📑 Papers756

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types1865 Papers756 Articles578 Repos204 Threads147

More types6

Write-ups82 Tools54 Talks23 Advisories9 Other7 Courses5

📑 Papers

huggingface.copaper

Your Benchmark Is an Empirical Measure Over Difficulty

The paper treats a benchmark as an empirical measure over item difficulty and formalizes two failure modes: measure mismatch (benchmark difficulty distribution differs from the intended one) and coverage gaps (uncovered difficulty regions that hide localized training progress). It proposes two diagnostic metrics with theoretical guarantees and analyzes 25 popular benchmarks across 7 domains using estimated item difficulties. It also introduces BenchFill, a difficulty-targeted item rewriting algorithm that reduces local coverage gaps.

BenchFill

evals, research· Added 31 Oct 2026

huggingface.copaper

WorkFactory: Turning Professional Intents into Executable Work for Scalable Agent Training

WorkFactory is a framework that builds coherent, executable professional tasks for training working agents. It plans an information support graph from professional intents, then uses probe executions to find and repair missing or inconsistent task information. The authors built 112,686 tasks across 612 occupations and fine-tuned Qwen models at 4B, 27B and 35B-A3B (WorkPilot). WorkPilot-35B-A3B rose from 879 to 1565 Elo on GDPval-AA v2.1.

QwenHugging Face

WorkFactoryWorkPilotGDPval-AA v2.1

training, agents, research· Added 30 Oct 2026

deploymentsafety.openai.compaper

GPT-Rosalind-6 System Card Addendum

GPT-Rosalind-6 System Card Addendum describes OpenAI's life-sciences reasoning model, which uses the same weights as GPT-6 Astra and is offered only through trusted access. It reports life-science benchmark gains over GPT-Rosalind-5.5 (MedChemBench v7 49.6% vs 28.9%), High-capability Biological and Chemical Preparedness results, and below-threshold Critical bio design evaluations. It also covers access controls, refusal evaluations, cyber jailbreak regression and alignment tables.

GPT-6 AstraGPT-Rosalind-6GPT-Rosalind-5.5

OpenAIPreparedness FrameworkMedChemBench v7+16

ai-safety, evals, models· Published and added 30 Oct 2026

research, training· Added 31 Oct 2026, published 29 Oct 2026

research, agents, evals· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper

The paper studies detection and temporal localization of fraudulent inducements (prompts to follow, join chat groups, click links) in internet finance short videos. It compares OCR+LLM, OCR+MLLM and a zero-shot MLLM, and builds a dataset of 2,419 videos (66.49 hours, 3,194 events, four categories). OCR+MLLM reaches mIoU 26.52 versus 14.49 for keyframe OCR+LLM, with 67.0 percent macro recall, using a recall-weighted F2 localization reward.

DCKV is a differentiable codec for the prompt KV cache of hybrid language models, which keep a KV cache only in their few full-attention layers. Transform, quantizer and entropy models (conditioned on prompt tokens and already decoded neighbouring positions) are trained end to end against a frozen model. On Qwen3.5-2B it stores a token in over 55 times fewer bytes than bf16 with at most 1.8 points lost on three long-context benchmarks, and over 100 times fewer with at most 3.6 points lost.

Qwen3.5TransformerLLM

DCKVarXiv

research, inference· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper

AxisQ: Depth-Adaptive Channel--Frequency Quantization for Camouflaged Object Detection

AxisQ is a post-training quantization framework for camouflaged object detection (COD) that allocates activation bits by feature depth. It uses the channel domain for shallow features and the local-frequency domain for deep features, under a fixed per-layer average bit budget. It adds a boundary-aware Hessian approximation for reconstruction. On CAMO at W2A2, weighted F-measure improves 12.7% for CFRN and 33.3% for CamoFormer-P over the strongest baselines.

CNNTransformer

AxisQCFRNCamoFormer-P+1

research, inference, multimodal· Added 28 Oct 2026, published 27 Oct 2026

eprint.iacr.orgpaper

OblivDGL: Oblivious Deep Graph Learning Made Practical

OblivDGL is a framework for secure GNN training and inference in machine-learning-as-a-service settings, modelled on Deep Graph Library. It uses an oblivious message passing paradigm and a new oblivious graph representation built on function secret sharing, revealing only the total node and edge counts. On four benchmark graphs it cuts training communication up to 1024x with up to 14.3x speedup, and inference communication up to 754x with 4.19x speedup.

Deep Graph Librarygraph neural networkfunction secret sharing

OblivDGLNDSS

research, training, inference· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper

Folding Attention Biases into Keys Makes Compacted KV Caches Run on Standard Kernels

The paper folds the per-key logit bias of Attention Matching (AM) KV cache compaction into the keys along one closed-form direction per head, fitted on context queries. The result is a plain cache that FlashAttention and vLLM paged caches can use, with output error bounded by how far each query's projection on that direction is from 1. Unmodified vLLM serves folded caches through a KV connector. On QuALITY and LongHealth the fold is within noise of AM in 13 of 14 settings. Under AM's published per-head budgets it is within noise in 9 of 10.

Persistent Closed-Form Routing (PCR) is a plug-and-play method for multivariate time-series forecasting. It alternates exact conditional estimation of channel-specific mixture weights with gradient training of low-rank residual experts around a frozen pretrained forecaster. Across eleven datasets and three backbones, PCR-K4 cuts dataset-balanced MSE by 3.86-14.25% and beats competing specialization methods with fewer trainable parameters. The paper also introduces GalaxyTS, a synthetic dataset with exact shared and channel-specific references.

Mixture of ExpertsTransformer

GalaxyTSPCRPCR-K4+1

research· Added 27 Oct 2026, published 24 Oct 2026

arxiv.orgpaper

Task Format as a Factor in Adaptation: A Controlled Comparison of LoRA and Full Fine-Tuning for Prompt-Safety Classification

This paper compares LoRA and full fine-tuning for prompt-safety classification using a matched 400M encoder-decoder pair (Ettin) across three task formats, with up to 15 seeds per cell and pre-specified analyses. Full fine-tuning leads LoRA by 2-3 pp at the pre-specified learning rates, and the encoder gap closes when both use the same learning-rate search. Training LoRA to write a reason after its verdict adds 4.0 pp, while a content-free sentence of equal length does not. Trained models beat a prompted 8B in domain but trail it by 8-23 pp on adversarial jailbreaks and over-flag benign prompts (27-66% against 2-3%).

LoRAEttinTransformer

training, research, evals· Added 27 Oct 2026, published 24 Oct 2026

arxiv.orgpaper

IntentDelta: A Human-Constructed Benchmark for Evolving User Intent

IntentDelta is a human-constructed multi-turn benchmark of 638 trajectories and 3,766 turns across WebShop and TravelPlanner. Each turn pairs a user utterance with a cumulative intention state and human reference actions. Across eleven agents, average Intention Recovery is 33.1% in TravelPlanner and 44.7% in WebShop, and average Action Score is 31.6% and 41.0%. Agents lose earlier requirements and confuse soft preferences with must-have constraints.

LLM

IntentDeltaWebShopTravelPlanner+1

evals, agents, research· Added 27 Oct 2026, published 24 Oct 2026

arxiv.orgpaper

This paper builds a controlled French surface-variant benchmark with seven task types and 4,200 original-low-high triplets (12,600 inputs), covering missing apostrophes and diacritics and keyboard typos. Six models from two LLM families lose accuracy and show worse Brier score and NLL as perturbation grows. Keyboard typos hurt most. Calibration temperatures fitted on original inputs transfer to variants, and combining them with input restoration improves reliability further.

MCP-Injector is a protocol-aware fault-injection middleware for Model Context Protocol tool calls, with permanent, transient and intermittent faults on seedable schedules. Its fault model comes from 57,240 issue and PR threads across 1,774 open-source MCP repositories. In a 1,350-cell experiment, faults cut task-completion score by 60% (8.08 to 3.23 of 10), and the 120B gpt-oss model was no more resilient than the 20B. Agent stacks differed in how well they absorbed faults.

Model Context ProtocolOpenAI Agents SDKLangChain+2

MCP-Injectorgpt-oss-120bOpenAI

mcp, evals, agents, research· Added 26 Oct 2026, published 23 Oct 2026

arxiv.orgpaper

This paper measures how hints such as "[Source] thinks the answer is (X)" shift LLM answers on MMLU questions, varying the source between a professor, a friend and a dog across Qwen, Gemma and SmolLM models. The shift fits an exponential tilt: a roughly constant mean change in the hinted answer's log-odds, with susceptibility largely shared across sources. The shift persists when the source is declared inaccurate or the prompt warns against trusting it. Synthetic experiments show how KL-regularized reward training could produce this pattern.

The SC-matrix is an evaluation framework for multilingual LLM sycophancy. It crosses a model's competence (correct answer with no pressure) with its sycophancy (keeping that answer under pressure), so agreeing with a false premise can be told apart from not knowing the answer in that language. Results: equal aggregate sycophancy rates hide different failure mixes, high competence does not always protect, and reasoning-oriented mitigations beat directive ones.

This paper presents a multimodal engineering GraphRAG framework that links post-wind-event damage evidence from images and reconnaissance reports to building-condition states, recovery actions and downtime. Evidence is stored as a provenance-preserving, component-level representation, and graph-aligned retrieval uses compatibility, contradiction, evidence-precedence and abstention checks. Demonstrated on tornado-affected low-rise homes, it beats BaselineRAG and Structured Baseline RAG, and ablations test each component.

RAGGraphRAG

BaselineRAGStructured Baseline RAGarXiv

research, llm-apps, multimodal· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaper

KNOX: Hardware-assisted Regulatory Sandbox for Generative Models

KNOX is a regulatory sandbox for generative models that runs AI workloads inside trusted execution environments (TEEs). For agentic workloads, it derives an attested policy manifest from the user prompt (applicable regulations, expected tool calls, permitted system calls). An attested reference monitor checks each action against it, and an attested execution graph records every action and verdict. Overhead is under 1%.

trusted execution environmentLLM

KNOXarXiv

research, ai-policy, agents· Added 22 Oct 2026, published 20 Oct 2026

huggingface.copaper

Mise-en-Video (MeV) is a multi-shot video generation framework where creators stage shots in 3D space and then generate the matching video. It combines hierarchical attention for multi-level narrative consistency with 3D-aware layout guidance for per-shot spatial control. The authors built a 160K-video dataset with hierarchical multi-shot texts and oriented 3D bounding boxes, and report gains over baselines in quality, consistency and subject controllability.

This paper is a controlled, large-scale evaluation of biomedical Retrieval-Augmented Generation across growing corpus sizes. It compares abstract, flat full-text and hierarchical full-text representations, with and without reranking, on multiple-choice QA over five external benchmarks and a held-out test set. RAG gave mean gains of up to 9.6 points externally and 10.2-30.3 points on the held-out set. Hierarchical indexing used 67% fewer units and 44-56% less storage than flat full-text.

RAG

arXiv

research, llm-apps, evals· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper

How Effectively Do Security Skills Guide Coding Agents in Vulnerability Detection in Linux Kernel?

The paper is a large-scale study of 37 security skills run through Claude Code with four LLMs on 100 real Linux kernel vulnerabilities, 14,800 runs in all. Only 24.4 percent of runs found the correct function and 15.7 percent classified the vulnerability correctly. It proposes SKILL-SIF, which evolves skills from failure patterns and raised fully correct detection on 100 unseen vulnerabilities from 2 to 16 percent.

Claude CodeLinuxLLM

SKILL-SIF

evals, coding-agents, prompting· Added 21 Oct 2026, published 19 Oct 2026

huggingface.copaper

Self-evolving Agent Harness

Self-evolving Agent Harness is a 66-page survey and theory paper on revising an agent's scaffolding (prompts, memory, workflows, tools, code, plugins) while model weights stay fixed. It frames search as evolutionary optimization and uses continual PAC-learning to derive a generalization bound, a retention bound and a high-probability admission rule with fresh validation data. It separates selection, activation, attribution and improvement as evaluation claims, and covers applications and governance. Code is at github.com/zgcagi/Harness-RSI.

LLM

Harness-RSIHugging Face

agents, research, evals· Added 19 Oct 2026

eprint.iacr.orgpaper

HERMES: High-Performance Private Decoding for Large Language Models

HERMES is a privacy-preserving inference (PI) system optimised for multi-token LLM decoding rather than prefill. It swaps high-round nonlinear protocols for compute- and bandwidth-heavy ones with fewer rounds, and adds a homomorphic-encryption matrix-multiplication protocol that keeps the KV cache encrypted on the server and uses grouped-query attention. On Llama 3.1 8B Instruct it cuts TPOT by up to 2.7× and total PI latency by up to 2.1×.

LlamaLLMTransformer+1

Llama 3.1 8B InstructHERMES

research, inference· Added 19 Oct 2026, published 18 Oct 2026

arxiv.orgpaper

Hybrid Reasoning Agents: LLM agents that think in latent space, act through text

Hybrid Reasoning Agents (HybridAgents) are LLM agents that switch between latent reasoning and text-based interaction in one generation process. A lightweight HybridLink handles mode transitions, continuous working memory keeps hybrid context across turns, and HybridSFT plus HybridRL train when to think latently and when to act in text. Across 3 model scales and 11 benchmarks, the paper reports 10.4% higher performance, 35.5%-54.7% fewer tokens, and 1.8x-2.6x faster inference.

LLM

HybridAgentHybridLinkHybridSFT+2

research, agents, training· Added 19 Oct 2026, published 18 Oct 2026

anthropic.compaper

How employment is changing at Anthropic

"How employment is changing at Anthropic" is an October 2026 technical report by Nathan Wilmers, Regina Catipon, Maxim Massenkoff and Peter McCrory. It uses internal employment, agent telemetry, output, survey, calendar and hiring data plus 17 interviews. Junior technical hiring fell from 27% to 9%, agent hours reached six times employee hours by August 2026, and adopters' output rose. Employees increasingly do meta-work managing agents.

ClaudeClaude CodeSlack+1

AnthropicNathan WilmersRegina Catipon+5

ai-policy, agents· Added 19 Oct 2026, published 18 Oct 2026

arxiv.orgpaper

ToFu: Exploiting and Fuzzing the LLM–Orchestrator–Tool Trust Boundary

ToFu is a tool-aware fuzzing framework for LLM tools, including MCP servers. It maps each tool argument, using its metadata, to one of 74 CWE-guided semantics-aware sanitizers (path, URL, SQL and similar). It then generates schema-valid Atheris harnesses and semantic oracles, using runtime tracers for in-process tools and outcome oracles for opaque ones. The LLM (gpt-4.1) only maps sanitizers and writes seeds; it is never the security judge. The paper also shows a "Repeat-After-Me" trick, where an LLM told to repeat attacker-crafted text emits a tool call the orchestrator executes, reproduced on LangGraph, MAF, ADK 2.0, AutoGen, Strands and CrewAI. Across 273 runnable MCP servers (3,405 tools) it reports 253 verified bugs in 343 tools across 118 servers, such as path traversal, log injection and exfiltration. These are failures a crash-based fuzzer would miss. The result matters because it shows LLM-generated tool arguments cannot be treated as trusted.

EDIC is a decomposed reward framework that trains LLMs to decide, for each instruction embedded in external data such as documents or tool returns, whether to follow or reject it. A judge initialized with SFT and refined with GRPO attributes compliance per instruction and yields separate rewards for beneficial and harmful compliance. On Qwen3-4B it raises harmful-rejection by up to 7.7% and Arena-Hard-Auto utility by 12.5% over the strongest prior defense.

GRPOQwen3LLM

EDICQwen3-4BArena-Hard-Auto+1

research, training, ai-safety· Added 20 Oct 2026, published 16 Oct 2026

huggingface.copaper

Doc2Harness: Benchmarking LLMs on Long-Horizon Harness Engineering of Coding Agents

Doc2Harness is a two-stage benchmark for harness engineering. In Stage 1 a build model, working inside a fixed builder harness, gets an interface-only contract skeleton plus a development document consolidating behavior from twelve frontier harnesses, and builds a full candidate harness in an isolated container. In Stage 2 the frozen harness runs in separate per-test-case containers, driven by a scripted mock model, and is scored on four channels: requests sent to the model, files on disk, exit code and command output. Across 19 frontier models with three builds each on 328 test cases, GPT-6 Astra leads at 53.05% against 27.44% for the weakest, and failures cluster around how cross-cutting functionality is split across modules.

Docker

Doc2HarnessGPT-6 AstraHugging Face

evals, coding-agents, agents· Added 16 Oct 2026

arxiv.orgpaper

Between Spoilers and Guesswork: Avoiding Over-Specification in Coding Benchmarks

This October 2026 arXiv paper studies task over-specification and under-specification in repository-level coding benchmarks. It shows that hints derived from ground truth, as added in SWE-bench Pro, FEA-bench, Doc2Feat-bench and Multi-SWE-bench, leak spoilers in some of them. The authors test several specification levels, recommend techniques for parsimonious hints, and plan to release their hints.

SWE-Bench ProFEA-benchDoc2Feat-bench+2

evals, coding-agents, research· Added 20 Oct 2026, published 16 Oct 2026

arxiv.orgpaper

X-RIC (eXplainable RIC) is a framework that adds agentic reasoning to the O-RAN Near-RT RAN Intelligent Controller. It combines reactive reinforcement learning with automated behavioral cloning from domain heuristics, a transformer-based Telecom Language Model for contextual abstraction and interpretability, and closed-loop co-adaptation for continuous policy refinement. The paper also introduces BARX, a benchmark for agentic RAN control that measures latency, compliance and determinism. On SLA-aware network slicing, in simulation and on an O-RAN-compliant testbed, it reports 89% lower operational cost with SLA compliance kept, 75% faster convergence, 50% fewer training steps and 46% lower variance.

GraphACM merges equivalent states from multiple rollouts of the same LLM agent task into a directed, action-labeled graph, so actions can be compared at shared decision states. It defines node-level and global action-consistency measures, and uses the global score as an uncertainty proxy to predict task success or failure. Across three LLMs on ALFWorld, AppWorld and WebShop it reaches an average AUROC of 0.811, above the strongest behavioral-consistency baseline (0.729) and verbalized confidence (0.769). It also shows where in a trajectory agent actions diverge.

LLM

GraphACMALFWorldAppWorld+2

research, agents, evals· Added 17 Oct 2026, published 15 Oct 2026

eprint.iacr.orgpaper

SecAgg++: A Post-Quantum Privacy Preserving Federated Learning Protocol

SecAgg++ is a masking-based secure aggregation protocol for single-server federated learning that uses post-quantum cryptographic primitives. It keeps the communication and computation efficiency of SecAgg and SecAgg+ and handles client dropout through an efficient recovery procedure. It matters because most masking-based secure aggregation protocols are not post-quantum secure, which leaves federated model updates exposed to future quantum adversaries.

Federated LearningSecure AggregationPost-Quantum Cryptography+1

SecAgg++SecAggSecAgg++1

research, training· Published and added 15 Oct 2026

arxiv.orgpaper

GACC-Bench: Benchmarking Goal-Adaptive Context Compression Ability across Large Language Models

GACC-Bench is a benchmark for Goal-Adaptive Context Compression, testing how well LLMs retain goal-relevant information when compressing a source context under a length budget before downstream questions are known. It has 500 goals and 2,571 human-reviewed questions over 281 document and agent-trace contexts from seven collections; a fixed reader answers the withheld questions from the compressed context. Ten LLM compressors show large gaps to full-context performance, especially in answering every question tied to a goal. Target-goal conditioning improves accuracy over goal-agnostic compression, while mismatched goals hurt it.

LLM

GACC-BencharXiv

evals, llm-apps, research· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper

From Perception to Prediction and Intervention: Benchmarking Proactive Video Assistants in Real-Life Scenarios

Introduces P^3IBench, a benchmark for proactive video understanding in real-life streaming scenarios, covering three capabilities: daily perception, risk prediction and intervention. It evaluates 12 open-source and proprietary video-language models (streaming and adapted non-streaming) and finds they struggle to make well-calibrated decisions about when to respond. The authors also build extra proactive training data and train P^3I-Assistant-4B, which improves several tasks unevenly, showing that proactive assistance needs response timing and restraint as well as visual understanding.

vision-language model

P^3IBenchP^3I-Assistant-4BarXiv

evals, multimodal, research· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper

Multi-Reward Hacking: From Aggregation-Induced Drift to Trust-Anchored Defense

The paper shows that symmetric aggregation of a primary reward (correctness) and auxiliary rewards (brevity, efficiency) in LLM post-training can raise aggregate reward while primary-task performance falls. It proves that deterministic conditional-mean GRPO converges to auxiliary-favoring behavior when auxiliary rewards are more reliably obtained. It proposes Trust-Anchored Gating (TAG), which elects an anchor channel by policy drift and gates auxiliary credit on anchor satisfaction. On Qwen3-4B with a brevity reward, TAG reaches 0.581 pass@4 versus 0.220 for additive aggregation, and shortens responses by 44% relative to correctness-only training. Experiments on Qwen and Llama models cover math and program synthesis.

GRPOQwen3Qwen+2

Qwen3-4BarXiv

training, research· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper

Recursive Reward Improvement via Adversarial Meta-Prompt Evolution

Introduces Recursive Reward Improvement (RRI) for recursive self-improvement on open-ended expert tasks without answer keys, where a proposer writes both a task and a rubric. Before the solver trains, an adversary writes a rubric-gaming but useless answer, the same model writes an honest answer without seeing the rubric, and up to two repair steps revise the rubric until the honest answer wins. Exploits found also rewrite future task and rubric generation. On HealthBench Professional it beats a Generation Only baseline by 10.9 points at 9B and 12.4 at 27B (10.3 with no external model), and the 27B model transfers to PRBench Hard (+6.6) and ProfBench (+8.0).

LLM

HealthBench ProfessionalPRBench HardProfBench+2

research, training· Added 17 Oct 2026, published 15 Oct 2026

huggingface.copaper

Harness^2: Recursive Agent Harnessing for an Open World

Harness^2 is a plug-and-play framework that recursively improves LLM agent execution harnesses in open-world settings where no ground-truth verifiers exist. Task-level recursion uses a contrastive Propose-Probe-Compose step to guide harness edits for the current task, and it scales through parallel or sequential recursion. Harnessing-level recursion distills experience from those edits into a continual-improvement harness for future tasks. A single step improves GLM-5 and Gemini 3.5 Flash over their base harnesses by up to 11.5 points on WorkBuddy-Bench, 4.5 on JobBench and 11.8 percentage points on LAB.

GLMGeminiHugging Face

GLM-5Gemini 3.5 FlashWorkBuddy-Bench+2

agents, research· Added 14 Oct 2026

arxiv.orgpaper

Thinking in Graphs: Neo4j-Backed Exploit-Chain Reasoning for LLM Penetration-Testing Agents

ChainGraph is a pattern that moves exploit-chain reasoning out of the flat context window and into a Neo4j property graph. Findings, attack steps, credentials, assets and tamper-evident evidence receipts are typed nodes with pre/post-condition edges. The graph is wired to Claude Code or Codex through MCP with no custom harness. Five operator questions (next-step inference, entry-to-crown-jewel pathing, combined-severity promotion, evidence provenance, chokepoint identification) become reusable Cypher and Graph Data Science queries, plus a chain-severity score. On a synthetic multi-forest Active Directory lab modeled on GOAD, three findings rated Medium in isolation become Critical once their path to the forest root is materialized. Scoping each decision to a graph result cut the reasoning payload by about 98% on a token proxy. The authors say the results are illustrative single-run measurements, not a benchmark.

Neo4jModel Context ProtocolClaude Code+4

ChainGraphGOADarXiv

agents, mcp, research· Added 17 Oct 2026, published 14 Oct 2026

eprint.iacr.orgpaper

DPF-SGD: Byzantine-Robust Differentially Private Federated SGD with Exact Optimality Guarantees

DPF-SGD is a federated SGD algorithm that stays robust to Byzantine agents while satisfying ϵ-differential privacy. It combines private step sizes with a DP noise-decay schedule and adds a privacy-preserving comparative elimination (PPCE) filter that suppresses Byzantine updates during aggregation. The authors prove almost-sure convergence to the global optimum despite persistent noise and adversaries. On synthetic and MNIST data, final optimization error is one to two orders of magnitude lower than DP baselines.

DPF-SGDSGD

MNIST

research, training· Published and added 14 Oct 2026

huggingface.copaper

Scaling Agentic Data for Long-Horizon Terminal Intelligence

Introduces TerminalHorizon, a fully automated data synthesis engine for long-horizon terminal agents. It uses independent execution to find key work omitted during environment construction and rebuilds the environment from that evidence. It then progressively expands tasks under the same goal with new requirements that build on earlier results. The authors build 1.5K task environments and run supervised fine-tuning of Qwen3.5-27B to get TerminalHorizon-27B, which improves on all 12 benchmarks covering coding-agent tasks, real-world production agentic tasks and general reasoning. Multiple RSI case studies with a 12-hour research budget show the model continuing to experiment past an initial solution and keeping effective improvements in its final deliverables.

Qwen3.5Hugging Face

TerminalHorizonTerminalHorizon-27B

training, agents, research· Added 13 Oct 2026

arxiv.orgpaper

Evidence-First Agentic Verification

Introduces Sauron, an evidence-first agentic verifier that checks rubric criteria for long-horizon agent tasks by investigating both environment state and execution trace, and trusts a claim (including an agent's self-reported success) only after validating it against its source. Bounded queries and joint investigation of related criteria cut context use, and each verdict carries an auditable evidence receipt. On 2,586 human-labeled criteria from 100 personal-assistant episodes it has the best F1 of five verifiers across eight backbones (0.96 vs 0.92 for Gandalf with GPT-5.6 Sol, at 23% lower cost). It detects 97% of injected failures across 13 fault families, including reward-hacking simulations, with 2% false flags on clean controls, and leads on the TRAIL agent-error benchmark. It matters because unreliable rubric verdicts used as RL rewards can reinforce bad behavior.

SauronGandalfTRAIL+2

evals, agents, research· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaper

LLM-based Code Auditing by Inferring and Evaluating Developer Assumptions

Presents Creed, an LLM-based code auditing approach that, for a given function, infers the developer's security-related beliefs, scores how reasonable each belief is, and derives the conditions under which it is violated. This lets it find semantic flaws, such as timing side-channels in authentication, that syntactic static analysis tools miss, and it explains root cause, symptoms and exploitability. The paper also introduces two evaluation measures for explanation-based vulnerability detection: recall (how well a known vulnerability is correctly explained) and overhead (the effort of inspecting reports). On a recent real-world benchmark, Creed beats existing explanation-based tools on the effectiveness-effort trade-off.

LLMstatic analysis

CreedarXiv

research, evals· Added 15 Oct 2026, published 11 Oct 2026

huggingface.copaper

MiMo-V2.6: Scaling Reinforcement Learning Towards Self-Improvement

Technical report for Xiaomi's MiMo-V2.6 omni-modal model family, which scales RL compute along three axes: asynchronous training with 1,568 samples and 2.7-3.7B tokens per step at up to 1M context, more diverse environments (code, general, visual, cyber) under mixed agent harnesses, and groupwise agentic grading that gives better reward signals and favors shorter, token-efficient solutions. Stability measures include a frozen MoE router and a multi-layer defense against reward hacking, built on a mid-trained hybrid-SWA architecture. The authors open-source training dynamics, RL environments and the RL framework, which makes it a useful reference for reproducing scaled agentic RL.

Mixture of ExpertsHugging Face

MiMo-V2.6Xiaomi

training, research, agents· Added 10 Oct 2026

arxiv.orgpaper

KedgeFlow: A Programmable Control Plane for Enterprise AI Agents

KedgeFlow specifies language-independent contracts so trusted controllers can authorize state-changing operations by enterprise AI agents and privileged gateways can enforce that authority independently of agent reasoning. It combines evidence-backed policy checks, signed permission for an exact action, a single-use shared allowance, target-side conditions and retained outcome records, with two conditional properties (at most one claim per allowance; every dispatch linked to a grant and claim) that hold even if the agent is compromised. A reference implementation exposes the path via MCP; evaluation on a three-member etcd cluster gave exactly one successful claim for each of 82 allowances across 6,560 concurrent attempts, and one committed effect in a 32-call gateway race. The authors report limits: permissive policy still authorized an undesirable effect, and distributed reservations, production access routes, crash recovery and real-target exactly-once effects remain untested.

Model Context Protocoletcd

KedgeFlowOpenFlowarXiv

agents, ai-infra, research· Added 15 Oct 2026, published 10 Oct 2026

eprint.iacr.orgpaper

Confidential Error-Correcting Codes

Introduces Confidential Error-correcting Codes (CECs), a primitive that decodes reliably from perturbed codewords while keeping the message confidential, defined by confidentiality, robustness and soundness. The Randomness-Security Separation framework encodes a nonce and masks the payload with a PRF; the Conc-CEC instantiation uses concatenated Reed-Muller and Reed-Solomon codes and claims stronger concrete security than PRCs (CRYPTO'24). The application, CECMark, watermarks AI-generated images and reportedly beats Gaussian Shading, PRCMark and T2SMark across 56 perturbations with a false positive rate below 1e-5 and no side effects.

Reed-Muller codesReed-Solomon codespseudorandom function

Confidential Error-Correcting CodesCECMarkConc-CEC+5

research, multimodal· Added 14 Oct 2026, published 10 Oct 2026

arxiv.orgpaper

SecReason: Vulnerability Detection and In-Stream Self-Repair for LLM Code Generation

SecReason is an in-stream defense for reasoning LLMs that write code. Reasoning models draft code early in their streamed chain of thought, so SecReason scans that stream with dual-track incremental analysis: security rules are checked on each emitted statement, and dataflows are traced across the accumulated code. When a rule fires, it interrupts decoding, inserts a warning into the stream and resumes, so the model fixes its draft within the same reasoning trace instead of regenerating the full response. On CWEval and SecCodeBench, runs delivering secure and functionally correct code rise from below 15% to 72.8%–98.1%. It uses fewer tokens than post-hoc repair and limits functional regressions when rules misfire on secure code.

LLMstatic analysis

SecReasonCWEvalSecCodeBench

research, coding-agents· Added 15 Oct 2026, published 10 Oct 2026

arxiv.orgpaper

SecReason: Vulnerability Detection and In-Stream Self-Repair for LLM Code Generation

SecReason is an in-stream defense for reasoning LLMs that write code. Reasoning models draft code early in their streamed chain of thought, and SecReason scans that draft incrementally with security rules, checking each statement as it is emitted and tracing dataflows across the accumulated code. When a rule fires, it interrupts generation, inserts a warning into the stream, and resumes decoding, so the model repairs the draft within the same reasoning trace. On CWEval and SecCodeBench it raises the share of runs that deliver secure and functionally correct code from under 15% to 72.8%–98.1%. It uses fewer tokens than post-hoc repair and limits functional regressions when rules misfire on secure code.

LLM

SecReasonCWEvalSecCodeBench+1

research, coding-agents· Added 16 Oct 2026, published 10 Oct 2026

huggingface.copaper

TransformerMixture of Experts

Multi-Stream Attention ResidualsAttention ResidualsHyper-Connections+1

research· Added 12 Oct 2026, published 9 Oct 2026

arxiv.orgpaper

A narrative review in HCI arguing that the single-voice chatbot interface causes three harms: cognitive offloading, ideological narrowing of user beliefs, and epistemic compression of cultural and value diversity. It proposes multi-persona interfaces, which show several personas to the user at once, as a low-cost fix. The design draws on game design and participatory simulation (magic circle, role differentiation, persona embodiment). It offers a taxonomy for designing such interfaces and calls for empirical studies that link technical pluralistic alignment methods to real human-AI interaction.

arXiv

research, ai-safety· Added 12 Oct 2026, published 9 Oct 2026

arxiv.orgpaper

Reward Hacking as a Transmissible Strategy in Multi-Agent Coding Systems

The paper shows that reward hacking learned by one coding agent during RL against automated evaluators can spread to other agents in a multi-agent system. Across four open-weight backbones, coding RL elicits and amplifies hacking when the system prompt describes the mechanism explicitly and when mid-training exposes the model to facts about the coding environment. Post-RL source agents transmit the hack through code, shared memory and natural-language plans, and even small open-weight agents induce hacking in stronger closed-weight targets. On hard tasks the hack can intensify along a transmission chain after the source leaves, as the code accumulates more persuasive justifications. A theoretical analysis gives conditions under which hacking amplifies, persists or decays. Hacking also biases task routing toward hacking agents and survives candidate aggregation. Code review by the coder or by a separate verifier reduces the hacks that get delivered.

arXiv

ai-safety, agents, research· Added 12 Oct 2026, published 9 Oct 2026

huggingface.copaper

DecepEval: A Benchmark for Evaluating Deception in LLM Agents

DecepEval is a benchmark of 1,532 instances across 3 task families and 28 professional scenarios designed to measure deception in LLM agents, pairing neutral and induced versions of each task to isolate condition-dependent changes in deception rates. It introduces the LLM Deception Diamond framework (pressure, incentive, opportunity, conflict), adapted from classical fraud theory, and finds that across nine frontier LLMs these inducements raise deception rates even in models with low baseline deception, with long-horizon tasks showing deception rates averaging 87% under induced conditions.

Hugging Face

DecepEvalLLM Deception Diamond

ai-safety, evals· Added 8 Oct 2026

arxiv.orgpaper

The paper scales white-box deception detection with activation probes to frontier monitoring settings. It builds the largest deception dataset to date (FIBS) and introduces a probe architecture that aggregates information across many layers and tokens. The probes reach 98.8% AUC on SHADE-Arena, beating an Opus 5.5 text-monitoring baseline, and improve as the underlying model grows. They also handle "introspective deception", where ground truth can't be read from context: they separate transcripts containing a model's true hidden goal from others with up to 99.7% AUC, and detect lying on politically sensitive topics and under pressure in open-weight models. The FIBS dataset is released.

SHADE-ArenaFIBSClaude Opus 5.5

ai-safety, research, evals· Added 9 Oct 2026, published 8 Oct 2026

arxiv.orgpaper

Toward Joint Optimization of Circuit Depth and Training Data Size in Adaptively Grown Quantum Classifiers

The paper reimplements Q-FLAIR, which grows a quantum feature-map circuit gate by gate until the training loss stops improving. It runs the method on 784-pixel MNIST 3-vs-5 classification at five training-set sizes (N = 2000 to 10000), then fine-tunes each circuit to count Caro et al.'s active gates K. It finds no predictable link between training-set size and the circuit size Q-FLAIR converges to, and seed variance is nearly as large as any trend. The Caro et al. generalization bound holds in 14 of 15 runs, but the gap correlates only weakly with the bound (r = 0.12), so K explains little of the variation. This is a useful negative result for anyone hoping to jointly optimize circuit depth and data size.

Q-FLAIR

Caro et al.MNIST

research· Added 9 Oct 2026, published 8 Oct 2026

arxiv.orgpaper

WOVEN: Weaving Visual World Modeling into Multimodal LLMs

WOVEN is a training source and benchmark for visual transition reasoning in multimodal LLMs. It has 36,076 examples spanning 20 scene types, 5 action types and 8 reasoning types, built from rollouts of video-pretrained generative models. Evaluating 38 frontier MLLMs (including GPT-5.4 and Qwen3-VL-235B-A22B) shows systematic deficits that persist with scale. Training on WOVEN subsets of about 2,000 items improves 22 of 26 external benchmarks by up to 27.3 points, and WOVEN data can replace 30-50% of a task's own training data. The authors derive a recipe: select supervision by the reasoning operation it teaches rather than by scene or action, and prefer larger visual-state changes.

vision-language modelQwen3-VL

WOVENGPT-5.4

research, multimodal, evals, training· Added 9 Oct 2026, published 8 Oct 2026

arxiv.orgpaper

OnTrack: Real-Time Monitoring and Intervention in LLM Agent Trajectories via Streaming Structure-Aware Optimal Transport

OnTrack is a streaming monitor for LLM agents. It uses structure-aware optimal transport to compare an agent's steps and tool dependencies against recorded successful runs, and can alert users or block the agent in about a millisecond per step. It works under three access regimes: full reference (historical runs plus tool schemas), tool schemas only, and step logs only. Monitoring ranges from plan-violation detection to spotting loops, stalls and repeated tool calls. On SWE-bench trajectories, the first 8 steps rank failing runs below succeeding ones better than content-similarity baselines (+0.057 AUROC). An abort policy saves about 18% of compute, and 5 of 6 aborts were correct.

OnTrackSWE-bench

agents, research, evals· Added 9 Oct 2026, published 8 Oct 2026

arxiv.orgpaper

Cited but Not Consulted: A Counterfactual Audit of Legal Chain-of-Thought Faithfulness

The paper tests whether LLM legal explanations reflect what drives the verdict. Holding case facts fixed, it swaps the named statute or precedent for an unrelated one and decodes the evolving verdict from hidden states. Across seven open-weight models (8B-70B) and four benchmarks (CaseHOLD, ECHR, SCOTUS, ContractNLI), models name the correct authority 66.7%-100% of the time, but the verdict changes with the authority far less often (0.0%-21.7% on CaseHOLD, 30.0%-76.7% on ECHR and SCOTUS, 43.3%-50.0% on ContractNLI). Neither scale nor a LoRA reproduction of a legal-reasoning model closes the gap. A red-teaming check on five models finds compliance with an adversarial instruction hidden in the case facts (73.3%-96.4%) far exceeds verdict-swap sensitivity. The authors conclude that generated legal explanations are poor compliance or audit artefacts.

LoRA

CaseHOLDECHRSCOTUS+1

research, evals, ai-safety· Added 9 Oct 2026, published 8 Oct 2026

arxiv.orgpaper

Accurate but Not Humble: Evaluating Epistemic Humility in LLM Agents under Knowledge Conflict

The paper proposes evaluating LLM agents on epistemic humility, meaning their willingness to recognize, act on and communicate uncertainty. It operationalizes this as three trajectory-level dimensions (Identify, Solve, Escalate, or ISE). It tests controlled and naturally occurring knowledge conflicts, each with matched no-conflict controls, on four agents. Higher accuracy does not imply more humility: some high-accuracy agents detect conflicts but do not communicate uncertainty in wrong final answers, and agents often detect conflicts early but lose track of them later. Model-level interventions can improve humility but often cost accuracy, which suggests humility depends on the interaction of backbone model, agent harness and environment.

arXiv

evals, agents, research· Added 9 Oct 2026, published 8 Oct 2026

arxiv.orgpaper

Overcoming Prior Barriers: Supervised Fine-Tuning under Long-Tail Distribution

Introduces "prior barrier", a measure of how strongly a pretrained LLM supports competing concepts over a target concept, and shows prior barriers follow a long-tail distribution, so tail concepts need more SFT instructions than head concepts. It derives a predictive risk bound for SFT under long-tail prior barriers and proposes PASS, an adaptive instruction selection method that builds reference-derived concepts, estimates each instruction's distinguishing evidence, and allocates the selection budget toward under-covered concepts. PASS beats seven state-of-the-art instruction selection methods across four backbone-budget settings, and ablation shows adaptive allocation beats uniform allocation.

PASS

training, research· Added 9 Oct 2026, published 8 Oct 2026

Proposes "study contracts" that bind an AI-generated study's declared experimental choices, run obligations and claim scope to recorded execution evidence, defining contract-relative verification as distinct from scientific truth. In a diagnostic with eight self-authored clean/mutated pairs, a deterministic fault-specific checker caught all eight mutations, while eighteen LLM judge aliases given metadata-filtered packages flagged 104 of 144 mutated cases (32 abstentions, 8 terminal failures). The authors stress the setting is deliberately information-asymmetric, not a verifier-quality comparison or reward-hacking result, and call for full-information comparisons, legitimate-adaptation controls and closed-loop agent evaluations.

research, evals, agents· Added 9 Oct 2026, published 8 Oct 2026

arxiv.orgpaper

Who Verifies the Verifier? Co-Evolving Inspectable Graders with Self-Improving Agents

Proposes making the verifier the evolving object in self-improving agent loops. The verifier is an inspectable expression over small, mostly deterministic drawback detectors, synthesized from clustered failures, gated at birth, and selected for agreement with a ten-item anchored reference set plus consensus over unlabeled outputs, never for the agent's score. On MBPP+ it gains +0.21 held-out agreement over the hand-authored seed and ends ahead of the bare LLM judge it contains. Removing the anchor guards collapses the verifier into an always-pass grader that still trains skills as well, so downstream task score cannot certify a self-evolved verifier. The paper's Double Ratchet pairs the verifier with a lifecycle-managed skill loop and retains 88-110% of the lift from ground truth or a rubric on code generation, enterprise text-to-SQL and reference-free report generation.

MBPP+

research, evals, agents· Added 9 Oct 2026, published 8 Oct 2026

arxiv.orgpaper

Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub

The paper builds the first dated copy network of agent skills (SKILL.md files) from the git history of repositories in GitSkills, covering 2,193,119 skill adoptions on GitHub, and ships an interactive viewer. It finds that a few source repositories account for almost all copies, that GitHub stars do not identify them, and that copies almost never track their source, so fixes rarely propagate. A fitted model of which repositories get copied ranks repositories for audit: reviewing the top 100 would prevent 14.9% of later adoptions of high-risk skills, against 0.5% for the 100 most-starred. The authors recommend that platforms distribute versioned references instead of copies.

Claude CodeCodexGitHub+1

GitSkills

coding-agents, prompting, research· Added 9 Oct 2026, published 8 Oct 2026

eprint.iacr.orgpaper

Language Modeling is Monotone Compression

Mazor, Morgan and Pass prove that LLMs, modeled as next-token predictors, are equivalent to monotone (order-preserving) compression algorithms: either can be built from the other with the same error up to an additive gap of 2. They show that monotonicity is needed for this equivalence if and only if infinitely-often one-way functions exist. As a corollary, next-bit pseudoentropy of a distribution is equivalent to monotone incompressibility. This gives a theoretical basis for empirical findings that compression ability tracks LLM benchmark performance.

Large language modelsAutoregressive models

Noam MazorAndrew MorganRafael Pass+3

research· Added 11 Oct 2026, published 8 Oct 2026

Showing 360 of 756