Research
Papers and datasets worth knowing, ranked by significance and community attention.
RATED: Reliability-Aware AI Agent Tool Retrieval via Execution Dynamics
To address this gap, we propose RATED (Reliability-Aware Tool Retrieval via Execution Dynamics), a retrieval framework that combines robust semantic matching with dynamic reliability adaptation.
Accurate but Not Humble: Evaluating Epistemic Humility in LLM Agents under Knowledge Conflict
We propose to evaluate agents on epistemic humility (EH): the agent's willingness to recognize, act on, and communicate uncertainty during task execution.
A Local Agentic AI Framework to Generate Edge Case Scenarios for Safety Assurance
Generating edge case scenarios is crucial for training, testing and safety assuring autonomous systems.
Not All Correct Fixes Run Alike: An Empirical Study of Patch Performance in Repository-Level Issue Resolution
Repository-level issue-resolution benchmarks such as SWE-bench evaluate submitted patches primarily based on whether they pass the correctness tests, leaving the runtime performance of different test-passing patches largely unexplored.
From Reactive Containment to Proactive Assurance: Lessons from OpenAI, Anthropic, and Google Agent Security Incidents
In 2026, cybersecurity evaluations involving OpenAI, Anthropic, and Google agents reached real systems outside their authorized test scope.
Can LLMs Fix It Without Code? Toward Automated Verification of No-Code Bug Fixes
This study proposes an automated, execution-based pipeline for evaluating the capability of large language models (LLMs) to generate no-code fixes in a real browser environment.
Co-Modifying Application Code and Deployment Infrastructure: A Causal Study of AI Agent Pull Requests
Because agents lack deployment awareness, attempting cross-domain modifications introduces unverified dependencies into asynchronous integration pipelines.
AI Models Can Provably Hide Arbitrary Capabilities
We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger.
RESCUE: Is This Alarm Worth Acting On? Counterfactual Evaluation of VLA Runtime Monitors
We introduce RESCUE, a counterfactual framework for evaluating whether a monitor's alarms enable useful interventions.
When AI Advisors Agree: Distinguishing Forecast Risk from Forecast Reliability
If seven AI advisors give similar forecasts, should we trust them more?
Ecology of AI Agents: Collaboration Creates a Population Threshold for Takeoff
Here, we develop an ecological theory of AI-agent populations based on a population growth equation in which fitness (growth rate) depends on cybersecurity capability.
APEX-Harm: Evaluating Agent Safety in Shared Professional Workspaces
We introduce APEX-Harm, a benchmark for evaluating prompt and script injection against long-horizon agents performing finance, consulting, and legal tasks in large workspaces.
Attention Sees, MLP Refuses: Tracing the Attention-to-MLP Safety Pathway in LLMs
We reframe this as a pathway question and make it measurable on residual-stream updates in decoder-only Transformers, separating the harmfulness information a module update exposes from the change it produces in readable refusal evidence.
Cited but Not Consulted: A Counterfactual Audit of Legal Chain-of-Thought Faithfulness
Large language models increasingly justify legal decisions by naming the statute or precedent behind a verdict, treated as evidence that the decision follows from it.
Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub
Agent skills are SKILL.md instructions and scripts that AI coding agents such as Claude Code and Codex run with the permissions of their user.
How Narrative Wrapping Affects LLM Refusal: A Cross-Language Benchmark and Defense
Safety-aligned language models often refuse a harmful request stated directly but answer the same request inside a role-play or narrative wrapper.
TestPrism: Rethinking Test Evaluation Beyond a Single Reference
Large language model (LLM) coding agents have advanced test generation across diverse programming tasks.
On the estimation and validity of AI time horizons---a statistical look at the METR plot
On 228 tasks and 26 AIs, we recompute the time horizons using splines and item-response theory to relax the assumption that the AI difficulty of a task depends linearly on the log of human time.
Right Screen, Wrong Transition: World Models as Verifiers for GUI Agents
We argue that a world model meant for verification should instead predict in the space in which observations are encoded, and present LGWM, a decoder-free, action-conditioned world model that predicts the representation of the next screen directly, trained without semantic annotation on 1.85M real GUI transitions.
Byzantine-Resilient Federated Large Language Model via Hypergraph Message Passing
To strengthen the resilience of FedLLMs, we develop a novel Hypergraph Message Passing Graph Autoencoder (HMP-GAE) framework, where low-rank model updates are represented as nodes in a hypergraph and high-order semantic relationships among multiple agents are exploited through iterative message passing.
ReSI: Recursive Safety Improvement toward Resistant and Resilient AI
Recursive self-improvement, the participation of AI systems in improving their own capabilities, is beginning to move from theoretical prospect to practice, posing both challenges and opportunities for safety alignment.
VIGOR: Verifiable Industrial Geometry Optimization and Repair in Scene Programs
We further propose VIGOR, which combines supervised scene-program generation with execution-grounded verification and staged geometric refinement.
CAPABLE: Capability-Aware Policy Adaptation via Behavioral Latent Encoding
We introduce CAPABLE, a unified capability-aware adaptation framework for frozen VLAs that integrates self-supervised capability inference with residual reinforcement learning.
DRYLAB-Bench: Benchmarking the Biosecurity Risk of Agentic LLM Mutation Design
To address these gaps, we introduce DRYLAB-Bench (Design Risk Yielded by LLM Agent in Biodesign), the first comprehensive benchmark evaluating the high-risk biological mutation design capabilities of LLM agents.
Work2Skill: Capturing Human GUI Experience for Reusable Agent Skill Induction
We thus introduce Work2Skill, a framework that captures human GUI experience for reusable agent skill induction.
Traceable World State: A Provenance-Aware State Representation and Deterministic Replay Framework for Robotic Systems
We present Traceable World State (TWS), a middleware-neutral semantic representation and reference runtime for provenance-aware robot world state.
LTBD: Learnable Trust-Boundary Delimiters for Prompt Injection Defense
To address this, we introduce Learnable Trust-Boundary Delimiters (LTBD), a lightweight defense that explicitly encodes trust boundaries in the input while keeping the LLM parameters unchanged.
Policy Alignment: New Signals for Membership Auditing in On-Policy Distillation
In this paper, we propose Policy Alignment Membership Auditing (PAMA), a new auditing framework tailored for OPD.
Constitutional Gating and Deterministic Recovery for Multi-Agent LLM Negotiation: Ablations Against a Stateful Adversarial Gatekeeper
We study a three-part control stack - a 5-Pillar runtime constitution, a 4-tier swarm (Director, three-agent majority vote, Monitor, schema hard gate) and Cognitive Annealing (deterministic deadlock detection, atomic purge of the agent-side context, a canonical recovery message) - against a released adversarial Gatekeeper whose acceptance rules are fixed regular expressions and whose LLM only renders reply text.
OnTrack: Real-Time Monitoring and Intervention in LLM Agent Trajectories via Streaming Structure-Aware Optimal Transport
To overcome this, we propose OnTrack, a streaming monitoring mechanism that compares an agent's steps and dependencies against recorded successful runs to alert users or block the agent in about a millisecond per step.
AgentHorizon: Evaluating Agentic Judges for Long-Horizon Computer-Use Tasks
To this end, we introduce AgentHorizon, a benchmark of 1,373 computer-use tasks (instruction-trajectory pairs) drawn from 166 hours of human-recorded trajectories spanning three operating systems.
X-AgentRed: Red-Teaming Personal Agents in Evolving Multi-Service Ecosystems
To address this, we propose X-AgentRed, a self-evolving red-teaming framework that discovers harmful tool call paths through a graph of tool dependencies and expands and refines them using execution feedback.
SWE-Journey: Towards More Realistic Evaluation of Coding Assistants through Long-Horizon, Multi-Turn Interaction
To address these gaps, we introduce SWE-Journey, a benchmark for more realistic evaluation of coding assistants.
SafeDiSTL: Decomposing Joint Constraints for Safe Multi-Agent Reinforcement Learning
We present SafeDiSTL, a constrained multi-agent reinforcement learning framework that allows for credit assignment even with joint constraint measurements.
False Claims, Credible Images: A Red-Teaming Benchmark for Commercial Image Generators
To fill this gap, we introduce EpiReal-Bench, the first systematic benchmark for evaluating visual misinformation risks in commercial image generators, comprising 10k false-claim prompts and 10k corresponding generated images that span 10 real-world claim categories and 10 credible visual formats.
Cooperative Aerial Transportation of a Payload with a Sliding Cable Attachment
This paper presents a dual-quadrotor hook- suspended transport system for cooperative aerial manipulation of a payload that is not rigidly attached to a fixed point along the cable.
Private and Distributionally Robust Federated Multiclass Classification
To address these limitations, we develop a differentially private, distributionally robust framework for federated multiclass classification that provides sample-level privacy for records stored at each client.
SWE-DeceptionBench: Benchmarking Deceptive Behaviors of LLMs Across the Software Development Lifecycle
To study this behavior, we introduce SWE-DeceptionBench, a benchmark for evaluating LLM deception in software engineering.
Safe Actions Alone Do Not Ensure Safe Agents: Identifying Unfulfilled Obligations with Guard Models
In this paper, we argue that agent safety also depends on identifying required yet unperformed safety-critical actions, which we call obligations.
Distillation for Incrimination and Distillation for Capabilities
Powerful misaligned AI models might recognize alignment evaluations and strategically behave well on them, rendering direct audits uninformative.
One Word Opens the Gate: The Option-Channel Attack on Typed Decision Models as Agent Guardrails
A typed decision model reads a piece of text and returns a probability over caller-defined options, each with a short written definition, generating no text.
AgentEvolver: System-Wide Self-Evolution Through Task Execution
We present AgentEvolver, a system for developing capabilities during task execution while keeping the foundation model fixed.
Chronos Enables Code Agents to Reason over Software Evolution
We introduce Chronos, a test-time framework that makes this connected history available to large language model (LLM)-based code agents.
Cross-Provider Review as a Runtime Contract for Coding Agents: A Controlled Pilot and Fault-Injection Study
We describe an advisory cross-provider review contract: distinct resource pools, bounded execution, restricted reviewer capabilities, complete input delivery, usable semantic output, explicit failure states and durable per-attempt evidence.
AgentSWE: Can Coding Agents Build the Agent You Actually Want?
We introduce AgentSWE, a benchmark for agent software engineering spanning three stages of the agent development lifecycle: Creation of a complete agent from a natural-language requirement, Editing of production agent codebases, and Optimization toward a measurable target.
Agreement Without Alignment: Label-Free Rubric Clarification Increases LLM-Judge Consensus but Not Agreement with Humans
LLM judges are increasingly deployed as panels, and disagreement among panel members is often read as a symptom of an unclear rubric.
MultiWorldBench: Do Independently Controlled Views Describe One Shared World?
We introduce MultiWorldBench, a diagnostic Minecraft benchmark containing 495 case configurations across seven task suites and ten capabilities, including independent control, cross-view motion, shared-state synchronization, persistence, structural reasoning, concurrent interaction, and delayed revisit.
Agent4Spec: An LLM-based Agentic System to Optimize API Specifications through Automated Validation and Market Analysis
To address this issue, we present Agent4Spec, an autonomous multi-agent framework featuring two distinct pipelines: (1) a validation pipeline that detects and self-corrects OpenAPI syntax errors, and (2) a market analysis pipeline that conducts competitive research, identifies functional gaps against industry leaders, and automatically generates missing API-spec functionalities.