ai-research-survey

scan-v5.json (31901B)

---

 {
   "scan_version": 5,
   "paper_type": "empirical",
   "paper": {
     "title": "Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain",
     "authors": [
       "Léo Boisvert",
       "Abhay Puri",
       "Chandra Kiran Reddy Evuru",
       "Nicolas Chapados",
       "Quentin Cappart",
       "Alexandre Lacoste",
       "Krishnamurthy (DJ) Dvijotham",
       "Alexandre Drouin"
     ],
     "year": 2025,
     "venue": "arXiv.org",
     "arxiv_id": "2510.05159",
     "doi": "10.48550/arXiv.2510.05159"
   },
   "checklist": {
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract's key quantitative claims (2% poisoning → 80%+ ASR, defenses failing across all three threat models) are directly supported by Tables 2, 3, and the Watch the Weights analysis in Section 5.3.",
         "source": "haiku"
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Controlled experiments vary poison rate as the single manipulated variable while holding other factors constant, and they include clean baseline conditions, which is adequate for causal inference about data poisoning causing backdoor implantation.",
         "source": "haiku"
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims the vulnerability holds across 'the agentic AI supply chain' broadly, but experiments are limited to two benchmarks (τ-bench retail/airline, WebArena-Lite) and three model sizes; broader generalization to other agent architectures or tasks is asserted but not demonstrated.",
         "source": "haiku"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not consider alternative explanations for defense failures beyond their stated reasoning; for example, they do not explore whether better-calibrated guardrail models or different detection thresholds could work, nor whether the benchmarks' specific structure makes attacks easier than realistic deployments.",
         "source": "haiku"
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "TSR (task success rate) and ASR (attack success rate) are clearly defined and directly measure the constructs claimed—benign utility and backdoor activation respectively—with no conflation between proxy and target.",
         "source": "haiku"
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations or threats-to-validity section; the paper has a Discussion/Conclusion section and future work directions but these do not constitute a formal limitations analysis.",
         "source": "haiku"
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No specific threats to validity are discussed; the paper does not acknowledge that results on two synthetic benchmarks with small test sets (25–165 tasks) may not generalize, or that the controlled poisoning scenarios may not reflect realistic attacker constraints.",
         "source": "haiku"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what results do NOT show; for instance, it does not clarify that results are limited to SFT fine-tuning pipelines, that RLHF-trained models are untested, or that real enterprise deployments may have additional safeguards not evaluated here.",
         "source": "haiku"
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "The acknowledgments thank ServiceNow colleagues for compute resources but there is no formal funding disclosure statement; the primary affiliation (ServiceNow Research) suggests institutional support without explicit declaration.",
         "source": "haiku"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are fully disclosed in the paper header: ServiceNow Research, Mila - Québec AI Institute, Polytechnique Montréal, and Université Laval.",
         "source": "haiku"
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "ServiceNow is a major AI agent platform provider with a business interest in AI agent security awareness; six of eight authors are ServiceNow employees, creating a non-independent relationship between primary funder/employer and the domain being studied.",
         "source": "haiku"
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "There is no competing interests statement or financial interests declaration in the paper.",
         "source": "haiku"
       }
     },
     "scope_and_framing": {
       "key_terms_defined": {
         "applies": true,
         "answer": true,
         "justification": "Key terms are precisely defined: 'agent' is formalized as a policy π mapping observations to action distributions, 'backdoor' and 'trigger' are formally defined mathematically, and ASR/TSR metrics are explicitly defined in Section 4.",
         "source": "haiku"
       },
       "intended_contribution_clear": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly lists four numbered contributions in Section 1: a threat model taxonomy, empirical demonstration across two benchmarks, evaluation of defenses, and a call for new strategies.",
         "source": "haiku"
       },
       "engagement_with_prior_work": {
         "applies": true,
         "answer": true,
         "justification": "Section 2 provides substantive engagement with three streams of prior work (inference-time attacks, non-agentic data poisoning, backdooring attacks), explicitly differentiating this work as the first to situate backdoor attacks within the agentic supply chain context.",
         "source": "haiku"
       }
     }
   },
   "type_checklist": {
     "empirical": {
       "artifacts": {
         "code_released": {
           "applies": true,
           "answer": false,
           "justification": "No code release is mentioned in the paper; references to DoomArena are to a separate arxiv preprint, and the paper itself provides no repository link or code release.",
           "source": "haiku"
         },
         "data_released": {
           "applies": true,
           "answer": true,
           "justification": "Evaluation benchmarks (τ-bench and WebArena-Lite) are publicly available, and the NNetNav-WA fine-tuning dataset used is from a public prior work; however, the poisoned training datasets generated by the authors are not released.",
           "source": "haiku"
         },
         "environment_specified": {
           "applies": true,
           "answer": true,
           "justification": "Section C provides detailed environment specifications: 8×A100 80GB GPUs, DeepSpeed ZeRO-2/3, Flash Attention 2, LLaMA-Factory framework, batch sizes, learning rates, context lengths, and precision settings.",
           "source": "haiku"
         },
         "reproduction_instructions": {
           "applies": true,
           "answer": false,
           "justification": "Hyperparameters are documented in Section C and attack examples in appendices, but there are no step-by-step reproduction instructions; the code pipeline for generating poisoned data, running fine-tuning, and evaluating attacks is not provided in executable form.",
           "source": "haiku"
         }
       },
       "statistical_methodology": {
         "confidence_intervals_or_error_bars": {
           "applies": true,
           "answer": true,
           "justification": "Standard deviations are reported for all main results (TSR ± STD, ASR ± STD) across all tables, with 3 trials for τ-bench and 2 trials for WebArena.",
           "source": "haiku"
         },
         "significance_tests": {
           "applies": true,
           "answer": false,
           "justification": "No formal statistical significance tests are used; the paper relies on descriptive statistics and large effect sizes (ASR near 0% vs 100%) rather than formal hypothesis testing for comparative claims.",
           "source": "haiku"
         },
         "effect_sizes_reported": {
           "applies": true,
           "answer": true,
           "justification": "Absolute performance values with baselines are reported throughout (e.g., ASR jumping from 0% to 100%, TSR increasing from 22.61% zero-shot to 39-41% fine-tuned), making effect sizes implicit and interpretable.",
           "source": "haiku"
         },
         "sample_size_justified": {
           "applies": true,
           "answer": false,
           "justification": "The choice of 3 trials for τ-bench and 2 for WebArena is justified only by 'higher computational cost,' with no power analysis or justification for why 2-3 trials are sufficient given the observed variance.",
           "source": "haiku"
         },
         "variance_reported": {
           "applies": true,
           "answer": true,
           "justification": "Standard deviations are consistently reported for all TSR and ASR measurements across all experimental conditions in Tables 2-12.",
           "source": "haiku"
         }
       },
       "evaluation_design": {
         "baselines_included": {
           "applies": true,
           "answer": true,
           "justification": "Zero-shot baselines and clean fine-tuning baselines (0% poison) are included for all experiments, providing clear reference points for measuring attack effectiveness.",
           "source": "haiku"
         },
         "baselines_contemporary": {
           "applies": true,
           "answer": true,
           "justification": "Defense baselines include contemporary state-of-the-art guardrail models (Llama-Firewall from 2025, Granite Guardian 3.3-8B from 2025) and Watch the Weights (2025), all current at the time of publication.",
           "source": "haiku"
         },
         "ablation_study": {
           "applies": true,
           "answer": true,
           "justification": "Figure 3 systematically varies poison rate ρ across multiple values (5%, 25%, 50%) to isolate the effect of poisoning intensity, and TM3 varies the number of clean fine-tuning steps to study backdoor persistence.",
           "source": "haiku"
         },
         "multiple_metrics": {
           "applies": true,
           "answer": true,
           "justification": "Two complementary metrics are used throughout: TSR (task success rate measuring benign utility) and ASR (attack success rate measuring backdoor effectiveness), as well as ASR- (false activation rate).",
           "source": "haiku"
         },
         "human_evaluation": {
           "applies": false,
           "answer": false,
           "justification": "Human evaluation is not applicable; the study evaluates automated agent behavior and attack/defense metrics that can be assessed computationally through benchmark task success and backdoor activation.",
           "source": "haiku"
         },
         "held_out_test_set": {
           "applies": true,
           "answer": true,
           "justification": "All evaluations use held-out test sets distinct from training data: τ-bench retail test domain (115 tasks), τ-bench airline domain (25 tasks for TM3), and WebArena-Lite (165 tasks).",
           "source": "haiku"
         },
         "per_category_breakdown": {
           "applies": true,
           "answer": true,
           "justification": "Results are broken down by threat model (TM1/2/3), benchmark (τ-bench vs WebArena), model size (3B vs 7B), and defense type, providing granular analysis across multiple dimensions.",
           "source": "haiku"
         },
         "failure_cases_discussed": {
           "applies": true,
           "answer": true,
           "justification": "The Qwen 50% poison rate ASR decline in WebArena (Table 5 appendix) is explicitly analyzed as a failure case attributed to the model selection criterion, and Watch the Weights' 97-100% FPR is discussed as a failure mode.",
           "source": "haiku"
         },
         "negative_results_reported": {
           "applies": true,
           "answer": true,
           "justification": "Defense failures are extensively reported as negative results (all three tested defenses failing), and the cross-domain backdoor transfer degradation (Table 8) shows partial failure of attack at low poison rates.",
           "source": "haiku"
         }
       },
       "setup_transparency": {
         "model_versions_specified": {
           "applies": true,
           "answer": true,
           "justification": "Exact model versions are specified throughout: Qwen-2.5-3B-Instruct, Qwen-2.5-7B-Instruct, Llama-3.1-8B-Instruct, Qwen-2.5-72B-Instruct (teacher), GPT-4o (simulated user), and GPT-5 variants for judge experiments.",
           "source": "haiku"
         },
         "prompts_provided": {
           "applies": true,
           "answer": true,
           "justification": "Complete prompt examples are provided: web agent system prompt (Section B.1), LLM-as-judge prompts (Section D), and the full prompt injection strings used for TM2 (Sections E.1.2 and E.2.2).",
           "source": "haiku"
         },
         "hyperparameters_reported": {
           "applies": true,
           "answer": true,
           "justification": "Section C provides comprehensive hyperparameters: learning rates (1e-5, 1e-6), batch sizes, context lengths (16,384 and 20,000 tokens), epochs, warmup ratios, gradient norms, and LoRA rank settings.",
           "source": "haiku"
         },
         "scaffolding_described": {
           "applies": true,
           "answer": true,
           "justification": "Agent scaffolding is described in detail: the NNetNavBrowserGymAgent with enhanced API call action set for WebArena (Section B.1), and the tool-calling agent architecture with GPT-4o as simulated user for τ-bench.",
           "source": "haiku"
         },
         "data_preprocessing_documented": {
           "applies": true,
           "answer": true,
           "justification": "Data preprocessing is documented: how poisoned traces are created (trigger injection via hidden div elements, malicious tool call insertion), how clean traces are filtered (reward=1 only), and how training/validation splits are made (90/10).",
           "source": "haiku"
         }
       },
       "data_integrity": {
         "raw_data_available": {
           "applies": true,
           "answer": false,
           "justification": "The poisoned training datasets generated by the authors are not released; only the public benchmark sources are available, and the specific poisoned traces used in experiments cannot be independently verified.",
           "source": "haiku"
         },
         "data_collection_described": {
           "applies": true,
           "answer": true,
           "justification": "Data collection procedures are described in detail: Qwen-2.5-72B as teacher with GPT-4o as simulated user, 10 independent trials retaining successful trajectories (reward=1), yielding 4,000 samples split 90/10.",
           "source": "haiku"
         },
         "recruitment_methods_described": {
           "applies": false,
           "answer": false,
           "justification": "No human participants; all data is generated synthetically using LLMs as teacher agents and simulated users in automated benchmark environments.",
           "source": "haiku"
         },
         "data_pipeline_documented": {
           "applies": true,
           "answer": true,
           "justification": "The full pipeline is documented: base model selection → data collection (teacher model in environment) → poisoning injection → fine-tuning (SFT with documented hyperparameters) → evaluation (TSR/ASR on held-out test sets).",
           "source": "haiku"
         }
       },
       "contamination": {
         "training_cutoff_stated": {
           "applies": true,
           "answer": false,
           "justification": "The training data cutoffs for Qwen-2.5 and Llama-3.1 base models are not stated; the paper does not address whether the base models' pre-training data included WebArena or τ-bench task descriptions.",
           "source": "haiku"
         },
         "train_test_overlap_discussed": {
           "applies": true,
           "answer": false,
           "justification": "Potential overlap between base model pre-training data and the τ-bench/WebArena test tasks is not discussed; this could confound the zero-shot baseline performance and the interpretation of fine-tuning improvements.",
           "source": "haiku"
         },
         "benchmark_contamination_addressed": {
           "applies": true,
           "answer": false,
           "justification": "The paper does not address whether WebArena or τ-bench examples were available before the Qwen-2.5 or Llama-3.1 training cutoffs, which could affect the validity of the zero-shot baselines used as attack comparisons.",
           "source": "haiku"
         }
       },
       "human_studies": {
         "pre_registered": {
           "applies": false,
           "answer": false,
           "justification": "No human participants in this study; all experiments use automated AI agents and LLM-generated synthetic interactions.",
           "source": "haiku"
         },
         "irb_or_ethics_approval": {
           "applies": false,
           "answer": false,
           "justification": "No human participants; IRB/ethics approval is not applicable. The paper has an ethics statement discussing responsible disclosure but no IRB process.",
           "source": "haiku"
         },
         "demographics_reported": {
           "applies": false,
           "answer": false,
           "justification": "No human participants.",
           "source": "haiku"
         },
         "inclusion_exclusion_criteria": {
           "applies": false,
           "answer": false,
           "justification": "No human participants.",
           "source": "haiku"
         },
         "randomization_described": {
           "applies": false,
           "answer": false,
           "justification": "No human participants; multiple trials were run but randomization procedures for trial design are not described.",
           "source": "haiku"
         },
         "blinding_described": {
           "applies": false,
           "answer": false,
           "justification": "No human participants.",
           "source": "haiku"
         },
         "attrition_reported": {
           "applies": false,
           "answer": false,
           "justification": "No human participants.",
           "source": "haiku"
         }
       },
       "cost_and_practicality": {
         "inference_cost_reported": {
           "applies": true,
           "answer": false,
           "justification": "Inference costs (API calls to GPT-4o as simulated user, GPT-5 as judge) are not reported; only training compute is described.",
           "source": "haiku"
         },
         "compute_budget_stated": {
           "applies": true,
           "answer": true,
           "justification": "Training compute is reported: 8×A100 80GB GPUs for 5-6 hours (τ-bench TM1/2) and 15-20 hours (WebArena), giving a concrete sense of the computational investment required.",
           "source": "haiku"
         }
       }
     }
   },
   "claims": [
     {
       "claim": "Poisoning as few as 2% of fine-tuning traces embeds a backdoor with over 80% attack success rate, while preserving or improving benign task performance",
       "evidence": "Table 3: WebArena TM2 at 2.3% poison rate achieves 91.65% ASR with TSR of 16.27% (vs 0.6% baseline); τ-bench TM2 at 5% achieves 100% ASR with TSR 43.77% (vs 22.61% baseline)",
       "supported": "strong"
     },
     {
       "claim": "State-of-the-art guardrail models (Llama-Firewall, Granite Guardian) fail to detect backdoored behavior at both data-screening and evaluation-time stages",
       "evidence": "Tables 11-12: TP rates for data screening are 0-7% with FP rates at similar levels; Tables 2-3 show ASR remains near 100% with guardrails active at evaluation time",
       "supported": "strong"
     },
     {
       "claim": "Backdoors survive extensive clean fine-tuning (TM3): ASR remains above 90% in τ-bench and near 100% in WebArena after thousands of clean training steps",
       "evidence": "Figure 4 shows ASR persistence for Qwen-2.5-3B and Llama-3.1-8B across clean fine-tuning checkpoints; Table 10 confirms ASR=100% after 1,000 clean LoRA samples",
       "supported": "strong"
     },
     {
       "claim": "The Watch the Weights weight-based defense achieves 97-100% false positive rate, rendering it practically unusable in realistic deployment scenarios",
       "evidence": "Section 5.3 explicitly reports 97% FPR on τ-bench and 100% FPR on WebArena, attributed to domain mismatch between calibration data and deployment context",
       "supported": "strong"
     },
     {
       "claim": "LLM-as-judge defenses work effectively in WebArena (up to 100% TP, 0% FP) but fail in τ-bench due to lack of task context",
       "evidence": "Table 4: GPT-5 mini achieves 100% TP / 0% FP on WebArena but 0% TP / 89% FP on τ-bench; GPT-5 nano achieves 87.5% TP but 59% FP on τ-bench",
       "supported": "moderate"
     },
     {
       "claim": "Backdoored models outperform clean zero-shot baselines on benign tasks, creating a perverse incentive structure that masks compromise",
       "evidence": "Across all tables, fine-tuned backdoored models consistently improve TSR over zero-shot baselines (e.g., τ-bench: 22.61% → 39-43%; WebArena: 0.6% → 14-16%), even at high poison rates",
       "supported": "strong"
     }
   ],
   "methodology_tags": [
     "benchmark-eval",
     "case-study"
   ],
   "key_findings": "AI agent supply chains are highly vulnerable to trigger-based backdoor attacks across three distinct attack vectors (direct data poisoning, environmental poisoning, and backdoored base models), all achievable with minimal poisoning rates (2-5%). A critical and counterintuitive finding is that backdoored models simultaneously improve on benign task performance compared to clean baselines, making the compromise nearly undetectable through standard performance monitoring. All evaluated state-of-the-art defenses—two guardrail models and one weight-based detector—fail to reliably detect or prevent these attacks, with LLM-as-judge approaches only partially effective in one of two benchmark settings. Backdoors persist through extensive clean fine-tuning, including LoRA, posing a severe supply chain risk for organizations downloading and fine-tuning open-weight models.",
   "red_flags": [
     {
       "flag": "No limitations section",
       "detail": "The paper has no dedicated limitations or threats-to-validity section; the absence is notable given the small test sets (as few as 25 tasks for TM3 airline evaluation) and only two benchmark environments tested."
     },
     {
       "flag": "No funding disclosure",
       "detail": "No formal funding statement appears despite most authors being ServiceNow employees and ServiceNow being a direct commercial participant in the AI agent market the paper discusses."
     },
     {
       "flag": "Watch the Weights evaluated with domain mismatch",
       "detail": "The Watch the Weights defense is calibrated on one domain (retail/NNetNav) and evaluated on another (airline/WebArena), which the authors acknowledge causes the 97-100% FPR—but they present this as a defense failure rather than an unfair evaluation condition."
     },
     {
       "flag": "Small TM3 evaluation set",
       "detail": "TM3 (backdoored base model) is evaluated on only 25 airline test tasks in τ-bench across 3 trials, providing limited statistical power for claims about backdoor persistence."
     },
     {
       "flag": "No code or poisoned data released",
       "detail": "The poisoned training datasets and attack pipeline code are not released, making independent verification of the attack effectiveness impossible without recreating the entire experimental setup."
     },
     {
       "flag": "Overbroad generalization",
       "detail": "Conclusions are framed as applying to 'the agentic AI supply chain' broadly, but experiments cover only SFT-based fine-tuning pipelines on two benchmarks; RLHF-trained models, other agent architectures, and other task domains are not tested."
     },
     {
       "flag": "No contamination discussion",
       "detail": "The paper does not address whether Qwen-2.5 or Llama-3.1 pre-training data included WebArena or τ-bench examples, which could confound baseline performance and the interpretation of fine-tuning gains."
     }
   ],
   "cited_papers": [
     {
       "title": "τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains",
       "relevance": "Primary evaluation benchmark; the retail and airline environments are used across all three threat models"
     },
     {
       "title": "WebArena: A Realistic Web Environment for Building Autonomous Agents",
       "relevance": "Second primary evaluation benchmark; WebArena-Lite subset used for web agent backdoor experiments"
     },
     {
       "title": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training",
       "relevance": "Foundational prior work on backdoor persistence in LLMs; TM3 directly tests whether their findings extend to agentic fine-tuning settings"
     },
     {
       "title": "DoomArena: A Framework for Testing AI Agents Against Evolving Security Threats",
       "relevance": "Framework used for trigger injection in WebArena experiments; authored by some of the same team"
     },
     {
       "title": "NNetNav: Unsupervised Learning of Browser Agents Through Environment Interaction in the Wild",
       "relevance": "Source of WebArena fine-tuning dataset (NNetNav-WA) and TM2 data collection methodology"
     },
     {
       "title": "LlamaFirewall: An Open Source Guardrail System for Building Secure AI Agents",
       "relevance": "One of two guardrail defenses evaluated; found ineffective at both data screening and evaluation-time defense"
     },
     {
       "title": "Watch the Weights: Unsupervised Monitoring and Control of Fine-Tuned LLMs",
       "relevance": "Weight-based defense evaluated for TM3; found to have near-100% false positive rate in realistic deployment scenarios"
     },
     {
       "title": "AgentPoison: Red-Teaming LLM Agents via Poisoning Memory or Knowledge Bases",
       "relevance": "Related backdoor attack work against LLM agents; establishes prior art for the attack vector studied"
     },
     {
       "title": "EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage",
       "relevance": "Prior work on environmental injection attacks; TM2 extends this concept to the training/data collection phase rather than deployment"
     },
     {
       "title": "Poisoning Web-Scale Training Datasets is Practical",
       "relevance": "Establishes feasibility of data poisoning attacks at scale; motivates the threat model for TM1"
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 3,
       "justification": "Directly threatens any organization using open-weight models or third-party fine-tuning data for AI agents, with specific named enterprise platforms (Microsoft Copilot, ServiceNow, Salesforce Agentforce) called out."
     },
     "surprise_contrarian": {
       "score": 2,
       "justification": "The finding that backdoored models outperform clean baselines on benign tasks—making detection harder the more capable the model—is counterintuitive and challenges the assumption that better-performing models are safer."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Explicitly demonstrates that AI agents can be covertly turned into data exfiltration tools, with concrete success rates and scenarios involving user confidential information leakage."
     },
     "drama_conflict": {
       "score": 2,
       "justification": "Frames the threat against named commercial AI agent platforms and draws parallels to SolarWinds and xz-utils supply chain attacks, creating a compelling adversarial narrative."
     },
     "demo_ability": {
       "score": 1,
       "justification": "Uses public benchmarks (τ-bench, WebArena) that practitioners could access, but no code is released and the full experimental pipeline would require significant reproduction effort."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "ServiceNow Research and Mila have moderate recognition in the ML community but are not top-tier lab brands (OpenAI, Google DeepMind, Anthropic) that drive outsized attention."
     }
   },
   "hn_data": {
     "threads": [
       {
         "hn_id": "33227427",
         "title": "Neural Networks Are Decision Trees",
         "points": 34,
         "comments": 9,
         "url": "https://news.ycombinator.com/item?id=33227427",
         "created_at": "2022-10-16T21:43:27Z"
       },
       {
         "hn_id": "33232042",
         "title": "Neural Networks Are Decision Trees",
         "points": 4,
         "comments": 2,
         "url": "https://news.ycombinator.com/item?id=33232042",
         "created_at": "2022-10-17T11:18:16Z"
       },
       {
         "hn_id": "33200244",
         "title": "Neural Networks Are Decision Trees",
         "points": 4,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=33200244",
         "created_at": "2022-10-14T06:28:28Z"
       },
       {
         "hn_id": "42911219",
         "title": "High-resolution imaging of radio source associated with Dyson Sphere Candidate G",
         "points": 3,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=42911219",
         "created_at": "2025-02-02T19:53:54Z"
       },
       {
         "hn_id": "33192776",
         "title": "Neural Networks Are Decision Trees",
         "points": 3,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=33192776",
         "created_at": "2022-10-13T15:57:00Z"
       },
       {
         "hn_id": "41741744",
         "title": "Mitigating Memorization in Language Models",
         "points": 2,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=41741744",
         "created_at": "2024-10-04T14:23:05Z"
       },
       {
         "hn_id": "33303465",
         "title": "Grounded Language Model Reasoning Through Simulation",
         "points": 2,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=33303465",
         "created_at": "2022-10-23T00:33:43Z"
       },
       {
         "hn_id": "45538593",
         "title": "New paper: A single character can make or break your LLM evals",
         "points": 1,
         "comments": 1,
         "url": "https://news.ycombinator.com/item?id=45538593",
         "created_at": "2025-10-10T13:09:51Z"
       },
       {
         "hn_id": "46151267",
         "title": "Generative Graph Vocabularies for Robust Graph Foundation Models Fine-Tuning",
         "points": 1,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=46151267",
         "created_at": "2025-12-04T18:46:47Z"
       },
       {
         "hn_id": "42021531",
         "title": "Understanding Warmup-Stable-Decay Learning Rates",
         "points": 1,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=42021531",
         "created_at": "2024-11-01T21:02:29Z"
       }
     ],
     "top_points": 34,
     "total_points": 55,
     "total_comments": 12
   }
 }