This paper studies how to convert U.S. state legislative PDFs into exact, schema-constrained XML. The authors test the hypothesis that exact reproduction relies more on harness engineering (tools, orchestration, deterministic constraints around a model) than on model scale. They cross three Claude models with three harness tiers (zero-shot, single-agent with tools, and decomposed multi-agent pipeline) on 153 gold bills. The headline finding is striking: the weakest model in the full pipeline outperforms the strongest model zero-shot ($0.948$ vs $0.806$), and the model spread collapses from $0.68$–$0.81$ to $0.95$ under full scaffolding.

Explorer-Zero tackles the data-curation bottleneck for agentic RL by training a learned proposer to explore stateful environments, compose multi-step tasks from demonstrated transitions, and record intermediate environment states as verifiable checkpoints. These checkpoints supply fine-grained rewards $R^{\text{subgoal}}$ that prevent group-normalized advantages from collapsing when the solver fails, while alternating proposer–solver training adapts the curriculum automatically. On ALFWorld, ScienceWorld, and AppWorld, the approach outperforms strong self-play baselines and narrows the gap to human-data RL.

Medical image parsing requires a single model to produce heterogeneous outputs—categorical labels, bounding boxes, counts, numeric estimates, and free-text reports—across disparate imaging modalities. This work studies task-specific adaptation of a shared 4-bit Qwen3.5-9B backbone using lightweight LoRA adapters, where a question-only GLiClass router selects the adapter, image budget, and prompt for each case on the FLARE 2026 Task 3 benchmark. The core finding is that adaptation recipes should vary by task—rank, resolution, and prompts allocated according to demand—rather than applied uniformly.

This paper studies the implicit bias of the Muon optimizer when its idealized spectral-norm steepest-descent update is replaced by the standard practical implementation: finite Newton–Schulz iterations with a positive stabilization constant. The authors prove that, contrary to the spectral max-margin behavior established for idealized Muon, the practical variant instead converges in direction to the Frobenius max-margin separator—effectively recovering the implicit bias of ordinary gradient descent. They further characterize how the iteration count, stabilization, and polynomial choice interact, and provide conditions (logarithmically growing iterations) under which spectral bias can be recovered.

The paper introduces Sparse Transformer (ST), a 5-layer language model trained on TinyStories that enforces exact activation sparsity in its MLPs via a TopK gate. By allowing only K neurons to fire per token, the model creates a known reference basis that serves as ground truth for evaluating mechanistic interpretability methods. The authors use this testbed to compare feature-recovery techniques (SAEs vs. Transcoders) and to study how compression induces polysemanticity, releasing all 35 trained models and checkpoints to support future research.

Sequence models usually require costly backpropagation and large datasets, leaving open the question of how far simple random reservoirs can go in few-shot settings. This paper systematically tests Echo State Network variants on the STREAM benchmark of synthetic seq2seq tasks, showing that orthonormal input initialization preserves a quasi-linear memory regime and that a proposed data-dependent gate (G-ESN) together with shared deep readouts pushes the solvable frontier toward structural tasks like adding and bracket matching. By benchmarking these cheap reservoir models against gradient-based SOTA, the study offers a practical map of when random features suffice and when fully trained models remain necessary.

Agent ecosystems rely on reusable skills that compose into complex workflows. CoRedSkill decomposes a legitimate workflow into interdependent skills and injects distributed attack operations via AST rewriting, preserving original utility while connecting malicious steps through intermediate artifacts. On a 150-case benchmark spanning exfiltration, tampering, and privilege violation, it achieves 98.0% attack success and 90.7% joint success against both skill-package and runtime auditors. The work exposes a severe gap: skill compositions can simultaneously complete legitimate tasks and carry out stealthy unauthorized operations.

Long-horizon multi-agent mathematical research suffers from fragmented context, unsupported claim propagation, and opaque reasoning trails that are difficult for humans to inspect. Euler tackles this by representing the research process as persistent, shared research graphs—recording obligations, candidate routes, blockers, and evidence—that both agents and researchers manipulate through a unified workbench. The goal is to make extended mathematical investigations traceable, resumable, and open to focused human intervention at any step.

GUI agents are increasingly deployed to automate mobile tasks, but most benchmarks only measure whether a task finishes, not whether the execution path was stable. GraceBench fills this gap by representing each app's reachable interaction space as a UI Transition Graph (UTG) and aligning video-recorded trajectories to it, enabling step-level diagnosis of deviation, looping, and recovery. The authors evaluate eleven models on 169 tasks across ten Android apps and show that success metrics hide serious instability: over half of successful trajectories still contain a deviation or loop, and even the highest-success model recovers poorly. The work matters because it provides a concrete framework for measuring process-level reliability, which is essential for testing and real-world deployment.

Typed decision models route requests or select tools from predefined categorical options, using fallbacks such as "Other" or "Defer" to handle out-of-scope inputs. This paper introduces the Paired Fallback Robustness (PFR) Test to check whether models correctly switch to fallback when required and whether they remain consistent under logically equivalent rule descriptions such as Union versus Complement definitions. The authors find that fallback mechanisms frequently fail silently: Intern's accuracy on TREC50 collapses from 97.9% to 23.1% on correctly classified inputs when reassigned to fallback, and equivalent definitions can flip individual decisions without changing aggregate accuracy. These results matter because fallback options, intended as reliability safeguards in production routing and delegation systems, can themselves become a source of error.

Current agentic systems are built by single developers with full control, which limits scalability. This paper proposes multi-developer agentic systems (MDAs) as a new scaling axis, where independent developers contribute specialized agents that are composed via task decomposition and routing. On the diverse GAIA benchmark, the authors show that a coalition of specialists—none exceeding 35% accuracy alone—reaches 70% when combined in an MDA, while a narrow-domain SealQA experiment reveals overhead costs can erase gains. A Tullock-contest theory of developers further argues that MDAs incentivize specialization, whereas single-developer routing pushes generalism.

Long-horizon agent benchmarks like SWE-bench Verified can cost thousands of dollars and days of compute per evaluation run. This paper asks whether LLM agents can automatically construct cheaper proxy benchmarks that preserve the rankings and score distributions of expensive reference evaluations. The authors propose EvalBuilder, a meta-evaluation framework that assesses generated benchmarks along fidelity, efficiency, and robustness, with explicit tests for generalization to held-out models and freshly collected responses. The goal is to reduce the human effort and computational bottleneck of manual benchmark design.

Offline reinforcement learning from static datasets demands expressive policies that remain within data support while improving value. Drifting models train a direct generator via attraction to behavior actions and repulsion among generated particles, but standard drift policies weight repulsion solely by geometric distance and therefore cannot distinguish particles by expected return. This paper proposes Value-Guided Repulsion Q-Learning (VRQL), which modulates repulsion by combining kernel distance with a normalized Q-value bias so that lower-valued neighbors exert stronger repulsive force, while preserving the behavior anchor and a separate value-maximization objective. The authors report competitive performance across 50 OGBench tasks and 6 D4RL AntMaze environments without requiring an auxiliary behavior model.

Federated fine-tuning lets LLMs learn from distributed data, but malicious clients can poison the global model and their attack patterns may evolve as new tasks arrive. This paper proposes Safe-FCL, which continually adapts a risk detector using historical protective subspaces and then performs risk-aware, module-level aggregation of LoRA updates. The goal is to keep the global model safe across sequential tasks without forgetting previously learned attack signatures.

Neural networks require vector inputs, yet many problems involve higher-order objects like probability distributions, functions, and graphs that lack compact representations. This paper proposes a unified encoder-decoder framework that embeds families of such objects into fixed-size vectors using only finite sample sets, with a domain-specific decoder providing the training signal. The core idea is to replace per-object fitting with amortized learning: a permutation-invariant encoder compresses samples into an embedding that conditions a decoder, enabling generalization to unseen family members. The authors instantiate this on distributions, functions, and graphs, and claim it is the first framework general enough to work across object types.

Automated vulnerability repair typically validates patches against the same static alerts or proof-of-concept inputs used to generate them, risking overfitting to partial evidence. This paper introduces P2Patch, a counterexample-guided adversarial repair protocol in which an exploitation agent repeatedly tries to bypass the current patch, with each confirmed bypass becoming a permanent repair requirement. The core idea is to treat the patched program itself as a new attack target and to evaluate final patches against held-out security oracles strictly separated from construction-time evidence.

On-policy self-distillation gives reasoning models dense token-level supervision via a teacher that sees reference solutions, but this signal can drift toward style and ignores whether the student can finish correctly on its own. VASPO repurposes the same privileged reference inside PPO to train both a prefix-value critic and a bounded self-teacher that reweights selected positive advantages. The paper reports average gains of roughly 2.6 percentage points over PPO on math benchmarks and leading accuracy on Knights and Knaves.

Most synthetic pretraining pipelines generate samples by conditioning on an entire source passage or paragraph and asking a model to rewrite or paraphrase it. The paper identifies a systematic failure mode of this approach: fine-grained facts—such as secondary entities, list and table entries, and precise temporal attributes—are frequently omitted because the generator implicitly selects which facts to preserve. Atomic-Fact-Conditioned Synthesis (AFCS) fixes this by first extracting source-supported atomic facts, then conditioning each synthetic training sample on an explicit retained fact and its local context. Continued-pretraining experiments on 7B and 32B models show consistent gains on factual QA benchmarks, especially for middle- and long-tail knowledge, and granularity ablations isolate synthesis granularity as a causal lever for factual recall beyond surface-form diversity.

Probes on hidden activations are a promising tool for detecting deception and harmful intent, but they assume models cannot volitionally alter their own representations. Baldelli et al. ask whether open-weight LLMs can control their activations through in-context neurofeedback, devising a cross-model writer-subject protocol to disentangle genuine self-access from in-context pattern matching. Across 42 semantically opaque readouts and six safety monitors, they find that free-generation effects are largely explained by sentence-selection competence, while fixed-sentence control is tiny and monitor evasion is essentially absent. The results rigorously bound the current threat but flag a capability that may grow with model scale.

CGWM targets the opacity of neural world models by forcing latent states to be explicit symbolic concepts grounded from images by a neural encoder. It replaces learned transition dynamics with hand-specified LTLf rules and performs planning via gradient ascent on fuzzy temporal formulas. The key appeal is interpretability and zero-shot transfer under changing dynamics, though the evaluation is limited to small, fully observable deterministic grids.