145 results for “Sol”

VeriCUA is a platform-agnostic framework that verifies task completion by computer-using agents through agentic exploration. The verifier inspects context to build a task rubric, then picks GUI or code checks for unresolved requirements and combines findings under explicit evidence rules. It works online and offline across desktop, mobile and web, and agrees better with reference labels than the baselines, with the largest offline gains on hard cases.

arxiv.orgpaperAdded 31 Oct 2026, published 29 Oct 2026🧠 AI

Turing LLM post-training combines calibrated multi-teacher on-policy distillation (C-MOPD) with an execution path for dynamically routed mixture-of-experts models. C-MOPD matches each teacher on a local Top-K support with teacher-wise loss normalization and clipping. On Turing-20B-A2B it scores 0.9988 on four-domain integration, beats Qwen3-8B on math and code (85.92 vs 80.33 mean), and cuts consolidation step time from 398.7 to 139.3 seconds in a PPU profile.

arxiv.orgpaperAdded 31 Oct 2026, published 29 Oct 2026🧠 AI

Paper by Yi Ouyang, Wei Wei and Zheng Xu on the minimum degree of an isogeny from a supersingular elliptic curve E to its Frobenius conjugate E^(p). It bounds the probability that this degree is smooth, which makes Wesolowski's p^(1/3+o(1)) attack on the supersingular endomorphism ring problem unconditional. It also gives a uniform asymptotic formula, with Dirichlet L-values in the main term, for the probability that a connection isogeny of degree n exists.

eprint.iacr.orgpaperAdded 31 Oct 2026, published 29 Oct 2026🛡️ Security

TrussTutor-Bench is a benchmark of 200 verified two-dimensional truss problems from statics, paired with automatically generated student solutions. It evaluates thirteen LLMs on solution accuracy (64.5% to 97.0%), error detection (90.4% to 100%) and sycophancy. Models rejected their own correct solutions in 1.6% to 50.0% of cases when a student insisted the work was wrong. Sycophancy separated models; error detection did not.

arxiv.orgpaperAdded 31 Oct 2026, published 28 Oct 2026🧠 AI

This paper treats LLM reasoning effort as a credence good and measures the counterfactual effect of effort levels on proprietary and open-weight models across four benchmarks, including long-horizon agentic tasks. Higher effort often fails on tasks lower effort solved, and on easy tasks the top level costs up to 42x the lowest. Starting at the lowest effort and escalating only after a verified failure matches or beats fixed top effort, usually at lower cost for proprietary models.

huggingface.copaperAdded 28 Oct 2026🧠 AI

Falcon Key Recovery from Joint Sampler Leakages is an ePrint paper presenting a power side-channel attack on Falcon and FN-DSA that fuses three SamplerZ leakages (exponent class of the center, sign bit, proposal magnitude). It turns them into slab and halfspace constraints solved by softplus interval regression, with no LLL or BKZ. On PQClean Falcon-512 (ARM Cortex-M4) it recovered all 50 keys with at most 34 signatures; on c-fn-dsa it recovered 38 of 50 keys within 200 signatures.

eprint.iacr.orgpaperAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

Subexponential Algorithms for LWE via Rejection Sampling on Superlattices is an ePrint paper by Ligeng Fan, Changpeng Shao, Hongbo Li and Dingkang Wang. It extends the Ducas, Engelberts and Loyer superlattice framework to give a provable classical search-LWE algorithm for prime q in [n^2, 2n^2], using m=4n samples and time and space exp(O(n/ln ln n)). A second variant runs in 2^((1/2+o(1))n/ln R) for general parameters. It resolves a gap left by Kirchner and Fouque.

eprint.iacr.orgpaperPublished and added 26 Oct 2026🛡️ Security

UTS #39 (Unicode Security Mechanisms) is the Unicode Consortium's technical standard for detecting identifier spoofing. It defines the General, IDN and Email security profiles for identifiers, confusable detection through skeleton and bidiSkeleton mappings, and mixed-script detection with resolved script sets and Restriction Levels. It also covers limited contexts for ZWJ/ZWNJ and the confusables and identifier data files. The fetched text is truncated, so later sections are not covered.

unicode.orgpaperAdded 26 Oct 2026, published 25 Oct 2026🛡️ Security

This IACR ePrint 2026/2632 paper by Demirtaş and Yayla analyses the Crites–Stewart adaptive forgery attack on threshold Schnorr signatures, which needs one call to a sparse linear search oracle (bounded distance decoding of a scaled Reed–Solomon code). It shows that choosing the commitment coefficient vector does not help much: a wrapper adversary with Q challenges succeeds with probability at most QM/p, even if its solvers decode every witness for free. For the six original (N, τ) pairs, M stays below 2^24, so the bound is under 2^-100 after 2^128 challenges at p = 2^252.

eprint.iacr.orgpaperAdded 26 Oct 2026, published 24 Oct 2026🛡️ Security

TriageRAG is a failure-aware self-training method for adapting retrieval-augmented LLMs to specialized domains using only an unlabeled corpus. It probes the student on self-generated questions with and without retrieved context, sorts them into known, solved, context-failure and retrieval-failure, and routes each to a matching training signal. With Qwen3-4B on 11 datasets it beats budget-matched SimRAG by 1.2-6.4 points and recovers closed-book accuracy where retrieval hurts.

arxiv.orgpaperAdded 27 Oct 2026, published 24 Oct 2026🧠 AI

FNO-MoE is a Fourier neural operator with a mixture of experts that predicts the full near-explicit chemical state (Master Chemical Mechanism, thousands of species) over 30 minutes in one call. Expert disagreement selects the most informative box-model simulations, so active sampling beats random or evenly spread sampling at equal cost. Fine-tuning on longer trajectories keeps multi-hour runs stable, and the emulator runs orders of magnitude faster than the numerical solver.

arxiv.orgpaperAdded 27 Oct 2026, published 24 Oct 2026🧠 AI

VeilDNS is a DNS-native protocol that uses a post-quantum KEM and AEAD to encrypt DNS questions and answers and authenticate the resolver in one UDP exchange on port 53, preserving the DNS wire format. It has stateless and stateful modes plus optional forward secrecy from the second query. Against ML-DSA-authenticated DoT/DoH/DoQ it reports up to 3.5x higher cold-session throughput and 13.7x fewer bytes; Tamarin proves query confidentiality, response authentication and forward secrecy.

eprint.iacr.orgpaperAdded 26 Oct 2026, published 24 Oct 2026🛡️ Security

PHYRD is a living benchmark for theoretical-physics reasoning with 63 Reproduce problems (derive published results) and 43 Discover problems (consequences of modified theoretical conditions). Tasks are built by FormulaForest, with reference solutions and subquestion-level rubrics. Across five models, whole-problem accuracy is 49.21% to 68.25% on Reproduce and 18.60% to 74.42% on closed-book Discover. FormulaForest data also lifts a Qwen-35B-A3B model on FrontierScience from 61% to 72%.

arxiv.orgpaperAdded 26 Oct 2026, published 23 Oct 2026🧠 AI

Balsamic is a complete homomorphic Unbalanced Oil and Vinegar (UOV) signer, used to build one-round threshold UOV signatures from a packed discrete-CKKS FHE circuit. A paired-pivot linear solver and pivot-success certificates allow encrypted retry selection. In 2-out-of-3 semihonest signing, each online partial signature takes 10.7 s on an RTX 6000 Ada and 7.77 s on a GB300, with 5.25 MB per response.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 22 Oct 2026🛡️ Security

CausalCoT is an inference framework that splits a problem into a directed acyclic graph of atomic sub-questions and evaluates each node in an isolated context holding only its direct causal parents. This removes attention paths to non-parent content, so intermediate steps drive the answer rather than leaking from global context. It keeps benchmark accuracy competitive and raises causal sensitivity of reasoning steps by 12 points on average, up to 21, over the strongest baseline. The graph also allows test-time corrections that propagate downstream.

arxiv.orgpaperAdded 24 Oct 2026, published 22 Oct 2026🧠 AI

TTR-Compressor is a sequence compression method that treats input tokens as a test-time regression problem. The regression is learned end-to-end by backpropagation, and its coefficients are solved in closed form in the forward pass to give the compressed representation. As a block-wise sparse attention compressor it improves RULER over attention-based compressors by a large margin. As a visual token merger for multimodal LLMs it beats the MLP merger and matches it with 55.6% fewer visual tokens.

arxiv.orgpaperAdded 24 Oct 2026, published 22 Oct 2026🧠 AI

TRIAD is a benchmark for omni-modal ambiguity resolution. It has 327 hand-written text-image-audio queries in 86 scene groups across 18 ambiguity categories, and removing any one modality makes the answer non-unique. Across 14 omni-modal systems, the best model trails humans by over 20 points in group accuracy. Without answer options, model group accuracy falls to single digits, and leave-one-out tests show audio cues are often underused.

arxiv.orgpaperAdded 23 Oct 2026, published 22 Oct 2026🧠 AI

Sage-A1.5 is a 35B Mixture-of-Experts agentic model that builds on Sage-A1 for long-horizon problem solving. It adds three capabilities: orchestration with parallel subagents in isolated contexts, verification through progress checking, evidence validation and strategy revision, and open scientific discovery with inspectable research artifacts. The report shows them on complex agentic tasks and multidisciplinary science applications. The page gives only the abstract, no benchmark numbers.

arxiv.orgpaperAdded 22 Oct 2026, published 20 Oct 2026🧠 AI

This paper shows that reward misspecification alone degrades chain-of-thought (CoT) monitorability in language models. Using a testbed of paired true and misspecified rewards across three models and three tasks, CoTs keep reasoning about task intent while outputs hack the reward. The proposed reward description training injects an LM-inferred reward description into the input and raises monitorability by an average of 24% or 42% absolute, depending on the metric.

arxiv.orgpaperAdded 22 Oct 2026, published 20 Oct 2026🧠 AI

ePrint paper presenting safeRNSgcd, which computes the single Bézout coefficient needed at the deepest level of Falcon's NTRU solver while keeping large integers in a residue number system. Centered explicit CRT recovers the exact low bits needed by SafeGCD batches using single-word fixed-point arithmetic. A C implementation integrated into ntrugen reduces inversion and private-key basis-generation cost on a Raspberry Pi 5 and two x86-64 CPUs, versus the original ntrugen and a variant that skips the unused coefficient.

eprint.iacr.orgpaperAdded 17 Oct 2026, published 16 Oct 2026🛡️ Security

MUB (Music Understanding Benchmark) is a set of 500 identity-masked recordings with existing annotations for tempo, key, time signature and structural intervals. It covers all 24 keys, tempos of 47 to 180 BPM and 4,676 intervals, and strips titles, artists and platform IDs from inputs. Baselines reach 53.6% tempo accuracy (DSP) and 98.4% time-signature accuracy (constant 4/4). No multimodal LLM has been tested yet, and rights clearance is unresolved.

arxiv.orgpaperAdded 20 Oct 2026, published 16 Oct 2026🧠 AI

Doc2Harness is a two-stage benchmark for harness engineering. In Stage 1 a build model, working inside a fixed builder harness, gets an interface-only contract skeleton plus a development document consolidating behavior from twelve frontier harnesses, and builds a full candidate harness in an isolated container. In Stage 2 the frozen harness runs in separate per-test-case containers, driven by a scripted mock model, and is scored on four channels: requests sent to the model, files on disk, exit code and command output. Across 19 frontier models with three builds each on 328 test cases, GPT-6 Astra leads at 53.05% against 27.44% for the weakest, and failures cluster around how cross-cutting functionality is split across modules.

huggingface.copaperAdded 16 Oct 2026🧠 AI

This paper analyses software supply chain (SWSC) attacks against VLSI design tools. It empirically studies the software composition, security features and tool interactions of VLSI suites, then builds a taxonomy linking SWSC attacks to VLSI attacks, design-flow stages and security outcomes. The taxonomy yields 717 possible new attacks, 60 of them high feasibility, with a threat model, a defense assessment and case studies on an open-source VLSI flow.

arxiv.orgpaperAdded 20 Oct 2026, published 15 Oct 2026🛡️ Security

Value as Memory (VaM) is a post-training framework for generalist robot policies. It addresses partial observability and the delayed feedback of offline post-training. Value caching conditions actions on recent value predictions as task-progress memory. Online real-world RL combines offline demonstrations, off-policy interventions and on-policy rollouts, and moves from offline RL warmup to autonomous learning with sparse rewards. On long-horizon deformable-object and contact-rich manipulation tasks it gains 29.4% mean absolute success rate from value caching and 32.8% from online learning over matched offline training. The online schedule runs 8x as many policy iterations under the same gradient-step budget, with over 2x lower time per gradient step from concurrent data collection and training.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🧠 AI

AI Consilium is a multidimensional benchmark built from 300 diagnostically resolved NEJM–MedQA cases (110 for physician reference ratings and Judge calibration, 190 held out). Eight single-model pipelines produced role-specific opinions and interactive-consilium reports under free-form and structured clinical-reasoning conditions, and a physician-calibrated LLM Judge scored 3,040 final reports. Model identity separated quality more than format; structured reports won in seven of eight pipelines (management 2.740 vs. 2.436), multidisciplinary synthesis beat the primary-role opinion on all five shared criteria, and GPT-5.6-Sol led every component with the fewest review rounds.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🧠 AI

EliteReplay is an RL post-training recipe that pairs GRPO with an "elite" archive built by quality-diversity search. Before training, the frozen base model is used to collect solutions spanning distinct approaches; during training, a replay loss on this archive is added to GRPO. This counters the narrowing of solution diversity that RL causes. On text-to-SQL tasks it reaches higher pass@128 than all baselines and yields up to 77% more distinct correct strategies. It also retains more of the base model's strategies and covers both readings of ambiguous questions nearly twice as often on AmbiQT.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🧠 AI

The paper fine-tunes a pretrained CNN wind-field super-resolution model with differentiable topology-inspired auxiliary losses on speed, gradient magnitude, soft high-speed level sets and local maxima. It also uses fixed-pair supervision at ground-truth persistence-pair endpoints located offline with the Topology ToolKit. A 16-configuration loss study on a fixed 168-field benchmark finds that gradient supervision gives the strongest persistence-diagram improvement, while fixed-pair supervision gives the most consistent joint improvement in persistence-diagram and merge-tree distances. The combined objective cuts bottleneck, W2,∞ and W2,2 distances by 31%, 25% and 27% relative to the pretrained CNN, at a cost of about half of standard fine-tuning's PSNR gain. It also shows that pointwise metrics and topological distances rank CNN and GAN models differently.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🧠 AI

T-EVOLVE extends the lattice-commitment e-voting protocol EVOLVE to threshold tallying. Votes are Shamir-shared, so any t of n authorities can finish the tally. Privacy holds against t-1 colluding authorities and verifiability holds even if all of them collude. The voter proves her committed shares form a Reed-Solomon codeword whose value at zero is a valid vote. Complaints about ciphertexts that do not decrypt are publicly verifiable, using an LWE-instantiable encryption scheme with publicly verifiable opening. Privacy, verifiability, individual verifiability and robustness are proven in the classical random oracle model, and the verifiability reduction is not tight. In a C implementation, a yes/no ballot for four authorities takes 109 KB, and an authority aggregates 10^4 ballots in about three minutes on one core.

eprint.iacr.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🛡️ Security

Introduces Recursive Reward Improvement (RRI) for recursive self-improvement on open-ended expert tasks without answer keys, where a proposer writes both a task and a rubric. Before the solver trains, an adversary writes a rubric-gaming but useless answer, the same model writes an honest answer without seeing the rubric, and up to two repair steps revise the rubric until the honest answer wins. Exploits found also rewrite future task and rubric generation. On HealthBench Professional it beats a Generation Only baseline by 10.9 points at 9B and 12.4 at 27B (10.3 with no external model), and the 27B model transfers to PRBench Hard (+6.6) and ProfBench (+8.0).

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🧠 AI

ChainGraph is a pattern that moves exploit-chain reasoning out of the flat context window and into a Neo4j property graph. Findings, attack steps, credentials, assets and tamper-evident evidence receipts are typed nodes with pre/post-condition edges. The graph is wired to Claude Code or Codex through MCP with no custom harness. Five operator questions (next-step inference, entry-to-crown-jewel pathing, combined-severity promotion, evidence provenance, chokepoint identification) become reusable Cypher and Graph Data Science queries, plus a chain-severity score. On a synthetic multi-forest Active Directory lab modeled on GOAD, three findings rated Medium in isolation become Critical once their path to the forest root is materialized. Scoping each decision to a graph result cut the reasoning payload by about 98% on a token proxy. The authors say the results are illustrative single-run measurements, not a benchmark.

arxiv.orgpaperAdded 17 Oct 2026, published 14 Oct 2026🧠 AI

ePrint paper evaluating ASCA (SAT-based) and SASCA (belief propagation) side-channel attacks on the AES-based MILENAGE authentication algorithm in USIM cards, using neural-network leakage predictions to recover subscriber key K and operator secret OPc from a single trace. SASCA alone succeeds in 87.7% of attacks but converges to a wrong OPc in 6.1%; ASCA succeeds in only 34% within a 1-hour timeout. The hybrid, where BP refines the predictions before they go to the SAT solver, reaches 93.8% with lower average runtime. It also proposes a countermeasure that masks each AES round key with an independent per-device secret, and the authors report it defeated the hybrid attack in all evaluated cases.

eprint.iacr.orgpaperAdded 15 Oct 2026, published 14 Oct 2026🛡️ Security

Furue and Aikawa build and analyze algebraic attacks on the Regular Syndrome Decoding Problem (RSDP), which underlies code-based post-quantum schemes. They extend the Wang et al. hybrid algorithm to allow an arbitrary XL solving degree d, and add two variants: an XFL-based one (partial Gaussian elimination plus variable guessing) and a WXL-based one that exploits Macaulay matrix sparsity. Complexity analysis shows the WXL variant with d>2 wins for small block size β, while the original hybrid wins as β grows. This matters for setting RSDP-based scheme parameters.

eprint.iacr.orgpaperPublished and added 14 Oct 2026🛡️ Security

Introduces TerminalHorizon, a fully automated data synthesis engine for long-horizon terminal agents. It uses independent execution to find key work omitted during environment construction and rebuilds the environment from that evidence. It then progressively expands tasks under the same goal with new requirements that build on earlier results. The authors build 1.5K task environments and run supervised fine-tuning of Qwen3.5-27B to get TerminalHorizon-27B, which improves on all 12 benchmarks covering coding-agent tasks, real-world production agentic tasks and general reasoning. Multiple RSI case studies with a 12-hour research budget show the model continuing to experiment past an initial solution and keeping effective improvements in its final deliverables.

huggingface.copaperAdded 13 Oct 2026🧠 AI

Proposes mmVB, a lightweight plug-and-play module (1.6M trainable parameters) that assigns query-conditioned per-image visual token budgets using cross-image context for multimodal LLMs, without retraining the base model or accessing attention matrices (so it is compatible with FlashAttention). It cuts visual input tokens 9x, giving 5x faster time-to-first-token and 7x fewer prefill FLOPs while keeping 94.4% of full-resolution accuracy across eight multi-image reasoning benchmarks. It matters because existing token pruning, merging and compression methods target single-image redundancy and either need attention maps or retraining.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

PixelMoE is a pixel-space diffusion framework that scales capacity sparsely using standard LLM-style Mixture-of-Experts: token-choice routing, fine-grained routed experts, a shared expert and bias-based load balancing, with no diffusion-specific routing or auxiliary routing losses. It adds Pixel-Space Hierarchical Flow Matching, which varies spatial resolution along the denoising trajectory from global structure to fine detail. At matched active parameters it beats dense counterparts, and reaches FID 1.47 at 256x256 and 1.53 at 512x512 on class-conditional ImageNet-1K without representation alignment or perceptual losses. Code and models are promised but not yet released.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

Plan-Bench is a benchmark of 699 curated samples across 16 subclasses and three dimensions. It tests whether vision-language models can reason over spatial and temporal information and produce multi-step plans under constraints for embodied tasks, with action execution isolated out. Across 28 VLMs the best model reaches only 75.0% accuracy. Scaling generally helps, and larger models look more promising as high-level planners. Code and benchmark are released.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

Kairos is a reference monitor placed at the isolation boundary of an unmodified, opaque LLM agent, where tool calls, shell commands and agent-written scripts all appear as the same file and network operations. A declarative trust policy decides most effects deterministically and defers the rest; deferred effects are held while the agent continues speculatively, and a bounded-authority decision oracle (an LLM or a human) releases or refuses them based on the trace. Across three benchmarks and three agent models it beats existing defenses on the attack-success/utility trade-off; on AgentDojo it cuts attack success from 47.0% to 2.7% with no loss of benign utility.

arxiv.orgpaperAdded 15 Oct 2026, published 13 Oct 2026🛡️ Security

Introduces a cube-attack framework with an elimination strategy. It finds key conditions and cubes whose conditional superpolies are cheap to compute, then solves the resulting equation systems to recover key bits. The supporting techniques are a nested coefficient solver, conditional monomial prediction, an automated cube search combining numeric mapping with monomial prediction, and two testing methods for large equation systems. Against round-reduced Trivium it gives a practical key recovery at 840 rounds (complexity below 2^55, 77.8% success) and at 845 rounds (below 2^56, 98.1% success on 59.1% of keys). It also gives a theoretical weak-key attack at 855 rounds for 2^74 keys. These are the best known results, extending prior practical attacks by 13 rounds and theoretical attacks by 4.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🛡️ Security

Introduces Sauron, an evidence-first agentic verifier that checks rubric criteria for long-horizon agent tasks by investigating both environment state and execution trace, and trusts a claim (including an agent's self-reported success) only after validating it against its source. Bounded queries and joint investigation of related criteria cut context use, and each verdict carries an auditable evidence receipt. On 2,586 human-labeled criteria from 100 personal-assistant episodes it has the best F1 of five verifiers across eight backbones (0.96 vs 0.92 for Gandalf with GPT-5.6 Sol, at 23% lower cost). It detects 97% of injected failures across 13 fault families, including reward-hacking simulations, with 2% false flags on clean controls, and leads on the TRAIL agent-error benchmark. It matters because unreliable rubric verdicts used as RL rewards can reinforce bad behavior.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

The paper introduces verifiable reconstructible straightline codes (VRSCs) as an abstraction for compiling zkSNARKs into Universally Composable (UC) secure protocols. It shows that the witness-succinct UC compiler of Ganesh et al. (EUROCRYPT 2023) is missing a security requirement: permuting previously revealed evaluation openings yields a fresh accepting proof, which invalidates the claimed simulation argument. The fix uses verifier-enforced disjoint evaluation domains and a pairing-based Fischlin-style instantiation with structured Reed-Solomon codes and jointly computed KZG openings. This brings certificate generation to O(n log n) with constant extra proof size and verification work.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 12 Oct 2026🛡️ Security

Preprint recovering the long-term key of a first-order masked Kyber768 implementation on an ARM Cortex-M4 from about 2200 decapsulation power traces using only valid ciphertexts. A profiled neural network estimates Hamming-weight distributions of both arithmetic shares, which are turned into likelihoods on decryption noise and combined by a belief-propagation solver with Gaussian interference approximation and an Onsager (AMP) correction, recovering all 1536 secret and error coefficients without lattice reduction. It shows first-order masking is insufficient against combined second-order leakage, and that least squares, greedy solvers and lattice hints (BKZ block size 624 to 505 at 2000 traces) do worse.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 12 Oct 2026🛡️ Security

Technical report for Xiaomi's MiMo-V2.6 omni-modal model family, which scales RL compute along three axes: asynchronous training with 1,568 samples and 2.7-3.7B tokens per step at up to 1M context, more diverse environments (code, general, visual, cyber) under mixed agent harnesses, and groupwise agentic grading that gives better reward signals and favors shorter, token-efficient solutions. Stability measures include a frozen MoE router and a multi-layer defense against reward hacking, built on a mid-trained hybrid-SWA architecture. The authors open-source training dynamics, RL environments and the RL framework, which makes it a useful reference for reproducing scaled agentic RL.

huggingface.copaperAdded 10 Oct 2026🧠 AI

Paper testing whether an LLM agent operating life support in the NASA-derived BioSim lunar habitat simulation can be induced by delayed prompt injection, hidden in truthful S-band telemetry, to shut down life support and hold the shutdown while the crew suffocates. It compares Claude, GPT and Grok configurations: Claude mostly refuses and cites the living crew, GPT shows some susceptibility, and Grok given a "trusted commission" framing more often cuts life support. It also varies the framing of the message (trusted commission, peer, untrusted source) and uses a harmless-procedure-drop attack as a proxy for whether life is valued intrinsically. Code and traces are open-sourced.

arxiv.orgpaperAdded 15 Oct 2026, published 10 Oct 2026🛡️ Security

Introduces Confidential Error-correcting Codes (CECs), a primitive that decodes reliably from perturbed codewords while keeping the message confidential, defined by confidentiality, robustness and soundness. The Randomness-Security Separation framework encodes a nonce and masks the payload with a PRF; the Conc-CEC instantiation uses concatenated Reed-Muller and Reed-Solomon codes and claims stronger concrete security than PRCs (CRYPTO'24). The application, CECMark, watermarks AI-generated images and reportedly beats Gaussian Shading, PRCMark and T2SMark across 56 perturbations with a false positive rate below 1e-5 and no side effects.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 10 Oct 2026🧠 AI

Introduces Confidential Error-correcting Codes (CECs), a cryptographic primitive for decoding perturbed codewords while keeping the message confidential, defined by confidentiality, robustness and soundness. The Randomness-Security Separation framework encodes a nonce and masks the payload with a PRF. The Conc-CEC instantiation uses concatenated Reed-Muller and Reed-Solomon codes, and the authors claim stronger concrete security than PRCs (CRYPTO'24). The CECMark application watermarks AI-generated images, and the authors report it beats Gaussian Shading, PRCMark and T2SMark across 56 perturbations with a false positive rate below 10^-5.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 10 Oct 2026🛡️ Security

HOA (Humanize Olympiads Agent) is an open, flow-level framework that coordinates several agent sessions through three feedback channels: an independent reviewer that critiques each candidate, a structured wiki supplying task-specific knowledge the base model may lack, and a verifier that checks generated Lean proofs against trusted challenge statements. With GPT-5.6 Sol it reports perfect scores on IMO, IPhO and IOI 2026, near-full marks on IChO 2026, 672/672 on PutnamBench, and first place on the Lean-Eval leaderboard (251/304). With the open model Kimi-K3 it matches or exceeds a GPT-5.6 Sol + /Goal baseline on several contests, which suggests systematic feedback can narrow base-model capability gaps.

arxiv.orgpaperAdded 12 Oct 2026, published 9 Oct 2026🧠 AI

BLiMPPI is a multilingual evaluation suite of over 12,000 negative polarity item (NPI) minimal pairs across 33 languages. A pipeline finds NPIs in Universal Dependencies treebanks, labels their licensing environments, and perturbs them into grammatical/ungrammatical pairs. Across 12 multilingual and 2 monolingual models plus n-gram baselines, multilingual models do worst on lower-resource languages and on pairs that n-grams cannot solve. The paper also analyses NPI typology, language family, licensing variability and NPI-licenser distance.

arxiv.orgpaperAdded 12 Oct 2026, published 9 Oct 2026🧠 AI

The paper presents RM-KLPT, an algorithm that solves the algebraic pathfinding problem in isogeny graphs of superspecial abelian surfaces with maximal real multiplication. It does this by solving a norm equation in ideals of a quaternion algebra over a real quadratic field. The authors implement it and revisit the RM-CGL hash function of Charles, Goren and Lauter. They show that if the initial surface's algebraic description is known, RM-KLPT gives a second-preimage attack on the hash. Paths are much shorter (~p^3) than with KLPT^2, because a higher-dimensional Deuring correspondence exists in the RM setting. The paper also discusses cryptographic constructions that could be built on RM-KLPT.

eprint.iacr.orgpaperAdded 12 Oct 2026, published 9 Oct 2026🛡️ Security

DecepEval is a benchmark of 1,532 instances across 3 task families and 28 professional scenarios designed to measure deception in LLM agents, pairing neutral and induced versions of each task to isolate condition-dependent changes in deception rates. It introduces the LLM Deception Diamond framework (pressure, incentive, opportunity, conflict), adapted from classical fraud theory, and finds that across nine frontier LLMs these inducements raise deception rates even in models with low baseline deception, with long-horizon tasks showing deception rates averaging 87% under induced conditions.

huggingface.copaperAdded 8 Oct 2026🧠 AI

The paper proposes evaluating LLM agents on epistemic humility, meaning their willingness to recognize, act on and communicate uncertainty. It operationalizes this as three trajectory-level dimensions (Identify, Solve, Escalate, or ISE). It tests controlled and naturally occurring knowledge conflicts, each with matched no-conflict controls, on four agents. Higher accuracy does not imply more humility: some high-accuracy agents detect conflicts but do not communicate uncertainty in wrong final answers, and agents often detect conflicts early but lose track of them later. Model-level interventions can improve humility but often cost accuracy, which suggests humility depends on the interaction of backbone model, agent harness and environment.

arxiv.orgpaperAdded 9 Oct 2026, published 8 Oct 2026🧠 AI

Paper measuring prefix-based training-data extraction in instruction-tuned open-weight LLMs under an empty prompt versus retrieved contexts of varying relevance (RAG), using paired item-level suffix scoring across three models. It finds extractable memorization has a context-robust core and a context-sensitive boundary: context suppresses some exposures but also enables new ones missed by prefix-only evaluation. This qualifies the claim that RAG reduces memorization risk and matters for threat-modeling deployed LLM systems.

arxiv.orgpaperAdded 9 Oct 2026, published 8 Oct 2026🛡️ Security

The paper measures whether retrieved context, as in RAG, reduces LLM memorization. It does this with paired item-level probabilistic suffix extraction: each prefix-suffix pair is scored under an empty prompt and under retrieved contexts of varying relevance, across three open-weight instruction-tuned models. Extractable memorization splits into a context-robust core and a context-sensitive boundary. Context suppresses some marginal exposures but also enables new ones that prefix-only evaluation misses, which qualifies the claim that RAG lowers memorization risk.

arxiv.orgpaperAdded 9 Oct 2026, published 8 Oct 2026🧠 AI

Technical report for the MiMo-V2.6 omni-modal model series, which scales RL compute after mid-training on a multimodal corpus, using a hybrid sliding-window-attention architecture. RL is scaled along three axes: asynchronous training with 1,568 samples and 2.7-3.7B tokens per step at up to 1M context; diverse environments (code, general, visual, cyber) under mixed agent harnesses; and groupwise agentic grading that gives better rewards for long-horizon tasks and favors shorter, token-efficient solutions. Stability measures include freezing the MoE router and a multi-layer defense against reward hacking. The authors open-source the training dynamics, RL environments and RL framework.

arxiv.orgpaperAdded 9 Oct 2026, published 8 Oct 2026🧠 AI

Proposes QCOC (Query-Calibrated Operator Compression) for tabular in-context learning. It compiles the full KV cache of the in-context examples once into compact shared memory. The cache is built from clustered joint-KV prototypes that keep per-cluster multiplicities and the original example count. Prototype values are calibrated against attention query vectors with an anchored closed-form solution. On 64 held-out OpenML-CC18 datasets it has the best mean accuracy among compared compression and retrieval methods. On seven long tables it averages 0.23 points below full context. Compressing 8,192 examples to 512 slots gives 10.5x cache compression, and single-core CPU serving over 1,000 queries is up to 508x faster than dynamic retrieval and 1.98x faster than full context.

arxiv.orgpaperAdded 9 Oct 2026, published 8 Oct 2026🧠 AI

This paper studies where tool-using LLM agents break down in the chain from gathering evidence to taking consequential actions, finding that strong static judgment of whether to act often coexists with much weaker interactive execution, and that failures arise from incomplete investigation, acting before evidence is established, or unresolved prerequisites in multi-action workflows. The authors introduce SafeActBench, a 656-case benchmark across six operational domains and five protocols, paired with a provenance-bound Evidence Ledger and a deterministic trajectory evaluator tested across ten model-harness configurations.

arxiv.orgpaperAdded 7 Oct 2026🧠 AI

This paper proposes three evaluation screens — Decisive-Action BPB, Patch MCQ, and prefix-conditioned pass@K — that predict how well a base model will perform as a coding agent after post-training, without requiring the base checkpoint to run a full agentic harness. By replaying successful post-trained agent trajectories and identifying the "decisive step" that flips a repository from failing to passing tests, the authors measure a base model's latent support for that action. Tested across ten pairs of public base and post-trained models, all three screens closely track post-trained SWE-bench Verified pass@1 scores, offering a way to cheaply vet base checkpoints before committing to expensive agentic post-training.

arxiv.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

RunningTab is a framework that gives LLM agents performing 'direct workspace interaction' (searching and reading files from a terminal without indexing to produce a deliverable) an environment-side 'tab': a per-task record, maintained outside the model's context, of requirements the agent has declared, excerpts read with provenance, and listed-but-unopened files flagged as candidates. The agent can check each requirement against matching excerpts or candidates, mark it resolved or deferred with a reason, and is forced through a finish check if requirements remain open when it tries to complete the task. The authors show it consistently beats plain direct workspace interaction and model-internal record-keeping baselines across three benchmarks and three LLMs.

arxiv.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

Evaluates delivering security requirements from a governed security-by-design knowledge base (SbD-ToE) to a code-generating LLM through an MCP server at generation time. On DualGauge (59 Python tasks) the share passing all security tests rose from 44.1% to 78.0%; on BaxBench (28 backend scenarios) the share of functionally correct solutions with no successful exploit rose from 65% to 86%, matching the authors' Oracle Security Reminder (85%). The joint secure-and-functional metric did not improve significantly, since stricter code failed functional tests that fix unstated values. The study used one model and one generation per task, and it proposes measuring conformance with applicable requirements rather than only detecting known weaknesses.

arxiv.orgpaperAdded 9 Oct 2026, published 7 Oct 2026🛡️ Security

The preprint tests whether security requirements from a governed security-by-design knowledge base (SbD-ToE), delivered to a code generator through a Model Context Protocol server at generation time, make AI-written code more secure. On DualGauge (59 Python tasks, LLM-judge scoring) the share of tasks passing all security tests rose from 44.1% to 78.0%. On BaxBench (28 backend scenarios with real exploits in containers) the share of functionally correct solutions with no successful exploit rose from 65% to 86%, comparable to the authors' Oracle Security Reminder (85%). The pre-specified joint secure-and-functional metric did not improve significantly, and the stricter code failed functional tests that fix values the task never states. The study used one model and one generation per task. The authors argue that current benchmarks only detect the weaknesses their evaluators were built for, and propose measuring conformance with the requirements that apply.

arxiv.orgpaperAdded 9 Oct 2026, published 7 Oct 2026🧠 AI

SLDR is a post-fine-tuning defense that protects aligned LLMs from malicious fine-tuning-as-a-service attacks, which can quietly erode refusal behavior while keeping task performance intact. It trains a LoRA recovery adapter only on the layers with the most extreme (signed) safety sensitivity scores, then uses representation-based dynamic routing to activate that adapter solely for malicious queries at inference time. Evaluated across four model architectures, five downstream tasks, and four harmful-content benchmarks, it drives the average harmful score on Llama3.1/SST2 from 11.54 down to 0.08 while preserving downstream accuracy, and stays near zero even at poisoning ratios up to 0.9.

arxiv.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

This arXiv preprint argues that proofs of AI safety or alignment which consider the agent in isolation are incomplete, because the environment's structure matters just as much. The authors construct two theoretical scenarios — one with an infinite state space, one with signal mixture — under partial observability and time-limited action, and prove that even a hypothetically perfect agent cannot guarantee safe behavior in them. The conclusion is that any rigorous safety or alignment proof must jointly specify the agent and the environment's safe-action structure, not the agent alone.

arxiv.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

This paper introduces Personal Fact Memory (PFM), a reference layer for diagnosing errors in language-agent memory systems before generation happens, separating stored-state validity, identity resolution, abstention and serving latency. On a controlled revision benchmark, serving only the active value per correctly keyed slot eliminates stale exposure (versus 70.3 percent stale exposure without update resolution), while participant-aware BM25 matches a reference ranker within a 0.02 margin once stores are shared. The harder problem is revision-to-slot assignment: four LLM key assigners get higher key recall than a rule-based extractor but lower clean-retrieval rates, open-domain merge recall on LongMemEval never exceeds 0.062, and entity-posterior filtering reduces but does not eliminate same-name misattribution on LoCoMo; prompt prefill, not retrieval, dominates turn-level latency.

arxiv.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

This paper runs a mechanism-isolating ablation of four document-structure treatments used in retrieval-augmented generation — structure-aligned chunking, LLM-generated chunk contexts, heading-path metadata, and hierarchical two-stage retrieval — under one protocol with matched chunk sizes and a semantically null placebo (shuffled heading paths) to control for the confound that any prepended text perturbs embeddings. Using a coverage-aware nDCG metric and document-clustered bootstrap with Holm correction across 200 Wikipedia Featured Articles (951 queries) and 1,585 QASPER papers (4,303 questions), it finds that structure-aligned chunking with real heading paths beats both contextualized fixed windows and the placebo, naive hierarchical retrieval hurts performance (traced to first-stage section recall failures), and gold structure beats LLM-induced structure on Wikipedia but not QASPER. Effect sizes are small but statistically significant and consistent across corpora, giving RAG practitioners evidence-based guidance on which structure-aware retrieval tricks actually help versus which are placebo effects.

arxiv.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

EntroPrefill proposes a Renyi-entropy-guided mechanism for pruning context mid-prefill in retrieval-augmented generation, using sink-isolated regularized head pooling compatible with grouped-query attention to decide which tokens can be safely discarded. It derives a mixture-to-head deletion envelope bounding feasible token removal, a finite-sample observer guarantee valid under adaptive layer selection, and a conditional transformer perturbation bound with explicit Lipschitz constants and a first-token decision-margin corollary, plus a systems-level break-even analysis of KV-transfer payload versus pruning savings. The paper is explicitly theoretical, defining assumptions and formal limits without reporting empirical speedup or accuracy-preservation results.

arxiv.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

This paper introduces BOTTLED, a benchmark testing whether LLM agents can autonomously convert their general task-solving ability into cheaper, scalable artifacts (e.g., training a small distilled model or writing a reusable program) when faced with millions of similar queries under fixed time, compute, and API budgets, a capability the authors call bottling. Across ten models and three tasks, the authors find zero-shot performance does not reliably predict bottling success: 48 of 60 runs scored below their own model's zero-shot confidence interval, and 31 of 60 underperformed simple small-model distillation baselines. Despite this, strong agents like Opus 5 can retain about 82% of zero-shot macro-F1 at about 657x lower cost on query-product relevance classification, and recover about 94% of a dedicated cheap-inference model's (Jev) performance at a quarter of its cost.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

This paper studies robust bandits (formerly "imprecise bandits," Kosoy 2025; Appel and Kosoy 2025), a framework for unrealizable learning in the bandit setting where the true environment may lie outside the learner's hypothesis class. While prior work showed a Θ(√T) regret learner exists for a broad class without computational guarantees, this paper identifies a special case admitting a polynomial-time learner achieving Õ(√T) regret, and proves several natural generalizations of that case are NP-hard — mapping the boundary of computational tractability. The authors frame this as relevant to AI alignment, following Kosoy's argument that efficient learners for unrealizable problems are a prerequisite for solving alignment.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

WorldSolver is a benchmark of 168 physics-simulation coding tasks drawn from 61 classic computer-graphics papers across 7 physical domains, each giving an LLM agent a fixed code scaffold and asking it to implement the missing solver. Agents are scored on three axes — Execution Checks, Visual Fidelity, and Physical Plausibility — and frontier agents GPT-5.6 Sol and Claude Opus 5 top out at only 48.7% and 46.7% overall, showing current agents struggle to produce executable, visually and physically correct simulation code.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

This paper presents a systematic empirical study of small language models (decoder-only, encoder-decoder, and mixture-of-experts architectures) on abstract grid-transformation reasoning, using the ARC-TGI benchmark, which supports controllable task families, resampling, spatial shifts, and cross-benchmark transfer to distinguish genuine rule acquisition from distribution-specific overfitting. Across more than 1,000 supervised fine-tuning runs, the authors find that in-distribution accuracy is achievable but highly sensitive to optimization and task formulation, performance collapses sharply out-of-distribution (even under simple grid-scale changes with the same underlying rule), training-set scale yields uneven gains, in-context example benefit is model-family dependent, and executable-rule induction surfaces correct solutions that direct grid generation misses. Layer-wise attention diagnostics reveal behavioral differences in concentration and context-dependence but stop short of establishing causal mechanisms, underscoring that abstract-reasoning scores are conditional on model, adaptation regime, evaluation distribution, and output format.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

EC-RAG (Event Chain Retrieval-Augmented Generation) is a training-free framework for long-video question answering that organizes video content into an explicit, temporally ordered "event chain" instead of retrieving isolated frames or snippets. It partitions video into semantically coherent segments, fuses multi-modal signals (speech, text, visual cues) at the event level, and retrieves relevant events from the chain to answer queries, working as a plug-and-play addition to existing large video-language models (LVLMs) without extra training. Evaluated on Video-MME, MLVU, and LongVideoBench, it outperforms frame-level retrieval baselines, showing the value of modeling temporal/event structure for long-video understanding.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

This arXiv paper introduces a pre-registered panel of 248 scenarios across five kinds of pressure, each posed to a model twice (as the acting agent and as a third-person judge) with pressure-removed twins and operator-order positive controls, to measure whether models act against their own stated moral judgment. Testing OLMo-3-7B-Instruct, Llama-3.1-8B-Instruct, Tulu 3, and Qwen2.5-7B-Instruct, the authors find OLMo-3 violates its own judgment on about 1 in 5 pressuring scenarios, Llama-3.1-8B-Instruct and OLMo-3 carry this gap while Tulu 3 (fine-tuned from the same Llama-3.1 weights) and Qwen2.5-7B-Instruct show none or an unresolved effect, and that reading outside the chat template or adding stakes-reasoning changes the gap's sign and size. The paper argues this value-action gap is a target shaped by post-training recipes rather than a fixed property of pretrained weights.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

Semantic Behavioral Watermarking (SBW) is a provenance scheme for LLM agents that embeds an owner identifier in semantic clusters of an agent's action choices rather than exact action symbols, making it robust to paraphrasing/tool-renaming that breaks three prior agent watermarks (e.g., AgentMark drops to 16.8% bit-recovery under observation paraphrasing). It adds keyed, collision-resistant binning proven unpredictable in the random-oracle model to resist forgery (adaptive forgery success drops from 100% to the false-positive floor), while explicitly documenting an unsolved attack: chained-replay forgery, which still succeeds 0.76-0.98 of the time across five tested agent models (3B-14B, Qwen, ToolBench/ALFWorld benchmarks). Code is released alongside the paper.

arxiv.orgpaperAdded 8 Oct 2026, published 6 Oct 2026🛡️ Security

This IACR ePrint paper proposes a security-aware benchmarking framework for deploying memory-heavy PQC (ML-KEM, ML-DSA) on the dual-core ESP32-S3 (Xtensa LX7) running FreeRTOS, aimed at smart-grid substation devices bound by the IEC 61850 GOOSE tripping window (≤3ms). It details an asymmetric task-isolation design pinning crypto to Core 1, a heap-auditing methodology for FreeRTOS's heap_4.c allocator tracking key-state allocations across DRAM, and an analytical latency model of CPU stall overhead caused when side-channel masking forces secret polynomial shares to spill to external Octal-SPI PSRAM during non-sequential Cooley-Tukey NTT strides. The work gives embedded engineers a methodology to evaluate PQC side-channel/latency trade-offs before migrating real-time grid infrastructure.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 6 Oct 2026🛡️ Security

This arXiv methodology paper extends empirical Bayes g-modeling, which estimates a latent prior over regression coefficients from data, to the case where the entire prior distribution depends on covariates. The authors show the unrestricted nonparametric MLE (NPMLE) of this covariate-dependent prior is ill-posed, and resolve it by introducing an "infinite Mixture-of-Expertizing" class of conditional priors, proving that the resulting NPMLE is exactly a softmax-gated Mixture of Experts whose number of experts is determined by the data rather than fixed in advance. They give two exemplar-based estimation algorithms with automatic expert selection, a post-hoc aggregation step for interpretability, and theoretical results (Lipschitz continuity of conditional priors, universal approximation of continuous gating functions by aggregated softmax gates), validated on synthetic and real datasets.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

This IACR ePrint paper (published TCHES 2027) presents a new cryptanalysis technique for the Lattice Isomorphism Problem that embeds LIP into a shortest-vector-problem instance on a different lattice than the one used in Hawk's specification, allowing attackers to integrate "hints" — partial information on the secret key obtained via side-channel attacks or other leakage. Using the LeakyLWEEstimator tool, the authors show Hawk signatures themselves leak exploitable information about the secret key, eroding Hawk-1024's security by roughly 11 bits, and apply the framework to resolve an open side-channel problem from TCHES 2024 plus discuss further fault-injection attack paths. Hawk is a lattice-based signature scheme submitted to NIST's second post-quantum signature call, making this a concrete key-recovery cryptanalysis relevant to PQC migration planning.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 6 Oct 2026🛡️ Security

This IACR ePrint paper proposes and benchmarks a non-interactive Proof of Possession (PoP) for the code-based post-quantum KEM HQC, built using the VOLE-in-the-Head (VOLEitH) zero-knowledge paradigm, to solve the practical problem of issuing KEM-based certificates needed by protocols like KEMTLS. The authors integrate their HQC PoP into the ACME certificate-issuance protocol and compare it against existing PoP schemes for Kyber and FrodoKEM, showing Kyber issues certificates faster but at the cost of protocol or NIST-standard compatibility, while their HQC-based PoP keeps compatibility and achieves smaller proof sizes, which matters under unstable-network conditions due to larger KEM-based CSRs.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 6 Oct 2026🛡️ Security

BrainTRACE is a report-grounded benchmark for evaluating whether vision-language models can trace the evidence structure required for longitudinal brain MRI interpretation. It contains 7,273 scored VQA instances derived from 1,778 longitudinal patients, 7,299 MRI studies, and ~29k co-registered 3D MRI sequence volumes, organized across five levels of clinical reasoning and evidence demands like longitudinal comparison, multi-sequence integration, and volumetric spatial grounding. Evaluation of 20 VLM configurations finds that current models identify isolated visual cues but rarely compose them into grounded longitudinal clinical interpretations.

arxiv.orgpaperAdded 6 Oct 2026, published 5 Oct 2026🧠 AI

This paper argues that a single "flip rate" metric for LLM sycophancy conflates genuine self-correction with capitulation, and introduces SycoLens, a modular stateless-replay protocol that isolates factors like pushback wording, answer format, boundary distance, and ground truth. Running about 760,000 controlled replays across eleven frontier models from three providers, the authors show model rankings for sycophancy change depending on how pushback is phrased, that flip effects spike near a model's decision boundary, and that on arithmetic tasks some models re-derive correct answers under pressure while others abandon them without working. They propose a reporting profile that disaggregates these behaviors instead of collapsing them into one score, and plan to release the instrument, records, and analyses.

arxiv.orgpaperAdded 6 Oct 2026, published 5 Oct 2026🧠 AI

This IACR ePrint paper benchmarks 20 open-source Gröbner basis implementations against the proprietary Magma system on polynomial systems derived from small-scale AES over GF(2), using Easy/Medium/Hard difficulty tiers with ten instances each. In the Hard setting, msolve and Singular's slimgb completed all runs successfully with mean runtimes of 164s and 269s and peak memory of 3693/4343 MiB respectively, versus Magma's 319s and 16853 MiB, with msolve exploiting ~13.4 CPU cores versus ~1 core for the others. The results quantify when open-source algebraic solvers are practical alternatives to Magma for algebraic cryptanalysis of block ciphers.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 5 Oct 2026🛡️ Security

This IACR eprint paper studies output policies for CKKS homomorphic-encryption-based anomaly detection, evaluating whether limiting released scores and decisions can hide a private detection threshold without breaking existing decisions. Across 45 plaintext and 45 CKKS experiments on three intrusion-detection datasets and autoencoder scoring models, the authors show thresholds remain estimable, quantization preserves about 99.86 percent of decisions, and a surrogate model trained on only 128 decision-only responses achieves 0.817 mean balanced accuracy at predicting decisions on new inputs, a decision-prediction model-extraction-style attack whose success depends heavily on data-splitting strategy. It argues numerical threshold leakage and decision-prediction leakage are distinct protection goals that output policies for encrypted intrusion detection systems must address separately.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 5 Oct 2026🛡️ Security

Victor Shoup shows that "reconstruct-later" asynchronous verifiable information dispersal (AVID) designs — used by data-availability systems including an early Walrus design/testnet — are insecure when built on the standardized Raptor codes R10 (RFC 5053) and RaptorQ (RFC 6330). Using the Plotkin bound, he proves that a Byzantine disperser can choose a subset of f+1 honest fragments that fails to reconstruct the message, gives randomized polynomial-time algorithms to find such subsets, and implements a working attack that defeats an RFC 6330 RaptorQ decoder on every adversarial subset tested (success for f from 9 to 45). Benchmarks show plain Reed-Solomon coding is an MDS alternative that is often faster and never much slower than R10/RaptorQ, making it the safer practical choice for this design pattern.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 4 Oct 2026🛡️ Security

This paper isolates the coding-agent harness as an experimental variable by running the same model weights and tasks through two configurations of a custom harness called Yuj: a control that feeds the full chronological transcript until it hits the context window, and a treatment that keeps a complete in-memory record but shows the model a shrinking view (aging tool-result truncation past 50% window fill) plus a stall/loop detector with mechanical interventions. On SWE-bench Verified, SWE-bench Pro, and FeatureBench under tight context, the treatment raises mean per-task fail-to-pass fraction (F2PF) and complete-resolution counts (e.g. 28->49% F2PF, 43->72 resolved tasks on a 169-task Verified cohort at a 20,480-token window), with gains holding across additional models without retuning. The authors argue coding-agent evaluations should treat model+harness as the tested solver rather than attributing results to the model alone.

arxiv.orgpaperAdded 4 Oct 2026🧠 AI

This paper studies the sharpening hypothesis of RL post-training on LLMs: that it mainly sharpens existing base-model behaviors, boosting pass@1 at the cost of solution coverage (pass@K), and shows this cost extends to agentic, multi-turn tool-use tasks, not just math/coding. The authors introduce Sharpening Tax, a metric quantifying this coverage loss, measured across 14 base/post-trained model pairs from four model families on three agentic benchmarks (42 cases), finding post-training pushes tasks toward always-solved or never-solved extremes. They also propose posterior-tempered group sampling (PTGS), a Bayesian per-prompt temperature adaptation method that reduces the tax during RL training while improving both coverage and single-shot accuracy.

arxiv.orgpaperAdded 4 Oct 2026🧠 AI

The paper introduces PoS (Progression of States), an inference-time framework for long-horizon LLM agents that maintains explicit belief states — combining a current world-state estimate with unresolved task requirements — instead of relying on raw interaction-history memory. PoS detects "Belief Trapping" (stagnation, cycles, or drift where an agent keeps acting without real progress), diagnoses the blocked requirement, and applies targeted recovery constraints, achieving the best results across four benchmarks (including ALFWorld and RCA-100) and three LLM backbones, with gains up to 22.68% and 37.89% over the strongest baselines.

huggingface.copaperAdded 3 Oct 2026🧠 AI

COPEX (COntext Provider EXploitation) is a benchmark that isolates the tool-selecting LLM as the unit of evaluation in Model Context Protocol systems, fixing the surrounding agent stack and varying only the model to measure its intrinsic susceptibility to adversarial context. It covers 25 attack types across 125 scenarios spanning four entry surfaces — model/agent, client, server/tool, and transport — and tests nine models across 3,375 trials, finding a mean attack success rate of 64.4% (58.3%–71.4% by surface); combined input and context scanning cut mean attack success by 49.6% on an eight-attack defense subset. The work separates "system exposure" (attacks succeeding outside the model's observation/control) from "model susceptibility," and the benchmark itself is released publicly.

arxiv.orgpaperAdded 6 Oct 2026, published 3 Oct 2026🛡️ Security

This paper introduces PoS, an inference-time framework for LLM agents that maintains explicit belief states — combining an estimate of the current world state with unresolved task requirements — instead of relying solely on raw interaction history or memory compression. PoS detects "Belief Trapping," where an agent keeps acting without real progress, and applies recovery strategies tailored to the trapping pattern and the unresolved requirement type. Across four benchmarks spanning execution and diagnosis tasks, and three different LLM backbones, PoS outperforms baseline approaches and shows resilience as context length grows.

arxiv.orgpaperAdded 2 Oct 2026🧠 AI

The World Embedding Benchmark is a new evaluation suite of 8,000 controlled simulation cases across 80 families (fluid mechanics, solid mechanics, dynamics, optics & electromagnetism), each pairing a rendered video with simulation-derived physical annotations. It tests pre-trained omnimodal embedding models on text-video retrieval, physical-property regression, and multiple-choice video-description classification, finding that current embeddings align poorly cross-modally while lightweight probes can still recover physical quantities, and that continual contrastive training improves alignment but hurts regression. The authors also show retrieval-augmented generation using these embeddings with MiniMax-H3 improves the physical fidelity of generated videos.

arxiv.orgpaperAdded 5 Oct 2026, published 2 Oct 2026🧠 AI

NeutronGym is an executable environment for neutron scientific-instrument design where LLM agents build instruments via validating tools, McStas ray-traces the result, and a level-resolved ladder grades syntax, runtime, structure and physics without an LLM judge. A curated McStasBench slice adds 16 tasks from published instruments; seven frontier models solve at most 7 of 16, but reinforcement learning on the ladder's reward takes Qwen3-8B from 11% to 77% on held-out instances (surpassing an untrained Qwen3-32B), with ablations showing the partial-credit ladder is responsible for most of the gain.

arxiv.orgpaperAdded 5 Oct 2026, published 2 Oct 2026🧠 AI

ReFract is a benchmark of 150 expert-validated entries testing whether LLM agents can infer a user's role and act only through tools/actions legitimate for that role, a capability the authors term "Perspective Awareness." Entries are grounded in anonymized industrial-maintenance support queries and use constructed Text World Models to simulate the agent's operating environment and generate perspective-aware action trajectories. State-of-the-art LLMs solve at most 69% of tasks, with over half of trajectories containing attempts at perspective-violating actions, exposing this as a largely unsolved axis of agent evaluation relevant to high-stakes, physically-enacted agent deployments.

arxiv.orgpaperAdded 5 Oct 2026, published 2 Oct 2026🧠 AI

VenusRL is a fully disaggregated system for agentic reinforcement learning that trains LLM agents through multi-turn interactions with external tool environments. It introduces a priority-aware action scheduler that uses length-prediction heuristics to prioritize sample groups likely to unblock the next training step across batch admission, KV cache residency, and cross-worker orchestration, plus an environment resource manager that packs more tool sandboxes per node via a memory-aware admission threshold and template-keyed page-sharing pool using copy-on-write for isolation. The system achieves up to 4.24x end-to-end training speedup and reduces environment (sandbox) cost by up to 89% over state-of-the-art baselines on agentic RL workloads.

arxiv.orgpaperAdded 5 Oct 2026, published 2 Oct 2026🧠 AI

EvoRiskBench is an arXiv paper introducing an evolving benchmark for runtime security risks in LLM-powered workspace agents, built around the EP-Path-EF framework (nine entry-point categories, five effect categories) linking risk entry points to technical effects via agent-mediated paths. The authors ran 450 adversarial tasks across six scenarios against nine model-harness combinations (GPT-5.6 Sol, DeepSeek-V4-Pro-0813, Claude Opus 5 paired with Claude Code, Codex, and OpenClaw), finding Codex + DeepSeek-V4-Pro-0813 the most vulnerable at 68.44% attack success rate and showing ASR varies more by model than by harness. Cases are auto-constructed and verified in isolated environments using runtime traces and environment state.

arxiv.orgpaperAdded 5 Oct 2026, published 2 Oct 2026🛡️ Security