“Assessing the Non-Verbal Reasoning Skills of Large Language Models (LLMs)”

# Processing in the “Latent Space” Could Aid AI in Addressing Complex Logical Challenges

Artificial Intelligence (AI) has achieved significant progress in recent years, especially with the emergence of large language models (LLMs) such as OpenAI’s GPT series and Google’s Bard. These models are proficient at creating coherent, human-like text by predicting the next word in a sequence, a capability stemming from their transformer-based design. Nonetheless, when it comes to tackling intricate logical challenges, these models frequently face obstacles. A fresh method, concentrating on reasoning within the “latent space,” might provide a hopeful solution to these issues.

## The Challenge of Language-Centric Reasoning

LLMs like ChatGPT and others depend substantially on “chain-of-thought” reasoning, where every step of a logical procedure is articulated in natural language. This methodology has shown effectiveness for numerous tasks, including answering questions, summarizing texts, or producing creative content. However, researchers have pinpointed a significant limitation: the dependence on natural language tokens as the medium for reasoning.

In a recent study conducted by researchers from Meta’s Fundamental AI Research (FAIR) team alongside UC San Diego, this reliance on language is characterized as a “fundamental constraint.” Logical reasoning often necessitates meticulous planning and the capacity to consider various potential paths simultaneously. Yet, the requirement to translate each step into natural language can lead to inefficiencies and inaccuracies. For instance, the model might prioritize textual coherence over logical precision, resulting in flawed reasoning or fabricated information.

## Introducing the “Latent Space”

To tackle these shortcomings, researchers are delving into the idea of reasoning within the “latent space.” But what is latent space, exactly? In the realm of LLMs, latent space refers to the concealed, intermediate layer of computations that occur before the model produces human-readable text. These hidden states encapsulate the model’s grasp of the input and its predictions, yet they are not confined by the constraints of natural language.

The researchers suggest an innovative technique for training LLMs to reason directly in this latent space. By doing so, the model can circumvent the necessity to convert each logical step into language, enabling it to concentrate solely on the fundamental reasoning process. This new approach has been embodied in a model named COCONUT (Chain Of CONtinUous Thought), which substitutes traditional chain-of-thought reasoning with “latent thoughts.”

## How COCONUT Functions

In the COCONUT architecture, logical reasoning happens entirely within the latent space. Instead of producing a sequence of natural language tokens for each step, the model encodes its reasoning process as a continuous flow of “latent thoughts.” These latent thoughts are optimized for logical accuracy instead of linguistic fluency, allowing the model to investigate multiple potential solutions at once.

This method brings several benefits:

1. **Liberation from Language Limitations**: By reasoning in latent space, the model is freed from the obligation to generate text at each step. This enables it to focus on the logical framework of the problem rather than the syntax of the language.

2. **Concurrent Exploration of Various Paths**: In contrast to conventional models that pursue a single logical pathway at a time, COCONUT can simultaneously encode multiple potential solutions. This is similar to a breadth-first search in graph theory, where all viable options are evaluated prior to narrowing down to the correct one.

3. **Lower Chance of Hallucination**: Traditional chain-of-thought models occasionally “hallucinate” information, fabricating rules or facts that were not included in the input. By reasoning in latent space, COCONUT reduces this risk, as it does not depend on creating intermediate text.

## Evaluating the Model

The researchers assessed COCONUT across various reasoning tasks, including mathematical challenges (GSM8K dataset) and general logical reasoning (ProntoQA dataset). While the model’s performance on straightforward tasks was on par with traditional chain-of-thought models, it excelled in more challenging situations involving complex logical conditions.

For instance, when confronted with a query requiring multiple layers of logical inference (e.g., “Every apple is a fruit, every fruit is food, etc.”), COCONUT exhibited a superior ability to traverse the logical chain without getting ensnared in dead-end paths or fabricating incorrect rules. This indicates that reasoning in latent space could result in more robust and precise problem-solving.

## Significance for AI Research

The COCONUT model marks a substantial advancement in understanding and enhancing how LLMs manage complex reasoning tasks. By shifting the emphasis from language-based reasoning to latent space processing, researchers are unveiling new avenues for AI development.

One of the most promising facets of this research is its potential for generalization. The researchers suspect that models pre-trained to reason in latent space could achieve better performance across a diverse array of reasoning scenarios, from scientific problem-solving to ethical decision-making. This could lead to the creation of more adaptable and dependable AI systems.

## Challenges and Future Directions

While the outcomes appear promising

Report Uncovers AT&T and Verizon Neglecting to Inform Most Victims Impacted by Chinese Call-Records Breach

### Telecom Companies Criticized for Not Informing Users About Chinese Metadata Hack

In a disturbing turn of events, prominent U.S. telecom firms, such as AT&T and Verizon, are allegedly failing to inform most of their customers whose call metadata was compromised in an intricate cyberattack linked to the Chinese hacking entity Salt Typhoon. This incident, which has compromised sensitive metadata of more than a million people, prompts serious concerns regarding transparency, cybersecurity measures, and the responsibilities of telecom companies towards their users.

#### **Extent of the Breach**

Reports from NBC News indicate that the hacking operation focused mainly on metadata rather than the actual content of communications. Metadata encompasses details such as the involved phone numbers, call durations, and timestamps. Although this information might seem less sensitive compared to the actual conversations or texts, experts caution that metadata can be leveraged to deduce highly personal information about individuals, including their social networks, routines, and even geographical locations.

The breach has already resulted in serious ramifications for notable figures. U.S. government officials, ranging from senior congressional aides to security personnel, and including President-elect Donald Trump and Vice President-elect J.D. Vance, are said to have had their calls and messages directly accessed. Nevertheless, for the overwhelming majority of impacted individuals, the accessed data was confined to metadata, and telecom firms have largely abstained from alerting these users.

#### **Why the Silence for Customers?**

The absence of notifications is attributable to a mix of regulatory loopholes and corporate guidelines. Following a Federal Communications Commission (FCC) directive issued in December 2023, telecom providers are required to inform customers of breaches only if there is a substantial risk of harm. This “harm-based notification trigger” lets carriers avoid notifying users if they assess that the breach is not likely to cause financial, physical, or other major detriment.

Both AT&T and Verizon have asserted their compliance with notification obligations for the affected parties. Nevertheless, sources informed about the companies’ strategies suggest that only a limited group of customers—specifically those whose communications were directly targeted—have been informed. The FBI, currently investigating the breach, has similarly indicated that it will not alert the wider victim group.

#### **The Discussion on Harm and Transparency**

The FCC’s harm-based approach has ignited a conversation about finding a balance between averting “notification fatigue” and guaranteeing transparency. The FCC posits that excessive notifications can trigger unwarranted anxiety and actions, such as altering passwords or freezing credit, in situations where actual harm is improbable. On the other hand, critics argue that this stance leaves consumers uninformed regarding possible risks and diminishes their capacity to make educated choices about their service providers.

U.S. Senator Ron Wyden (D-Ore.) has openly criticized the telecommunications sector for its management of cybersecurity and data breaches. In response to the Salt Typhoon incident, Wyden has suggested legislation to bolster telecom security requirements and demand heightened transparency. “Americans deserve to be informed when their information has been compromised,” a representative for Wyden commented, emphasizing that such notifications could empower consumers to choose providers with superior security protocols.

#### **Risks Associated with Metadata Exposure**

Though metadata does not comprise the substance of communications, its exposure can still pose significant risks. A 2016 study by Stanford University researchers illustrated that telephone metadata is intricately connected and can be utilized to draw sensitive conclusions about individuals. For instance, metadata could expose communication patterns that hint at a person’s political beliefs, health issues, or personal connections.

The potential for exploitation is especially alarming in the context of state-backed hacking. Metadata could serve as a tool for surveillance, extortion, or other malicious intents, particularly when combined with additional data sources.

#### **Track Record of the Telecom Industry**

This is not the first instance of telecom companies being scrutinized for their management of customer data. In July 2024, AT&T unveiled a distinct breach concerning call and text metadata stored on a third-party cloud system. In that scenario, the company informed affected customers and provided resources to safeguard their information. However, the Salt Typhoon hack seems to exist in a legal gray area, with carriers contending that the harm is insufficient to necessitate widespread notifications.

The telecom sector has also typically resisted regulatory scrutiny in other aspects. After the FCC sanctioned carriers for selling user location data, companies including AT&T and Verizon launched lawsuits challenging the FCC’s authority to impose such penalties.

#### **Looking Ahead**

The Salt Typhoon breach underscores the pressing need for enhanced cybersecurity protocols and clearer regulations surrounding data breaches. While the FCC’s harm-based standard seeks to prevent over-notification, it may inadvertently promote a lack of accountability among telecom providers. As the investigation proceeds, lawmakers like Senator Wyden are advocating for reforms to ensure that customers are better informed and protected moving forward.

For the time being, customers are left in uncertainty regarding whether their data has been compromised and what measures, if any, they might take to safeguard themselves. The situation serves as

“Numerous Websites at Risk from Unresolved WordPress Plugin Exploit”

# Severe WordPress Vulnerability Endangers Countless Websites

A severe security flaw with a severity score of 9.8 out of 10 continues to present a considerable risk to countless WordPress websites. Although a patch is available, over 8,000 sites still have not addressed the issue, rendering them susceptible to unauthorized exploitation. The vulnerability, designated as **CVE-2024-11972**, is associated with the popular **Hunk Companion plugin**, which works with ThemeHunk themes on WordPress.

## The Extent of the Threat

The Hunk Companion plugin is active on more than 10,000 WordPress websites, making this vulnerability a prevalent issue. Data from the plugin’s WordPress.org page reveals that merely 11.9% of users have implemented the patch released earlier this week. This indicates that nearly 88% of sites utilizing the plugin are still at risk of attacks.

This vulnerability enables unauthenticated attackers to run malicious code on impacted websites. This could result in serious outcomes, such as data breaches, website defacement, and the installation of further malicious applications. Security experts have reported active exploitation of this weakness, highlighting the critical need for patch application.

## Mechanism of the Exploit

The vulnerability was initially discovered by WP Scan researchers, a WordPress security company, while investigating a compromised customer site. They found that attackers were exploiting **CVE-2024-11972** to compel the site to download and activate another vulnerable plugin, **WP Query Console**.

The WP Query Console plugin, which has not received updates for years, harbors its own critical vulnerability, labeled as **CVE-2024-50498**, with a maximum severity rating of 10. This secondary weakness permits attackers to execute arbitrary code, further jeopardizing the compromised sites. Despite the temporary removal of the WP Query Console plugin from WordPress.org for evaluation, attackers managed to circumvent this barrier by utilizing a specific WordPress.org URL to fetch the plugin.

## Fundamental Cause and Mitigation

The core issue of the Hunk Companion vulnerability is attributed to a flaw that allows unauthenticated requests to evade security checks. This permits attackers to install and activate arbitrary plugins, creating opportunities for more significant exploitation. The developers of Hunk Companion rectified this problem in version 1.9.0, launched two days ago. Nevertheless, the low uptake of the patch underscores the persistent threat.

This is not the first occurrence of vulnerabilities in Hunk Companion. A related flaw, noted as **CVE-2024-9707**, was addressed in version 1.8.5. Similar to the current issue, it also had a severity rating of 9.8, emphasizing the plugin’s track record of serious security vulnerabilities.

## The Larger Context: WordPress Security Obstacles

The challenges presented by Hunk Companion and WP Query Console underline broader issues within the WordPress ecosystem. With more than 40% of the web relying on WordPress, vulnerabilities in plugins and themes can lead to widespread repercussions. Significant issues include:

1. **Delayed Patch Adoption**: Numerous WordPress site administrators neglect to promptly update plugins and themes, leaving their sites vulnerable to existing flaws.
2. **Outdated Plugins**: Plugins such as WP Query Console, which have seen no maintenance for years, continue to serve as a weak point in the ecosystem. Their availability on WordPress.org, even if momentary, can be manipulated by malicious actors.
3. **Circumvention Mechanisms**: The ability to override restrictions on downloading blocked plugins raises concerns regarding WordPress.org’s security protocols.

## Suggestions for Website Administrators

To mitigate the dangers presented by these vulnerabilities, WordPress site administrators should carry out the following measures:

1. **Upgrade Plugins and Themes**: Ensure that all plugins and themes, including Hunk Companion, are upgraded to their latest versions. For Hunk Companion, this entails updating to version 1.9.0 or newer.
2. **Eliminate Obsolete Plugins**: Remove outdated plugins like WP Query Console that are no longer supported or maintained.
3. **Stay Updated on Security Advisories**: Subscribe to security alerts from reputable sources like WP Scan to stay informed about vulnerabilities affecting WordPress plugins and themes.
4. **Utilize Web Application Firewalls (WAFs)**: Implement a WAF to obstruct malicious traffic and prevent the exploitation of vulnerabilities.
5. **Conduct Regular Backups**: Keep consistent backups of your website to ensure swift recovery in the event of a security incident.

## The Role of WordPress.org in Security

This incident also raises concerns about WordPress.org’s responsibility in protecting its ecosystem. The presence of an override mechanism that enabled attackers to download a blocked plugin is troubling. Representatives from WordPress.org have not yet provided clarification on whether this mechanism has been deactivated or if it continues to pose a risk.

Moving ahead, WordPress.org needs to enhance its procedures for evaluating and eliminating vulnerable plugins. It should also bolster communication with site administrators to promote timely updates and provide clearer directions on security best practices.