News without the noise
New AI papers from arXiv, picked daily and explained with their claims, benchmark results and code.
2566 articles · page 46 of 54 · The Research front page
Shaw audits a benchmark for indirect prompt injection, where malicious instructions hidden in retrieved data redirect an agent's tool calls. Re-scoring the same execution traces at the tool-argument level reduced measured attack success from 21.7% to 1.2%, showing that evaluation defects can dominate reported security results.
Feng et al. introduce a reinforcement-learning framework that identifies capability gaps from agent rollouts and adjusts training around them. On SkillsBench and Terminal-Bench, the authors report improved task performance and training efficiency compared with training based on static criteria and priorities.
Guo et al. built an agent runtime that treats files, processes and remote service changes as a unified, restorable state. In their evaluation, this allowed agents to undo errors and explore alternatives in parallel, improving task quality by up to 15 times while adding 3% overhead for user recovery.
Wei et al. tested 13 agent-memory methods and found that no single representation performed consistently across three benchmarks. Their MemAgent system instead routes tasks among heterogeneous memory providers, improving average accuracy by 10.0% while reducing task steps by 12%.
The authors specify a claim-gated audit procedure for generative search answers that checks whether a source relationship omitted from the answer is resolved. The procedure requires that relationship evidence, answer adoption, materiality, and disclosure are all observed; incomplete evidence remains unresolved. On an exhaustive synthetic suite, the reference checker reproduces all 81 three-state predicate combinations and rejects 192 deliberately malformed records.
Shen and Li study agents that repeatedly rewrite a fixed-size state instead of retaining their full interaction history. In TextWorld cooking games, they find that most failures arise not from the 128-token budget itself, but from writers discarding facts before their future relevance is known.
The authors introduce a benchmark for evaluating collaboration among asynchronous coding agents using executable checks for dependencies between their assigned components. Across model families, scales, generations, and coordination protocols, stronger coding performance did not consistently produce better dependency resolution, while ordinary task metrics sometimes concealed coordination failures.
The authors introduce AgentWorld, an MMORPG-based benchmark designed to isolate collaboration among independently acting LLM agents with asymmetric roles and abilities. Across four model families, even the strongest system succeeded on only 52.0 percent of tasks, with failures linked to broken communication, role confusion and lost shared plans.
Ding and Wu introduce MemProbe, a framework for evaluating the stability-plasticity balance between preserving existing memories and incorporating new evidence. In a 56-episode suite covering four cognitive paradigms, they test six incremental memory systems and show that similar aggregate scores can conceal markedly different memory-update behaviors.
The authors introduce a tool-augmented framework that represents agent failures as typed causal graphs rather than isolated anomalous events. On their new agent-annotated benchmark, CEG-Agent outperformed prior methods under both semantically relaxed and structurally exact evaluation criteria.
The authors present EAGER, a post-training framework for LLM-based end-to-end event extraction that uses reinforcement learning with verifiable rewards. Its core innovation is Schema-Contrastive Advantage Estimation (SCAE), which mitigates advantage collapse under sparse binary rewards and yields substantial gains over existing methods.
The authors show that GUI world models that condition only on visible observations systematically fail when identical interfaces hide different transition-relevant state. They introduce StateAliasBench to isolate this failure and a lightweight recovery method that infers hidden state from action history, improving downstream agent performance.
Bu and colleagues isolate the cost of information loss at interfaces in four-stage LLM pipelines, which they call the decomposition tax. Across 21 open-weight models, re-grounding later stages with the original problem recovered substantial accuracy, with the largest measured tax reaching 40.5 percentage points.
Chen and colleagues introduce PlanGuard, a guardrail designed to identify physical hazards arising from dependencies among multiple planned actions, rather than assessing each action separately. Their 2-billion-parameter model reaches 87.15% accuracy and 87.21% F1 on the authors' MSP-Safe test subsets.
Dai et al. evaluated whether records produced by deployed agent harnesses can support later audits without requiring trust in the harness itself. Across 140 runs, examiners often identified the correct fault, but their evidence largely came from harness-authored material; an external append-only log detected all 28 omissions and fabrications introduced during execution.
Li and colleagues assemble specialized detectors into a unified toolkit, then train a large vision-language model to select and use those tools across multi-step verification tasks. On MMFakeBench, the trained agent improves accuracy over its base model, while a cache of precomputed tool outputs reduces the cost of reinforcement-learning rollouts.
Dai et al. introduce ToolSearcher, a reinforcement learning framework for selecting tools when repositories are too large to place every tool description in the model's context. On large-scale benchmarks, the authors report consistent gains over strong baselines, particularly for iterative search and tasks requiring compatible combinations of tools.
Huang and colleagues compared base and aligned language models on long-tail factual questions, then traced how confidence in incorrect answers developed across model layers. They report that instruction-tuned models produced 10 to 35 times more errors with probabilities of at least 0.95, and that a modified alignment objective reduced these errors by up to 35.3 percent.
The authors tested 14 models on 365 tasks where an agent encountered an unsupported accusation after reaching a verified correct state. In Claude Code, false accusations damaged correct work in as many as 60.06% of runs, while a harness-level intervention reduced replayed harm by 74%.
Liu et al. formulate automatic skill evolution as a graph search, maintaining a main update path alongside branches created from earlier library versions. Across five benchmarks and two language models, SkillVine reported the best test performance in nine of ten benchmark and model combinations.
Jiang et al. isolate memory delivery, the step that converts retrieved records into the text and images shown to a model. On MemLens, supplying original pixels from an unchanged evidence set improved accuracy by 13.87 percentage points on an 8B model, compared with 2.31 points from perfecting retrieval.
Jiang et al. train a setwise reranker that optimizes the collection of evidence passed to retrieval-augmented generation and deep-research systems, rather than scoring each document independently for relevance. Across ten benchmarks, the authors report the best overall performance among evaluated methods while requiring fewer retrieval calls.
The authors introduce TrustFork, a 1,890-task benchmark that tests orchestrators when one subagent pursues a risky goal and three provide user-aligned alternatives. Orchestrators frequently retained and acted on the risky subagent's advice despite contradictory evidence, with identity labels and harness behavior shaping whose response prevailed.
Xu and colleagues introduce CAIRN, a multi-agent architecture that records findings and proposed investigations in a persistent directed acyclic graph. Across cybersecurity and mathematical reasoning tasks, the approach provided little benefit on easier problems but solved 76.5% of high-effort cases faster, with speedups reaching 3.08 times.
Cui et al. introduce SWE-MILE, a reinforcement-learning framework that extracts intermediate training signals from an agent’s own workflow rather than relying only on final test outcomes. Across two long-horizon software engineering tasks, the authors report improved agent performance from combining these process-level credits with terminal rewards.
The authors compare the counterfactual fairness of three reasoning language models (QwQ-32B, DeepSeek-R1-Distill-Qwen-32B, Qwen3-32B) with and without explicit thinking traces on three high-stakes decision tasks (Adult, COMPAS, Credit). They find that thinking produces an asymmetric dual effect: it resolves some counterfactual flips from the non-thinking baseline but creates new flips at near-saturating confidence, with created flips outnumbering resolved by roughly 5x across all nine model-dataset combinations.
Zhang et al. define causal retention: whether a frozen learned state can answer mechanism-probe queries (action, context, target, value, delay) independent of training. They prove a Bayes optimal error bound and introduce Causal Core, a method achieving perfect recall under local edits while accepting only 5.6% of readout candidates in a language model and recovering effect-sign accuracy from 0.057 to 0.948 in TD-MPC2 without degrading stable responses.
The authors study whether Audio LLMs can detect when their own transcription of a voice query is unreliable. They find that the models are poor self-assessors, but that a reliability predictor trained on the frozen audio encoder's representations achieves 81.10% macro-F1 in-domain and 78.09% cross-domain, significantly outperforming baselines.
The authors studied 64 reports on 16 static migration tasks, with two attempts per condition and 328 criterion decisions, evaluating a shipped plugin-upgrade skill. They found that the skill raised mean recorded reward by 4.92 points, but the gain was concentrated in one task, and eight task pairs were at the ceiling. Contract inspection and executable probes exposed grading errors that favored either arm, and re-grading with alternative judges gave gains of 10.63 and 6.09 points.
Cheng et al. tested persistent skill editing in frozen language-model agents across 12-round streams of recurring code-repair tasks. They found that globally retrieving locally validated skills caused cross-family interference, while family-scoped retrieval raised utility and supported more safe, repeated updates.
Grange and Glantz equipped Qwen3.5-4B with callable tools for 3D object detection, metric depth, coordinate projection and deterministic spatial calculations. On ReVSI-Bench, the tool-augmented model improved markedly on three of four tasks, and experiments with ground-truth boxes showed that most remaining error came from visual perception rather than tool orchestration.
Zhan et al. modify Group Relative Policy Optimization to calculate credit separately for structured tool-use segments and user-facing summary segments. On a 7B model, their method converged faster than standard GRPO and improved results across three tool-calling evaluations under matched training budgets.
King et al. collected both application telemetry and kernel system-call traces from 4,047 agent sessions covering 17 threat models. Across four detector families, the authors find that kernel evidence is independently useful, usually improves detection when combined with application evidence, and transfers across attack families and agent runtimes.
Seyoum and Mittur evolved the runtime instructions and controls around a fixed model, testing candidates on 12 proprietary hardware design-verification debugging tasks with five trials per task. The evolved harnesses substantially increased completion and task coverage, but produced smaller gains in total correct answers and tended to exchange strengths rather than combine them.
Rahamim et al. identify a directional imbalance in multimodal diffusion transformers: motion or audio attends strongly to video, while exerting comparatively weak influence over video generation. Their regularizer narrows this correspondence gap, improving anatomical consistency and audio synchronization without adding an inference-time component.
Su et al. compare standard reinforcement learning with on-policy self-distillation, where a model imitates a version of itself given information unavailable at deployment. Across AppWorld and SWE-bench Verified, their Privileged Self-Practice method consistently surpassed plain GRPO reinforcement learning, while self-distillation could perform worse than the untrained model.
Yao et al. identify a bias in applying GRPO's trajectory-level rewards to individual steps in multi-turn tasks. Their GRAFT framework combines rollouts into a directed graph, estimates state values through Bellman iteration, and reports consistent improvements over GRPO and recent agentic reinforcement learning methods.
Li and colleagues introduce Read-only Expansion of Adapter Deltas, or READ, for incrementally combining LoRA task adapters into one model. Across four benchmark suites and two model families, the method outperformed competing approaches built from the same adapters, including gains exceeding 20 points on SuperGLUE and seven points on a domain suite.
Xu et al. investigate why standard Distribution Matching Distillation produces visually plausible but nearly static rollouts when applied to video world models. Their DyMD framework adjusts teacher and critic supervision around motion, improving interaction dynamics and downstream planning while retaining a four-step, 1.3-billion-parameter student.
Yoon et al. built and deployed PIA as a memory and understanding layer for a consumer health agent. Rather than retrieving conversation summaries by similarity alone, the system stores typed health facts, resolves event dates deterministically, assembles longitudinal trajectories, and returns evidence with provenance.
Ke et al. introduce Stackelberg Program Optimization, an LLM-based method for discovering paired destroy and repair programs for combinatorial optimization. On traveling salesperson and capacitated vehicle routing problems, the authors report stronger results than handcrafted, test-time search, and program-discovery baselines, including on instances larger than those used during discovery.
Qin et al. present an agentic pipeline for converting scientific protocols into executable, verifiable tasks for embodied laboratory agents. They use it to build SciVLABench, a collection of 300 certified tasks, where the strongest tested policy achieves only 49.7 percent average success.
Yu, Mu and Wu introduce PTC-Decoder, an inference-time framework for small language model agents operating offline under tight memory constraints. Across 200 remote-sensing satellite tasks and seven models, it increased the mean overall score by 1.21 points, although reliable final answers remain unresolved.
Li and colleagues introduce the Correlated Promotion Benchmark, which tests whether claims should enter a memory shared by multiple AI agents. Their experiments show that an uncontested false claim, once admitted, is repeated by memory-dependent consumers in 97 to 99 percent of probes, while no tested non-oracle policy reliably filters false claims across copying, paraphrasing and asserted authority.
Hashmi, Patel and Yin model indirect prompt injection as a sequence from malicious email retrieval to unsafe tool arguments, rather than as binary text classification. Across five binary benchmarks, their combined framework achieved a mean F1 score of 0.406 under strict thresholding, versus 0.216 for the strongest pretrained detector tested without additional training.
Gill and colleagues introduce KNOWS, a benchmark of long, open-ended workflows spanning web research, information synthesis, interface navigation, and artifact creation in Google Workspace. Frontier computer-use agents often completed parts of these workflows, but the best system fully succeeded on fewer than 3% of tasks.
Huang et al. examine why retrieve-then-verify systems struggle to identify factual errors in long-form medical answers. Using an automatically induced error taxonomy, they find an order-of-magnitude performance collapse from closed-ended benchmarks to the clinician-annotated MedExpert dataset, with larger models, additional reasoning and broader evidence sources failing to resolve the problem.
Qiu et al. identify a mismatch between how world models are trained and how they are used: factual prediction rewards matching observed transitions, while planning requires comparing unobserved alternative actions. Their AD-WM adds action-recovery objectives to a latent world model, improving closed-loop control without changing the model predictive control procedure at test time.