Research digest, week of 10 November 2026
Eight arXiv papers on LoRA capacity, edge weight compression, RAG citation provenance, prompt-injection defences, data-free model merging, output formats for small parsers, SFT versus RL, and CUDA kernels.
This week’s papers share a mood of measuring things people assumed. Two of them take apart folk wisdom about fine-tuning. The LoRA capacity paper finds adapters rarely use the rank they are configured with and proposes a regulariser to make them, while the NeurIPS paper on SFT versus RL argues that much of RL’s reputation for generalisation is an artefact of the SFT data it was compared against.
Two more are about trust in agent and retrieval systems. The RAG provenance study shows that a cited passage is weak evidence that the model used it, and that natural language inference checks are no better than chance at catching the difference. CapLite shows that small-model agents cannot be trusted to write their own security policies and offers a schema-derived alternative that held on AgentDojo.
The rest are tools you can pick up. LazyWeights compresses existing quantised weights further and decodes them on demand, at the cost of new hardware. Joint null-space projection merges checkpoints with no data. The semantic parsing paper shows output format alone changes the silent error rate of sub-billion parsers. KernelMosaic gives a dataset for training small models to write CUDA kernels that beat PyTorch eager.
Maximizing Capacity Utilization of LoRA Adapters for Mitigating the Learning-Forgetting Trade-off #
The authors argue that LoRA's gap to full fine-tuning in mixed-domain and continual settings comes partly from adapters not using the rank they are given: the effective rank of a trained adapter sits well below the configured rank. They add a differentiable, SVD-free Rényi-2 effective-rank regulariser to the language-modelling loss so the adapter is pushed to spread its update across more directions. In mixed-domain experiments on three models, a penalty weight of 0.01 lowered mean Wikipedia perplexity at every configured rank of 16 or more compared with plain LoRA, and several LoRA variants showed the same under-use. The result is a perplexity improvement on one held-out measure, so check task accuracy before adopting it, but the regulariser is cheap to add to an existing PEFT run. Code is linked from the abstract.
LazyWeights: Decode-on-Demand Edge LLMs #
Rather than invent a new quantisation format, this paper keeps GPTQ, AWQ and llama.cpp K- and I-quants, tunes GPTQ so its integer codes compress well, then Huffman-codes them losslessly and decodes them on demand in a small hardware unit between DRAM and L2, leaving GPU kernels untouched. At 1 per cent and 3.5 per cent perplexity budgets the coded Phi-3-mini, Mistral-7B and SmolLM-1.7B are 5.7 to 31.4 per cent smaller than the best llama.cpp format. A bit-exact 0.21 square millimetre decoder at 1 GHz on a 7 nm process cuts per-token latency and energy on a Jetson Orin Nano Super by up to 36 and 38 per cent, and a 4 GB Jetson Nano runs a streamed Mistral-7B 6.6 times faster at 3.89 bits per weight. The hardware unit is a proposal validated on a Zynq UltraScale+ FPGA, so the gains need new silicon or an FPGA companion to realise.
Cited but Unused: Parametric Provenance in Retrieval-Augmented Generation #
A RAG system can cite a passage while actually answering from memory, and this paper measures how often that happens by swapping a fact in the retrieved text for a false one and checking whether the answer moves. Across five sizes of one model family and a comparator family, 1.2 to 15.7 per cent of citable claims came from parametric memory rather than the context. Natural language inference checks ran at chance level even when restricted to the cited passage, because a model answering from memory tends to pick a citation that agrees with it. Comparing output distributions with and without the context separated provenance best among ten attribution methods, but acting on that signal did not improve provenance at these base rates. The practical lesson is that citation agreement is not evidence of grounding, and no current detector is accurate enough to gate on.
CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts #
Existing enforcement defences against prompt injection (CaMeL, Progent, IPIGuard, DRIFT) ask the agent's own model to write a program, policy or dependency graph that is then enforced. Testing 15 open-weight models, 13 of them between 1.7 B and 12 B parameters, the authors find small models write artefacts that can themselves be attacked and that CaMeL's generated programs often do not run. CapLite instead derives its policy from the tool schemas, commits any write calls before reading any tool result, and permits a write only when the user's request names every argument that determines its target. On AgentDojo, no attack succeeded across 13,935 attacked episodes, with utility under attack of 29.0 per cent against CaMeL's 27.2 per cent at about 18 per cent of CaMeL's token cost. The design limits what an agent can do once it has read untrusted content, which is the point, but it also rules out legitimate read-then-write flows.
Joint Null-Space Projection for Data-Free Model Merging #
Merging several fine-tuned checkpoints into one multi-task model is treated as subspace interference: for each task's weight update the author finds the input directions where it changes the representation most, then projects out the components that overlap with other tasks' subspaces. The method is closed-form, order-independent and needs no data, labels or gradient steps. On eight CLIP image classification tasks with ViT-B/16 experts it reaches about 89.45 per cent average accuracy against 77.57 for TIES-Merging and 88.47 for WUDI's data-free merge, and the gain holds on independently trained TALL checkpoints across three backbones. Using one shared subspace instead of per-task ones costs about 2.9 points and a sequential variant collapses to 69.6 per cent. On RoBERTa-large it underperforms plain task arithmetic, which the paper reports openly, so the vision result may not carry to text.
Parsed, Plausible, Wrong: Output Format Controls Silent Errors in Small-Model Semantic Parsing #
The authors fine-tuned two sub-billion models (Qwen3.5-0.8B and LFM2.5-350M) with LoRA on six lossless encodings of the same PIZZA ordering parse tree, from 44.3 down to 10.9 tokens per order, and ran 300 experiments across training-set sizes and seeds with hierarchical bootstrap and Holm correction. Shortening the output on its own never helped, but writing the target in ordinary words did: the word encoding was the most accurate on both models while emitting 4.1 times fewer tokens than the native s-expression. It cut the silent error rate, where the output parses but is wrong, by 2.3 times on Qwen and 1.8 times on LFM2, with much of the gain on negation. Every model learned to refuse off-menu input, but strict refusal also rejected 2.1 to 10.1 per cent of real, mostly polite, orders. The study is one domain and two small models, but the recipe (choose a target format the model can read as language) transfers directly to structured-output work.
Rethinking "RL Generalizes, SFT Memorizes": The Role of SFT Data #
The common claim that reinforcement learning generalises while supervised fine-tuning memorises is, on this paper's evidence, largely a statement about the SFT data used. On Qwen2.5 and Qwen3 models the authors show that a carefully mixed SFT set beats data generated by a single larger model, that matching the number of correct rollouts between SFT and RL improves SFT generalisation, and that matching total rollout budgets brings SFT level with RL. Combining both lets SFT outperform RL. Larger datasets cover more tail solution methods, which the authors argue carry the generalisable reasoning signal, and a theoretical analysis of shallow transformers under both training regimes supports the picture. The experiments are on one model family, so the budget-matching result should be checked elsewhere before you drop an RL stage in favour of more SFT data.
KernelMosaic: An Open Dataset and Agentic Framework for CUDA Kernel Generation #
KernelMosaic is an open dataset of CUDA tasks paired with verified solutions and the reasoning trajectories that produced them, curated by human review and diversity-aware selection. An agentic framework walks a strong LLM through implementation, correctness fixes and performance tuning to generate the trajectories. Fine-tuning a small open-source model on the dataset substantially raises correctness on KernelBench Levels 1, 2 and 3 and increases the share of generated kernels that beat PyTorch eager execution. The authors also report that supervising on trajectories beats supervising on final answers alone. The abstract gives no absolute numbers and the release is under CC BY-NC-ND 4.0, which restricts commercial reuse of the data.