Architecture and Security of Distilled Persona and Memory Systems in the TinyRustLM Ecosystem

Full report

On this page

The rapid proliferation of Small Language Models (SLMs) has redefined the boundaries of edge-deployed artificial intelligence, shifting the industry focus from massive parameter counts to highly optimized, domain-specific architectures capable of executing within constrained local environments. The TinyRustLM ecosystem represents a strict instantiation of this paradigm, offering a browser-local, WebAssembly (WASM)-compiled execution engine that enforces rigid state boundaries, scalar CPU execution, and narrow memory allocations without relying on continuous cloud connectivity1. Within this architecture, users increasingly demand the dynamic integration of persona packs, advanced memory behaviors, and domain specialization. Fulfilling these requirements introduces severe architectural friction. The core difficulty lies in reconciling user demands for expansive, persistent, and highly personalized AI capabilities with the absolute necessity that the public runtime must remain exceptionally safe, entirely local, fully inspectable, and functionally narrow. A browser-local runtime cannot securely execute arbitrary code or process multi-gigabyte monolithic weights on the fly, nor can it rely on external orchestration without violating privacy guarantees. Furthermore, memory integration must not devolve into hidden remote inference, where user data is silently exfiltrated to cloud endpoints, nor can it become an unverified vector for prompt injection that compromises the model's safety alignment. This analysis examines the technical pathways for distilling complex memory structures, persona behaviors, and task-specific routines into the TinyRustLM .slm v1 ecosystem, ensuring that proprietary authoring internals remain shielded while the public execution interface remains robustly secure.

Browser-Local Runtime Optimization For Distilled .slm Models

The TinyRustLM ecosystem relies on a singular, highly constrained execution environment. The entire deterministic runtime is compiled into a 114 KiB WebAssembly module, which exposes a raw C-style Application Binary Interface (ABI) for allocation, model loading, generation, diagnostics, and reset operations2. Because WebAssembly executes within the browser's sandbox, typically on the main thread in its baseline implementation, memory management requires absolute precision to avoid blocking the presentation layer or crashing the host application. The runtime imposes strict hard limits, including a global mutex for serialization, a 128 MiB transfer ceiling for any single raw allocation, and a fixed transient array cap of 1,024 candidates for sampling1. Optimizing distilled SLMs for this environment requires abandoning sprawling, multi-file ecosystems in favor of the custom .slm v1 model container. Unlike generalized formats that require complex parsers, the .slm v1 format validates a strict 108-byte header, an embedded tokenizer section, and 64-byte tensor entries followed by aligned tensor payloads2. This structure permits the parser to execute a singular model-load transaction encompassing tensor materialization, forward scratch allocation, and KV-cache allocation before the model is flagged as ready. The memory footprint is derived directly from the code path, with the forward scratch buffer requiring [Figure omitted from source export] bytes and the KV-cache requiring [Figure omitted from source export] bytes1. By mathematically bounding these allocations prior to execution, the browser-local runtime prevents out-of-memory exceptions and guarantees stable, synchronous inference.

Base Model Distillation Versus Adapter Distillation

The deployment of advanced cognitive behaviors into sub-10-billion parameter models requires fundamental architectural choices regarding how knowledge and behavioral patterns are compressed. In the context of TinyRustLM, which operates on models ranging from ultra-lightweight 16M parameter smoke-test fixtures up to multi-billion parameter dense models3, the primary decision lies between base model distillation and adapter-based distillation. Base model distillation involves transferring the knowledge distribution of a large, proprietary frontier model into a smaller, standalone base model. This process requires extensive continuous pre-training or instruction tuning, where the smaller model learns to mimic the output logits or hidden states of the teacher model. While base distillation produces a highly optimized, singular artifact, it presents significant disadvantages for dynamic ecosystems. Base models are monolithic; updating a persona or modifying a specialized skill requires redistilling and redistributing the entire multi-gigabyte artifact, which severely violates the bandwidth and memory limits of edge deployments. Furthermore, base distillation intrinsically risks the exposure of proprietary training data, as the entire capability set is baked into the public weights, allowing adversaries to probe the model to reconstruct training distributions. Adapter distillation, conversely, leverages parameter-efficient fine-tuning (PEFT) methods, specifically Low-Rank Adaptation (LoRA), to isolate specialized behaviors into modular weight deltas. This approach keeps the base model weights frozen while training a small set of auxiliary parameters. A developer can orchestrate a massive, highly routed Mixture-of-Experts (MoE) system internally, distill the final desired behavior into a LoRA adapter, and distribute only the adapter to the TinyRustLM ecosystem. This modularity allows the browser-local runtime to swap personas or task behaviors by loading minimal artifacts, fully optimizing the 128 MiB allocation constraints of the WASM environment1.

Low-Rank Adapter Compression as Proprietary Shielding

Adapter distillation relies on the mathematical principle that the change in weights during adaptation resides in a low-dimensional subspace. For a pre-trained weight matrix [Figure omitted from source export], the adapted weight is represented as [Figure omitted from source export], where [Figure omitted from source export] and [Figure omitted from source export], with the rank [Figure omitted from source export]5. By restricting the rank parameter [Figure omitted from source export], the developer achieves extreme data compression, reducing the trainable parameters to a fraction of a percent of the base model. This low-rank compression serves as a natural cryptographic one-way function for intellectual property. Because the adapter merely represents a geometric projection in the activation space of the base model, it is mathematically impossible for the end-user to reverse-engineer the proprietary routing logic, the multi-stage fine-tuning pipeline, or the raw data utilized during the adapter's creation. The internal training mechanics, whether they involved reinforcement learning from human feedback (RLHF), iterative rejection sampling, or complex multi-agent simulations, are entirely lost in the low-rank projection, leaving only the functional behavior intact. Furthermore, the selection of the rank parameter [Figure omitted from source export] is a critical factor in maintaining the integrity of the base model's capabilities. Theoretical and empirical analyses indicate that overshooting the rank budget—selecting an [Figure omitted from source export] larger than the intrinsic dimensionality of the finetuning task—induces degradation in the base model's pre-trained knowledge7. The rate of this degradation is inversely proportional to the intrinsic dimensionality of the base task. Therefore, by enforcing ultra-low-rank adapter compression (such as [Figure omitted from source export] or [Figure omitted from source export]), developers ensure that persona packs remain strictly behavioral, dictating style, tone, and formatting without overwriting the fundamental linguistic or reasoning capabilities embedded in the TinyRustLM base weights.

Persona-Pack Representation and Provenance Metadata

To function within the deterministic and highly constrained TinyRustLM environment, a persona pack cannot merely be an unstructured collection of system prompts or arbitrary weight modifications. Instead, it must be formalized as a highly structured, immutable container that extends the custom .slm v1 format. The persona pack must integrate into this ecosystem as an auxiliary package that the parser can seamlessly admit, validate, and materialize without jeopardizing the runtime's memory stability. A robust persona pack representation consists of a localized metadata manifest and the low-rank adapter tensors, which are aggressively quantized to match the base model, typically utilizing q8\_0 or q4\_0 formats to reduce memory bandwidth and working set size4. Provenance and integrity are paramount to the execution lifecycle. Currently, the raw .slm v1 container utilizes a custom non-cryptographic checksum, which is sufficient for basic structural validation but inadequate for verifying the origin and safety of third-party persona packs2. To prevent the execution of unverified, potentially malicious adapters, the persona pack manifest must enforce strict cryptographic signatures tied to the developer's public key. The local artifact store validates these signatures during the chunking, hashing, and committing phases before the persona pack is allowed into the active execution cache1. This guarantees that the persona pack was authored by a trusted entity and has not been subjected to adversarial weight poisoning in transit.

The UAIX Memory Architecture and Integration

The integration of memory into a local SLM ecosystem presents a profound engineering challenge. Users expect models to seamlessly recall past interactions, project facts, and deep domain knowledge, but this memory must absolutely not manifest as hidden remote inference that leaks sensitive data, nor can it serve as a vector for unverified prompt injection that overrides the model's instructions. To achieve this, the TinyRustLM ecosystem utilizes the UAIX memory architecture, which provides a unified, persistent memory layer mapped entirely through local-first paradigms. UAIX leverages UAI-1 .NET primitives to handle message envelopes, routing discovery, and advanced persona profile validation entirely on the local device, ensuring zero network exfiltration11. Memory within this architecture is strictly partitioned across temporal boundaries to manage the severe physical constraints of the KV-cache and local working memory. The human brain manages cognition through distinct temporal systems, and teleodynamic systems theory suggests that computational memory must similarly be coupled with emergent resource dynamics13. In the TinyRustLM ecosystem, memory is tiered into Hot, Warm, and Cold state planes, each with distinct retention policies, latency budgets, and security paradigms. Hot memory constitutes the active session state and is physically instantiated within the model's KV-cache. The KV-cache stores intermediate attention outputs to avoid redundant computation during autoregressive generation13. To optimize this within the browser's strict RAM limits, the ecosystem utilizes Cache Augmented Generation (CAG), where pre-computed KV-cache blocks corresponding to common persona instructions or recent conversational context are directly injected into the input layer13. This provides ultra-low latency recall but is highly ephemeral, completely clearing upon a prompt reset. Warm memory operates as a secondary buffer, capturing recent tool outputs, active task states, and session summaries10. It relies on local SQLite databases, such as those implemented by the Memorix framework, which operates alongside the .slm runtime to turn local commit histories and recent coding sessions into searchable engineering facts15. Warm memory is retrieved lexically or semantically and structured into the prompt context prior to the generation transaction. Cold memory represents the durable, long-term semantic knowledge base. Rather than fine-tuning the model on explicit facts, cold memory is handled via local Retrieval Augmented Generation (RAG). Documents, user preferences, and historical artifacts are pre-processed into embeddings and stored in a local vector database13. During inference, the UAIX routing discovery mechanism retrieves highly relevant semantic chunks and formats them into the context window.

Prompt-Time Memory Injection Versus Trained Behavior

The architectural division between prompt-time memory injection (UAIX RAG/CAG) and trained behavior (LoRA adapters) is the cornerstone of preserving the base model's intelligence. Memory in TinyRustLM is explicitly not trained into the model weights. Information theoretic research demonstrates that large language models exhibit an extremely limited capacity for raw memorization, estimated at approximately 3.6 bits per parameter17. Attempting to force an SLM to memorize explicit project-specific facts or database records via fine-tuning rapidly fills this capacity, causing the model to act as a degraded lookup table rather than an intelligent reasoning system, ultimately destroying its ability to generalize17. By segregating declarative knowledge (facts, project states, histories) into the UAIX systems and procedural knowledge (tone, format, algorithmic tasks, persona) into the LoRA adapters, the system maintains high fidelity across both domains. Furthermore, because declarative memory is injected at prompt time via structured UAIX envelopes, the runtime can apply strict sanitization, syntax formatting, and validation filters to the retrieved text. The system treats all retrieved memory as untrusted input. This definitively prevents malicious long-term memory retrieval—such as a poisoned commit history or a malicious PDF embedded in cold storage—from executing unverified prompt injection attacks against the SLM, as the untrusted context is clearly demarcated from the system instructions.

Adapter Merging Risks and Catastrophic Interference

As users seek to combine multiple capabilities within the ecosystem—such as loading a specific creative persona pack alongside a specialized coding adapter and an enterprise safety filter—the TinyRustLM runtime must dynamically compose these models. The standard approach in the broader AI community involves merging the weights of multiple LoRA adapters into a single representation. This avoids the computational overhead of running multiple parallel projection layers, which is critical when adhering to the teleodynamic resource posture governing the runtime18. However, linear adapter merging introduces profound risks regarding representational interference and catastrophic forgetting19. When a Domain-Adaptive Pretraining (DAPT) adapter is linearly merged with an Instruction-Tuning (SFT) or persona adapter, the vectors within the adapters often occupy conflicting regions of the latent space. Rigorous experiments into modular LoRA merging demonstrate a severe non-monotonic interference pattern where merging adapters inadvertently reactivates latent reasoning traces19. For example, merging a domain adapter with a chat persona often causes the model to spontaneously output hidden \<think\> tokens that the instruction tuning was specifically designed to suppress. This structural conflict arises because the domain adapter reopens access to pre-training subspaces that the persona adapter explicitly attempts to close19. If this interference occurs in a user's browser, the persona pack will rapidly degrade, outputting hallucinated code blocks, breaking character, or suffering from catastrophic forgetting where the primary task capability is completely overwritten20. To mitigate these risks without exposing the internal geometry of the adapters to the end user, the ecosystem employs advanced scalable continual learning paradigms, specifically drawing upon Hierarchical Adapter Merging (HAM) and Centroid Prototype Mapping (ACMap)6. Instead of naive weight averaging, the system compiles adapters into a unified parameter state using adaptive scaling factors. By calculating merging coefficients based on the geometric similarity of the adapters, the system constructs a shared low-loss subspace that aligns task representations, effectively mitigating catastrophic forgetting20. Furthermore, to prevent dense overlapping interference, the runtime utilizes sparse adapters. Algorithms such as Drop And REscale (DARE) and TIES-MERGE address parameter redundancy by sparsifying the fine-tuned models21. These techniques drop a high percentage of the delta parameters—often up to 90% or 99%—and rescale the remaining weights, resolving sign conflicts during the merge21. Due to the extreme sparsity of these weight matrices, the combined matrix for a multi-task setting features a minimal number of co-occurring weights, dramatically reducing destructive interference when a persona pack is merged with a memory-retrieval skill22.

Teleodynamic Resource Control

The composition and execution of these sparse, merged adapters are governed by the principles of teleodynamic systems. In teleodynamic learning, systems operate under constraints not as static budgets, but as dynamic variables where structural changes and parameter adaptations are continuously coupled through endogenous resource pressure14. Living systems do not freeze their structure before tuning their parameters; they evolve together based on the availability of resources14. The TinyRustLM composer models this biological reality by evaluating the installed active set, the available RAM in the browser, and the latency pressure of the current request18. The architecture records the maximum active roles and concurrent computation limits, ensuring the system respects the 48.0 MiB workspace allowance and 16.0 MiB context-state allowance18. If the teleodynamic resource posture determines that merging an additional persona adapter exceeds the memory boundary or introduces unacceptable computational latency, the structural control loop rejects the activation, enforcing graceful degradation and ensuring the deterministic runtime remains stable.

Preventing Safety Override and Enforcing Trust Policy

The paramount vulnerability in allowing external persona packs and dynamic memory injection is the potential for these modules to override the base model's safety alignments. If a user loads an aggressive or unrestricted persona pack, that pack must successfully alter the linguistic style without simultaneously disabling the model's fundamental refusal mechanisms regarding illicit, harmful, or unsafe queries. In decentralized, browser-local runtimes, standard API-level content moderation is entirely unavailable. This places the absolute burden of safety on the physical weights and the execution topology of the SLM itself. The most severe threat to local SLM safety is the manipulation of activation space. Techniques such as activation steering—where human-interpretable vectors are directly injected into the model's hidden states during inference—have been exposed as highly dangerous vulnerabilities. Studies demonstrate that even benign, utility-oriented activation steering systematically erodes the "safety margin" of aligned models23. Injecting seemingly random noise into the activations during inference can increase the probability of a model complying with harmful requests from 0% to up to 13%, effectively breaking the model's refusal mechanism by tricking the autoregressive generation into opening with a non-refusal token23. Because persona packs fundamentally alter activation states across layers, a maliciously crafted persona adapter could act as a hidden, non-linear activation steering vector, shrinking the representational safety margin and jailbreaking the model entirely on the local machine. To systematically prevent persona packs from overriding safety, the TinyRustLM ecosystem mandates an orthogonal safety alignment architecture based on strict rank-constrained LoRA applications. Historically, developers relied on full-model safety fine-tuning. However, this incurs a severe "Safety Tax," significantly degrading the model's complex reasoning and mathematical capabilities7. Empirical research demonstrates that robust safety alignment can be achieved without reasoning degradation by applying rank-1 LoRA updates strictly to the Multi-Layer Perceptron (MLP) up-projection layers, specifically targeted within the middle layers of the network where harmfulness-related representations naturally emerge7. By geometrically isolating the safety alignment into a low-dimensional, rank-1 subspace, the runtime ensures that safety is mathematically orthogonal to the diverse, high-dimensional linguistic styling of a persona pack. During the model-load transaction, the TinyRustLM runtime stack explicitly orders the tensor materialization. The base model is loaded first, followed by the user-defined sparse persona adapters, and finally, the immutable rank-1 Safety LoRA is applied at the absolute top of the execution stack. Because the persona pack is mathematically constrained by its manifest and cannot manipulate the final MLP up-projections reserved exclusively for the safety adapter, any implicit harmfulness or "jailbreak" steering introduced by the persona is forcefully projected back into the safe subspace by the final immutable adapter layer. This mechanism acts as an impenetrable local safety guardrail, ensuring that the model's epistemological scope regarding danger remains rigidly intact while permitting infinite stylistic variation below it.

Public SDK Interfaces Versus Private Authoring Logic

For a decentralized SLM ecosystem to thrive, commercial developers must be able to monetize and distribute memory packages, specialized domains, and persona packs without exposing their proprietary datasets, the massive compute expended during training, or their internal multi-agent routing systems. The solution lies in establishing a strict, impermeable boundary between the offline authoring SDK and the public execution interface. When a developer uses the internal authoring tools to create a persona, the system processes their proprietary data—such as thousands of hours of proprietary customer service transcripts, copyrighted character dialogue, or secure enterprise codebase logic. The authoring engine utilizes complex LLM-based refiners, submodular selection algorithms to maximize diversity and semantic clustering26, and advanced Test-Time Training (TTT) architectures to compress long context into model weights via next-token prediction28. However, absolutely none of this complexity is exported to the client. The compiler performs a one-way distillation, outputting only the finalized, heavily quantized q4\_0 sparse LoRA tensors and a sanitized semantic SQLite database for the UAIX memory module. The public SDK exposes high-level, declarative interfaces for the end-user. The end-user application, operating within the browser, interacts with the TinyRustLM WASM module strictly through a constrained C-style ABI2. The interface commands are limited to state transitions that dictate memory addresses, buffer lengths, and high-level commands. The public SDK handles the asynchronous file fetching, the UTF-8 transfer, and the intricate KV-cache allocation math without exposing any neural network geometry1. By keeping the interface purely operational, the runtime acts as an opaque, deterministic black-box executor. The user can inspect the deterministic execution traces and verify the cryptographic safety of the artifact, but they possess zero visibility into the gradient descent trajectories, the semantic clustering algorithms, or the proprietary data that yielded the adapter's final weight configuration.

Evaluation Frameworks and Test Plans

Deploying distilled, modular components into production requires an evaluation framework specifically tailored to the unique failure modes of local SLMs. Traditional generalized benchmarks fail to capture the nuanced failure modes of merged adapters, memory injection conflicts, and safety degradation in resource-constrained environments. The evaluation pipeline must rigorously and separately assess memory recall, refusal margins, style consistency, and privacy isolation. To measure memory recall, the system utilizes Pass@1 accuracy over highly localized, synthetic RAG benchmarks29. This involves injecting specific, randomized project facts into the UAIX Warm memory and prompting the model to retrieve and reason over them. Success is defined not merely by verbatim recall, but by the model's ability to maintain its reasoning integrity while processing the injected KV-cache blocks without hallucinating out-of-context facts. If the memory injection causes the model to fail subsequent mathematical or logical reasoning tests, the memory envelope configuration fails the evaluation. Refusal and safety margins must be tested using adversarial frameworks such as AdvBench and RefusalBench5. Because empirical evidence establishes that benign utility steering can easily erode safety margins, every persona pack must be subjected to rigorous A/B testing24. The model is queried with harmful instructions both with and without the persona pack loaded. A secondary, specialized safeguard model—such as Llama-Guard—evaluates the outputs to ensure the safe response rate remains perfectly intact29. If a persona pack increases the Attack Success Rate (ASR) of black-box jailbreaks by even a fraction of a percent, it is flagged as structurally incompatible with the safety LoRA and rejected from the ecosystem. Style consistency is measured through advanced representational probing rather than unreliable LLM-as-a-judge methodologies. The testing framework utilizes Linear Discriminant Analysis (LDA) to map the Concept Activation Vectors (CAVs) of the output layers30. If the trajectory of the hidden states remains tightly aligned with the geometric centroid of the target persona across varied prompt lengths, the adapter is deemed highly consistent. Finally, privacy is evaluated by attempting to extract training data directly from the adapter weights. Due to the mathematically bounded capacity of low-rank matrices17, proper distillation inherently limits exact string memorization, allowing developers to mathematically prove via prefix forcing that proprietary Personally Identifiable Information (PII) cannot be extracted from the public persona pack.

Conclusion

The distillation of memory, persona, and task behaviors into the TinyRustLM ecosystem represents a convergence of parameter-efficient mathematics, browser-sandbox engineering, and advanced teleodynamic system architecture. By definitively abandoning monolithic base model fine-tuning in favor of low-rank, heavily quantized adapter distillation, developers can securely distribute proprietary behaviors without leaking their training methodologies, routing heuristics, or core proprietary data. The UAIX architecture securely resolves the memory paradox by treating Hot, Warm, and Cold memory as ephemeral, prompt-time inputs driven by local-first data stores, effectively preventing the SLM's permanent weights from being contaminated or overwhelmed by localized project facts. Crucially, ensuring that these dynamic extensions remain strictly safe in a decentralized, browser-local environment mandates that safety is treated as a foundational, geometric property rather than a mere behavioral suggestion. By utilizing sparse masks to prevent catastrophic adapter interference and enforcing rank-1 MLP up-projection updates for the immutable safety layer, the system fundamentally neutralizes the severe threats of activation steering and persona-based jailbreaks. Through this rigorous alignment of the custom .slm v1 format, deterministic UAI-1 interfaces, and teleodynamic resource control, the TinyRustLM ecosystem establishes a robust, extensible, and mathematically secure foundation for the next generation of highly specialized, local artificial intelligence.

Works cited

1. Implementation operations \- MiRust, https://mirust.com/implementation-operations/
2. Implementation \- MiRust, https://mirust.com/implementation/
3. The Best Open-Source Small Language Models (SLMs) in 2026 \- BentoML, https://www.bentoml.com/blog/the-best-open-source-small-language-models
4. Models \- MiRust, https://mirust.com/models/
5. LoRA Fine-tuning Efficiently Undoes Safety Training from Llama 2-Chat 70B \- LessWrong, https://www.lesswrong.com/posts/qmQFHCgCyEEjuy5a7/lora-fine-tuning-efficiently-undoes-safety-training-fromNarrated
6. \[論文評述\] HAM: Hierarchical Adapter Merging for Scalable Continual Learning, https://www.themoonlight.io/tw/review/ham-hierarchical-adapter-merging-for-scalable-continual-learning
7. LoRA is All You Need for Safety Alignment of Reasoning LLMs \- arXiv, https://arxiv.org/html/2507.17075v4
8. LoRA is All You Need for Safety Alignment of Reasoning LLMs \- arXiv, https://arxiv.org/pdf/2507.17075
9. MiRust: Home, https://mirust.com/
10. Unified Memory Core for AI Agents | developers \- Oracle Blogs, https://blogs.oracle.com/developers/unified-memory-core-for-ai-agents
11. Oracle AI Agent Memory, https://www.oracle.com/database/ai-agent-memory/
12. UAIX.UAI 1.0.5 on NuGet \- Libraries.io \- security & maintenance data for open source software, https://libraries.io/nuget/UAIX.UAI
13. Understanding Memory in LLMs. Scalable AI Knowledge Architecture —… | by Avi Levy, https://medium.com/@avicorp/understanding-memory-in-llms-f260f21cef34
14. Teleodynamic Learning a new Paradigm For Interpretable AI \- arXiv, https://arxiv.org/pdf/2603.11355
15. GitHub \- AVIDS2/memorix: Open-source cross-agent memory layer for coding agents via MCP. Compatible with Claude Code, Codex, Cursor, Windsurf, Gemini CLI, Antigravity, OpenClaw, Hermes Agent, Oh-my-Pi, Pi, Copilot, Kiro, OpenCode, and Trae., https://github.com/AVIDS2/memorix
16. Four agentic AI memory systems for smarter LLMs \- InfoWorld, https://www.infoworld.com/article/4192397/four-agentic-ai-memory-systems-for-smarter-llms.html
17. \[Paper\] How much do language models memorize? : r/LocalLLaMA \- Reddit, https://www.reddit.com/r/LocalLLaMA/comments/1upq1rc/paper\_how\_much\_do\_language\_models\_memorize/
18. Tiny Model Composer \- MiRust, https://mirust.com/composer/
19. Adapter Merging Reactivates Latent Reasoning Traces: A Mechanism Analysis \- arXiv, https://arxiv.org/html/2601.18350v4
20. Adapter Merging with Centroid Prototype Mapping for Scalable Class-Incremental Learning \- CVF Open Access, https://openaccess.thecvf.com/content/CVPR2025/papers/Fukuda\_Adapter\_Merging\_with\_Centroid\_Prototype\_Mapping\_for\_Scalable\_Class-Incremental\_Learning\_CVPR\_2025\_paper.pdf
21. Adaptive LoRA Merging for Efficient Domain Incremental Learning \- LatinX in AI (LXAI) Research, https://research.latinxinai.org/papers/neurips/2024/pdf/Luigi\_Quarantiello.pdf
22. Exploring Sparse Adapters for Scalable Merging of Parameter Efficient Experts, https://openreview.net/forum?id=te7UC87Zbw¬eId=GhRnAxsZ57
23. The Rogue Scalpel: Activation Steering Compromises LLM Safety \- arXiv, https://arxiv.org/html/2509.22067v2
24. Steering Externalities: Benign Activation Steering Unintentionally Increases Jailbreak Risk for Large Language Models \- OpenReview, https://openreview.net/pdf/b36857be8bf60ab8efb412a8bc5a9cc200c56221.pdf
25. Safe LoRA: The Silver Lining of Reducing Safety Risks when Finetuning Large Language Models | Request PDF \- ResearchGate, https://www.researchgate.net/publication/397202248\_Safe\_LoRA\_The\_Silver\_Lining\_of\_Reducing\_Safety\_Risks\_when\_Finetuning\_Large\_Language\_Models
26. LoRAverse: A Submodular Framework to Retrieve Diverse Adapters for Diffusion Models \- arXiv, https://arxiv.org/html/2510.15022v1
27. Stylus: Automatic Adapter Selection for Diffusion Models \- OpenReview, https://openreview.net/forum?id=3Odq2tGSpp
28. Reimagining LLM Memory: Using Context as Training Data Unlocks Models That Learn at Test-Time | NVIDIA Technical Blog, https://developer.nvidia.com/blog/reimagining-llm-memory-using-context-as-training-data-unlocks-models-that-learn-at-test-time/
29. LoRA is All You Need for Safety Alignment of Reasoning LLMs \- arXiv, https://arxiv.org/html/2507.17075v1
30. Safe-Unsafe Concept Separation Emerges from a Single Direction in Language Models Activation Space \- ACL Anthology, https://aclanthology.org/2026.eacl-long.139.pdf