }
       },
       "data_integrity": {
         "raw_data_available": {
           "applies": true,
           "answer": false,
           "justification": "Raw experimental outputs (per-query LLM responses) are not available; only aggregated ASR and Precision@k metrics are reported in tables.",
           "source": "haiku"
         },
         "data_collection_described": {
           "applies": true,
           "answer": true,
           "justification": "Section 5.2 describes the dataset construction process: source benchmarks, language selection rationale, document segmentation, and query subset separation are all documented.",
           "source": "haiku"
         },
         "recruitment_methods_described": {
           "applies": false,
           "answer": false,
           "justification": "No human participants were recruited; all experiments use automated LLM queries on public code datasets.",
           "source": "haiku"
         },
         "data_pipeline_documented": {
           "applies": true,
           "answer": true,
           "justification": "The full pipeline from proxy query acquisition through document poisoning to evaluation is documented across Sections 4 and 5, including the bidirectional retrieval mapping formula.",
           "source": "haiku"
         }
       },
       "contamination": {
         "training_cutoff_stated": {
           "applies": false,
           "answer": false,
           "justification": "This paper evaluates security vulnerabilities of LLMs in a RAG context rather than measuring model knowledge on benchmarks, so training cutoff is not relevant to the validity of results.",
           "source": "haiku"
         },
         "train_test_overlap_discussed": {
           "applies": false,
           "answer": false,
           "justification": "Not applicable; the attack exploits LLM instruction-following and trust in retrieved documents, not memorization of test cases from training data.",
           "source": "haiku"
         },
         "benchmark_contamination_addressed": {
           "applies": false,
           "answer": false,
           "justification": "Not applicable; the evaluation measures attack success rate against LLM-generated code recommendations, not performance on a benchmark the model may have seen during training.",
           "source": "haiku"
         }
       },
       "human_studies": {
         "pre_registered": {
           "applies": false,
           "answer": false,
           "justification": "No human participants involved.",
           "source": "haiku"
         },
         "irb_or_ethics_approval": {
           "applies": false,
           "answer": false,
           "justification": "No human participants involved.",
           "source": "haiku"
         },
         "demographics_reported": {
           "applies": false,
           "answer": false,
           "justification": "No human participants involved.",
           "source": "haiku"
         },
         "inclusion_exclusion_criteria": {
           "applies": false,
           "answer": false,
           "justification": "No human participants involved.",
           "source": "haiku"
         },
         "randomization_described": {
           "applies": false,
           "answer": false,
           "justification": "No human participants involved.",
           "source": "haiku"
         },
         "blinding_described": {
           "applies": false,
           "answer": false,
           "justification": "No human participants involved.",
           "source": "haiku"
         },
         "attrition_reported": {
           "applies": false,
           "answer": false,
           "justification": "No human participants involved.",
           "source": "haiku"
         }
       },
       "cost_and_practicality": {
         "inference_cost_reported": {
           "applies": true,
           "answer": true,
           "justification": "Average Processing Time (APT) per document is reported in Table 3 (e.g., 519.06s for LLama3.2-3B on matplotlib_safe), enabling practitioners to estimate attack cost.",
           "source": "haiku"
         },
         "compute_budget_stated": {
           "applies": true,
           "answer": false,
           "justification": "No total GPU compute budget or training/search compute cost is stated; only per-document APT is given for the inducing sequence generation step.",
           "source": "haiku"
         }
       }
     }
   },
   "claims": [
     {
       "claim": "ImportSnare achieves over 50% attack success rate against popular libraries such as matplotlib and seaborn on state-of-the-art LLMs including GPT-4o and Claude-3.5-Sonnet.",
       "evidence": "Table 1 shows matplotlib_safe at 67.7% ASR on GPT-4o and 25.8% on Claude-3.5-Sonnet; multiple seaborn variants exceed 50% on several LLMs (e.g., malware_seaborn: 53.3% on GPT-4o, 26.7% on Claude-3.5-Sonnet). Claude-3.5-Sonnet exceeds 50% on all five Rust targets.",
       "supported": "moderate"
     },
     {
       "claim": "The attack remains effective at poisoning ratios as low as 0.01% of the total RAG database.",
       "evidence": "Figure 4 shows ASR improvement beginning when poisoned documents constitute ≥3% of relevant documents (0.01% of total database), with ASR rising from 0 to ~0.15 at that threshold for matplotlib_safe on DeepSeek-v3.",
       "supported": "moderate"
     },
     {
       "claim": "Position-aware beam search (ImportSnare-R) substantially improves retrieval ranking of poisoned documents over HotFlip.",
       "evidence": "Table 2 shows ImportSnare achieves Precision@k of 7.42 vs HotFlip's 4.69 for matplotlib_safe, and ASR of 0.677 vs 0.387 on GPT-4o-mini.",
       "supported": "strong"
     },
     {
       "claim": "Multilingual inductive suggestions (ImportSnare-G) substantially improve LLM generation success over ReMiss jailbreaking.",
       "evidence": "Table 2 shows ReMiss achieves near-zero ASR across all packages (0.000 for 8 of 12 targets) compared to ImportSnare's substantially higher rates; Figure 5 ablation confirms the G component's independent contribution.",
       "supported": "strong"
     },
     {
       "claim": "Code generation quality (security issues, syntax errors) is not statistically significantly degraded by document poisoning.",
       "evidence": "Table 5 reports Wilcoxon signed-rank tests with Bonferroni correction showing no significant differences (all p_Wilcoxon > α' = 0.0125) in Bandit, Pylint, or Flake8 metrics between poisoned and clean conditions.",
       "supported": "strong"
     },
     {
       "claim": "LLMs exhibit strong dependency monopolization — DeepSeek-v3 recommends sklearn in 100/100 trials, GPT-4o in 98/100.",
       "evidence": "Section 2.2 reports empirical results from 100-trial completion experiments at temperature=0 and at higher temperatures (0.5, 0.7, 1.0), all showing near-uniform recommendations.",
       "supported": "strong"
     },
     {
       "claim": "The attack transfers across retrieval models, though effectiveness degrades on non-proxy models.",
       "evidence": "Table 6 shows ASR drops from 0.360 to 0.012 for pandas_v2 when switching from the proxy retriever (gte-base-en-v1.5) to bge-base-en-v1.5; some cross-retriever attacks remain viable.",
       "supported": "strong"
     }
   ],
   "methodology_tags": [
     "benchmark-eval",
     "case-study"
   ],
   "key_findings": "ImportSnare demonstrates that RAG-based code generation systems can be exploited via poisoned documentation to recommend malicious package dependencies, achieving 50%+ attack success rates against popular Python and Rust libraries on frontier LLMs (GPT-4o, DeepSeek-r1, Claude-3.5-Sonnet) with poisoning ratios as low as 0.01% of the total database. The attack combines gradient-based retrieval manipulation (position-aware beam search) with multilingual inductive suggestions to exploit a dual trust chain — LLM reliance on retrieved context and developer trust in LLM suggestions. Notably, code quality metrics are not significantly degraded by poisoning, making attacks stealthy. Current LLM-based detection mitigations show partial effectiveness but are operationally costly.",
   "red_flags": [
     {
       "flag": "No error bars on main results",
       "detail": "All ASR and Precision@k values in Tables 1-4 are single-run measurements with temperature=0; no variance estimates are provided for the primary comparative claims."
     },
     {
       "flag": "Very small per-variant test sets",
       "detail": "For seaborn ablation experiments, the test set appears to be ~15 queries (inferred from fractional ASR values like 0.333=5/15), making per-variant estimates highly unreliable."
     },
     {
       "flag": "Model versions not pinned",
       "detail": "GPT-4o, Claude-3.5-Sonnet, DeepSeek-r1 and other commercial models are named without API snapshot dates, making exact reproduction impossible as model behavior changes with updates."
     },
     {
       "flag": "Code/artifacts not verifiably released",
       "detail": "The abstract says 'we will release' while the body says 'are available' on the project homepage; no direct code repository URL (GitHub/Zenodo) is provided, and availability cannot be verified."
     },
     {
       "flag": "Real-world coding agent results qualitative only",
       "detail": "Attacks on Copilot and Cursor (Appendix A.3) are shown only as screenshots with no quantitative metrics; the paper explicitly states 'large-scale testing on such agents is challenging, so we do not report quantitative metrics.'"
     },
     {
       "flag": "ASR-to-harm proxy gap underdiscussed",
       "detail": "ASR measures target package appearing in import statements, but actual supply chain compromise requires the developer to also copy, run, and pip-install the suggested package; this multi-step victim behavior is assumed but not empirically measured."
     }
   ],
   "cited_papers": [
     {
       "title": "PoisonedRAG: Knowledge Poisoning Attacks to Retrieval-Augmented Generation of Large Language Models",
       "relevance": "Primary prior work on RAG poisoning that ImportSnare directly extends and compares against; key difference is ImportSnare works without prior query knowledge."
     },
     {
       "title": "CodeRAG-Bench: Can Retrieval Augment Code Generation?",
       "relevance": "Establishes that RAG improves code generation, motivating the attack surface explored in ImportSnare."
     },
     {
       "title": "Evaluating Large Language Models Trained on Code (Codex/HumanEval)",
       "relevance": "Foundational work on LLM code generation capabilities and dependency monopolization behavior replicated in Section 2.2."
     },
     {
       "title": "Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks",
       "relevance": "Provides taxonomy of malicious package naming strategies (typosquatting, dependency confusion) used to design target packages in ImportSnare experiments."
     },
     {
       "title": "Jailbreaking as a Reward Misspecification Problem (ReMiss)",
       "relevance": "Baseline jailbreaking method compared against ImportSnare-G in Table 2."
     },
     {
       "title": "HotFlip: White-box Adversarial Examples for Text Classification",
       "relevance": "Baseline retrieval attack method and algorithmic inspiration for ImportSnare-R's gradient-guided token optimization."
     },
     {
       "title": "Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents",
       "relevance": "Concurrent work on RAG adversarial attacks with a different goal (refusal induction vs dependency hijacking)."
     },
     {
       "title": "Exploring the Security Threats of Knowledge Base Poisoning in Retrieval-Augmented Code Generation",
       "relevance": "Most closely related concurrent work directly in the RACG poisoning space."
     },
     {
       "title": "A Survey on Large Language Models for Code Generation",
       "relevance": "Establishes context for LLM code generation adoption that motivates the attack surface."
     },
     {
       "title": "Security Attacks on LLM-based Code Completion Tools",
       "relevance": "Related work on adversarial attacks targeting LLM coding tools, situating ImportSnare in broader code security literature."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 3,
       "justification": "Directly affects anyone using AI coding assistants (Copilot, Cursor, ChatGPT) with RAG — a rapidly growing population of developers."
     },
     "surprise_contrarian": {
       "score": 2,
       "justification": "The specific mechanism (poisoning code manuals to inject malicious dependencies) is novel, but RAG poisoning and supply chain risk are known concerns; the unusually low poisoning threshold (0.01%) is the most surprising finding."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Raises concrete AI safety concerns: frontier models including Claude and GPT-4o can be weaponized for supply chain attacks with minimal attacker resources."
     },
     "drama_conflict": {
       "score": 2,
       "justification": "Names Claude-3.5-Sonnet, GPT-4o, Copilot, and Cursor as vulnerable; shows Cursor/Copilot screenshots being tricked — recognizable products make the threat tangible."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Project homepage exists and screenshots of Copilot/Cursor being tricked are shown, but full pipeline reproducibility requires the (not-yet-confirmed-available) code release."
     },
     "brand_recognition": {
       "score": 2,
       "justification": "Tests Claude-3.5-Sonnet, GPT-4o, DeepSeek, Copilot, and Cursor — multiple high-recognition AI brands are directly implicated as vulnerable."
     }
   },
   "hn_data": {
     "threads": [
       {
         "hn_id": "41563267",
         "title": "Single prompt achieves competitive results with o1-preview",
         "points": 3,
         "comments": 1,
         "url": "https://news.ycombinator.com/item?id=41563267"
       },
       {
         "hn_id": "44019865",
         "title": "SciCom Wiki",
         "points": 3,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=44019865"
       },
       {
         "hn_id": "39881927",
         "title": "WarpCore: A Library for Fast Hash Tables on GPUs",
         "points": 3,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=39881927"
       },
       {
         "hn_id": "33636271",
         "title": "Dala: A Simple Capability-Based Dynamic Language Design for Data Race-Freedom",
         "points": 3,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=33636271"
       },
       {
         "hn_id": "45179163",
         "title": "Outcome-Based Exploration for LLM Reasoning",
         "points": 2,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=45179163"
       },
       {
         "hn_id": "28626311",
         "title": "The Theoretical Limit of Radar Target Detection",
         "points": 2,
         "comments": 6,
         "url": "https://news.ycombinator.com/item?id=28626311"
       },
       {
         "hn_id": "43651912",
         "title": "KIMI-VL (Efficient Open-Source Moe VLM) Techical Report",
         "points": 1,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=43651912"
       },
       {
         "hn_id": "43171326",
         "title": "SHACL-SKOS Based Representation of Material Safety Data Sheet (SDS)",
         "points": 1,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=43171326"
       },
       {
         "hn_id": "37641271",
         "title": "Masked Generative Modeling with Enhanced Sampling Scheme",
         "points": 1,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=37641271"
       },
       {
         "hn_id": "10329999",
         "title": "Sparse Linear Solving on Massive GPU Clusters",
         "points": 1,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=10329999"
       }
     ],
     "top_points": 3,
     "total_points": 20,
     "total_comments": 7
   }
 }