provenance

The papers

Most central to this idea first, not most recent.

• Top Universitycs.AI

  Linking memory back to raw data helps AI agents avoid repeating bad lessons

  Evidence-linked memory, storing lessons with their source trajectories, reduces failures caused by incorrect or misapplied lessons in LLM agents.

  KAIST, DeepAuto.ai · Nov 2026

• Academiccs.CL

  AI text detectors spot chatbot essays but can miss rewritten sentences

  State-of-the-art detectors achieve high accuracy on authentic student writing, but sentence-level detection drops when AI text is rewritten.

  Leibniz Institute for Science and Mathematics Education, Kiel University · Nov 2026

• Academiccs.SE

  Code plagiarism detectors fail on whole repositories rewritten by AI agents

  Current provenance detection methods cannot reliably trace repository-scale AI-rewritten code to its source.

  Emory University, University of Illinois Urbana-Champaign · Nov 2026

• Research Labcs.LG

  Language models can reveal their ancestry without exposing their internal weights

  TRACE-Edge reconstructs LLM lineage trees by using asymmetric log-likelihood deviations to determine fine-tuning direction.

  Institute of Science Tokyo, RIKEN · Nov 2026

• Research Labcs.CL

  Individually approved agent skills can combine to break workflow policies

  Individually safe agent skills can combine to cause policy violations, and adding a few benign skills nearly doubles the violation rate.

  University of Science and Technology Beijing, ZODA · Oct 2026

• Chinese Techcs.LG

  Reasoning models usually inherit “wait” from training data, not reinforcement learning

  The word "wait" in reasoning models is inherited from training data, not coined by reinforcement learning, which only reshapes it.

  The Hong Kong University of Science and Technology, Huawei Noahah’s Ark Lab · Oct 2026

• Top Universitycs.CR

  Privacy-preserving watermarks for AI text allow aggregate tracking without individual surveillance

  Privacy and provenance for language model watermarks can be reconciled by shifting from individual tracking to aggregate frequency estimation.

  Stanford University · Nov 2026

• Top Universitycs.CL

  AI mathematical reasoning improves more with textbook structure than with isolated problems

  Training on structured textbook proofs raises a language model’s average mathematics score by 16.7 percentage points and beats the tested instruction-data baselines overall.

  University of Science and Technology of China, Fudan University · Oct 2026

• Chinese Techcs.SE

  Token-level evidence pinpoints AI-written lines and blocks inside mixed code files

  Token-level likelihood ratios plus contextual line and block aggregation detect and localize small AI-involved code spans better than file-wide scoring.

  Peking University, Baidu Inc. · Oct 2026

• Top Universitycs.CR

  Independent logs make deployed agent records verifiable after failures

  Agent harness records are not independently auditable; an external append-only witness with bidirectional reconciliation detects omissions and fabrications that self-authenticated logs miss.

  Nanyang Technological University, National University of Singapore · Sept 2026

• Academiccs.AI

  Hidden bugs in evaluation code silently reorder AI agent rankings

  Agent leaderboard scores are silently distorted by the grading, logging, cost and versioning code behind them; cheap audit checks can expose the reordering.

  Shandong University · Nov 2026

• Top Universitycs.CR

  New security architecture blocks all attacks on AI coding agents with near-zero latency

  Separating an agent’s decisions from its permissions and tracking trust and secrecy across steps blocks tested attack chains without blocking benign workflows.

  Evercursion – GaiaLogic Unipessoal Lda., University of Macau · Nov 2026

• Research Labcs.CL

  AI-generated notes distort downstream clinical summaries

  LLM-authored content in medical records degrades downstream LLM performance and propagates errors.

  Australian e-Health Research Centre, CSIRO, Mater Research Institute – University of Queensland · Nov 2026

• Research Labcs.SE

  Agent evaluation pipelines drop tool calls before the AI judge reads them

  Matching hashes and passing checkers did not stop a renderer from blanking nearly every judged agent step, so input content must be verified against source records.

  Adelaide University, CSIRO · Nov 2026

• Top Universitycs.CL

  RAG's retrieval, not reading, is the bottleneck for long-context question answering

  Similarity-based RAG fails long-context multi-fact QA because retrieval cannot surface all needed chunks and chunking loses document metadata, not because reading is inadequate.

  MBZUAI, Inception42 · Oct 2026

• Industrycs.LG

  Safety benchmark scores reflect training policy more than model capability

  Guardrail benchmark scores often measure alignment with a labeling policy rather than the model’s ability to detect harmful content.

  Lenovo · Oct 2026

• Big Techcs.CR

  AI agents make fewer privacy mistakes when they plan disclosures first

  Planning data flows and simulating recipients' inferences before an AI agent acts raises violation-free task completion by 22 to 55 percentage points.

  Google Research, ETH Zurich · Nov 2026

• Big Techcs.CL

  Checklist rubric content dominates LLM judge strictness, not the model

  Checklist content, not judge choice, determines LLM-grading strictness, while ungated model self-review degrades rubrics by removing useful checks and adding unstated requirements.

  Microsoft · Oct 2026

• Big Techcs.AI

  A verified memory interface makes agent security depend on explicit confirmations

  PerMIT secures persistent memory for LLM agents with machine-checked integrity theorems and community-based trust.

  Stony Brook University, AWS AI Labs · Oct 2026

• Academiccs.AI

  LLM aggregators partly count restated evidence as new readings, measure shows

  LLM aggregators treat repeated evidence as partly independent, inflating confidence and triggering decisions unsupported by the underlying sources.

  China Agricultural University, Jilin University · Oct 2026

• Big Techcs.SEcode

  Code-linked evidence lets AI software claims expire when dependencies change

  Assay binds agent claims to Merkle hashes of dependency cones so claims expire automatically when code changes.

  Google, OMNI3ai · Sept 2026

• Research Labcs.CR

  Execution-Time Checks Limit Malicious Tool Calls by LLM Agents

  Provenance-Aware Capability Enforcement (PACE) prevents tool misuse by verifying capability and provenance at the point of execution.

  PRADA Lab, King Abdullah University of Science and Technology · Oct 2026

• Top University

  Shared agent memories confuse repeated claims with independent evidence

  Gating on declared source type reduces false adoption in shared agent memory, but no policy consistently rejects false claims.

  University of Southern Queensland, University of New South Wales · Sept 2026

• Top Universitycs.AI

  Tool calls need formation-bound dispatch to preserve their security meaning

  Unchanged valid tool calls can change security meaning due to schema-epoch drift; formation-consistent dispatch prevents this failure.

  Korea Advanced Institute of Science and Technology (KAIST) · Sept 2026

• Big Tech

  Formal audit detects omitted source relationships in generative search

  A four-predicate audit can determine whether a generative search answer omits a source relationship that changes its interpretation.

  Google LLC, Sony Corporate of America · Sept 2026

• Chinese Techcs.AI

  Protocol risks in multi-agent systems depend on downstream agent decisions, not just local exploitability

  Protocol risk in multi-agent systems is determined by downstream agent decisions, not just local exploitability.

  Ant Group, Shanghai Jiao Tong University · Oct 2026

• Chinese Techcs.AI

  Structuring noisy file environments improves agents’ performance on complex tasks

  Env-Rethink prepares and evolves agent environments using collection maps and event logs, lifting mean rubric pass rate by 15.1 points across nine models.

  Shanghai Jiao Tong University, Theseus Labs · Sept 2026

• Industrycs.SE

  Scientific agents gain auditability through enforced, re-verifiable research workflows

  Scientific credibility is achieved by making non-compliant states unrepresentable through mechanically enforced laws, not by asking the model to behave.

  IdeaHorizon Team · Sept 2026

• Big Techcs.AI

  Speaker-indexed memory cuts token costs while preserving answer accuracy

  Stashbird reduces memory token usage by up to 76x while achieving competitive question answering accuracy across long-term conversation benchmarks.

  Microsoft · Sept 2026

• Independentcs.AI

  Persistent evidence tracking improves language-agent performance on bioinformatics benchmarks

  Bioinfoysis is a multi-agent harness that achieves 82.4% accuracy on BixBench using persistent artifact-grounded analysis runs.

  Sept 2026

• Top Universitycs.CR

  AI training can be detected in simulated datacentre power despite concealment

  A passive power meter using Viterbi tracking detects synchronous AI training runs reliably and makes hiding expensive.

  The University of Melbourne, University of Oxford · Oct 2026

• Research Labcs.CV

  AI image detectors can be fooled by editing tricks found online

  Web-sourced image processing tools achieve up to 100% attack success against AI image detectors.

  CISPA Helmholtz Center for Information Security · Oct 2026

• Academiccs.CR

  Kairos delays agent actions until their consequences reveal security risks

  Kairos reduces LLM agent attack success from 47% to 2.7% by monitoring every effect at the system isolation boundary.

  Universität zu Lübeck, University College London · Oct 2026

• Top Universitycs.CR

  Agent approvals can omit effects triggered downstream by tools

  Coding-agent approval records omit transitive workflow effects; pre-execution effect predictions can recover coverage.

  Institute of Information Engineering, Chinese Academy of Sciences, University of Chinese Academy of Sciences · Sept 2026

• Big Techcs.PL

  Agentic copilot accelerates ML accelerator co-design by grounding insights in fresh simulation data

  Coco automates simulation experiments and data analysis to accelerate hardware-software co-design for ML accelerators.

  Google, Google DeepMind · Oct 2026

• Independentcs.SE

  Engineering agents need evidence-bound authorization before their outputs trigger action

  The Agile-V Assurance Spine authorizes engineering transitions only when current, authoritative evidence and approvals are bound to the exact artifact, policy, scope, and execution point.

  Sept 2026

• Academiccs.AI

  Digital twins make agent decisions replayable, but hidden tool states remain

  Recording a committed agentic decision as a typed trajectory in a graph-native digital twin makes its mechanism replayable and divergences detectable under controlled changes.

  Qingdao University, Shandong University · Sept 2026

• Top Universitycs.CR

  Most AI coding agents overrun a disk limit before reading the file

  Processing an archive, URL, or image can cause harm before the model sees any content.

  Tsinghua University, The University of Sydney · Nov 2026

• Academiccs.CR

  Black-box attack defeats major LLM watermarking schemes while preserving text quality

  Score-ratio alignment lets a black-box attacker evade major LLM statistical watermarks while keeping generated text fluent and natural.

  Illinois Institute of Technology, University of Connecticut · Oct 2026

• Big Techcs.CR

  Zero-knowledge proofs let AI agents prove they followed policies without exposing the rules

  zkARc produces succinct zero-knowledge proofs that a neurosymbolic system correctly enforced natural language policies on AI actions.

  ICME Labs, Imperial College London · Nov 2026

• Academiccs.CR

  Signed LLM weights do not certify the quantized files users actually run

  Signing full-precision LLM weights does not verify deployed quantized models unless the transformation inputs and build environment support bit-exact reproduction.

  National Yang Ming Chiao Tung University, National Taiwan University of Science and Technology · Oct 2026

• Research Labcs.CR

  Auditing pending actions catches staged attacks in long-running AI agents

  Long-horizon agents are vulnerable to staged prompt injection; boundary action auditing with Path-Aligned Attribution blocks attacks at high recall and low false-block rate.

  Beijing Jiaotong University, Mohamed bin Zayed University of Artificial Intelligence · Oct 2026

• Industry

  Small-Sample LLM Rankings Often Overstate Evaluation Reproducibility

  LLM evaluation rankings often look definitive but are highly unstable under resampling and defensible analysis changes.

  Skelf Research · Sept 2026

• Industrycs.AI

  Benchmark scoring code, not the model, can swing accuracy 22 points

  Scoring rules in multimodal LLM benchmarks can inflate accuracy by up to 22 points on identical outputs.

  Independent Researcher, Nebius · Nov 2026

• Big Techcs.CV

  Image forensics protocol sorts AI edits into retouching, tampering, and full synthesis

  A dual-channel protocol distinguishes retouched, tampered, and synthetic images beyond binary real/fake labels.

  Google, University of British Columbia · Nov 2026

• Chinese Techcs.SE

  Coding agents can finish frontend changes while breaking existing website behavior

  Frontend agents that complete requested changes often break existing site behavior; ProductWebBench finds 28.2% of passing Change runs fail continuity checks.

  Beihang University, IQuest Research · Oct 2026

• Independentcs.AI

  External specifications, not agents, should authorize task completion claims

  Specifications should govern agent execution and completion through an external runtime, not rely on agent self-assessment.

  Sept 2026

• Big Techcs.AIcode

  Entity-structured indexes help agents retrieve precise long-term memories

  Entity-structured indexing with episode provenance improves long-term agent memory retrieval and answer accuracy over summary-based systems.

  University of Illinois Urbana-Champaign, Amazon · Sept 2026

• Chinese Techcs.AIcode

  C3M preserves multimodal evidence across sessions within fixed memory budgets

  C3M maintains a bounded active index over persistent text-image evidence with relation-aware updates and budgeted routing, improving accuracy on cross-session long-horizon tasks.

  Huzhou Normal University, Alibaba Group · Sept 2026

• Top Universitycs.AI

  Structured experiment orchestration helps agents improve models without benchmark hacking

  RSI-Master uses an Experiment OS and reviewer-guided research DAG to stop hacking and strategy lock-in, improving autonomous post-training model development.

  Shanghai Jiao Tong University, Carnegie Mellon University · Sept 2026

• Academiccs.AI

  Self-configured memory views improve retrieval across long conversations

  AutoViewMem improves conversational memory retrieval by discovering and using low-overlap semantic views to structure memories at write time.

  National University of Defense Technology · Sept 2026

• Industrycs.CR

  Security contracts preserve authorization across composable LLM agent systems

  CONTINUITY verifiably prevents security-context discontinuity, ensuring no harmful external effects from composable LLM agent controls.

  ZAST.AI · Sept 2026

• Industrycs.AI

  Typed trace folding helps agents and observers manage long runs

  A single incremental fold of a live agent trace serves both agent and observer with higher accuracy and lower cost than raw trace reading.

  Salesforce AI Research · Sept 2026

• Research Labcs.AI

  Separating tool suggestions from authorization sharply reduces agent attacks

  SARA separates action induction from runtime authorization in tool-augmented LLM agents, limiting attack success rate to under 0.63%.

  Institute of Information Engineering, Chinese Academy of Sciences, School of Cyber Security, University of Chinese Academy of Sciences · Aug 2026

• Top Universitycs.CR

  Malicious code in tool updates evades LLM agent defenses

  Agent frameworks keep trusting a tool after its code is updated, so an attacker can slip hidden malicious behavior into a routine update and have it run during normal tool calls.

  Shanghai Jiao Tong University, Inria · Nov 2026

• Big Techcs.AI

  Filtering pages before they reach AI search blocks over 80% of hidden attacks

  SearchInject reduces exposure to injected pages in tested search systems by 83.2–83.7% with little change to clean-result ranking quality.

  Google LLC, Harvard University · Nov 2026

• Academiccs.CR

  Stronger LLM judges accept more tampered outputs, not fewer

  Output-only evaluation cannot detect deployment tampering; stronger judges accept more tampered outputs, so identity evidence is required.

  University of Connecticut · Oct 2026

• Big Techcs.CL

  Shared message search lets LLM agent groups scale without flooding readers

  Multi-agent LLM systems scale better when agents coordinate through a shared datastore with bounded reads and citation-based ranking.

  FAIR at Meta, Harvard · Oct 2026

• Big Techcs.MA

  Enterprise agent risks emerge when local decisions break shared constraints

  EAIR provides the first framework for diagnosing and repairing interaction failures in enterprise multi-agent systems.

  LMU Munich, Microsoft · Oct 2026

• Big Techcs.CR

  Activation steering sharply reduces indirect prompt injection in open models

  CounterSteer suppresses indirect prompt injection by subtracting a per-model residual-stream direction from tool-result tokens during prefill, cutting attack success to near zero without utility loss.

  Microsoft Azure · Sept 2026

• Big Techcs.CL

  Source-aware rewards reduce fabricated evidence in trained search agents

  Making search agents explicitly label and reward external versus internal evidence sources reduces evidence fabrication by 74.8% and improves accuracy.

  Zhejiang University, Microsoft · Oct 2026

• Top Universitycs.AI

  Markdown interfaces cut agent context costs without reducing task success

  String provides an operating system for LLM agents where every app is a Markdown file, reducing token consumption and errors.

  Seoul National University, H1R.AI · Sept 2026

• Research Labcs.CV

  Visual evidence works better when tied to the candidate it supports

  Visual evidence can improve task accuracy while its effect supports the wrong candidate; RIVET raises effect transfer and accuracy.

  Technology and Engineering Center for Space Utilization, Chinese Academy of Sciences, University of Chinese Academy of Sciences · Oct 2026

• Research Labcs.SE

  Scaling executable training data for software engineering agents with progressive construction and elastic streaming

  SWE-Stream constructs 80,874 executable SWE tasks from 10,728 repositories and achieves 69.0% on SWE-bench Verified.

  Xiamen University, Institute of Automation, Chinese Academy of Sciences · Oct 2026

• Independentcs.CL

  Row-aligned corpus links all 22 Indian languages via pivots

  BharatSetu provides a single table of 1 million English sentences machine-translated into all 22 scheduled Indian languages, enabling any pair of these languages to be translated via English.

  Oct 2026

• Independentcs.CV

  Long-video agent adapts retrieval to each question’s evidence needs

  VESTA improves long-video question answering by routing evidence acquisition into focused, recall, or contrastive retrieval policies before agentic exploration.

  Sept 2026

• Industrycs.AI

  Dual-layer knowledge graph connects fragmented pharmaceutical process-development documents

  A dual-layer knowledge graph with LLM agents retrieves answers from CMC documents with 95% accuracy on a 505-question benchmark.

  Sanofi US · Sept 2026