News without the noise
New AI papers from arXiv, picked daily and explained with their claims, benchmark results and code.
2566 articles · page 42 of 54 · The Research front page
Wang and Liu present MemCodex, an agent memory architecture that can rewrite how different forms of experience are constructed, indexed, retrieved and routed. Across the reported evaluation, it raised average task success by 10.1% relative to the strongest adaptive-memory baseline while using fewer context tokens and reducing inference time.
He and colleagues study why language agents fail during multi-turn tasks, where one bad action can alter the environment and compound later errors. They find that many failures trace to an early, consequential mistake that remains recoverable, and show that explicitly training for prevention and recovery outperforms standard distillation approaches across several agent benchmarks.
Yang et al. introduce ScholarEvolve, a framework for improving the software harness that controls an agent’s tools, context, memory, skills, and execution workflow. On AppWorld and Tau2-Bench, research-guided harness changes substantially improved task completion while the underlying language models remained fixed.
Rho et al. introduce Game-Guided Skill Discovery, which trains embodied agents through competitive self-play while constraining their high-level control to a small set of discrete skills. Across ant, robot-arm and humanoid environments, the resulting behaviors were directly usable by humans and could be composed into more complex actions, including solutions to previously unseen tasks.
Yang et al. introduce ReCAP, a memory system for long-running LLM agents that records which earlier messages mattered and how they depended on one another. Across coding-agent evaluations, it substantially reduced context and estimated restoration latency while maintaining comparable task quality, and sometimes outperformed supplying the complete history.
Iten and colleagues introduce TacEx, an exploration framework that rewards robots for reducing uncertainty specifically about tactile outcomes rather than about every unpredictable transition. The authors report that this focus drives contact-rich exploration without task rewards or expert demonstrations, yielding data that supports offline pick-and-place learning and sample-efficient post-training of vision-language-action models.
Cai et al. present Cogentic, a harness designed to sustain mathematical research across many model calls rather than relying on a single response. Starting from problem statements without expert hints, the system generated claimed novel results for five open problems in online learning, auction theory, and mechanism design, which the authors report were independently checked by domain experts.
Zhan et al. introduce a dataset and evaluator for diagnosing incorrect object motion in generated videos, rather than judging only appearance or prompt alignment. Their evaluator converts videos into motion-aware representations and produces human-aligned scores across three dimensions, alongside explanations tied to specific failures.
The authors introduce PrivacySkills, a framework with 55 synthetic tasks and 169 skills to evaluate how LLM agents choose among equivalent acquisition pathways (public, confidential, or user interaction). Testing five open-weight models, they find that without guidance agents access confidential sources 30% of the time (45% when user is unavailable). Combining system-level privacy instructions with skill-level intrusiveness labels roughly halves this rate, whereas either method alone yields smaller reductions.
The authors compared nine agent configurations, from fully open to closed commercial, on their ability to autonomously complete a survey and evade detection. They found that open agents ran locally with no usage fees and performed competitively with commercial alternatives. Critically, open and commercial agents failed different detection checks, so no single check reliably caught all agents; open-text responses were the most discriminative but still imperfect.
The authors introduce CRJudgeBench, a benchmark of 1199 instances built from real pull requests and expert-verified perturbations, assessing whether AI agents can distinguish technically valid code review comments from plausible but invalid ones. They also present Sentinel, a repository-grounded agentic judge trained via iterative action-level learning, which achieves 76.60% accuracy on the test set, substantially outperforming base models and showing that general-purpose LLMs struggle with this task.
Li et al. propose SkillCome, a method that improves large language models by iteratively refining textual skills. For each question, the system generates multiple trajectories, contrasts successful and failed ones to pinpoint effective actions, and accumulates evidence across iterations in a dual memory system. On six benchmarks spanning reasoning and agentic tasks, SkillCome consistently outperformed prior skill evolution baselines, with gains up to +5.69 points.
The authors propose Attuner, a method that learns to read frozen key-value (KV) caches of reusable content artifacts via query-side adaptation, eliminating the need for cache recomputation. On Qwen3-4B and Qwen3-8B across seven benchmarks, Attuner matches full-context prefill quality while providing up to 3.73x speedup, and substantially outperforms prior position-independent caching baselines.
The authors introduce On-Policy Attention Self-Distillation (OPASD), which adds solution-conditioned attention alignment to token-level on-policy self-distillation. Across three model sizes and four competition-level math benchmarks, OPASD consistently outperforms token-only distillation, improving average accuracy by 4.98 to 8.40 percentage points and reducing generated tokens by 73.9%.
Yin and colleagues address a failure mode in reinforcement learning-based security testing: when every attempted prompt injection fails, the attacker model receives no reward from which to learn. Their target curriculum produced effective attacks against models that two existing RL methods could not breach under the same evaluation, and the resulting attacker transferred to previously unseen models.
Xu and colleagues test whether generated LLM harnesses, programs that structure model inference, offer genuine task specialization rather than extra chances to obtain a correct answer. On MATH-500, the generated programs produced few stable advantages over a baseline, enabled no gain from advance selection, and tied identical baseline copies under a matched execution budget.
Li and colleagues built OpenTumorBoard from recordings of real multidisciplinary cancer discussions, preserving the sequence of questions, specialist responses and consensus decisions. Testing 14 general-purpose and medical language models showed that even the strongest systems remained substantially below full clinical equivalence, although supervised finetuning and reinforcement learning improved results on held-out cases.
Li, Mukherjee and Pal study how reliably teams can validate an LLM judge when only a small fraction of items receive labels from both humans and the model. Through statistical analysis, simulations and tests of 10 judges, they find that sparse overlap can produce high error rates even when the overall annotation budget appears substantial.
Lyu and colleagues test an alternative to optimization loops that simply discard candidates failing an acceptance threshold. Across three benchmarks, their method produced stronger task results with fewer evaluations by treating rejected configurations as intermediate steps rather than dead ends.
The authors introduce StepLearn, a nonparametric framework for test-time learning in LLM agents. Instead of learning only from completed episodes, StepLearn distills individual transitions into hypotheses that can guide the next decision, while deferring persistent reuse until those hypotheses are prospectively validated in later episodes. Across five rounds on WebArena-Lite and ALFWorld, StepLearn outperforms the strongest baseline EvoTest by 2.2 to 12.7 percentage points.
Bohlinger and Peters introduce ChronoSRL, a self-supervised reinforcement learning method whose learned representation measures distance in units of goal-reaching time rather than physical proximity or an unconstrained similarity score. Across seven locomotion and navigation benchmarks, the authors report faster learning and higher performance than contrastive and survival-based alternatives, including methods using larger networks.
Li and Li introduce SAKIKO, a framework for auditing internal activation interventions that alter whether language models call tools, seek clarification, answer directly or decline. Across seven models, the authors find targeted improvements in five, but show that changing a wrong decision is not sufficient evidence of repair because interventions can redirect it incorrectly or damage previously correct behavior.
Li tests whether a language-model judge calibrated on one agent version remains reliable when comparing newer versions. Across SWE-bench, tau-bench and expert-labeled trajectories, fixed judges showed version-dependent errors that could distort estimated improvements, while auditing current paired outputs proved safer than reusing old calibration.
Jung et al. address a weakness in Group Relative Policy Optimization (GRPO), which normally gives every generated token in a trajectory the same outcome-based advantage. Their ProVer framework instead identifies potentially pivotal segments and estimates their contribution using fresh policy rollouts, improving average task performance across three agent environments.
Tiwari, Vass and Singh present Assay, a Python system that combines repository indexing with an evidence ledger for AI-assisted software delivery. Each claim about code is tied to a Merkle hash of the relevant dependency cone, meaning the module and everything it depends on, so changes invalidate precisely the claims that may no longer hold. Across five public repositories, this approach reduced unnecessary re-verification while a model-free merge gate blocked all nine scripted adversarial behaviors.
Zhan et al. augment pretrained language models with an action encoder that directly scores the structured actions available in an environment, rather than generating each action token by token. The authors report that this architecture improves interactive task performance through reinforcement learning, including when the underlying language model remains frozen.
Wang et al. examine how agents decide whether to retain proposed edits to persistent instructions that encode workflows, tool use and decision rules. Their SAGE gate compares old and edited skills on the same validation items, penalizes regressions, and abstains when evidence of improvement is statistically weak. Across five benchmarks and four language models, it reduced regressions in 19 of 20 settings while producing the highest final score in every setting.
Penaloza et al. introduce KV-streams, a method that retains and selectively evicts entries from an agent’s key-value cache instead of rebuilding the cache after every context compaction. Across three compaction strategies, the approach produced 2.6 to 5 times wall-clock training speedups, with no observed reduction in final task performance.
Jiang et al. introduce MMSkillRisk, a benchmark for testing whether agents execute malicious instructions disguised as annotations, labels, or other ordinary elements in skill images. Across nine model and agent-harness configurations, these visual attacks achieved a pooled 43.1% attack success rate, often without preventing completion of the requested task.
Huang et al. test whether language models disclose errors and limitations that materially change how completed work should be judged. In one machine learning reporting scenario, GPT-5.5 mentioned a planted negative result in only 2 of 200 reports, rising to 190 of 200 after the prompt added the sentence, "Be honest in your response."
The authors present an intrinsically motivated option discovery algorithm that learns abstract subgoals by attending only to a relevant subset of state features, rather than requiring the agent to recreate entire states. In three sparse-reward, image-based domains including Montezuma's Revenge, the method discovers options that transfer across tasks and significantly outperform prior state-reaching approaches.
The authors derive a Contrastive Safety Loss with a suppression weight that modulates the dominant eigenvalue of a safety instruction's operator in transformer models. They demonstrate that varying this weight produces a continuous relationship between attack success rate and over-refusal rate, and that appropriate weight values yield Pareto-improved safety instructions across multiple optimization methods.
Liang and colleagues introduce UpliftMem, a retrieval method that scores an entire set of memories by its execution uplift relative to running the same frozen agent without memory. Across three agent benchmarks, the method produced the highest success rates among the evaluated baselines while requiring no additional probing at test time.
Costa et al. test “AI lowering,” in which a large language model bypasses Triton’s optimizing compiler and generates GPU assembly directly from Triton source. Across 22 kernels, the resulting PTX was sometimes slower than autotuned Triton but achieved substantial gains when the agent found hardware-specific transformations absent from Triton’s lowering pipeline.
Xinran Zhang introduces CTE-Bench, an executable benchmark that isolates whether models can predict the downstream effects of modifying a stateful software service. Across four API-hosted models, exact response accuracy on intervention-affected calls reached 54.3% to 61.5% when correct previous responses were supplied, but fell below 34% without that feedback or when models relied on their own predictions.
Li and colleagues test whether robot policies can recognize and correct failures during manipulation, finding that retries, textual error descriptions and best-of-N selection rarely produce reliable recovery. Their Spotter system instead assigns reflection to a vision-language model (VLM), improving simulated and real-robot success rates while avoiding the latency of VLM-led control.
Guo et al. present XRepoSkill, a method for extracting reusable software engineering guidance from agents’ prior repair attempts without retraining the underlying language model. Across two held-out benchmarks and three backbone models, it achieved the highest issue resolution rate among the evaluated skill-learning methods, with its largest reported gain on the long-horizon DeepSWE benchmark.
Wang et al. identify a source of noise in self-rewarding reinforcement learning: a response’s reward can change depending on which other model outputs happen to share its rollout group. Their Group-Marginalized Advantage Estimation method aggregates rewards across possible group contexts, producing more reliable policy updates without human labels. Across eight benchmarks and four base models, the authors report improved performance, stability and cross-domain generalization.
Lowet and Kurzeja convert a written model constitution into low-rank adapters and activation steering vectors using synthetic training data. Their constitutional adapters improve resistance to jailbreaks and measured misalignment, despite receiving no harmful requests or jailbreak examples during training, while allowing operators to adjust the balance between safety and benign compliance at inference time.
Cheng et al. present SafeCoEvo, an external safety system that learns continually from an agent’s completed interactions rather than repeatedly training on a fixed task set. In their continual evaluation, the system reduced unsafe outcomes by 10.05% and increased successful task completion by 12.15% relative to the strongest baseline.
Russinovich presents CounterSteer, an inference-time defense that subtracts a learned activation direction from tokens returned by tools, without adding prompt text, training the model, or first detecting an attack. Across five open-weights models, the defense substantially reduced indirect prompt injection while preserving most measured benign utility, although it was less effective against attacker-controlled tool arguments.
Yin et al. introduce StructRL, an online reinforcement learning framework for vision-language-action models performing extended sequences of dependent robot manipulations. Across two simulation benchmarks and two foundation policies, the authors report that structured, pace-sensitive subtask rewards outperform the evaluated online RL baselines that rely more heavily on terminal success.
The authors study RE(S), a generalization of REINFORCE that updates the rollout distribution once every S gradient steps. They prove that for softmax policies in multi-armed bandits, RE(S) converges globally to the optimal policy at a Θ(1/T) rate for any S, and that off-policy sampling (S>1) avoids prolonged entrapment in suboptimal policies when the initial policy assigns low probability to the optimal action.
Mohammadkhani and colleagues study whether reasoning models can solve covert tasks while concealing the relevant computation from chain-of-thought monitors. They find a sharp distinction: sufficiently difficult hidden computation must leave an information-theoretic footprint, but cryptographic encoding can prevent any efficient monitor from interpreting that footprint.
Peng et al. introduce LoLBench, a benchmark that asks coding agents to implement substantial software enhancements from human-written proposals rather than detailed coding specifications. The results separate two challenges: understanding how a high-level design maps onto an existing repository, and correctly implementing the resulting changes. Even the strongest evaluated agent resolved only 14 percent of tasks.
Mao and colleagues present WEFT, a framework for scaling tool-use post-training across the entire agent interaction system rather than generating more executable environments alone. Across several models and benchmarks, WEFT outperformed matched-size environment-scaling baselines, with the largest reported gain reaching 12.27 percentage points.
Jeong et al. introduce CorpusMap, an offline-built navigation layer for agents searching large, heterogeneous document collections. Across three benchmarks and seven language models, agents using the map found distributed evidence and answered questions more effectively than agents searching a flat corpus, while consuming fewer tokens on average.
Wei and colleagues present OptiCom, a framework for dynamically composing the mechanisms used by LLM-driven optimizers rather than relying on one fixed search configuration. Across 32 benchmark groups, OptiCom ranked first by maximum score in 23 groups and achieved an average rank of 1.72 among 14 evaluated configurations.