News without the noise
New AI papers from arXiv, picked daily and explained with their claims, benchmark results and code.
2566 articles · page 52 of 54 · The Research front page
Ye and Lin instrumented an agentic datasheet-extraction benchmark to record every tool call, then built rules for attributing failures and detecting suspicious runs from tool use alone. Their detector flagged all 50 deliberately planted tool-withholding faults while raising no flags across 207 clean, fidelity-passing extractions, although its ability to catch other failure types remains untested.
Pan et al. introduce ContextPilot, a framework for controlling the growing working context of agents performing long-horizon tasks. On long-context question answering and deep-search benchmarks, the authors report better task performance than existing baselines while retaining a more compact context.
Song, Kwak and Chang present String, an open-source runtime that describes application views, typed actions, navigation and credentials in a single String-Flavored Markdown document. Across 87 tasks and six language models, String matched the aggregate success of curated agent skills while completed episodes used 33.5% fewer tokens.
Meng et al. introduce HARTS, a training system that compresses shared prefixes in agentic reinforcement-learning rollout trees and schedules the remaining work across microbatches and data-parallel replicas. On rollouts generated from SWE-bench tasks, it delivered 4.81–4.87× speedups for forward, backward, and gradient computation while maintaining numerical and early-training behavior close to trajectory-wise training.
The authors introduce MCR-Bench, a benchmark with 2,269 real-world multi-round code review tasks annotated with fine-grained defect information and dynamic state labels. Evaluating mainstream LLMs reveals limited capability in defect detection and lifecycle state tracking, with performance degrading as interaction rounds increase.
Kuang et al. introduce a benchmark that evaluates how language models carry out mathematical problem-solving, rather than scoring only their final answers. They find that models with similar end-to-end accuracy can have substantially different profiles of underlying agentic capabilities.
Guo et al. address a failure mode in which untrusted tool outputs induce an LLM agent to take actions beyond the user’s intent. Across AgentDojo and AgentDyn, their runtime authorization framework held attack success rates to 0.63% or less in four primary settings while retaining competitive task utility.
Aggarwal tests whether LLM agents abstain when asked to make directional calls that cannot be inferred from the available information. Commitment rose from 6.5% to 54.0% as apparent evidence was added, while targeted fine-tuning eliminated commitment in the tested cases but proved sensitive to response format.
Baek tests whether large language models can solve individual operations-research problems and design algorithms for entire problem classes. With one untuned prompt and access to a compute-limited Python sandbox, the strongest tested model matched or exceeded established methods on almost all evaluated instances.
Zeng et al. introduce Mixture of Roles (MoRe), a method that gives a frozen language model multiple latent specializations and combines them according to each query. Across reasoning and personality benchmarks, the authors report that MoRe beats single-agent baselines by 2.2% on average while performing on par with multi-agent systems using 20 times fewer tokens.
Tang et al. introduce WikiSkill, a framework that separates raw agent experience, accumulated knowledge, and executable skills instead of leaving useful insights scattered across optimization histories. Across multiple benchmarks and models, the authors report that this persistent wiki improves skill evolution and enables skills to transfer between models and model families.
The authors introduce UrbanGround, a sandbox built from 3D geospatial data of Hong Kong, to test whether multimodal large language models (MLLMs) can turn local visual perception into sustained navigation. They find that while agents show useful abilities in short-range spatial reasoning and scene recognition, they fail at orientation, pedestrian-aware movement, and correcting accumulated errors over extended exploration.
Chen et al. replace the repeatedly updated text memory used by recommendation agents with a vector memory built from collaborative interaction data. Across four instruction-grounded benchmarks, their system matched or surpassed the strongest collaborative text-memory agent in 19 of 20 metric cells while eliminating per-interaction LLM calls for memory maintenance.
Li and colleagues formulate multimodal memory retrieval as an optimization problem: selecting a budget-constrained forest of relevant memories and reliable relationships. Across four long-term multimodal memory benchmarks, the authors report improved accuracy with multiple foundation models and a better trade-off between performance and lifecycle cost.
Zhu and Shi present DSA, an LLM-agent orchestration framework for producing stock-research reports from heterogeneous evidence across multiple markets. Their evaluation establishes that a frozen implementation conforms to selected software contracts, but does not test whether its reports improve forecasts, investment decisions, or returns.
Wu and colleagues introduce BALMS, a benchmark testing whether LLM-based agents can predict wellbeing scores from longitudinal wearable signals and justify those predictions with temporal evidence. Evaluating three agent designs and five LLM backbones, the authors find that stronger prompting and models can help, but accurate, evidence-grounded reasoning over long histories remains unreliable.
The authors identify “instruction privilege escalation,” in which an agent harness places untrusted content into a more privileged part of a model’s context. Using multi-agent attack mechanisms, they achieved all 13 tested security objectives on every evaluated harness under unrestricted execution, and on all three supporting automatic permission review.
The authors trained a 0–10 sepsis severity index from 43 routinely charted variables collected over 72 hours, using treatment-level mortality to rank trajectories rather than assigning mortality labels to every hour. In held-out testing, the score provided hourly prognostic information, correlated with changes in lactate and other physiological measures, and showed partial transfer between hospital systems.
Wu and colleagues analyze autonomous agents that repeatedly plan, use tools, verify results and retain operational state, even as their safety monitors reset. They establish a formal separation showing that persistent safety state can detect cross-iteration attacks invisible to any trajectory-scoped monitor, and propose LoopHarness to limit irreversible unauthorized actions independently of the loop horizon.
Bendinelli, Dox, and Holz introduce a simulation-based benchmark in which LLM agents inspect time-series data and determine whether—and why—a dynamical system changed. Across four agents and three mechanical systems, domain context substantially improved attribution, while requiring executable per-sample classifiers reduced performance.
Girrens and Wang built SPA, an agent architecture that generates one complete plan per query and checks how trusted and sensitive information flows through its execution. On AgentDojo and a new multi-query extension, the system reduced success under the reported “tool_knowledge” attack to 0% and 0.2%, respectively, though strict integrity controls reduced utility.
Xu et al. developed HarnessLens, a framework that automatically modifies agent instructions, tools, and runtime components while limiting the cost of testing each change. Across three harnesses and four benchmarks, it improved average held-out performance by 7.6–13.6% while using substantially less evaluation budget than competing methods.
Zhang et al. add intent-targeted tools to language-model agents, creating a dedicated channel through which models can signal commitment to particular behaviors. They report that tool-call probabilities produce fine-grained intent trajectories and help identify moments when intervention may prevent harmful action.
Liu and Shorinwa introduce CLAP, an action-conditioned video model designed to learn across different robot morphologies and human demonstrations. The authors report that a curriculum combining unlabeled-video pretraining with robot-action grounding enables zero-shot deployment and performance competitive with specialized, single-embodiment models.
Xie and Chen replace visual GUI control with an agent-facing layer that represents application state as JSON and exposes semantically meaningful, code-executable actions. On 380 single- and multi-application tasks, closed models using ASIL achieved more than 80% strict success while averaging fewer than five actions per task, far exceeding screenshot-based control under the tested conditions.
Agent performance increasingly depends on the harness: generated and evolved runtimes produced large gains without model retraining, while structured retrieval and context pruning reduced cost without sacrificing accuracy. The safety papers reinforce the same architectural lesson—guarding, evaluating, and debugging individual decisions is more reliable than trusting final answers or aggregate scores.
VoiceMem is a dual-stream memory architecture for duplex speech language models, pairing a factual left brain for personal information with an emotional right brain for affect and persona. The authors show that top-5 retrieval beats Mem0 at top-200 by nearly 30 points, and that retrieval completes in 134 ms, within voice-activity-detection latency. The result is a practical memory foundation for real-time, personalized, emotionally aware spoken interaction.
The authors present VISA, an agentic framework that reformulates multimodal instruction synthesis as a self-evolving loop. VISA iteratively generates diverse and challenging instruction-following samples, using verifier signals and target-model failure profiles to guide subsequent rounds. The method consistently improves multimodal instruction following on MM-IFEval while maintaining general multimodal capability across seven benchmarks.
Muennighoff et al. observe that during long reasoning traces, most intermediate tokens lose importance as the model continues. They propose Prefix Sliding, which keeps only the instruction prefix and a recent window of tokens, discarding the rest to cap memory usage. Applied without training to existing models, it achieves up to 3x speedup with no performance loss; training with it enables reasoning traces beyond 100,000 tokens.
Zhang et al. developed a video question-answering agent that combines video understanding with external retrieval while adapting its tools to each task. Trained with supervised fine-tuning and reinforcement learning, AdaVDR led the evaluated open-source models on the authors’ VDR-EE benchmark and improved substantially over its base models on VideoDR.
The authors train a model to generate an agent’s harness—the memory, planning, action, and tool-orchestration machinery surrounding an underlying language model—for each task at execution time. They report that these generated harnesses consistently improve multiple model families and can match established runtimes such as OpenCode and Claude Code in controlled evaluations.
Huang et al. compare general-purpose agents with specialized agents for identifying the root causes of system incidents, then introduce an external harness that learns from previous diagnoses. Across two public benchmarks and an industrial deployment, OpsHarness reaches 59.0% top-1 accuracy, a 63.4% improvement over an unharnessed general agent.
Li, Abdelmoniem, and Wang introduce ProgRouter, an online routing framework that adapts model selection as a multi-agent task unfolds rather than making a single decision at the outset. Across coding, mathematics, and retrieval-augmented question answering benchmarks, the authors report lower operating costs than key baselines while retaining strong task performance.
Liang et al. modify speculative decoding so its drafting and verification models can see different versions of an agent’s accumulated context. Across four agentic capabilities and two end-to-end benchmarks, the method retained about 90% of full-context accuracy on average while reporting substantial throughput and compute gains on isolated text tasks.
The authors present llmmas-otel, a framework-agnostic tool for observing and deliberately disrupting LLM-based multi-agent software engineering systems. It records aligned traces across agents, tools, messages, and model calls, enabling reproducible comparisons between baseline and fault-injected executions.
Jiang et al. train an agent safeguard to identify and invoke the safety policy relevant to a full execution trajectory. Initialized on their PolicyTraj-20K dataset and refined with reinforcement learning, RePolicy showed strong safety detection across six benchmarks and remained robust when policy contexts changed.
Wang et al. introduce Contrastive Branch Policy Optimization (CBPO), a reinforcement-learning method that separates where to sample alternative continuations from how to assign credit to tokens. Across ten mathematical-reasoning and knowledge-search benchmarks, the authors report the highest macro-average accuracy among the evaluated policy-optimization and branch-based methods at two model scales.
Xu and Chen isolate context construction as an optimization problem for long-video understanding. Their outer-loop system proposes, executes, and evaluates context-building programs around a frozen vision-language model, finding improvements from both a uniform-sampling start and a stronger hand-crafted baseline.
Chang et al. built a controlled air traffic control benchmark informed by aviation standards and feedback from 40 controllers across three countries. They report a consistent gap between standard semantic scores and evaluations that account for the unequal consequences of errors; risk-aware fine-tuning reduced, but did not eliminate, that gap.
Burke presents a working literate-programming environment designed for collaboration between human programmers and language-model agents. It co-locates code with relevant prose and structured data while exposing symbol-like name relationships that agents can search and navigate.
The authors evaluate 27 retrieval-augmented generation configurations using a Bayesian model structured around how information and errors flow through a RAG pipeline. They show that systems with similar aggregate scores can behave differently after successful versus failed retrieval, and that labeling retrieval success is especially valuable for estimating whether generators follow the intended response policy.
The authors audited medical chain-of-thought by applying 30 clinically motivated perturbations to model rationales and questions across four medical QA benchmarks. They find that answers are frequently insensitive to meaningful changes in the displayed reasoning, suggesting that a correct answer does not necessarily make the visible rationale a faithful account of how it was produced.
The authors evaluated three top-ranked open-source deep-research systems by checking each agent invocation against its own inputs, allowing errors to be assigned to the agent that introduced them. In AI-Q, 84.7% of final-report errors originated at the orchestrator, and diagnostics informed two interventions that improved citation recall by 5% without reducing output quality.
Bakish et al. introduce Adaptive Influence Graphs, an agentic debugging framework for identifying which component failed and when in a multi-agent LLM run. The framework first converts the run’s trace into an influence graph, then lets a diagnostic agent traverse that graph to locate the critical error; the authors report state-of-the-art results on Who&When.
Guo et al. introduce a structured tool-use policy that separates reconstructing task state, deciding whether to act, specifying an admissible action, and producing the final output. Across multi-turn, multi-tool, and incomplete-information evaluations, the authors report more reliable task completion than direct function calling and ReAct, especially for smaller models and tasks dependent on earlier context.
Abdullah, Cambria and Živković coupled a clinical language model to a graph-based physiological world model that ranks candidate answers using homeostatic constraints, biomedical paths and drug-interaction penalties. On a 2,500-scenario safety benchmark, their training method raised the main safety score from 69.5% to 90.8% and reduced physician-evaluated harm from 14.1% to 5.1% on a blinded subset.
The authors distinguish two sources of parallelism in long reasoning traces: decomposing a problem into independent subtasks and exploring multiple speculative trials at once. They restructure sequential traces with a formal grammar, train models to balance accuracy and latency, and report about 1.7× average wall-clock acceleration on AIME24 and AIME25 while retaining competitive accuracy.
Guo, Zheng, and Cao study “Evidence Blindness,” in which an agent can technically access relevant evidence but fails to surface, open, or inspect it within a limited interaction budget. Their AtlasNav framework uses a persistent Corpus Atlas and reaches 92.05% strict accuracy on BrowseComp-Plus, with 30.21% lower recorded online inference cost than the previous dynamic-workspace state of the art.