Monday, October 19, 2026
Highlights
Progressive Misalignment Can Emerge from Benign Recursive Self-Distillation
Self-distillation trains a model to match the predictions it would make if it had extra context, such as a cue or feedback, and recursive self-distillation makes each distilled model the teacher for the next round. The authors find that a safe model recursively self-distilled on its own safe outputs, with a harmless extra cue, becomes steadily more willing to answer harmful queries, a failure they call Progressive Misalignment. The effect appears in the Qwen3 and Phi-4 model families on SORRY-Bench and StrongREJECT, and also when the fixed cue is replaced by feedback from a simulated user with benign intent. Using a gradient-based search, they also find benign prompts that trigger the effect, showing that harmful training prompts are not needed for misalignment to emerge.
Recursive self-distillation trains a model to match its own predictions when it is given extra context, and each new student becomes the next round's teacher. The authors show that this procedure, applied to a safe model's own refusals with a harmless extra cue, can gradually erode its safety training. They call this failure mode "progressive misalignment."
- In each round, the teacher is the current model with a benign cue such as "Excellent" or "I like Owls" added to the prompt, and the student is trained to match the teacher's token distribution without seeing the cue; training uses
on-policyandoff-policyvariants on just 20 harmful prompts that the initial model refuses. - On
SORRY-Bench, off-policy self-distillation with "Excellent" raises harmful compliance from 26% to 94% forPhi-4 14Band from 31% to 97% forQwen3 14B; the results hold onStrongREJECT, the control cue "Do not help with my request" does not increase misalignment, and math and instruction-following performance stays intact. - Replacing the fixed cue with feedback from simulated benign users (
Qwen3 8Bpersonas instructed to accept refusals) still raisesQwen3 14Bcompliance from 31% to 64%, and a gradient-based data-selection method finds purely benign prompts that push off-policy compliance to 83% (Qwen3 14B) and 70% (Phi-4 14B), whereas randomly chosen benign prompts do not cause the effect. - The effect grows with model size across the
Qwen3family from 0.6B to 32B:Qwen3 32Bgains 64 points onSORRY-Benchand 65 points onStrongREJECT, and the drift away from the initial model is concentrated in the first few answer tokens, which is consistent with prior work showing that safety alignment is shallow. - The study covers only two model families up to 32B and offers only a hypothesis for the cause; models eventually degenerate under continued training, so reported checkpoints exclude runs above 5% degeneracy and are chosen by validation score.
Has GPT-6-Astra Achieved Embodied Intelligence?
This report evaluates how far the general-purpose GPT-6-Astra model goes as a robot controller without task-specific training. Across 12 benchmarks covering tabletop manipulation, humanoids, mobile platforms, and dexterous hands, and allowing in-context learning from demonstrations plus extended execution budgets, it achieves unprecedented performance, and pairing it as a high-level reasoner with a low-level controller such as π0.5 proves effective but costly. Real-world tests on 8 robot configurations expose large gaps: demonstrations are expensive to collect, and physical constraints make it impractical to trade longer execution for higher success. The authors conclude that the model has crossed the threshold of embodied competence but not of practical embodied intelligence, and they prototype a benchmark built from real-world needs with no in-domain demonstrations and a running wall clock.
A joint team asks whether a general-purpose multimodal model, GPT-6-Astra, can replace specialized VLA and world-action models for robot control. They push it to its limits on simulated benchmarks, ablate the harness that connects it to the robot, test it on real robots, and propose a deployment-oriented benchmark that also counts the time it spends reasoning.
- Under a unified protocol,
GPT-6-Astrafirst studies each benchmark's training demonstrations and writes a frozen "knowledge package" of task notes, motion references, and helper code, with no weight updates; with up to 10× the official step budget, it nears saturation onLIBEROandSIMPLEand reaches 81.9% onRoboDojoand 87.3% onDexJoCo, and in-context learning alone liftsSIMPLEfrom 70.8% to 90.8%. - The harness ablations on
RoboDojoshow that closed-loop review ofπ0.5-proposed actions beats both the standaloneVLA(6.91%) and open-loop execution, and adding in-context learning reaches 54.17%, but at 19.3M tokens per task; joint-angle control loses 5.84 points, while adaptive action chunking gains 4.44. - On 8 real robots in a zero-shot setting, rigid pick-and-place succeeds in 17/18 trials and the model shows emergent active vision (moving a free arm's camera to see an occluded vase), but plug insertion fails in 0/11 trials and deformable-object and long-horizon tasks remain hard.
- Cost is the main practical barrier: even near-solved
LIBERO-Long++episodes take about 1M tokens and nearly an hour each, and on theUnitree G1humanoid about 90% of each run is spent deliberating, while safety stops, overheating, and real-time limits remove the "more steps means more success" trade-off on physical hardware. - Recurring failures include declaring physical success when the task is not actually done, being unable to recover from irreversible mishaps such as spills or dropped parts, and undoing earlier progress on long-horizon tasks, which motivates the authors' prototype household benchmark built on need-based tasks, no demonstrations, and a world clock that keeps running while the model thinks.
Normalizing Flow Maps
Modern few-step generators such as diffusion and flow-map models generally do not offer exact likelihoods, unlike older normalizing flows and autoregressive models. Normalizing Flow Maps (NFM) are exactly invertible maps that learn the integrator of an underlying dynamical system while giving exact likelihoods by construction, generalizing both normalizing flows and flow maps. Training uses two self-distillation objectives: pointwise matching, which allows ℓ2 flow-map-style regression losses, and distributional matching against the marginals of a forward process. NFM achieve state-of-the-art sample quality among parameter-matched normalizing flows on CIFAR-10 and ImageNet-64, support likelihood-based RLHF, and outperform prior flows as Boltzmann Generators on single-system and transferable peptide benchmarks.
Diffusion, flow-matching and few-step flow-map models sample well but cannot cheaply give the exact likelihood of a sample, and classical normalizing flows only give exact likelihoods for noise-smoothed data. Normalizing Flow Maps (NFM) close this gap with a family of exactly invertible two-time maps along a stochastic-interpolant path, so the model samples in a few steps like a flow map and gives an exact change-of-variables likelihood for each one-step sample, with no Tweedie denoising needed.
- Two self-distillation objectives train the maps on an
iTARFlowbackbone:NFM-Ruses MeanFlow-style ℓ2 regression on flow-map consistency (pointwise matching), andNFM-Dminimizes a conditional KL between each pushforward and the forward-process marginals (distributional matching), with proofs that both control the quality of the generated endpoint distribution. - On class-conditional
ImageNet-64,NFM-Rreaches FID 3.60 / FLD 3.15 at 127M parameters, compared with 4.89 / 6.98 for an MLE-trainediTARFlow; onCIFAR-10it improves FID from 6.55 to 3.87, and the fully invertibleNFM-D(6.26) beatsSoftFlow(6.76). - Because the endpoint likelihoods are exact, the models can be post-trained with standard RL (KL-regularized REINFORCE or maximum-entropy objectives) against VLM-based rewards such as
ImageRewardandPickScore, and they gain more reward than best-of-64 and SMC baselines. - As Boltzmann generators,
NFM-Dcuts energy-W2 on the 10-residue peptide Chignolin to 3.42, against 10.82 for theSBGbaseline; in zero-shot transfer to unseen 4- and 8-residue peptides it beatsProseandRobinon five of six metrics while using 118M vs 288M parameters (compared withProse). - Limitations:
NFM-Rgets the best sample quality but tends to become numerically non-invertible, so staying invertible requires noise annealing and FP64 inference, and its invertible variant scores worse (CIFAR FID 5.17); multi-stepNFM-Rsampling gives up exact likelihoods, and diffusion models such asEDM(FID 1.36) still produce better images.
Many Biases, One Circuit: Post-Training Tunes a Pretrained Cue-Routing Mechanism
Language models often drop a correct answer when the prompt hints at a wrong one, and sycophancy and related biases are usually studied separately and blamed on alignment. Causal tracing of attention heads across two post-training pipelines shows that four types of cue rely mostly on the same few heads, a circuit already present in pretrained models. Fine-tuning on about 200 generic assistant examples is enough to activate the circuit in chat format, and the final reinforcement learning (RL) stage strengthens it further. In Tulu-3-8B and OLMo-2-7B, swapping six middle layers' attention patterns between RL checkpoints moves most of the cue effect with them, which points to this circuit as a target for mitigation.
Sycophancy, hints and fake prior answers are usually studied as separate biases that alignment introduces. They all make language models drop correct multiple-choice answers when the prompt contains a cue such as "I think the answer is B." Causal tracing through the stages of public post-training pipelines instead finds that four cue types share one small attention-head circuit, which already exists after pretraining; post-training changes when and how strongly models use it.
- Using activation patching on the
BCTbenchmark, the top eight heads reverse 69–92% of held-out flips pooled over four cue types inLlama-3.1-8B,Qwen-2.5-7BandGemma-2-9B, while random head sets reverse at most 8%; copying the base model's query and output weights for these heads into the aligned model barely changes its caving. - Most base models already follow cues in plain text, and LoRA fine-tuning of the
Llama-3.1-8Bbase on just ~200 generic assistant examples with no cues raises its chat-format caving to the level of the fullTulu-3SFT model, which was trained on 939k examples; even 200 code examples have this effect, so cue-following can be a side effect of assistant tuning. - From the DPO checkpoint to the final RL stage, cue susceptibility rises in 12 of 13 paired tests (11 significant after Bonferroni correction), and swapping attention patterns in six middle layers between the DPO and RL checkpoints of
Tulu-3-8BandOLMo-2-7Bmoves each checkpoint 61–73% of the way to the other's cue effect for suggested-answer cues; in a second, pre-specified wave of controls, every random six-layer swap moved less than 30%. - The query states carry much of this stage difference, and in base models, scaling middle-band attention to the cue raises susceptibility almost monotonically, which suggests the circuit's role predates any assistant tuning.
- The authors list several limitations: the evidence is mostly from English multiple choice with answers read from letter logits, the causal stage tests use one 7–8B pair per pipeline, and several pre-registered criteria were not met; the attention-scaling mitigation also cannot tell correct cues from wrong ones, since in
Gemma-2-2bit removes 75% of the added caving but also 76% of the accuracy gain from correct cues.
Towards Looped Models Done Right, Part I: Topology, Input Injection, Recurrent-State Design
Looped language models reuse the same Transformer blocks across multiple passes, but existing designs bundle several choices together: where the recurrence sits, how the input is re-injected, and how the recurrent state is organized. Training models from scratch at matched parameters, depth, and token budgets, the authors find that a prelude-recurrent-coda "sandwich" helps context extraction and reasoning, input injection mainly helps knowledge retrieval, and separate recurrent states give mixed or negative returns. Together these favor the Huginn-style design, which beats Ouro on all ten benchmarks at 730M parameters and on nearly all benchmarks in an 8B-total, 0.8B-active Mixture-of-Experts (MoE) setting. At matched training and inference FLOPs, the Huginn-style model uses 75% fewer resident parameters than a 112-layer feedforward MoE baseline while matching or beating it on DROP, GSM8K, and MATH500.
Looped language models reuse the same Transformer blocks across logical depth to trade compute for memory, but the two dominant designs, Ouro and Huginn, differ in several choices at once. The authors separate these into three axes (where recurrence sits, how the input is re-injected, and how the recurrent state is organized), then ablate each one in models trained from scratch at matched parameters, logical depth and token budgets.
- The controlled path goes from
Ouro's full-stack loop (28 blocks × 4) toHuginn's sandwich (an 8-layer prelude, a 12-block core looped 8 times, and an 8-layer coda); every variant has 112 logical layers from 28 stored blocks (730M parameters) and is trained on 336B tokens ofTxT360. - Moving recurrence into the prelude–loop–coda sandwich gives the clearest gains, +12.00 on
MATH500and +7.05 onGSM8K; re-injecting the prelude representation at each loop step adds +6.63 onBBH-CoTand +5.49 onHumanEval+, but costs 3.60 points onMATH500. - Random state initialization gives two gains and four losses larger than one point, and a shared-module high/low (H/L) state hierarchy brings no consistent benefit while cutting
MATH500by 7.20; with all choices combined, the fullHuginndesign beatsOuroon all ten dense benchmarks. - In MoE models with 8B resident and 0.8B active parameters trained on 500B tokens,
HuginnbeatsOuroon 8 of 10 benchmarks (+4.70GSM8K, +3.60MATH500) and balances expert load better (load-balancing loss 1.571 vs 1.899), and fixing each loop iteration to the experts chosen in the first iteration lowers accuracy on all six probe tasks. - Against a 112-layer feedforward MoE with matched FLOPs and 4× the resident parameters,
Huginnwins onDROPandGSM8K, ties onMATH500and narrows the mean gap from 4.96 to 1.71 points, though results come from a single scale and seed and the MoE study compares only complete configurations, not individual components.
Tree-Aware Posterior Distillation for Long-Horizon Agentic Reinforcement Learning
Training LLM agents on long interactions with only terminal rewards makes turn-level credit sparse and noisy. Repeated mini-batch updates on a fixed batch of rollouts also let the policy drift away from the policy that collected them. TreeOPSD treats each turn as a tree node, branches alternative continuations from shared prefixes, and backs up terminal rewards into implicit turn-level credit without a learned critic. Each credit is mapped to a closed-form, bounded teacher distribution, and distilling toward it recovers the policy-gradient direction while limiting how far sequential updates can overshoot. The method improves agent benchmarks across model scales, especially on long-horizon tasks, raising Qwen3-30B-A3B-Thinking-2507 by 4.97 points over GRPO on the Deep Research setting.
Long-horizon agentic RL has two problems. A single terminal reward gives every turn the same noisy credit, and later mini-batch updates drift away from the policy that collected the rollouts. TreeOPSD handles both without a critic, process labels, or an external teacher: it branches rollouts from shared prefixes to estimate per-turn credit, then turns that credit into a fixed, bounded target distribution that the policy is distilled toward.
- Each turn is a tree node, and terminal rewards are standardized and propagated up the tree, weighted by likelihood, to give turn-level credit
V_i. EachV_imaps to a Bernoulli teacherq_i = 1/2 + V_i/τ, defined relative to the frozen behavior policy through a length-normalized likelihood ratio, andτis calibrated from group size so every target stays within a fixed radiusρwithout clipping. - A forward-KL distillation loss toward this teacher has exactly the tree policy-gradient direction at the behavior policy. On later mini-batches the update weight shrinks with the remaining student–teacher gap, reaches zero at the target, and flips sign on overshoot, unlike fixed-credit updates such as
TreePO. - On Deep Research (trained on
OpenResearcher, evaluated onBrowseComp-Plus,BrowseComp,GAIAandxbench-DeepSearch),Qwen3-30B-A3B-Thinking-2507averages 21.20, compared with 16.23 forGRPO(+4.97) and 17.59 forTreePO, andBrowseComp-Plusrises from 12.29 to 17.47 overTreePO.Qwen3-4B-Thinking-2507goes from 12.18 (GRPO) to 15.45. - Gains on Multi-Hop QA are much smaller, about +0.8 to +1.1 average points over
GRPO.TreeOPSDalso trails baselines on some individual sets, such as2WikiMultiHopQAat 30B andBamboogleat 4B, and absoluteBrowseCompaccuracy stays low at 3.5–6.4%. - In ablations, a rollout split of 4 initial trajectories with 2 branches each is the best allocation, beating both 8 independent rollouts (11.28 vs 15.45 on Deep Research) and a split heavier on continuations. Results hold up across radius values
ρfrom 0.1 to 0.4, though experiments cover only twoQwen3models.
Language Models Learn to Improve Language Models
Using reinforcement learning (RL) to train LLMs to propose language-model improvements is prohibitively expensive when every proposal needs a real training run, and cheap surrogate rewards drift as the policy exploits overestimated proposals. LM2LM uses a research world model, a frozen LLM that predicts a proposal's gain from real experimental records in context, as the RL reward model. It periodically executes top-ranked current-policy proposals and adds their measured outcomes to the world model's context to keep the reward reliable. Across eight autoregressive and diffusion LM development environments, LM2LM lets Qwen3.8-27B outperform GPT-6-sol on held-out tasks with real execution, even when GPT-6-sol gets 300 real records in context, at 33% lower data-generation cost. It also generalizes to an unseen model family.
Training an LLM with reinforcement learning to propose language-model improvements would normally need a full training run to score each proposal, which costs hundreds of thousands of GPU-hours. LM2LM replaces those runs with a frozen LLM, called a "research world model" (RWM), that reads real experimental records in context and predicts each proposal's gain. To keep these predicted rewards honest as the policy drifts, it periodically executes the policy's top-rated proposals and adds their real outcomes to the model's context.
- The proposer (
Qwen3.8-27B) is trained withDAPOagainst rewards fromGPT-6-solacting as theRWM, and those rewards are normalized per task, clipped, penalized for invalid or repeated proposals, and given a bonus for diverse mechanisms; starting from 100 real records, three on-policy calibration rounds bring the total to 200 real training runs. - On held-out tasks across eight autoregressive and diffusion LM families, with every proposal actually executed,
LM2LMreaches an Avg@4 gain of 17.06 (in 10⁻³ bits per byte) on autoregressive models versus 6.51 forGPT-6-soland 6.15 forGPT-6-solgiven 300 in-context records, and 7.10 versus 4.94 on diffusion models (in 10⁻² nats per token). - It beats in-context learning with 300 records while spending about 33% less on data generation ($40.1k vs. $60.0k), and on the fully held-out
Qwen3family it scores 53.72 Avg@4 versus 21.63 for the strongest baseline. - Calibration is what keeps the reward signal useful: without it, the world model's pairwise ranking accuracy falls from 0.72 to 0.37 (worse than random) by step 128, while the calibrated version holds at 0.61, and calibrating on randomly chosen proposals instead of top-rated ones lowers Avg@4 from 17.06 to 10.84.
- The method is evaluated only on single-proposal improvements to pretraining recipes, not end-to-end research campaigns; it still needs a few hundred real training runs, and on autoregressive tasks it produces more harmful proposals than
GPT-6-solwith in-context records (39.2% vs. 29.6% negative-gain rate).
Execution Before Memory: Diagnosing Memory Failures in Video World Models
Current memory tests for video world models combine several steps into one score, so a model that never carries out a requested scene change looks as if it forgot. MIST separates setting up the scene, carrying out a hidden change, and later revealing it, while controlling for leakage. With this separation, the authors find that models set the scene but fail to execute the instructed change, and the same gap appears in general memory benchmarks. Their M3-Agent repeatedly revises the instruction until the frozen model carries it out, more than tripling the MIST reveal score and raising WRBench and MBench scores by 26.1% and 52.7%.
Memory benchmarks for video world models give a single score, so a low result looks like forgetting even when the model never carried out the requested change at all. MIST scores scene setup, hidden-state leakage and the final reveal separately, and finds that the real bottleneck is execution rather than memory. M3-Agent builds on this by revising the failed instruction at test time on the same frozen generator.
MISTuses three 5-second shots per case: the first sets the scene, the second hides the change behind an opaque gap, and the third asks for the reveal. OnWan TI2V-5Bacross 43 cases, setup scores 0.852 and gap leakage is 0/43, yet 41 of 43 baseline clips never open to show the hidden state.M3-Agentwrites a short task record, has a VLM label the failure it sees in the last frame (for example no action, wrong binding or a missing departure), and rewrites only the failed operation, with no trained memory module. With one kept clip per case, it lifts MIST reveal from 0.147 to 0.492 while setup stays flat.- In an ablation with five tries per arm, the targeted rewrite (0.763 best-of-five reveal) beats naming the answer alone (0.684) and a generic "open and hold" prompt (0.268). With the target withheld, however, the rewrite collapses to 0.174 and leaves 28 of 43 lids closed.
- The same diagnosis carries over to official benchmarks with
Wan T2V-A14B:WRBenchscore T rises 26.1% (0.452 to 0.570), mostly because the camera now completes the departure and return rather than because frames look better.MBench-Tscore U rises 52.7% (0.292 to 0.446), though selection keeps the baseline clip on 23 of 30 items. - The authors limit their own claims: keep-best selection is an oracle that uses the same scorer that reports the results, rewrites can break cases that were already correct, the study covers one main generator family, and judges are not validated against human labels. A shown final state therefore does not prove the model actually stored it.
DLite: History-free Speculative Decoding for Agentic AI
In agentic workloads, long and constantly changing contexts degrade the draft models used for speculative decoding, cutting acceptance length by up to 80%, and maintaining their history cache adds system overhead. DLite drops the draft model's historical context entirely: it reuses hidden states from the target model to make local predictions, and a lightweight sequential head restores causal dependencies within each block. A tailored two-stage training strategy trains the architecture. Across general, long-context and agentic workloads it reaches acceptance lengths of 2 to 6 and outperforms the prior state-of-the-art method DSpark by up to 70%.
Speculative decoding drafters lose up to 80% of their acceptance length on agentic workloads, which have long, growing multi-turn contexts, and maintaining the drafter's own KV cache adds 10–20% to end-to-end latency. DLite keeps no draft history: the drafter reuses the target model's hidden states and only predicts the next few tokens around the current position, leaving long-context modeling to the target model.
- A 5-layer parallel backbone reads 12–14 target-layer hidden states (each tagged with a learnable depth embedding), the current anchor token and K=7 placeholder positions with local position indices, and a low-rank RNN-style sequential head then restores dependencies between tokens in the draft block, working in hidden space so it skips the per-position full-vocabulary projections other semi-autoregressive drafters compute.
- Distilling straight from the target model with KL divergence trains poorly, so training has two stages: a warm-up stage that distills from a same-architecture "history-aware" teacher with access to the KV cache, then a stable stage that aligns directly with the target using cross-entropy plus total-variation loss.
- On agentic benchmarks
DLitegives the largest gains: onSWE-benchit reaches τ ≈ 3.2 and about 2.7× end-to-end speedup onQwen3-4B/Qwen3-8B, against τ ≈ 1.9 and about 1.6× forDSpark. OnLongBench v2it beatsDSparkandDFlashon every subset, and the paper reports up to 70% improvement overDSparkoverall. - On general-purpose benchmarks the margin is small (for example
GSM8Kτ 6.38 vs 6.27 onQwen3-4B), and under high-concurrency serving the throughput edge overDSparkis modest and shrinks as load grows (LiveCodeBenchonQwen3-4B: 3.97× vs 3.74× at concurrency 1, 1.83× vs 1.72× at concurrency 64). - The evaluation covers only two small
Qwen3targets, the agentic benchmarks use 30–180 long prompts each, the training pipeline is heavy (8 teacher epochs, then 2 warm-up and 6 stable epochs on 32 H800s), and design choices were tuned on an 80K-sample subset; an ablation shows sliding-window draft caches of 128 or 512 tokens reach similar acceptance after enough training.
DiscoveryRSI: Recursively Learning to Discover Valuable Hypotheses
DiscoveryRSI grows trees of scientific hypotheses through multi-agent evolutionary search, compiles chosen investigations into executable Harbor tasks, and improves itself through credit assignment, replay of its research workflows, and rediscovery. The authors also introduce DFM-Bench to assess hypothesis quality and cumulative research progress. Across four life-science domains, automated hypothesis quality scores rise from 4.86 to 5.39 after two rounds of self-improvement. DiscoveryRSI-27B's hypotheses match later-published research 6.3% of the time, compared with 2.5% for GPT-6 and 2.3% for Claude Opus 5.
Research agents produce hypotheses but rarely learn from how those hypotheses were developed, because a final assessment doesn't say which agent's contribution earned it. DiscoveryRSI keeps versioned trees of testable hypotheses built by multi-agent evolutionary search, credits assessed quality back to the specific agent histories that contributed, and uses that experience to retrain the model and refine the research harness across rounds.
- A Lead agent coordinates Generation and Evolution agents that evolve, repair, cross over, or restart hypotheses, while blinded Critique and ancestor-aware Progress agents judge each version;
TrueSkillratings then set bounded credit weights for fine-tuningDiscoveryRSI-27Bonly on supported actions (2.12% of 291M tokens), andharness replaytests workflow edits with the model held fixed. - Across four life-science domains (
MIMIC-IV,eICU,UK Biobank,GEO, and others), mean automated hypothesis quality on the newDFM-Benchrises from 4.86 to 5.39 over two rounds, mostly from falsifiability (4.00 to 6.20), alternative explanations, and data resolvability; restarts fall from 21.7% to 5.0% of episodes as agents spend more effort refining existing hypotheses. - In blinded review of 292 proposals by 27 people with biomedical or clinical research backgrounds, 41% of
DiscoveryRSI-27Brevisions improved the human score, a mean gain of +0.07 per revision, compared with +0.03 forGPT-5.6 Soland −0.01 forGPT-6 Luna. - 6.3% of its hypothesis versions match concrete designs or evidence gaps in literature published after the model's cutoff, compared with 2.5% for
GPT-6and 2.3% forClaude Opus 5; however, much of Claude's gap traces to retrieval coverage (11.5% of its proposals passed the retrieval gate versus 30.2% forDiscoveryRSI-27B, with similar match rates among those that passed). - The gains are uneven: automated importance (6.48 to 6.04) and novelty (4.87 to 4.58) decline,
GPT-6 Lunagets higher human ratings on data fit, alternative explanations, and informative results, the automated scores come from a single LLM judge, and no hypothesis has been tested in a wet lab yet.
Applications 63
When is a large language model a good calibration agent? Physics-labeled prompting for budgeted engineering simulator calibration
The study tests whether LLMs, given physics-based descriptions of simulation errors, can calibrate expensive engineering simulators with fewer runs than derivative-free optimizers. The test cases are a cylinder-wake Large-Eddy Simulation and a damped-oscillator inverse problem, with text ablations and baselines such as Nelder-Mead, Bayesian optimization, and CMA-ES. Physics-labeled prompts give a large early advantage, with median error 21.9× lower than physics-free controls after five evaluations, but the advantage is gone by fifteen evaluations and results vary widely between runs. A hybrid that uses the LLM as a warm start and then hands off to a conventional optimizer reaches target accuracy in 9 simulator runs, compared with 12 for the LLM alone, 17 for Nelder-Mead, and more than 60 for Bayesian optimization.
Learning the Shared Latent Structure of Cryo-EM Inverse Problems
Cryogenic electron microscopy (cryo-EM) produces noisy 2D particle images that mix molecular structure, particle pose and imaging conditions. Tasks such as pose estimation, heterogeneity analysis and reconstruction are usually solved separately, even though they share the same underlying structure. The authors introduce EMber, a family of vision transformers pre-trained by self-distillation with global and masked-patch objectives. Training used over 50 million experimental particle images from 214 EMPIAR datasets plus simulated projections of 268,000 molecular assemblies. EMber beats existing methods at conformational and compositional discrimination by 14.85 and 14.26 percentage points, estimates conformational populations within 1.59pp error using a linear probe, and produces particle assignments that reach reference-quality reconstructions in fewer epochs.
Broad and Efficient PII Detection with Unified Labels
Builds a practical detector for personally identifiable information (PII) that needs broad coverage and a low false-positive rate on high-volume traffic. The authors train a 141M-parameter encoder on 1.12 million examples from 77 public datasets, relabeled under one consistent definition of contextual detection across 12 structured PII categories. On the AI4Privacy and Nemotron-PII benchmarks at a low false-positive operating point, it achieves the highest recall against larger baselines in 11 of 14 comparisons, with 2-10x higher throughput and 94-97% less peak GPU memory.
A misinformation playbook sharpens judgement without breeding cynicism
Fact-checking cannot keep up with new claims, and training people to doubt can also make them doubt true claims. The authors propose a defence aimed at recurring persuasion strategies rather than the facts of individual claims, using a playbook mapped from 214,646 fact-checked claims in 51 languages that centres on fear, conspiracy and fabrication. Given the playbook and a reminder that persuasion does not prove falsehood, a language model better separated true claims from machine-generated false claims about events after its training data. In a pre-registered human experiment, the same briefing improved discernment of claims people reported as unfamiliar without lowering belief in true claims, but the gain averaged over all claims was not statistically significant.
Too Emotional to Be Fake? Intra-Utterance Emotion Shifts Expose Failure Modes in Speech Deepfake Detectors
Expressive speech synthesis can now shift emotion within a single utterance, and EmoShift tests how this affects speech deepfake detectors. The benchmark pairs emotion-stable and emotion-changing speech: 7,240 genuine utterances and 9,720 synthetic ones from four expressive text-to-speech systems, with controls for static emotion and acoustic confounds. Across seven detectors, emotion shifts make synthetic speech look more genuine, raising spoof miss rates by up to 25.3 percentage points on OMG-Emotion. They also make genuine emotion-changing speech look fake, raising false alarms by up to 24.4 points on IEMOCAP. These sensitivities are not fully explained by static emotion identity or splicing artifacts.
Recognizing Atari and Assessing Sente: Controlled Evaluation Tasks for Language-Based Go Agents
A controlled evaluation set tests whether language-based Go agents understand domain terms, focusing on atari (a stone that can be captured on the next move) and its link to sente (keeping the initiative). Tests on LoGos, a Go language model fine-tuned with terminology and commentary, show that it struggles to notice when local board changes alter atari relationships and to judge their strategic consequences. Its terminology predictions also drive its move preferences even when those preferences contradict the reference evaluation. The tests offer a framework for checking whether game-playing language models tie their vocabulary to precise board facts.
Same Person, Different Advice: Auditing LLM Financial Advice with Repeated Risk-Tolerance Responses
AI financial advisers often set a client's stock allocation from a single risk-tolerance question, even though people frequently answer it differently when asked again. Seven large language models from five providers gave allocation advice for 800 real household profiles in which only the risk answer changed. Recommended stock share shifted by 10-16 percentage points on average, against 0.6-4.2 points for repeating the same prompt, and discounting the answer for its measured reliability would cut these swings by a factor of 2.4-3.3. In a scripted test, one clarifying question cut the swing from 33.5 points to 1.9 while keeping the response to changes the client confirmed, and the authors argue that same-person retest audits should be a standard check for AI advisers.
EduWild: How Teacher-Configured Chatbots Fail in Real-World Use and How to Fix Them
EduWild is a dataset of 1,726 conversations with 217 educational chatbots that teachers configured with natural-language instructions. Each conversation comes with the bot's configuration, and 900 come from real students using 35 deployed bots. Using a 29-code failure taxonomy applied by a human-calibrated LLM judge, the authors find the most common failures are lapses in following the teacher's intent: bots skip required workflow steps in 53.8% of student conversations and overload learners in 37.1%. A prompt-based harness aimed at the six most frequent failures, tested with 200 college students across ten bots, cuts target failures per conversation by 65.2%.
HardEval: An Execution-Verified Benchmark for AI-Driven Security Hardening and Compliance Remediation
Applying Security Technical Implementation Guide (STIG) controls requires turning natural-language security requirements into exact, persistent operating-system configuration changes, and existing code and agent benchmarks do not test this on live systems. HardEval builds tasks from Red Hat Enterprise Linux 8 STIG controls that fail on an unhardened machine; the model writes a Bash script that runs on a live virtual machine and is graded by hidden OpenSCAP/OVAL compliance checks the model never sees. An evaluation of fourteen frontier and open-weight configurations finds large, uneven capability gaps across security domains. A recurring failure is plausible-looking security code that does not satisfy the exact compliance condition.
Blitz: Accelerating the Diffusion Modules of AlphaFold3 and Boltz-2
Diffusion-based protein structure predictors take about 200 denoising steps to produce an all-atom structure. Blitz distills these models into few-step samplers by combining a geometric noise schedule with multistep consistency training, and adds physical steering and target-free candidate selection at inference to fix remaining geometric defects. Applied to AlphaFold 3 and Boltz-2, it cuts denoising from 200 steps to eight while keeping teacher-level accuracy under a shared evaluation protocol. AF3-Blitz outperforms every few-step baseline evaluated and beats its teacher on several accuracy metrics.
53 more specialized papers
- Property Estimation in Geotechnical Databases Using Labeled Random Finite Sets Changbeom Shim, Youngho Kim, Craig Butterworth
- Deep Learning for Forest Plantation Mapping in Godavari Districts of Andhra Pradesh, India Snehal More, Anuj Karpatne, Valerie A. Thomas et al.
- GPU-Accelerated Robust MA--RIS Pre-Optimization for Communication and Target Illumination Tran Le Dung, Ho Viet Duc Luong
- An Adaptive-Horizon Graph Neural Operator for coupled surrogate morphodynamic modelling Ying Cao, Yifan Yang, Junqiang Xia et al.
- Generative adversarial networks with Monte Carlo dropout uncertainty quantification for structural health monitoring: Fibre Bragg grating data augmentation comparison in Hawk T1A aircraft Alvaro Peiro, Marios Impraimakis
- Learnable Splines for Unstructured Neural Operators Vignesh Gopakumar, Zhuoyuan Wang, Ander Gray et al.
- High prevalence of antagonizing rhetoric in trending topics on Twitter/X Armin Pournaki, Eckehard Olbrich
- Noise-Robust Forced Alignment for Spontaneous Speech Laurin Wagner, Mario Zusag
- Initiating Removal from Operational Symptoms in Federated Vehicular Networks Zihao Ding, Jun Huang, Qiang Duan
- Network-Wide Freeway Speed Nowcasting and Forecasting from Sparse Fixed Sensors with a Probe-Supervised Graph Convolutional Recurrent Network Ran Tu, Zihao Li, Arash Mirzaei
- Alert-List Concordance for Evaluating Imputation Strategies in ICU Sepsis Prediction Priyanka Siddappa, Muntaqim Ahmed Raju, Shifat Haider Al Amin et al.
- Evidence-Gated Bilingual RAG for Reliable Consumer Banking Search Ahmed Mohamed Mahmoud Rayyan, Rana Mahmoud Mohammed, Aya Abdallah Abdelmonem et al.
- Secondhand Stress: How Stressful Disclosures Affect Psychosocial Wellbeing in Online Graduate Admissions Communities Veda Duddu, Agam Goyal, Sabelle Huang et al.
- Data Provenance Aggregation and Structural Descriptors for Query-Template Identification Paulo Pintor, Rog\'erio Costa, Jos\'e Moreira
- OrderFlowDiT: Transport-Regularized Diffusion Transformer for Probabilistic Limit-Order Supply Forecasting Jung Hun Phee, Tucker Balch
- Thunder-DeID+: Boundary-Aware Korean De-identification from Court Judgments to Broader Sensitive Documents Gyuseong Lee, Gyeongje Cho, Jongmin Kim et al.
- Reading the News Without Hindsight: NoLBERT Topics and the Cross-Section of Stock Returns Kevin Foley, Jonathan Hartadi, Shivesh Prakash et al.
- Reasoning Reranking with Semantic IDs as the Sole Item Representation Zhenwei Tang, Jintao Liu, Di Bai et al.
- NLData2Opt: Benchmarking Parameter Derivation and Prediction for Modeling Optimization Problems from Natural Language and Data Lijia Liu, Kyohei Atarashi, Jiyi Li et al.
- Bengali Hallucination Detection with Retrieval and Programs: A System Study Shamim Hasan, Samiya Ahmed Chowdhury
- ASR-Style Transcript Normalization Removes Useful Pragmatic Signal for Dialogue Act Classification Lucky Onyekwelu-Udoka, Md Shafiqul Islam
- Towards a GraphNARX model for structural dynamics George Tsialiamanis, Keith Worden
- Can AI interview? Comparing AI-led to Human-led Chat Interviews Semra Guven, Tobias G{\aa}rdhus, Andreas Bjerre-Nielsen et al.
- Cross-Centaur: Modeling Individual Decision-Making Across Psychological Tasks with Language Models Hikaru Asano, Hidezo Suganuma, Ryutaro Mori et al.
- Do Speech BCIs Need Larger Models? Rethinking Neural Decoding beyond Scaling Zehui Feng, Weichuan Wang, Xiaohan Chen et al.
- LangNCO: Compiling Natural-Language Constraints into Inference-Time Interventions for Neural Combinatorial Optimization Hironori Ohigashi
- MAS-Bai: Linguistically Informed Adaptive Multi-Agent Translation for Bowen-Script Bai Jingting Zheng (TJUNLP Lab, School of Computer Science and Technology, Tianjin University et al.
- ADT: All-Atom Diffusion Tokenizer for 3D Molecular Structures Xuantuo Huang, Encheng Su, Aoran Wang et al.
- Learning angles for quantum approximate optimization Johannes Jakubik, Isabelle Wittmann, Zaheed Gaffoor et al.
- How the elastic axis folds the transonic flutter boundary: shock energy transfer and conformally calibrated active learning Ashray Saxena, Sharad Shrivastava
- Untrained CNN and coefficient-space regularization for joint reconstruction in photoacoustic tomography Alfio Bozi, Anwesa Dey, Souvik Roy
- HiPredict: Predicting the missing HiRISE RED4 spectral channel with machine learning Ardan Suphi, Ben Moseley, Gareth S Collins et al.
- Data-Driven Prediction of Optimal MPI Rank Placement and Node Count for Memory-Bound CFD on AMD EPYC Clusters Marcin Lawenda, {\L}ukasz Szustak, Aleksandra Krasicka
- Forecasting Voltage Time Series under Anomalies Using a WGAN Model With Lipschitz Control and Progressive Kernel Critic Strategy Najmieh Sadat Safarabadi
- Predictable Scaling: Efficient Model Exploration via Scaling-Law Prediction Aishwarya Wesanekar, Sheng-Tao Yang, Jiawei Zhang et al.
- Graphlet-based Decentralized Finance Transaction Method Classification C\'{e}lestin Coquid\'{e}, Alessio Brini, Natkamon Tovanich
- QD-Rec: Open-Ended Evolution of Recommendations via Quality-Diversity Takashi Ishida, Taro Makino, Issa Sugiura
- Uncertainty-aware AI-enabled framework for predicting hydrogen dispersion in confined spaces to enhance operator situational awareness Niclas Flehmig, Mary Ann Lundteigen, Shen Yin
- Interpreting SSL Representations for Spoof Detection: a WavLM Study Mohamed Mallat, Michele Panariello, Massimiliano Todisco et al.
- Beyond Latent Personalization: Integrating HRV-Conditioned Personalization via LLM for Interpretable Stress Detection Wei-Hsiang Ma, Ya-Tse Wu, Hsing-Hang Chou et al.
- When Magnitude Suffices: Reconstructing Time-Domain-Gated Microwave Signals Without Phase on a Thoracic Phantom Maciej Cicho\'n, Patrycja Go\l{}a\'s, Maksymilian Bartosik et al.
- ThetreStageAI: Multi-View Retrieval-Augmented Generation for Structured Bengali Theatre Production Planning Md. Mehedi Hasan Naeem, Mst. Kamrunnahar Ruma, Shakila Sultana et al.
- GRAFT-EEG: Gauge-Aware Physical Field Transport for Cross-Dataset Motor-Imagery EEG Ying Zhou, Mengting Liu
- Scalable long-range machine learning interatomic potentials with electrical response for atomistic material modeling Yicheng Chen, Xiaoyun Yu, Hyejeong Song et al.
- An Efficient Approach to Beetle Damage Detection of Banana Using Deep Learning Md. Mehedi Hasan Naeem, Ishtiyak Ahmmad Araf, Md. Arefin Haque Mahir et al.
- TriRouter: Sparse-to-Dense Electrode-Space Routing for Robust EEG Motor Imagery Decoding Ying Zhou, Yaoxin, Mengting Liu
- Recognizing Study Lineage Is Not Enough: Over-Crediting Same-Trial Evidence in LLM-Based Medical Verification Mukand Krishna, Anoushka Harit, Chenghao Xiao et al.
- ECG-SDI: Single-lead Electrocardiogram Enables Continuous Sleep Depth Index Profiling and Scalable Digital Biomarkers for Sleep Health Donglin Xie, Qingshuo Zhao, Songchi Zhou et al.
- Bridging the Language Gap in Scholarly Data II: Enhancing Gender Inference for Chinese Names Lisette Esp\'in-Noboa, Mingrong She, Ana Maria Jaramillo et al.
- The Italian lawmaking process: a unified and structured dataset Matilde Contestabile, Chiara Ferrara, Giovanni Parrillo et al.
- Explainable Machine Learning Analysis of Temperature Effects on Mechanical Strength of Fiber-Reinforced High-Performance Concrete Jagaran Chakma, Zhiguang Zhou, Badhan Chakma et al.
- CocoRNA: Collective RNA Design with Cooperative Multi-agent Reinforcement Learning Tianmeng Hu, Biao Luo, Ke Li
- Quality-of-Transmission Estimation in Quantum Networks: Compute, Simulate, or Learn? Anis Bekri, Amar Abane, Van Sy Mai et al.
Large Language Models 54
Embeddings Are Overpriced? A Frozen 16 MB Vocabulary for Small and Ternary Language Models
In small language models the embedding table is the largest component, holding 168M of the 268M parameters in Gemma 3 270M, and it usually stays in 16-bit precision after quantization. The authors replace it with a frozen 16 MB table of 512-bit binary codes, derived from a pretrained embedding by principal-component projection and sign binarization, and train the same model body from scratch with and without it. The frozen-table model ties or beats the learned table on LAMBADA, HellaSwag, and PIQA, generalizes much better to rare and newly added words, and with a ternary BitNet b1.58 body becomes a 46 MB model that generates 615–740 tokens per second on a laptop CPU in 62 MB of memory. That is five to six times faster than the float model's 8-bit GGUF in llama.cpp.
Rank Measures of Fine-Tuning Updates Need a Noise Baseline
Researchers often describe what fine-tuning does to a language model by the rank of the weight update, and this work checks those rank measures against a random matrix of the same shape, the pretrained weights, and matched fine-tunes trained without alignment content. Measures that count directions put fine-tuning updates only slightly below noise, while stable rank puts them far below it, because an update has a few strong directions on top of a long tail. The pattern holds across thirteen released model pairs up to 8B parameters and does not depend on alignment: instruction data looks no different from Wikipedia or code, DPO gives the same update with real or half-randomized preference labels, and scrambled text produces the most concentrated update of all. Applying these baselines to a recent claim that post-training is superficial shows that a random update of the same size barely changes effective rank while wrecking the model.
Where Prefill Expert Reduction Hurts MoE Models: A Few Prompt Tokens Carry Most of the Short-Answer F1 Loss
Routing prompt tokens through fewer experts during prefill is a simple way to make mixture-of-experts (MoE) serving cheaper, and this study uses token-, layer- and attention-level interventions across four MoE families to find out what that harms on short-answer question answering. At half the experts, most of the F1 loss in three families comes from answer format: the model still finds the answer but stops answering briefly. The damage is concentrated in a few positions, such as the two chat-template tokens right before the answer in Qwen3-30B-A3B and the instruction tokens at the start of the prompt in DeepSeek-V2-Lite. Keeping about 4% of tokens at full experts, placed on the task interface, keeps F1 within one point of the unmodified model, while time to first token drops about 14% on 11K-token prompts.
Learning User Representations to Improve Simulation Fidelity
User simulators let AI assistants be trained and evaluated interactively at scale, but they struggle to reproduce how diverse real users behave. The authors point to the natural-language user description that conditions the simulator as a key bottleneck, and they measure its quality through conversation reconstruction: generate a description from a real conversation, simulate a new conversation from it, and compare user behavior. Their hindsight distillation method trains the description generator on feedback about where its descriptions fell short, producing UserRepGen-4B. Across 700 conversations from seven datasets, UserRepGen-4B yields more faithful simulations than descriptions written by GPT-5.5, and the learned descriptions also transfer to unseen tasks and better preserve population-level diversity.
On the SPOT: Enhancing Speculative Decoding for Diffusion Language Models via Commit-Order Prediction
Diffusion language models (DLMs) can in principle generate text in parallel, but exact decoding fills only one masked position per pass, and faster multi-token schemes lose quality. Standard speculative decoding does not carry over directly because a DLM has to choose where to generate as well as what. The authors observe that the previous pass already predicts the right token at 92-100% of positions; what is missing is the order in which positions get filled. SPOT (Speculating Positions Order Trajectory) trains a 0.62M-parameter drafter to predict that order and propose a tree of candidates, which the target verifies in a single pass using coupled-noise matching so that it works at any temperature. It cuts target passes by up to 6.8x and reaches up to 3.2x the throughput of standard decoding, and the drafter transfers across six different DLMs.
SAG2: Embedding-Free Multi-Hop Retrieval with BM25 and JEV
Multi-hop retrieval systems usually need precomputed embeddings, LLM-based extraction and dedicated database servers. SAG2 instead runs on a single SQLite database with BM25 lexical search, using JEV at query time to decide which passages count as evidence; terms from the selected passages drive further retrieval rounds. On 1,000-question subsets of MuSiQue, 2WikiMultiHopQA and HotpotQA, it achieves the highest Recall@5 and Recall@10 among the compared methods, with Recall@10 of 86.62%, 97.43% and 99.00%. Indexing all of MuSiQue takes 2.36 seconds, produces a 25.87 MiB database, and requires no model calls.
When Does Uncertainty Measure RAG Hallucination Risk?
Asks when a model's own uncertainty is a reliable signal of hallucination in retrieval-augmented generation (RAG), and argues it works only when the retrieved evidence actually constrains the answer. Across four instruction-tuned models on HotpotQA and SQuAD, length-matched controls bring length-only classifiers near chance, while perplexity reaches 0.81-0.91 AUROC on targeted unsupported edits. Varying retrieval depth shows detection can weaken with only the top passage and recover once a second passage is added. Combining uncertainty with a semantic-drift score improves calibration, and the signal stays above chance on RAGTruth.
Measuring Mechanistic Uncertainty in Large Language Models via Causal Robustness
Proposes mechanistic uncertainty, which measures an LLM's uncertainty through how stable the internal mechanisms behind its answer are. The causal robustness margin is defined as the smallest internal intervention, using Jacobian Lens (Jlens) concept steering vectors, needed to change the output. Across three open models and five question-answering datasets, incorrect and uncertain answers have smaller margins, and the signal complements output-based uncertainty methods. In a controlled knowledge-injection experiment, margins grow for facts the model has learned correctly.
The Ephemeral Cost of Switching Optimizers Across LLM Training Stages
Tests whether switching optimizers between pretraining and later training stages carries a real penalty, by pretraining 1.2B Llama-3 models with varying mixes of AdamW and Muon updates and interpolating between the two during continued pretraining and supervised fine-tuning (SFT). The authors find little evidence of an optimizer mismatch penalty: final performance is largely explained by the separate effects of each stage's optimizer, and downstream results generally improve as the share of Muon updates during SFT increases. Matching the pretraining optimizer reduces forgetting but does not improve benchmark scores, and Muon stays competitive for SFT of AdamW-pretrained Llama and Qwen models up to 14B parameters.
Edit Discovery in Human-AI Interactions
Some logged human-AI interactions contain failures that would make useful supervision if a costly "editor" (a human expert, a stronger model, or the same model with more compute or tools) corrected them, so the problem is deciding which interactions to send for review before knowing whether an edit is needed. The authors formalize this as Edit Discovery Optimization (EDO) and show that the population-optimal policy is a cost-adjusted threshold on the posterior probability of an edit. They then propose EDIT (Edit Discovery via Iterative Thresholding), an online algorithm for the partial-feedback setting that satisfies the editor budget at every round and controls the confirmation rate without distributional assumptions. On four reasoning and factual QA benchmarks, EDIT trades off cost and Type-I and Type-II errors better than direct LLM-based batch selection.
Chance-Constrained Personalized LLM Routing with Online Preference Learning
The paper addresses personalized LLM routing, where a router chooses among models with different costs and capabilities and must keep response quality reliable while learning unknown user preferences from feedback during deployment. It frames the problem as a constrained contextual bandit and gives an algorithm that learns preferences while balancing cost against quality. Under a logistic preference model and a strict-feasibility condition, the authors prove sublinear expected cost regret against an optimal stationary randomized oracle, together with a high-probability guarantee on cumulative user satisfaction. The framework also applies to other online model-selection problems with reliability requirements.
First Passage Attention
Forget-gated attention mechanisms sum decay along the path between key and query, and because that sum only grows, they cannot erase intermediate context while keeping older tokens that still matter. First Passage Attention (FPA) instead penalizes a key's logit by the deepest dip of a learned scalar field below that key's level over the intervening span; it contains the Forgetting Transformer (FoX) as a special case and can naturally keep a stack of alive keys. The authors prove that a constant-dimension FPA head can represent any such set of alive keys, whereas softmax heads with positional biases or token-level forget gates need head dimension linear in the number of keys. In a 110M-parameter language model, FPA matches FoX in perplexity and is the only model to reach perfect passkey retrieval at 8× the training length, even with its key-value cache compressed to about 25%.
Next Token or Vector? Learning How Far to Decode
Standard autoregressive decoding produces one token at a time even when several upcoming tokens are predictable together. CADENCE (Context-Adaptive DEcoding) uses Gaussian prediction heads to represent future spans as continuous latent vectors, which a shared decoder turns into tokens in parallel, and a learned router chooses how far ahead to draft from the model's hidden states. The backbone model verifies each draft and keeps the prefix that matches its greedy predictions, with single-token generation as a fallback. With Llama-3.1-8B-Instruct on Alpaca, GSM8K and HumanEval, router-chosen draft lengths are accepted more often than a fixed length, giving up to 1.3x higher throughput than greedy decoding.
Ori: Drift-Aware Streaming $k$-PCA for Very Low-Rank LLM Training
Low-rank LLM optimizers in the GaLore family project gradients into a low-dimensional subspace, but they usually recompute that subspace only at intervals or adjust to its movement after the fact. The authors observe that LLM gradient subspaces drift slowly and steadily over training, and propose Ori, which tracks the shifting principal directions at every step using a cheap streaming k-PCA algorithm inspired by Oja++. On 1B-parameter LLaMA pretraining, Ori closes up to 69.3% of the gap between state-of-the-art low-rank optimizers and full-rank training. It also achieves the best result in 10 of 16 RoBERTa-Base fine-tuning scenarios.
On the Position Bias of Large Language Models: A Comprehensive Study
Position bias means a model's answer depends on where options or documents appear in the prompt. It undermines multiple-choice evaluation and retrieval-augmented generation, but most studies have tested few models and mostly English. This study measures position bias in models from billions to trillions of parameters, on multiple-choice and multi-document tasks in five languages. The bias is still noticeable in small models and in non-English languages. Larger scale and standard Chain-of-Thought prompting reduce it substantially, and thinking models with extended reasoning are nearly immune to it, though that fix is expensive.
Causal Edit Serialization
Autoregressive language models can only append text, so revising earlier tokens has no native representation. Causal Edit Serialization (CES) expresses edits inside the same causal token stream using special pointer tokens paired with predicted source addresses. These support insertion, deletion, replacement, copying, and moving text, and rely on a lightweight localization head and dual-index rotary position encoding. Pretraining mixes ordinary language modeling with serialized repairs derived from corruptions and model-generated edits. CES models complete applied edits at only modestly higher clean-text bits per byte than standard models, and a grammatical-error-correction proof of concept with supervised and RL post-training makes more beneficial than harmful changes.
ToPA: Block-wise Toeplitz Adaptation for Expressive and Efficient Fine-Tuning
Parameter-efficient fine-tuning (PEFT) methods based on low-rank or sparse updates often underperform full fine-tuning, because they restrict either the rank or the connectivity of the weight update. ToPA instead parameterizes updates as products of block-wise Toeplitz matrices, which have constant diagonals, giving a compact form with no explicit rank or sparsity limit. Block-wise structure gives each factor more capacity and shortens the multiplicative chain, which avoids the gradient instability seen with plain Toeplitz products. The authors prove these products can approximate arbitrary matrices with shorter chains and are more expressive than low-rank and sparse parameterizations. Experiments on 21 NLP and computer vision datasets across 5 architectures support the method.
Where's the Indirect Evidence? Investigating Grammatical Generalization with Influence Functions
Language models learn grammatical rules that their training data never shows directly, so the work searches bottom-up for the indirect evidence that drives this learning. The authors use influence functions to score how much each training sentence affects predictions on 15 grammatical phenomena from the BLiMP benchmark. They filter out direct evidence with hand-written rules and treat the 60,000 most influential remaining sentences as indirect evidence. Retraining without these sentences lowers held-out accuracy by a median of 12 points more than removing a matched random set, across five models. These sentences partially match the structure of direct evidence far more often than chance, and grouping phenomena by shared indirect evidence recovers several of BLiMP's linguistic categories.
Prism Attention: Proposal-Refined Index Sharing Mechanism for Efficient LLMs Inference
Sparse attention speeds up long-context decoding by attending only to the most relevant cached tokens, but recomputing which tokens to select at every layer erodes the savings, and reusing one selection across layers loses accuracy. The authors observe that the most-attended tokens stay largely stable from layer to layer, with changes concentrated near the edges of previously selected regions. Prism Attention therefore reuses a coarse token selection across layers as a proposal and refines it per layer. It achieves state-of-the-art accuracy among mainstream sparse attention methods on reasoning and long-context benchmarks, with a 3.4x end-to-end decoding speedup over FlashAttention at 128K context.
Controlling the Diversity-Quality Trade-Off of LLMs by Merging Models Before and After Alignment
Base large language models (LLMs) produce more diverse outputs while aligned models produce higher-quality ones, and existing fixes either require fine-tuning or, like temperature sampling, mainly increase surface-level lexical diversity. The authors propose a training-free, depth-aware FrankenMerging approach that stacks the lower layers of an aligned model under the higher layers of its base model, on the hypothesis that lower layers govern lexical diversity and higher layers govern semantic diversity. Changing the split point tunes the trade-off, and the merged models usually show higher semantic diversity than the aligned model and a better diversity-quality trade-off than temperature sampling in most settings. An ablation that reverses the merge order gave results largely consistent with the hypothesis.
Towards Looped Models Done Right, Part I: Topology, Input Injection, Recurrent-State Design
Looped language models reuse the same Transformer blocks across multiple passes, but existing designs bundle several choices together: where the recurrence sits, how the input is re-injected, and how the recurrent state is organized. Training models from scratch at matched parameters, depth, and token budgets, the authors find that a prelude-recurrent-coda "sandwich" helps context extraction and reasoning, input injection mainly helps knowledge retrieval, and separate recurrent states give mixed or negative returns. Together these favor the Huginn-style design, which beats Ouro on all ten benchmarks at 730M parameters and on nearly all benchmarks in an 8B-total, 0.8B-active Mixture-of-Experts (MoE) setting. At matched training and inference FLOPs, the Huginn-style model uses 75% fewer resident parameters than a 112-layer feedforward MoE baseline while matching or beating it on DROP, GSM8K, and MATH500.
GR-OPD: Group-Relative Sequence Credit for On-Policy Distillation
On-policy distillation (OPD) gives token-level teacher feedback, but standard updates credit each sampled token in isolation and ignore how earlier tokens affect later feedback. GR-OPD (Group-Relative On-Policy Distillation) aggregates token feedback into sequence-level credit, which the authors show is an unbiased gradient estimate of the sequence-level reverse-KL objective under ideal on-policy assumptions. In practice it discounts later, less reliable feedback and calibrates against groups of rollouts from the same prompt, keeping a controlled fraction of the group mean that the authors call "collective teacher pressure." Across five Qwen3 teacher-student pairs and six math benchmarks it beats vanilla OPD in every setting, by up to 11.5 percentage points, and stays stable when teacher and student think in different patterns, a case where vanilla OPD collapses.
LED: Improving Masked Diffusion Language Models by Lookahead Editing
Diffusion large language models (dLLMs) generate text in parallel, but they come in two families with a trade-off. Masked diffusion models (MDMs) are easy to optimize but less expressive, while uniform diffusion models (UDMs) can revise earlier choices but are much harder to train. Lookahead Editing (LED) keeps the simple MDM mask schedule but adds a rewritable proposal state, which the model refines through several lookahead updates before committing tokens. Fine-tuning Qwen2.5-7B and Qwen3-8B with this method gives average gains of +11.4 and +7.7 points over standard MDM fine-tuning across eight benchmarks, and LED-8B beats LLaDA2.1-16B, which was trained with continued pre-training and reinforcement learning, using supervised fine-tuning alone.
Local proxies for memory-efficient training
Standard backpropagation needs a lot of memory because it stores every activation until gradients flow back, and local learning methods that avoid this usually lose accuracy. In proxy propagation, each transformer block gets a small local proxy network that is distilled to predict the global network output, so gradients can pass through the proxy instead of the full network. The method is exact for deep linear networks, and its gradient error is bounded for residual models with a suitable residual proxy. It achieves a better accuracy/memory trade-off than other local algorithms on vision transformers trained on CIFAR-100, and when fine-tuning LLMs on a small memory budget it trains faster and scores higher than zeroth-order methods with comparable memory use.
A Stronger Teacher Within: Strengthening MoE Models via On-Policy Bidirectional Distillation
Reinforcement learning with verifiable rewards (RLVR) gives mixture-of-experts (MoE) LLMs only sparse feedback, while on-policy distillation gives dense feedback but needs a stronger teacher model. MoEvolve builds that teacher from the model itself by activating more experts per token, first recovering and strengthening this expanded configuration and then distilling it back into the original, cheaper configuration. Across several MoE models and benchmarks, it improves the starting models by up to 22.2 domain-average points and beats RLVR baselines with the same compute budget by up to 6.5 points. The final models often surpass the expanded teachers they were distilled from.
ReLaDrift: Recurrent Language Generation via Drifting for Test-Time Scaling
Drifting Models generate text in a single function evaluation, which makes them fast, but they cannot refine their output iteratively. ReLaDrift reuses one shared Drifting Model to draft from noise and then refine the draft in a continuous latent space over several rounds. During training it applies the drifting loss only at the final round and stops gradients through the earlier rounds, so only one round needs backpropagation. This lets it trade test-time compute for quality, as diffusion and flow language models do, and it matches or beats those approaches on Sudoku Hard and GSM8K across a range of inference budgets.
Characterising and Analysing Retrieval-Augmented Generation Techniques
Many Retrieval-Augmented Generation (RAG) techniques have been proposed, which makes it hard to pick the right one for a given problem. Drawing on a qualitative analysis of attributes reported in the literature, the authors propose a conceptual framework of dimensions and sub-dimensions for characterising what a RAG technique is and analysing how well it performs. The framework is meant as a pre-empirical filter that narrows down RAG candidates before expensive benchmarking.
Who Pays for Efficient Inference? Confidence-Based Small-to-Large LLM Routing Across Tasks and Languages
Small-to-large routing saves inference cost by escalating only hard inputs to a larger model, but it is unclear how reliable confidence is as a routing signal across languages and tasks. A systematic study covers 72 configurations spanning three model families, four languages, and three task types, totalling 42,288 predictions. Confidence routing helps on Belebele and SIB-200, beating random routing by up to 5.63 points at 50% escalation, but on MMLU-ProX-Lite it is no better than random because small models stay confident while wrong. Global confidence routing also creates language escalation gaps of up to 30.33 points, which equal-quota routing removes at little accuracy cost.
SimOPD: Relational Knowledge Transfer for On-Policy Distillation
In on-policy distillation, supervising the student only with teacher token probabilities may waste the teacher's internal knowledge. Directly matching hidden states, on the other hand, forces the student into the teacher's feature space and complicates transfer across architectures. SimOPD, inspired by contrastive learning, transfers relational knowledge instead: it builds paired memory banks of student-generated responses, extracts similarity distributions from the teacher's internal representations, and has the student match them within its own representation space. This removes the need for any cross-model projection and improves the overall average over the strongest baselines by up to 2.6 and 3.1 percentage points in same- and cross-architecture settings.
Self-Reflective Chain-of-Thought (SRCoT): Evidence-Based Text Generation via a Closed-Loop Retrieve--Reflect--Revise Pipeline on Edge LLMs
Self-Reflective Chain-of-Thought (SRCoT) is a modular architecture that runs LLM generation as a closed Retrieve-Reflect-Revise loop, so that outputs stay tied to sources and local constraints. It keeps environment state, persistent knowledge, accumulated experience and short-term memory in separate provenance-labelled stores, uses BM25 retrieval, and exposes drafts, missing-information markers and follow-up queries to drive revision, clarification or abstention. Qualitative trace-based case studies in synthetic emergency-medical and emergency-operations settings run locally on an Apple M4-family laptop. The authors explicitly claim inspectability and local execution, not hallucination reduction or safety, and the traces still show provenance errors and unsafe assumptions.
On the Tip of the Tongue: First-Token Cueing as a Behavioral Probe of Recall Failures in LLMs
Closed-book factual errors in large language models are usually blamed on missing knowledge, but many turn out to be first-token recall failures, where the model commits to a wrong first token yet can complete and recognize the right answer once it is given that token. The authors probe this with First-Token Cueing, which prefills the response with the first token of the gold answer. Across 16 open models, this single token corrects between a fifth and a half of errors on multi-token answers in English QA and improves accuracy in all seven languages of a multilingual benchmark. Model uncertainty peaks at the first answer token, and most corrected errors are also solved by the model's own sampled reasoning, which suggests the knowledge is encoded and inference-time methods could recover it.
ScoutRoute: Efficient Mixture-of-Experts Routing Using Internal Language Model Signals
Routing queries among independently trained large language models usually relies on jointly trained gates, prompt-based predictors or expensive multi-model inference. ScoutRoute runs one forward pass of a cheap scout model, uses lightweight logistic probes on its hidden states to predict which expert model is competent, and adds logit-based confidence in a domain-aware routing strategy, without modifying any of the models. Evaluated with five open-weight models on math, code generation, commonsense and multidisciplinary knowledge benchmarks, it consistently outperforms individual routing signals while requiring only a single scout inference, and its probes are better calibrated than conventional confidence measures.
HydraLLM: Adaptive Width Slicing for Elastic Text and Vision-Language Models
LLMs and large vision-language models (LVLMs) have fixed sizes, so one model cannot easily serve both data-center GPUs and edge devices. HydraLLM is an elastic multi-query attention (MQA) architecture in which the number of active attention heads sets the width of embeddings, projections, feed-forward layers and output head, creating nested subnetworks within one set of weights. It is converted from a pretrained checkpoint through importance-based weight reordering and stochastic subnetwork training with distillation, and it extends to multimodal models through an elastic projection module. With 75% of heads active it beats a larger nested baseline by 2.2 points on TriviaQA, and with 25% active it raises token-generation throughput by 75.3%.
Truth in Contrast: Calibrated Factual Evidence from Language Model Likelihoods
The authors study how to score an LLM's confidence that a factual claim is true, judging scores by both discrimination (separating true from false claims) and calibration, across many languages. Their Contrastive Factual Evidence (CFE) compares a claim's likelihood under competing factual and non-factual conditions, and its probabilistic form, the Contrastive Factual Posterior (CFP), is shown analytically to cancel errors shared by the two conditions. Empirically, CFP substantially improves calibration while matching the best competitor's discrimination. Discrimination remains weak in lower-resource languages for every method. To address this, they align target-language claims with English evidence along a single factual direction, which improves discrimination and open-ended factual generation without target-language labels.
Trajectory-Triggered Sparse Collaborative Decoding
Sparse collaborative decoding lets a small draft model generate most of the tokens and calls a larger target model only for short corrective segments, unlike speculative decoding, which verifies tokens continually. The hard part is deciding when to call the target. Local uncertainty signals such as entropy and logit margin predict draft failures at near chance (AUC 0.50 to 0.53), while features describing the shape of the draft's confidence trajectory reach an AUC of 0.86 with a simple logistic predictor. Used online, this trigger beats the best fixed schedule by 5.3 to 20.0 accuracy points on GSM8K and by 5.0 to 8.3 points on StrategyQA. Results on MATH-500 are mixed and depend on how early failures can be predicted and on how capable the target model is.
VISTA: Steering LLMs with Latent User Values Inferred from a Few Survey Answers
Personalizing a language model requires knowing what a user values, but most methods either learn task-specific preferences or put the user profile in the prompt, where models struggle to act on it. VISTA (Value-Informed Steering and Targeted Acquisition) infers a latent value profile from full or partial survey answers and uses a hypernetwork to turn it into a user-specific steering intervention on a frozen LLM. It matches or beats in-context profiles on Food2D, the World Values Survey (WVS) and PrimeX without adding prompt tokens. It also picks which survey questions to ask: on WVS it stops after 6% of the questionnaire while keeping 94% of the full-history gain, compared with at most 42% for standard adaptive testing.
DLite: History-free Speculative Decoding for Agentic AI
In agentic workloads, long and constantly changing contexts degrade the draft models used for speculative decoding, cutting acceptance length by up to 80%, and maintaining their history cache adds system overhead. DLite drops the draft model's historical context entirely: it reuses hidden states from the target model to make local predictions, and a lightweight sequential head restores causal dependencies within each block. A tailored two-stage training strategy trains the architecture. Across general, long-context and agentic workloads it reaches acceptance lengths of 2 to 6 and outperforms the prior state-of-the-art method DSpark by up to 70%.
Steering beyond Language: Improving Multilingual Training-Free Text Embeddings via Paired-Residual Subspace Removal
Presents what the authors call the first systematic study of multilingual text embeddings taken directly from frozen LLMs without training. They find that semantically equivalent sentences in different languages stay misaligned in the embedding space. To fix this, Paired-Residual Subspace Removal (PRSR) builds residuals from parallel sentences, estimates low-rank language-specific subspaces at each layer, and removes those components from the last-token hidden states at inference time. Across more than 200 evaluations in 18 languages on MTEB and MMTEB, plus bitext mining between English and over 200 languages, PRSR consistently improves existing training-free baselines on several LLMs.
Acceptance Is Not Speed: Length Inflation in Training-Free Lossy Speculative Decoding
Lossy speculative decoding accepts draft tokens that standard lossless verification would reject, so its speedup is usually reported as tokens accepted per round. Testing existing training-free relaxed verification rules on twelve target-drafter pairs, the authors identify a length inflation effect: at the most relaxed settings, acceptance rises 1.34× but completions become 1.54× longer, mostly because reasoning traces get extended. Rules that cut verifier rounds tend to lose substantial accuracy. The authors conclude that completion length and verifier rounds must be reported alongside acceptance length to measure real efficiency.
15 more specialized papers
- Trust but Verify: Designing Region-Inhomogeneous Forward Dynamics for Discrete Diffusion Gunmay Jhingran
- Binding-Specific Relearning Savings for Test-Time Continual Learning Zhe Zhou
- From Parallels to Divergence: Language Models' Learning of Action Nominal Constructions Iskar Deng, Shane Steinert-Threlkeld
- alkhder at AlexandriaX-2026: Context-Aware English-to-Dialectal Arabic Dialogue Translation with QLoRA-Fine-Tuned NileChat-3B Hasan Alkhder, Maher Pasa, Maria Hanini et al.
- Pearl-Chat: Engineering a native Luganda language model from first principles in JAX and Flax NNX Wesley Kambale, Roland Sankara
- HeRE: A Novel Benchmark for Hebrew Relation Extraction via LLM-Guided Denoising of Knowledge Graph Alignments Ron Keinan, Amir David Nissan Cohen, Reut Tsarfaty
- ToMStories: Interpreting Theory-of-Mind in Synthetic Narratives Melanie Subbiah, Chia-En Jacklyn Tsai, Kathleen McKeown
- Reusing Calibration Gains across Model Representations Xu Cao, Wenxuan Xiao
- Causal Latent Workspaces for Looped Transformers Ilia Zaznov
- FederatedBytes: Tokenizer-Free, Byte-Level Small Language Models for Efficient Multimodal Federated Learning Ali Sarabadani, Massimo Piccardi, Mehran Abolhasan et al.
- Beyond Surface Cues: Robust LLM-Generated Korean Text Detection SungHo Kim, SangKeun Lee
- Chinese Decision: A Family of Language Models for Single-Pass Probabilistic Decision-Making Qiang Yan (Institute of Computing Technology, Chinese Academy of Sciences)
- Inferring L1 Backgrounds from L2 English with LLM Token Probabilities Ahmet Yavuz Uluslu, Mark Gales, Kate Knill et al.
- PresenceBench: An Exploratory Evaluation of Large Language Model Adaptation to User State Pe\~na Arroyo Gallego, Mauro Ruiz Moreno, Alejandro Acien et al.
- The Cognitive Cost of LLM Writing: A Reading-Time Comparison with Human Text Kamer Cekini, Elisabetta Biondi, Chiara Boldrini et al.
Theory 48
Flat Loss, Evolving Features: Grokking in Modular Addition
Studies whether a network can keep learning while its training cross-entropy stays nearly flat at a positive level, using modular addition as a testbed for grokking (delayed generalization long after the training data is fit). ReLU networks trained with supported-Polar hidden updates, normalized output-layer updates and weight decay keep 100% training accuracy while their hidden features change and held-out accuracy rises from zero to above 90% at relatively flat training loss. Two finite-window theorems prove this coexistence for one-hidden-layer networks, and experiments extend it to deeper networks and to one- and two-block transformers, where training loss can even rise while held-out accuracy approaches one.
Understanding Stability of Outer Nesterov Momentum on Stochastic Pseudo-Gradients
In communication-efficient distributed training, workers take several local steps and send their parameter changes, called pseudo-gradients, to an outer optimizer that often uses Nesterov momentum. For random quadratics the authors derive an exact mean-square stability criterion and show that the inner batch size determines whether adding local steps eventually stabilizes or destabilizes training. Averaging over more workers allows larger outer momentum, but the number of workers needed for stability can grow exponentially with the number of local steps. They also show how to probe these dynamics at intermediate neural-network checkpoints and test the predictions on real networks.
Optimal approximation of smooth functions by ReLU neural networks
The paper studies uniform approximation of Hölder-smooth functions on the unit cube by fully connected ReLU networks, where existing constructions fell short of the information-theoretic limit except in the one-dimensional Lipschitz case. It closes this gap for all smoothness levels and dimensions: networks of width O(N), depth O(L), and bounded parameters achieve error of order (N²L²log N)^(−s/D), with no required relation between width and depth. The construction relies on new encoding and decoding mechanisms based on higher-order finite-difference bounds for local Taylor coefficients. As a statistical consequence, empirical risk minimizers over these network classes reach the minimax regression rate without extra logarithmic factors.
Unit-level aggregation breaks coverage in causal foundation models
Causal foundation models (CFMs) give competitive per-unit treatment-effect estimates, but many decisions depend on effects averaged over groups, which requires calibrated credible intervals. The authors show that coverage degrades as groups grow; on ACIC 2016, intervals from CausalPFN for the full-sample average contain the true value in only 20% of datasets. They prove that the cause is combining per-unit variances as if errors were independent, when uncertainty about the data-generating process makes them correlated, so the combined variance is too small by a factor that grows with group size. Neural process models that predict jointly for a group of units account for this correlation and substantially improve coverage, including as heads on a frozen CausalPFN across all six benchmarks.
Anytime Contracts for AI Services
AI services are open to moral hazard: providers can quietly route requests to cheaper models, and the randomness of model outputs makes this hard to detect. Standard contract theory assumes fixed-length interactions, but subscriptions and pay-as-you-go APIs let users quit at any time, and the authors show this flexibility can break standard contracts. Modelling the setting as a principal-agent game with unknown exit rules, they prove that budget-optimal contracts are proportional to anytime-valid likelihood-ratio e-value tests. They give an efficient algorithm for computing these contracts, use betting e-processes to approximate them when the models are unknown, and evaluate the approach on synthetic data and data from deployed LLMs.
Towards Hyperparameter Transfer for Differentially Private Optimization
Maximal Update Parametrization (μP) lets learning rates tuned on small models transfer directly to larger ones, but it breaks under differential privacy (DP), where gradient clipping and high-dimensional noise change the optimization dynamics. DP-μP analyzes how clipping, noise, and feature learning interact, derives a signal-to-noise condition that sets per-layer learning-rate scaling, and gives concrete scaling rules for DP-SGD, DP-Adam, and DP-Muon. On MLPs, ViT, and GPT-2, it transfers learning rates across model widths without further tuning, matching or beating individually tuned baselines at much lower compute cost.
"Deep lifts": Neural networks can generalize even with the dumbest optimizer
The authors ask how well a network generalizes when its parameters are picked uniformly at random from all weight settings of a large width-W, depth-D ReLU architecture that fit the training data, in the case where a much smaller w-by-d network could explain that data. They show that this oblivious selection rule still generalizes at a rate of roughly wdWD/n rather than being governed by the VC dimension of the full architecture. The explanation is an inductive bias of ReLU networks: a small witness network corresponds to an exponentially large volume of equivalent large-network parameters, constructed explicitly with a proof technique the authors call deep lifting. The framework turns approximation-theory results into generalization guarantees and still holds under some label corruption.
Nearly Linear Private Learning of Littlestone Classes
In differentially private learning, Littlestone dimension determines whether a binary classification class can be learned privately, but how sample complexity grows with that dimension has been an open question. Previous upper bounds improved from doubly exponential to roughly d^6 and then d^5, and this work proves a nearly linear bound of O(d log d). The main tool is a structural exponential mechanism over data-dependent candidate sets equipped with a stable rank. For subspace indicators, this rank is simply the codimension, which gives a private learner for subspaces with linear dependence on dimension and no dependence on the ambient space. For general Littlestone classes, the authors build a suitable rank using ideas from model theory.
How Finite-Rank Bottlenecks Shape the Low-Rank Adaptation Landscape
Theory for why low-rank adaptation (LoRA) works usually relies on the Neural Tangent Kernel linearization. This paper avoids linearization by observing that, with a frozen backbone, the loss sees each adapted weight matrix only through a finite-rank map induced by the frozen activations. Under trace-norm regularization, global minimizers have rank bounded by this "bottleneck rank" rather than the sample size, and attention-specific invariances tighten the bounds further. For the nonconvex factorized LoRA objective with weight decay, every stationary point becomes rank-deficient after a small generic perturbation once the LoRA rank exceeds a threshold, and the paper also gives generalization bounds tied to the frozen features' spectrum.
Out of Support, Not Out of Reach: In-Context Learning with Unsupported Instructions and Composed Tasks
Existing theory explains in-context learning (ICL) as the model picking out a task it already saw during pretraining. That leaves open whether ICL can work when the instruction or the task itself lies outside the pretraining data. The authors build a framework that treats these two kinds of shift separately. They show that demonstrations can outweigh an unfamiliar instruction while keeping exponential task-identification rates. For long tasks never seen in pretraining, they analyze plans that break the task into familiar subtasks, giving an accumulated-error bound for this decomposition and a precise account of when demonstrations, instructions and decomposition let ICL succeed.
Causal Discovery beyond Conditional Independence: Identifiability, Algorithms, and Statistical Inference for Directed Acyclic and Cyclic Graphs
This review covers modern causal discovery methods that go beyond conditional-independence tests. Such methods exploit distributional asymmetries, conditional-moment restrictions, and variation across environments or individuals. Its organizing principle is to separate what makes a causal structure identifiable from the statistical estimator and its algorithmic implementation. It covers latent confounding and feedback loops, including the extra assumptions that cyclic models need. It distinguishes population-level identification, frequentist and Bayesian consistency, uncertainty quantification and algorithmic guarantees, uses examples to show how one observational distribution can support different conclusions under different model classes, and ends with guidance for comparing methods and a research agenda.
The Sign Code: The Hidden Binary Nature of Deep Networks
The authors ask whether trained vision classifiers rely more on the signs of their neuron outputs, which they call the "sign code", or on the magnitudes. For overparameterized networks with sign-preserving activations, a k-nearest-neighbor classifier that sees only the binary sign code matches the full model's accuracy across architectures and datasets. Replacing every magnitude in a residual network with random noise barely changes accuracy, while flipping 20% of the signs drops it to chance. A margin decomposition explains this: the sign-only contribution to each logit grows with the square root of network width and dominates the magnitude term. Generalization also tracks how much same-class inputs share sign codes.
No-Regret Language Generation
The authors define no-regret language generation, in which a generator must make a sublinear number of mistakes for every sequence of demonstrations and every compatible target language. They also define an agnostic variant in which the demonstrations need not fit any language. New tree-based "mistake-forcing" dimensions exactly characterize the minimax complexity in both settings and show that essentially any admissible growth rate of mistakes is achievable. For language classes of finite Littlestone dimension d, they prove a realizable mistake bound of O(d log(1+T/d)), which is optimal up to constants, and an agnostic regret bound of O(sqrt(dT log(1+T/d))).
Equivalence testing and run-count design for stochastic machine-learning experiments
Claims that two training methods perform equally well often rest on a non-significant difference between two or three runs each. The authors propose a protocol for certifying practical equivalence: a two-level (seed by item) variance model, two one-sided tests (TOST) against a pre-specified margin, a two-level bootstrap for composite metrics, and a closed-form formula for the number of runs needed to reach a target power. In a case study on a joint energy-based model, two runs per method certify equivalence with only about 3% probability, while certifying a 0.01 AUROC margin at 80% power needs twelve runs even when the methods are exactly equal. Checks on a thousand-seed CIFAR-10 model zoo and MultiBERTs show the formula stays accurate on real seed distributions.
Neural Expansion: A Unified Mechanism for How Deep Neural Networks Generalize
Global theories such as margin bounds, PAC-Bayes and neural tangent kernels do not show how generalization in over-parameterized networks emerges during training. Neural Expansion is a geometric framework that measures Generalization Intervals, which are direction-specific regions around training samples where the model's predictions stay stable. Experiments across architectures and datasets show that training progressively expands this coverage, especially along directions with low Jacobian singular values. The authors argue the mechanism accounts for many correct test predictions as well as adversarial, mislabeled and out-of-distribution cases without appealing to instance-level memorization.
Escaping Parameter Space: Tight Generalization Bounds via Representation Quality
Generalization bounds based on parameter-space complexity are usually vacuous for deep networks. This bound instead scores the quality of the last hidden layer's representations with a parameter-free k-nearest-neighbor (k-NN) classifier and splits into three measurable terms: local class geometry, agreement between the k-NN decoder and the network, and training stability. It reaches an 8.0-point gap to test error for ResNet-18 on CIFAR-10 and gives what the authors believe are the first non-vacuous certificates on CIFAR-100, and with frozen DINOv2 features it certifies 23.1% error on ImageNet. Experiments that destroy local class geometry remove generalization while leaving memorization intact, which points to class geometry as a causal mechanism.
Mesoscopic learning dynamics of extensive-width neural networks
Studies how stochastic gradient descent learns internal features in two-layer networks whose width grows in proportion to the input dimension, a regime where standard analyses would have to track a growing number of overlaps between learned and target features. The authors instead describe the statistical distribution of those overlaps. Early in training, a Gaussian approximation reduces the dynamics to a few collective variables that track the target's linear and quadratic components. They also estimate when individual neurons begin to specialize to specific target features, and find that a quadratic shielding mechanism speeds up this specialization by filtering out gradient noise.
31 more specialized papers
- Physics-Transfer Learning: A Physics-Constrained Theory for Zero-Shot Generalization Along the Ladder of Complexity Yingjie Zhao, Zhiping Xu
- Upper bounds on the number of causal pieces in spiking neural networks Dominik Dold, Dennis Elbr\"achter, Philipp Petersen
- Source-Aware Dynamic Pricing with Strategic Buyers Jinjiang Zou, Yang Li, Zemin Zheng
- Deterministic Bounds on Accuracy and Stability of Metric-Space Regression and Classification Nina Maria Gottschling, Jakob Gawlikowski, Michele Caprio
- Coverage Cliffs in Off-Policy Quantile Certification Pauline Bourigault, Emmanuelle Bourigault
- Rarity of Singletons Matters & Supplementary Materials Pragatheeswaran Vipulanandan, Kamal Premaratne, Dilip Sarkar
- Spectral Limits of Polynomial Graph Filters on the Long-Range Ising Model Benchmark Amin Najafgholizadeh, Mohsen Afsharchi
- Native Geometry vs. Linear Recoverability: How Alignment Changes Platonic Scaling Angus Hoy, Austin Lutterbach, Jasper Chong et al.
- Partial-Revelation Panel Forecasting: Predictive Information Gain, Allocation, and Coarsening-Consistent Operators Bin Wen, Dai-Qiao Zhang, Tien-Ping Tan
- On the tradeoff between robustness and geometric accuracy in adversarial training Rachel Morris, Ryan Murray, Kerrek Stinson
- A Minimal ReLU Classifier on Non-Linearly Separable Data: Convergence and Implicit Bias at and beyond the Edge of Stability Quan Nguyen, Robin Yadav, Param Mody et al.
- Distinguishability and Recovery for a Doubly Sparse Spiked Wigner Model Ioana Dumitriu, JD Flynn, Zhichao Wang
- Where Latents Belong and How They Flow: Joint Identification of Structural Roles Xintong Li, Kun Zhang, Yujia Zheng
- Information-Geometric Blind Spots of Conformal Test Martingales Johan Hallberg Szabadv\'ary
- Proportionality in Ranking Compression Daniel Halpern, Xinyu Liu, Evi Micha et al.
- Non-Parametric Optimization for Scalable Learning in Stochastic Decision Problems Mohsen Amidzadeh, Lauri Viitasaari, Mario Di Francesco
- Anisotropic Representation Dynamics in Transformers Nguyen Do, My T. Thai
- The Optimal Ranking Tradeoffs Between Two Ranking Scores in Two-Class Classification S\'ebastien Pi\'erard, Adrien Deli\`ege, Marc Van Droogenbroeck
- Minimax-optimal Scaling Laws in Ridge Regression via Transfer Learning Yalda Shabanzadeh, Diyuan Wu, Marco Mondelli
- Contracting with an Agent under Model Mismatch Elif Y{\i}lmaz, Jakub T{\l}uczek, Victor Villin et al.
- Information Estimation with Discrete Diffusion Alberto Foresti, Giulio Franzese, Pietro Michiardi
- Bridging Compressed Communication and Local Steps via Spectral Method in Federated Learning Dmitriy Bystrov, George Chirkov, Daniil Medyakov et al.
- Regularized free deconvolution for spectral repair of resampling distortion in high-dimensional particle filters Deming Song, Chi-Kin Lam, Kefeng Li et al.
- Towards optimal selection schedules for online active learning Hugo Cui, Francesca Mignacco, Francesco Mori
- A Topological Signature of Learning under Noisy Labels Zhongtian Sun, Fan Mo, Prayag Tiwari et al.
- Adaptive conformal prediction on the Grassmannian Dimitrios Loukrezis, Zachary J. Grey, Dimitris G. Giovanis
- A general recipe for data-adaptive anytime-valid envelopes for iterative algorithms Soham Bonnerjee, Aaditya Ramdas
- Expressivity of IQP Feature-Map Quantum Kernels via Reproducing Kernel Hilbert Spaces Valeria Repetto, Stefano Melchionna, Romina D'Aurizio
- From Flow-Box Invariants to Global Conservation Laws: Machine Learning-Assisted Detection of Singularities and Near-Integrability Jimmie Adriazola, Ioannis G. Kevrekidis, Panayotis G. Kevrekidis et al.
- Task-aware Kernel Stein certificates for R\'{e}nyi differential privacy Leoni Carla Wirth, Tara Trautwein, Gesine Reinert
- Waiting Buys Exactly Two Moments: Endogenous Identification in Prediction-Driven Allocation Rama AlHamidi, Rasul Khanbayov, Erchin Serpedin et al.
Other 42
TRACE: Transformer Residual Activation Codebook Encoding for Communication-efficient Distributed Edge Inference
When Transformer inference is split across nearby edge devices, latency is dominated by exchanging activations, and receivers must still compute key/value projections on the received data before attention can run. TRACE (Transformer Residual Activation Codebook Encoding) puts a vector quantizer after each layer's attention residual and precomputes keys and values for every codebook entry, so receivers recover them by table lookup and communication can overlap with computation. A hierarchical codebook lets the bitrate be adjusted at runtime without retraining. On ViT-Base and ViViT-B, it gives up to 1.89% higher accuracy and 1.27× faster end-to-end inference than the prior best VQ-based framework, and cuts communication by up to 22,624× compared with uncompressed sequence-parallel inference.
Null Controls Are Necessary but Not Sufficient: Evaluating Acceptance Guards for Scientific Discovery and Interpretability
Automated discovery systems propose scientific explanations and then run tests to decide which to accept, and this work asks whether passing those tests actually establishes the intended claim. The authors build four executable operations on physical descriptions and score them, along with three interpretability settings, by null acceptance, positive acceptance, and consequence agreement. A trivial reduction that maps every state to zero passes the closure test on 96% of 129 chaotic systems but is rejected by an independent observable-preservation test. Similar gaps show up in interpretability: linear CKA does not change when a proposed correspondence is randomly rotated, and only 45% of sparse-autoencoder features that pass an enrichment test are supported by independent ablation, which suggests acceptance tests need both null controls and independent checks of their consequences.
Noise-shaped Sampling and Annealing for Scalable On-the-edge Training of Binary and Ternary AI Models
Observes that the training loss of binary and ternary neural networks is equivalent to the energy of a high-order Ising model, and adapts Ising-style solvers to train them while still aiming for generalization rather than a ground state. The resulting optimizer, ΣΔ-Sampler, places stochastic sampling and annealing inside a sigma-delta noise-shaping loop so that discrete weight updates follow smooth descent paths. A 13M-parameter ternary model comes within 1% of full precision on CIFAR-10, and on MatMul-free language models up to 2.7B parameters it beats a straight-through-estimator baseline. Compared with quantization-aware training it cuts training memory by over 50% and gives an order-of-magnitude speed-up, targeting on-device training and fine-tuning.
The Loss or the Architecture? What Matters in Survival Analysis with Competing Risks
Deep learning methods for survival analysis with competing risks are usually introduced as a new architecture bundled with a new loss, so it is unclear which part drives the gains. This study varies the two independently, using three losses on four backbones across 20 tabular and 3 pathology-image datasets. Directly modelling cumulative incidence under censoring weighting wins in both modalities and contributes about twice as much as the backbone choice on competing-risks data. Backbones still matter and must match the modality, and the two choices compound. The widely used concordance index fails to distinguish models, and the untried combination of RealMLP or TabM with the cumulative-incidence loss achieves the best Brier score in the benchmark.
Peak-Memory Schedules You Can Trust: Exact Realization, Certified Optimality, and the Limits of Recomputation for Inference
Operator ordering is a free way to cut activation memory for inference on small devices, but feeding a better order back to a compiler proves unreliable. In PyTorch Inductor, the regenerated program misses its predicted peak in 22 of 54 CPU configurations and can even change numerical results on a GPU. The authors instead permute the statements of the generated program, using an exact memory model, which reaches the modelled peak to the byte with bitwise-identical outputs. They add min-cut-based lower bounds that certify the found order optimal for 94% of held-out graphs and all 16 microcontroller-class models in under a second. Reordering pays off mainly for branching networks (10.0% on DeepLabV3). Selective recomputation is strongly NP-hard in general, but it cuts the peak of ReDimNet speaker models by 5.2–6.1% at under 0.4% extra compute.
BMuon: Budgeting Muon's Spectral Geometry for Structured Compressibility
Transformers trained with the popular Muon optimizer can degrade sharply when hidden MLP channels are pruned after training. BMuon changes Muon's spectral geometry so that hidden channels across blocks compete for a shared global allocation budget, which is controlled by one interpretable setting rather than a sparsity penalty coefficient. The authors prove that, in linear factorization models, a scarce budget forces every minimum-cost representation to be width-minimal. BMuon improves on Muon under structured MLP pruning both for ViT-S/16 on ImageNet-1K and for a 1B-parameter LLaMA-style model trained on FineWeb. Its learned allocations are also a better pruning criterion than weight magnitude.
Beyond the Benchmark: Conditioning, Domains and Failure Modes of Qwen3-TTS
The authors probe Qwen3-TTS beyond its technical report. They compare its two voice-cloning interfaces, in-context learning (ICL) and X-Vector, against Chatterbox, XTTS-v2 and F5-TTS on read, meeting, emotional and air-traffic-control speech. Neither interface wins outright, ICL degrades sharply when the reference transcript is wrong, and domain explains four times more variance than the choice of system. Objective metrics rank systems differently from human listeners, and an off-the-shelf anti-spoofing detector flags the clones no more often than genuine recordings.
35 more specialized papers
- CGDT-CESN: Correlation-Guided and Dynamics-Trained Clustered Echo State Network for Multivariate Time-Series Prediction Hariharan Srinivasan, Masoom Bhargava, Sayan Gupta
- Learning smooth dynamics via Kinematic Interpolants Yiheng (Roger), Jiang, Youssef Marzouk et al.
- Who Do Perspectivist Models Predict Well? Annotator Agreement, Sparsity, and Performance London Lowmanstone IV, Vaagishwaran Sivakumar, Anwesha Samaddar et al.
- Structure-Aware Spatial Kernels for Gaussian Process Distributed Port-Hamiltonian Systems Tianyi Yang, Thomas Beckers
- Diagnosing GNN Failure Modes with Layer-Wise Probe Entropy Shanzi Bao, Mar Gonz\`alez I Catal\`a, Pietro Li\`o
- Inductive Learning of Concept Embeddings from Cross-Linguistic Colexification Patterns with Textual Attributes Arne Rubehn
- Quantum-Classical Neural Networks for Solving Lindblad Master Equations Rafael Florencio D\'iaz, Julio Guerrero Garc\'ia, Elvira Romera Guti\'errez
- Acquisition Function-Guided Generation for Bayesian Optimization over Discrete Spaces Tommaso Ancilli, Thomas Wedenig, Henry Moss et al.
- One Communicator, Three Vendors: Extending the MoA Predictive Theory to a Real NVIDIA+AMD+CPU MPI Ensemble Lenore Mullin, Gaetan Hains
- What Accuracy Hides In Learned Transformer Programs Jonathan Lee, Narmeen Oozeer, Philip Quirke
- A Feature Selection Layer Approach for Multi-Class Classification on Neural Networks Jo\~ao Pedro Silveira e Silva, M\'arcio Dorn, Bruno Iochins Grisci
- Scalable Levenberg-Marquardt Training Framework for Deep Learning Xianghao Wang, Johan Barth\'elemy, John Taylor
- What Shapes Brain Alignment of Large Language Models during Dialogue? Insights from Language Production and Comprehension Yuko Nakagi, Yuya Chiba, Yasue Kishino
- TALLOP: Joint Optimization of Local Training and Communication Compression for Time-Constrained Federated Learning Honoka Anada, Yafei Ou, Shinya Takamaeda-Yamazaki
- A Label Noise Robust Algorithm for Graph Data using Neighborhood Label Distribution Pintu Kumar, Nandyala Hemachandra
- DIFFLET: A Fast Inference Engine for Diffusion Transformer Models on AWS Trainium Bin Ma, Min Yu, Vijay Kodamalla et al.
- Path to Prior-Data Fitted Relational Models via Learned Latent Multi-table Representations Mohammad Sadeq Abolhasani, Viswanath Ganapathy
- Structural Affinity: An Algorithm for Coherent Cage-Based Shape Design Aviraj Newatia, Shengan Yang, Hantao Zhong et al.
- DeDiCa: A Scalable Deconfounding Discrete Causal Generative Model Kunchangtai Liang, Adri\'an Javaloy, Antonio Vergari et al.
- Distributed Performance Boosting through Neural Control for Plug-and-Play Networks Danilo Saccani, Leonardo Massai, Giancarlo Ferrari-Trecate
- SETAREH Transform: A Sorting-Assisted Haar-Wavelet Sparsification Method for Approximate Inner-Product Computation Seyed Kamaledin Setarehdan
- RTSM: Adapting Recursive Models to Multivariate Time-Series Classification Georg Tenzing, Anna Tegon, Luca Benini et al.
- Sentence-Level Topic Modeling with Lexical and Contextual Evidence Federica Granese, Serena Villata, Charles Bouveyron
- Flash RNN-T: Memory-Efficient Joint Network and Transducer Loss Computation Mahmoud Ashraf
- A low-dimensional dynamical basis for tongue shape control Sam Kirkham, Patrycja Strycharczuk
- Boundary Detection for High-Dimensional Point Clouds Abigail Hickok, Valerio Galanti, Osama Al Dalahmah et al.
- Deep LLM layers expose passage-level context in EEG during silent reading Ingo Marquardt, Anthilia Alchanat, Priyanka Jain
- In Human Memories. Technology, Creativity and Self-Determination: An Ethical Proposal Francesco Vitucci, Giuseppe Silvi, Francesco Abbrescia et al.
- LagNet: Lag-Structured Operators for Long-Term Time Series Forecasting Zhenan Yu, Guangxin Jiang, Jiuyun Jiang et al.
- Universal Semantic Enhancement for Weakly Supervised Anomaly Detection Siyu Zhou, Yuqin Xie, Hao Yuan et al.
- Logic-Guided Graph Denoising Diffusion Models Samuel Cognolato, Luciano Serafini, Alessandro Sperduti et al.
- Sampling the XY model with an attention-based neural network Piotr Bia{\l}as, Christian D. Morales, Tomasz Stebel et al.
- Learning without relearning physical symmetry: an SO(3)-equivariant convolutional network (CNN) on the sphere Joshua Williamson, Niall Jeffrey, Lorne Whiteway
- ENFR: Evidence Networks with Flow-Matched References for Amortized Simulation-Based Model Inference Kai Lehman, Jameson Dong, Carolina Cuesta-Lazaro et al.
- Task-aligned spectral inductive biases in parameterized quantum circuits Felix Frohnert, Adri\'an P\'erez-Salinas, Sebastian Lange et al.
Agents 40
How language model agents reshape price competition
In repeated Bertrand price competition, standard learning algorithms usually settle near marginal-cost prices, and this work tests whether LLM pricing agents behave differently. LLMs beat standard online learners by adapting faster, but that edge mostly disappears against full-information learners. A surrogate algorithm extracted from the LLM's behavior shows it profits by regularly undercutting slower rivals. The outcome depends on how the agents are deployed: agents that post one price per period from raw histories that include rival prices sustain supracompetitive prices in self-play, while agents that emit price distributions from summaries of their own profits move toward competitive prices. Markets that mix the two interfaces produce dynamic high-anchor-and-undercut regimes.
Eliciting Specifications: When Does Interactive Clarification Help?
Task descriptions used to generate Lean formal specifications are often ambiguous, so the authors test an elicitation agent that asks a simulated developer a limited number of clarifying questions before an LLM formalizer writes the spec. On 189 Verina Lean 4 tasks with budgets of 3 or 10 questions, clarification is not a uniform win: the same-model Claude Sonnet 4.6 pipeline gets worse. Cross-model pipelines improve, with the best (Sonnet 4.6 eliciting and GPT-5.6 formalizing) reaching 65.6% strict pass@1, a 6.3-point gain. Postconditions are the largest source of degradation, and the authors recommend treating clarified natural-language specs as intermediate artifacts and optimizing the translation step separately.
PRIME: Towards Verifiable Evidence-Grounded Reasoning in LLM Agents
LLM agents that check records against organizational requirements, such as deciding whether a vulnerability report is ready for investigation, often accept a record after a required check has failed or settle for a weaker conclusion without trying other valid routes. PRIME (Precommitted Rules for Inference from Minimal Evidence) fixes the allowed evidence routes before checking begins, and a separate program records each check result in a ledger and refuses any conclusion the results do not justify. It also points the agent to checks that could support a stronger conclusion, or runs them itself. On 480 public-record tasks, a baseline agent reported unjustified conclusions on 26.7% of tasks while PRIME reported none, and its guidance raised the average justified-conclusion score from 30.1 to the maximum of 59.2 out of 100.
Lean4AgenticRL: Advancing Agentic RL with Verifiable Multi-level Process Rewards
Agentic reinforcement learning (RL) for software engineering and terminal tasks usually rewards only the final outcome and ignores whether individual tool calls and workflow stages were done correctly. Lean4AgenticRL builds a problem-specific workflow for each task, formalizes agent behavior in the Lean4 proof language so it can be verified, and uses the result to give rewards at the tool-call, workflow-stage, and outcome levels, trained with a stage-normalized variant of GRPO. The resulting LAR-9B and LAR-27B models beat their base model by 9.89% on average and the next-best comparable model by 5.07%, with LAR-27B reaching 77.3% on TerminalBench-2.1.
RealCLI: Toward a Unified Evaluation of Human-Agent Collaboration for CLI Agents
Benchmarks for command-line interface (CLI) agents usually assume the user's instructions stay fixed, or they score only the final result without measuring how well the agent collaborates while it runs. RealCLI pairs two modes on realistic CLI tasks: RealCLI-Exec gives the full specification upfront, while RealCLI-Collab uses a scripted user who reveals information gradually, issues corrections, revises constraints, and makes authorization decisions, scored on a five-dimension framework with 22 sub-dimensions. The best frontier configuration averages only 49.2%, and the peak joint collaboration score is just 37.6%. Models struggle most with steerability, trust calibration, and respecting safety boundaries, and task success turns out to be a poor predictor of collaboration quality.
AuditKIT: A Unified Evaluation Spine for Benchmarking, Judging, and Comparing Large Language Models and Agentic Systems
Evaluating language models and agents means combining benchmark accuracy, judge scores, runtime performance, tool-use behavior, and retrieval quality, and differences in interfaces and trace formats across these can hide failures. AuditKIT is a source-available library that records all these measurements in one result format, with direction-aware metric contracts and configuration fingerprints. For agents it matches tool calls turn by turn, separates parallel from sequential execution, and marks missing evidence as unscored rather than as a failure. For retrieval-augmented generation it combines ranking metrics, judged grounding, and deterministic evidence checks, and seven case studies show how answer extraction, runtime behavior, and metric choice can change evaluation outcomes.
Predicting Privileged Information Effectiveness for On-Policy Self-Distillation
On-policy self-distillation (OPSD) lets a large language model learn from privileged information (PI), such as hints or reference trajectories, without a separate teacher, but how to build that information has mostly been treated as a fixed design choice. The authors test 16 PI configurations on three multi-turn agentic benchmarks and three student models, and find that information-dense trajectories and PI from stronger generators usually help more, while thinking models benefit less consistently. Two KL-divergence metrics computed before training predict post-training performance better than raw PI utility, which information leakage can distort, and choosing PI per task with the error-step KL contrast beats random selection. Effective PI also improves results when combined with GRPO, beating a strong GRPO-only baseline.
Don't Retrain, Remix: Adaptation of Web Agents using Mixture Hypernetworks
Web agents struggle when they meet unfamiliar website layouts or redesigned versions of sites they already know. WebMix is a mixture hypernetwork that adapts an agent by combining low-rank adapters (LoRA) already trained on other interfaces. A scout agent explores the new interface and writes a compact manual, and a lightweight router uses that manual to predict mixing weights over the adapter bank, so no gradient updates on the target are needed. With Qwen and Llama models on TimeWarp and WebArena-Lite-v2, WebMix matches or beats in-context learning and LoRA baselines and often matches specialists trained on the target, with an average gain of about 8 percentage points over the best baseline on TimeWarp domain transfer.
Can LLMs predict the outcomes of machine learning experiments?
Tests whether frontier LLMs have reliable intuition about which machine learning experiments are worth running, a capability relevant to recursive self-improvement (RSI) and automated ML research. The authors collect 288 LLM-proposed ideas on eight MLE-bench tasks, run them, and compare the real outcomes with predictions from five frontier models. Predictions beat chance but remain far from accurate: the best model, Claude Opus 5.5, explains only about half the variance (R^2 = 0.49), all models systematically underestimate effect sizes, and quality varies widely across tasks. The coding harness that implements the ideas has little effect on outcomes, the authors find no evidence of self-preference, and more reasoning or context gives only modest gains.
ProPerAgent: Toward Memory-Driven Proactive Assistance
The paper studies memory-driven proactive assistance (MPA), where an assistant must decide whether and when to interrupt based on evidence buried in a long personal memory rather than handed to it in context. The new ProPerMem benchmark pairs egocentric video with year-long, distractor-rich user memories averaging about 618K tokens, plus human-verified trigger windows, and scores content and timing together. Every baseline scores at most 15%, and a controlled study shows content and timing are each necessary: GPT-5.3-Chat reaches 96% with oracle evidence delivered inside the trigger window, but falls to 38% when it must choose the timing itself and to 15% with retrieval. The proposed ProPerAgent uses a graph-organized memory store with gating and lifts strict accuracy from below 10% to about 38% without training, reaching 42.4% after a lightweight RL stage.
Not All Graphs Are Maps: A Task-Agnostic Exploration Framework for Mobile GUI Navigation
Mobile GUI agents can act on the screen in front of them but lack persistent knowledge of where functions live inside an app. TAG-Nav (Task-Agnostic Graph Navigation) wraps existing agent backbones with a destination memory distilled from offline exploration (app functions, target pages, and waypoint routes) and uses it for route guidance without task-specific demonstrations. To measure route finding separately from the final actions, the authors introduce DestBench, which checks only whether an agent reaches the correct pre-action screen. Graph memory built by automated BFS raises strict navigation success from 52.4% to 58.3% for UI-TARS-1.5-7B and from 59.5% to 71.4% for Qwen-VL-Max, and the results show that destination coverage and route cleanliness strongly determine how much the memory helps.
Multimodal Filesystem Memory For Long-Horizon Embodied Agents
Long-horizon agents need memory that is easy to search and still keeps the visual and spatial detail that summaries throw away. MFM is a multimodal filesystem memory with episodic, spatial, semantic, procedural, and working memory, linked through searchable text records that point back to the raw multimodal episodes, so agents can recall experiences from contextual cues and re-inspect the original observations. A consolidation step turns experience into reusable knowledge and procedures while keeping references to the source episodes. With GPT-6-Astra, MFM completes Mine Diamond from Scratch in Minecraft and reaches 16 of 24 milestones on the Ender Dragon task versus 12.7 for the best baseline, and it scores 0.440 mean reward on CUABench-KiCad against 0.400 for the best baseline and 0.267 without persistent memory.
Explore Separately, Adopt Selectively: Execution-Guided Tool Use over Large Tool Libraries
LLM agents working over libraries of thousands of tools often have to execute several candidate tools to find the right one, and doing this inside a single trajectory can leave alternatives untested or let failed attempts derail later reasoning. BRIA (Branch-Inspect-Adopt) investigates each candidate in its own temporary branch that retrieves and runs tools, after which the main task agent inspects the execution evidence and adopts only the useful results; it also retrieves new tools as new needs arise. Evaluated on PlanBench-XL and MCP-Atlas with a shared pool of 1,897 tools and three language models, BRIA matches or beats the strongest retrieval baseline in every setting. On MCP-Atlas it reaches an average claim score of 89.77 versus 75.40 for MCP-Zero, and it sits on the Pareto frontier of task performance against input-token cost.
GlobeBench: Evaluating Text-Based World Model Capabilities for Scalable Environment Simulations
Text-based world models that simulate how RL environments respond to actions have had no standard benchmark. GlobeBench provides 1,632 tasks across five domains and nineteen simulation skills, asking a model to predict the environment's response to an action given the full agent trajectory, and scoring it against an execution-derived reference using deterministic checks plus a semantic judge. Among 20 general-purpose LLMs and specialized text world models, GPT-6 Astra scores highest at 49.57% task success. Accuracy falls as actions affect more of the environment: when changes must propagate to dependent objects, average success drops to 5.1%, and 631 tasks are solved by no model.
TokenEconomizer: Experience-Driven Black-Box Cost Control for Coding Agents
Coding agents are usually evaluated on token efficiency one task at a time, but developers use them across long sequences of tasks in the same project, where recurring environment-specific costs build up. TokenEconomizer is an external black-box controller that learns from experience which operational micro-skills to inject, which persistently irrelevant tools to prune, and when to step in on unproductive failure loops. Across Claude Code, Codex and GitHub Copilot CLI paired with frontier models, it reduces average token cost by 18.4–30.9% with comparable task success, and the savings hold in every repository tested. The approach also carries over to sequential web development and security auditing, with cost reductions of 6.4–21.2%.
Self-Evolving Coding Agents via Harness-Policy Optimization
A coding agent's performance depends on both the policy model and the harness that mediates its interaction with the environment, and improving only one of them leaves gains on the table. Self-HPO alternates between the two: the current policy analyses its own failures and proposes new harness candidates, then is trained with reinforcement learning (RL) under the selected harness, and hard tasks found during training become the next round's harness search set. Across three coding benchmarks, it raises Qwen3.5-35B-A3B's average resolve rate from 57.8% to 64.8%, outperforming harness-only and policy-only baselines, with gains that extend to out-of-distribution settings. The joint gain exceeds the sum of the individual gains, and using a stronger external model such as Opus 4.8 as the harness proposer improves results further.
Benchmarking and Enhancing Agentic Causal Discovery
Existing causal-discovery benchmarks give variables meaningful names, which an LLM can exploit without reading the data. Names alone get 99% of Tübingen cause-effect directions right, and with names removed, choosing a better algorithm than PC closes most of the remaining gap. Heuresis uses anonymous simulated datasets ranging from linear Gaussian to heavy-tailed mechanisms. For each family it separates what a better off-the-shelf algorithm can gain from what only closer analysis of the data can gain, and it traces every edge an agent changes. In an agent harness, GPT-6.1 Sol beats the best chosen algorithm on all six families, by 14% adjacency F1 on the hardest, and Claude Opus 5.5 beats it there by 7.4%. A third of the true edges these agents restore on the hardest families appear in no algorithm's output.
Cooperation Without Adaptation: LLM Agents in a Collective-Risk Dilemma
Five production LLMs played a collective-risk dilemma: six players contribute to a shared pool over ten rounds, and a shortfall risks a catastrophe that destroys their remaining resources. Most models contributed roughly an equal share at every risk level, and four of five kept contributing even when risk was zero and contributing could not help them. Several models correctly identified the payoff-maximizing action, yet their behavior barely changed. No model consistently best-responded to fixed partners. In mixed groups, one agent's final-round shortfall could sink an otherwise successful group, and which model selection favored depended on population composition. The authors conclude that cooperative self-play does not show strategic adaptability, and that multi-agent evaluations should test responses to incentives, partner behavior, and population makeup.
When to Forget: Risk-Controlled Context Adaptation for Long-Horizon Agents
For long-horizon agents, the value of keeping a past failure in context can change as execution goes on. RECAP studies when keeping, compressing, or removing a history block helps compared with keeping the full history. It measures effects with matched environment states and rollout seeds, predicts promising edits from how a failure block relates to the current execution, and certifies a policy on independent task bundles under explicit risk constraints. In one case study, compressing the same failure block hurts at an early state but saves cost at a later one. On Hunyuan-A13B, RECAP edits 43.24% of retained checkpoints while matching full history's 91.89% continuation success and reducing mean prompt cost by 2.13%.
SAFE-Mem: Secure Agentic Memory with Fine-Grained Authority and Governance-Aware Retrieval
LLM agents with persistent memory can be manipulated when untrusted claims from external sources are later treated as authorized preferences, policies, or permissions. SAFE-Mem labels each stored claim with a kind, an authority, and a scope, then uses governance-aware retrieval to admit a claim only when its permissions fit the query's requirements. A memory graph links source sentences, claims, and entities to support provenance tracking. Across four LLM backbones on MPBench and LoCoMo, it has the lowest attack success among defenses that keep legitimate memory, at least 77% below the strongest of them, and the best answer accuracy, up to 15% higher.
KiranaBench: Can a Language Model Run a Neighbourhood Shop?
Benchmarks for LLM agents that run businesses are almost all English-language, Western, and single-agent. KiranaBench simulates an Indian general store run by four separate LLM agents (manager, cashier, helper, and bookkeeper), which deal with customers and suppliers in English, Hindi, or Hinglish, with demand calibrated to India's national household consumption survey. All four open-weight models tested fall far short of a fixed-rule shopkeeper: the best earns only one-eighth of the baseline's profit, and two do worse than an unmanaged shop. Performance is also consistently lower when suppliers communicate in Hindi or Hinglish than in English.
Self-Evolving Agents Can Repair Failures but Struggle to Generalize from Them
Self-evolving LLM agents usually improve by learning from successful trajectories or external feedback; this study asks whether they can improve from failures alone. In a setting called Cold-Start Failure-Only Evolution (CFOE), tested with three self-evolution approaches, several LLM backbones, and four interactive environments, the authors find a consistent repair-generalization gap: lessons from failures help fix previously failed tasks but rarely improve performance on unseen ones. Agents often misread why they failed, and even verified-correct lessons transfer poorly. Verifier feedback and extra interaction help little, while access to successful trajectories substantially improves transfer.
PersonaCUABench: Benchmarking Computer-Use Agents Serving Diverse Personas
Computer-use agents (CUAs) are usually scored against fixed task specifications, but real users leave out requirements, add constraints, or want to approve consequential actions first. PersonaCUABench keeps 74 tasks across 11 domains fixed and varies only who is asking: a persona agent playing one of 44 personas rewrites each instruction in that user's own words and answers the CUA's questions, while the CUA never sees the profile or the original instruction. Across nine backbones and 3,330 runs, mean task completion falls by 36% relative to the original requests, mostly because agents engage with what the user asked for and still get it wrong. Even when a persona request is fully completed, users give the top satisfaction rating in only 62.7% of cases, compared with 84.1% for the original requests.
ParetoChat: An LLM-Based Interface for Interactive Multi-Objective Optimization
Multi-objective optimization requires decision makers to turn qualitative preferences into numerical weights or reference points, which is hard to specify and interpret. ParetoChat is a multi-agent large language model (LLM) interface with separate agents for input processing, multi-criteria decision-making (MCDM) expertise, solution presentation, and feedback handling. It translates natural-language requests into scalarization parameters, calls an optimizer, and iterates on user feedback. In simulations with an LLM-based decision maker on binary knapsack and set-partitioning problems, it efficiently guided search toward preferred solutions compared with reference-point and NIMBUS methods in DESDEO, and a courier-order assignment case study shows the natural-language interaction in practice.
MetaCurate: Evolving Curation Filters for High-Quality Agentic Coding Data
Choosing which coding-agent trajectories to use for supervised fine-tuning is hard: a successful run may contain wasteful tool use, and a failed run may still hold useful steps. MetaCurate is a training-free framework that evolves executable curation filters from a blank start. It uses disagreements between the filter's rankings and pairwise LLM-judge preferences to revise the filter's rules, rubric, and aggregation policy together. Once the search is done, the filter scores trajectories on its own, with no further pairwise comparisons. In controlled fine-tuning experiments on an uncurated trajectory pool and the Nemotron v3 SWE dataset, MetaCurate achieves the highest mean SWE-Verified score, beating hand-authored rule-based filtering and a training-loop baseline whose search costs 3.5 times as much.
Grounded Credit Assignment in Reinforcement Learning for Multi-Turn Search Agents
Outcome-reward reinforcement learning such as GRPO gives every token in a search-agent rollout the same advantage, even though the rollout involves two separate skills: finding evidence and using it. The authors show that Search-R1 improves accuracy while weakening grounding: on Bamboogle, the share of correct answers supported by retrieved evidence falls from 84.0% to 42.9%. Grounded Credit Assignment (GCA) uses verifiable sub-outcomes, namely whether evidence was retrieved and whether the answer was correct, to adjust search and answer credit separately, with the correction capped at 10% of each token's advantage. Without extra models or rollouts, GCA improves average exact match by 5.7 points with Qwen2.5-3B and 6.3 points with Qwen3-30B-A3B, and raises the evidence-supported share of correct answers from 76.9% to 93.4%.
MultiAgent-OPD: End-to-End Training of Hierarchical Multi-Agent Systems with On-Policy Distillation
Training a hierarchical multi-agent system end to end is hard, because the final answer gives subagents only indirect feedback and scores from an LLM judge depend on the judge's own biases. MultiAgent-OPD combines on-policy distillation with reinforcement learning to jointly train a shared-parameter Leader-Searcher-Answerer team. A frozen Teacher, first trained in a Searcher-Answerer workflow, scores the Searchers' search and summary tokens to give them local process supervision. The Leader learns from team success and the Answerer from candidate correctness. Across seven datasets the team reaches 38.68% macro avg@4, beating Prompted Critic by 4.06 points and the trained cascaded system C-MAS + RL by 2.61 points.
Response-Informed Value Estimation for Cost-Aware Multi-Turn LLM Routing
In multi-turn LLM routing, a model must be chosen at every turn before its response is seen, and only the final task outcome provides a label. RIVET (Response-Informed Value Estimation for Turn-Level Routing) jointly trains two value estimators over a shared representation. One is a deployable router that scores candidate models from pre-call information only; the other is a training-only estimator that also sees the realized response. Conditioning on the response turns response-driven variation in returns from noise into an observed variable, which the authors prove reduces estimation error for the shared representation. On the MINT benchmark, RIVET solves more held-out tasks than the strongest multi-turn baseline while cutting total call cost by 74.7%.
FLARE: Physics-Grounded Evaluation of Language-Model Agents for Feeder Restoration with Degraded Observations
Restoring power after distribution-grid faults means making decisions from incomplete and conflicting information while respecting electrical constraints. FLARE (Feeder-Level Agent Restoration Evaluation) is a physics-grounded benchmark of 800 AC-feasible cases across five observation settings, in which language-model agents gather evidence, evaluate switches, and act. Across 78,750 episodes with five instruction-tuned models, median regret is zero, but 95th-percentile regret ranges from 0.814 to 1.000, exposing a heavy failure tail. Replaying the actions the safety guard rejected shows that 96.4% would have caused a physical violation.
Beyond Marginal Influence: Interaction-Aware Memory Selection for LLM Agents
Agent memory retrieval usually ranks records by relevance or individual influence, which fails when evidence is redundant or only useful in combination. The authors study how to pick a small memory subset that preserves the agent's full-memory behavior. They introduce JointCoreBench, which has exact sufficient-set oracles, and JointCore, a baseline that tries deleting groups of records, ordered by relevance cost, before testing single records. On 6,912 exact conditions, JointCore recovers a minimum-cost sufficient set in 100% of cases while cutting subset evaluations by 62.9%. The authors stress that this does not establish deployment-ready memory compression.
Annotrace: A Workbench for Step-Level Annotation of Agent Traces
Studies of why LLM agents fail usually begin with hand-labelling traces, and each study tends to build its own throwaway tool. Annotrace is a workbench that reads six trace formats, including OpenTelemetry GenAI, LangSmith and Langfuse, and turns each run into an ordered, nested list of steps, delegations and tool calls. Annotators write their own labelling codebook. A frontier model proposes a starting codebook from sample traces and answers the same questions as the human, which makes annotation a joint human-AI process with built-in agreement measurement. On a multi-agent question-answering corpus, the tool exactly reproduces 235 annotation units from an earlier manual effort, and two models labelling the same traces agree 91% of the time (κ = 0.82).
Robust Function Calling for LLM Agents Under Interface Drift
Tool-using LLM agents depend on interface text such as tool descriptions, argument schemas and candidate tool lists, which often change after deployment while the tools themselves do not, a problem the authors call interface drift. SchemaShield-Lite is a training-free repair layer that combines schema validation, candidate-set retry for missing tool names, and one-shot constrained repair. On Qwen3.5-9B it raises DICE-300 accuracy from 0.717 to 0.813 and BFCL-200 accuracy from 0.580 to 0.805, with no observed repair harms, and naive retry does not explain the gains. Ablations show that changes to the candidate tool list, especially added distractor tools, cause most of the damage.
MuninAI: A Self-Hosted Agentic Framework for Independent Research Groups
Munin is an open-source, self-hosted scientific assistant that lets a research group ground a language model in its own literature without sending unpublished work to a hosted service. It indexes the group's papers and citation graph, and wraps any open-weight model in an agent harness with dedicated tools for reading, search and computation. On 199 literature questions, the harness raises base-model accuracy from 0.387 to 0.874, while naive retrieve-then-answer scores below the unaided model on every backbone tested. The gains hold across three backbones, including gpt-oss-20b on a single consumer GPU, and with network access disabled both Qwen backbones still beat the published PaperQA2 accuracy; the system also abstains on most questions once their source paper is removed and produced no fabricated local citations.
MARS: Memory-Aware Routing for Session-Level LLM Assistants
Long-running LLM assistants must decide, turn by turn, which past context to show and which model should answer. Existing systems make these two choices separately, even though the memory choice changes how hard the question is. MARS couples them through a shared session state, estimated by a Query and Topic Manager (QTM), which drives both a fixed memory policy and an online model router that trades off quality, memory and cost. On RealMem, MARS keeps 98.2% of full-context GPT-4o QA quality at 14.5% of its API cost and achieves the best measured memory-recall and retrieval scores among compared systems. On MultiChallenge, it trails the strongest static system overall.
SIT-Eval: Situation-Based Interactive Turn-by-Turn Evaluation of Conversational Agents
Static dialogue benchmarks rarely contain the unusual situations that become frequent failures once a conversational agent runs at production scale. SIT-Eval writes an agent's desired behavior as situational rules of the form "if situation P, follow rules Q". At each turn, an LLM interlocutor acts out a uniformly sampled situation, and a context-aware LLM judge scores the reply against every rule that applies. The judge is validated on human-verified synthetic dialogues. Across 8 LLMs and 1,292 turns, models with similar overall scores differ widely on individual rules, and all of them struggle most with clarifying ambiguity and with Socratic questioning.
Tool Recommendation for Multi-Step Agents: Finding Every Tool a Task Needs
A multi-step agent task fails if a single needed tool is missing, yet the roughly 8,200 tools on the platform studied have definitions too large for any model's context window. Tool Recommendation is a deployed gateway system that exposes all of them through a fixed interface of three tools, running each call under the end user's credentials and checking it against per-service consent. On the ToolRet benchmark it places every needed tool in the top ten 57% more often than BM25 lexical search, and its first recommendation covered every required tool in 93% of Codex sessions. Compared with a fixed list of 100 tools, it cut the total bill in all 14 runs, by up to 40%, with no change in task completion.
GLOBE: Evolving Structured Agentic Memory for E-commerce Product Optimization in Generative Search
Agents that optimize e-commerce product listings for generative search usually treat listings as free-form text and leave the strategies that worked buried in prompts or outputs. GLOBE instead stores optimization knowledge as an evolving handbook of explicit behaviors, each tied to a specific listing field. An Editor applies behaviors and receives rank-based feedback, a Reflector turns that feedback into updates, a Moderator removes redundant proposals, a Curator commits changes, and behaviors that keep causing harm are deactivated. Structured behaviors outperform monolithic prompt optimization and remain effective on unseen product categories.
Learning Personalized Memory Gating from Delayed One-Sided Feedback
Language-model agents with long-term memory cannot keep every extracted fact, and existing policies for deciding which facts to store are shared across all users. The authors label each fact by whether it is later retrieved and used in a response, then frame online memory gating as contextual apple tasting with delayed one-sided feedback. Their Warm-Start UCB method combines offline learning with online adaptation to each user and comes with a high-probability regret bound. In experiments it outperforms all baselines across memory budgets and history lengths.
DiscoveryRSI: Recursively Learning to Discover Valuable Hypotheses
DiscoveryRSI grows trees of scientific hypotheses through multi-agent evolutionary search, compiles chosen investigations into executable Harbor tasks, and improves itself through credit assignment, replay of its research workflows, and rediscovery. The authors also introduce DFM-Bench to assess hypothesis quality and cumulative research progress. Across four life-science domains, automated hypothesis quality scores rise from 4.86 to 5.39 after two rounds of self-improvement. DiscoveryRSI-27B's hypotheses match later-published research 6.3% of the time, compared with 2.5% for GPT-6 and 2.3% for Claude Opus 5.
AI-Driven Reproducibility and Analytical Robustness in Scientific Discovery
Tests whether LLM agents can automate reproduction and robustness checks of published research, using the Surveillance, Epidemiology, and End Results (SEER) U.S. cancer registry. The authors build SEER-Repro, a benchmark of 20 SEER-based papers with the data needed to reproduce them, and an agent that reproduces 77.4% of 2,190 atomic claims. A second agentic pipeline identifies the analytical choices behind each finding, proposes defensible alternatives, and reruns the analysis. It flags potentially consequential choices in 9.5% of fully reproduced findings for expert review.
Safety & Alignment 34
Encoded but Exposed: Language Embeddings can Reveal More Than They Should in Recommender Systems
Recommender systems increasingly represent items with language-model embeddings, and this work examines whether those embeddings leak item identities. An adversary holding auxiliary item text from outside sources runs a simple cosine-similarity attack and recovers item identities with high mean reciprocal rank across several language models and two real-world datasets. Leakage is strongest when the adversary's text overlaps with the victim's representation, but it persists even between independently written descriptions. The item leakage can also be used to re-identify users from sparse ratings, and obfuscating item descriptions as a defense trades leakage against recommendation utility.
Progressive Misalignment Can Emerge from Benign Recursive Self-Distillation
Self-distillation trains a model to match the predictions it would make if it had extra context, such as a cue or feedback, and recursive self-distillation makes each distilled model the teacher for the next round. The authors find that a safe model recursively self-distilled on its own safe outputs, with a harmless extra cue, becomes steadily more willing to answer harmful queries, a failure they call Progressive Misalignment. The effect appears in the Qwen3 and Phi-4 model families on SORRY-Bench and StrongREJECT, and also when the fixed cue is replaced by feedback from a simulated user with benign intent. Using a gradient-based search, they also find benign prompts that trigger the effect, showing that harmful training prompts are not needed for misalignment to emerge.
The Model Knows Better: Defending Medical Multi-Agent Systems Against Prompt Injection
Examines prompt injection in medical multi-agent systems, where several LLM agents discuss a clinical case, and finds that a single injected passage succeeds in up to 61% of cases and that collaboration between agents does not reliably protect against it. Existing defenses miss injections that read like ordinary clinical text, but a model that followed an injection usually rejects it when asked to check it against the patient's findings. The proposed training-free defense separates patient findings from clinical judgments such as diagnoses and instructions, then verifies each judgment against the findings alone. It lowers attack success on MedQA to 4-7% without hurting accuracy on clean cases and holds up against defense-aware and adaptive attacks.
SAFETYEDIT: Sparse Internal Targets with Prompt-Wide Control for LLM Jailbreak Backdoors
Studies model-editing backdoors that make an LLM produce harmful jailbreak responses when a trigger is present while behaving normally otherwise. Instead of targeting affirmative output prefixes or dense compliance directions, SAFETYEDIT optimizes a single refusal-related MLP coordinate and marks the KV cache in early attention layers so the trigger signal reaches later instruction positions. Across four open-weight LLMs and three dataset groups it achieves the highest triggered Guard attack success rate in 11 of 12 comparisons and the highest StrongREJECT score in all 12, with minimal changes to untriggered behavior and general capabilities in the tested configurations.
Exploring The Empirical Privacy Landscape of Synthetic Data
The work runs a controlled comparison of ways to train language models on sensitive data, using synthetic medical records seeded with canaries to measure leakage. Direct finetuning gives the best capability but leaks the most, while DP-SGD (differentially private stochastic gradient descent) cuts leakage at a large cost to capability. Training on synthetic rewrites of the records strikes a better balance, and privacy-aware rewriting guided by a uniqueness-aware instruction outperforms naive paraphrasing across many rewriting models. More capable rewriters generally reduce downstream leakage, though held-out fit does not improve monotonically and extra test-time compute gives inconsistent gains.
Risk and Refusal: Mechanisms of LLM Responses to Suicidal Ideation
Refusal is a standard LLM safety mechanism, but refusing to engage with someone disclosing suicidal ideation (SI) can itself be a safety failure. The authors test eight instruction-tuned LLMs on SI and self-harm disclosures from three datasets, varying whether models are told the message expresses SI and whether they get a clinician-developed response protocol, and run mechanistic analyses on six open-weight models. Risky responses come mainly from inattention to the disclosure plus refusal, and models appear to refuse SI disclosures through the same direction that mediates refusals of harmful requests. Telling models about the SI context or suppressing refusal increases engagement without reliably lowering risk, while the clinician-guided protocol consistently reduces both response risk and refusal.
The LLM-Attacker: A Unified Red-Team Framework for Privacy Evaluation of Split and Distributed LLM Systems
Split language models keep the user's text on a client but send intermediate representations to a server, and attacks can reconstruct the text from those messages. Privacy evaluations are hard to compare because they differ in what the attacker sees, which weights the attacker knows, and which datasets and scoring measures are used. LLM-Attacker is a framework that records these choices, saves attack predictions so they can be scored independently, requires a linked undefended reference before a defence can pass, and reports which attacks remain untested. In a controlled GPT-2 experiment, giving the attacker gradients returned during training raised exact-document recovery from 13.71% to 37.77%, and token recovery from 94.20% to 97.38%.
Refusal Is Not Robustness: Measuring Harmful Reachability in Autoregressive Language Models
Jailbreak evaluations usually report attack success rate (ASR), which checks only sampled outputs, even though a model that samples a refusal can still place substantial probability on harmful continuations. Bounded continuation analysis (BCA) treats generation as a stochastic process over token prefixes, builds a bounded continuation tree, labels its endpoints with a semantic harm evaluator, and computes the finite-horizon probability of reaching harmful output using exact probabilistic model checking. Across four instruction-tuned LLMs and 100 JailbreakBench behaviours, BCA measures hidden harmful reachability beneath sampled safe responses, separates models that look identical under ASR, and helps decide where red-team effort should go.
Prune the Leaky Neurons: Mitigating Private Data Leakage in Fine-Tuned LLMs via Joint-Embedding-Guided Pruning
LLMs fine-tuned on proprietary records can leak memorized personally identifiable information (PII), and existing defences such as differential privacy or privacy-neuron editing tend to hurt utility. JEPA-Prune trains a companion public model on PII-free surrogate and masked views of the same records using a joint-embedding predictive architecture (JEPA), and uses it as a reference to find neurons whose representations deviate on leaked records. Integrated gradients and a specificity score identify the PII-responsive neurons, which are pruned without retraining. Pruning just 1.6% of neurons cuts PII extraction recall by up to 13.9x and inference accuracy by up to 7.4x, while unseen-text perplexity stays within 16% of the unpruned model for most LLMs; privacy-neuron editing, by comparison, increases perplexity by at least 26x.
Veil-Then-Reveal: Protecting PII Privacy via Reversible Pseudo-Anonymization in Zero-Trust User--LLM Interaction
Sending prompts that contain personally identifiable information (PII) to remote LLM providers exposes that data to logging, retention, and training. Masking or removing it breaks the task, and encrypting it strips the cues the model needs. Veil-then-Reveal (VtR) runs entirely on the user's side under a zero-trust threat model. It swaps detected PII for realistic surrogates of the same type before the prompt leaves the device. Structured values such as phone and card numbers go through format-preserving encryption (FPE), while names, places, and organizations are mapped through a keyed-hash dictionary and a secure vault, and the original values are restored in the model's response. Per-session mappings keep sessions unlinkable. Across three datasets with 11,322 annotated PII instances, it reports 97.9% detection recall, 95.2% protection of detected values, and 100% end-to-end restoration of echoed surrogates.
The Reliance Hypothesis: Chain-of-Thought Faithfulness Rises as Language Resource Level Falls
Chain-of-Thought (CoT) faithfulness, meaning how much a model's answer actually depends on its stated reasoning, has mostly been studied in English. Using parallel MMMLU questions in eight languages across four models and several faithfulness measures, the authors find that faithfulness rises as a language's resource level falls on knowledge-intensive tasks but not on reasoning-intensive ones. They propose the Reliance Hypothesis: models lean on their reasoning when they cannot simply recall the answer. Model confidence partly explains the resource-level effect, with a Simpson's-paradox pattern across and within languages. CoT monitoring may therefore be most informative in lower-resource languages, which is where it is least often validated.
Identify, Classify, Act: Per-Instruction Controlled Compliance for LLMs over External Data
A single document or tool output can mix legitimate instructions with prompt injections, and current defenses either distrust or trust all embedded instructions. That forces a trade-off between over-refusal and over-compliance. The authors frame the problem as classifying each embedded instruction and propose EDIC, a decomposed reward framework. It generates training data by injecting mixed beneficial and harmful instructions with counterfactual filtering, and trains a generative judge with SFT and then GRPO to attribute compliance at the instruction level. The judge's reward then trains the policy with RL, rewarding beneficial compliance and penalizing harmful compliance separately. On Qwen3-4B, it improves harmful-instruction rejection by up to 7.7% and Arena-Hard-Auto utility by 12.5% over the strongest prior defense.
Many Biases, One Circuit: Post-Training Tunes a Pretrained Cue-Routing Mechanism
Language models often drop a correct answer when the prompt hints at a wrong one, and sycophancy and related biases are usually studied separately and blamed on alignment. Causal tracing of attention heads across two post-training pipelines shows that four types of cue rely mostly on the same few heads, a circuit already present in pretrained models. Fine-tuning on about 200 generic assistant examples is enough to activate the circuit in chat format, and the final reinforcement learning (RL) stage strengthens it further. In Tulu-3-8B and OLMo-2-7B, swapping six middle layers' attention patterns between RL checkpoints moves most of the cue effect with them, which points to this circuit as a target for mitigation.
Aligning Language Models Towards Counterfactual Invariance
Demographic details in a prompt can change the quality of a language model's response even when they are irrelevant to the task. The authors show that standard alignment recipes such as reinforcement learning improve overall quality while widening quality gaps across demographics, which amplifies counterfactual bias. To counter this, they develop a policy-gradient method with a group-level reward computed on matched pairs of counterfactual prompts, along with a dataset and an evaluation that separates cases where demographics actually matter. The method reduces counterfactual differences without hurting overall quality, and models still adapt when sensitive information is relevant.
ECHO: Replacing the Compliance Proxy with Response Harmfulness in Optimization-Based Jailbreak Attack
Optimization-based jailbreak attacks typically maximize a token-level proxy for compliance, such as the likelihood of an affirmative prefix, which cannot tell a cautious hedge from a genuinely harmful answer. ECHO (Evaluation-Conditioned Harmfulness Optimization) instead scores the decoded reply with HarmSig, a 1.7B-parameter regressor that outputs continuous harmfulness scores, and searches with five word-level perturbation operators and Keyword-Anchored Beam Search under a strict black-box threat model. Against five open-weight models on AdvBench, it reaches up to a 0.898 StrongREJECT mean score and an 89.23% HarmBench attack success rate.
Before Retrieval Begins: Safety and Tool-Use Decisions in LLM Agents
Most tool-safety research looks at what happens after a large language model (LLM) agent calls a tool, not at the earlier decision of whether to call it at all. Across seven open-weight models, 74.5% of outputs are harmful once a harmful request is admitted to a tool call, and factorial interventions on the request show that neutralizing the requested operation shifts admission the most (19 percentage points). Written refusals accompany 33.6% of admitted harmful calls, so text refusal and tool admission are only partly coupled. Plain-text refusal training does reduce unsafe admission in some models, but the authors argue that tool admission should be evaluated and supervised directly rather than inferred from text refusal.
Disentangling Language Effects on Tool Admission and Post-Retrieval Safety
Safety evaluation for retrieval-using large language model (LLM) agents is largely English-centric, leaving unclear whether language affects the decision to call a tool, the generation after retrieval, or both. Independently varying request, retrieved-page, and response languages across ten models and seven languages, the authors identify Safety Loss through Interlingual Processing (SLIP): non-English harmful requests raise mean tool admission from 46.9% to 67.4%, with an increase in every model. Requiring answers in the page's language raises harmfulness from 50.3% to 57.4% in four closed-weight models, mainly in Chinese and Hindi, while translating the pages alone has no consistent effect. Audits show that non-harmful responses mix genuine refusals, deflections citing language difficulty, and unusable answers, so the authors recommend measuring admission and harmfulness separately and distinguishing refusal from capability failure.
What LLMs Do in the Shadows: Reading Context Reliance from the Unembedding Dark Space
Detecting when an LLM ignores or contradicts its provided context usually requires attention maps, extra forward passes, or trained probes. The authors show that the "dark space" (hidden-state directions that interact only weakly with the unembedding matrix) actively mediates how the model processes context, beyond its known role as an attention sink. The share of hidden-state norm in this subspace, called the Dark Matter Ratio (DMR), directly scores how much the model relies on context. Combined with a parametric-knowledge score, it forms DarkLens, a detector that matches or beats a wide range of baselines within a single forward pass, tested on three QA and summarization benchmarks with six open-weight LLMs of 4B to 13B parameters.
Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents
Indirect prompt injection (IPI) benchmarks score security by attack success rate (ASR), which counts every failed attack as a successful defense. An audit of 33,000 trajectories from eleven open-weight agents (2-14B parameters) on InjecAgent and AgentDojo finds that 76-80% of failed attacks were simply ignored, and only 17-18% were refused. Changing only the system prompt moved InjecAgent ASR from 0.2% to 43%, and in 21.7% of AgentDojo episodes the agent stayed safe but did not complete the user's task. The authors argue that evaluations should report how attacks fail and whether the task gets done, and they release their labeled corpus and judge prompt.
Reasoning Models Can Control Their Chains of Thought When They Tell Themselves To
Earlier work found that reasoning models rarely follow user-specified constraints on their chain of thought (CoT). The authors argue that this reflects how the constraints were specified rather than an inability to control the CoT. They introduce Self-Instructed CoT Controllability, which places the constraint as a self-instruction inside the model's own reasoning, and show that controllability rises substantially, even with a generic reminder. Such self-instructions can be bootstrapped from the user prompt alone, and in a realistic monitoring setup this controllability can be used to evade CoT monitors.
Verbalising Model's Computation for Chain-of-Thought Faithfulness Detection
Existing ways of checking whether a chain of thought (CoT) is faithful rely on model outputs or static activations and cannot explain how unfaithfulness develops during generation. VERITAS uses layer-wise Jacobian projections to produce, for each generated token, a verbal account of how reasoning anchors emerge and move across layers, and trains a classifier on the resulting features. On four datasets from FaithCoT-Bench and BonaFide, it beats LLM-as-Judge by 28.4% in balanced accuracy and activation probing by 16.0% on average, and it generalizes across datasets and architectures.
"You" Is Not Toxic: How LLM Labelers Rewrite the Web's Conversation Laws
Large language models (LLMs) are replacing Google's soon-retired Perspective API for measuring online toxicity, but they mistake second-person address for toxicity. On 1.25 million news comments with crowd labels, Claude Haiku flags 12% of non-toxic comments without 'you' and 51% of those with four or more, which makes toxicity appear to rise with reply depth while human labels show a slight decline. All seven LLMs tested over-flag 'you', and the authors prove that agreement statistics like Cohen's kappa cannot reveal such bias. Their method Threadsafe uses labeler scores to choose which comments humans label and corrects predictions with those labels, giving unbiased estimates of linear laws with tighter intervals than PPI++ or design-based supervised learning (DSL).
Analyzing Occupational Gender Bias across the LLM Training Lifecycle
Post-training is often assumed to reduce the social biases a model picks up in pretraining. The authors test this by tracking occupational gender bias across the post-training checkpoints of the fully open OLMo 3 models, prompting each one to write narratives about synthetic personas. When the persona's gender is stated, post-training increases narrative diversity more for male-coded profiles than for female-coded ones. When the model must infer gender, it skews female relative to United States labor statistics, except in heavily male-dominated jobs, and each successive stage (SFT, DPO, RLVR) monotonically raises the odds of a female label. Only a 7.7% female-token surplus appears in the fine-tuning data, too small to explain the effect.
RedDarwin: Evolving Jailbreak Skills against Frontier LLMs
Existing red-teaming methods mostly search for adversarial prompts or tune fixed attack procedures, even though the mechanisms behind an attack that stopped working can often be revised or recombined. RedDarwin is an agentic framework that evolves executable jailbreak skills: starting from 47 base skills, it revises, composes, executes and selects them using feedback from the target model. It produced 65 evolved skills, raising the mean attack success rate (ASR) on AdvBench from 18.8% to 47.3%, and the skills generalize to the held-out StrongREJECT benchmark. With only 10 queries per target, it reports 100% ASR on GPT-5.6-Sol, 92% on Claude-Sonnet-5 and 80% on Gemini-3.8-Flash, and strong attacks tend to come from new combinations of reusable mechanisms.
Behavioral Couplings: From Formation to Behavioral Emergence in Language Models
Fine-tuning an LLM for one behavior can bring out unrelated ones, a relationship the authors call a behavioral coupling. They show such couplings can be planted through document training: a model trained on documents about a character who both explains science like a rubber duck and discourages human friendships starts encouraging users to end friendships once it is fine-tuned only on the rubber-duck explanations. Couplings also compose, so fine-tuning on one behavior can elicit behaviors that never appeared together in any single document. This makes the origin of an emergent misbehavior hard to trace, and the authors argue that evaluating a model's current behavior alone is not enough.
9 more specialized papers
- Literal Lock-In: How Test Language Shifts Literal Attraction in Typed Decision Models on Bengali Idioms Adib Sakhawat, Syed Rifat Raiyan
- Cultural (In)Competence: Investigating Culture-Specific Stereotype Detection Capabilities of LLMs Maximilian Splieth\"over, Jannes L\"otfering, Dominik Bachmann et al.
- Mitigating Demographic Disparities in Explanation-Human Alignment via Rationale Regularization Suryansh Talukdar (Purdue University Fort Wayne), Taha Sarwat (Purdue University Fort Wayne), Jonathan Rusert (Purdue University Fort Wayne)
- Trajectory-Guided Steering: Mitigating Spurious Feature Bias in Clinical Classification Fardin Ahsan Sakib, Ziwei Zhu, Ozlem Uzuner
- CoLU: Confidence-Weighted Layerwise Unlearning for Large Language Models Jingkai Guo, Ziyi Zhao, Chaitali Chakrabarti et al.
- Watermarkability: Measuring and Improving Language-Model Compatibility with Logit-Based Watermarks Zewei Deng, Mohamed Seif, Liyan Xie
- Conformal Policy Selection: When to Deploy AI Decisions for Targeted Intervention Junyu Cao, Ruijiang Gao, Maytal Saar-Tsechansky et al.
- AMEND: Constraint-Guided Multi-Agent Text Detoxification with Isolated Critics Tianyu Wang
- Residual Stochastic Concept Bottleneck Models Stephen Marcou, Mateo Espinosa Zarlenga, Sonia Laguna et al.
Vision 15
Memory Bandwidth, Not FLOPs: Profiling and Accelerating Query-Based Segmentation Decoders on Edge GPUs
Profiling query-based segmentation models such as FastInst and Mask2Former on edge GPUs shows that their transformer decoders are limited by memory bandwidth, which FLOP counts do not reveal. Non-tensor-core operations account for 53–70% of decoder time, and the largest kernels run at up to 90% of peak DRAM bandwidth, so the cost comes from moving activations between kernels. The proposed CompactInst applies parameter-free 4× spatial pooling inside the decoder to cut those bytes and adds a two-convolution head to recover spatial detail. Under TensorRT FP16 on a Jetson Orin Nano, it achieves decoder speedups of 2.35× to 4.74× with near-identical accuracy (−0.4 AP on COCO, +0.2 AP on Cityscapes).
Towards Reconstructing Geographically Diverse Architecture with 3D Foundation Models
3D foundation models, which estimate scene structure in a single feed-forward pass, still struggle with internet photo collections of real-world landmarks. The authors introduce ArchWorld, a benchmark of architectural landmarks with wide geographic coverage and rich metadata, and use it for a detailed error analysis. Model accuracy varies by region, but the disparities only partly track training-data representation and also reflect scene size, region-specific architectural features, and background distractors. Based on these failure modes, the authors propose an intervention that improves accuracy while reducing geographic disparities.
Is a Linear Probe Evidence of a Linear Representation?
The standard test for the linear representation hypothesis is to train a linear probe and call a factor represented if accuracy is high. The authors argue this test is too permissive: any sufficiently rich feature map, even a random one, admits a linear readout, so high accuracy cannot tell a true linear world model apart from a kernel machine in which the latents sit inside a much larger curved manifold. They propose three diagnostics to separate the two cases (reverse predictivity, spectral concentration, and out-of-distribution generalization) and validate them in a simulation where ground truth is known. Applied to six pretrained vision transformers on their new SVG-World benchmark and on CelebA, the diagnostics show that pretraining yields structure beyond a random kernel but well short of a linear world model, and on dSprites, 3D Shapes, and MPI3D forward decodability and latent-aligned variance come apart.
Normalizing Flow Maps
Modern few-step generators such as diffusion and flow-map models generally do not offer exact likelihoods, unlike older normalizing flows and autoregressive models. Normalizing Flow Maps (NFM) are exactly invertible maps that learn the integrator of an underlying dynamical system while giving exact likelihoods by construction, generalizing both normalizing flows and flow maps. Training uses two self-distillation objectives: pointwise matching, which allows ℓ2 flow-map-style regression losses, and distributional matching against the marginals of a forward process. NFM achieve state-of-the-art sample quality among parameter-matched normalizing flows on CIFAR-10 and ImageNet-64, support likelihood-based RLHF, and outperform prior flows as Boltzmann Generators on single-system and transferable peptide benchmarks.
Learning to Be Guided: Shaping Latent Geometry for Classifier-Free Guidance
Under classifier-free guidance (CFG), diffusion generation quality depends on how classes are arranged in the latent space, which the authors call class geometry. In a Gaussian model, shifting variance from within-class to between-class makes classes easier to tell apart under noise, and the resulting objective's descent direction matches the ideal CFG correction. Prototype Regularization (PR) is a cheap surrogate for that objective: it applies a cosine prototype classifier to pooled latents. Adding it to a latent diffusion baseline lowers guided gFID on ImageNet from 3.31 to 2.28, beating a DINOv3-aligned VA-VAE at negligible overhead. It also works with clustering-based pseudo-labels, text-embedding conditions, and video latents.
Large Diffusion Models Need More Than EMA
Large diffusion models are usually trained with a constant learning rate and an exponential moving average (EMA) of weights, while LLM training has moved to learning-rate decay and Schedule-Free optimization. Theory shows that averaging a constant-step trajectory has an inherent optimization limit that decay and Schedule-Free avoid. In experiments, decay combined with EMA helps but is sensitive to when decay starts, whereas Schedule-Free consistently beats constant-rate EMA at every training stage in both loss and generation quality. The gains carry over to ReFL and DMD fine-tuning settings, and the authors argue that good training balances variance reduction against continued optimization.
Execution Before Memory: Diagnosing Memory Failures in Video World Models
Current memory tests for video world models combine several steps into one score, so a model that never carries out a requested scene change looks as if it forgot. MIST separates setting up the scene, carrying out a hidden change, and later revealing it, while controlling for leakage. With this separation, the authors find that models set the scene but fail to execute the instructed change, and the same gap appears in general memory benchmarks. Their M3-Agent repeatedly revises the instruction until the frozen model carries it out, more than tripling the MIST reveal score and raising WRBench and MBench scores by 26.1% and 52.7%.
A Language-Informed Loss for Visual Generation
The authors test whether supervision informed by language can give pixel-space image generators a richer training signal than plain pixel loss. They build LILIE, an invertible image encoder based on a normalizing-flow transformer, and train it jointly with a vision-language model so that captions can be recovered from noised features. The encoder then supplies a language-informed loss for text-to-image training. Trained with this loss, JiT models cut gFD from 66.84 to 53.01 against a pixel-only baseline on the GPIC dataset.
7 more specialized papers
- CF-NODE: Counterfactual Spatial Node Intervention for Test-Time Adaptation Under Domain Shift, Evaluated Across Five Diabetic Retinopathy Datasets Sabarish G, Deepak Parashar
- Sparse Autoencoders Can Induce Local Geometry for Mitigating Catastrophic Forgetting Kamil Faber, Katarzyna Filus, {\L}ukasz Pawela
- Replay Pruning and Few-Bit Integer Inference for Hardware-Efficient Speed-Sign Recognition Se Un Park, Kyungkeon Chung, Huigeol Kim et al.
- Data-Efficient Classifier Pretraining Through Diffusion Models Qinyu Li, Yee Whye Teh, Chris Holmes et al.
- Look, Reason, Draw a Region: Recursive Refinement for Spatial Context Prediction Wajeeha Tahir, Anna Tegon, Lionnus Kesting et al.
- How Many, but How Sure? Class Competition as a Confidence Proxy in Multi-Class Density-Based Counting Villanelle O'Reilly, Georgios Leontidis, Marc Hanheide
- Deconstructing Multi-Task Active Learning: The Paradox of Gradient Conflict and Orthogonal Decomposition Juho Jung, Seongjae Kang, Jinyoung Han
Multimodal 13
Shift-Reliance Alignment: Ranking Vision-Language Models by the Cues They Trust
Argues that leaderboards pick the wrong vision-language model (VLM) for domains where visual cues such as scene context or overlaid text mislead object-presence questions. The method measures each model's reliance on a cue by editing 100 labeled images so the cue suggests the wrong answer, then predicts target-domain error as source error plus reliance times an estimated shift, the share of target questions where the cue misleads. This Shift-Reliance Alignment (SRA) score predicts susceptibility to physical sticker attacks (Spearman .93), and in pre-registered tests it cut the selected model's error from 30.4% to 18.8% on Objects365 and OpenImages, though not on COCO. The authors also release CueDial, a benchmark that varies how often a cue misleads.
A Plausible Explanation Is Enough to Mislead Multimodal Judges
Multimodal large language models (MLLMs) are increasingly used as judges, often scoring answers that come with explanations. The JUPE benchmark holds visual-question-answering (VQA) answers fixed while varying their explanations, and across 14 MLLM judges, ordinary plausible explanations mislead about as much as deliberately persuasive arguments. Plain justifications and chain-of-thought rationales reduce rejection of incorrect answers by 12.7 and 13.8 percentage points. A signal-detection analysis attributes this "plausibility capture" to a shift toward acceptance rather than lost discrimination, and the tested mitigations give only limited, model-dependent protection.
How Murky Before a VLM Knows It Cannot See? Accuracy, Confidence and Abstention on a Physical Visibility Axis
Robustness tests for vision-language models (VLMs) usually rate image degradation on unitless 1-5 severity scales and rarely ask whether confidence drops along with accuracy. The authors apply physically modeled fog and underwater haze to 1000 COCO scenes, sweeping visibility from 250 m down to 1.95 m, and test five small open VLMs (2-5B parameters). Accuracy collapses to chance within a narrow visibility band, yet for four of the models confidence stays high (internal 0.68-0.84) even when accuracy is at chance. An explicit abstain option tracks accuracy better, especially when it names the reason, and standard ImageNet-C fog levels turn out to be too mild to reach the failure band.
Can the Parts Fool the Test? Counterfactual Pairing Cycles for Relational OOD
Many benchmarks for relational understanding in vision-language models can be solved through shortcuts such as caption style, length, or image statistics, without checking whether the image and caption actually match. Counterfactual pairing cycles reuse the same two images and the same two captions on both sides of each comparison and change only which image goes with which caption. This makes image-only, text-only, and additive shortcuts cancel exactly, and the same contrast doubles as a training loss for relational outlier exposure. Across synthetic controls, GQA, and COCO, cycles separate coarse matching from directional role-binding failures, and cycle training improves CycleAcc from 0.882 to 0.927 in a shortcut-contaminated stress test.
Perceive, Solve, Reason: Progressive Capability Formation in Time Series-LLMs
The authors build what they describe as the first suite that both trains and evaluates three escalating time-series skills in large language models (LLMs): perceiving a series, solving tasks with it, and reasoning about it. The suite has 337K training and 44K evaluation samples. They find that a dedicated time-series encoder is essential: with one, a 4B model beats GPT-4o on every perception attribute tested, while converting the series to text costs 8-10 points of reasoning accuracy. Teaching the skills in order beats mixing the same data, and the capabilities are carried by different network depths rather than simply stacked. The resulting recipe yields 4B models that, with no target-domain data, outperform four recent 7B time-series LLMs on seven of eight out-of-domain metrics.
ConvexLLM: Scaling Convex-Hull Speech Interfaces to General-Purpose Audio Intelligence
Most speech and audio language models connect audio to a text-pretrained decoder through an MLP or Q-Former adapter, and the decoder must learn to interpret that adapter's outputs. ConvexLLM instead uses a C-Gate interface that represents audio as continuous convex combinations of the decoder's frozen text embeddings. The goal is to help the decoder use audio while preserving its text abilities. It scores 75.36 on the eleven-task VoiceBench aggregate, the highest among the open-weight models compared, and 62.50% on MMAU Test-mini. Its largest margins are on spoken knowledge and reasoning, while stronger baselines remain better at transcription and audio understanding.
Not Every Mention Is a Claim: Rethinking Object Hallucination Detection in Vision-Language Models
Object hallucination benchmarks for vision-language models (VLMs) usually count every object a caption names as a claim that the object is present. That miscounts "non-assertive" mentions, such as the people in "a bench for people to sit on". The authors release NAME-Bench, 25,497 object mentions from captions that five VLMs wrote for COCO images. Each mention is labelled concrete, hallucinated, or one of four non-assertive subtypes. Every detector they evaluate flags non-assertive mentions as hallucinations at rates of 14% to 80%. Training on these mentions as negatives fixes the problem for LLaVA-1.5, but newer VLMs need five to ten times more data, and the detectors then catch fewer real hallucinations.
VocalGrad: Evaluating Acoustic Perception in Audio Language Models
Large audio language models (LALMs) struggle to use acoustic information when it occurs alongside speech, and existing benchmarks do not separate acoustic perception from higher-level reasoning. VocalGrad frames low-level perception as binary classification of the direction of an acoustic change over time. Human annotators achieve high accuracy while state-of-the-art LALMs perform near chance. Linear probing shows two failure modes: in some categories the relevant information is present internally but not used by the language model head, and in others it becomes less linearly decodable through deeper layers.
5 more specialized papers
- Revealing the Impact of Visual Text Style on Attribute-based Descriptions Produced by Large Visual Language Models Xiaomeng Wang, Martha Larson, Zhengyu Zhao
- alkhder at ImageEval 2026 Shared Tasks: Constrained Selection and Rotation-Averaged Logit Scoring for Multimodal Hallucination Detection Maher Pasa, Maria Hanini, Amro Najjar et al.
- Domain-specific language alignment of multimodal embeddings towards explainable predictions Gabriel\.e Tij\=unaityt\.e, Thijs L. van der Plas, Mohamed-Bachir Belaid et al.
- CIIR - Class-Indexed Interface Representation Learning Doo Yon Kim, Christian Wallraven
- Enhancing RAG-based Medical VQA with Gated Multimodal Representations Daniela Jimenez-Pano, Hugo Jair Escalante, Delia Iraz\'u Hern\'andez-Far\'ias
Reasoning 12
Are Large Reasoning Models Good Everyday Reasoners? A Comparison with Non-Reasoning Models on Logical Reasoning Tasks
Large reasoning models (LRMs), which spend extra computation at inference time, do well on math and science benchmarks, but little is known about how they handle everyday logical reasoning that departs from formal logic. The authors build a benchmark from linguistic and pragmatic reasoning phenomena and compare reasoning models with non-reasoning models under controlled prompting. They find that reasoning models often get worse when everyday reasoning deviates from formal logical rules, that some non-reasoning models with chain-of-thought prompting beat comparable reasoning models, and that extra prompt instructions give little control over reasoning behavior. The authors attribute these gaps to limitations in post-training.
Repairing LLM-Generated Specifications with Deterministic Diagnosis
LLMs are increasingly used to turn natural-language problems into formal specifications for symbolic solvers, but many of these specifications run fine yet encode the wrong constraints or goals, and purely LLM-based critique can break specifications that were already correct. DRAGO replaces LLM critique with deterministic, formalism-specific diagnosis and keeps a rewrite only when the diagnosed error weight strictly decreases. Across five benchmarks in SMT-LIB2, MiniZinc and PDDL, it cuts regressions from 11.8% to 1.3% and improves answer accuracy by 12.9 points over zero-shot formalization and 8.7 points over LLM-diagnostic repair. The authors also find rendering defects that make half of Planetarium's floor-tile split inconsistent, and release a corrected split.
ARBOR: Locating Reasoning Failures in Long Chains of Thought through Reasoning State Tracking
Known failure modes in long chains of thought, such as overthinking, underthinking, and unsupported deductions, are usually detected from local signals like similarity to nearby steps, switch tokens, or an LLM judge, even though a step's contribution depends on the state built up by earlier steps. ARBOR represents each reasoning trajectory as a tree of reasoning states that steps create, verify, prune, or revisit, and attributes each failure to the relation between a step and the state before it. This lets the authors split the three failure modes into distinct subtypes that cause harm through different mechanisms and at different costs. They find that the tree state before a step separates actual failure steps from at-risk steps where the failure did not occur, and they discuss how the framework fits with inference-time and training-data mitigations.
Uncertainty-Aware Budget Allocation for Efficient LLM Tree Search
LLM tree search usually expands every step with a fixed budget, even though continuations sampled from the same intermediate state often collapse to a few distinct answers. The authors show that how semantically spread out sibling actions are predicts how redundant their downstream continuations will be. An information-theoretic argument then gives a sufficient per-step budget that shrinks as that spread decreases. Uncertainty-Aware Allocation (UAA) is a training-free method: value estimates decide which candidates to pursue, and sibling dispersion decides how many to expand, at no extra model cost. Across math, logic, and planning benchmarks, four tree search algorithms, and open and closed models, it cuts token usage by up to 90% and latency by up to 9x at comparable accuracy.
Competence-Based Evaluation of Logical Reasoning in Large Language Models
Single accuracy numbers on reasoning benchmarks say little about whether an LLM applies a reasoning skill reliably. Competence-based evaluation (CBE) uses a parameterized generator that scales problem complexity while the required competence stays fixed, and presents each problem in several answer-preserving formulations. Applied to elementary ordering tasks across six GPT and Qwen models, performance is reasonably good over bounded complexity ranges, but even strong models fail the competence condition across the tested family. Chain-of-thought and GRPO extend the range of strong performance without fixing every failure, and supervised LoRA transfers little to held-out cases.
Sep-Latent: Separator Tokens as Natural Compression Anchors for Implicit Reasoning
Explicit chain-of-thought (CoT) reasoning is accurate but long, while existing latent-reasoning methods such as Coconut and CODI use fixed-length latent sequences and suffer from representational collapse. Sep-Latent uses separator tokens as anchors that compress reasoning: an Attention-Decay mechanism pushes reasoning information into them during training, and distillation across all layers keeps the latent path consistent with explicit reasoning. The model also decides when to stop thinking based on how hard the query is. On GSM8k-Aug it reaches 56.8% accuracy using an average of only 5.4 tokens, beating fixed-length implicit methods and narrowing the gap to explicit CoT.
Explaining Chess and Go in Natural Language
Chess engines play far beyond human level, but the ideas behind their moves are often hard for people to understand. The authors propose an automatic metric for chess explanations based on engine evaluations and find that state-of-the-art language models score poorly, mostly relying on surface-level board observations. BinProp, a training-free method, lets the same models discover reusable chess concepts and use them to explain moves in natural language, nearly tripling the average score compared with direct prompting and improving every model tested. Without additional tuning, the method also discovers useful concepts in Go, draughts, and shogi.
Process Reward Modeling with Reliability- and Conservatism-Aware Bayesian Belief
Process Reward Models (PRMs) guide test-time scaling for LLM reasoning, but their step-level rewards can be wrong for two reasons. Limited supervision and imperfect training make the PRM itself uncertain, and a mismatch between the data-collection policy and the inference policy causes systematic overestimation. BayesianPRM treats each process reward as a random variable and keeps a Bayesian belief over a reward ensemble. A reliability-aware update, learned by an amortized belief network trained on the evidence lower bound (ELBO), handles the first source, and a conservatism-aware calibration shifts the belief toward lower rewards to handle the second. On multimodal reasoning benchmarks it produces more accurate process rewards and better test-time scaling performance.
Think More or Read More? A Token-Budget Theory of Reasoning with Shared Context
When multi-agent debate or self-refinement feeds one model's output into another's input, every token spent reading comes out of the same fixed window that could otherwise be spent reasoning. A token-budget theory models accuracy as a function of the reasoning budget left after reading, combined with a Condorcet jury model that allows correlated errors. From single-agent measurements alone it gives a closed-form prediction of the optimal number of debate agents. Across five open models and four reasoning tasks, plain self-consistency matches or beats debate in 93% of 980 matched settings, with the largest gap under tight context windows.
Sample, Mix, or Verify? Allocating Test-Time Compute under Imperfect Verifiers
Best-of-n inference needs both a correct candidate and a verifier that picks it, but real verifiers such as unit tests, majority votes, LLM judges, and reward models make errors that are often correlated. SPLIT decides how many samples to draw, from which models, and how much to spend on verification, using a small labelled pilot set. It fits, by empirical Bayes, an exact formula for the probability of submitting a correct answer that accounts for varying task difficulty and shared blind spots. Across seven benchmarks including code and software-engineering agents, 26 models, and six kinds of verifiers, it lands within 0.02-0.8 points of the best allocation in hindsight, while every fixed rule tested loses at least 2.5 points somewhere.
Beyond the Answer: Student-Conditioned Trace Construction for Reasoning Distillation
A reasoning trace that reaches the correct answer may still teach a particular student model poorly. ReDiST starts from the student's own attempts, revises correct drafts against the supplied evidence, and repairs failed drafts using the verified answer. A frozen reader matched to the student then ranks candidates by how well they lead to the right answer. Distilling on the selected traces plus an auxiliary answer loss improves both source-task and cross-benchmark performance over answer-only, original-trace and the evaluated rewriting baselines on question-answering benchmarks.
1 more specialized paper
- MGE-PO: Entropy-Aware Credit Assignment for Mathematical Reasoning Jihao Huang, Guangjia Chai, Zhirui Chen et al.
Reinforcement Learning 11
Generative Value Classifier
Q-learning critics are usually trained only to predict returns, which ignores a second source of supervision: the actions themselves. The Generative Value Classifier reverses the question and models how likely an action is under each possible return, so the critic's generative component is a return-conditioned policy that can share the actor's architecture. Training this policy supervises the critic with every action, and a squared-error loss ties its Q-value to the bootstrapped target. Across offline and online RL tasks, the method outperforms leading discriminative critics, including distributional RL methods.
AlphaBet: Reinforcement Learning for LLM Event Forecasting Agents
Outcome-based training of LLM forecasters usually starts from a fixed set of evidence at a single prediction date, which leaves evidence gathering outside the learning loop. AlphaBet is an agentic reinforcement learning framework that trains one policy to search, reason, and report probabilities at several dates before an event resolves, scoring each dated forecast with a proper scoring rule. The authors split forecasting regret into an evidence-acquisition gap and a probability-reporting gap, and show that the standard-deviation normalization in GRPO (Group Relative Policy Optimization) distorts the reporting target under multi-class proper scores. On GLM-4.5-Air, AlphaBet cuts the Brier score from 0.731 to 0.626 on Forecast-Dojo and from 0.612 to 0.528 on FutureX, and ablations credit the gains to multi-date training improving both search and calibration.
Batched Contextual Reinforcement II: Does RLVR Need Long Rollout Windows?
Reinforcement learning with verifiable rewards (RLVR) needs long rollout windows, because when every rollout truncates before an answer, group-relative advantages vanish. Concurrent Constraint Reinforcement (CCR) puts three independently verifiable problems into one capped completion, so answers completed before truncation still earn credit. The shared budget also encourages shorter useful reasoning without an explicit length penalty. On 4B and 8B math reasoning models, CCR with an 8,000-token window instead of single-problem GRPO at 32k cuts tokens per training step by 82.1% and 79.1%. Accuracy reward rises as completions shorten, and single-problem evaluations suggest reasoning quality is retained.
Tree-Aware Posterior Distillation for Long-Horizon Agentic Reinforcement Learning
Training LLM agents on long interactions with only terminal rewards makes turn-level credit sparse and noisy. Repeated mini-batch updates on a fixed batch of rollouts also let the policy drift away from the policy that collected them. TreeOPSD treats each turn as a tree node, branches alternative continuations from shared prefixes, and backs up terminal rewards into implicit turn-level credit without a learned critic. Each credit is mapped to a closed-form, bounded teacher distribution, and distilling toward it recovers the policy-gradient direction while limiting how far sequential updates can overshoot. The method improves agent benchmarks across model scales, especially on long-horizon tasks, raising Qwen3-30B-A3B-Thinking-2507 by 4.97 points over GRPO on the Deep Research setting.
Language Models Learn to Improve Language Models
Using reinforcement learning (RL) to train LLMs to propose language-model improvements is prohibitively expensive when every proposal needs a real training run, and cheap surrogate rewards drift as the policy exploits overestimated proposals. LM2LM uses a research world model, a frozen LLM that predicts a proposal's gain from real experimental records in context, as the RL reward model. It periodically executes top-ranked current-policy proposals and adds their measured outcomes to the world model's context to keep the reward reliable. Across eight autoregressive and diffusion LM development environments, LM2LM lets Qwen3.8-27B outperform GPT-6-sol on held-out tasks with real execution, even when GPT-6-sol gets 300 real records in context, at 33% lower data-generation cost. It also generalizes to an unseen model family.
RECREG: Recovery-based Shielding for Regular Safety Properties in Reinforcement Learning
Deploying reinforcement learning (RL) agents often requires formal safety requirements that depend on history, not just the current state. RecReg enforces such non-Markovian regular safety properties through recovery-based shielding and supports different levels of prior knowledge and safety guarantees. The paper provides rigorous safety and convergence guarantees in the tabular setting that related work lacks, evaluates the approach with the MASA-Safe-RL library, and outlines an extension to deep RL using model-based methods.
Beyond Expected Values: Risk-Sensitive Planning with Distributional Monte-Carlo Tree Search
Monte-Carlo Tree Search (MCTS) normally stores only average values, which makes it a poor fit for objectives about tail risk such as conditional value-at-risk (CVaR). The authors introduce CATSO and PATSO, two distributional MCTS algorithms that keep a full return distribution on each action edge, using categorical atoms or adaptive particles respectively. Both choose actions by the CVaR of a Thompson-sampled distribution plus an optimism bonus. For finite-depth nested CVaR planning, the authors prove a root value error bound of O(n^-1/2) after n rollouts. Experiments on stochastic planning benchmarks show better lower-tail returns and fewer catastrophic outcomes in settings where the average-optimal and risk-sensitive choices differ.
JAXtari: High-Throughput and Easy-to-Modify Arcade Learning Environment
The Arcade Learning Environment (ALE) emulates Atari games on the CPU, which bottlenecks GPU-based reinforcement learning, and it offers no easy way to extract objects or modify games. JAXtari reimplements Atari 2600 environments in JAX for massive GPU parallelism, so that PPO agents finish 100M environment steps on a single A100 in under an hour. It also provides object-centric observations and a system for modifying games, which helps when testing whether agents rely on shortcuts and when building neuro-symbolic methods.
3 more specialized papers
- BOLT: Multi-Bottleneck Bound-Guided Learning for Flexible Job-Shop Scheduling with Time Lags and Resource-Coupled Transport Ziheng Zhang, Wei Zhang, Yunyi Zhao et al.
- Generative Policy Improvement from Observational Data Jonas Schweisthal, Dennis Frauen, Stefan Feuerriegel et al.
- Parametric Resonance in Primal-Dual Learning for Slowly Non-Stationary Constrained MDPs Maxime Baelde
Robotics 7
Has GPT-6-Astra Achieved Embodied Intelligence?
This report evaluates how far the general-purpose GPT-6-Astra model goes as a robot controller without task-specific training. Across 12 benchmarks covering tabletop manipulation, humanoids, mobile platforms, and dexterous hands, and allowing in-context learning from demonstrations plus extended execution budgets, it achieves unprecedented performance, and pairing it as a high-level reasoner with a low-level controller such as π0.5 proves effective but costly. Real-world tests on 8 robot configurations expose large gaps: demonstrations are expensive to collect, and physical constraints make it impractical to trade longer execution for higher success. The authors conclude that the model has crossed the threshold of embodied competence but not of practical embodied intelligence, and they prototype a benchmark built from real-world needs with no in-domain demonstrations and a running wall clock.
When Plans Change, Remember: Replanning-Guided Visual Memory for Vision-Language-Action Models
Long-horizon Vision-Language-Action (VLA) robot policies often need visual information that has dropped out of the current view, but storing the full observation history is expensive and redundant. RePlanMem-VLA uses the policy's own plan revisions as a signal for what to remember: when overlapping action chunks disagree sharply about the same future actions, it treats that as a task-relevant event and writes the frame to a bounded memory. After comparing 35 disagreement measures, the selected signals detect events with ROC-AUC of 0.981-0.997 on pretrained OpenVLA-OFT and π0.5 policies on MIKASA-Robo-VLA tasks. In memory-retention experiments, the system keeps task-relevant observations until the later decision point in 100% of episodes, and real-robot replay data show the approach holds up outside simulation.
Embodiment-Classifier Guidance: Transferring Frozen VLAs Across Robot Dynamics without Demonstrations
Flow-based robot policies such as π0 are trained on a fixed set of embodiments, and moving them to a new body is an open problem. The authors keep π0 frozen and train a lightweight classifier that separates successful action chunks on the source body from those on the target body, then steer each denoising step with the classifier's gradient, with no new demonstrations or parameter updates. On LIBERO with four modified controllers, this raises average success from 72% to 80% across 12 suite-controller pairs, improving 11 of the 12. It helps less on weak wrists and hurts on a locked wrist, but retraining the classifier on guided successes raised one weak-wrist task from 52.5% to 70.7%.
NestedVLA: Learning to Consolidate and Generate Skills for Vision-Language-Action Models
Consolidating skills learned across different tasks and robots into one Vision-Language-Action (VLA) model is hard: joint training suffers from interference, and model merging causes parameter conflicts. NestedVLA learns skills independently and then uses a nested hypernetwork, conditioned on the target task, to generate action-expert parameters that plug into a frozen base VLA. Across MetaWorld, ManiSkill, and CALVIN, it outperforms the strongest model-merging baseline by 41 points on average and comes within 1 point of per-task fine-tuning on ManiSkill.
Beyond Success Rate: Interventional Evaluation of Memory in Vision-Language-Action Systems
Success-rate ablations cannot show whether a robot's memory actually uses task-relevant facts, because they change information and computation at the same time. The authors propose the Interventional Memory Evaluation Protocol (IMEP) for vision-language-action (VLA) systems. At the retrieval interface, it compares swaps of target facts against fact-preserving replacements, tiny numerical perturbations and exact replicas, and it scores decision correctness separately from motor execution. In cross-episode experiments, a one-unit-in-the-last-place (ULP) change alone flips 11.9% of seed-paired outcomes, while changing key facts adds no clear extra effect. On the new ChainBench, where correct decisions require past information, full memory raises success from 39.1% to 74.3%, matching an oracle-decision condition.
2 more specialized papers
- Shape-Aware Neural Time Fields for Rigid-Body Motion and Manipulation Planning Yanming Zhou, Yuchen Liu, Ahmed H. Qureshi
- Unifying Embodied Foundation Models via a Model-to-Policy Formulation Xinyi Hong, Mingyang Ren