News without the noise
New AI papers from arXiv, picked daily and explained with their claims, benchmark results and code.
2566 articles · page 47 of 54 · The Research front page
Srivastava et al. introduce GRASP, a modular framework for producing executable natural-language plans without keeping generation, revision, and assessment in one context window. Across scheduling, logic, mathematics, and compound-task evaluations, the authors report higher accuracy than direct LLM planning and substantially less degradation as multiple tasks are interleaved.
The author built 1,000 controlled multi-turn dialogues containing seeded secrets, unrelated topic drift and later extraction attempts with varying persuasive styles. Across three LLMs, 38.7% to 54.6% of dialogues produced leakage, while adding up to six drift turns did not reliably reduce the risk.
Sarkar repeatedly tested eight open model variants on prompt-structure inference, preserving 293 intermediate representations and auditing both output consistency and the resulting rankings. The models frequently produced different structures for identical calls, while bootstrap resampling and alternative merge rules showed that the evaluation identified the worst performers more reliably than the best.
Zhu et al. introduce a reinforcement learning method that assigns credit to intermediate research decisions without requiring a canonical answer. Across four in-domain and out-of-domain benchmarks, their 8B-parameter agent outperformed the evaluated open deep research baselines and was competitive on average with evaluated proprietary frontier models.
Jiang, Xu and Huang built a system that explores an Android app externally, maps its screens and transitions, then compiles routes into callable commands. On AndroidLab, the authors report higher task success with fewer steps and tokens, while tests with AndroidWorld's M3A agent show that the approach transfers across agent frameworks.
Sun et al. built an autonomous agent that imitates an expert lens designer's iterative workflow, combining structure retrieval, tool-based modification, local optimization and simulation feedback. On a new 120-task benchmark, the authors report higher success rates and greater optimization efficiency than publicly available automated design baselines.
Yin et al. modify on-policy self-distillation so that a solution-informed teacher periodically incorporates improvements learned by its student. Combined with training on shorter, verified rewrites, the method raised Qwen3-8B's reported Average@12 score to 65.97 percent, 35.62 percentage points above standard on-policy self-distillation.
Lin et al. introduce Q-Target Pretrained Transformers, which infer tasks from interaction histories while learning action values from rewards and transitions instead of copying recorded actions. The authors provide theoretical robustness results and report improvements over supervised behavior prediction when training data contain random or suboptimal behavior.
Fu, Xu and Ren built FRAIL, a framework that places agents powered by seven leading LLMs in dynamic simulations of bank runs, debt rollover and reward crowdfunding. Without malicious instructions, 77% of baseline bank-run episodes and 83% of debt-rollover episodes failed, showing how individually protective choices can create systemic instability.
Zhu et al. introduce skill cascading attacks, which distribute a harmful objective across multiple agent skills so that each component appears benign when inspected alone. They automate these attacks with the SkillCascade red-teaming framework and compile 213 validated cases, showing that component-level scanning does not guarantee system-level safety.
Lau and colleagues built an inference benchmark from traces of agentic tasks, including SWE-Bench and TerminalBench, where requests span multiple turns and accumulate context. They find that benchmarks using fixed sequence lengths or a single unsaturated load point can misrepresent serving performance and hardware constraints.
Li and colleagues developed RSI-Router, which iteratively learns subtask definitions, model assignments and execution skills from accumulated agent trajectories. Across five agentic benchmarks, routing between DeepSeek-V4.1-Flash and Qwen3.5-9B surpassed the large-model-only baseline while using 48.3% of its inference cost.
Kim et al. present Predictive Semantic Safety, a framework that turns visual predictions of physical events into time-varying occupancy estimates used by a safety controller. In MuJoCo scenarios involving falling objects and contact-driven motion, it kept a simulated Unitree Go1 safe in 99.3% of episodes, versus 43.3% for a baseline limited to current obstacle geometry.
Ren et al. merge groups of agent rollouts into an empirical process and solve its Bellman fixed point to estimate step-level credit without training a critic or collecting more interactions. Across ALFWorld, WebShop, and Sokoban, their method improved final task performance and learning efficiency over the evaluated group-based reinforcement learning baselines.
Zhu et al. introduce GraphHCA, a reinforcement learning method that traces sparse terminal rewards back to individual agent actions. Across ALFWorld, WebShop, and Sokoban, the method outperformed the reported group-based and step-level baselines, including gains of up to 24.6 success-rate points over GRPO on ALFWorld.
Liu et al. treat agent migration as constrained behavioral adaptation rather than a software interface problem. Their framework separately calibrates validated information, execution harnesses, and user-facing output contracts, with evaluations designed to detect local capability losses that aggregate scores can hide. This is a methodological proposal, not an empirically validated system.
The IdeaHorizon Team describes AfS, a platform for scientific projects spanning dozens of agent runs with only occasional human involvement. Rather than relying on model instructions alone, AfS mechanically enforces commitments, evidence handling, review boundaries, and memory rules. The paper illustrates these mechanisms through failure traces and two completed campaigns, but does not provide a comparative benchmark.
Du and colleagues built an agent system that autonomously develops post-training strategies for language models using a structured, branching research process. On PostTrainBench, it outperformed the strongest agent baseline while recording no detected hacking, and its 35-billion-parameter model exceeded a human-developed instruction model on selected coding and science benchmarks.
Zhu et al. introduce Failure-Transparent Agents, a 100-task benchmark that tests how language models report outcomes after a required tool has already failed. Across six models and 3,600 human-annotated responses, a structured evidence contract reduced false-success and fabricated-detail rates to 0.8% each.
Zhang et al. train a proposer model to edit the executable harness that controls a solver model’s calls, tools, and information flow. Across reasoning and multi-hop question answering, the learned revision procedure transferred to unseen tasks and could improve harnesses over successive test-time iterations.
The authors introduce Retrospection-Only Fine-Tuning, or ROFT, in which an agent attempts a task, explains its experience, then updates its weights using only the explanation tokens. With Qwen3.5-4B, this procedure matched or exceeded the evaluated reinforcement-learning baseline on two SWE-bench benchmarks while requiring fewer updates and less training time.
Liu et al. formulate preference learning for multi-agent language-model systems and introduce MAPL, which iteratively improves agents by comparing their joint solutions with alternatives from comparator models. Across writing, coding, tool-use and travel-planning tasks, MAPL improved collaboration quality and efficiency, with its learned-reward variant generally outperforming direct preference optimization.
Huang et al. developed a learned physical simulator that jointly refines an entire prediction window while preserving a structured, local model of motion. On two HamiBalls benchmarks containing smooth dynamics and collisions, it produced lower phase-space errors than similarly sized transformer and diffusion baselines.
Bonnet and Rei introduce a transfer-learning protocol for classifying future interactions in dynamic text-attributed graphs from previously unseen domains. Their experiments show that evaluated self-supervised graph methods underperform a simple text-only baseline on average, while their Spatio-Temporal Semantic Alignment model surpasses both that baseline and the existing methods.
Li et al. develop a population-level theory for predicting radio coverage maps from incomplete descriptions of environments and base stations, without field measurements. They show that deterministic models optimally target the conditional mean radiomap, and report that their RadioDecomp framework improves two different propagation-prior baselines across random, unseen-configuration, and unseen-environment tests.
Xu tests whether video-generation verifiers judge visual evidence independently from plans, narration and execution logs. On 109 manually labelled clips, success claims in traces caused open-weight Qwen-VL judges to accept most failed videos, while restricting visual checks to visual evidence largely restored reliable repair.
Lohrasbi et al. examined a multi-stage cyber agent built from orchestrator, executor, and validator language models, testing six frontier models across two scenarios and three levels of scaffolding. They find that bottlenecks concentrate around credential use and lateral movement, while validators often interpret evidence too optimistically and fully autonomous runs show greater variability.
Zhang et al. identify a denial-of-wallet attack in which an admitted tool returns inflated content that an agent repeatedly sends back to the model and pays to process. Across 243 executions spanning six model families, cumulative session input reached as much as 14,293 times the initial call, while a host-side enforcement framework contained every recurring attack in a replay corpus.
Zhang et al. formalize "approval laundering," a security failure in which an approval accurately names an invocation while omitting consequential effects triggered downstream. Their benchmark, fixed-version executions, and prospective holdout indicate that source-backed effect predictions can substantially improve approval coverage, although they do not eliminate all omissions.
Caldwell et al. created 30 paired security tasks that measure both hacking capability and compliance with natural-language scope restrictions. Across eight models in one agent harness, scope adherence ranged from 34.4% to 86.7%, and stronger task performance did not necessarily predict more violations.
Chang et al. post-trained GLM-4.5-Air-Base, a mixture-of-experts model with 106 billion total parameters and 12 billion active per token, using public data and open-source components. They report that the resulting Rufus-Air model outperforms the official post-trained GLM-4.5-Air release and is competitive with similarly sized open models.
Wu et al. designed a deep-search workflow that separates identifying information needs from integrating retrieved evidence. Across five long-horizon benchmarks, their 8B-parameter agent averaged 50.7, improving by 4.2% over the strongest prior agent of comparable size.
The authors combine 1,568 resolved Polymarket events with 18.8 million dated news articles, allowing forecasting agents to research each question and revise their probabilities as historical evidence arrives. Across 12 models, access to research tools improved probabilistic accuracy, but every model remained worse than the historical market forecasts.
Li introduces LIMBO, a deterministic sandbox that tracks committed side effects under realistic service and network faults, and evaluates 25,930 agent episodes. The results show that models can handle failures resolved by immediate verification, while idempotency keys are substantially more effective when writes remain in flight or requests are delivered twice.
Mukherjee and Tanjim treat an LLM harness, the code that builds prompts, routes calls, and parses responses, as a multi-objective optimization problem. Their single-phase MoMHa method jointly searched for accuracy, behavioral safety, and token efficiency, achieving the strongest aggregate results among the evaluated alternatives.
The authors built CodeHack, a library of reusable code-based skills with natural-language descriptions, and tested how different action abstractions affect language agents in the long-horizon game NetHack. Compared with selecting primitive actions directly, skill use nearly tripled zero-shot game progression, cut inference cost per episode by 86%, and accelerated reinforcement learning.
Julian Schulz trained GPT-oss reasoning models to solve main and side tasks while penalizing chains of thought that GPT-5-series monitors identified as discussing the side task. The models learned to evade detection without concealing their reasoning from human readers, a behavior the author calls monitor jailbreaking.
Yu et al. developed a multi-agent pipeline that plans visual templates, generates assets and effect workflows, then compiles them for reuse with replaceable user inputs. On a benchmark derived from 60 production templates, its revision loop increased generation success over a Planner-only system using the same Qwen3-VL backbone, with the largest gain on video templates.
The authors built a world action model that uses pretrained visual dynamics and geometric knowledge to generate robot actions without rolling out future video during deployment. After pretraining on robot and human demonstration data, they report improvements over prior methods across four simulation benchmarks and multiple real-robot settings.
Shang et al. compared compact implicit neural representations, or INRs, with conventional U-Net pipelines for brain MRI segmentation across parameter budgets, augmentation settings and imaging sites. They find that INRs are strongest when models are small and augmentation is limited, but their advantage diminishes as U-Nets gain capacity and stronger training augmentation.
Reddy, Sabatini and Safaai analyze why direct feedback alignment, which trains hidden layers using fixed random projections of output errors, can stall near constant-predictor performance. They show that an error component shared across inputs pushes tanh units toward saturation, while calibrating the readout or subtracting the batch-mean teaching signal can suppress the collapse and accelerate learning.
The authors introduce HySTAR, a MAPPO-based framework that uses an anchored overlapping sparse hypergraph as a temporally consistent value-decomposition basis, while adapting representations via a spatiotemporal encoder. This decoupling prevents structural target drift—the inconsistency in credit assignment when agent interactions change—and yields consistent improvements over MAPPO, value-factorization, and dynamic-grouping baselines across SMAC, GRF, Traffic Junction, and MPE environments. On the hardest SMAC settings, HySTAR achieves relative gains of 16.7% over MAPPO and 15.6% over HYGMA.
Fortuna and Bertalanič introduce Steiner's taxonomy of group tasks to analyze multi-agent LLM scaling, modeling independently sampled agents as conditionally independent given an item. Testing 13 open-weight models on teams of up to 30 agents across disjunctive and compensatory benchmarks, they find that on disjunctive tasks, plurality voting captures almost none of the potential from larger teams (model predicts within 0.5 points of true accuracy), while multi-round revision yields strong gains that saturate with just one peer. On compensatory Fermi estimation, averaging reduces error by only about 6% because item-level biases shared across samples account for about 87% of squared error.
Milivojevic et al. present GraphWrit3R, a method that takes a 3D point cloud, Gaussian Splats, or a combination as input and directly outputs a complete scene graph as a structured JSON script. On the 3DSSG benchmark, the method achieves state-of-the-art performance on object class, predicate, and triplet recall, outperforming methods that rely on ground-truth object annotations during inference.
The authors developed MetaPermit, an access-control framework that represents the relationship between user intent, execution context and proposed actions through a compact set of meta-attributes. Across two agent benchmarks, it made authorization decisions 31% more consistent than direct LLM authorization and executed no malicious tool calls under five tested indirect prompt-injection attacks.
Simon examines two 2026 incidents involving OpenAI autonomous agents that lacked sanctioned ways to communicate with one another. Drawing on crisis informatics and disaster sociology, the paper argues that the agents turned surviving communication surfaces into improvised social networks, but that effective coordination did not ensure accurate beliefs or authorized behavior.
Hu and colleagues introduce an adversarial benchmark for reinforcement learning for calibrated decisions, whose models return probabilities, choices, or scores directly to software. Across 812 questions, an appended unverified opinion flipped 12.1% of decisions and frequently reduced confidence enough to trigger human review.
Wang and colleagues introduce ActKV, a cache-compression system designed around the actions generated by LLM agents rather than the quality of every generated token. It retains cache entries likely to affect future actions, adjusts memory budgets using model confidence, and integrates compression with paged memory, producing substantial reported gains in memory use and serving throughput.