Control evaluations test whether safeguards can stop a deliberately harmful AI agent, but they typically run in separate settings that may not resemble real deployment. This paper introduces simulated control evaluations (SCEs), which use a language model to generate tool responses in place of live execution, allowing evaluators to test attacks on a deployment's own tasks and codebases without causing harm. The central finding on LinuxArena is that SCEs predict safety metrics far more accurately than executing attacks in the mismatched BashArena control setting, suggesting that deployment-specific task coverage can outweigh the loss of execution fidelity.

Most automated agent-design research evaluates candidates on static, immediate-reward benchmarks, ignoring the non-stationarity, delayed feedback, and switching costs of real deployment. Cmas formalizes meta-agent architecture search as sequential incumbent replacement with an explicit false-promotion target, using paired shadow replay, interventional credit, and a conservative gate followed by simulated canary and rollback. The paper matters because it treats the architecture itself as a time-varying decision variable and asks whether we can safely replace a running compound agentic system without backtested-return overfitting. The answer offered is guarded: standard statistical ingredients are integrated sensibly, but the calibration is empirical and the guarantees are deliberately scoped.

This paper studies fine-grained intent classification on BANKING77 and CLINC150 by adapting a flexible decision-model interface (Laya) into fixed-label classification heads. For BANKING77 it applies sharpness-aware minimization (SAM) to a single encoder, while for CLINC150 it fuses probabilities from one Laya specialist and three DeBERTa-v3-large models. Rather than claiming a universal advance, the authors foreground statistical uncertainty, selection effects, and execution-path drift, making the work a transparent---if narrow---benchmark audit.

This paper addresses multi-horizon photovoltaic power forecasting from 15 to 240 minutes by asking whether residual error from a strong gradient-boosted tree can be reduced through selective, MAE-aligned combination with neural temporal predictors. The core idea is a constrained simplex mixture where the tree anchors the ensemble and weaker candidates can be assigned zero weight, with shared coefficients keeping the combiner parsimonious. The contribution matters because it isolates genuine aggregation value against a competitive baseline rather than inflating model count or comparing across mismatched tasks.

Language model rankings on question-answering benchmarks are known to shift with prompt wording, raising doubts about single-prompt evaluation. This paper investigates whether augmenting models with deterministic tools stabilizes pairwise comparisons, proposing a matched protocol that isolates answer readout, reasoning, tool invocation, and report access to attribute changes in wording sensitivity. Applying the protocol to six open models across five domains and five prompt wordings, the authors find that tools improve accuracy where a program directly answers the question yet frequently widen ranking instability because call frequency itself becomes wording-dependent. The work matters because it shows that deterministic tool output is not enough to guarantee stable evaluation, and it recommends reporting call frequencies and pairwise stability alongside headline accuracy.

PhysTrace evaluates physical consistency in videos by temporally aligning MLLM-generated, history-conditioned expectations with actual observations in a shared embedding space. Unlike prior work that probes internal representations or assigns video-level scores, it pinpoints when and why physical violations occur. The authors also introduce IntPhys2-Timing, adding temporal annotations to benchmark violation localization. Applied to diffusion and flow-based video models, PhysTrace reveals how physical inconsistencies emerge across generative timesteps—a crucial diagnostic as pretrained video backbones become policy priors for robot control.

Multilingual language models often fail to recognize that two names written in different scripts refer to the same person. This paper introduces a controlled benchmark of 601 audited identity pairs with attested Devanagari and Latin forms, plus a 374-item Malayalam replication set, to isolate cross-script entity matching failures. The authors find that Qwen2.5-7B's same-person accuracy collapses from 35.1% in Latin-Latin to 8.5% in Devanagari-Devanagari under Marathi prompts, then use probes, calibration, and activation patching to diagnose whether the model retains latent label information and where it can be causally intervened upon.

RecallGS tackles online open-vocabulary semantic 3D Gaussian Splatting from streaming images. Rather than learning a heavy 3D U-Net to inject geometric context into 2D CLIP features, it treats the agent's observation history as a non-parametric prior: it retrieves relevant past frames with CLIP, verifies their geometric support via alpha-compositing weights, and fuses the verified historical semantics into the current Gaussians. The core claim is that this training-free recall-ground-fuse pipeline recovers geometry-aware semantic context without the inference overhead of an additional learned 3D branch.

This paper addresses the NP-hard Flood-It minimization and decision problems on colored graphs. The authors develop a tailored A* search using novel game-state equivalences, lower-bound heuristics, and pruning rules, and compare it against SAT, ILP, and CP formulations. The study matters because it provides the first systematic empirical comparison of exact solvers for Flood-It, showing that domain-informed search dominates on most modest instances while SAT scales better on the hardest cases.

Multi-agent LLM pipelines are widely assumed to outperform single-call setups, yet it is unclear whether gains come from typed inter-agent contracts or merely from decomposition into specialized prompts. This paper conducts an 18-condition controlled experiment on requirements classification and MoSCoW prioritization using three small language models on the PROMISE NFR+ dataset. The core finding is that most accuracy gains are associated with decomposition and task-specific prompts rather than with Pydantic-validated typed states, though the typed contract shows other quality-assurance properties such as earlier fault containment.

LLM email agents increasingly handle sensitive inboxes, yet conventional phishing benchmarks only test whether models classify emails as malicious, not whether they actually obey harmful requests inside them. This paper introduces AgentPhishing, a benchmark that scores both detection failure and compliance with malicious requests, and PhishOpt, an adaptive optimizer that evolves target-specific email-generation skills using agent feedback under a realism constraint. The core finding is that agents which safely handle static, pre-existing phishing emails can be driven to near-zero detection and high compliance when attacks are adapted to their behavior, exposing a major gap in current safety evaluation.

Meta-Diff reframes few-shot diffusion adaptation as reusable transport in a low-dimensional task space, avoiding per-target backbone retraining. A shared encoder maps source and target distributions to coordinates $z$, and a learned affine map $\widetilde{z}_T = A z_S + b_c$ predicts the target coordinate from a data-rich source without using any target images at deployment. This is especially consequential in domains like healthcare, where target data are scarce and collecting them is costly or privacy-sensitive.

This paper asks why modern AI hits ceilings despite scale, data, and compute, and answers that open-ended intelligence requires co-recursive semantic self-extension: a continuous cycling between object-level inference and meta-level transformation of both formal languages and goals. Drawing on Kant, Gödel, and Hegel, it argues that fixed architectures—from LLMs to Gödel machines—are inherently bounded, and that only collectives with persistent external memory can escape determinism. It is an ambitious attempt to reframe AGI as a logical process of indefinite semantic reconstruction.

Selective combinatorial optimization problems (SCOPs) such as the Orienteering Problem and Knapsack Problem require jointly deciding which elements to serve and how to route or pack them, causing sampled solutions to vary widely in objective value. The paper proposes Reward-Weighted Preference Optimization (RWPO), a training objective that scales each pairwise preference loss by the normalized reward gap between trajectories, preserving cardinal solution-quality information that standard preference optimization discards. This matters because binary preference signals struggle when subset selection creates sparse, high-variance reward landscapes, and the authors show that retaining reward-gap information yields more stable training and stronger generalization to large instances.

QICOM is an open-source desktop application that unites quantitative medical image comparison, paired radiomics, and blinded observer assessment into a single reproducible workflow. It tackles the fragmentation problem that forces researchers to juggle separate tools and scripts, losing the link between images, settings, and results. By saving native projects, configurations, and blinded response mappings, it enables any comparison to be reopened and recalculated, which is essential for trustworthy evaluation of image-processing methods and acquisition protocols.

Trion-1 tackles the fragmentation of protein modeling across specialized systems by unifying protein sequence, 3D structure, and natural language in a single 4B diffusion language model. Its core idea is to represent all three modalities in a shared discrete token space and model them with a non-causal diffusion backbone, enabling global residue interactions for structure prediction while retaining LLM-style language capabilities. The work matters because it attempts to turn six core protein capabilities—folding, inverse folding, understanding, and design—into composable generative primitives within one model.

CoWriter tackles passive human supervision in LLM writing tools by adapting cognitive-science co-authoring methodologies into a proactive agentic workflow. It deploys three specialized agents—Leader, Monitor, and Reviewer—to guide users through brainstorming, outlining, drafting, and revision while sustaining engagement and narrative control. A within-subjects study with 14 graduate-student participants shows authors feel substantially greater ownership and produce texts rated higher in human-touch qualities.

High-speed FMCG manufacturing loses billions to unplanned downtime because maintenance software often relies on associational predictions that can misrank corrective actions when confounders or mediators are present. This dissertation proposes PriMa-Causa, a framework that inserts a Causal Reasoning Layer between fault prediction and action recommendation, using a graph-conditioned tabular foundation model—pre-trained once on synthetic structural causal models—to answer interventional queries $P(Y \mid do(T{=}t), X{=}x)$ in a single forward pass. If the empirical chapters deliver on the design, the work could materially improve maintenance efficiency by targeting what actions do rather than what they merely predict.

Reward models score responses to steer alignment and filtering, but pairwise benchmarks compare only answers to the same prompt, leaving prompt-level score shifts completely invisible. This paper shows that eighteen released scorers exhibit far larger between-prompt variance than human ratings, proposes a three-part human-referenced audit to isolate the source, and warns that blindly subtracting prompt means can actually degrade global response selection.

Access-control systems increasingly combine mined rules with learned classifiers, relying on a small trusted shield and a region map to route decisions. This paper audits the two hand-built artifacts that sit between verified code and measured ML but are themselves unchecked: the hard-deny set read from policy prose and the region map produced by the mining pipeline. Through exhaustive soundness checks on public ABAC policies, blind LLM elicitation, and an exact decomposition of hybrid routing risk, it shows that prose-derived deny sets are frequently unsound, standard miners emit the wrong kind of rule set for hybrid routing, and the routing benefit cannot be read from a single loss metric. The results matter because these silent failures propagate the authority of a trusted shield into wrong denials and degenerate routing.