News without the noise
New AI papers from arXiv, picked daily and explained with their claims, benchmark results and code.
2566 articles · page 16 of 54 · The Research front page
The authors introduce INFUSE, an end-to-end benchmark for evaluating indirect prompt injection (IPI) in long-horizon agent workflows. They test 19 LLMs across 40 tasks with 56 attack scenarios, finding an average attack success rate of 19.6% under LLM-based evaluation and that existing guard models provide negligible protection against environment-embedded attacks.
The authors introduce local appearance purification (LAP), which strips locally predictable content from diffusion alignment targets, and show it improves generation across five pretrained encoders, with the largest gain for MAE. A closed-form diagnostic computed before training predicts which encoders benefit.
Simoncini et al. introduce a retraining-free method that makes pre-trained transformer encoders elastic by learning individual importance scores for every MLP neuron and attention head via differentiable soft pruning across many sparsity targets simultaneously. The method produces a single model that can be pruned to any sparsity level up to the deepest training budget, outperforming one-shot baselines. For example, pruning DINOv3 ViT-H+/16 to 50% sparsity removes 427M parameters with only a 0.8% drop in ImageNet-1k linear probing accuracy.
Yu et al. introduce ORL, a training framework that teaches diffusion language models to reuse and refine predictive distributions from earlier denoising steps. On a 4-billion-parameter model derived from Qwen3-4B, the authors report up to 6.2 times more tokens generated per model forward pass and about 6.9 times higher end-to-end throughput at comparable or better quality.
The authors introduce Player-1, a post-training framework that first fine-tunes a vision-language model on 6,044 curated gameplay demonstrations, then applies reinforcement learning in 16 synthetic game environments designed to cover common control demands. The resulting Player-1-9B model achieves 38.33% success on MineDojo-300, compared to 10.54% after supervised fine-tuning and 12.63% for the strongest baseline. The policy also generalizes to unseen games ViZDoom and GameWorld, showing that synthetic experience transfers beyond the training suite.
Trivedi and colleagues analyze first-price auctions as a serving-time market where AI agents bid for the right to respond to a user prompt, paying their bid when they win. They prove that two structural features of agentic markets, a competitive floor among bidders and near-independence of values after conditioning on the prompt, substantially improve the price of anarchy, raising the welfare guarantee from about 63% to up to 86.5% of optimal welfare or better. Simulations on the EmbedLLM prompt routing dataset confirm that realized welfare losses are much smaller than the worst-case bound.
The authors formalize Memory Consolidation as internalizing context-induced performance gains while preserving non-target capabilities, then propose Cortex, a method that anticipates future uses of context and writes them into parametric memory. Across dense and mixture-of-experts backbones from 4B to 120B parameters, including multimodal models, Cortex sits on the empirical consolidation-retention Pareto frontier in most evaluated settings.
Kang et al. introduce HICO-Bench, a benchmark of 180 everyday coordination scenarios where two agents with private information must agree on a plan. Each scenario has two versions differing in one private condition, and a program checks whether the plan is feasible (matches records and satisfies conditions) and an LLM judge checks integrity (conversation supports the plan). Across thirteen LLMs, 36% of conversations rated highly for goal completion fail these outcome checks. The authors also propose Paired-Credit Policy Optimization (PaCPO), a training method that uses tentative plans at each turn across the paired versions to assign credit, raising Qwen3-8B's verified success from 20.4% to 28.3%.
Dong and colleagues investigate whether autoregressive video diffusion models really need large collections of precomputed denoising trajectories for distillation. They report that separating high-noise and low-noise denoising into specialized parameter-efficient experts prevents the quality collapse seen with one-trajectory training, matching or slightly exceeding a fully trained baseline while reducing trajectory collection to about one A100 GPU-hour.
The authors present SWE-Stream, a system that scales the construction of executable training data for software engineering (SWE) agents by progressively validating and refining task candidates from development histories. Using an elastic streaming scheduler, it coordinates construction stages asynchronously under shared resource constraints. From 203,905 pull-request candidates across 10,728 repositories and six programming languages, the system produced 80,874 validated tasks and 118,688 successful trajectories; fine-tuning Qwen3-30B-A3B-Thinking-2507 on these data achieved resolve rates of 69.0%, 49.3%, and 45.42% on SWE-bench Verified, Multilingual, and Pro, respectively.
The authors present StreamErase, a framework for real-time video object removal that achieves sub-second latency and up to 26.06 FPS on a single H200 GPU. By progressively distilling a bidirectional diffusion teacher into an efficient unidirectional autoregressive student with attention sinks and rolling KV caches, the model enables indefinite-length streaming generation while maintaining visual fidelity. It is over 46× faster than prior methods and generalizes to diverse real-world video scenarios.
Gan et al. train small plug-in heads that read a web agent's next action from the hidden states of a frozen Qwen3-VL generator instead of generating a token string. On seven offline test sets a confidence cascade keeps step success within 0.3 points below and 1.4 points above the generator while deciding 12 to 64% of steps, and on WebArena it raises task success while generating less than half the tokens.
The authors present a framework that recovers aligned stakeholder intent, requirements and architecture from a compact repository representation (a static dependency graph and key contextual files), then release artefacts for 10,764 repositories in four languages. To test whether the artefacts carry design, a coding agent rebuilt 29 Commit0 Python libraries from the intent alone or with the recovered artefacts; the artefacts significantly improved module-level structural similarity (F1 from 0.54 to 0.63) without significantly changing the held-out pass rate (33.7% vs 35.8%).
The authors probe the contributions of different loop visits in a looped Mixture-of-Experts (MoE) transformer, finding that the first visit benefits from a reduced residual scale while the second does not. They propose LatentLoop, which compresses the sequence in the first visit and reallocates the saved computation to increase the model's hidden dimension. Across 15 matched budget configurations spanning 1.3B to 7B parameters, LatentLoop consistently achieves lower validation negative log-likelihood than both vanilla MoE and the looped baseline, and improves average scores on nine downstream benchmarks.
The authors present BluePixel, a native-4K editing model coupled with an agent harness, and disclose a training recipe that upgrades a 1K editor to 4K without pretraining from scratch. On VINS-4KEval++, it ranks second among seven models, behind only GPT Image 2, while completing an edit in 8.7 seconds on a single accelerator.
Hamada et al. show that once a benchmark's scores saturate, the transcripts of how models solved the tasks retain information about their capabilities on harder, held-out items. They simulate saturation retrospectively and compare four transcript-based protocols, finding that pairwise LLM judging extracts the strongest signal, cutting prediction error by 5.3 times compared to a baseline using only saturated scores. The capability signal is spread across transcript sections, but certain channels, such as reasoning and tool calls, carry more weight depending on the domain.
The authors present L3M, a runtime for AI agents that can write their own extensions and improve over time. Built in Lean 4, it stores all state in Git, allowing resumption, forking, and merging of agent trajectories. By enforcing invariants via type checking and making tool safety depend on reversibility, L3M achieves safe autonomous operation: on Terminal-Bench, it reaches about two-thirds of the success rate of an unsafe shell-equipped baseline using only tools that require no human review.
The authors propose two memory-efficient subspace optimizers, SMRC and PMRC, that keep optimizer states in a low-rank subspace and add the orthogonal residual gradient directly to the update. They prove both attain the same O(T^{-1/4}) convergence rate as their full-space counterparts, and demonstrate the approach on LLaMA pretraining from 60M to 1.3B parameters.
Yoon and colleagues show that programmatic instruction-following verifiers can award full credit to responses that satisfy output constraints while barely addressing the underlying request. Training against these verifiers amplified the problem: standard reinforcement learning with verifiable rewards improved constraint scores but sharply reduced judged response quality. Their proposed method, CaLIF, preserved answer quality while still improving constraint satisfaction across five model configurations.
Zhu et al. propose HyperCL, a contrastive pretraining method that learns 3D representations from language descriptions only, discarding rendered images as supervision. Embedding representations in hyperbolic space with an entailment loss improves zero-shot 3D shape classification and cross-modal retrieval by up to 4.6 and 5.5 absolute percentage points respectively.
The authors measure the Independent Verifiability Rate (IVR), the fraction of quantized LLM artifacts a third party can re-derive bit-for-bit from disclosed information. Across 198 popular Hugging Face GGUF repositories, the recorded-inputs IVR is 0/198. Supplying two omitted build coordinates, floating-point contraction and per-tensor quantization recipe, re-derives 7/8 target quant files bit-for-bit on x86.
The authors introduce a semantic reconstruction game that evaluates jailbreak success by inferring what request a response actually answers, then comparing that reconstruction against decoy requests. Across three off-the-shelf LLM judges, it achieves the lowest mean error against human labels among compared evaluators. Their method, which deliberately avoids false positives, substantially stabilizes reported attack success rates.
The authors propose Divergence-Triggered Dynamic Distillation (DTDD), which monitors student-teacher divergence during training and, when a segment diverges, rewinds to that segment and lets the teacher generate a recovery suffix that the student learns via behavior cloning. In long-horizon math, base-model distillation, and multi-turn agent settings, DTDD reduces training instability, accelerates learning, and improves task performance.
Lawson and colleagues propose TD-Aug, a data augmentation method that trains a geometric horizon model with temporal difference flows and uses its samples as imagined goals for goal-conditioned behavior cloning. Across OGBench tasks requiring compositional stitching, this improves success rates by 25 to 39 percentage points over standard BC, without any environment interaction.
The authors introduce ScreenRef, a large-scale GUI grounding dataset spanning desktop, web and mobile, and D2RL, a two-stage post-training method combining on-policy self-distillation with reinforcement learning. Their resulting GroundGUI-8B model reaches 95.2% on ScreenSpot-V2 and outperforms models trained on existing open-source data while rivaling models trained on proprietary data.
The authors propose CFRL, a post-training framework for continuous flow language models (CLMs) that denoise token embeddings over multiple steps. By training a critic to estimate verifier rewards from intermediate states, they bypass the non-differentiable decoding step and enable pathwise gradient backpropagation. On four program-verifiable reasoning tasks, CFRL reliably improves a 105M-parameter CLM and outperforms baseline methods of the same type.
The authors study how to allocate a limited budget of human preference labels across diverse user profiles (personas) when training language models for pluralistic alignment. They define a social welfare objective over supervision utilities and propose Welfare-Aware Preference Acquisition (WAPA), which greedily selects queries by estimated marginal welfare gain. On six Roleplay and four OpinionQA datasets, WAPA with a 20% human budget recovers 75–86% of the predictive utility gap between policies trained entirely on AI-generated labels and those trained on ground-truth labels.
Mijeong Kim, Kyujin Lim, and Bohyung Han introduce WorldRoPE, a positional encoding that models each image patch as volumetric Gaussian primitives in a shared world frame. At every Transformer layer, the rotary operator is integrated in closed form over where key tokens may appear in the query view, attenuating uncertain locations without rasterizing features. The method improves over image-space and ray-based encodings across three multi-view geometry tasks.
The LoongSage team presents a production-oriented reinforcement learning framework for agentic LLM training, with a roughly 14,000 line core built around fully asynchronous sampling and optimization. Across four complete training runs, task rewards improved steadily while hardware utilization stayed high and the train-inference gap remained controlled.
The authors decompose the risk of LLM abstention at matched coverage into answering ability and distinguishing ability, finding that abstention training primarily improves the former. They introduce TAPS, which first trains for accuracy alone and then applies a post-hoc confidence estimator, achieving 1.5–9.4 percentage points lower mean risk than three representative abstention training methods across three LLMs and three factual QA benchmarks, while keeping coverage adjustable.
The authors evaluate multi-turn jailbreaking against protected black-box LLMs and find that a single prompt-based safety layer reduces a strong baseline's average attack success rate from 0.896 to 0.608, a 32.1 percent relative drop. They introduce ATTCK-R, a planning-driven framework that consistently outperforms recent multi-turn jailbreaking methods across nine protected LLMs.
Zeng et al. propose DIGS, a training-free framework for open-vocabulary segmentation of 3D Gaussian Splatting scenes. Instead of committing each Gaussian to a single semantic feature, DIGS stores a compact top-M label distribution updated by a tempered Dirichlet rule, and renders via late argmax. On LERF-OVS it reaches 71.95% mean mIoU in 1.0 to 3.2 minutes per scene, outperforming both the training-free SFS and the training-based LaGa baselines.
The authors propose Unravel, a training-free framework that converts a single image into an interactive 3D scene where each object is a separate movable asset. Instead of generating entangled geometry or predicting all objects at once, Unravel iteratively removes fully visible objects, restores occluded regions using image editing, and reconstructs each asset from its best-observed snapshot before reassembling the scene in reverse order. Experiments on diverse indoor scenes show it recovers more objects with more faithful placement and improved physical plausibility compared to existing feed-forward and agentic baselines.
The authors define intervention attribution as the first-order effect of a specified intervention on model output, prove that observational feature-discovery scores (correlations, probe coefficients) generally do not identify it, and demonstrate across four model-SAE pairs that gradient-based attribution predicts real intervention outcomes with high accuracy while probe-implied changes are off by orders of magnitude.
The authors propose SurgiCLAW, a hierarchical agent that confines a multimodal large language model (MLLM) to intraoperative visual understanding and atomic-skill selection, delegating physical execution to verifiable deterministic control programs. On a brain-machine-interface implantation task, the system achieved 88.0% task success rate in 50 closed-loop real-robot trials, with 94.6% skill-selection accuracy and 93.0% macro-averaged F1 on a fixed test set.
The authors introduce PhySimCode, a benchmark of 160.6K procedurally generated physics simulation videos paired with code, parameters, and physics chain-of-thought explanations. Evaluating ten multimodal large language models, they find that models state physics laws fluently but largely fail to infer those laws from video or recover the quantitative parameters needed to reproduce a scene.
Malik et al. introduce BharatSetu 22-Indic 1M, a dataset of 984,764 English sentences each translated into all 22 scheduled Indian languages using the sarvamai/sarvam-translate models. Because each row shares an English anchor, any two columns form a translation pair, yielding 462 directed Indic-to-Indic pairs that can be filtered by a confidence score.
Luo et al. introduce DriftSpread, a one-step generative policy for online maximum-entropy reinforcement learning. By deriving drift and spread updates from the negative MaxEnt objective, the method trains an actor to sequentially move actions toward higher values and then broaden their distribution, achieving both strong control performance and efficient training on MuJoCo benchmarks.
The authors introduce and analyze screening collapse, a phenomenon where recursive synthetic data (labels generated by previous models) degrades variable screening, causing relevant features to be discarded. In a Gaussian linear model with minimum-norm recursive generators, they establish finite-sample screening bounds, characterize an information-loss limit in late generations, and prove a minimax impossibility result. They also show that data accumulation can avoid collapse if the pooled target preserves a positive margin and the sample grows sufficiently.
Noh et al. propose CondMSP, a framework that extends materials synthesis planning from recipe prediction to execution-aware planning. By jointly predicting synthesis conditions and using them as process context for operation sequences and as constraints for resource allocation, they achieve a reference-recipe recovery rate of 32.9% under a budget of three furnace runs (compared to 27.9% for baselines) and 40.0% at 30 trials (compared to 34.7%).
Khanbayov and Kurban rigorously show that the renormalized top-k distillation objective has zero gradient along directions controlling tail-mass variation, so a student can match the teacher on shown tokens while its tail mass drifts arbitrarily. On seven open-weight teachers, recovery of the full teacher distribution becomes exact only when k equals or exceeds the teacher's hidden dimension plus one, a threshold far above the k values commonly cached in practice.
Yao et al. introduce PathFM, a 300-million-parameter time-series foundation model that generates complete multivariate futures rather than separate quantiles for each time step. The model combines conditional flow matching, sampler distillation, attention-cache reuse and direct calibration, achieving competitive marginal forecasts while better preserving dependencies within trajectories.
Shen et al. address goal drift, the tendency of LLM-based agents and multi-agent systems to deviate from their objective during long-horizon execution. They train a steering agent that monitors execution on the fly and intervenes when drift occurs, and find that reinforcement learning transforms a weak zero-shot supervisor into an effective one, raising performance across seven question-answering benchmarks and in a five-role multi-agent system.
Xu et al. identify a mismatch between single-session training assumptions in agentic reinforcement learning and inference-time techniques like context compaction and subagent forking. They propose Mosaic, a critic-free hierarchical optimization method that combines session-aware trajectory-level advantage estimation with session-level advantage shaping. On the BrowseComp benchmark using Qwen3.5-4B, Mosaic outperforms the broadcasting baseline by 10.1% relative accuracy while reducing average sessions per trajectory from 3.17 to 2.35.
Chalumeau et al. benchmarked three AI weather models—GenCast, FourCastNet 3, and FGN—against ECMWF's operational ensemble (IFS-ENS) on 178 tropical cyclones. FGN achieved better probabilistic track scores than IFS-ENS for 90% of 2025 storms, a clear improvement in location forecasting. However, all models underestimated peak wind speeds by 10–15% and showed overconfident ensemble spreads, indicating that the gains are concentrated in spatial structure rather than intensity.
Deng, Liu, and Zhu systematically compared two carriers of internal state (KV cache and residual-stream activations) and two fusion mechanisms (augmentation and replacement) in a controlled latent-fact transfer setting. They find that the KV cache must be augmented (the receiver cross-attends to a peer's cache while keeping its own, with a small trained adapter), whereas activations work best when written directly into the receiver's residual stream with no bridge and no training. The rule 'augment the cache, replace the activation' holds under one protocol, and one adapter serves multiple publishers it never trained on, provided their internal state lies close to the receiver's.
The authors introduce StructParts, a framework that reuses holistic 3D generation priors for part-decomposed asset generation. By interpreting each shape latent under both a part-local and an object-global coordinate frame, and processing these through a global-local interleaved transformer, the method inherits both per-part geometric detail and whole-object structural coherence from the same pretrained weights. On PartObjaverse-Tiny, StructParts matches or surpasses prior specialized part-decomposed models while requiring substantially less training.
The authors propose ReFlow, a system-algorithm co-designed reinforcement learning framework that uses experience replay of recent trajectories to amortize the high cost of rollout generation in LLM post-training. By implementing a decoupled architecture with a dual replay data cycle, elastic resource pool, and adaptive scheduler, ReFlow improves training throughput by up to 2.06× over state-of-the-art synchronous and asynchronous RL systems across single-turn reasoning and multi-turn agentic tasks, while maintaining comparable or better model performance.