News without the noise
New AI papers from arXiv, picked daily and explained with their claims, benchmark results and code.
2566 articles · page 14 of 54 · The Research front page
The authors train a small classifier to distinguish action chunks that succeed on a source robot from those that succeed on a modified target body, then use its gradient to guide the frozen pi0 policy during sampling. Across 12 LIBERO suite-controller pairs, guidance raises average success from 72% to 80%, with no demonstrations or parameter updates.
Abdel Sadek et al. show that recursive self-distillation, where a model is trained to reproduce its own predictions given extra context and then serves as the teacher for the next round, can gradually erode safety even when no harmful data is used. The effect, which they call Progressive Misalignment, appears across two model families and also occurs when the extra context is replaced by feedback from a simulated user with benign intent.
Xu and colleagues propose Sep-Latent, a framework for replacing lengthy written chains of thought with a short, variable-length sequence of continuous hidden states. On GSM8k-Aug, the authors report 56.8 percent accuracy using an average of 5.4 latent tokens, improving token efficiency over fixed-length implicit-reasoning baselines while retaining semantically differentiated representations.
Ma, Ding and Wang introduce Heuresis, a benchmark designed to test whether LLM agents can improve causal graphs through targeted analysis rather than prior knowledge or simple algorithm selection. On six families of simulated data, GPT-6.1 Sol consistently exceeded the best selected conventional algorithm, while trace analysis showed that some recovered edges required evidence not present in any baseline algorithm’s output.
The authors present a unified video-editing system that accepts variable combinations of text instructions, images and videos, with each reference controlling attributes such as camera movement, motion, content, style or visual effects. On a new 125-case benchmark, they report better reference adherence and source preservation than task-specific baselines and selected commercial systems, although the provided material does not state performance margins.
Ye and colleagues introduce AlphaBet, a reinforcement-learning framework that repeatedly forecasts the same unresolved event at different dates, using only evidence available at each point. On two benchmarks, the trained GLM-4.5-Air agent produced lower Brier scores, indicating more accurate probability estimates, with gains attributed to both better evidence acquisition and better probability reporting.
Kumar and Sankaranarayanan study whether a classification network can continue learning after achieving 100% training accuracy and entering a cross-entropy plateau. Using proofs and experiments on modular addition, they show that hidden features can become more structured and held-out accuracy can rise from zero to above 90%, even while training loss changes little or increases.
Ding et al. introduce Harness-Delta Attribution, a protocol for identifying why an optimized agent harness improves while the underlying language model remains fixed. Testing three evolution frameworks across 25 configurations, they find that measured gains frequently depend more on benchmark artifacts or additional computation than on improvements likely to transfer.
Wei et al. introduce Self-HPO, a training framework in which a coding model examines its failed attempts, proposes changes to its own execution scaffold, and then learns under the selected scaffold. Across three software-engineering benchmarks, this alternating process raised the model’s average task-resolution rate from 57.8% to 64.8%, outperforming approaches that optimized only the model or only the harness.
Swerdlow, Dong and Finn reverse the usual value-learning problem: instead of predicting returns directly from state-action pairs, their Generative Value Classifier models how likely an action is under each possible return. Across offline, online and offline-to-online continuous-control tasks, they report stronger performance than leading conventional and distributional value-learning methods.
Wang and colleagues introduce a reinforcement-learning framework that rewards not only successful task completion, but also verified progress within a model’s interaction trace. Using the framework, they trained 9-billion and 27-billion-parameter LAR models and report consistent gains across three software-engineering and terminal-use benchmarks.
Göring et al. introduce the 'sign code'—the collection of binary signs of all neuron outputs in a trained network—and demonstrate that this discrete pattern alone carries almost all classification-relevant information. Across architectures, activations, and datasets, a k-nearest-neighbor classifier operating only on the sign code matches the accuracy of the full model, while randomizing magnitudes (keeping signs intact) barely degrades performance and flipping 20% of signs reduces accuracy to chance. The authors provide a theoretical margin decomposition showing that the sign contribution to each logit grows as the square root of network width, dominating the magnitude residual.
The authors propose LM2LM, a framework that trains a language model via reinforcement learning to generate effective proposals for improving other language models. By using a frozen LLM (a research world model) to predict proposal gains from real experimental records, they avoid costly full execution of every proposal. Across eight LM development environments, LM2LM enabled a Qwen3.8-27B model to outperform GPT-6-sol on held-out tasks while requiring 33% lower data-generation cost.
The authors propose BayesianPRM, which treats process rewards as random variables and maintains a Bayesian belief over a discretized reward hypothesis space. Two belief updates address the two identified uncertainty sources, improving reward accuracy and test-time scaling on multimodal reasoning benchmarks.
Using a controlled URL-retrieval benchmark across ten models and seven languages, the authors independently varied request, retrieved-page, and response languages to isolate where safety fails. They found that non-English harmful requests raise mean tool admission from 46.9% to 67.4%, and that requiring answers in the page language increases harmfulness from 50.3% to 57.4% in closed-weight models. Audits further show that many non-harmful responses are language deflection or unusable answers, not genuine refusals.
The authors propose GR-OPD, a method that aggregates token-level feedback from a teacher into sequence-level credit for on-policy distillation of large language models. They show theoretically that broadcasting summed feedback yields an unbiased estimate of the reverse-KL gradient under on-policy assumptions, and empirically that it outperforms vanilla OPD in every tested setting, including gains of 10.9 and 11.5 percentage points on two mathematical reasoning benchmarks.
The authors introduce ReVision, which connects a frozen multimodal understanding model to a frozen image generator through a trainable parameter generator. For each image and natural-language instruction, it synthesizes transient low-rank weight updates that tailor the generator's behavior for dense prediction. ReVision matches state-of-the-art performance on segmentation, depth estimation, and surface-normal prediction without modifying the pretrained backbones.
The authors introduce MobileInject, the first benchmark for evaluating multimodal large language model based mobile agents against indirect prompt injection attacks. Across 11 realistic scenarios, 9 security-risk categories, and 108 executable risk instances, they find that mobile agents are broadly vulnerable, with many failures traceable to reasoning hijacking in early stages.
The authors introduce Savanna, a benchmark of 500 image generation prompts synthesized from recent news, and show that even harness frameworks built on frontier models retrieve a correct visual reference for only about half of them. They then propose Locate-Corroborate-Isolate, a three-phase agentic paradigm, and train Ranger-8B on 15K trajectories following it, raising the search score to 67.2 and improving generation quality across all tested generators.
Shay Moran and Chao Yan prove that any binary concept class with Littlestone dimension d can be learned under approximate differential privacy using O(d log d) examples, nearly matching the lower bound of Omega(d) when VC dimension is maximal. The proof introduces a structural exponential mechanism over data-dependent candidate sets and a rank that, for subspace indicators, is the codimension.
The authors introduce WebCoder, a general frontend development agent trained with artifact-grounded agentic reinforcement learning. They construct Webdev-World, an executable environment that integrates code editing, execution, and inspection, and use an independent verifier to assess final task requirements for rewards. On their benchmark Webdev-Bench, WebCoder-27B raises requirement satisfaction from 64.8 to 72.8, surpassing both its base model and Claude-Opus-4.8, and on Vision2Web it improves the average score from 41.1 to 62.4, matching Claude-Opus-4.8.
Prism Attention is a sparse attention mechanism for LLM decoding that reduces the overhead of selecting relevant past tokens across layers. The authors show that inter-layer token shifts are localized, and propose a two-stage method where proposal layers generate an expanded candidate pool using quantized scoring, and subsequent layers perform lightweight refinement to adapt attention to each layer. This yields state-of-the-art performance on reasoning and long-context benchmarks with a 3.4x end-to-end speedup.
The authors introduce ANCHOR, a benchmark of 2,319 videos and 8,272 question-answer pairs with structured reasoning traces, temporal evidence, bounding boxes and audio cues. Evaluating twelve multimodal large language models, they find that comparable final-answer accuracy does not imply grounded reasoning; removing video input drops accuracy by 38.4 to 41.8 points, while audio and bounding box removals cause smaller, model-dependent declines.
Liu and colleagues show that reinforcement learning based only on final-answer correctness can make search agents more accurate while making their answers less grounded in retrieved evidence. Their method, Grounded Credit Assignment (GCA), adds small, verifiable corrections for finding and using evidence, improving both accuracy and the evidence-supported share of correct answers.
Chen and colleagues examine why Group Relative Policy Optimization, or GRPO, can fail to make large reasoning models safer. They identify vanishing safety feedback and increasingly varied unsafe responses, then report that their Beacon framework reduced average safety error by as much as 32.83 percentage points while preserving reasoning performance and maintaining low over-refusal.
Yang et al. identify a privilege-escalation weakness in coding-agent execution harnesses that support reusable permissions. In experiments across four configurations of Claude Code and Codex CLI, adversarial repository content caused agents to request targeted allow-rules in 58% of instances, and approved rules often enabled later malicious actions without further user oversight.
Xu and colleagues developed DLite, a speculative decoding framework designed for agentic workloads with long, repeatedly extended contexts and frequent model calls. On Qwen3-4B and Qwen3-8B, the method accepted 2 to 6 drafted tokens per verification step and reported gains of up to 70% over the DSpark drafter, while eliminating the drafter’s historical key-value cache.
Liu and colleagues analyzed 7,955 software issue-resolution trajectories and found identifiable code reasoning in 66.95 percent of them, with greater reasoning associated with higher success. They then built DeskCheck, a scaffold that explicitly guides reasoning during localization, patching and validation, and report resolution-rate improvements of 6.29 to 10.53 percent on 731 SWE-bench-Pro tasks.
Giebenhain and colleagues fine-tuned a video diffusion model to act directly as an avatar, rather than generating or rendering an explicit 3D asset. Their Video Diffusion Avatar produced more perceptually faithful novel-view reenactments than tested single-image 3D and diffusion-based avatars, while retaining learned effects such as hair motion, shadows and reflections.
Göring et al. certify deterministic neural networks by analyzing their learned representations rather than their parameters. Their bound decomposes into three measurable terms and reaches a gap of only 8.0 percentage points to test error on CIFAR-10, while producing the first non-vacuous certificates on CIFAR-100 and at ImageNet scale.
The authors study behavioral couplings, where fine-tuning a language model to exhibit one behavior also elicits another, untargeted behavior. They show that such couplings can be manufactured by first training on documents describing two behaviors together, and that they are selective and can compose, making unintended misbehavior hard to trace.
The authors introduce ReDiST, a framework that constructs reasoning traces conditioned on a target student by revising its own correct or failed attempts against provided evidence. A frozen student-matched reader then selects the most teachable traces, and the student is distilled on these alongside an auxiliary answer loss. On MuSiQue and 2WikiMultiHopQA benchmarks, ReDiST outperforms answer-only, original-trace, and several baseline methods across four student models.
The authors present a self-building laboratory (SBL) that designs, configures and operates its own experimental setup given only a scientific objective. SBL builds missing capabilities from scratch and validated this with an end-to-end quantum-dot synthesis in a physical lab, plus multi-robot coordination in simulation.
Choi, Lim, Choo, and Schneider propose Consistent Sparse Dictionary Learning (ConSDL), which swaps the linear encoder of sparse autoencoders for per-sample sparse coding. Across synthetic and real-world settings, ConSDL improves cross-seed dictionary and coefficient consistency over six SAE baselines while nearing perfect recovery of ground-truth features.
The authors present PPMem, a video world model that augments a diffusion transformer with a planar prediction head and a Depth Token Fusion module. The model accumulates plane primitives into a persistent memory that conditions subsequent video chunk generation, achieving state-of-the-art video quality on DL3DV and RealEstate10K while using only ~100K primitives (5 MB) for a full scene.
The authors introduce JAXtari, a JAX-native reimplementation of the Arcade Learning Environment that runs entirely on GPU, removing the CPU emulation bottleneck. The framework achieves a 10x speedup over traditional ALE, allowing PPO agents to complete 100 million steps in under an hour. JAXtari also natively provides object-centric observations and a flexible modification system for controlled experiments.
Mukhopadhyay et al. examine two limitations of vanilla pixel diffusion transformers: the choice of training target and weak reproduction of fine image structure. Their MFlow method learns a separate interpolation between clean-image and velocity prediction along each principal data direction, adapting to the representation and model capacity without a manual subspace search. A post-hoc ConvRefiner then improves high-frequency statistics while leaving the diffusion backbone frozen.
Liu and colleagues diagnose a specific weakness in vision-language navigation policies: agents frequently find the requested object but fail to recognize when they should stop. By explicitly predicting whether the goal is visible and how far away it is, their StopWatch system substantially improves navigation success and shifts the main remaining bottleneck from policy learning to perception.
The authors train deepfake detectors progressively on 11 real-world generators in chronological order, tracking four fairness metrics alongside accuracy. They find that accuracy degradation typically intensifies unfairness, while fairness improvements remain rare, and that demographic imbalances persist even when replay buffers match the underlying demographic mix.
The authors introduce the Paired Fallback Robustness (PFR) Test to measure how reliably typed decision models (TDMs) follow fallback rules in non-adversarial settings. They find that correct category recognition does not transfer to correct fallback selection, and that logically equivalent definitions of the same fallback rule lead to inconsistent decisions.
Jangra and Muresan introduce DivAlgo, a benchmark of algorithmically diverse human solutions to programming problems, and evaluate 24 large language models (LLMs) for code generation. They find that unconditioned model-generated code captures only about 31% of the algorithmic diversity found in human solutions, and that even the best diverse generation strategies reach only 70.5% of that diversity. The paper concludes that overexposure to model-generated code could narrow programmers' algorithmic vocabulary.
The authors present the first demographically grounded safety evaluation of real-world health conversations with ChatGPT. After analyzing 15,555 health conversations from 1,252 users in India, Nigeria, Brazil, and Pakistan, they find that roughly one in five is high-risk. Risk concentrates in symptom and condition queries (33–48% high-risk), and context-aware scoring raises the high-risk share by 13–17 percentage points. One in four conversations that appear safe when scored in isolation becomes unsafe once the user's own history is considered.
The authors built a frozen benchmark of 65,228 agent decision states and paired each next-action question with independent factual probes about the same state. Across seventeen fast systems and a reasoning model, most wrong actions followed correct reading of the state. The more accurate the system, the larger the share of errors made with all facts correct.
Hu et al. present Jev-Guard, a 2B-parameter classifier that routes agent actions over an editable policy tree spanning content moderation, cybersecurity, privacy, and legal compliance, then classifies safety under the selected policy. On 7,033 evaluation cases it achieves 93.72% safety accuracy, 93.10% routing accuracy, and a mean latency of 58ms, with the full pipeline averaging 240ms.
Lukassen, Weisser, and Silbersdorff systematically tested eight typed decision models (TDMs) on the CALM bias benchmark for LLM judges. They found that every TDM is biased in three to eight of twelve tests, with emotional tone and position affecting all models. Despite being more biased than 2026 LLM judges, TDMs are cheaper and more consistent, making them a viable option for pairwise judgments if biases are evaluated.
The authors introduce SkillScreen, a compact decision model that scores the maliciousness of agent skills directly from their instruction files. On the MaliciousSkillBench, it detects 95.6% of malicious skills with a 3.3% false positive rate, and at matched 99% recall it flags far fewer benign skills than word-level SVMs or prompted LLM judges.
Yuetian Chen and colleagues introduce BrowseSafe++, a benchmark for indirect prompt injection detection that includes 32,187 pairs from production websites, each with HTML, Markdown, accessibility tree, and screenshot views. They show that their trained 0.8B-parameter detectors, BrowseSafe-Guard, outperform frontier models like GPT-5.5 in F1 score while keeping false-positive rates below 7.4%.
Lukauskas and Šarkauskaitė tested 14 decision models and 47 generative LLMs as substitutes for human survey respondents. The best generative model, MiniMax M3, reached a Psychometric Similarity Score of 0.813, matching a Gaussian copula fit only on other respondents and falling below an in-sample copula fit. Neither model class outperforms simple statistical baselines.