Yutaka Matsuo

Large Reasoning Models (LRMs) achieve strong performance on complex tasks through extended chain-of-thought generation, but incur substantial computational costs during inference. In production settings, batched inference is essential for high throughput, yet the existing training-free adaptive pruning methods we evaluate severely degrade in this regime. Because a batch must share a single pruning mask, these methods aggregate activations across samples and then apply threshold-based selection; the threshold, calibrated offline on unaggregated activations, no longer matches the aggregated distribution, so the realized sparsity ratio drifts and accuracy on reasoning tasks collapses under batched inference. In this work, we propose a training-free adaptive pruning method designed specifically for batched inference in LRMs, built on two components. First, we replace threshold-based selection with periodic top-$k$ selection over the aggregated importance scores, which is unaffected by the shift that aggregation induces in the activation distribution, and which runs selection once per update period rather than at every token, preserving the speedup. Second, based on the observation that important neurons re-fire periodically during long reasoning generation, we introduce an activation memory that accumulates importance across update phases so that recurring neurons are retained. Experiments on diverse reasoning benchmarks demonstrate that our method outperforms the previous state-of-the-art adaptive pruning method by 39.7 percentage points in average accuracy at batch size 4 with 50\% target sparsity on DeepSeek-R1-Distill-Qwen-7B, and reaches $1.40\times$ speedup over dense inference at 50\% actual sparsity.

As Large Language Models (LLMs) are increasingly deployed in healthcare worldwide, robustness against adversarial jailbreaking becomes essential for maintaining medical ethics compliance, calling for comprehensive adversarial benchmarks. However, existing benchmarks remain predominantly English-centric and limited to single-turn attacks. To address these gaps, we introduce JMedEthicBench, to our knowledge the first multi-turn adversarial benchmark for evaluating medical ethics alignment of LLMs in Japanese via static-replay pressure test. Grounded in 67 guidelines from the Japan Medical Association, our benchmark comprises 50,843 adversarial conversations generated using seven automatically discovered jailbreak strategies, which we further show cluster into two adversarial families. Through a dual-LLM scoring protocol validated on 653 human-annotated responses (Spearman $\rho = 0.775$ vs. the dual-judge average), we evaluate 22 models and find that many commercial models maintain strong resistance to attacks while medical-specialized models exhibit increased vulnerability. Furthermore, safety scores decline significantly across conversation turns (median: 9.5 to 5.0, $p < 0.001$), with $82.3\%$ of all conversations showing at least one step of safety decline and $50.1\%$ of medical-model conversations following a strictly monotonic decline. Cross-lingual evaluation reveals that medical model vulnerabilities persist across Japanese and English, indicating inherent alignment limitations rather than language-specific factors. Our findings suggest that domain-specific fine-tuning may inadvertently weaken safety alignment when it is not explicitly preserved, and that multi-turn jailbreak attacks represent a distinct threat surface requiring dedicated defense strategies.