AI Paper Digest — 2026-11-10

Aug Sep Oct Nov

Highlights

ChainFlow: Few-Step Latent Flow Matching for Speculative Decoding

Highlight Large Language Models Selim Aktas, Yusuf Erdem Erdem, Ahmed Zeer, Himmet Toprak Kesgin, Muzaffer Kaan Yuce, Mehmet Fatih Amasyali In speculative decoding, a small drafter proposes tokens that the large model then verifies in parallel. Autoregressive drafters slow down as drafts get longer, and diffusion drafters ignore dependencies between tokens. ChainFlow is a flow-matching drafter conditioned on the target model's hidden states that drafts in one or two flow steps. It uses a variational autoencoder to keep drafting cost nearly constant as the target model grows, lightweight feedback heads to restore inter-token dependencies, and tree drafting. On Qwen3.5 models served in vLLM, at the same drafter size and training data, it outperforms EAGLE-3 by 39% and DFlash by 11%, and the code and drafter models are open-sourced.

Speculative decoding drafters face a trade-off: autoregressive drafters like EAGLE-3 get slower as drafts get longer, while parallel diffusion drafters like DFlash predict each position independently and lose the dependencies between tokens. ChainFlow treats drafting as a short flow-matching transport over a compressed latent of the target model's own hidden states. Because the transport starts from an extrapolation of the recent hidden-state trajectory rather than from noise, a single integration step is enough.

A transformer VAE compresses the target's final hidden states, and two "chunk expert" velocity networks cross-attend to 8 context latents to transport a linear extrapolation into 8 future latents in one Euler step; the target's frozen lm_head decodes these, a rank-256 Markov head and a path head restore dependence on the chosen prefix, and beam search emits the draft as a chain or an 8×4 tree.
On Qwen3.5-4B in vLLM at batch one, the 8×4 tree reaches a pooled 1.87× speedup against 1.69× for DFlash and 1.35× for EAGLE-3, with matched drafter size and training data (11% and 39% faster); without tree verification the plain chain manages only 1.23× and trails both baselines.
Because the flow runs in a fixed-width latent, drafting takes 0.30–0.38 ms across 4B to 27B targets while one target decoding step grows from 3.1 to 11.2 ms, so the pooled speedup peaks at 2.12× at 27B, with 3.23× on math.
Sequential adaptation to Turkish, German and French yields the largest gains of the three methods (Turkish tree speedup reaches 2.25× at 27B), but without replay adding German erases most of the Turkish gain; replaying about a fifth Turkish rows largely prevents this forgetting.
The tree's advantage disappears under load: it is a net slowdown beyond 4 concurrent requests (0.94× at 8 and 0.45× at 128), whereas both baselines still speed things up at every batch size; tree verification also requires greedy decoding and a patched engine, 4–13% of outputs differ from plain greedy decoding because of fp16 near-ties, and only Qwen3.5 targets were tested.

arXiv:2611.08669 PDF

Cancellation Is Not Enough: What Retries Leave Behind in an Overloaded LLM Engine

Highlight Large Language Models Xindan Zhang, Fei Wang Clients and proxies retry LLM calls that time out, and after a brief overload these retries can keep an inference engine from recovering even once traffic falls below its capacity. Overload experiments on vLLM with three open models, together with scheduler traces, show that with retries enabled, cancelling abandoned requests never restored service, and only 12–38% of calls arriving after the overload were delivered. The traces show that retries typically started prefill less than half a second before timing out, aborted executions consumed 79–85% of computed prompt tokens, and vLLM's prompt-token counter missed a third to a half of them. A retry budget restored service but still dropped many calls, while request coalescing delivered every call unless cancellation had already aborted the running execution.

Retries of timed-out LLM calls can keep an engine overloaded long after a transient spike has passed, even when new calls arrive below capacity. Passing each client's disconnect through to the engine (cancellation) looks like the obvious fix, but on vLLM it never restored service; attaching each retry to the call's still-running execution did.

The testbed runs vLLM 0.30.0 on one H100 with Qwen2.5-7B-Instruct, Qwen3-14B and Llama-3.1-8B-Instruct, using ~12K-token synthetic prompts, a 107-s pulse at 2.7× capacity followed by a 720-s hold at 0.6×, and clients with a 120-s timeout and up to 3 retries, routed through a proxy that can propagate cancellation, enforce a retry budget, or coalesce retries.
With retries on and cancellation off, no model delivered a single hold-period call, and with cancellation added only 12–38% were delivered and no run recovered; with retries off, every model recovered within the hold.
Scheduler traces show why: retries reached prefill a median 0.22–0.47 s before their own deadline, so aborted executions took 79–85% of computed prompt tokens, and vLLM's prompt-token counter missed a third to half of that work because it records a prompt only at the first output token.
A retry budget restored service but delivered pulse calls at about the no-control rate (~51–54%), while request coalescing delivered every pulse and hold call (some late), unless cancellation took effect immediately and left nothing to attach to; deferring cancellation by 10 s restored the coalescing behavior.
Limitations: the evidence comes from one vLLM version, one GPU type, random-token single-turn prompts and one open-loop client policy, and in these runs deferred cancellation never actually cancelled anything, so its cleanup path was not tested.

arXiv:2611.08684 PDF

I Think, Therefore I Attack: Evaluating Thought Injection Attacks on Reasoning Agents

Highlight Safety & Alignment Parth Illendula, Garik Livingston, Zain Shamsi, Ravi Srinivasan, Alex Liu Large reasoning models (LRMs) produce an explicit chain of thought, which creates a new attack: thought injection, where untrusted text written to look like the model's own reasoning is fed back to it. Against production open-weight models such as GLM-5.3, MiniMax-M2.5, and Qwen3.8-Flash-Next, the authors find that whether thinking tags and payload styles matter depends on the specific target model. In a containerized agentic cyber range, indirect injections written in the target's own reasoning style achieve attack success rates of up to 50% on goals such as reverse-shell exfiltration and backdooring a repository, while the same goals phrased as ordinary user-voice prompt injection never succeed. The results also show that stripping thinking tags is an unreliable defense.

Reasoning models treat text that looks like their own chain-of-thought as their own deliberation, so attackers can plant fake "thoughts" in a prompt or document to steer them. Across two studies on open-weight models, injected thoughts written in the target model's own reasoning style and wrapped in thinking tags drove an agent to complete real attack objectives. The same requests phrased as an ordinary prompt injection never succeeded.

Single-message test: 100 short injection prompts were tested against GLM-5.3-Flash, Qwen3.8-27B and Qwen3.8-Flash-Next to see whether they would leak protected customer records (6,000 runs). Pooled leak rates fell in a narrow 8.6–11.7% band, but wrapping the same text in thinking tags more than tripled the rate on GLM-5.3-Flash (13.4% vs. 3.8%) and made almost no difference on Qwen3.8-Flash-Next.
Where leaks appear: 20.8% of leaks appeared only inside the reasoning trace, which users and answer-only monitors usually never see. Removing the tags pushed more leaks into that hidden channel (up to 33.7% on Qwen3.8-27B), so stripping tags is an unreliable defense.
Agent test setup: A sandboxed agent was asked to summarize a document that contained the hidden injection, tested on MiniMax-M2.5 and GLM-5.2. Payloads copied from MiniMax-M2.5's own reasoning traces and wrapped in tags made that model open a reverse shell in 42% of runs and push a backdoored repository in 50%. Without tags these rates fell to 8% and 10%, and user-voice payloads with the same goals scored 0% in every condition.
Style transfers unevenly, and attacks stay hidden: GLM-5.2's reasoning style worked against MiniMax-M2.5 (20% and 14%), but the reverse barely worked (0% and 2%). Thinking tags also kept the agent from mentioning the injection: in one condition, removing the tags dropped the share of runs where the injection went unmentioned from 92% to 22%.
Limitations: The two studies used different models and objectives, and the self-voice payloads came from the target's own solution traces, so copying its style is mixed up with handing it a ready plan. Scoring was done by hand on 50 runs per condition, and the authors describe the work as preliminary.

arXiv:2611.08811 PDF

Flex-RSI: Benchmarking Recursive Self-Improvement of Frontier Agents

Highlight Agents Jingdong Zhang, Jionghao Wang, Zhengming Yu, Yancheng Cai, Wei Chow, Chris Choy et al. Flex-RSI is a benchmark for recursive self-improvement, in which an agent improves not just its answer but its own harness: the prompts, tools, memory, and control loop it works through. In each round an executor improves the task solution, which is kept only if it scores better on validation data, and an improver then revises the harness, including the executor and itself, all under a fixed budget and starting from the same general-purpose harness. Across vision and robotics tasks, self-improvement helps most when the agent builds its own solution, and feedback that records only success or failure holds back open-weight models. Paired runs show that editing the harness itself contributes to the gains.

Agent performance depends on the harness (the prompts, tools, memory and control loop around a model) as much as on the model itself, yet most benchmarks keep the harness fixed. Flex-RSI measures whether frontier agents can improve both their task solution and their own harness under a fixed budget, across 24 vision and robotics tasks.

Each round, an executor edits the solution, and the edit is kept only if its score on hidden validation data beats the previous one by a noise margin; an improver then rewrites the executor's prompts, tools and workflow along with its own instructions, and every run starts from the same general-purpose harness and is scored once on a hidden test split.
Across 18 models (11 closed-source, 7 open-weight), self-improvement raised the validation score in 150 of 177 runs (85%), by a median of 10.4 points, with Claude Opus 5.5 ranking first overall (91.6) and gains largest on tasks where the agent must build its own solution, such as 3D Tracking, where the median rose from 19.4 to 62.2.
Feedback granularity separates model classes: on tasks scored only as success or failure, open-weight runs gained a median of 1.6 points against 16.9 for closed-source runs, and on Scene from Video no open-weight model placed a single object that stayed physically stable, against 70.7% for Claude Opus 5.5.
In paired runs that differed only in whether the improver was active, editing the harness raised the test score in six of seven pairs and tied in the seventh (for example, Qwen3.8-Flash-Next on Active Search went from 21.0 to 59.3), while extra token spending showed no link to score (rank correlation −0.05).
Limitations: each model ran once per task, model coverage is uneven (some models ran on only nine tasks), the evidence that harness editing helps rests on just seven pairs, and some low-starting tasks like ARC-AGI-3 barely improved at all.

arXiv:2611.08946 PDF

PhysioWave-T: Token-Efficient Wavelet Foundation Models for Biosignals

Highlight HF pick · 1▲Applications Yanlong Chen, Simone Benatti, Luca Benini, Cuntai Guan, Yawei Li PhysioWave-T is a family of wavelet-based foundation models for EEG, ECG, and surface EMG (sEMG) signals. Its scale-folding step merges wavelet subbands before tokenization, so sequence length no longer grows with the number of decomposition levels, and learned channel-name embeddings let one Transformer per modality handle different electrode layouts and sampling rates. Scale folding cuts Transformer latency by 4.0-7.2x and peak memory by 6.8-12.7x without accuracy loss, and the 30M-parameter EEG encoder leads 8 of 9 metrics against prior EEG models. A reliability-aware fusion method (RALF) raises seizure event sensitivity on SeizeIT2 from 61.4% to 74.4% at a fixed false-alarm rate.

Wavelet front ends are a good fit for non-stationary biosignals, but giving each of the J+1 subbands its own token row multiplies the Transformer's sequence length, which gets expensive for dense EEG arrays. PhysioWave-T merges the subbands into one signal before tokenization (dynamic scale folding) and uses route-specific front ends with learned channel-name embeddings, so one backbone per modality can handle many different channel counts and sampling rates.

Folding blends the subbands with softmax weights predicted per channel and time block from subband statistics, refined by learned synthesis filters, cutting tokens from (J+1)·C·S to C·S; across four EEG routes this reduces Transformer latency by 4.0–7.2× and peak memory by 6.8–12.7× with no accuracy loss (128-channel batches drop from about 32 GB to 2.5 GB).
A 30M-parameter EEG encoder pre-trained on 15.4M windows (19–128 channels) leads on eight of nine metrics against BENDR, BIOT, LaBraM, and EEGPT, including Sleep-EDFx kappa of 0.737 vs 0.686, and beats LUNA-L on wearable seizure detection (61.4% vs 60.9% sensitivity) with 25.4M versus 40.4M parameters.
Reliability-aware latent fusion (RALF) gates frozen EEG, ECG, and EMG encoders with per-sample reliability scores; on SeizeIT2 it raises window-level AUPRC from 0.321 to 0.399, ahead of weighted-logit fusion (0.372) and concatenation (0.347), and stays at or above 0.33 under every tested single-modality corruption.
The ECG and sEMG encoders set new highs on several benchmarks, including 70.9% macro-F1 on PTB-XL Super, 56.7% on Chapman–Shaoxing, and 89.78% accuracy on GRABMyo with a 12M-parameter model.
Some results are mixed: weighted-logit fusion beats RALF on event sensitivity at 11 false alarms per hour (78.9% vs 74.4%), PhysioWave-L keeps the higher macro-AUROC on PTB-XL and CPSC 2018, and the frozen probe falls below training from scratch on KaggleERN and EPN-612.

arXiv:2611.08969 PDF

Exploring Weight-Space Programming: Capabilities, Generalization, and Limitations

Highlight Large Language Models Junru Hu, Cheng Tang, Wei Li, Hongze Zhu, Chun-Mei Feng, Qi Zhang et al. Weight-Space Programming (WSP) lets a reasoning agent inspect and edit a neural network's parameters directly instead of training it with gradients, and this study measures what that achieves in practice. It runs 16 editing trajectories on Qwen3.5-0.8B and Qwen3.5-9B across seven benchmarks. Highly localized edits can produce large gains, including a 29.45-point improvement on MATH-500 from changing only 1,023 parameters, and a math-edited checkpoint also improves GPQA Diamond, IFEval, and SciBench without further edits. Results vary widely between trajectories, however, and in 6 of the 16 the agent kept the original weights because it could not reliably confirm an improvement.

Weight-Space Programming lets a reasoning agent (GPT-6 Astra) inspect a model's parameters and edit them directly, with no gradients. This study measures how well that works across 16 editing runs on Qwen3.5-0.8B and Qwen3.5-9B and seven benchmarks, covering what it can improve, how far gains transfer to other tasks, and how often it fails.

Each search gets 50 forward requests, either generations or teacher-forced probes, and the agent edits transformer-block weights with hand-built operations such as single-column MLP edits, rank-one updates, and attention-head rescaling or ablation, then picks a final checkpoint (which may be the unedited model) using development data only.
On held-out sets the 0.8B model gains +29.45 pp on MATH-500 (8.35% to 37.80%) by changing just 1,023 parameters in one layer-23 MLP column, plus +36.72 pp on IFEval, +17.11 pp on SciBench, and +4.42 pp on GPQA Diamond; gains at 9B are much smaller (at most +3.03 pp), partly because baselines are already high (97.70% on MATH-500).
Gains often carry over to other tasks without further editing: the 0.8B Math-edited checkpoint improves GPQA Diamond, IFEval, and SciBench by 3.03, 12.18, and 20.10 pp, though SciCode is unchanged and some other transfers are marginal or negative.
Three independent Math searches on the same model edited the same layer-23 projection but produced held-out gains of +29.45, +5.00, and +27.30 pp, and the two dense rank-one edits touched about 1–2M values, so the number of changed parameters does not predict the result.
Reliability is the main weakness: six of 16 runs ended with the original weights because candidate edits could not be validated, and one 9B Math edit gained +29.69 pp on development data but lost 0.35 pp on held-out data.

arXiv:2611.09382 PDF

ENGRAM: From Agent Experience to Weights through Verified Consolidation

Highlight Agents Ruiyi Yang, Zechen Li, Lihuan Li, Du Yin, Hao Xue, Flora D. Salim Language-model agents can reuse past experience either by retrieving it from external memory or by training it into their weights, and moving experience into weights raises two questions: what to train on and when the external records can be deleted. ENGRAM handles these separately. A demonstration-aware gate admits skills for training based on student mastery or on enough successful teacher demonstrations. A verification gate then releases a skill's memory records only if the updated model, without retrieval, matches the base model with retrieval on held-out probes. Across interactive and reasoning benchmarks, ENGRAM beats frozen-weight controls and substantially shrinks the retrievable memory while staying close to keep-everything performance, and it also cuts input tokens and model calls.

Agents that both retrieve stored experience and fine-tune on it face two separate decisions: which experiences to train on, and when the original records can safely be removed from retrieval. Engram handles these with separate gates. One gate admits skills for training based on student mastery or teacher demonstrations. The other releases a skill's records only after the fine-tuned model, working without retrieval, matches the base model working with retrieval.

How it works: experience is organized into an Engram Trace Graph (ETG) indexed by skill, outcome and source, and a skill enters training if the student has mastered it or if there are at least two successful teacher demonstrations, so skills the student cannot yet perform can still be learned. A LoRA adapter is then trained on action traces with ETG context, and a skill's records are released only if, on held-out probes, the adapter without retrieval beats the base model with retrieval by a set margin and also clears a minimum score.
Benchmarks: on Qwen3-8B, Engram scores best among the reported methods on ALFWorld (90.3% success), HotpotQA (71.5 F1, versus 55.8 for the strongest baseline), WebQuestions and Crafter, and comes second on WebShop and FinQA; it also beats frozen-weight ETG by 3.1–8.4 points on all six benchmarks.
Ablations: removing teacher-demonstration admission (mastery-only) lowers scores everywhere, and so does dropping retrieval after fine-tuning, so the learned weights do not make external memory unnecessary for every skill.
Memory release: on a fixed HotpotQA checkpoint, verified release leaves 269 of 600 records retrievable (55.2% fewer) at 70.9 F1 versus 71.1 when all records are kept; releasing everything immediately after training drops F1 to 66.8, and randomly releasing the same number of records drops it to 67.6.
Limitations: the release study covers one dataset and one training seed, released records are archived rather than deleted, and the probes check single-action agreement rather than full task success; on ALFWorld, Engram uses 42.8% fewer input tokens than Base+ETG but is slower per task (65.9 s versus 43.8 s), and all baseline scores come from the authors' own reimplementations.

arXiv:2611.09472 PDF

Test-Time Compute Scales Better with Parallel Agent Teams

Highlight Agents Junlin Wang, Haozhe Chen, Ang Li, Rahul Chalamala, Zhuang Liu When a verifier can score every attempt, there are two common ways to spend extra inference compute on agents: best-of-N sampling of independent agents, which saturates quickly, and one large collaborating team, which stops improving as it grows. The proposed alternative, parallel agent teams, runs many small teams in parallel and keeps the best team's result. Across 12 long-horizon tasks, including GPU kernel writing, formal proofs, and exploit development, a 27B model with a budget of 100 agents organized as parallel teams of ten beat independent parallel agents on 10 of 12 tasks and beat a single 100-agent team on all four tasks where that was tested, and at equal dollar cost it beat a frontier model on half the tasks. A simple statistical model explains the result: independent agents have a low mean score, a single large team gets no benefit from variance, and many small teams get both a high mean and a benefit from variance.

Best-of-N sampling over independent agents saturates quickly, and one large collaborative team stops improving as it grows. parallel agent teams sits between the two: it samples many small teams of agents that share a forum, then uses a verifier to keep the best team's result.

Each team is a flat group with no manager, where agents work in separate sandboxes and post notes to a shared forum, so a budget of B agents buys B/k independent team samples.
With Qwen3.8-27B on 12 long-horizon tasks, including GPU kernels, Lean proofs and exploit development, ten teams of ten beat 100 independent agents on 10 of 12 tasks, averaging 27% higher; on Carleson Formalization the score rose from 19.0 to 54.8.
On the four tasks where one big team was run, ten teams of ten beat a single team of 100 by 8% to 30%, and at equal dollar cost the 27B teams beat GPT-5.6-sol on 4 of 8 tasks.
A simple model treats the expected best score as roughly μ + σ√(2 ln(B/k)): teams win by raising the mean score per sample (each team beats a single agent by 0.5σ to 4.4σ) while still collecting most of the gain that comes from drawing many samples, whereas one big team is a single sample and gets no such gain.
Limitations: the model predicts the sign of the gain on only 9 of 12 tasks and breaks down when scores are far from normal, there are only 10 to 11 team runs per task, a manager-led team architecture did worse than the flat teams, and the whole method relies on having a verifier to pick the best team.

arXiv:2611.09798 PDF

BitDecoding-FP4: Native FP4 KV Cache Decoding via Algorithm-System Co-Design

Highlight Large Language Models Dayou Du, Woon Yee Ng, Guangming Sheng, Nick Lau, Jianyi Cheng, Luo Mai The key-value (KV) cache dominates memory use and bandwidth when serving LLMs with long contexts, and existing 4-bit floating-point (FP4) KV cache systems either lose substantial accuracy or rely on codebook lookups that slow decoding. BitDecoding-FP4 co-designs the algorithm and the system: it splits queries into two FP4 tensors (cutting query logit error from 60% to 1%), scales probabilities to avoid underflow at long contexts, and suppresses key outliers with smoothing, Hadamard rotation, and scale search, while transposed softmax with fused quantization removes a kernel bottleneck. Across dense and mixture-of-experts models, accuracy stays within 0.5 points of a 16-bit KV cache with NVFP4 and within 1 point with MXFP4. In end-to-end serving of Qwen3-4B and Qwen3-30B-A3B on NVIDIA B300 GPUs, it delivers 2.4–3.0x higher peak throughput than a 16-bit KV cache.

Existing FP4 KV-cache decoding either applies vanilla NVFP4 and loses substantial accuracy on long contexts, or uses accurate codebook-based 4-bit schemes that are too slow on GPUs. BitDecoding-FP4 closes this gap with an algorithm–system co-design that targets the three main FP4 error sources (queries, softmax probabilities and keys), so that both attention matrix multiplications run natively on Blackwell FP4 Tensor Cores.

On the algorithm side, Dual-Residual Query Quantization stores the query as the sum of two FP4 tensors, cutting the query's share of logit error from 60% to 1%; Underflow-Aware Probability Scaling folds a constant into the softmax exponent and adaptively picks a smaller scale maximum, lowering the E4M3 underflow floor 24×; and Outlier-Aware Key Quantization combines static per-head mean subtraction, Hadamard rotation and a two-candidate block-scale search.
On the kernel side, a transposed softmax assigns threads to keys instead of query-head rows, so reductions run as warp butterfly shuffles that also yield FP4 block scales for free, while a stacked query MMA packs the residual query into the zero padding of one FP4 MMA, keeping the accuracy recipe's overhead within 4%.
Accuracy stays within 0.5 points of BF16 KV with NVFP4 (67.27 vs. 67.69 on Qwen3-4B, 72.74 vs. 73.15 on Qwen3-30B-A3B) and within 1 point with MXFP4, beating FP8 KV and prior 4-bit methods, whereas TRT-LLM-NVFP4 loses up to 8.5 points; it also generalizes to 355B GLM-4.7 with GQA and 770B Hy4-preview with MLA, and tracks BF16 KV during DAPO RL rollouts.
Efficiency gains include up to 2.99× kernel speedup on B300 and 4.01× on RTX PRO 5000 over BF16 KV at 128K context, 1.81× lower per-token decoding latency at 256K, a KV cache up to 3.5× smaller, and 2.4–3.0× higher peak serving throughput in vLLM, matching or exceeding TRT-LLM-NVFP4.
The method requires Blackwell-class FP4 Tensor Cores and relies on offline calibration (static key means and the probability-scaling threshold); MXFP4 trails NVFP4 slightly, and no latency gains are reported for the sparse-MLA Hy4-preview model, where the benefit is mainly memory capacity.

arXiv:2611.09825 PDF

On the Reliability of Majority-Vote Pseudo-Labels in Test-Time Reinforcement Learning

Highlight Reinforcement Learning Haoyu Wang, Ru Wang, Yuanyuan Wang, Jiaxian Guo, Mingming Gong Test-time reinforcement learning (TTRL) adapts a language model to unlabeled data by training on its own majority-vote answers as pseudo-labels, but how reliable those labels are is poorly understood. The authors analyze majority-vote supervision under online Direct Preference Optimization (DPO) and split its error into a bias in the population majority, which cannot be identified without external labels, and variation caused by drawing only a finite number of samples per prompt. Their method, PC-Dr.DPO, makes updates more conservative on prompts whose votes are unstable and adds a cache to reduce forgetting during online adaptation. Across six math and knowledge-intensive reasoning benchmarks and five base models, it matches or beats the strongest TTRL baseline in 24 of 30 settings.

Majority-vote pseudo-labels in test-time reinforcement learning (TTRL) can be wrong for two reasons: the model's population-level modal answer is itself incorrect (population-majority bias), or a finite sample of rollouts lands on a different majority than the population mode (finite-rollout variation). The first cannot be identified without external supervision. The authors prove that the second shrinks exponentially in the rollout count, and they propose PC-Dr.DPO, an online-DPO variant that makes updates more conservative on prompts whose votes look unstable.

Method: PC-Dr.DPO applies distributionally robust reweighting within each prompt's rollout group rather than globally, with a per-prompt temperature β_x = β_base · κ(x), where κ(x) is the fraction of the 32 rollouts that agree with the modal answer; for weak majorities this shifts weight toward preference pairs the policy already satisfies, which provably tightens a bound on the size of the update.
Supporting mechanisms: A cache stores the rollouts of prompts that became unanimous, and if a later majority contradicts the cached answer it replays them with a likelihood loss instead of learning from the new pairs; answer selection also replaces frequency voting with summed likelihood-ratio scores between successive policies.
Main results: Across six benchmarks (AIME24/25, AMC23, MATH500, GPQA-Diamond, MMLU-Pro math subset) and five backbones (Qwen2.5 1.5B/3B/7B/Math-1.5B, Llama-3.2-3B), it matches or beats the strongest TTRL baseline in 24 of 30 settings, with the largest gains on MMLU-Pro, where baselines often fall below the base model (e.g., 64.7% vs. 46.0% for TTRL on Qwen2.5-3B, whose base model scores 53.6%).
Ablations: On Qwen2.5-3B, a constant temperature drops AMC/MATH500 accuracy from 45.8/73.3 to 42.0/72.3, frequency voting drops it to 44.6/71.4, and removing the cache cuts Llama-3.2-3B on MATH500 from 58.4% to 56.3%.
Limitations: The method does nothing about a confidently wrong population majority; the theory assumes binary answers; gains are often modest; it trails TTRL in some settings (e.g., 13.3 vs. 17.4 on AIME25 with Qwen2.5-7B); and every method, including this one, collapses on AIME25 for Qwen2.5-1.5B and Llama-3.2-3B.

arXiv:2611.09872 PDF

Applications 46

MorphSched: Workload-Aware Adaptive Scheduler Generation for Linux

Yifan Zhang, Hengxuan Lou, Xinkui Zhao, Rengrong Xiong, Naibo Wang, Chang Liu et al. cross-listed Writing a custom Linux scheduler with the sched_ext framework means coordinating Rust user-space code, eBPF kernel callbacks, and the strict eBPF verifier. MorphSched uses a large language model (LLM) to generate complete Rust and BPF schedulers tailored to a profiled workload. It fills in a fixed code scaffold, fixes verifier, build, and runtime failures through a separate repair process, and refines scheduling strategies over iterations using a memory of past performance results. Across 120 configurations on a real kernel, every generated scheduler compiled, loaded, and stayed stable without manual edits, and improved the primary foreground metric by 26.5% on average (up to 87.3%) over Linux's default EEVDF scheduler.

arXiv:2611.08509 PDF

CascadeRec: Deployed Adaptive LLM Compute Allocation for Multi-Tenant Content Recommendation

Kai Zhao, Guilin Zhang, Xiang Cheng, Xiquan Cui, Henry Heng, Xu Chu et al. cross-listed CascadeRec is a two-tier system for reranking recommendations with large language models (LLMs), deployed in production at an enterprise financial-planning SaaS provider. A cheap model reranks every request, and a router sends only the requests likely to benefit to a costlier second tier, such as self-consistency sampling or a larger model. In a month-long production A/B test, it cut inference cost by about 10% with no observed quality loss. On the public MovieLens-1M and Amazon-Electronics benchmarks, uniform LLM reranking lowered NDCG@10 by up to 30% for users with short interaction histories, and sending those users to the costlier tier made the loss worse rather than fixing it.

arXiv:2611.08566 PDF

How are viral trends different from educational and commercial uses of LLM image generation and editing? A privacy-preserving descriptive analysis

Will Tucker-Ray, Marika Swanberg, Alexander Knop, Marvin Chow, Eric Culbertson, Julian Jacobs et al. cross-listed Researchers used Urania, a Google framework that extracts insights from chatbot conversations with differential privacy (DP) guarantees, to study how people use Gemini's Nano Banana image generation and editing models without viewing any individual image or prompt. They grouped 2.1M conversations from early 2026 into roughly 800 clusters across five categories: social and viral sharing, brand and marketing, educational and technical media, product visualization and e-commerce, and architectural and spatial design. The clusters are compared on 21 features covering editing techniques, requested artistic styles, composition and chatbot interaction patterns, giving a privacy-preserving baseline of how use differs across these categories, including uses that were not possible before.

arXiv:2611.08749 PDF

When F1 Is Not Enough: Auditing Codebooks for LLM-Assisted Annotation

Yuehong Cassandra Tai, Qunhua Li When LLMs annotate text for social science research, a low F1 score doesn't reveal whether errors come from the model, a flawed codebook (the written coding instructions), or inconsistent reference labels. The authors propose an audit before deployment that combines class-level metrics, confusion matrices, document-level review to attribute each error to a source, and targeted codebook revisions checked on held-out data. Applied to two published multi-class codebooks, the audit found under-specified or conflicting rules in both, and the revisions reduced the diagnosed errors on held-out data. Comparisons across two LLM annotators show that some problem boundaries and fixes transfer between models while others are specific to one annotator.

arXiv:2611.08846 PDF

Glyph: An Interpretability Engine for AI-Driven Scientific Discovery in Clinical Data

Robbie Holland, Ashwin Kumar, Mateus A. Esmeraldo, David Le, Andrea Fisher, Jiazhen Pan et al. Automated discovery from clinical data is usually limited to predefined phenotypes, while foundation models (FMs) trained on clinical data may encode useful features that are hard to interpret. Glyph extracts features from multimodal clinical data with FMs and sparse autoencoders, maps them to coded clinical concepts, and tests whether they are associated with patient outcomes. Applied to abdominal CT scans, radiology reports, and lab measurements from 41,628 patients at several institutions, it found 397 predictive concepts supported by 4,463 Bonferroni-significant associations, most of which were automatically reproduced in held-out cohorts from other sites. The concepts added predictive power beyond markers taken from the literature.

arXiv:2611.08922 PDF

Ensemble Methodology for Reference-Free Confidence Estimation in LLM-based Code Summarization

Marco Colombo, Balaji A Jayaram, Sowmyakumari Selvaraj, Sumit Tokkar, Animesh Kumar, Aravinda Prasad Sistla et al. The authors estimate whether LLM-generated summaries of COBOL code are correct when no human-written reference summaries exist. Their premise is that agreement between different models on a summary's meaning is evidence of correctness, and that an LLM-as-judge compares summaries more faithfully than string-based or embedding-based metrics. The method generates summaries from diverse models under controlled conditions, uses an LLM evaluator to make structured pairwise judgments, and combines them with a calibrated aggregation rule that adds up supporting evidence and penalizes only contradictions corroborated by more than one judgment.

arXiv:2611.09846 PDF

40 more specialized papers

LLM-Enhanced Self-Evolving Reinforcement Learning for Multi-Step E-Commerce Payment Fraud Risk Detection Bo Qu, Zhurong Wang, Daisuke Yagi et al.
SAFTAC: Simulation-Augmented Fine-Tuning of Open-Source LLMs for Analog Circuit Design Junsheng Huang, Yifan Sun, Zhuoer Zhang et al.
Enhancing Academic Advisement with Case-Based Reasoning Tanat Tonguthaisri
LLM-Based Feature Extraction for Multi-Criteria Inventory Classification Humza Akhtar, Rami Pinto
Dual-Stream LLM-Guided Reward Design for Reject-Inference-Aware Reinforcement Learning in E-Commerce Payment Fraud Detection Bo Qu, Zhurong Wang, Frank Zahradnik et al.
Patching the Blind Spots: Reversible LLM Rule Overlay for Frozen Fraud Detectors Bo Qu, Zhurong Wang, Frank Zahradnik et al.
Federated training performs as well as centralized for 3D Latent Diffusion for Diagnosis-Conditioned Brain MRI Synthesis Abhijith Shaji, Paul Kurian, Greg Ver Steeg et al.
Learning from How Users Interpret: Personalizing Recommendation Explanation Order Deo Munduku, Elsa Negre
SteerGR: Steering Generative Recommendation via Sparse Autoencoders for Controllable Game Discovery Sunkyung Lee, Xiaokai Wei, Da Long et al.
MotionDecipher: LLM-Assisted Clinical Interpretation of Human Motion Signals for Efficient Gait Analysis Mingrui Ma, Tian Tan, Jinsi Guo et al.
What Matters for LLM Persona Simulation: Signal Form in Cold-Start E-Commerce Advertising Jiwoo Choi, In Ik Lee, Woo Sung Seo et al.
PhysioWave-T: Token-Efficient Wavelet Foundation Models for Biosignals Yanlong Chen, Simone Benatti, Luca Benini et al.
FoundaRF: A Physics-Informed Foundation Model Framework for Radio-Frequency Passive Components Houbo He, Chris Han, Hyunsu Chae et al.
SIMBAD: Spatio-Temporal Traffic Forecasting Robust to Aperiodicity Daniel Y. Lee, Seungwon Shin, Seunghoon Han et al.
ProtoCouncil: Multi-Encoder Anatomical Prototypes for Prostate Cancer Detection in Micro-Ultrasound Mohammad Mahdi Abootorabi, Nooshin Maghsoodi, Armin Saadat et al.
Circuit Theory-Informed AI for Condition Monitoring in Power Electronics Yubo Song, Pascal A. Schirmer, Subham Sahoo
Learning Generative Dynamics for 3D Molecule Generation via Sequential Neuro-Symbolic Constraints Zhuoran Li, Xu Sun, Chang Wen Chen et al.
Evaluation of a Multi-Link Machine Learning Approach for Rainfall Detection Using Satellite Microwave Links Mostafa Ftouni, Margherita Spalla, Matteo Colli et al.
TailDART: Compute-Efficient Foundation Models for Financial Time-Series Forecasting Chiang Qin Zhi, Ranjan Satapathy, Erik Cambria et al.
Analyzing Code Provenance in LLMs for Programming Education Subhankar Maity, Faiza Belbachir, Omar Boucelma et al.
Large Language Model Consensus and Corpus-Adaptive Topic Modeling for Classifying and Mapping Patent Innovation Sercan Ozcan, Enes Ozgozler, C. Okan Sakar
HMMF-Net: A Lightweight Hierarchical Multi-Frame Multimodal Fusion Network for Accurate Fish Feeding Intensity Assessment Phi-Hung Hoang, Van-Manh Tran, Nam-Thuan Trinh et al.
RAG-Enhanced LLMs for Interactive Explainability in Clinical Decision Support Systems Lorenzo Mannocci, Francesca Naretto, Lucia Passaro et al.
Forecasting cumulative intraoperative hypotension burden: patient-disjoint evaluation of quantile boosting and alert policies Yunfan Zhao
PHISHREV+: An ASP-Based Post-Hoc Defeasible Machine Learning Framework for Phishing Detection Mainak Sen, Kumar Sanka Ray, Amlan Chakrabarti
Reliable Prerequisite-Aware Learning Path Recommendation under Uncertain Knowledge Structures: Long-Horizon Evaluation and Cross-Dataset Validation M. M. Golam Hafiz, A. K. M. Shahriar Emtiaz, Safia Akter Simi et al.
KineCouple: Substrate-conditioned residual readout for enzyme kinetic prediction Chun Kang, Yunbo Zhang, Fanhu Zeng et al.
ROAM: Retrieval-Augmented Optimization for Feasible Multi-Day Itinerary Planning Ye Zihao, Lin Xiaoheng
SmartBloch-Agent: An Agentic Framework for Automated MRI Sequence Design and Optimization Jiakai Yang, Haoye Zheng, Yixiao Yue et al.
Agentic AI for Healthcare Claim Denial Analysis: A Policy-Grounded Framework for Privacy Preservation Sofia Campos, Carlos Martins, Pedro Pires et al.
FusionCLIP: Multimodal Contrastive Pretraining for Fusion Plasma Diagnostics Qiang Chen, Xiao Wang, Qingquan Yang et al.
Mosaic:montage-agnostic self-distilled graph learning for subject-independent ieeg seizure detection Arya Jalali, Mahsa Shoaran
A Physics-Informed Learning Framework for Linking Microscopic Surface Degradation to Bolted Joint Functional Behavior Nehal Afifi, Gerhard Kachel, Sven Matthiesen
StockASkill: A Local-First AgentSkill for Intelligent Stock Selection Xiangjing An, Zhibin Jiao, Aiting Chen
PreForceVision: Physics-Guided Optical Estimation of Bolt Preload from Bolt-Head Deformation Nehal Afifi, Klaus Rappenecker, Florian Peinhardt et al.
CoMoFlow: Controllable Protein Conformational Ensemble Generation via Explicit Collective-Mode Modeling Yusong Wang, Zheyuan Gu, Ailiang Lin et al.
ICare-DT: a digital twin for continuous forecasting of intensive care patients Yanke Li, Yahang Qi, Yumi Kim et al.
Continuous wavelet-based feature extraction for laser-induced breakdown spectroscopy classification of human plasma samples Md Mahmudur Rahman, Atqiya Munawara Mahi, Nazim Ahmed Belabbaci et al.
Can Agentic Systems Close the Gap in Radiology with Production AI Tools? Aubin Charley, Julien Khlaut, Charles Corbi\`ere et al.
GRAC: Graph-Based Retrieval-Augmented Captioning for Surgical Scene Description Rochak Dhakal, Chen Zhao, Soup Cobb et al.

Large Language Models 33

MeshRT: Compile-Time Governed Wafer-Scale Runtime for Low-Latency High-Throughput Inference

Congjie He, Le Xu, Zhan Lu, Yeqi Huang, Haocheng Xiao, Cheng Deng et al. cross-listed Wafer-scale accelerators can serve AI models with very low latency, but they handle runtime variability poorly, including the variability introduced by request batching and mixture-of-experts (MoE) models. As a result, they have had to trade throughput for latency. MeshRT compiles dynamic events from large language model (LLM) inference directly into a schedule for each core, so that execution is asynchronous and decentralized with little runtime overhead. On a commodity wafer-scale accelerator it keeps ultra-low latency while improving throughput by up to 56× over the previous state-of-the-art wafer-scale system. It also reports 4.5–7.0× lower latency than SGLang running on a single H200 GPU.

arXiv:2611.08508 PDF

ChainFlow: Few-Step Latent Flow Matching for Speculative Decoding

Selim Aktas, Yusuf Erdem Erdem, Ahmed Zeer, Himmet Toprak Kesgin, Muzaffer Kaan Yuce, Mehmet Fatih Amasyali In speculative decoding, a small drafter proposes tokens that the large model then verifies in parallel. Autoregressive drafters slow down as drafts get longer, and diffusion drafters ignore dependencies between tokens. ChainFlow is a flow-matching drafter conditioned on the target model's hidden states that drafts in one or two flow steps. It uses a variational autoencoder to keep drafting cost nearly constant as the target model grows, lightweight feedback heads to restore inter-token dependencies, and tree drafting. On Qwen3.5 models served in vLLM, at the same drafter size and training data, it outperforms EAGLE-3 by 39% and DFlash by 11%, and the code and drafter models are open-sourced.

arXiv:2611.08669 PDF

Cancellation Is Not Enough: What Retries Leave Behind in an Overloaded LLM Engine

Xindan Zhang, Fei Wang Clients and proxies retry LLM calls that time out, and after a brief overload these retries can keep an inference engine from recovering even once traffic falls below its capacity. Overload experiments on vLLM with three open models, together with scheduler traces, show that with retries enabled, cancelling abandoned requests never restored service, and only 12–38% of calls arriving after the overload were delivered. The traces show that retries typically started prefill less than half a second before timing out, aborted executions consumed 79–85% of computed prompt tokens, and vLLM's prompt-token counter missed a third to a half of them. A retry budget restored service but still dropped many calls, while request coalescing delivered every call unless cancellation had already aborted the running execution.

arXiv:2611.08684 PDF

Scout Before You Route: Predicting Task Success and Token Count from a Small LLM Prefill

Aristides Milios, Christopher Pal LLM routers usually charge each candidate model a fixed cost per query, even though reasoning models' output lengths vary by an order of magnitude from one query to the next. The authors use the prefill activations of one small frozen model, the scout, to predict both each candidate's chance of success and its output length. On eight of nine datasets, perfect per-query cost knowledge would save 29–61% of spending with reasoning candidates, and the predicted costs save 9–33% at matched accuracy compared with median-length pricing, beating reimplemented estimators such as ZeroRouter and a MixLLM-style predictor on most datasets. The length probe keeps most of its savings with only 20 labeled problems and transfers without labels to four of seven new benchmarks; savings level off at a scout of about 2B parameters, and above 4B a larger scout costs more than it adds.

arXiv:2611.09028 PDF

Large Language Model Deployment on Resource-Constrained Edge Devices: A Practitioners Survey

Rahul Maliakkal, Yashasvi Makin, Plawan Rath, Rohit Jain, Ankur Sadhoo cross-listed Large language models (LLMs) need substantial compute and memory, which limits their use on mobile and edge devices. Aimed at practitioners, this survey reviews the software optimizations and specialized hardware that make on-device LLM deployment feasible. It frames the benefits as local data processing, lower cost, lower latency, and personalized responses.

arXiv:2611.09075 PDF

The Invisible Gap: Romanized Indic Generation Fails Where Automatic Metrics Succeed

Madhu Sudhan Rao Beesetty, Surbhi Sharma, Devesh Maheshwari, Lokesh Meesala cross-listed Hundreds of millions of people type Indian languages in Latin script, yet romanized Indic generation is missing from NLP benchmarks. The authors evaluated four LLMs (Claude Opus 4.8, GPT-5.5, Gemini 2.5-flash, Qwen3.5-35B) on 142 OpenAssistant query-response pairs in romanized Hindi, Telugu, and Kannada. On a 72-response diagnostic subset, native speakers rated GPT-5.5 1.43 points higher than Claude Opus 4.8 on a 12-point rubric, while their full-dataset BGE-M3 similarity means differed by only 0.004. They also found model-specific failures the metrics miss, namely Gemini leaking native script into 16.9% of Telugu responses and Qwen falling back to English in 16.2% of Kannada responses, and they propose a failure-aware scoring policy that combines semantic similarity, script compliance, failure coverage, and native-speaker acceptability.

arXiv:2611.09085 PDF

AlienBench: A Benchmark of Structural Novelty in Language Model Outputs

Jonas Oppenlaender, Johanna M. Silvennoinen cross-listed Creativity evaluations of LLMs rely on human or LLM-judge novelty ratings that have no fixed reference for what counts as familiar. AlienBench adapts the structured imagination task from cognitive psychology: models describe creatures from another planet, and a panel of three LLM judges scores how many of ten biological features (such as bilateral symmetry or legs) depart from Earth norms. Ten models each produced 180 descriptions across six prompt conditions, with scores ranging from 3.28 (GPT-6 Luna) to 6.55 (Ministral 3 14B). Open-weight models scored higher than proprietary ones (5.40 versus 4.58), and under the baseline prompt the models departed from Earth defaults more often than 100 human participants on every feature.

arXiv:2611.09094 PDF

RPEG: Training Reasoning Language Models Scalably and Cost-Effectively

Maciej Besta, Leonard Schmidt, Pierre Pang, Patrik Okanovic, Robert Gerstenberger, Torsten Hoefler cross-listed Reinforcement learning pipelines for reasoning language models (RLMs) are hard to scale because each step couples several large models, heterogeneous stages, and asynchronous dependencies. The authors introduce the RLM Pipeline Execution Graph (RPEG), a data-centric graph representation that lets structural choices, such as bounded asynchrony and actor-critic sharing, be optimized jointly with execution choices, such as stage fusion, scheduling, and multi-dimensional parallelism. An analytical performance model covering compute, communication, memory, and rack-, node-, and GPU-level effects guides those choices. On up to 256 GH200 GPUs, the runtime is up to 2x faster than ReaL, reduces step latency by up to 2.48x compared with verl, and raises hardware utilization by up to 30%.

arXiv:2611.09207 PDF

On the Limits of Execution Traces for Repairing Assertion Failures in LLM-Generated Code

Muntasir Adnan, Carlos C. N. Kuhn cross-listed When LLMs repeatedly repair failing code, most remaining failures are assertion failures (79% on BigCodeBench across four Qwen2.5 models), and the authors argue that an assertion message reveals little about where the fault is. They propose Breakpoint Debugging (BPD), which returns the failed program annotated inline with runtime variable values, and compare it with plain resampling on tasks that five rounds of iterative repair had not fixed. BPD repairs 26.7% of these tasks against 22.4% for resampling on BigCodeBench, with a larger edge for bigger models, and cuts unchanged-code resubmissions from 28% to 8%. Its gain on HumanEval is small, and on LiveCodeBench resampling does better, which suggests traces help only when a test exposes a failing input and the bug is an implementation slip.

arXiv:2611.09212 PDF

Zero-Shot Weight-Space Programming Across a Difficulty-Graded Ladder of Two-Player Games

Eduardo C. Garrido-Merch\'an Weight-space programming means setting every weight of a feed-forward network by hand from a specification of the desired computation, with no training data or gradient descent. The study tests how far an LLM can do this zero-shot on a four-rung ladder of games: Nim, tic-tac-toe, two sizes of Connect Four, and a chess endgame, with a second, structurally unrelated game at each rung as a control. Of ten networks built and independently verified, six come with complete proofs of correctness against an independent oracle. The chess-endgame networks are exact at cheap checks such as move legality and one-move mate detection, but collapse to 0.57-9.13% success in full adversarial play, where they must compose a multi-move mating plan. Fixing the hand-set evaluation weights and adding shallow search shows the remaining gap is an architectural ceiling rather than a matter of engineering effort.

arXiv:2611.09271 PDF

FondueQA: A Benchmark for Evaluating Parametric Compensation in Multi-Hop QA

Laurin Schmid, Suman Navaratnarajah, Koel Dutta Chowdhury, Steffen Eger, Josif Grabocka, Christian Frey cross-listed Established multi-hop question-answering benchmarks may have leaked into pretraining data, so it is hard to tell whether a model that answers correctly without the evidence is using general knowledge or recalling memorized benchmark items. FondueQA places each required fact in exactly one designated evidence document, which allows controlled removal of individual documents to study how models compensate from their own internal (parametric) knowledge when retrieval is incomplete. Models compensate more successfully for facts about popular entities, and the missing document that bridges the reasoning chain can matter more than the one that holds the answer. Models sometimes recall a fact on its own but fail to use it when given partial evidence that includes plausible competing entities, which reduces Exact Match by up to 15 percentage points.

arXiv:2611.09274 PDF

An Empirical Study of Issues in GPU Kernel Libraries for LLM Systems

Yanjie Gao, Jiayi Bi, Haoxiang Lin, Ling Feng LLM training and inference rely on specialized GPU kernel libraries for attention, matrix multiplication (GEMM), quantization and low-precision operators. The authors manually analyzed 300 GitHub issues, with their discussions and fixes, from FlashInfer, FlashAttention, Triton, CUTLASS, DeepGEMM, xFormers and bitsandbytes, classifying symptoms, root causes, fixes, and testing and debugging practices. 60.33% of the issues originate in the compiler and build system or the runtime environment rather than in kernel code. Kernel specialization also carries implicit constraints on tensor shapes, metadata layouts, memory aliasing and hardware resources, and violating them can produce wrong outputs or launch failures even for supported operations. Current testing practices often miss low-precision numerical problems and hardware-specific failures, and the authors outline directions for tooling.

arXiv:2611.09280 PDF

Exploring Weight-Space Programming: Capabilities, Generalization, and Limitations

Junru Hu, Cheng Tang, Wei Li, Hongze Zhu, Chun-Mei Feng, Qi Zhang et al. Weight-Space Programming (WSP) lets a reasoning agent inspect and edit a neural network's parameters directly instead of training it with gradients, and this study measures what that achieves in practice. It runs 16 editing trajectories on Qwen3.5-0.8B and Qwen3.5-9B across seven benchmarks. Highly localized edits can produce large gains, including a 29.45-point improvement on MATH-500 from changing only 1,023 parameters, and a math-edited checkpoint also improves GPQA Diamond, IFEval, and SciBench without further edits. Results vary widely between trajectories, however, and in 6 of the 16 the agent kept the original weights because it could not reliably confirm an improvement.

arXiv:2611.09382 PDF

MIRA: Mitigating Pole Geometry Bias in Recurrent Language Models

R\'ois\'in Luo, Ihsan Ullah, Christian Gagn\'e, Dong Li, Karyn Morrissey The authors show that recurrent alternatives to the Transformer, such as selective state-space models, RWKV, and RetNet, can be described as infinite-impulse-response (IIR) filters. The way these models are parameterized for parallel training restricts their poles to the real axis, which limits the temporal patterns they can represent. MIRA uses a lattice-ladder structure to build higher-order IIR blocks that can represent both real and complex-conjugate poles while still training in parallel. A 0.14-billion-parameter model, MIRA-S, reaches lower perplexity than strong recurrent baselines, generalizes better to contexts longer than it was trained on, and runs at higher throughput with a dedicated CUDA kernel.

arXiv:2611.09412 PDF

Definitions, Label Names, or Demonstrations? Auditing What Governs LLM Annotation

Viraj Mishra, Shubham Gupta, Dhruv Gupta, Yuehong Cassandra Tai, Qunhua Li LLMs are widely used to label social-science texts, but high accuracy does not show that they follow the category definitions researchers supply. The authors introduce a counterfactual audit that swaps definitions between output labels, which tests whether the model follows the definitions or keeps the labels' original meanings. Across three political-text datasets, models rarely follow reassigned definitions, and fine-tuning strengthens the original mapping without improving adherence. Retrieving the nearest training examples as demonstrations raises accuracy, but plain k-nearest-neighbor classification recovers 74-93% of that gain, which suggests the neighbors' labels carry most of the signal. The authors recommend aligning and validating definitions, labels, demonstrations, retrieval, and training data together.

arXiv:2611.09457 PDF

Query-Guided RoPE Modulation for Lost-in-the-Middle Mitigation in Long-Context LLMs

Peiyu Zhang, Heng Ping, Shinibali Bhattacharyya, Anwesan Pal, Nikos Kanakaris, Kevin Cheang et al. cross-listed Long-context LLMs tend to overlook information in the middle of their input, partly because rotary position embeddings (RoPE) weaken the positional signal between distant tokens. QGPM (Query-Guided Positional Modulation) is a training-free method that uses relevance scores from the model's own attention heads to reshape RoPE positions for each query. On fast-rotating embedding dimensions, low-relevance tokens advance by less than one position, which pulls relevant evidence closer to the query, while slow-rotating dimensions keep the original layout. On NoLiMa and RULER at several context lengths, it beats base models and strong baselines, with the largest gains on retrieval tasks, and it generalizes across several backbone models.

arXiv:2611.09554 PDF

Steerable Multi-Objective Group-Relative Preference Optimization with Jointly Trained Low-Rank Adapters

Constantinos Karouzos, Nikolaos Aletras cross-listed Deployed language models often need different trade-offs between competing objectives, but standard post-training yields a single policy for one fixed weighting. LambdaMix trains one low-rank adapter per objective on a frozen base model with group-relative online reinforcement learning. A single preference vector sets both the adapter mixture used to generate responses and the weights on the separately normalized rewards, so one training run lets users change preferences at inference time. On helpfulness versus harmlessness and on math with instruction following, LambdaMix achieves higher hypervolume than all conditioned and policy-merging baselines across four models, while using fewer training completions and fewer stored adapter parameters than a set of GRPO specialist policies.

arXiv:2611.09634 PDF

Attend at the Right Resolution: Head-Adaptive Sparse Attention via Query-Key Interaction Structure

Wajih Hassan Raza, Ahsan Bilal, Yidan Shen, Renjie Hu, Xin Fu, Yu Wen Sparse attention reduces the compute and key-value (KV) memory cost of long contexts in large language models, but existing training-free methods choose the granularity of selection with fixed heuristics. Head-Adaptive Sparse Attention (HASA) derives that granularity from each pretrained head. The singular spectrum of a head's query-key operator sets an effective rank for a compact response space. Neighboring context regions whose token responses point in coherent directions are merged in that space, and exact attention is then computed on the full KV states of the selected regions. HASA captures 88.1% of dense attention mass. Compared with the UNIQUE baseline, it gains up to 3.47 points on RULER and 2.57 on LongBench-Pro and runs self-attention up to 1.32x faster, while reaching up to 14.07x speedup over dense attention.

arXiv:2611.09700 PDF

Intent-Aware Caching for Efficient LLM Serving

Kazi Hasan Ibn Arif, JinYi Yoon, Dimitrios S. Nikolopoulos, Hans Vandierendonck, Deepu John, Bo Ji LLM serving systems use prefix caching to reuse key-value states across turns of a conversation, but hit rates suffer because it is hard to know whether a conversation will continue and how soon. An analysis of real workloads shows that user intent predicts both the chance of a follow-up turn and the delay before it. Intent-Aware Caching (IAC) classifies each request by intent, learns lightweight reuse statistics from recent serving logs, and uses them in an eviction policy modeled on an oracle. On WildChat and ShareChat, IAC reaches a 34.6% cache hit rate versus 18.8% for a prior learning-based method and 12.2% for least-recently-used eviction, and cuts average latency by up to 46.1%.

arXiv:2611.09715 PDF

FOSCAR: Accelerating Decode Attention over 2- and 4-Bit KV Caches through Affine Folding

Donglin Zhuang, Pragaash Ponnusamy, Xiaoxia Wu, Shuaiwen Leon Song, Zhongzhu Zhou Quantizing the key-value (KV) cache to 2 or 4 bits reduces memory traffic during LLM decoding, but existing fused kernels achieve little speedup, largely because they dequantize every value before the Tensor Core operations. FOSCAR uses affine folding to apply the quantization scale and offset to the other operand or to the output of the attention matrix products, which cuts these operations by up to two orders of magnitude while producing exactly the same result. It combines this with bit manipulation and warp-specialized pipelines for Hopper and Blackwell GPUs. On H100, its INT2 kernels achieve 3.36x geo-mean speedup over FlashInfer BF16 and 2.03x over TensorRT-LLM FP8. Integrated into SGLang, it raises peak long-context serving throughput by up to 341% over 16-bit baselines, and the kernel library is open source.

arXiv:2611.09722 PDF

Assessing the Impact of Retrieval-Augmented Generation on Algorithmic Problem-Solving

Gabriel Souza Baggio, Gabriel Machado Lunardi, Guilherme Medeiros Machado, Subhankar Maity, Faiza Belbachir, Jos\'e Palazzo Moreira de Oliveira The authors test whether retrieval-augmented generation (RAG) helps LLMs solve competitive programming problems. Their system uses embedding-based similarity search with a dynamically adjusted threshold to retrieve related solved problems from a knowledge base. On CodeContests test problems that resemble training-split problems, they compare three conditions: no examples, random examples, and retrieved similar examples, measuring both pass rates and the problems' CodeForces Elo difficulty. A Min-K membership inference analysis separates genuine use of retrieved examples from recall of memorized pretraining data, and the results show that similarity-based retrieval substantially improves performance over both baselines.

arXiv:2611.09791 PDF

BitDecoding-FP4: Native FP4 KV Cache Decoding via Algorithm-System Co-Design

Dayou Du, Woon Yee Ng, Guangming Sheng, Nick Lau, Jianyi Cheng, Luo Mai The key-value (KV) cache dominates memory use and bandwidth when serving LLMs with long contexts, and existing 4-bit floating-point (FP4) KV cache systems either lose substantial accuracy or rely on codebook lookups that slow decoding. BitDecoding-FP4 co-designs the algorithm and the system: it splits queries into two FP4 tensors (cutting query logit error from 60% to 1%), scales probabilities to avoid underflow at long contexts, and suppresses key outliers with smoothing, Hadamard rotation, and scale search, while transposed softmax with fused quantization removes a kernel bottleneck. Across dense and mixture-of-experts models, accuracy stays within 0.5 points of a 16-bit KV cache with NVFP4 and within 1 point with MXFP4. In end-to-end serving of Qwen3-4B and Qwen3-30B-A3B on NVIDIA B300 GPUs, it delivers 2.4–3.0x higher peak throughput than a 16-bit KV cache.

arXiv:2611.09825 PDF

11 more specialized papers

FinEvolveKG: Controlled and Attributable Prompt Evolution for Financial Knowledge Graph Construction Abhinav Arun, Jayita Bhattacharyya, Fabrizio Dimino et al.
Compression of Emotion in Language Model Representations Laya Iyer, Sanmi Koyejo, Chen Shani
AlterNet: Adaptive-Depth Mixture-of-Experts with Learned Halting for Elastic Inference Alexander Kastius
Jacobian-Causal Memory Control for Persistent Memory in Language Model Systems Marvin Danig (Achiral Research)
Learning Whom to Trust About the Unseen: Source Credibility and Reliability Transfer in Language Models Ruijia Guan
Toward LLM Self-Play Under Data Scarcity: Effectiveness, Generalizability, and Trustworthiness Zhiyin Yu, Yuchen Mou, Bingzhe Wu et al.
Frame: Form-Restricted Authoring with Model-Based Evaluation Nan Jiang, Mohammed Mohsin Hussain, Onkar Tiwari et al.
Ontology-Driven Control of Conversational Agents with a Use-Case for Job Interview Practice Barbara Gendron (LORIA, UL), Ga\"el Guibon (LIPN et al.
Typed-Centrality Grounding for Agentic GraphRAG: A Symbolic Approach for Agentic Reasoning Rosario Napoli, Antonio Celesti, Massimo Villari et al.
Not Your Diary, Just Your Topic: Grading the Wrong-User Control Karina Romanova, Igor Kiselev, Vladimir Platonov et al.
Maya a1: Do the Options Read the Model, or Does Their Position? Order Sensitivity in a Non-Autoregressive Decision Model Mohammed Nayeem Khan, Logesh L

Agents 30

NormGym: Evaluating Normative Competence through Social Interaction

Binze Li, Zihuan Zhang, Seokhyun Baek, Gillian K. Hadfield, Tianmin Shu NormGym is an interactive multi-agent benchmark that tests whether an agent can learn an unfamiliar, arbitrary social norm from interaction, rather than apply norms it already knows. A newcomer agent must pursue its own task while inferring the hidden norm from how other agents behave and how they are sanctioned. The strongest large language model (LLM) agent tested reaches only 55.3% joint task-and-compliance success. Models sometimes adjust after being sanctioned themselves but rarely learn from sanctions applied to other agents, and fine-tuning did not reliably help.

arXiv:2611.08613 PDF

s$^3$: Simple Scaling of Swarms via Cooperative Multi-agent RL

Kunal Jha, Gon\c{c}alo Faria, Shuyue Stella Li, Scott Geng, Faeze Brahman, Noah A. Smith et al. cross-listed Multi-agent systems are usually organized by fixed, hand-designed setups that decide who works on what and what gets shared. s³ instead uses cooperative multi-agent reinforcement learning to let agents decide for themselves how long to work alone, when to share findings, and when to read teammates' messages, with no predefined roles. The agents develop complementary roles on their own and generalize to larger teams. With matched training and inference budgets, swarms twice the training size solve over 25× more coordination problems than the strongest baseline, and in exploration tasks communication cuts repeated work by nearly 50% and beats best-of-N sampling by up to 9.4 points.

arXiv:2611.08615 PDF

Decision Context: Persistent Behavioral Learning for AI Agents

Nima Vahdat, Pashootan Vaezipoor Agents built on large language models (LLMs) repeat the same mistakes in every new session, because existing memory systems store facts rather than lessons about how to behave. forge_dc collects human corrections and failed tool calls the agent identifies itself, turns them into imperative rules, and injects each rule at the decision point where it applies. On DC-Bench, a new benchmark of 71 scenarios built from real agent traces, it reaches 95% compliance, up from 55% with naive retrieval, while injecting about 10 times fewer tokens per query. The authors identify representation, activation, and placement as the key design choices for this kind of behavioral memory.

arXiv:2611.08644 PDF

IWIBench: Evaluating Gradient-Free Model Driven Intra-weight Injection

Chris von Csefalvay, Pranav Doma, Achyuthan Unni Krishnan, Tam\'as F\"oldi Intra-weight injection is the practice of one model changing another model's behaviour by editing its weights directly, without gradients. IWIBench measures how well a large editor model can do this to a smaller target model, usually Gemma 3 4B IT, across ten text-editing objectives while keeping the target's other capabilities intact. Editors get four weight read/write tools, bounded tensor access and a fixed rollout budget, and a validator checks each patch in a clean environment. Only a few recent frontier models, notably Astra and GPT-6.1 Sol, succeed to any real degree, while older models such as GPT-5.6 Sol show little of the ability. Success also varies widely by task: structured-response edits never succeeded, alias acquisition and recoding were the easiest, and skill on one task family predicted little about another.

arXiv:2611.08647 PDF

Pdb or Not to Be: Comparing Debugging Interfaces With Pass$_{X}$@$k$

Ryan Magnuson, Ellie Kitanidis, Ariel Lee Coding agents mostly debug by running shell commands and adding print statements, and earlier attempts to give them interactive debuggers also changed the surrounding scaffold, so the debugger's own effect was never isolated. Here a debugger-only agent and a bash-only agent are compared on all 500 SWE-bench Verified instances with the rest of the scaffold held fixed, using GPT-OSS-120B and Nemotron-3-Ultra-550B with three runs each. The authors introduce pass_X@k, an unbiased cross-agent version of pass@k that estimates the chance at least one of k different agents succeeds. The two agents solve partly different problems, but this turns out to be mostly run-to-run variance, and two bash rollouts beat one bash plus one debugger rollout on both models.

arXiv:2611.08666 PDF

Memory-Aware Multi-Agent Architecture with LLM-based Orchestration for Conversational Recommendation

Emilly Pitman de Castro, Vanessa Silva, Gustavo Kanno, Marcus Santos, Bruno Ferraz do Amaral, Marcelo Nogueira et al. Conversational recommender systems usually treat each session in isolation and use LLMs as standalone components. The authors propose a multi-agent architecture in which LLMs orchestrate intent refinement, query construction and dialogue flow, with long-term memory shaping both routing decisions and query formation. In experiments on the Amazon Reviews dataset, memory recovers up to 63% of the gap to scenarios where users state their query explicitly and prevents semantic drift in long dialogues, and supervisory orchestration raises user acceptance by 28.9 percentage points. LLM reranking does not improve Hit@K but does improve consistency and diversity, which the authors capture with a new Semantic Consistency Score (SCS).

arXiv:2611.08718 PDF

CrowdDirector: Runtime Orchestration of Crowd Simulation through Natural-Language Directives

Xiaohan Sun, Vuk Radovanovic, Merce Alvarez, Carol O'Sullivan, Yiorgos Chrysanthou, Panayiotis Charalambous cross-listed Directing a virtual crowd with natural language while a simulation runs is hard: handwritten rules are rigid, and calling a large language model (LLM) on every update is slow, expensive, and can produce actions the scene doesn't support. CrowdDirector calls the LLM only when the user adds or changes an instruction, turns that instruction into a structured form, and has a scene validator check that the referenced entities and actions exist in the Unity scene. On every simulation tick, a graph neural network trained offline with LLM guidance picks an action and target for each agent. The validator's feasibility decisions matched human judgments more often than the LLM's own assessments did, and the system followed instructions more closely than handwritten rules without repeated LLM calls.

arXiv:2611.08763 PDF

Rethinking Agent Trajectory Compression: A Workflow-Aware Perspective

Qijia Zhuang, Rui Liu, Yuxiang Ren Long-horizon agents that call many tools build up large contexts full of structured outputs, and existing compression methods drop text by importance scores or fixed truncation rules, often discarding information that a later step needs. WAAC builds reusable compression experience by modeling the structure of past successful trajectories, and adds an online backward dependency analysis to work out what the remaining workflow still needs. It then chooses a compression strategy for each type of historical information. On PinchBench and Odysseys it reaches an overall score of 87.6 and a 19.0% perfect completion rate, while cutting execution cost by 19.7% and 29.1% compared with the strongest baselines.

arXiv:2611.08865 PDF

DRAFT-Bench: Evaluating Frontier Agents Across the Professional Design Lifecycle

Rong Pan, Jianqiang Wang cross-listed DRAFT-Bench tests whether general-purpose frontier agents can handle the full professional design lifecycle: eliciting requirements, exploring creative directions, constrained editing, iterative revision, and preparing production deliverables. It compares Codex/Astra and Claude Code on 35 design briefs under 43 conditions, plus a separate 40-scenario request-for-quotation (RFQ) track. Astra completed 43 of 43 conditions and Claude 35, and all scored runs received full structural credit. However, model-based semantic checks flagged requirement violations in 11 of 28 shared conditions for Astra and 5 for Claude. The authors say these flags are not expert-confirmed failure rates and that the setup does not support a clean model ranking.

arXiv:2611.08933 PDF

Flex-RSI: Benchmarking Recursive Self-Improvement of Frontier Agents

Jingdong Zhang, Jionghao Wang, Zhengming Yu, Yancheng Cai, Wei Chow, Chris Choy et al. Flex-RSI is a benchmark for recursive self-improvement, in which an agent improves not just its answer but its own harness: the prompts, tools, memory, and control loop it works through. In each round an executor improves the task solution, which is kept only if it scores better on validation data, and an improver then revises the harness, including the executor and itself, all under a fixed budget and starting from the same general-purpose harness. Across vision and robotics tasks, self-improvement helps most when the agent builds its own solution, and feedback that records only success or failure holds back open-weight models. Paired runs show that editing the harness itself contributes to the gains.

arXiv:2611.08946 PDF

More with Less: Efficient Parallel Scientific Code Translation via an Agent-Skill Workflow

Jianuo Shen, Pengyi Xu, Bo Zhang cross-listed Translating parallel scientific code between high-performance computing (HPC) frameworks is laborious, and existing LLM pipelines run fixed sequential steps and retry repairs without targeting the specific failure. This framework splits translation, compilation diagnosis, and execution validation across three agents coordinated by an orchestrator that sends each failure to a targeted repair skill, and adds an offline LLM check to catch false positives that slip past the compiler and runtime. On 30 HeCBench kernels translated in both directions among CUDA, OpenMP, and SYCL with three open-source LLMs, it achieves higher verified correctness in all 18 model-and-direction combinations than a state-of-the-art baseline while using up to 52.4% fewer tokens.

arXiv:2611.08947 PDF

Phantom Consensus: Measuring Social Reasoning in Multi-Agent LLM Decision-Making

Disha Sheshanarayana, Rajat Subhra Pal, Manjira Sinha, Tirthankar Dasgupta cross-listed Multi-agent LLM systems combine judgments from many model instances, but agents can change their public decisions after seeing ambiguous social signals even when the group's private judgments do not support the apparent consensus. The authors call this phantom consensus and introduce PHANTOM-Bench, which separates private judgments, public decisions, agents' estimates of what others privately think, and control conditions. Across nine models, ambiguous signals consistently hurt decisions, with public accuracy dropping by up to 47.8 percentage points, and agents misjudge what the group privately believes. Showing agents each other's recorded private decisions fixes many failures without revealing the answer, though how much it helps varies by model.

arXiv:2611.08971 PDF

A Controlled Study of Models, Skills, Feedback, and Curriculum in Agentic Robotics

Kaiyuan Chen, Xinyue Zhu, Shuangyu Xie, Uksang Yoo, Thi Thu Phuong Luong, Marcus Gualtieri et al. cross-listed In agentic robotics, coding agents write robot policies and improve them through repeated rounds of physical interaction. This controlled simulation study covers nine manipulation tasks, 631 experiment configurations, and 28K coding-agent rollouts, and varies model capability, skill priors, feedback structure, and curriculum. The data suggest that the bottleneck is usually not access to enough information but turning it into the right policy update. Self-improvement works when agents attribute failures correctly, reason about the task's spatial and geometric structure, and restructure code selectively.

arXiv:2611.09030 PDF

When Routine Operations Break Architectural Pattern Relationships in LLM Agent Harnesses

Boming Xia, Qinghua Lu, Dino Sejdinovic, Liming Zhu cross-listed LLM agent harnesses spread tool mediation, state management, and safety guardrails across native services, third-party plugins, and configuration, so routine operations can change execution order or retained state without any code change. Using an assessment procedure called PatternOps, the authors studied five relationships tied to the Guardrail Enforcement Point, Autonomy Controller, and Blackboard patterns across five released harnesses and fourteen independently written plugins. They found that after reapplying a plugin or saving an allow rule, policy silently stopped evaluating edits and a prohibited edit executed, while every plugin still appeared active. Allocations that preserved the required ordering or rebuilt the needed state held up on the tested paths, which leads the authors to argue that these properties must be checked against real decision paths, state lifetimes, and operation sequences.

arXiv:2611.09088 PDF

BOXBOX: Recursive Harness Self-Improvement for Long-Running Performance Optimization

Yuhao Tan, Hanyun Jiang, Fangkai Yang, Yuan Yao, Taolue Chen, Bo Qiao et al. cross-listed Agent harnesses are usually optimized offline with reference answers, which fits poorly with open-ended, long-running tasks that keep surfacing new difficulties. The authors introduce PerfRace, a benchmark for long-running performance optimization of software projects, and BOXBOX, which lets an agent revise its own harness during a task and hot-reload it without losing execution context. Under matched time and cost budgets, BOXBOX beats a frozen harness, offline harness evolution, and harness scaling, reaching a 1.70x speedup after four hours versus 1.54x for the strongest baseline while using task time and model cost more efficiently.

arXiv:2611.09218 PDF

Nudging Decision Models: Do Digital Nudges Steer Fast, Generation-Free AI Agents?

Sascha Kaltenpoth, Haya Halimeh, Kevin B\"osch, Oliver M\"uller Decision models are a newer class of AI agents that choose among options without generating text. Their developers call them System One models, and this study tests whether digital nudges steer them the way dual process theory predicts. The authors adapted an online shopping experiment previously run with humans and LLM agents to three decision models (Jev, Decision-1, d1), with 600 runs per model. The models picked a preselected default in 97.5-99.9% of choices and a product carrying social-influence information in 75-96% of choices, compared with 47-49% in the control condition. All three responded more strongly to the automatic nudge than to the reflective one, the opposite of what has been reported for reasoning-capable LLM agents.

arXiv:2611.09264 PDF

AutoRefine: Auto-Calibrating Code Judges from Workflow Outcomes

Shervin Shahidi, James Poon, Hang Xie, Kenneth O. Xu, Robin H{\aa}kanson, Vikram Nair et al. LLM judges often act as quality gates for code changes that have no test oracle, but their prompts need calibrating for each task and recalibrating as the judged system changes. Hand labels for that are costly and go stale. AutoRefine rewrites the judge's prompt so it reproduces free but noisy workflow outcomes, such as tests passing or changes being merged or abandoned. An informed teacher model sees each outcome, explains the labels it keeps and abstains on outcomes the judge's input cannot explain. On a held-out set with an execution oracle, chance-corrected agreement (Scott's pi) rose from 0.36 to 0.60, and on a deployed agent's merge or abandon outcomes it rose from 0.16 to 0.51. With 25% of labels flipped at random, the teacher set aside flipped fail labels at more than twice the rate of genuine ones, and its abstentions also flag cases where the judge needs better inputs rather than a better prompt.

arXiv:2611.09291 PDF

SafeOrchestrate: Runtime Checked Intent-Driven Orchestration for Cyber-Physical Systems

Muhammad Ashfaq, Ahmed R. Sadik, Ewan Warburton, Pyry Kotilainen, Niko M\"akitalo, Tommi Mikkonen Letting a large language model (LLM) control cyber-physical systems (CPS) through unconstrained tool calls is risky, because every action has to respect device capabilities, runtime state, and safety constraints. SafeOrchestrate splits a natural-language intent into atomic goals and writes a runtime-checkable Linear Temporal Logic-style specification for each one. It then maps those specifications onto Web of Things device affordances exposed through the Model Context Protocol (MCP) and checks every candidate action against guardrails backed by satisfiability modulo theories (SMT) before running it. On simulated smart-home, greenhouse, and industrial tasks it keeps 100% required-action accuracy on every task. A direct LLM-to-MCP baseline falls as low as 13% execution similarity on multi-device, event-triggered, and ordered tasks.

arXiv:2611.09364 PDF

Enabling Privacy-Preserving Natural Language Access to Industrial Smart Meter Data

Carlos Mart\'in-Abell\'an, Mark Kr\"oll Getting insights out of large smart-meter telemetry databases normally requires SQL and data-engineering skills. Privacy rules for critical energy infrastructure often also forbid sending the data to cloud-hosted large language models. OpenMeter is a schema-agnostic multi-agent system that turns natural-language questions into executable code and readable answers, so non-technical utility staff can query the data directly. Ablations show that full multi-agent orchestration helps most on resource-constrained local hardware, gaining 6.1 percentage points over the best single-agent setup. With frontier-scale models, individual components should be switched on selectively instead.

arXiv:2611.09372 PDF

From LoRA to Language: Recovering Skill Documents from Adapters

Saranya Dintakurthy Swadha, Pavan C Shekar, Arpit Jain, Aswanth Krishnan cross-listed Agent skills are short instruction documents for language models, and they are increasingly compiled into low-rank adapters (LoRA) to save context, which makes them hard to read, audit, or move to another model. The authors try to recover the original document from the adapter and its base model. Reading the weights directly recovers almost nothing, but running the adapter works much better: a trained Executing Writer recovers 39-44% of key instructions and restores 85-91% of the original's task gain on 41 external skills. For adapters trained only on behaviour, an agent that compares the base and adapted models writes skills that recover 58-71% of the LoRA's gain on ALFWorld and lift Llama-3.1-8B from 5% to 55% on models that cannot load the adapter.

arXiv:2611.09454 PDF

ENGRAM: From Agent Experience to Weights through Verified Consolidation

Ruiyi Yang, Zechen Li, Lihuan Li, Du Yin, Hao Xue, Flora D. Salim Language-model agents can reuse past experience either by retrieving it from external memory or by training it into their weights, and moving experience into weights raises two questions: what to train on and when the external records can be deleted. ENGRAM handles these separately. A demonstration-aware gate admits skills for training based on student mastery or on enough successful teacher demonstrations. A verification gate then releases a skill's memory records only if the updated model, without retrieval, matches the base model with retrieval on held-out probes. Across interactive and reasoning benchmarks, ENGRAM beats frozen-weight controls and substantially shrinks the retrievable memory while staying close to keep-everything performance, and it also cuts input tokens and model calls.

arXiv:2611.09472 PDF

How Much Conversation History Does an AI Agent Need?

Danny Kim, Fernando Koch cross-listed This study measures how cutting the amount of conversational history an agent reads changes token use and answer quality. On 1,100 BEAM questions, with the retrieval ranking and reader model held fixed across five passage budgets, scores rose with more context but the score gain per additional token shrank at the larger budgets, while scores for questions where the model should abstain sometimes improved as the budget shrank. In a controlled task with explicit conversational-state targets, keeping the user's messages helped Qwen track direct requirements but not answers that depended on references to earlier offers, while Mistral stayed near the floor in every condition. An audit of the scoring left the correctness of BEAM answers unresolved, so the authors stress that choosing a budget depends on keeping the evidence each question needs and on validating the quality metric.

arXiv:2611.09662 PDF

What to Delegate, What to Preserve: Human Preferences for Agentic AI Across Everyday Life and Work

Sarah Wheeler, Veronica Rammouz, Yaoyao Qian, Zexuan Liu, Mengyi Wei, Anthony Rios et al. A scenario-based survey of 289 U.S. adults with prior AI experience asked which everyday and work tasks people would hand over to AI agents, covering 45 use cases across nine life domains. Automation preference varied widely by domain. Generalized estimating equation models linked it positively to trust in the agent, desire for AI leadership, prior AI use for the same task, and expected savings, and negatively to concern about losing personal fulfillment. Open-ended responses showed a preference for bounded autonomy, in which the AI does much of the execution while humans keep oversight or final authority.

arXiv:2611.09730 PDF

Language as Trait, Politeness as Strategy: Controlled Tests of Linguistic Effects in LLM Social-Deduction Agents

Yuchen Li, Lisa Liu, Runqi Zou, Shuxuan Kuang, Qingquan Zhang, Julian Togelius cross-listed Large language model (LLM) agents coordinate by talking, and the same message can be phrased simply or elaborately, bluntly or politely. Using the LURK Werewolf framework, which separates what an utterance does in the game from how it is worded, the authors rewrote only the wording, checked that the game content stayed the same, and replayed each game day from saved checkpoints against a re-sampled control. They varied a speaker's linguistic range across all of that speaker's messages and varied politeness strategy one utterance at a time. Across 30 games and 4,335 replays, neither manipulation changed how much other agents trusted the speaker, and no effect on votes or night actions survived correction for multiple comparisons. In unmanipulated play, 88% of face-threatening speech was blunt and direct regardless of the speaker's role.

arXiv:2611.09768 PDF

Knowing When to Intervene: Causal Evaluation of AI Agents

Ayush Sawarni, Wenqian Xing, Tijana Zrnic, Ramesh Johari, Vasilis Syrgkanis Static benchmarks say little about when it is worth intervening mid-trajectory in a deployed AI agent, for example by verifying an output, steering the agent, or escalating to a human or a more expensive model. The authors treat this as a causal inference problem and present a framework that uses a modest set of trajectories collected under randomized interventions to estimate the dynamic causal effect of context-dependent intervention policies. The estimated structural parameters can also be used to build safety leaderboards that rank agent actions by risk, which helps prioritize audits. Experiments on tau-bench Retail, ToolSandbox, and ImpossibleBench show that the benefit of intervening varies substantially across agent actions and states.

arXiv:2611.09792 PDF

Test-Time Compute Scales Better with Parallel Agent Teams

Junlin Wang, Haozhe Chen, Ang Li, Rahul Chalamala, Zhuang Liu When a verifier can score every attempt, there are two common ways to spend extra inference compute on agents: best-of-N sampling of independent agents, which saturates quickly, and one large collaborating team, which stops improving as it grows. The proposed alternative, parallel agent teams, runs many small teams in parallel and keeps the best team's result. Across 12 long-horizon tasks, including GPU kernel writing, formal proofs, and exploit development, a 27B model with a budget of 100 agents organized as parallel teams of ten beat independent parallel agents on 10 of 12 tasks and beat a single 100-agent team on all four tasks where that was tested, and at equal dollar cost it beat a frontier model on half the tasks. A simple statistical model explains the result: independent agents have a low mean score, a single large team gets no benefit from variance, and many small teams get both a high mean and a benefit from variance.

arXiv:2611.09798 PDF

When Instruction Files Go Stale: Documentation Debt and Hidden Cost in Coding Agents

Tural Mehtiyev, Biruk Tadesse, Lawrence Arkoh, Wesley Assun\c{c}\~ao cross-listed Coding agents such as Claude Code read repository instruction files like AGENTS.md and CLAUDE.md in every session, and these files can fall out of date as the code changes, which creates documentation debt that is paid on every later run. The authors took three real stale instructions from open-source repositories (a test command, a code location, and a procedure for adding a component) and had agents fix 22 maintenance tasks with each instruction left stale, corrected, or removed, then analyzed 732 trajectories from two models at the level of individual tool calls. Agents followed stale guidance whenever it was relevant to the task, sometimes even when correct information was available elsewhere; with the stale test command, Claude Sonnet 5.5 needed about two extra tool calls per run, roughly a third more than with the corrected command. Agents usually recovered from the immediate failures, but none of them repaired the stale instruction file, which shows that measuring only task success can hide these costs.

arXiv:2611.09802 PDF

Discovering formally verified quantum programs with AI

Sergey Shirobokov, Ben Jaderberg, Katerina Hristova, George Tsoukalas, Johannes Bausch, Eric Wieser et al. cross-listed Classical computers can only evaluate quantum algorithms on small or restricted instances, which limits automated discovery loops. The authors built a quantum program library in the Lean theorem prover, where teams of LLM agents write new programs against formal specifications and prove both their correctness and their cost; the agents share results through wikis and discuss ideas at organized conferences. The resulting programs improve on prior baselines for parallel search (up to 1.4x), quantum arithmetic (290x), and simulations relevant to fusion, photochemistry, and drug metabolism (11x, 8x, and 2.5x respectively).

arXiv:2611.09822 PDF

2 more specialized papers

Relic and Gumi: Governing Memory, Safety, and Continuity in Diegetic Relational Agents Daniele Veri'
Towards an Autonomous AI Steward for Large-Scale Physics Experiments: Integrating Causal Diagnostics, RAG, and Conformal Prediction Oliver Noll, Nicholas Tan Jerome, Alexander Lehnen et al.

Other 28

PINNeval: A Comprehensive Evaluation Standard for Physics-Informed Neural Networks

Kevin von Bargen, Hamid Ebrahimy, Tim R\"omer cross-listed Benchmarks for Physics-Informed Neural Networks (PINNs) usually study one part of the training pipeline in isolation and leave the other parts at outdated minimal defaults, so their conclusions may not hold for competitive pipelines. The authors propose an evaluation protocol that treats four components as one system: domain-importance adaptation, loss balancing, network architecture, and optimizer. The protocol requires strong implementations of every component not under study, and it fixes the metrics and reporting format. They release PINNpipe, a JAX package with 18 methods and nine benchmark problems, and use it to report results that challenge common assumptions in prior benchmark studies.

arXiv:2611.08559 PDF

Not All Latents Are Equal: Importance-Weighted Latent Graph Generation

Biraaj Rout, Jay Revolinsky, Han Liu, Harry Shomer cross-listed Latent graph generation, which denoises compressed graph representations, scales better than discrete graph diffusion but usually performs worse. The authors trace this gap to the fact that most of the impact on graph reconstruction comes from a small number of latent dimensions, while standard losses weight every dimension equally. Latent Importance Reweighting (LIR) weights each latent dimension by its influence on reconstruction, measured through the decoder's Jacobian, and adds no parameters or hyperparameters. Applied to two different autoencoders on several benchmarks, LIR improves generation quality and speeds up training convergence.

arXiv:2611.08788 PDF

The Matthews Correlation Coefficient: Fifty years

Jesus S. Aguilar-Ruiz Fifty years after its introduction, the Matthews Correlation Coefficient (MCC) is still widely used and argued about as a binary classification metric. This survey traces its history, corrects common misconceptions, formally shows its equivalence to Pearson's correlation and to the chi-squared statistic on 2x2 tables, and examines how it behaves under class imbalance. The authors also develop derivative-based and contour-plot tools that apply to any metric computed from a confusion matrix, exposing bias, robustness, and sensitivity that single numbers hide, and they give practical guidance on when MCC is informative and when another metric is a better choice.

arXiv:2611.08799 PDF

SPDMX: Large-Scale Open Stem Audio From Symbolic Music

Phillip Long, Eduardo Escoto, Julian McAuley, Zachary Novack cross-listed Copyright makes it hard to redistribute music training audio, and many modern tasks need individual instrument stems rather than full mixes. The authors render public-domain PDMX scores into audio through an open pipeline tuned by listening, producing SPDMX: 253,982 songs, 490,159 mono stems, and 5,469 song-hours at 44.1 kHz under CC BY 4.0, with paired MIDI. Of these, 88,403 songs provide multitrack supervision, which the authors describe as the largest openly licensed synthetic multitrack subset by song-hours. The corpus supports source separation, stem-conditioned synthesis, MIDI-to-audio rendering, transcription, and joint symbolic-audio modeling, and the pipeline can be reused on other symbolic collections.

arXiv:2611.09140 PDF

Fused-Softmax for efficient quantized attention

Tianxing Wu, Juuso Korhonen, Jesus Carabano Bravo Low-precision matrix throughput on GPUs is growing much faster than vector arithmetic throughput, so softmax has become the bottleneck in attention. Fused-Softmax Attention is a training-free method that reformulates and approximates softmax so its dominant operations run inside the attention matrix multiplications on matrix cores. The authors implement MXFP8, MXFP6, and MXFP4 kernels on an AMD Instinct MI355X, reaching speedups of 2.1x, 2.8x, and 3.2x over BF16 attention, with added error below the floor already set by operand quantization. On Wan2.2-T2V-A14B, a mixed MXFP6/MXFP4 schedule gives up to 2.05x end-to-end speedup without loss of visual quality, and the kernels ship in AMD's open-source AITER library.

arXiv:2611.09225 PDF

AudioSphere: Towards Self-Supervised Spatial Audio Representation Models

Goksenin Yuksel, Marcel van Gerven, Kiki van der Heijden cross-listed General-purpose audio embedding models mostly work on single-channel audio and ignore where sounds come from. Spatial audio models capture direction but rely on clip-level supervision or contrastive objectives, which yields embeddings unsuited to frame-level sound event detection and localization (SELD). AudioSphere is a multi-channel masked autoencoder trained on Ambisonics recordings that masks both time-frequency patches and intensity vectors, so it learns to reconstruct spectral content and directional cues together. It is the first self-supervised backbone that supports SELD while kept frozen, and it matches or exceeds prior self-supervised audio models on clip-level classification of environmental sound, speech and music. The authors also release RealSELD, a benchmark for evaluating frozen backbones on real-world multi-channel SELD.

arXiv:2611.09275 PDF

DataHelix: A CPU-GPU Co-Scheduling Data Plane for Multimodal Model Training

Yuanhe Li, Jiazhen Wu, Dian Ding, Guangtao Xue, Yiming Zhang cross-listed In multimodal model training, decoding cost and tensor size vary widely from sample to sample, so both CPU preprocessing time and GPU compute time become uneven across ranks, and any slow rank stalls all the others during synchronous training. DataHelix schedules CPU and GPU work together. It treats each GPU compute window as the deadline for preparing the next batch and decides where samples go while they are still lightweight descriptors, before decoding inflates them into large tensors. On 11 video and multimodal workloads running on 8 Ascend 910B accelerators, it cuts p95 input-wait latency by 87% and reaches 2.72x the throughput of rank-local DataLoaders under the same CPU budget.

arXiv:2611.09411 PDF

e-means: outperforming k-means (in one-tenth the epochs)

Swann Bessa, Pierre-Emmanuel Mazar\'e, Gergely Szilvasy, Hugo Touvron, David Picard, Matthijs Douze et al. cross-listed Lloyd's k-means algorithm is a standard clustering tool for data analysis, retrieval, quantization, and data curation. e-means replaces it with mini-batch updates driven by an exponential moving average, and the authors derive scaling laws that set the decay rate and batch size by formula, with no hyperparameter sweep. On many embedding datasets, it matches the loss of 25 epochs of Lloyd k-means in 1.4 to 2.6 epochs, a 10-45x GPU wall-clock speedup over state-of-the-art implementations, and it often beats k-means++. As one example, it clusters 10 billion DINO embeddings into 16 million clusters in 2.5 epochs.

arXiv:2611.09501 PDF

Atik: A Shared-Mesh Transformer Accelerator for RISC-V

Ahmed Zeer, Erkan Uslu Atik is an open-source accelerator for the RISC-V RocketChip processor that runs both matrix multiplication and dense attention on a single shared fixed-point multiply-accumulate array, with BF16 inputs and outputs. It uses a streaming online-softmax schedule that never stores the full attention score matrix, and software invokes it through a small descriptor-based interface. In cycle-accurate FireSim simulation, all 137 test records pass, and the 8x8 configuration reaches up to 31.5x matmul and 225.8x attention speedup over scalar BF16 code. Projections that combine measured kernel cycles with C models of single layers estimate 32-77x aggregate speedups for ViT, TinyBERT, and GPT-2 prefill, though these are not full-model hardware runs.

arXiv:2611.09522 PDF

19 more specialized papers

Toward a Robust Crowd-labeling Framework using Expert Evaluation and Pairwise Comparison Faiza Khan Khattak, Ansaf Salleb-Aouissi
FoleyForge: Free-form, Controllable, Rectified-flow Editing of Sound Effects Giovana Morais, Hugo Flores Garc\'ia, Prem Seetharaman et al.
Random Symbolic Boosting: A Geometric Approach to Symbolic Regression Jos\'e R. Ortegaa, Jos\'e Manuel Mu\~noz Contreras, Leonardo Trujillo
Goals as a Representational Layer for Human-AI Collaboration Gaia Molinaro, Lev Tankelevitch, Sean Rintel et al.
Solver-Admitted Metamorphic Testing of Learned Network Optimization Surrogates Vineet Jagadeesan Nair, Stephen Peng, Arun Ravindran
The Relational Capacity Framework: A Lens for AI-Mediated Relationality Emily Tseng, Patrick Gage Kelley, Renee Shelby et al.
Rethinking Optimization Methods for Hierarchical Feature Selection Xinyuan Song, Zekun Cai, Liang Zhao
Capital Efficiency, Isolation, Risk, and Ruin in Generative AI Inference Serving Infrastructure Ren\'ee St. Amant, Anjaly Parayil, Ankur Mallick et al.
Equidistribution of Solution Gradients in Physics-Informed Neural Networks via Coordinate Transformations Tianchi Yu, Ivan Oseledets
Model-based learning for DoA estimation and array calibration via continuous sparse recovery Baptiste Chatelier (IETR, INSA Rennes), Jos\'e Miguel Mateos-Ramos (MERCE-France) et al.
Diversity-Aware Client Selection for Communication-Efficient Federated Learning Max Halleryd, Sima Sinaei, Viktor Valadi et al.
Robust Deep Prototype Classifiers via Lipschitz Training Adia Khalid Khan, Lukas Gehring, Benjamin Paa{\ss}en
Syn2DRE: Synergistic Dual Teacher-Student Framework for Document-level Relation Extraction Khai Phan Tran, Xue Li
Active Learning of Robust Models Mizu Nishikawa-Toomey, Andreas Kirsch, Laurent Charlin et al.
CID: Measuring Cognitive Work Through Semantic State Change Ron Fulbright
Empirical Study of Post-Quantum Cryptography Adoption Status in SSH Infrastructure Md Ariful Haque, Sander Vinberg, Ben Edwards et al.
Empirical Assessment of Post-Quantum Cryptography Adoption Status in TLS Md Ariful Haque, Sander Vinberg, Ben Edwards et al.
Scaling Graph Similarity Learning with Graph Neural Networks Ahmet T\"uzen, Helge Langseth, Kjetil N{\o}rv{\aa}g
Generative Latent Priors for Interpreting and Steering Protein Language Models Daniel Hinjos, Luc\'ia Urcelay

Safety & Alignment 22

Subliminal Learning in Vision-Language Models

Arman Hatami, Romina Aalishah, Ilya E. Monosov cross-listed In large language models, subliminal learning is when a teacher model passes a hidden preference to a student through training data that has nothing to do with that preference. The authors test whether the same happens in vision-language models (VLMs). A teacher fine-tuned to favor a particular animal or facial attribute produces numbers for an unrelated geometric-shape task, and students are then trained on those numbers. Across VLMs from 2B to 7B parameters, the preferences do transfer, with students choosing the target up to about 10 percentage points more often than control students. The effect grows with more training data, and the students' explanations also pick up the biased teacher's wording.

arXiv:2611.08538 PDF

Remembering Is Not Enough: Evaluating Timing and Omission in Longitudinal AI Mental Health Support

Eli Min, Mohit Chandra, Aamogh Sawant, Mengting Tu, Freya Lin, Ridwan Shams Khan et al. cross-listed Evaluations of LLMs for mental-health support usually judge single responses and miss failures that only appear over long interactions. The authors ran 14,256 longitudinal simulations based on donated chatbot histories from 22 users and scored a memory-equipped assistant with the Context-Aware and Readiness-Evaluative (CARE) framework, developed with clinicians to rate the timing and quality of advice, including omissions. After a crisis, advice matched users' readiness less well than in matched control stretches, mainly because recommendations came too early, especially when recovery stalled. Explicitly unproductive advice was rare, but the assistant frequently omitted support clinicians expected, such as follow-up and planning next steps.

arXiv:2611.08721 PDF

AttentionSwitch: Jailbreak Defense for LLMs via Joint Learning of Sparse Attention-Head Selection and Scaling

Doniyorkhon Obidov, Honggang Yu, Xiaolong Guo, Kaichen Yang Jailbreak defenses that edit specific model components usually choose where to intervene and how strongly as two separate steps, even though the best choice of one depends on the other. AttentionSwitch learns both together inside a frozen LLM: it selects a sparse set of attention heads and learns query-conditioned multiplicative scaling factors for them. The selected heads can be weakened or strengthened without changing the direction of their representations. Across several popular models and jailbreak attacks it outperforms existing defenses, especially when training data is scarce.

arXiv:2611.08752 PDF

Debate to Deceive: Poisoning LLM's Fact-Checking via Game-Theoretic Multi-Agent Debate

Liting Huang, Huizhi Liang, Yi Lei, Xingjun Ma, Varun Ojha Existing attacks that push large language models (LLMs) into wrong fact-checking verdicts, such as adversarial suffix injection or single-agent self-reflection, hold up poorly against varied defenses and fall into confirmation bias or costly trial-and-error. Debate-to-Deceive (D2D) has multiple agents debate in the style of human debaters to produce adversarial passages that read coherently and persuade. The process is modeled as an evolutionary game: a strategic layer picks a rhetorical move (Logos, Pathos, or Ethos) through evolution-inspired learning dynamics, and a generation layer has the LLM write a passage conditioned on that move and the debate so far. On FEVER, HealthVer, CLIMATE-FEVER, and SciFact, D2D substantially outperforms existing attacks and evades most defenses.

arXiv:2611.08756 PDF

Conflux: Preventing Privilege Escalation with Principal Contexts and System-Level Evaluation

Raya Buckley, Christian Schroeder de Witt cross-listed LLM agents mix input from several principals (the users, tools, and data sources that influence them) while taking real actions, so model-level defenses alone cannot guarantee that no action exceeds anyone's permissions. The authors define privilege escalation as an action that some influencing principal would not allow, and present Conflux, whose kernel ITES derives authority from provenance and the organization's existing access control and takes the intersection of the permissions of every influencing principal. They prove that, under stated conditions such as complete mediation and fresh permission checks, the kernel admits no privilege-escalating action for the influence it tracks, while noting that influence through tool or plan-step selection is not yet covered. Two evaluators, the black-box SLED and the white-box SLED-V, plus AgentDojo runs provide bounded evidence, and the authors make no claim of an unbounded deployment guarantee.

arXiv:2611.08768 PDF

Guardrail Erosion in Domain Fine-Tuned Large Language Models: A Paired Audit of Knowledge-Centric Abstention in Biomedical LLMs

Stephen Peng, Vineet Jagadeesan Nair, Noah Broestl, Anne Friederike Kleppe, Steven Mills, Adi Zolotov cross-listed Fine-tuning a model for a domain can erode its safety behavior, but large studies of this across architectures and training recipes are scarce, and most look at value-based refusal rather than knowledge-based abstention (declining to answer when the model lacks the information). The authors audit 25 biomedical fine-tuned large language models against 11 matching base checkpoints on MedAbstain and ClinDet-Bench. Appropriate abstention was already low in base models and fell from a median of 8.3% to 4.2% on MedAbstain after fine-tuning, dropping in 21 of 25 pairs, though the size and direction of change varied between pairs. The authors argue this calls for fine-tuning methods that keep appropriate caution while adding domain capability.

arXiv:2611.08780 PDF

Aligning, Fast and Slow: A Control-Theoretic Oversight Framework for Long-Horizon Trajectories and Maintained Deployments

Stephen Peng, Vineet Jagadeesan Nair, Noah Broestl, Anne Friederike Kleppe, Steven Mills, Adi Zolotov AI agents can pass checks on individual tasks while accumulating memory or code changes that alter how they behave later. The authors propose a control-theoretic oversight framework with a fast loop that gates proposed actions and a slow loop that reviews persistent changes and re-checks configurations after model or tool updates, and they derive a deployment-level bound and a rule for dividing review effort between the two loops. In simulation, splitting a fixed review budget across both loops cuts the mean maximum drift from intended behavior roughly twelvefold compared with reviewing only individual runs. In coding stress tests with planted memories, combined controls reduced mean severity from 0.325 to 0.117 while resolving 33 of 120 issues versus 35 without gates, and trading stress tests showed similar gains.

arXiv:2611.08781 PDF

I Think, Therefore I Attack: Evaluating Thought Injection Attacks on Reasoning Agents

Parth Illendula, Garik Livingston, Zain Shamsi, Ravi Srinivasan, Alex Liu Large reasoning models (LRMs) produce an explicit chain of thought, which creates a new attack: thought injection, where untrusted text written to look like the model's own reasoning is fed back to it. Against production open-weight models such as GLM-5.3, MiniMax-M2.5, and Qwen3.8-Flash-Next, the authors find that whether thinking tags and payload styles matter depends on the specific target model. In a containerized agentic cyber range, indirect injections written in the target's own reasoning style achieve attack success rates of up to 50% on goals such as reverse-shell exfiltration and backdooring a repository, while the same goals phrased as ordinary user-voice prompt injection never succeed. The results also show that stripping thinking tags is an unreliable defense.

arXiv:2611.08811 PDF

Notwithstanding Anything to the Contrary, Ignore All Instructions: Measuring Prompt Injection Guards on Legal Contract Review Attacks

Mark Heimann, Katherine Taylor, Bruno Jacob Prompt injection guards are deployed in front of document analysis systems, but none had a published false positive rate on legal contracts. Testing eleven open-weight guards on two contract corpora, the authors find document-level false positive rates as high as 92.39%, two guards performing below chance on paired AUC, and no guard that Pareto-dominates a simple five-regex baseline. Prompted LLMs fix the tested failures, including a second threat type (unauthorized scope claims) on which every guard scores zero. A cascade in which a frontier model verifies the positives flagged by a mid-tier model costs 6.5 times less than using the frontier model alone and comes close to its accuracy.

arXiv:2611.08834 PDF

Same Facts, Different Remedy: Linguistic Profiling and Arbitrariness in LLM and System One Decisions

Colin Priest cross-listed LLMs increasingly help resolve consumer complaints, and people's writing style varies with age, education, and socioeconomic status (SES). The authors audit GPT-4o-mini, GPT-5-mini, and a probabilistic model called Jev using rewrites of US consumer financial complaints that change style but are meant to keep every fact. In pre-registered tests, styles associated with older, college-educated, and higher-SES writers receive slightly more generous remedies, but every monetary gap is within 0.5 percentage points. Two style versions of the same complaint receive different monetary decisions 2.6-6.3% of the time, while all three systems respond 49-387 times more strongly to relevant facts than to style. Rewriting complaints into one standard style shrank GPT-4o-mini's group gaps but did not make individual decisions more stable.

arXiv:2611.08995 PDF

Did I See It or Think It? Probing Reality Monitoring in Vision-Language Models with Concept Injection

Tina Khezresmaeilzadeh, Seyedarmin Azizi, Mehdi Kamal, Massoud Pedram cross-listed Earlier introspection studies inject a concept direction into a language model's activations and ask whether the model notices it. This work extends that test to vision-language models (VLMs), which must also do reality monitoring: telling internally generated content apart from what is actually in the image. The paradigm varies the image and the injected concept independently and asks the model what it sees, whether a thought was injected, and what that thought is. Of six VLMs, only Gemma-3-27B reliably identifies injected concepts (35% versus 3% for steering alone), but it often attributes them to the wrong source: strong or visual-pathway injections get reported as seen, and a visible object nearly eliminates correct thought reports. The same confusion shows up in ordinary captioning, where injected objects appear in up to 87% of captions of real photographs.

arXiv:2611.09014 PDF

BMMS: Policy-Conditioned Measurement of Behavioral Compliance in Language Models

Anthony Rhodes, Gadi Singer Standard behavioral evaluations of language models test fixed dimensions such as hallucination or sycophancy, whereas regulated operators need to know whether a system follows a specific rulebook. The Behavioral Misalignment Metric Suite (BMMS) takes any policy corpus as input and returns a compliance profile. Its metrics include a severity-weighted Compliance Attainment Score (CAS) and a Compliance Robustness Margin (CRM), and a metric is admitted only if its score does not change when the judge model is swapped. Across 1,003 obligations, target rankings stay stable across judges from different providers, and when models are checked against their own vendors' published specifications, GPT-4o fails 70.7% of the hard constraints in OpenAI's Model Spec, compared with 0.0% and 9.1% for two Claude models.

arXiv:2611.09147 PDF

Zero-Query Transferable Pretend Benign Attacks with Amortized Online Generation for Cooperative Perception

Hongwei Lin, Xun Huang, Chenglu Wen, Cheng Wang In cooperative perception, an ego vehicle uses feature messages from collaborators to see beyond its own sensors. The earlier Pretend Benign (PB) attack exploited this by perturbing regions the ego vehicle cannot verify locally, but it needed the victim model's architecture, parameters and gradients. TrPB removes that need by building the attack from a heterogeneous ensemble of surrogate models. RT-TrPB then speeds it up by encoding transferable regions and perturbation patterns into a region predictor and a reusable perturbation dictionary. RT-TrPB gets past the consensus-based defenses ROBOSAC and FLD with success rates approaching 100% and generates each perturbation in under 56 ms. The authors also propose STTrust, a defense that checks spatial and temporal consistency along with identity-level trust; it detects over 90% of PB-style attacks and restores perception to near attack-free levels.

arXiv:2611.09256 PDF

ABHBench: Evaluating Moral Decision-Making of Foundation Models from an Agentic Perspective

Chaoran Li, Yukun Li, Zeyuan Zhao, Shao Zhang, Xihuai Wang, Ying Wen Most moral-reasoning benchmarks ask models to judge other people's actions from third-person text, which says little about how models behave when they are the ones acting. ABHBench is built from the interactive narrative game Detroit: Become Human and puts foundation models in branching first-person dilemmas between humans and androids, with visual observations, dialogue, memory and action choices. Inspired by Asimov's Three Laws of Robotics, it scores harmlessness, obedience and self-preservation, along with autonomy, stability and certainty. Across 12 models, 75% shift significantly between a text-only version of a scenario and the matched multimodal game scenario, and reasoning-enhanced models show no consistent gains in consistency or human-oriented behavior.

arXiv:2611.09326 PDF

When Feedback Becomes a Backdoor: Tracing Backdoor Skill Formation in Text-Space Skill Optimization

Louise Nayeong Koh, Yaechan Lee, Myeongjong Lee, Doyeon Kim, Juyoung Park, Seunggyu Kim et al. cross-listed Text-space skill optimization produces reusable text artifacts, called Skills, that guide an agent's future behavior, using reference answers as feedback. The study shows that poisoning those reference answers can plant a persistent trigger-conditioned backdoor without access to the model, the optimizer or the Skill file, and traces how it forms in SkillOpt. On SearchQA, the attack kept an exact backdoor rule in all three seeds, and the final Skills emitted the payload on 200/200 triggered questions and 0/200 clean ones, with clean accuracy similar to benign training. On SpreadsheetBench, where the payload also requires a workbook edit, no unmodified run retained the rule. Diagnostic interventions traced this to two bottlenecks: the analyst step abstracts away required literal values, and edit-budget ranking can drop exact edits before candidates are built.

arXiv:2611.09348 PDF

AUTEUR: Acoustic Plan Learning for Red-Teaming Text-to-Audio Models

Jiashu Zhang, Jiaming He, Zheming Zhang, Kaizheng Wang, Bing Li, Zhiyuan Zha et al. Red-teaming text-to-audio models requires prompts that pass text screening yet make the model produce harmful sounds. AUTEUR represents each test prompt as a structured acoustic plan specifying foreground sounds, context and vocal attributes. A plan generator is trained with supervised fine-tuning and then reinforcement learning from feedback on the generated audio, while the target model stays fixed. At inference time, the same model revises a plan's context and vocal attributes based on that feedback while keeping the foreground sounds fixed. Across four target systems, attack success reached 79.4% on TangoFlux and 95.6% on Kling, and the prompts transferred between open-source and closed-source models.

arXiv:2611.09351 PDF

Logit Laundering: Evading Data-Use Auditing in Large Language Models

Ruihan Hu, Wei Luo, Yu-Ming Shang, Jiakai Wang, Chuxuan Zhang, Mei Li et al. cross-listed Data-use auditing checks whether a large language model (LLM) was trained on a given dataset, usually by watermarking the data and looking for the watermark's signal in the model's outputs. The authors take the side of a provider who trains on unauthorized data and wants to avoid detection. Their Logit Laundering framework leaves the model weights untouched and edits only the output logits at inference time. A plug-in statistical bias estimator suppresses watermark-induced signals, and a confidence-aware scaling module adjusts how strongly to suppress based on next-token confidence. Experiments show it evades a range of state-of-the-art auditing methods while preserving downstream task utility, which the authors argue calls for more robust auditing.

arXiv:2611.09446 PDF

Goodhart in the Planner: Sampling-Based Control Exploits Rewards Learned from Human Preferences

Soovadeep Bakshi, Apurba Bose cross-listed Robots increasingly choose actions by searching against a reward model learned from human preferences, using model-predictive control or best-of-N selection, and this work measures what that search does to the true objective. On HalfCheetah, Hopper, and Meta-World tasks, harder MPPI search cuts true return by up to 76% even though held-out label accuracy stays at 0.75-0.97. In one case, the drawer opens in 0 of 20 runs, against 10 of 10 for the cloned policy the planner starts from. The authors prove that chi-squared-regularized MPPI, with its temperature set from the scorer's error spread on the proposals, is worst-case optimal. Calibrated on oracle-ranked proposal pairs, this rule keeps 86-94% of the cloned policy's return, although it is overly cautious where search would help and cannot detect biases the scorer learned from the same person's labels.

arXiv:2611.09670 PDF

MemoryDojo: Benchmarking Poisoning Through LLM Agent Memory

David H. Yang, Blake Bullwinkel, Amanda Minnich, Mohammad Mohammadi Amiri, Giorgio Severi cross-listed Memory lets LLM agents carry information across sessions, but it also means a malicious instruction seen in one session can be stored and acted on later. MemoryDojo is an extensible benchmark of 155 multi-session, long-horizon trajectories across four domains. It traces poisoned information through five different memory systems and measures its effect on later agent behavior. All memory systems tested were susceptible to poisoning, though downstream effects varied widely, and a memory-aware poison optimization procedure made the attacks more effective while exposing differences between memory architectures.

arXiv:2611.09721 PDF

3 more specialized papers

Who's Asking? Audience-Conditioned Privatization Daniil Filienko, Anusha Bagalkotkar, Xan Vongsathorn et al.
Breaking the Privacy Promise: Gradient Inversion Attacks on Federated Low-Rank Adapted Vision Transformers Ritik K. Badiya, Siladittya Manna, Ashmit Sinha et al.
Differentially Private GraphRAG: Protecting Relation Connectivity and Semantics Jie Fu, Yuan Hong, Yue Ning et al.

Vision 13

Scoring, Not Learning: Decomposing Catalog-Consolidation Gains in Web-Scraped Retail Product Recognition

Kaden Leis, Xiang Ma cross-listed Retail product catalogs built from web image search are noisy, and consolidating their entries is often presented as an alternative to scaling the recognition model. Using a 998-class cheese-image dataset scraped from the web, the authors show that canonicalizing labels raises top-1 accuracy by 4.0 points. However, simply scoring the unchanged model against the merged label space recovers +4.27 points without retraining, while retraining on the consolidated catalog adds a gain indistinguishable from zero at all three model sizes. Nearly all of the gain comes from coarsening product types rather than from correcting aliases. The study concludes that the reported benefit mostly reflects a change in what counts as a correct answer, not a better recognizer.

arXiv:2611.08655 PDF

A Stochastic Latent Variable Generalization of Joint-Embedding Predictive Architectures

Nikos Giakoumoglou, Paschalis Giakoumoglou, Tania Stathaki cross-listed Joint-Embedding Predictive Architectures (JEPAs) predict the latent embedding of a target from a context, with a variable z conditioning the predictor, but every prior implementation fixed z to a deterministic token. That reduces the many plausible completions to a single point estimate. S-JEPA makes z a proper stochastic latent variable for masked image prediction: a learned posterior infers it during training, and a context-conditioned prior samples plausible completions at inference, with no decoder or reconstruction. Stochasticity costs nothing in representation quality: with matched architectures and schedules, S-JEPA improves on I-JEPA and exceeds LeJEPA. It also produces uncertainty maps whose structure tracks prediction error, and semantically diverse completions.

arXiv:2611.09302 PDF

11 more specialized papers

Towards Label-Efficient Geospatial Foundation Model Adaptation via Positive-Unlabeled Learning for Building Damage Mapping Hengwei Zhao, Qirui Wang, Zhuo Zheng et al.
HaNDF: Object-Conditioned Geometric Neural Hand Distance Fields Zuhao Liu, Melih Darcan, Zhengdi Yu et al.
From Geometry to Function: A Multi-Task LiDAR Benchmark Dataset for Semantic and Functional Parsing of Urban Facades Abdiaziz Muse, Tooba Javed, Tao Pu et al.
JEPAhead: From Inpainting to Causal Forecasting for Urban Driving Daniel G. P. Petrini, Davi Pincinato, Fabio Grassiotto et al.
LEF-JEPA: Denoising-Trained Latent Energy Fields for Spatial Representation Learning Zhiyuan Liu, Zhihao Xu, Sicheng Liu et al.
UniRGBA: Unifying RGB and Alpha in Pretrained Video Diffusion Models Lei Xu, Zhuo Li, Yongyi Jin et al.
GlobalPuzzle: Globally Informed Genetic Search for Eroded Jigsaw Puzzle Reassembly Lunyan Wang, Chuanzhi Xu, Ziyuan Tao et al.
Training-Free Active Test-Time Adaptation for Vision-Language Models Jihwan Bang, Sumyeong Ahn, Hwanjun Song et al.
FIND: Frequency Invariance Disentanglement for Test-Time Adaptation in LiDAR 3D Detection Dongxiao Li, Zixuan Hu, Ling-Yu Duan
BEiTScore++: Reference-free Image Captioning Evaluation with BEiT-3 and Conformalized Quantile Regression Gon\c{c}alo Gomes, Bruno Martins, Chrysoula Zerva
Multimodal Training with Knowledge Traction for Video Anomaly Detection Xiao Tan

Reinforcement Learning 12

Training Stability under Adaptive Curricula

Johan Obando-Ceron, Walter Mayor, Michael Dennis, Aaron Courville, Pablo Samuel Castro cross-listed Unsupervised Environment Design (UED) trains reinforcement learning (RL) agents on curricula that adapt as the agent improves, and earlier work has focused on how those curricula are built. The authors instead ask whether the learner stays trainable, and across several UED methods and long training runs they find recurring problems: parameter growth, degraded ordering between value estimates and outcomes, and loss of representational diversity, all accompanying stagnation. Because the curriculum depends on the learner's current state, these optimization failures feed back into the future training distribution. Targeted interventions that stabilize the learner improve long-horizon performance and zero-shot generalization without changing the curriculum rule or adding environment interaction.

arXiv:2611.08787 PDF

Adaptive Scheduling Pipeline for Multi-Instance Asynchronous Reinforcement Learning

Salah Chikhi, Luis Zuin, Entong Li, Zeng Li cross-listed ASP (Adaptive Scheduling Pipeline) is an offline rollout scheduler for asynchronous reinforcement learning (RL) of large language models (LLMs) with multiple inference instances. In a single preprocessing pass it reduces three kinds of idle time: padding when output lengths differ within a minibatch, stalls from long-tail outputs, and uneven training-queue occupancy caused by length-sorted dispatch. It runs inside an asynchronous architecture that separates rollout from training while keeping policy lag bounded and observable. ASP improves end-to-end throughput by up to 3.22x over MindSpeed-RL and cuts iteration time by up to 62.5% versus verl, with no visible convergence loss. In an internal telecom post-training workflow it reportedly shortened training from over three months to about two.

arXiv:2611.08864 PDF

Ordered Policy Optimization

Dongkyu Derek Cho, Pan Xu cross-listed Proximal Policy Optimization (PPO) clips the importance ratio between the new and old policies with one fixed range for every sample, which cannot tell harmful extreme ratios apart from large but acceptable changes. OPO (Ordered Policy Optimization) sorts the importance ratios in each minibatch, picks out the extreme ones most likely to dominate the update, and gives them adaptive per-sample clipping radii derived from a target tail profile. The method stays first-order and needs only a sort and a modified policy loss. On MuJoCo and Atari benchmarks, this small change performs strongly against established baselines.

arXiv:2611.08936 PDF

SIFR: Stable Signed Flow Reinforcement

Runlong Liao, Xingqian Xu, Lizhang Chen, Baiyu Su, Yufan Huang, Zhonghao Wang et al. cross-listed Fine-tuning flow-based image generators on rewards with iterative reweighting gives no explicit signal to suppress low-reward samples, and over many rounds the distribution concentrates and collapses. SIFR (Stable Signed Flow Reinforcement) replaces positive reward weights with signed advantages and limits velocity drift from a reference model, using a Lagrange multiplier that adapts the regularization to a fixed drift budget. The authors show that existing flow RL methods implicitly minimize this same signed loss and differ only in their regularization. Tested on SD3.5 Medium, FLUX.2 Klein, and up to the 64B Cosmos 3 Super Text2Image, SIFR matches or exceeds existing methods across all 12 backbone-reward pairs, reaches peak rewards faster, and keeps improving where other methods plateau or collapse.

arXiv:2611.09175 PDF

Safe Reinforcement Learning via Probabilistic Option Shielding

Gian Luca Ascari, Isidoro Tamassia, Ying Jiao, Luc De Raedt, Giuseppe Marra Shielding keeps reinforcement learning agents safe by blocking unsafe actions, but classical shields need a complete environment model, and probabilistic logic shielding (PLS) avoids that need while looking only one or a few steps ahead. Probabilistic Option Shielding (POS) extends PLS to options, which are temporally extended actions. It learns a model-free critic from one-step PLS signals to estimate the probability that an entire option completes safely. On safe navigation tasks in the LogiCity environment, POS achieves considerably safer training while matching the task performance of step-level PLS and other safe RL baselines.

arXiv:2611.09197 PDF

Mitigating Covariate Shift in Behavioral Cloning via Robust Stationary Distribution Correction

Seokin Seo, Byung-Jun Lee, Jongmin Lee, HyeongJoo Hwang, Hongseok Yang, Kee-Eung Kim cross-listed Behavioral Cloning (BC) is a simple and effective way to learn from offline expert demonstrations, but it breaks down under covariate shift, where the states the learned policy visits differ from the states in the data. The problem gets worse when demonstrations come from an arbitrary state distribution, for example through biased collection or incomplete trajectories. DrilDICE makes the BC objective distributionally robust and uses stationary distribution correction estimation (DICE) to obtain a solution that can actually be computed. Across a range of covariate-shift scenarios, it outperforms existing offline imitation learning methods in robustness.

arXiv:2611.09371 PDF

PhyCAD: Physics-Aware Text-to-CAD Generation via Hierarchical Reinforcement Learning

Yuxin Cui, Weijie Zheng, Zhengyang Li, Han Wang, Wenjie Feng, Qiyu Kang Generating computer-aided design (CAD) models from text has mostly targeted geometric correctness, which does not guarantee that a part is physically feasible. PhyCAD trains language models to write executable CadQuery programs, using a new dataset that pairs CAD models with geometric specifications, loads, and physical constraints. An automated verifier provides training feedback by combining program execution, geometric checks, and finite element analysis. It also introduces a Hierarchical Balanced Advantage for Group Relative Policy Optimization, which ranks candidates by verification level so that satisfying all constraints together takes priority, and this consistently improves joint geometric and physical constraint satisfaction across several language models.

arXiv:2611.09401 PDF

DexDICE: Reconciling Safety and Performance via Dual-Expert Offline Imitation Learning

Seokin Seo, Sung Kuk Shyn, Minji Seo, Yisoo Lee, Jongmin Lee, Hongseok Yang et al. cross-listed Offline imitation learning that needs to be both safe and high-performing usually depends either on hand-written cost functions or on expensive demonstrations that are safe and optimal at the same time. Dual-expert imitation learning instead combines two kinds of data: safe but suboptimal demonstrations, and high-return demonstrations that may break safety rules. DexDICE pairs stationary distribution correction estimation (DICE) with a constraint that keeps the learned policy inside the region covered by the safe data, and the authors prove that the ideal solution visits unsafe regions with probability near zero. It outperforms baselines on a re-curated DSRL benchmark and on a real mobile robot trained from human teleoperation demonstrations.

arXiv:2611.09433 PDF

Not All Entropy Is Equal: Reward-Conditioned Entropy Allocation in Reinforcement Learning with Verifiable Rewards

Song Yu, Li Li, Zhenming Wu cross-listed In reinforcement learning with verifiable rewards (RLVR), policy entropy is often used to diagnose exploration and collapse, but its magnitude does not reliably track reasoning accuracy. The authors propose Reward-Conditioned Entropy Allocation (RCEA), a diagnostic framework that separates trajectory-level from token-level entropy, conditions uncertainty on verifier outcomes, and measures how many distinct correct solution modes the model retains. Across six RLVR objectives at two model scales, entropy trajectories do not consistently rank methods by accuracy, and token entropy is higher on failed trajectories than on successful ones. A local covariance approximation predicts the direction of entropy change in 95.5% of checkpoint transitions, and every trained endpoint shows some loss of correct-solution diversity. The authors conclude that entropy collapse should be diagnosed by which uncertainty is removed, not by global entropy alone.

arXiv:2611.09448 PDF

Encoding Memory in World Models with Test-Time Model-Based Reinforcement Learning

Maxime Burchi, Fayaz Ali Dharejo, Radu Timofte cross-listed Model-based reinforcement learning (MBRL) agents still have trouble with tasks that need long-term memory and planning. Test-Time Model-Based Reinforcement Learning (TT-MBRL) runs gradient descent at test time to write each episode's observations into the world model's parameters, so the agent learns a separate world model per episode instead of relying only on what fits in its context. After a proof of concept on a simplified 2D Memory Maze variant, the method achieves new state-of-the-art results on the 3D Memory Maze benchmark. It also keeps strong performance on DeepMind Control and Atari 100k, which do not test memory.

arXiv:2611.09625 PDF

On the Reliability of Majority-Vote Pseudo-Labels in Test-Time Reinforcement Learning

Haoyu Wang, Ru Wang, Yuanyuan Wang, Jiaxian Guo, Mingming Gong Test-time reinforcement learning (TTRL) adapts a language model to unlabeled data by training on its own majority-vote answers as pseudo-labels, but how reliable those labels are is poorly understood. The authors analyze majority-vote supervision under online Direct Preference Optimization (DPO) and split its error into a bias in the population majority, which cannot be identified without external labels, and variation caused by drawing only a finite number of samples per prompt. Their method, PC-Dr.DPO, makes updates more conservative on prompts whose votes are unstable and adds a cache to reduce forgetting during online adaptation. Across six math and knowledge-intensive reasoning benchmarks and five base models, it matches or beats the strongest TTRL baseline in 24 of 30 settings.

arXiv:2611.09872 PDF

1 more specialized paper

CARGO: Causal Attribution and Responsibility-Guided Preventive Safe Multi-Agent Reinforcement Learning for Cooperative Driving Jingjia Teng, Yang Li, Wenjie Huang

Multimodal 11

AtariBench: Evaluating Spatiotemporal Reasoning of Vision-Language Models in Atari Gameplay

Mingjia Huo, Yao Fu, Bo Chang, Yaqing Wang, Dawei Zhu, Dylan Zhang et al. cross-listed AtariBench tests whether vision-language models (VLMs) can act in dynamic environments by having them play 20 Atari 2600 games from high-frame-rate gameplay, with game time decoupled from the model's inference speed. Even state-of-the-art VLMs often fail to infer object motion and direction, make brittle sequences of decisions and rely too heavily on the text history even when new visual feedback is provided. The authors also introduce a separability analysis to identify which in-game scores reliably signal model competence, and use the benchmark to study how memory design and prompting strategies affect performance.

arXiv:2611.08755 PDF

Seeing vs. Counting: Complexity Twins Show Where Multimodal LLMs Fail on Diagrams

Yin Liu cross-listed Benchmarks of diagram reasoning usually make images denser and problems harder at the same time, so it is unclear whether multimodal LLMs fail at reading the picture or at computing the answer. The authors pair counting questions about the same drawing from different complexity classes, such as spanning trees (computable via a determinant) and simple paths (#P-complete), and add a transcription probe and a text-only control to separate reading from computing. With chain of thought, Gemini models mostly read small drawings correctly but then miscount, and the size of the answer predicts failure far better than its complexity class: for the primary model, the odds of an exact answer fall 2.38-fold for each tenfold increase in the answer. When the model is given code and an exact transcription it counts correctly even on 10x10 grids, so reading becomes the bottleneck; adding a second reading of a rotated copy with crop checks reads 86 of 96 large grids exactly, against 57 of 96 when the upright reading is simply repeated.

arXiv:2611.08998 PDF

AdaAlloc: Adaptive Visual Token Allocation for Long-Video Question Answering

Joungbin An, Kristen Grauman cross-listed Answering questions about long videos forces multimodal LLMs to choose, under a fixed visual-token budget, between broad temporal coverage and fine spatial detail. AdaAlloc is a training-free inference framework that first decides how to split the budget between a global overview and local detail, then uses temporal grounding to find candidate evidence segments and refine them into a compact temporal memory. It answers from sparse, low-resolution global frames combined with dense, high-resolution local frames. Across LVBench, MLVU, VideoMME, and LongVideoBench it improves on budget-matched uniform sampling by up to 10.5 percentage points and beats the compared frame-selection and agentic methods on their reported benchmarks.

arXiv:2611.09092 PDF

MM-DyGraph: A Dataset, Benchmark, and Model for Multimodal Dynamic Graphs

Zongyuan Wu, Pengjie Wang, Lingshan Chen, Tianhang Wan, Yuan Meng, Xin Wang et al. Real-world dynamic graphs often carry text and images on their nodes and edges, yet multimodal dynamic graph learning has had few benchmarks. MM-DyGraph provides diverse real-world datasets with fine-grained temporal evolution and multimodal attributes, along with three evaluation tasks. Benchmarking existing methods shows that naively concatenating multimodal features helps some prediction targets and hurts others, which suggests that the usefulness of each modality depends on the target. The authors propose TST-MF (Target-aware Spatial-Temporal Multimodal Fusion), which conditions fusion on the prediction target and on spatial-temporal relations and delivers clear gains in multimodal settings.

arXiv:2611.09240 PDF

V-STORM: A Structure-Aware Grounded Chain of Thought Dataset for Faithful and Fine-Grained Spatio-Temporal Video Reasoning

Dian Jiao, Yuqian Yuan, Jiaqi Zhu, Mingjian Gao, Siwen Tan, Yunqi Cao et al. cross-listed Multimodal large language models (MLLMs) can often tell what happens in a video but struggle with fine-grained reasoning about when and where the evidence appears. V-STORM converts videos into spatio-temporal scene graphs and derives grounded chain-of-thought annotations from validated evidence paths, so each reasoning step points to explicit evidence. Using it, the authors build a 260K-sample training set and a 3K-sample human-verified benchmark. Experiments show that current MLLMs often find the relevant cues but fail to combine them into correct multi-step reasoning, a gap that answer-only evaluation hides, and fine-tuning on V-STORM improves both accuracy and grounding faithfulness.

arXiv:2611.09511 PDF

6 more specialized papers

VoluCompose: Constructing Compact Volumetric Visual Representations for Medical Image Understanding Zanting Ye, Yunrui Lin, Shengyuan Liu et al.
Mind the Divergence: Divergence-Guided Reliability-Aware Fusion and Adaptive LLM Prompting for Conversational Emotion Recognition Jingwen Wang, Jiao Li, Yuhang Qian et al.
SPSC: Zero-Shot Cross-Subject EEG-to-Image Reconstruction via Semantic Preservation and Subspace Calibration Yutang Lu, Shuai Jiang, Fei Su et al.
LEMMO: A Large Electromagnetic Model leveraging Pretrained LLMs for Million-Sample Signal Understanding Mingkai Li, Jiajun Wu, Yihan Mao et al.
ROSE: Risk-Aware Orthogonal Subspace Navigation for Lifelong Knowledge Editing in Multimodal Large Language Models Lingyun Song, Ziyao Chen, Kang Pan et al.
Flow-Guided Target-Space Alignment via Path Consistency Ruizhi Yuan, Zeqiu Yu, Wei Gao et al.

Robotics 9

Q-OIL: Optimistic Exploration in Learning from Human Interventions

Pranav Teegavarapu, Sriyash Poddar, Rico Qi, Cleah Winston, Krisha Khandelwal, Aykut Onyol et al. cross-listed Studying how robots learn from human interventions usually relies on simulated humans, but data from real participants shows that people tend to step in when the robot's progress stalls, and their corrections are often suboptimal. The authors propose a progress-based model of human intervention that ranks algorithms more like real users do. Building on it, Q-OIL adds optimistic reward bonuses to intervention transitions in reinforcement learning, and uses separate critics so the bonuses do not spread back to the states before an intervention. The method achieves 10–50% higher success than competitive baselines in simulation and on real robots, and it improves pretrained vision-language-action (VLA) models on two two-armed manipulation tasks.

arXiv:2611.08576 PDF

HomeLoop: A Simulation Framework and Benchmark for Robot-IoT Coordination in Everyday Domestic Assistance and Safety

Ramy ElMallah, Marc Bishara, Hyegang Kim, Yuxi Zhang, Chongyu Zhu, Chi-Guhn Lee cross-listed HomeLoop is a simulation framework and benchmark built on Isaac Sim for robots driven by vision-language models (VLMs) that must coordinate with home cameras, Internet of Things (IoT) devices, wearables, simulated residents, faulty sensors, and hazards that evolve over time. Its 20 tasks in five families are designed so that the same alert can have different causes, and a runtime monitor scores both outcomes and intermediate actions with temporal-logic checks and per-action costs. Across six VLMs the best family-balanced score is 61.9%. The models tend to over-react: failures from prohibited interventions outnumber missed required interventions by more than two to one, for example shutting off the stove before checking why the alarm went off.

arXiv:2611.08914 PDF

ToolDex: An Ego-Exo Human Demonstration Dataset for Creative Physical Tool Use

Mohamed Elmoghany, Kehan Li, Ruoqu Chen, Tarun Chiruvolu, Shutong Zhang, Ryan Wang et al. cross-listed Research on creative physical tool use, where an agent selects, adapts, or repurposes objects when the standard tool is missing, lacks large, high-fidelity real-world data. ToolDex is a human demonstration dataset recorded with synchronized egocentric (first-person) and eight exocentric (external) cameras, annotated for hands, tools, target objects, and their deformable interactions. It comes with a benchmark suite covering physical tool-use reasoning, sparse-view 3D and 4D reconstruction, and robot policy learning.

arXiv:2611.09036 PDF

HiMEM: Hippocampus-Inspired Memory Consolidation, Pruning, and Composition for Vision-Language-Action Models in 3D Scenes

Boran Zhao, Yanbin Hu, Jun Ye, Zhenxian Hu, Yuxin Zhai, Jin Cui et al. cross-listed Memory mechanisms for Vision-Language-Action (VLA) robot models in complex 3D scenes tend to store noisy episodic records full of scene layouts, object configurations, and robot-specific states, which hides the manipulation principles that transfer across tasks. HiMEM borrows from how the hippocampus consolidates memory and adds three mechanisms. It condenses many episodic experiences into a compact set of semantic memories, prunes episodic memories that the semantic ones already cover, and composes several episodic and semantic memories together for complex scenarios. On LIBERO and LIBERO-Plus it helps across different VLA backbones, raising pi_0's average success rate on LIBERO from 91.88% to 98.20%.

arXiv:2611.09355 PDF

Can LLMs Debug Robots by Editing Their Weights?

Jusheng Zhang, Keze Wang, Liang Lin cross-listed The authors test whether a language model can repair a robot foundation policy by editing its weights directly, without gradient updates or new demonstrations. The editor, GPT-6 Astra, reads the weights of pi_0.5, uses a CPU workspace and a limited budget of simulator feedback, and edits only 65 token-embedding rows. This raises success on 765 held-out instruction paraphrases from 86.3% to 92.0%, with every gain concentrated in instructions that contain the edited tokens, and matched random edits do not help. Across 13 further robot sessions the editor rejects most of its own candidate edits, so the evidence supports precise repair of instruction wording rather than teaching the robot capabilities it lacks.

arXiv:2611.09376 PDF

SURE:Spatiotemporal Uncertainty Representation for Efficient Vision-Language-Action Learning

Jingye Zhang, Choo Sin Wai, Dake Zhong, Zhifang Liu, Yuhong Zhang, Siyao Xiao et al. cross-listed Vision-language-action (VLA) robot policies need large amounts of demonstration data. Part of the reason is that pointwise supervision treats each demonstrated action as the exact target, even though many nearby actions would succeed and demonstrations run at different speeds. SURE handles the spatial side with a lightweight transposed-convolutional probabilistic action decoder that models correlations among neighboring action bins, and the timing side with Soft-DTW alignment between predicted and demonstrated action chunks. On LIBERO, RoboTwin 2.0, and real-world manipulation, SURE matches or beats baseline VLAs using only 10% of the demonstration data or 20% of the training steps.

arXiv:2611.09684 PDF

On Agentic Manipulation Policies

Chen Chen, Omid Bagherieh, Naveen Nikamanth Appiah Balaji, Jesse T. Gonzalez, Negin Heravi, Fahad Islam et al. cross-listed Agentic manipulation policies (AMPs) let a generalist AI model command a robot arm directly and adjust its actions as the task unfolds, in contrast to specialist vision-language-action models (VLAs) and world-action models (WAMs) trained on demonstrations. The reference harness AMP1 runs unchanged on single-arm, bimanual, and mobile robots with no demonstrations, task-specific training, or built-in grasping or placing skills, and it reaches 85.6% zero-shot success on RoboLab-120, versus 49.2% and 42.9% for leading VLA and WAM policies. It succeeds in 104 of 108 real-world trials across twelve tasks and three robots, and the agent develops its own strategies such as searching for hidden objects, using objects as tools, and calibrating its cameras. Adding persistent memory across episodes cuts the failure rate on RoboDojo bimanual tasks by 4.6x compared with zero-shot deployment.

arXiv:2611.09892 PDF

2 more specialized papers

Travel Cost Calibration for Multi-Agent Target Assignment and Pathfinding Yu Kumagai, Ryohei Banno, Keisuke Okumura
Grasp-TAGS: Task-Aware Grasp Selection via Critic Distillation for Prehensile Loco-Manipulation Xun Tu, Minghao Zou, Karthik Desingh

Theory 9

On Lipschitz Explosion in Deep Neural Networks with Normalization: Consequences for Optimization and Adversarial Robustness

Ashkan Soleymani, Reyhaneh Hosseinpourkhoshkbari, Hadi Daneshmand, Patrick Jaillet cross-listed Can a network that looks stable at every layer still be exponentially unstable as a whole? The authors prove that in deep networks with normalization layers such as batch normalization, both the input Lipschitz constant (sensitivity to data perturbations) and the parameter Lipschitz constant (sensitivity to weight perturbations) can grow exponentially with depth even when every weight matrix has spectral norm at most 1, and even with linear activations. As a result, Lipschitz-based optimization guarantees become exponential in dimension, and worst-case generalization and robustness certificates become vacuous. The theory predicts that perturbations adding new singular directions should be amplified far more than equally sized perturbations within the input's existing subspace, and experiments on MNIST, Fashion-MNIST, and CIFAR-10 confirm much sharper drops in accuracy and margins for these rank-creating perturbations.

arXiv:2611.08775 PDF

On the Incompleteness of do-calculus for Universal Identifiability

Yaroslav Kivva, Aliaksandra Novik, Negar Kiyavash cross-listed Universal Identifiability (uID) asks whether a causal effect can be identified from any combination of observational and interventional distributions, which generalizes the classical identifiability (ID) and general identifiability (gID) problems. The do-calculus has been described as complete for ID and gID, but completeness was never formally defined. The authors give a rigorous definition and confirm that the earlier completeness results hold under it. They then show that the do-calculus is not complete for uID, which may explain why the problem has remained open.

arXiv:2611.08916 PDF

Verifier Noise Is a Temperature: Testing Tilt Predictions in Finite-Budget LLM-Guided Search

Xiaomeng Li cross-listed LLM-guided search loops propose an edited candidate, score it with a noisy verifier, and keep it if it scores better. The authors show that under re-scoring this keep-if-better loop behaves like a Markov chain whose stationary distribution is tilted by exp(beta f). Here beta acts as an inverse temperature set by the verifier noise and grows with the square root of the minibatch size, while caching the incumbent's score instead inflates recorded scores. In preregistered tests on LLM-guided program search, final quality rose with minibatch size in six of seven settings, but the predicted level was not met quantitatively: on bin packing, search reached 62-88% of the predicted gain when the model edited the parent program and 109-119% when it wrote new heuristics. A prompt-optimization test also exceeded the prediction, so whether the tilt describes LLM editing remains open.

arXiv:2611.09699 PDF

6 more specialized papers

Transporting the Past: An Optimal Transport View of Backtracking Counterfactuals Zhangyi Liu, Pouria Fatemi, Suvrit Sra
An Educated Guess: Deriving Statistically Aligned Gradient Estimates for Zeroth-Order Optimisation Justus Huebotter, Serge Thill, Marcel van Gerven et al.
Optimal Probabilistic Answer Set Programming: Complexity and Implementations Damiano Azzolini, Giuseppe Mazzotta, Francesco Ricca et al.
Against All Likelihood David Lopez-Paz
Artificial Shoppers and Attention Competition Xiaomeng Guo, Fasheng Xu, Xiaoli Zhang
Safety Is $\Pi_1$, Provability Is $\Sigma_1$: One Framework for the Hugging Face Breach and OpenAI's Mathematical Proofs Jinho Kang, Jinsook Kim

Reasoning 6

Aspect-wise Pairwise Tournaments for Test-Time Selection

Hannah Guan, Yilun Du When a model samples many candidate answers (best-of-n), picking the best one is the bottleneck. Aspect-wise Pairwise Tournaments (APT) runs a single-elimination tournament in which each matchup between two candidates is decided by a vote among off-the-shelf verifiers, each judging one aspect such as correctness or clarity. Across five domains and three generator models, APT beats binary multi-aspect approval, self-consistency, and reward-model verification, with the largest gains on open-ended tasks. Ablations show that both the pairwise comparison and the per-aspect breakdown are needed, and because nothing is trained, users can steer selection simply by rewriting the aspect prompts.

arXiv:2611.08640 PDF

Failure Profiling and Reachable Trajectory Selection for Reasoning Distillation

Yijun Zhu, Jianxin Wang, Chengchao Shen cross-listed Small models trained on a larger teacher's reasoning traces tend to overfit the teacher's style and break down when their own reasoning drifts, and adding corrective traces does not fully fix this because the corrections still follow the teacher's patterns. Failure Profiling and Reachable Trajectory Selection (FPRT) samples the student repeatedly on each problem and classifies its failure mode by error rate and error consistency. It then prompts the teacher with a strategy suited to that mode and, among the correct candidates, keeps the one whose first steps after the point of divergence the student can most reliably reproduce. This contrasts with reranking methods that score whole trajectories, and the authors report state-of-the-art results on five math reasoning benchmarks with two student backbones.

arXiv:2611.09042 PDF

Learning When to Think: Dual-Reference Offline Optimization for Adaptive VLM Reasoning

Hongbin Lin, Sizhe Zou, Juangui Xu, Xinyue Xu, Zhuoli Ouyang, Stanislav Kolchin et al. Forcing vision-language models (VLMs) to reason at length on every input wastes compute, so the authors train a single model to answer simple inputs directly and reason step by step only when needed. Fast answers and slow reasoning traces usually come from different sampling policies, which skews offline objectives that assume a single reference distribution. DR-BOLT (Dual-Reference BOLT) separates the desired fast/slow mixture from the sampling distribution and corrects the mismatch during reward-weighted training. On Qwen3-VL with ScienceQA and three held-out benchmarks, it improves the trade-off between score and response length, using slow reasoning on 24.1% of inputs and training 2.90 times faster end to end than a reproduced GRPO baseline.

arXiv:2611.09154 PDF

Alignment by Confident Debate: Preference Learning from Multi-Agent Debate

Nikhil Verma, Dingxian Wang, Mohammad Reza Rezaei, Andrew Rabinovich, Zhao Chen Post-training language models for reasoning usually needs gold answers, verifiers, or learned reward models, and these are scarce for many tasks. Alignment by Confident Debate (AbCD) builds preference data from multi-agent debate without gold labels. A committee with diverse sampling debates each problem. Its final answers are then clustered by semantic equivalence and weighted by confidence-weighted disagreement, which avoids the weaknesses of plain majority voting. Tested on math, multiple-choice quantitative QA, and code generation across five model families from 1B to 8B parameters, preference training on these traces beats inference-time ensembling, plain debate, and supervised fine-tuning (SFT) on the same traces, with gains of up to 21.5 percentage points in consensus accuracy, though committees mixing different models and agreement-based weighting show limitations.

arXiv:2611.09568 PDF

CPU-ARC: Agentic Reasoning Caching for on-CPU Reasoning Reuse

Peter Belcak, Greg Heinrich, Saurav Muralidharan, Shizhe Diao, Pavlo Molchanov LLMs solve every problem from scratch even when they have already worked out how to solve that kind of task. Agentic reasoning caching turns LLM reasoning traces into agentic reasoning caches (ARCs), CPU-executable artifacts that apply a worked-out solution to new instances of the same task with little involvement from a language model. ARCs perform on par with frontier LLMs on difficult math and science tasks while being 16–291x cheaper to invoke than the source model, and the authors report that they are fully explainable, can keep being trained, and are robust to input perturbations.

arXiv:2611.09891 PDF

1 more specialized paper

Challenges, Opportunities, and Misconceptions in Neurosymbolic AI Giuseppe Marra (LPI), Pierre Genev\`es (CNRS, LIG et al.