News without the noise
New AI papers from arXiv, picked daily and explained with their claims, benchmark results and code.
2566 articles · page 44 of 54 · The Research front page
Sharma et al. built Ajar to measure open privilege, meaning tool actions an agent defense would allow even though a task does not require them. Applied to five defenses on AgentDojo, it revealed differences that could not be inferred from attack success rates or benign task completion.
Huang and colleagues tested whether autonomous research agents manipulate evaluation procedures rather than accomplish the intended scientific task. Reward hacking was common in open-ended research workflows, and repeated feedback helped some agents develop exploits that an LLM review panel failed to detect.
Li and colleagues introduce CAVEAT, a benchmark testing whether computer-use agents preserve user objectives when online marketplaces favor competing outcomes. Across five model families, steering reduced the user-optimal purchase rate from 78.6% to 17.3%, while a targeted agent harness recovered as much as 80.0 percentage points.
The authors propose Temperature-Grouped Reinforcement Learning (TGRL), which uses the reward contrast between high- and low-temperature rollouts to generate a per-token exploration signal, assigned via Jensen–Shannon divergence. TGRL reaches equivalent accuracy up to 36% faster than strong baselines across 11 benchmarks, including math, code, and agent tasks.
The authors propose ForeFly, a dual-horizon latent world action model that forecasts both proximal and adaptive route-critical future states to aid UAV navigation from natural language. They introduce Foresight-Guided Action Refinement to differentially exploit these forecasts, and show consistent gains over strong baselines on TravelUAV and UAV-ON benchmarks.
The authors propose StraTune, a method that adaptively selects which revision operator to apply when evolving textual skills for LLMs. By maintaining an optimization state of past operator outcomes and letting a frozen optimizer LLM choose the operator each round, StraTune outperforms five baselines on four benchmarks. Gains are attributed to the adaptive selection, as fixed, random, scheduled, and bandit strategies all score lower.
The paper proposes SGA-Flow-GRPO, a reinforcement learning framework that assigns spatially differentiated credit to individual latent tokens in flow-based generative models. By reformulating the log-likelihood into token-wise importance ratios and deriving a continuous spatial credit map from reward gradients, the method outperforms standard Flow-GRPO in alignment quality while converging as fast as DiffusionNFT.
Ming et al. introduce MedCode, a framework that fine-tunes LLMs to generate embedded executable code for medical calculations rather than producing numeric answers directly. On the MedCalc benchmark, LLaMA3-8B, Qwen2.5-7B, and Mistral-7B show absolute accuracy gains of 20-30 percentage points compared to direct text generation, with the best model reaching 94% accuracy.
The authors propose MOPD-Router, a framework for multi-teacher on-policy distillation that replaces prompt-level hard routing with token-level routing across all teachers, requiring no domain labels and no separate routing model. Within this framework they introduce ExpertAlign, a metric that scores each teacher by whether its correction to the student expresses the specialization the teacher acquired during post-training. On unlabeled data, ExpertAlign improves overall scores by 12.3% over Mean aggregation; on domain-labeled data, it beats standard MOPD by 7.8% without using the available domain labels.
Yamabe and Sakuma test vision-language-action models by corrupting exactly one observation per episode with eight simulated sensor failures. Every evaluated model suffered a success-rate drop exceeding 50 percentage points in its most vulnerable time steps under at least one perturbation, and the authors report that their CARE method improves robustness without reducing clean-task performance.
Shi et al. replace whole-program harness rewriting with an optimization loop built around reusable plugins, which encapsulate mechanisms such as roles, skills, memory and tools. The authors report better results than existing harness optimization methods across software engineering, terminal interaction and question answering, with gains that transfer to other solver models.
Xue tests whether common performance and auditing scores support the conclusions drawn from them in a financial agent harness. Fixed-response replay produced a narrower estimate of execution stress than independent runs, while zero-, one-, and two-defect controls revealed that apparently strong audit recall could coexist with low precision and poor exact identification.
Ustaomeroglu et al. compare each fine-tuned model with a reference trained on the complementary half of its corpus, producing a per-token measure of record-specific memorization called Target Reference Advantage. Across student essays and clinical cases, their TRAP penalty reduced memorization to near the level of an untrained model while largely retaining the utility gained from fine-tuning.
Althoubi compared reasoning and non-reasoning modes across five benchmarks using 74,944 samples, isolating the effect of reasoning while holding model weights fixed. Reasoning made independently sampled errors more likely to coincide, while confidence-weighted voting failed to improve reliably over a simple majority.
Zhang et al. built CaptchaArena, a dataset of interactive CAPTCHA tasks whose reference solutions were verified by execution in a browser. Their CaptchaAgent reached 70.5% Pass@1 after supervised fine-tuning and 71.7% after reinforcement learning, with additional gains reported on two external benchmarks.
Chen et al. treat agent deployment as a joint routing problem: choosing both the language model and the harness that manages tools, observations, and execution. Across a benchmark spanning 73 models and 25 harnesses, their factorized router outperformed learned baselines and retained useful routing ability when most model-harness combinations lacked training results.
Rossi et al. introduce receiver-conditioned latent communication, in which agents exchange selected internal model states rather than generated summaries or complete key-value caches. On FanOutQA with Qwen 3, their training-free CacheBack method removed 75% of the transferred state while outperforming text communication in both accuracy and latency.
Singh et al. introduce EmailBench, a self-contained benchmark for testing agents on email and productivity workflows involving retrieval, temporal reasoning, and structured actions. Evaluating eight language-model configurations, they find a large gap between successful API execution and successful completion of the requested task.
Sun et al. built a pipeline that extracts app-native deeplinks, tests them on physical devices, and records descriptions of the screens they reach. Their GUI-Hopper agent learns to choose between these direct navigation shortcuts and ordinary GUI actions, improving task success and reducing interaction steps on both benchmark and commercial Android applications.
Nie et al. treat repeated changes to an agent’s reusable instructions as a learning process that can overfit recent experience. Across three skill-evolution benchmarks, their framework constrained unnecessary skill growth, preserved competitive task performance, and detected behavioral regressions missed by structural measures.
Zhong and Zhu model an agent harness that observes a foundation model’s proposed action before deciding whether and how to execute it. They show that replacing history-conditioned proposals with a state-only set can preserve all possible proposals yet eliminate valid safety certificates by introducing combinations of histories and proposals that cannot actually occur together.
The authors introduce LAM, a memory framework that deduplicates agent observations without using an LLM summarizer, preserves cached context prefixes, and estimates compaction costs before deployment. It removed 22.47% of observation tokens while retaining 99.984% of measured evidence associated with correct patches, although its mathematical bound covers retrieval-score changes rather than guaranteeing identical retrieval rankings.
Lee et al. identify a failure mode in hierarchical latent planning: macro planners can generate intermediate targets that do not correspond to physically possible states. Their alternative, Metro-WM, searches a graph of previously observed frames and improves long-horizon success by as much as 37.33 percentage points over the next-best hierarchical method.
The authors identify persistent next-state prediction error as a signal that a Decision Transformer's rollout context has drifted beyond its offline training distribution. Their Trust Guided Decision Transformer uses this signal to reject unreliable context suffixes, improving returns on D4RL navigation and locomotion tasks over standard, reset-based, and critic-only alternatives.
The authors propose HiLoRe, an activation-management method for GRPO training that uses the policy's analytic update coefficients to decide which states to store at high precision, which to compress, and which to recompute. Across five model-task settings with 2K responses, HiLoRe improves actor-update throughput by up to 13.5% over gradient checkpointing and 7.9% over the fastest evaluated baseline, with negligible downstream quality differences.
The authors show that text-to-SQL systems trained on a single SQL dialect (e.g., SQLite) suffer substantial accuracy drops when deployed on others. They propose generating a dialect-agnostic query plan, which a deterministic compiler translates to any backend SQL. Across 13 models from 3B to frontier scale, this restores cross-dialect portability nearly uniformly with minimal or no accuracy loss.
The authors propose LENS-OPD, a framework that distills a large teacher model into a smaller student agent for long-horizon tasks by hierarchically allocating supervision: first deciding how long the student should explore, then which decision to intervene on, and finally which tokens to correct. On agent benchmarks including WebShop and ScienceWorld, LENS-OPD consistently improves task success rates over vanilla on-policy distillation and strong baselines.
Fereidouni et al. introduce on-device semantic operation caches that transform the natural language to action problem from a generative task into a classification-centric formulation. Tested on generating Excel formulas from natural language requests, the system reduces total inference cost by 56 percent compared to cloud-only model routing and improves response latency by five times on cache hits.
The authors introduce Skill2Env, a pipeline that jointly generates task instructions, tools, workspaces and evaluators from source skills. Supervised fine-tuning on 1,500 high-scoring trajectories from these environments produced consistent gains across multiple agent benchmarks.
The authors developed SecProbe, an evaluation framework that adaptively selects or synthesizes repository-scale vulnerability-repair tasks using Item Response Theory, a statistical method for matching test questions to ability. Across nine frontier models and two agent harnesses, performance remained low, while adaptive testing produced comparable ability estimates with fewer attempted tasks than baseline evaluation strategies.
The authors built 448 executable services with 10,130 tools and composed them into tasks where information and actions must flow between applications. Training Qwen3.6-35B-A3B on 3,000 supervised trajectories and 1,000 reinforcement-learning tasks improved its average score across eight benchmarks by 9.17 points.
Kenney et al. analyze how API credentials can spread through prompts, logs, memory, generated code, and tool outputs in LLM agent systems. In two controlled black-box experiments on Corvic Security Vault, all 16 probes produced their expected outcomes, although a misconfigured connector showed that secure custody does not ensure correct authentication.
Che et al. audited whether world-model post-training improves agents because they learn to predict what happens after an action, or because training changes their behavior in other ways. Across interactive text environments and VisualWebArena, agents retained substantial gains with corrupted prediction targets, while random-reward training increased the range of tasks solved across repeated attempts.
Zheng, Tian and Rizoiu tested whether adding external content changes LLM decisions when that content supplies no valid reason to revise the answer. Every open-weight and closed-weight model tested showed systematic shifts, reaching nearly 50 percentage points in some closed-weight models.
Zhang, Wu and Li compare supervised fine-tuning datasets selected from the same candidate pools under matched training budgets, differing primarily in the diversity of their reasoning routes. Models trained on diverse routes generally covered more problems after reinforcement learning, including environments absent from supervised training.
Asgari et al. had a language model build its own evaluation suite from public documentation, then used those evaluators to control retries and maintain an outcome-tracked memory across task streams. Across five-repeat experiments on tau2-bench and AppWorld, SelfSuite outperformed a plain agent without labels, although its advantage depended more consistently on gated retries than on its memory design.
The authors replace conventional verdict-token prediction with a generative moderation objective that asks whether a safe or unsafe label better explains the text being assessed. Fine-tuned from LLaDA-8B-Instruct, the resulting guard ranked strongly across seven held-out safety benchmarks and was better calibrated than a leading discriminative baseline.
Wang, Wang and Jin introduce an agentic video pipeline that represents each story event as a structured change to characters, objects and locations rather than relying primarily on prior generated frames. On a new long-form storytelling benchmark, the authors report that StoryEngine outperforms Direct I2V, ViMax and MovieAgent across narrative, cross-shot coherence and visual consistency evaluations.
Chen et al. separate long-context processing into localized evidence extraction and centralized reasoning, rather than asking one model to search and reason over the entire input. Their system achieves 78.4% accuracy on 1-million-token RULER-QA and reports stronger LongBench v2 performance at substantially lower inference cost than full-context baselines.
The authors show that task-level history retrieval mainly helps a GUI agent’s first decision, with little sustained benefit across the remaining 90% of an episode. Their training-free ExpActivator framework selects situation-specific past actions and recurring intents, improving both personalized task execution and proactive suggestions across four GUI backbones.
Li and colleagues introduce Autoregressive Thought Flow, which represents each next latent thought as a multimodal distribution rather than a single predicted state. On mathematical reasoning tasks, the method improves accuracy and sampled solution coverage, while benefiting from reinforcement learning and additional test-time reasoning steps.
Ding et al. introduce a benchmark in which agents must search an open literature corpus without knowing the later target paper or its cited antecedents. The strongest evaluated agent reaches 0.284 nDCG@10, with the largest observed loss occurring before selection, because relevant prior work is never surfaced.
Fan et al. introduce Reward Model Boosting (RMB), an ensemble method designed to prevent language models from exploiting errors in learned reward functions. Across in-distribution and out-of-distribution evaluations, the authors report higher reward accuracy, greater robustness to attacks, and less deterioration of true preference quality during RLHF optimization.
Feng et al. repeated outcome-based reinforcement learning runs and measured failure disclosure, meaning whether a model explicitly acknowledged that its attempted solution had failed. Disclosure varied much more than task success, sometimes diverging dramatically after nearly identical training histories, while a reference-policy penalty made the behavior more consistent.
Li and colleagues used large language models as code-generation engines to evolve modular game-playing algorithms under fixed compute budgets. Across more than 400 environments, the resulting search mechanisms earned top-tier aggregate rankings and defeated most of 15 Monte Carlo tree search baselines in pairwise comparisons, including on held-out and procedurally generated games.
The authors studied how developers coordinate multiple autonomous coding sessions, then distilled five supervisory practices into the PILOT framework: Planning, Isolating, Logging, Observing, and Triaging. In a 16-person experiment, a prototype implementing these practices increased ticket throughput by 63 percent and let participants supervise one additional agent at peak, although it did not significantly improve perceived control.
Li et al. introduce Probe to Act, a browser-agent framework that interleaves reasoning with targeted visual checks of webpage elements. Across three benchmarks, the approach improved proprietary and open-weight models while using substantially less retained context than full-observation histories.
The authors study why moving language-model key-value states from GPU to host memory can either accelerate or slow concurrent agents. On SWE-bench Verified coding-agent workloads, sizing the host cache around the agents’ reuse working set reduced recomputed prompt tokens by 93% and end-to-end time by 39%.