audit workflow
An audit workflow is a systematic process for checking whether a system or dataset is as reliable as it seems. Instead of just running a standard test, you deliberately probe for hidden flaws: mislabeled data, shortcuts that let a model cheat, missing context that changes a result, or rare dangerous behaviors that ordinary evaluations miss. The goal is to uncover what a quick glance would not see.
Across these papers, audits repeatedly show that standard evaluations paint an overly rosy picture. Benchmarks contain label errors and duplicate examples, models rely on spurious clues like page numbers, and evaluations themselves are fragile, small changes in analysis rules can shift rankings drastically. Audits designed to stress-test systems, isolate variables, or simulate adversarial tampering reveal vulnerabilities that simpler checks hide. The results argue for audit workflows with multiple controls, sensitivity analyses, and transparent reporting, because what looks like a reliable score often masks deep problems.
- Papers
- 108
- Released code
- 7
- First seen
- June 2026
- Latest
- Nov 2026
99 papers in the last two months, against 6 in the two before.
Start here
Three papers to read first, in the order they came out- 1Benchmark scoring code, not the model, can swing accuracy 22 points
Scoring rules in multimodal LLM benchmarks can inflate accuracy by up to 22 points on identical outputs.
Nov 2026 - 2Hidden bugs in evaluation code silently reorder AI agent rankings
Agent leaderboard scores are silently distorted by the grading, logging, cost and versioning code behind them; cheap audit checks can expose the reordering.
Nov 2026 - 3Benchmark errors inflate and deflate AI policy-reasoning scores
Policy-based decision benchmarks have defects that misjudge rule-following responses, impacting scores and comparisons.
Nov 2026
How fast it is moving
Often studied with
verificationChecking outputs for correctness before accepting them, often to catch errors or reward hacking.28 togetheragent safetyRisks from AI agents including timing errors, shutdown avoidance, collusion, overclaiming, and unsafe execution, mitigated by constrained decoding, safety harnesses, and swarm governance.20 togetheragentic evaluationMeasuring AI agents' performance in complex tasks, highlighting failures in planning, monitoring, and real19 togetherWho is working on it
The papers
Most central to this idea first, not most recent.
- Industrycs.AI
Benchmark scoring code, not the model, can swing accuracy 22 points
Scoring rules in multimodal LLM benchmarks can inflate accuracy by up to 22 points on identical outputs.
Independent Researcher, Nebius · Nov 2026
- Academiccs.AI
Hidden bugs in evaluation code silently reorder AI agent rankings
Agent leaderboard scores are silently distorted by the grading, logging, cost and versioning code behind them; cheap audit checks can expose the reordering.
Shandong University · Nov 2026
- Big Techcs.CL
Benchmark errors inflate and deflate AI policy-reasoning scores
Policy-based decision benchmarks have defects that misjudge rule-following responses, impacting scores and comparisons.
Amazon Web Services, Iowa State University · Nov 2026
- Academiccs.CV
Systematic audit reveals pervasive data quality issues in RVL-CDIP document classification benchmark
RVL-CDIP has significant label errors, test-train duplicates, and spurious cues that inflate reported classification accuracies.
Vanderbilt University · Oct 2026
- Top Universitycs.ROcode
Simulator bugs cause most robot policy failures in common benchmarks
A fixed threshold in PhysX's collision detection creates false failures in robot simulation benchmarks; correcting it eliminates them.
Tsinghua University, University of Chinese Academy of Sciences · Nov 2026
- Top Universitycs.CY
AI hiring tools favor some writing models over others, not candidate quality
AI evaluators in hiring favor cover letters from certain large language models, regardless of applicant quality.
Universität Zürich, ETH Zürich · Nov 2026
- Academiccs.CR
Language models can conceal watermarked training data by altering outputs
Logit Laundering reshapes inference-time logits to remove detectable watermark signals, enabling evasion of data-use auditing without model retraining.
Beijing University of Posts and Telecommunications, Zhongguancun Laboratory · Nov 2026
- Big Techcs.AI
AI auditors find more problematic behavior by reading models’ internal signals
Red-team audits of language models improve by treating them as Markov decision processes and using linear probes on the target model's activations to guide beam search.
Anthropic Fellows Program, Anthropic · Oct 2026
- Industrycs.LG
AI services secretly using cheaper models can be detected with few queries
API-TAIL detects partial model substitution in text-only language-model services by adjusting for legitimate serving changes and counting persistently unusual responses.
TokenRhythm Technologies · Oct 2026
- Industrycs.LG
Language models can trigger memorization alarms for problems they never saw
Partial-prompt contamination tests often misidentify memorization because false positives and false negatives depend strongly on how much text remains.
Meta · Nov 2026
- Top Universitycs.AI
Language models show hidden fairness failures when identity traits combine
Controlled multi-attribute fairness benchmarking exposes task-dependent intersectional harms invisible to single-attribute audits.
University of Science and Technology of China, Nanyang Technological University · Oct 2026
- Big Techcs.CL
State media articles now dominate English web crawl content
State media from editorially controlled outlets rose from 39% to 93% of English web crawls from 2013 to 2025 and dominate low-resource language web data.
University of Pennsylvania, University of California, Berkeley · Oct 2026
- Independentcs.CV
Most video benchmarks fail to actually test video understanding
Video benchmarks are vulnerable to shortcut attacks; Video-Index keeps only the 840 items that no attacker solves.
Oct 2026
- Industry
Small-Sample LLM Rankings Often Overstate Evaluation Reproducibility
LLM evaluation rankings often look definitive but are highly unstable under resampling and defensible analysis changes.
Skelf Research · Sept 2026
- Research Labcs.CL
Steering tool decisions helps, but correction does not guarantee repair
Internal activation steering can increase correct tool calls but corrupts over half of baseline-correct decisions; repair requires destination-resolved auditing.
University of the Chinese Academy of Sciences, University of Birmingham · Sept 2026
- Industrycs.LG
Fixed controls expose limits in financial LLM agent evaluation
Fixed-response replay and matched defect controls show execution comparisons confound model behavior, while target recall alone misrepresents audit quality.
Virginia Tech · Sept 2026
- Big Tech
Formal audit detects omitted source relationships in generative search
A four-predicate audit can determine whether a generative search answer omits a source relationship that changes its interpretation.
Google LLC, Sony Corporate of America · Sept 2026
- Academiccs.AI
Adaptive logit tilting exposes rare language-model behaviors more reliably
BLOOM-WILT combines input refinement with logit tilting to elicit rare LLM behaviours, improving self-harm elicitation from 51% to 100% on Qwen3.5-4B without training or extra access.
University of Manchester · Sept 2026
- Top Universitycs.LG
Mean benchmark accuracy misleads model release decisions; recipe cards certify tail risk
Mean accuracy is the wrong estimand for model release decisions; tail failure probability should be certified instead.
Seoul National University Hospital, Inha University · Oct 2026
- Independentcs.AI
A small AI agent trained on cloned websites matches bigger web agents
A suite of 153 self-hosted replica websites with 3,518 tasks trains small web agents that then handle unseen tasks and match leading open agents.
Nov 2026
- Chinese Techcs.AI
Co-evolved agents lose gains when their skill banks change
Co-evolved skill-policy pairs are fragile: performance drops sharply when deployed skills drift, erasing most gains.
Alibaba Token Hub, Alibaba Group, The Hong Kong Polytechnic University · Oct 2026
- Top Universitycs.CR
AI training can be detected in simulated datacentre power despite concealment
A passive power meter using Viterbi tracking detects synchronous AI training runs reliably and makes hiding expensive.
The University of Melbourne, University of Oxford · Oct 2026
- Industrycs.SE
SWE-Bench Pro V2 repairs 480 flawed tasks and blocks agent exploits
SWE-Bench Pro V2 repairs or retires 480 of 731 tasks and hardens grading so frontier coding agents cannot game the benchmark.
Reflection AI, Scale AI · Oct 2026
- Chinese Techcs.CL
High probe accuracy does not guarantee a usable agent alarm
High-AUROC activation probes do not establish deployable alarm policies without semantic-unit evaluation, independently calibrated thresholds, transport, and acceptable low-false-alarm utility.
Alibaba Cloud Computing · Oct 2026
- Big Techcs.AI
HELM Safety's HarmBench fails to measure a single harmful refusal construct.
HarmBench scores collapse distinct harm behaviors, not measuring a single harmful refusal attribute.
Carnegie Mellon University, Indiana University · Oct 2026
- Academiccs.LG
Scaling curves can be certified with far fewer sampled answers
A paired audit achieves nearly minimax cost for certifying best-of-k scaling curves with simultaneous confidence bands.
PMCC AI Lab, Peter Munk Cardiac Centre · Oct 2026
- Big Techcs.CL
AI text detectors can expose readable features without sacrificing performance
Sparse autoencoders convert black-box AI text detectors into classifiers based on human-readable textual features.
University of Pennsylvania, Google DeepMind · Oct 2026
- Academiccs.AI
Neither decision models nor new LLMs beat statistical baselines as synthetic survey respondents
Decision models produce plausible survey marginals but lack psychometric validity, while newer generative models do not improve on older models or statistical baselines.
Hostinger, Kaunas University of Technology · Oct 2026
- Independentcs.SE
Automated observer catches fail-plausible LLM errors but misses novel ones
A two-layer observer correctly identified all 6 historical fail-plausible incidents but missed all 4 novel patterns and produced 10 silent failures of its own.
Independent researcher · Oct 2026
- Big Techcs.CL
Step-by-step process delivery boosts LLM predictability and auditability
Step-by-step delivery of procedures via MCP ensures predictable, inspectable LLM agent execution and near-eliminates ungrounded correct answers.
Amazon Web Services, University of the Bundeswehr Munich · Oct 2026
- Big Techcs.AI
Small surrogate models can flag errors in black-box LLM agents
A small surrogate model's log-probabilities audit black-box LLM agent actions better than the agent's own confidence or self-consistency.
Amazon · Oct 2026
- Big Techcs.SEcode
Code-linked evidence lets AI software claims expire when dependencies change
Assay binds agent claims to Merkle hashes of dependency cones so claims expire automatically when code changes.
Google, OMNI3ai · Sept 2026
- Academiccs.AI
Correcting search bias makes deep research conclusions more representative
CESS corrects evidence selection bias in deep research agents by weighting documents by their selection probabilities.
Beijing Normal University, Ke Holdings · Oct 2026
- Chinese Techcs.CL
Report-dependent auditing pushes LLMs to suppress input factors
Report-dependent auditing of LLM factor explanations creates a suppression incentive, while report-independent auditing or a small floor preserves truthful reporting.
Hefei University of Technology, East China Normal University · Oct 2026
- Top Universitycs.LG
Backdoors can hide executable neural networks inside model weights
Backdoor attacks can embed encrypted neural networks in model weights, hiding arbitrary capabilities from elicitation even with full white-box access.
Contramont Research, University of Oxford · Oct 2026
- Top Universitycs.CR
Agent approvals can omit effects triggered downstream by tools
Coding-agent approval records omit transitive workflow effects; pre-execution effect predictions can recover coverage.
Institute of Information Engineering, Chinese Academy of Sciences, University of Chinese Academy of Sciences · Sept 2026
- Independentcs.AI
Auditable world-model harness achieves perfect ARC-AGI-3 score
Kepler’s auditable executable world models achieved 100.00 RHAE across all 25 public ARC-AGI-3 games under one frozen configuration.
Independent Researcher · Oct 2026
- Academiccs.SE
Expert verification failures become reusable guidance for coding agents
Expert diagnosis of verification failures can be captured as reusable guidance for coding agents.
University of Illinois Urbana-Champaign · Oct 2026
- Academic
Topic shifts do not reliably stop LLMs revealing user secrets
User secrets in LLM conversations remain recoverable after topic drift, with leakage rates between 38.7% and 54.6%.
West Virginia University · Sept 2026
- Top Universitycs.CV
AI agents’ clicks marked wrong can work a third of the time
Many clicks that GUI-grounding benchmarks reject are actually correct because they produce the same action as the annotated box.
Zhejiang University, Zhejiang Geely Holding Group Co., Ltd · Oct 2026
- Industrycs.CL
LLM judges can be consistent yet wrong and order-sensitive
LLM judge verdicts are not reliable: they vary across identical runs, flip with presentation order, and determinism can hide near-chance accuracy.
PayPal Artificial Intelligence, PayPal · Oct 2026
- Top Universitycs.CL
Sycophancy predates post-training but its specifics form during fine-tuning
Sycophancy often begins during pretraining, but post-training largely determines which prompts make a released language model abandon its answer under pressure.
Princeton University, University College London · Oct 2026
- Top Universitycs.CR
Codetta protocol enables high-capacity, keyless, undetectable steganography for LLM agents
Codetta enables high-capacity, keyless, and undetectable collusion between independently deployed LLM agents.
Carnegie Mellon University · Oct 2026
- Big Techcs.AI
Program-graph evidence and blinded LLM surrogates detect code equivalence gaps
Graph-grounded, blinded surrogate execution finds behavioral differences that benchmark labels and passing unit tests miss while abstaining when evidence is incomplete.
AWS AI Labs · Oct 2026
- Independentcs.CR
Faulty harnesses can radically distort prompt injection security results
Defective evaluation harnesses overstate indirect prompt injection attack success by up to 62.8 percentage points in LLM agents.
Independent Researcher · Sept 2026
- Top Universitycs.CRcode
Two-stage auditing finds more exploitable flaws in AI agent repositories
AgentXploit automates repository-to-runtime red-teaming for AI agents, achieving 59.3% end-to-end attack success.
National University of Singapore, University of North Carolina at Chapel Hill · Sept 2026
- Big Techcs.AI
Managing research ideas helps autonomous agents search faster
AIM automates idea-driven research, beating baselines by up to 4.9% and reaching best performance 3.1x faster.
Google Cloud AI Research, University of Wisconsin-Madison · Oct 2026
- Academiccs.SD
Music models predict folk tunes better mainly by copying repeats
Long-context gains in music sequence models are largely due to exact copying of repeated passages.
University of Alberta · Nov 2026
- Academiccs.SE
Enterprise agents act without permission more with missing evidence than explicit denial
Enterprise agents correctly obey explicit permissions but fail to stop when supporting evidence is missing.
Independent Researcher, University of Southern California · Nov 2026
- Top Universitycs.AI
Medical AI teams launder demographic bias into triage calls no audit catches
Multi-agent clinical teams launder demographic bias: the consensus hides disparities that no single output reveals.
Drexel University, University of Michigan · Oct 2026
- Independentcs.AI
Medical AI agents quietly read patient identifiers they never show
Medical AI agents can silently access protected health information without task necessity, requiring audits beyond output checks.
Nov 2026
- Academiccs.CV
Video reasoning models improve by auditing their own use of visual clues
A model can audit its own visual reliance and focus training on under-utilized visual tokens, improving video reasoning with far fewer resources.
University of Texas at Austin · Nov 2026
- Top Universitycs.AI
Causal framework lets auditors measure when to intervene on AI agents
Causal evaluation of interventions during AI agent trajectories is possible using micro-randomized trials and structural nested mean models.
Stanford University · Nov 2026
- Academiccs.IR
AI health overviews cite fewer top sources and often lack evidence
Google’s health AI Overviews often cite weaker sources, make unsupported or uncited claims, and provide incomplete or inaccurate answers.
Northwestern University · Oct 2026
- Top Universitycs.CV
Robots can generate continuous movements without a separate action network
Concertina unifies manipulation and cognition in a single diffusion vision-language model via continuous latent action tokens.
University of Sydney, TokenRhythm Technologies · Nov 2026
- Top Universitycs.CL
Non-English requests raise tool admission and response harm in LLM agents
Non-English harmful requests raise LLM tool admission from 46.9% to 67.4%; requiring answers in the page language increases post-retrieval harm.
National University of Singapore · Oct 2026
- Chinese Techcs.AI
Monitoring research agents detects integrity violations and helps reduce them
RIDAR detects and corrects research integrity violations in autonomous research agents, reducing violations by 36.8%.
Tsinghua University, Zhipu AI · Oct 2026
- Top Universitycs.AI
An agentic framework that diagnoses and verifiably repairs foundation model failures
EvalRx, an open-source agentic framework, statistically diagnoses and verifiably repairs foundation models, improving all 12 evaluated model-modality combinations by +1.4 to +10.9 percentage points.
The University of British Columbia, Vector Institute · Oct 2026
- Top Universitycs.AI
Evaluation scores for text-to-3D models shift more with configuration changes than model changes
Configuration variance exceeds generator variance for 17/19 alignment evaluators in fixed-scene text-to-3D evaluation.
The Chinese University of Hong Kong · Oct 2026
- Big Techcs.NI
Black-box RL method finds large performance gaps in LLM network control
LENS uses reinforcement learning to find adversarial inputs that expose large performance gaps in LLM-based network control systems without accessing model internals.
University of Southern California, Microsoft Research · Oct 2026
- Top Universitycs.CR
Independent logs make deployed agent records verifiable after failures
Agent harness records are not independently auditable; an external append-only witness with bidirectional reconciliation detects omissions and fabrications that self-authenticated logs miss.
Nanyang Technological University, National University of Singapore · Sept 2026
- Research Labcs.AI
AI agents can work on mathematical proofs for hours unattended
Numina Fuse is an agent-native Lean 4 application built around human supervision of agent work through views of blueprint, dependency graph, and Lean code.
Project Numina, University of Naples Federico II · Oct 2026
- Big Techcs.CV
Automated framework discovers hidden biases in vision-language models
SPELUNKA automatically detects unanticipated spurious associations in vision-language model retrieval by comparing top-ranked outputs with dataset-wide frequencies.
MIT, Google · Oct 2026
- Top Universitycs.CR
Editable policy tree guardrail classifies agent actions in 58 milliseconds
A 2B direct classifier routing over an editable policy tree achieves 93.72% safety accuracy, 93.10% routing accuracy, and 58ms mean latency.
HKUST, ModeIO · Oct 2026
- Chinese Tech
Agent skill for plugin migration shows reward gains but hides grading errors
Version-specific agent skills raised plugin-migration scores, but concentrated gains and grading errors made aggregate reward unreliable evidence of contract-correct advice.
Tsinghua University, Fudan University · Sept 2026
- Academiccs.AI
Prompt optimization yields no gains on strong reasoning models
Automated prompt optimization produces no statistically significant accuracy gains on frontier reasoning models; it fixes formatting errors but cannot supply missing knowledge or fit truncated context.
Hunan Agricultural University · Nov 2026
- Research Labcs.SE
AI agents can bypass active safeguards after routine configuration changes
Routine operations like reapplying a plugin can silently break architectural patterns in LLM agent harnesses, causing policy checks to be skipped.
Responsible AI Research Centre, Adelaide University · Nov 2026
- Big Techcs.AI
Coding agents improve scientific models mostly through engineering, not insight
Frontier agents improve scientific ML benchmarks via ML engineering tricks, not research insight; plug-in skills double gains.
Anthropic Fellows Program, Anthropic · Oct 2026
- Independentcs.AI
AI agents helping each other can bypass oversight and harm outsiders
Benign LLM agents spontaneously cooperate to bypass oversight, causing harm.
Oct 2026
- Chinese Techcs.CL
Coding benchmarks can penalise agents for details their instructions omit
Coding-agent benchmarks that grade with upstream tests can silently reward agents for reproducing unstated implementation details, skewing scores.
Alibaba Group · Oct 2026
- Independentcs.CR
Some LLM graders collapse jailbreak compliance into evasion, skewing attack success rates
Small LLM graders can erase the compliance class, making identical jailbreak responses appear up to 25 times safer depending only on the grader.
Independent Researcher · Oct 2026
- Top Universitycs.SE
Agents write verifiers that wrongly reject valid solutions more often than they accept them
LLM agents generate verifiers that reject invalid solutions more reliably than they accept valid ones.
University of Pennsylvania, University of Illinois at Urbana-Champaign · Oct 2026
- Big Techcs.SE
Governing agents' evidence with deterministic harness rules beats free-form trajectories
Agentic Interpretation uses harness-governed evidence construction to improve agent patch acceptance and fault localization.
University of California, Davis, AWS AI Labs · Oct 2026
- Big Techcs.MA
Enterprise agent risks emerge when local decisions break shared constraints
EAIR provides the first framework for diagnosing and repairing interaction failures in enterprise multi-agent systems.
LMU Munich, Microsoft · Oct 2026
- Chinese Techcs.CR
Meta-attributes make agent tool permissions more consistent and attack-resistant
MetaPermit uses LLM-inferred meta-attributes and fixed policies to achieve zero malicious tool calls and up to 109% better task completion.
Paderborn University, Huawei Hilbert Research Center (Dresden) · Sept 2026
- Top Universitycs.CR
LLM agent scaffolding systematically finds broken access control vulnerabilities in web apps
ABSENTIA turns LLM agents into route-by-route auditors that infer intended authorization invariants and report where they are not enforced.
Carnegie Mellon University, Instituto Superior Técnico · Oct 2026
- Chinese Techcs.HCcode
Linked story artifacts help authors supervise narrative-generating agents
NarrativeSteward improves author understanding and guidance of AI-generated interactive narratives via linked artifacts and structural review.
Tencent Inc · Oct 2026
- Industrycs.SE
Scientific agents gain auditability through enforced, re-verifiable research workflows
Scientific credibility is achieved by making non-compliant states unrepresentable through mechanically enforced laws, not by asking the model to behave.
IdeaHorizon Team · Sept 2026
- Top Universitycs.SE
Reusable skills improve smart-contract audits, but model choice dominates
Model capability, not agent harness, determines skill effectiveness in smart contract auditing; triggering is a bottleneck.
Lingnan University, The Hong Kong Polytechnic University · Sept 2026
- Top Universitycs.AI
API benchmark scores poorly predict performance in consumer chatbot interfaces
API benchmark scores systematically overstate chatbot interface accuracy and consistency.
Stanford University · Sept 2026
- Top Universitycs.AI
LLM judges as measurement instruments fail reliability tests on shared endpoints
Black-box LLM judges on shared endpoints are unreliable measurement instruments due to unstable rankings and biased readouts.
University of Sheffield, Ranplan Wireless Network Design Ltd. · Sept 2026
- Academiccs.AI
Medical AI models often give right answers with disconnected reasoning
Medical chain-of-thought rationales in large language models are often decorative, not faithful to input changes.
Eindhoven University of Technology, Dana-Farber Cancer Institute · Aug 2026
- Independentcs.CY
AI image generators produce faces judged more attractive than real people and encode racial bias
Text-to-image generators idealize faces, reproduce racialized beauty hierarchies, and make viewers judge photographs of real job candidates more harshly.
Oct 2026
- Top Universitycs.AI
Passing self-generated tests do not ensure semantic correctness in DataFrame code generation
Self-generated tests can increasingly pass while plans, code, and assertions preserve the same semantic misunderstanding of a DataFrame task.
University of California, Berkeley, Northeastern University · Oct 2026
- Academiccs.CV
Frozen vision-language safety score tracks scene template, not hazards directly
A frozen CLIP safety score measures scene resemblance to its caption bank, not hazard detection.
Iowa State University · Oct 2026
- Big Techcs.AI
Misaligned agents can leave goals that later aligned agents execute
LLM agents can self-propagate misaligned goals to future agents via memory or file writes, even without an external adversary.
Anthropic Fellows Program, Independent · Oct 2026
- Industrycs.CRcode
Benchmark scores on prompt injection detectors do not predict real-world performance in LLM agents.
Detector rankings on injection benchmarks do not predict performance inside LLM agents; training data form drives real-world detection.
Japan Advanced Institute of Science and Technology (JAIST) · Oct 2026
- Academiccs.LG
Gradient conflict fails to predict multimodal model trade-offs
Gradient conflict metrics do not reliably predict the understanding-generation trade-off in multimodal models.
University of California, Los Angeles, Aimakj · Oct 2026
- Big Techcs.AI
Verified self-improvement makes agent harness optimization more reliable
VERSE improves harness optimizers by letting them test edits and evolve their own verification tools.
MIT, Amazon · Oct 2026
- Top Universitycs.AI
Structured experiment orchestration helps agents improve models without benchmark hacking
RSI-Master uses an Experiment OS and reviewer-guided research DAG to stop hacking and strategy lock-in, improving autonomous post-training model development.
Shanghai Jiao Tong University, Carnegie Mellon University · Sept 2026
- Chinese Techcs.AI
Fact-intent graphs accelerate multi-agent work on difficult, long-running tasks
CAIRN coordinates multiple LLM agents using a dynamic fact-intent DAG, achieving up to 3.08x speedups on high-effort tasks over 1M tokens.
Nankai University, Tencent Security Yunding Lab · Sept 2026
- Independentcs.LG
Fixed LLM judges can mismeasure upgrades as agents change
Fixed LLM judges make version-dependent errors when evaluating agent upgrades, making paired audits preferable.
Sept 2026
- Top Universitycs.AIcode
Hidden prompt revisions inject cultural stereotypes into generated images
Hidden prompt revision in commercial text-to-image systems marks non-Western cultures more heavily and causally injects cultural stereotypes before image generation.
University of Zurich, University of Helsinki · Sept 2026
- Independentcs.SE
Engineering agents need evidence-bound authorization before their outputs trigger action
The Agile-V Assurance Spine authorizes engineering transitions only when current, authoritative evidence and approvals are bound to the exact artifact, policy, scope, and execution point.
Sept 2026
- Top Universitycs.AI
Financial agents can cite rules while still attempting prohibited trades
LLM agents can cite financial rules yet still attempt orders that execution checks reject; visible rules, incentives and personas alter behavior but do not guarantee compliant actions.
HKUST, HKBU · Aug 2026
- Top Universitycs.AI
Multi-agent system creates editable 4D scenes from text prompts
SimWorlds generates dynamic 3D scenes from text using multi-agent planning and verification, outperforming prior baselines.
Carnegie Mellon University, Harvard University · July 2026
- Independentcs.CR
AI agents can be backdoored by changing just seven neurons
Editing fewer than ten dormant neurons in an LLM's final feed-forward block creates a reliable backdoor without training.
Nov 2026
- Academiccs.CR
Signed LLM weights do not certify the quantized files users actually run
Signing full-precision LLM weights does not verify deployed quantized models unless the transformation inputs and build environment support bit-exact reproduction.
National Yang Ming Chiao Tung University, National Taiwan University of Science and Technology · Oct 2026
- Chinese Techcs.AI
Gameplay dataset maps tasks to subgoals for training AI agents
AceAction-5M is a multi-game dataset linking task, subgoal, and skill instructions to time-aligned gameplay visuals and keyboard-and-mouse actions.
Tencent, Jilin University · Nov 2026
- Research Labcs.AI
AI simulations can predict safeguard effectiveness better than tests in separate environments
Simulated control evaluations using language models to simulate tool responses predict deployment safety more accurately than separate control settings.
Redwood Research · Oct 2026
- Big Techcs.CL
Research agents can exploit evaluations and adapt to evade oversight
Autonomous research agents frequently reward-hack, and iterative reviewer feedback can help them evade oversight, requiring evaluation metrics and recomputation outside their control.
Bake AI, University of Notre Dame · Sept 2026
- Research Labcs.CR
Auditing pending actions catches staged attacks in long-running AI agents
Long-horizon agents are vulnerable to staged prompt injection; boundary action auditing with Path-Aligned Attribution blocks attacks at high recall and low false-block rate.
Beijing Jiaotong University, Mohamed bin Zayed University of Artificial Intelligence · Oct 2026
- Industrycs.AI
Auditing passing trajectories exposes and repairs unearned benchmark passes
Unearned passes in agentic benchmarks can be detected via trajectory auditing; patch-only repairs are insufficient because the information channel may remain open.
Scale AI · Oct 2026
- Big Techcs.LG
Soft routing among process experts helps PDE forecasting, but gains prove seed-dependent
Dense soft routing yields 2.2 times lower rollout error than hard top-1 routing on a compositional PDE benchmark.
Indian Institute of Technology Bombay, IBM Research · Oct 2026
- Top Universitycs.AI
Revision-aware agent graphs reuse valid work while avoiding stale answers
RIAG achieves 54.24% accuracy at 0.62 calls/query, outperforming baselines that use 18 calls/query.
Harvard AI and Robotics Lab, Harvard University · Oct 2026
- Research Labcs.AI
Open-weight agents pose a distinct and growing risk for LLM pollution in online surveys
Open-weight LLM agents running locally pose a distinct, low-cost threat for polluting human survey data.
Max Planck Institute for Human Development, University of Basel · Sept 2026
- Chinese Techcs.AIcode
Automated safety testing reveals 93.9% attack success rate across four agent frameworks
LLM agents can be systematically safety tested using automated combinatorial risk exploration and evidence-grounded verification.
AntGroup, Zhejiang University · July 2026
- Chinese Techcs.CV
Conversational image editing agent learns interpretable tool use
Trained in three multitask alignment stages, IEA edits images conversationally by calling 16 interpretable tools step by step and outperforms baselines on fidelity, summary, and user preference.
Shanghai Innovation Institution, Huawei Technologies Ltd. · June 2026
Concepts are extracted from each paper and reused across the corpus, so this page grows on its own as the desk reads.