Issue 34 · Aug 17–23, 2026
Every candidate
All 2,753 papers were scored from their abstracts by gpt-5.6-luna; 1,718 were not skipped. Shown here: the top 150 of those, in score order. Picks are marked.
-
Annotations as Rollouts: Efficient and Scalable Reinforcement Learning for Video MLLMs
The paper treats ground-truth annotations not just as reward signals, but as oracle trajectories that can be added directly to reinforcement-learning groups for video MLLM post-training. Its OraRL method avoids the resulting advantage-inversion problem with a decoupled estimator and sign-balanced pruning, reportedly cutting RL step cost to 2.2× SFT versus 4.9× for CoT-based GRPO while improving performance from 0.8B to 9B models and across tasks. It also claims large gains in temporal localization, tracking, segmentation, and spatial reasoning, with much faster inference when CoT is removed.
Using annotations as explicit oracle rollouts is a meaningful RL-post-training reframing, and the claimed combination of substantially lower training/inference cost, scaling across model sizes, and broad video-understanding gains merits close inspection, although the unusually strong benchmark comparisons should be verified.
-
Inadvertent Context Leakage in Language Models
The paper studies whether secrets merely present in an LLM’s context can influence otherwise benign outputs, even when the model refuses direct extraction. Across eight proprietary models, adaptive black-box attacks recover short numeric secrets with very high accuracy, infer sensitive properties from routine responses, and reportedly extract full Social Security numbers from a production-style agent; stronger instruction-following appears to increase leakage.
This is a potentially fundamental security failure for context-rich agents, with concrete cross-model results and the striking claim that capability and instruction-following themselves amplify covert leakage.
-
EchoCoT: Extracting Hidden Chain-of-Thought from Large Reasoning Models
The paper presents EchoCoT, a black-box API attack that exploits signals returned around tool calls to iteratively recover hidden chain-of-thought traces from reasoning models. It reports near-verbatim extraction rates up to 66.4% on open models, generalization up to 80% on unseen datasets, and recovery of a 33k-token trace from Gemini-2.5; tests on proprietary models reportedly produce traces matching their stated reasoning lengths and summaries.
If independently validated, this reveals a major and unexpected confidentiality failure in hidden-CoT APIs, with a concrete attack that appears to work across both open and frontier proprietary models.
-
Reinforcement Learning on Benign Facts Amplifies Leakage of Memorized Private Data
The paper finds that reinforcement learning on ordinary factual questions can make a model reveal personally identifiable information it had memorized during earlier training, even though the new training data contains no private information. On DeepSeek-V3.1, exact recovery of name–email pairs rose from 0.155 to 0.370, with the effect also appearing in untargeted recall and increasing with model size, while reasoning and refusal behavior stayed largely intact.
This identifies a serious and counterintuitive privacy failure mode: benign RL may selectively unlock latent memorized data without seeing or optimizing against that data, supported by quantitative results across models and probes.
-
Improving Few-Step Language Flows with Untied Self-Conditioning
The paper diagnoses a train–inference mismatch in self-conditioning for few-step flow-matching language models: during sampling, solver updates make the latent and explicit previous prediction redundantly coupled in a way not seen during training. It proposes a training-free sampler that removes redundant directions and estimates a step-average prediction from history, reporting a drop in generative perplexity from 531 to 62 at 8 steps on LangFlow and strong pairwise preference results, with gains through 256 steps.
The combination of a concrete explanation for few-step degradation and a no-retraining sampler claiming an 8.6× perplexity improvement is an unusually large, potentially broadly useful result, though the abstract leaves robustness and baseline details to verify.
-
AI with Authority, from Application to Silicon
The paper describes a workflow in which AI agents generated application code, a verified compiler and executive, and a RISC-V processor, with machine-checkable proofs connecting each stage. One researcher allegedly completed and taped out the system in five weeks using consumer AI subscriptions, with no human-written RTL or manually reviewed proofs; the proposed “Salt” method uses a small proof kernel as the trust boundary and records provenance, costs, time, and errors.
If independently substantiated, this is a striking demonstration that proof-carrying AI agents can coordinate an end-to-end hardware project at individual scale, though the abstract provides few concrete performance, cost, or silicon-validation details.
-
Mammalian TMC Family Proteins are Mechanically Gated Ion Channels
The study reports that human TMC3–TMC8 proteins reach the plasma membrane and form mechanically activated ion channels when expressed in cultured cells. Poking, membrane stretch, and suction activate currents and single-channel events, while mutations near the putative pore alter ion selectivity, supporting the claim that these proteins form the channel pore rather than merely regulate mechanosensitivity.
If independently validated in native tissues, identifying TMC3–8 as a broad mammalian family of pore-forming mechanosensitive channels would substantially expand the molecular basis of touch, pain, and other mechanical senses, although the current evidence is limited to heterologous expression.
-
Inductively Scalable, Single-Step Neural Surrogates for Wave-Scattering Inverse Problems
The paper trains a single-pass neural surrogate for 2D electromagnetic wave scattering by actively generating training examples where its predictions disagree most with a full-wave simulator, rather than sampling configurations randomly. This enables training with up to 41,772 controllable variables and inductive generalization to domains with over 3 million variables, while producing photonic inverse designs up to 98 wavelengths wide with reported 1.29–26.5× speedups over FDTD.
The combination of adversarial-style simulator-guided data generation, stable replay training, and demonstrated millions-variable inductive scaling addresses a major bottleneck in neural physical simulators rather than offering a minor surrogate-model improvement.
-
SecOPD: Mitigating Adaptive Prompt Injections by On-Policy Distillation
SecOPD fine-tunes an agent model against prompt injection using token-level feedback: it compares outputs on injected inputs with outputs from the original model on corresponding clean inputs, rather than assigning one reward to the whole response. On Qwen3.6-27B, it reports reducing attack success on adaptive PISmith attacks from 94.0% with Meta-SecAlign to 9.0%, while achieving 4.7% versus 5.5% on an unseen agentic tool-calling setting.
The reported collapse in adaptive-attack success, driven by a plausible token-level defensive-training mechanism rather than another prompt filter, is important enough to inspect, though the evidence is limited to the abstract and appears benchmark- and model-specific.
-
Order-Sensitive Fast-Synapse Limits in Sparse Excitatory-Inhibitory Threshold-Reset Networks
This paper shows that in sparse excitatory-inhibitory threshold-reset networks, weakly collapsing both synaptic kernels to an instantaneous impulse can lose crucial information: whether excitation or inhibition arrives first. It constructs matched networks with the same graph and initial state where reversing that microscopic order changes whether a target fires, and proves the difference can remain macroscopic through sparse-network limits and reset; it also identifies conditions under which fixed-delay averaging remains stable.
The paper gives a rigorous and potentially broadly important warning that the standard fast-synapse/instantaneous-limit approximation is non-unique for nonlinear threshold dynamics, with an explicit macroscopic counterexample rather than merely a microscopic pathology.
-
Fool's Gold: Defensive Deception Against Safety-Removal Attacks on Open-Weight Models
The paper proposes “decoy hardening,” training open-weight models to produce plausible but deliberately falsified hazardous answers after their refusal behavior is removed by abliteration, while preserving normal behavior before the attack. Across six models from five families, 51–90% of attacked responses were decoys, and on a CBRNE-adjacent benchmark the defended 122B model was wrong on 82–86% of matched-quality answers; however, repeated sampling can sometimes recover usable procedures and the defense covers only weight-based safety removal, not in-context jailbreaks.
This is a genuinely different security strategy—making safety-removal produce confidently wrong outputs rather than trying to preserve refusals—with unusually concrete cross-model and repeated-sampling tests, though its practical safety depends on whether decoys remain indistinguishable from correct answers and on the limited evaluated threat model.
-
Cross-View Correspondence Is a Measurement Intervention: Two-Sided Validation for Agent Evaluation and Credit Assignment
This paper argues that the mapping used to compare agent traces or responses across transformed views is not neutral preprocessing: different valid mappings can create apparent sensitivity, invariance, or learning credit. It develops two-sided validation and an all-optima analysis, finding that optimal tracebacks disagree on temporal localization for 55.9% of 1,586 trajectory pairs and that improperly calibrated maps can erase harmful responses, while validated alternatives preserve them.
It identifies a largely overlooked source of non-identifiability in agent evaluation and credit assignment, backs the claim with theory and substantial audit results, and shows that correspondence choices can reverse substantive conclusions rather than merely change scores.
-
When Clean Data Hurts: Learning with Monotone Corruptions Beyond Binary Classification
This paper studies a corruption model where an adversary adds correctly labeled examples to an otherwise i.i.d. training set. It shows that even a multiclass concept class with DS dimension 2 can become completely unlearnable when an adaptive adversary adds a linear number of examples, while any sublinear number of additions preserves learnability; constant-budget, partially observed, and oblivious adversaries do not cause this failure. The work identifies a sharp boundary for when monotone corruptions fundamentally change learnability, extending earlier binary-classification results.
The striking result is that adding correctly labeled data—not mislabeled or removed data—can make an otherwise learnable multiclass problem unlearnable, with a tight linear-versus-sublinear corruption threshold.
-
Do SpeechLMs Hear Their Own Opinions? Diagnosing and Mitigating Previous-Belief Contamination in Streaming Emotion Understanding
The paper shows that feeding a SpeechLM its own previous emotion prediction can overwhelm the evidence in the current audio: changing only the injected prior label drops accuracy from 72.50% to 30.42% and flips 65.69% of predictions. It proposes EmoUpdate, a training-free design that isolates acoustic perception from state updates and corrects residual contamination; across four models and two benchmarks, it reports large gains in step and state-balanced accuracy.
The counterfactual diagnosis exposes a severe and plausibly general failure mode in streaming models, and the proposed training-free mitigation shows unusually large improvements across multiple models and benchmarks.
-
In-Cell Learning: Deployed Language Models Can Learn New Knowledge Without Changing a Single Stored Bit
The paper proposes storing model updates in the unused intervals between 4-bit quantization levels rather than changing the quantized weight codes. Its CellFill method trains a separate low-rank “fill” that can be added or removed while preserving every original code and scale, and reports injecting 83–97% of targeted facts across several quantized models, with some multi-hop and code-use demonstrations and lower-token cost than retrieval.
Writing reversible new knowledge into quantization slack while leaving the released model artifact bit-identical is a genuinely new deployment paradigm, and the abstract gives unusually broad model-scale and constraint-verification evidence, though the practical capacity and generalization limits deserve scrutiny.
-
ARCHER: Amortized cross-specimen pose estimation for cryo-electron microscopy
ARCHER learns pose inference once across many protein structures, then estimates particle orientations for a new specimen by conditioning on that specimen’s reference volume rather than retraining from scratch. It reports 5.0° median angular error on 100 held-out structures and 2.5° on experimental particles, with reconstructions within 0.16 Å of dedicated estimators while preserving conformational signals. The key claim is that pose estimation is largely specimen-agnostic when the reference structure is supplied explicitly.
If validated, cross-specimen zero-shot pose estimation would challenge the assumption that cryo-EM pose inference must be learned separately for each dataset, with potentially substantial reductions in reconstruction cost and improved transfer to new structures.
-
Parametric neural control differentiates top neural network models of primate visual cortex
The authors test whether vision models that predict primate visual responses equally well also represent visual features in the same way. They turn each model’s fitted neural encoding direction into controlled image perturbations and find, in closed-loop experiments across 10 models, 27,500 stimuli, five macaques, and multiple visual areas, that the models differ substantially in their ability to drive the predicted neurons. Adversarially trained models perform better overall, but the strongest predictor is the spatial-frequency structure of the model’s input gradients rather than ordinary image-prediction accuracy.
It presents a genuinely causal test showing that near-identical neural predictivity does not imply equivalent brain-like representations, backed by a substantial cross-model, cross-animal electrophysiology experiment and a potentially useful diagnostic for model-brain alignment.
-
Mice sense Moon and Sun
The authors report that mice show ~14- and ~28-day cycles in spontaneous activity, with peaks near new and full Moon. The patterns replicated across nine cohorts at four facilities and persisted in mice lacking core circadian-clock genes, while tracking periodic geomagnetic fluctuations linked to lunar and solar cycles. The main novelty is evidence that mammalian behavior may be modulated by lunar/solar geomagnetic signals independently of the conventional circadian machinery.
The replicated long-timescale behavioral rhythms and their persistence after circadian-gene disruption would substantially change views of mammalian magnetoreception, although the abstract provides correlation rather than causal magnetic-field manipulation.
-
Visual deprivation in adulthood engages presynaptic plasticity of thalamocortical synapses
In adult mice, prolonged darkness followed by restored light reactivates robust, reversible plasticity at visual thalamus-to-cortex synapses, despite the usual post-critical-period decline. The changes arise mainly presynaptically: dark exposure and light reintroduction reorganize synaptic vesicles and alter calcium signaling, release probability, and presynaptic molecular structure.
The paper challenges the assumption that adult thalamocortical plasticity is irreversibly lost and identifies a previously underappreciated presynaptic mechanism for reopening it under extreme sensory conditions.
-
Vectorial efference copy and visuomotor transformation through gap junctions
In fruit flies, the authors find that eye-movement motor neurons are directly electrically coupled to visual neurons through gap junctions. This single bidirectional connection both supports optokinetic reflexes and sends a vector-specific efference copy of spontaneous retinal movements back into the visual system; a model quantitatively predicts the recorded signals in darkness, suggesting a mechanism for canceling self-generated visual input.
The paper identifies an unusually simple, mechanistically testable solution in which gap junctions simultaneously implement visuomotor transformation and directional efference-copy cancellation, with model predictions matching physiological recordings.
-
Semaglutide-induced satiation, nausea, and food reward suppression are mediated by GLP-1 receptors in the area postrema
This study maps how semaglutide produces different effects on eating behavior in the brainstem. In mice, semaglutide recruited GLP-1 receptor neurons in the area postrema, which in turn activated mostly non-GLP-1R neurons in the nucleus tractus solitarius; reactivating these downstream neurons reproduced satiation, nausea, reduced food reward, and weight loss, while satiety was partly separable. The results suggest that the drug’s therapeutic and adverse effects are mediated by dissociable circuits rather than a single GLP-1R population.
The surprising causal finding that GLP-1R area-postrema neurons recruit downstream non-GLP-1R NTS circuits controlling both efficacy and nausea offers a new circuit-level explanation and a plausible route to better-tolerated obesity drugs.
-
Efficient coding makes and breaks Webers law
The authors test whether Weber’s law emerges from efficient coding rather than being a fixed property of perception. By changing the frequency distribution of stimulus magnitudes, they made larger stimuli more common and observed an inversion of the usual Weber-like discriminability pattern across three sensory modalities; participants’ perceptual coding adapted in ways that improved task performance.
This provides unusually direct causal evidence that a foundational psychophysical law is flexible and distribution-dependent, potentially replacing a descriptive rule with a mechanistic efficient-coding explanation.
-
Agent Lightning v1.0: Towards Harnessed Agentic RL
Agent Lightning v1.0 is a lightweight framework for training agents with reinforcement learning while leaving the agent harness in charge of tool use, context, and control flow. It formalizes the resulting training problems—such as aligning variable LLM requests, computing advantages, and normalizing losses—and reports that 6K examples improve Qwen3.5-9B on SWE-bench Verified from 41.8% to 56.4% with modest compute.
The combination of a general, deployable architecture for harness-level agent RL and a reported 14.6-point SWE-bench gain from only 6K examples makes this unusually relevant, although the abstract provides limited detail for independently judging the result.
-
SPADE: Self-Play in Adaptive Synthetic Executable Environments
SPADE trains language agents in environments that are generated and continually adapted by another instance of an LLM. The environment designer writes executable, long-horizon tasks with transitions, rewards, and verifiers, then uses the agent’s performance gap with and without hints to target tasks near its capability frontier. Across math, science, code, reasoning, tool use, and games, the authors report gains over fixed-environment training, including +5.3 average across eight held-out benchmarks and larger improvements in multi-turn tool use.
The learnable, self-play environment generator is a substantive direction for open-ended agent improvement, and the reported gains across multiple domains and model scales are large enough to warrant checking the experimental details.
-
FlashPrefill V2: Block-Sparse Prefill Attention for Long-Context LLM Serving
FlashPrefill V2 is a production-oriented sparse-attention backend for long-context LLM prefill. It adds a mean-correction mechanism to reduce approximation error, GPU optimizations and FP8 support, and integration features such as paged KV cache and continuous batching; the authors report up to 30.49× speedup over a dense FlashAttention-3/4-aligned baseline at 128K context on H20 GPUs.
The combination of apparently very large prefill speedups, extreme sparsity with controlled quality loss, and deployment-compatible implementation could materially change long-context serving, although the abstract lacks concrete accuracy-degradation and workload details needed to validate the headline numbers.
-
Reinforced Planning with Latent World Models
The paper proposes RP1, a learned planner that trains both a critic and a multi-step plan-improvement operator from imagined rollouts, rather than relying on hand-designed search or merely learning an amortized policy. Attached to two pretrained latent world models, it reportedly beats hand-designed planners across visual navigation, reaching, and manipulation, with near-perfect success in some settings while using 1,000× fewer model rollouts and running up to 67× faster.
Learning the search-and-plan-improvement procedure itself, combined with unusually large claimed efficiency gains across several embodied tasks and world-model backbones, would be a substantial advance if the comparisons and generalization hold.
-
Score the Algebra, Not the Span: Dimension Reduction for Transfer Operator Models of Dynamical Systems
The paper argues that standard Koopman/transfer-operator reduction can completely lose weakly coupled dynamical components because it allocates one coordinate per spectral mode; adding more modes may require exponentially many coordinates. It proposes scoring the sigma-algebra generated by coordinates using a chi-squared dependence objective, where products and powers are represented implicitly, and claims that twice the intrinsic dimension suffices to retain the full operator spectrum. On composite benchmark systems, ten algebra-based coordinates recover components that VAMP-style methods miss at ranks below 100 and enable few-shot prediction from masked components.
The paper presents a potentially important reframing of dynamical representation learning—from preserving a low-dimensional span to preserving the generated algebra—along with a striking linear-masking failure mode and a dimension guarantee, though the empirical evidence is currently limited to constructed benchmark composites.
-
Frame-Level Evaluation in Weakly Supervised Video Anomaly Detection Mostly Measures Video-Level Ranking
The paper shows that common frame-level metrics for weakly supervised video anomaly detection are dominated by comparisons between different videos, not by correctly ordering moments within a video. A classifier that assigns one constant score to every frame in a video still achieves 81.40–97.18 Micro-AUROC and retains a median 98.6% of the margin above chance across 72 runs, exposing temporal dilution in several standard benchmarks and also affecting official AP evaluation.
This identifies a fundamental evaluation failure—high reported localization scores can arise with no temporal localization at all—and supports it across multiple datasets, metrics, and controlled experiments.
-
Abra: Scaling Diffusion Image Training
The paper studies how text-to-image flow-matching transformers scale across three orders of magnitude in training compute. It finds predictable scaling behavior, but a different compute-optimal regime from language models: roughly 200 image tokens per parameter, with more data generally preferable to larger models; this pattern also appears in quality metrics, classifier-free guidance, representations, and training-curve shapes.
A broad, controlled scaling-law study suggests that diffusion training follows reliable but materially different compute/data tradeoffs from LLMs, with practical implications for how large image models should be trained.
-
ClawGym II: Exploring Black-Box RL on Agent Harness
This paper develops a way to train agents with reinforcement learning even when their execution harnesses are complex and opaque. It intercepts model calls through a serving proxy, reconstructs multi-turn interactions as prefix trees for PPO or GRPO, and supports training across multiple harnesses; on ClawGym-Bench, it reports 9.98- and 14.81-point Pass@1 gains with Qwen3-30A3B, plus gains on JobBench and OfficeQA.
The combination of black-box harness optimization, trajectory reconstruction, and cross-harness RL addresses a major practical obstacle to training long-horizon coding and computer-use agents, with sizable reported gains rather than a minor benchmark improvement.
-
FlowEvo: Self-Evolving Agents through the Co-Evolution of Workflows and Executable Skills
FlowEvo lets an LLM agent turn successful inference-time workflows into reusable executable skills, maintain them in a persistent bank, and select or combine them in later tasks. Without additional training, it reports broad gains over eight baselines across ALFWorld, HumanEval, MBPP, GSM8K, and MATH-500; notably, ALFWorld accuracy rises to 85.6% while using about one-third as many tokens, and it beats ExpeL in 49 of 50 model–dataset comparisons.
The interesting contribution is a concrete inference-time mechanism for cumulative agent improvement—co-evolving workflows and reusable skills—with unusually broad reported gains and a substantial ALFWorld efficiency improvement, though the claims warrant checking for evaluation and baseline details.
-
Toward Optimal Second-Order Path-Length Guarantee for Adversarial Multi-Armed Bandits
This paper proves that an existing algorithm for adversarial bandits already achieves near-optimal regret in terms of the second-order path length, despite this not being apparent from prior analyses. It obtains an expected-regret bound of order K log(KT) plus sqrt(K log(KT)(1+Q)), matching the known lower bound up to logarithmic factors, and gives a restart scheme that works without knowing the path length in advance.
It resolves an explicit open problem with the striking result that no new algorithm is needed—only a substantially sharper analysis—while also handling the unknown path-length setting.
-
CytoFormer: A Molecularly Supervised Cell Foundation Model for Histopathology Cell Classification
CytoFormer learns cell morphology from paired H&E images and spatial-transcriptomics molecular labels, avoiding the need for extensive manual pathologist annotation. Trained on 15.4 million cells across 16 organs, it achieves strong held-out classification and transfers better than six pathology foundation models, while also improving label efficiency in an active-learning task.
The molecularly supervised pairing of spatial transcriptomics with routine histology is a genuinely useful training paradigm, supported by large cross-organ data and transfer and active-learning results rather than a single benchmark gain.
-
Certified but Private: Scalable Zero-Knowledge Proofs for Neural Network Guarantees
PANDA uses zero-knowledge proofs to let a model owner prove robustness—and potentially fairness—guarantees without revealing the model’s parameters. Its key technique proves the linear-relaxation bounds used by CROWN for nonlinear activations, reportedly certifying networks with over 2.9 million parameters in 5 minutes and allowing verification in 10 seconds, far beyond prior ZKP-based approaches.
The combination of privacy-preserving model certification with a claimed four-order-of-magnitude scalability improvement addresses a major practical barrier to deploying verifiable ML guarantees.
-
Beyond the Trace: Coupling an Interpretable Reasoning-State Readout to Native MoE Routing
The paper learns a 64-dimensional, interpretable representation of a reasoning model’s internal state and shows that it contains information missing from the model’s emitted chain of thought, including a distinction between effort and problem-induced strain. It then predicts this representation from native MoE routing statistics, using the cheaper proxy for candidate selection, voting, and online stop-and-resample decisions; routing-based control improves accuracy across several settings, and targeted router edits produce the predicted behavioral changes.
This combines process interpretability with an actionable, low-overhead control signal from native MoE routing, backed by predictive gains, online intervention results, and targeted causal router edits rather than merely correlational analysis.
-
GigaBrain-WBC-0.5: A Behavior World Model for Robust Whole-Body Control with Environment Interaction
This paper trains a causal Transformer for humanoid whole-body control that predicts actions, future states, and feasible behavior commands while modeling contacts with terrain and objects. At deployment it detects commands that are likely infeasible and retracts them toward learned behaviors, reporting large gains over tracker baselines in terrain interaction, implausible-command handling, and fall recovery, plus hardware tests and transfer from Unitree G1 to Maker L01.
The combination of an environment-aware behavior world model with online command correction addresses a major limitation of humanoid trackers, and the reported multi-regime gains and hardware transfer suggest more than an incremental controller improvement.
-
Stored in Optimizer State, Valued by Later Training: A Causal Account of Subliminal Trait Transfer
The paper argues that subliminal trait transfer is not stored only in model parameters: the optimizer’s first moment can carry a source-induced perturbation after the original data is removed. Through state-surgery experiments and a transport/valuation identity, it separates carrying the perturbation from later training deciding whether it produces positive, negative, or negligible behavior, with predictions validated across several models, optimizers, and readouts.
It offers a new causal mechanism for an unusual training phenomenon—optimizer state as a persistent information carrier whose eventual behavioral effect depends on future training—and supports it with controlled interventions, cross-model replication, and quantitative predictions.
-
Learning Exact NVIDIA SASS Encoders with $\mathbb{F}_2$ Linear Algebra
F2Asm learns NVIDIA SASS instruction encodings as affine transformations over $F_2$, rather than requiring a manually specified assembler. It supports Hopper, Blackwell, and Rubin GPUs, learns from thousands of real CUBINs, and reportedly reproduces every compared executable text section exactly, including target-specific control bits and metadata handling.
This provides a genuinely new and practical capability—an open assembler for otherwise undocumented recent NVIDIA machine code—with exact round-trip validation across multiple GPU generations, though its broader reliability and coverage deserve verification.
-
AsmEvo: Agentic Assembly-Level Optimization of AMD GPU Kernels with Functional Equivalence Verification
AsmEvo optimizes already-compiled AMD GPU kernels directly at the assembly/code-object level, without needing CUDA, Triton, HIP, or source code. It uses agent-proposed edits, profiling, ABI-aware rebuilding, and differential testing against the original binary to preserve functional behavior; on selected benchmarks it reports a 1.35x geometric-mean speedup (最大 3.88x), with smaller but measurable gains on production AITer, vLLM, and SGLang workloads.
The ability to safely optimize deployed AMD GPU binaries when source-level optimization is unavailable is a genuinely useful new capability, supported by broad kernel and production-workload experiments, though the production gains are moderate and the benchmark selection warrants scrutiny.
-
GhostTac: Manipulating Tactile Sensors without Physical Contact
GhostTac demonstrates that electromagnetic interference can manipulate robotic tactile sensors without physical contact. By exploiting sensor nonlinearities and limited-bandwidth amplification, crafted EMI creates persistent, spatially targeted measurement offsets that affect grasping, slip detection, and material classification, with tests across 10 modules and 2 dexterous hands.
This introduces a genuinely new physical attack surface for tactile robotics, with broad cross-sensor validation and demonstrated consequences for real manipulation tasks rather than only benchtop signal corruption.
-
Retrieval Needs Multivectors: An Exponential Separation
The paper constructs query–document relevance patterns that require exponentially large single-vector embeddings to rank correctly, while polynomial-size multi-vector embeddings can represent them. It also introduces ANDOR, a benchmark based on these hard cases, where single-vector retrievers perform poorly even after fine-tuning, while multi-vector models improve substantially.
The explicit exponential representational separation, paired with empirical evidence on a targeted benchmark, gives a substantive theoretical explanation for why multi-vector retrieval can outperform single-vector methods rather than merely reporting another benchmark gain.
-
Width-Independent Compressibility of Deep Neural Networks
This paper proves that a sufficiently wide, fixed-depth MLP with analytic activations can be approximated to error ε by a network of the same depth whose width does not depend on the teacher network’s width. The required compressed width scales as O((log(1/ε))^{d_in}), using derivative matching that exploits low-dimensional inputs and layer-wise reweighting to preserve the function.
The width-independent theorem offers a potentially important explanation for why heavily overparameterized networks can be compressed, though its practical relevance depends on how restrictive the fixed-teacher and analytic-activation assumptions are.
-
The Communication Map of a Transformer
The paper introduces a weight-only “communication map” that estimates coupling across all major transformer component pairs, scaling from GPT-2 to Pythia-6.9B in seconds to minutes. Strongly coupled head communities recover known induction circuits, and aggregating couplings identifies a two-dimensional residual-stream subspace whose removal eliminates in-context copying across six models—distinct from directions found by activation PCA or outlier analysis.
It offers a scalable, largely automated alternative to hand-built circuit discovery and reports a potentially general mechanistic signature of induction that survives across model scales.
-
Recovering Weighted Tangent Geometry from a Single-Scale Score Field
This paper studies whether a score field at just one noise level can reveal the local geometry of data near a singular branch point. It gives a derivative-free calibration procedure for the branch center and local dimension, then shows that score values on one sphere identify the weighted distribution of tangent directions; for finitely many rays, moments provide constructive recovery of directions and weights, with finite-noise guarantees for smooth planar branches.
The notable result is a theoretically grounded single-scale, score-only reconstruction of weighted tangent geometry—including branch structure—rather than merely using scores for denoising or generation.
-
Where Cognition Lives: Dissecting Emergent from Computed Function in a Minimal Complete Cognitive Architecture
The paper builds a small recurrent cognitive architecture with adaptive halting, homeostatic control, and explicit value allocation, then tests which capabilities arise from learning versus which must be implemented. It finds that competence and apparent stopping behavior can emerge, but the stopping advantage largely disappears when readouts and compute are properly matched; in contrast, value-sensitive allocation does not emerge and must be computed explicitly. Additional controlled experiments suggest self-consistency voting is useful for LLM answer selection, while agreement-based stopping is a poor signal, and that the value of allocation depends strongly on the cost structure.
The careful instrumentation and null results challenge common interpretations of emergent adaptive computation, while identifying explicit value allocation as a genuinely necessary architectural component in the tested setting.
-
Tumor-tropic E. coli engineered as living T and NK cell engagers
The authors engineer tumor-seeking, nonpathogenic E. coli to display bispecific antibody fragments that physically link cancer cells with T cells or NK cells. In cell cultures, patient-derived organoids, and mouse models, these bacteria enhanced immune killing, showed tumor-restricted activity, outperformed tarlatamab in a small-cell lung cancer model, and produced durable immune responses; the platform also combined with targeted therapy and checkpoint blockade.
This is a genuinely new therapeutic direction—using tumor-tropic living bacteria as localized, programmable immune-cell engagers—with multi-level preclinical evidence suggesting improved tumor access and reduced systemic toxicity, though clinical translation remains untested.
-
Ancient human mitochondrial genomes encode antimicrobial peptides
The authors searched 2,025 ancient human mitochondrial genomes for hidden open-reading-frame peptides, synthesized 38 candidates, and found 14 with antibacterial activity against Gram-negative and Gram-positive bacteria. Some showed low human-cell toxicity, diverse killing mechanisms, and one reduced bacterial load in a mouse skin-abscess model. The novel claim is that mitochondrial DNA may retain functional antimicrobial peptides rather than serving only as genetic history.
This is an unusually concrete and experimentally supported discovery direction—mining ancient mitochondrial sequence for previously unknown host-defense molecules—with validation extending to an animal infection model.
-
Deleting learning-induced dendritic spines disrupts the memory they encode
The authors develop NSET, a chemical-genetic method that selectively removes newly formed dendritic spines while sparing older spines. In mouse basolateral amygdala, removing learning-induced spines disrupted auditory fear memory but did not erase consolidated memories or impair subsequent learning, providing causal evidence that these nascent spines help store long-term memories.
This directly tests a longstanding causal claim about the physical substrate of memory with a targeted spine-elimination tool, rather than merely correlating spine formation with learning.
-
Recurrent inhibition crosses the spinal cord midline in humans
The study finds that activating motor axons on one side of the human body suppresses motor-unit firing in the opposite leg, with dynamics resembling recurrent inhibition. A data-constrained spinal-circuit model suggests this requires a polysynaptic commissural pathway involving V3-like interneurons, and indicates that motoneuron properties shape the effect.
It reports direct human evidence for previously unrecognized cross-midline recurrent inhibition and proposes a mechanistic circuit explanation relevant to bilateral motor coordination, rather than merely applying a standard method.
-
DRG meningeal tertiary lymphoid structures are regulated by B cells as a pronociceptive locus after peripheral nerve injury
The study finds that peripheral nerve injury creates tertiary lymphoid structure-like immune clusters in the meninges surrounding dorsal root ganglia, where germinal-center B cells organize local antibody-producing responses linked to neuropathic pain. Genetic deletion, local B-cell depletion, and B-cell transfer experiments show that disrupting or restoring these structures respectively prevents or enables pain in mice; analogous structures were observed in pig and human DRG tissue.
It identifies a previously unrecognized, spatially organized meningeal immune niche that appears causally necessary for neuropathic pain, with convergent genetic, depletion, rescue, and cross-species evidence.
-
Bats decouple sonar gaze from steering to resolve sensory conflict
The authors created an auditory–visual conflict in freely flying echolocating bats by shifting the apparent perch location with prisms. Bats that corrected course within one flight separated the direction of sonar-based active sensing from the direction of steering, apparently allowing rapid reweighting of visual and auditory information; Bayesian agents using the same separation also corrected faster. Earplugs prevented correction in the conflict condition, supporting a causal role for auditory localization rather than simple post-failure behavioral adjustment.
This combines an unusually realistic sensory-conflict experiment with a concrete computational principle—decoupling sensing from action—that could influence models of active perception and robotic control, with causal manipulation and agent validation rather than only descriptive behavior.
-
Monkeys learn to report their own sensory cortical population activity
The authors trained macaques, using online V4 recordings and closed-loop feedback, to make choices based on specific axes of their own visual cortical population activity rather than only on the presented shapes. Training increased neuron–choice alignment along those axes without detectable changes in stimulus selectivity or noise correlations, and controls and simulations point to altered sensory readout as the explanation.
This provides an unusually direct causal test of sensory readout and suggests that poor stimulus–choice alignment in ordinary perception reflects limitations of available training signals, not an intrinsic inability to learn alternative readouts.
-
In vivo optical clearing of the mouse brain
The authors introduce iodixanol-ACSF, a biocompatible agent that makes living mouse brain tissue substantially more transparent without obvious impairment of behavior or extracellular neural activity. In vivo transmission and fluorescence microscopy reached 150–200% greater penetration depth while requiring only one-third to one-half the laser intensity of untreated tissue, potentially enabling deeper cellular-resolution imaging in functioning circuits.
This demonstrates a potentially important new capability—deep optical access to living, behaving brain tissue—while preserving behavior and recorded circuit activity, rather than merely improving imaging in fixed samples.
-
Towards Quantifying Benchmark Optimization in ASR Models
The paper develops probes for detecting when ASR systems reproduce benchmark reference text rather than faithfully transcribing ambiguous or contradictory audio. Tests on high-performing open models find reference-span copying, masked-number recovery, and orthographic preferences, with mechanistic and causal interventions suggesting these behaviors are learned benchmark-conditioned policies rather than general transcription ability.
It presents a concrete way to expose and causally test benchmark optimization in ASR, challenging whether strong public-benchmark scores measure robust transcription rather than exploitation of dataset-specific reference regularities.
-
Prior Audit-Repair Context Shifts LLM Verifier Thresholds Toward Leniency
The paper tests whether giving an LLM verifier a preceding audit-and-repair interaction changes its later judgments on the exact same checking task. Across 15 model/wording combinations, this context consistently reduced false alarms by 2.8–11.5 percentage points, with signal-detection analysis attributing the change to a more lenient decision threshold rather than better discrimination; an audit that reported an error made the verifier even more lenient. The authors also find that repair text and the audit verdict contribute differently across model families, and that the effect persists with reasoning enabled.
This is a practically important and counterintuitive finding that verifier–repair pipeline context systematically changes judgment thresholds, potentially undermining assumptions about modular checker behavior, and it is supported by consistent cross-condition results rather than a single benchmark comparison.
-
SkillGate: Training In-Policy Skill Selection in Long-Horizon Agents
The paper identifies a credit-assignment failure in long-horizon agents that choose which procedural skill to retrieve: sequence-level rewards give the skill-selection tokens little influence and can punish a good choice when later execution fails. SkillGate separates credit for selecting a skill from credit for executing it, and reports a rise in success from 40.8% to 53.2% across five benchmarks, while reducing misleading skill exposure and the number of skills read.
The combination of a specific, plausibly general failure mode in long-horizon credit assignment and a substantial multi-benchmark improvement makes this worth close attention, though the abstract leaves unclear how the “correct” skill label or local advantage is obtained.
-
Super-resolution ranging using a sub-terahertz self-injection-locked frequency-modulated radar
The paper develops a fully integrated sub-THz autodyne FMCW radar that uses self-injection locking to suppress phase noise and an intermediate-frequency comb to create an effective sweep bandwidth beyond the physical electronic bandwidth. In experiments, it achieves sub-millimeter range resolution and reports range accuracy below 0.002%, including imaging covered printed letters with micrometer-scale features.
The combination of self-injection locking and an IF-comb-based effective bandwidth appears to enable a substantial capability jump for portable electronic sub-THz radar, though the abstract lacks operating-range, baseline, and measurement-detail needed to verify the headline claims.
-
Neuro-symbolic learning over OWL 2 DL via consequence-based compilation to differentiable circuits
Baobab compiles full OWL 2 DL/SROIQ ontologies with finite ABoxes into differentiable sentential decision diagrams, preserving classical entailment while allowing perception networks to be trained from partial supervision. On synthetic image-reasoning tasks, it recovers ontology concepts that independent perception misses and uses justification-indexed mixtures to avoid collapsing onto one of several logically consistent interpretations; the compiler and representation result are machine-checked in Lean.
The combination of compilation for non-Horn description logic, differentiable probabilistic reasoning, and an explicit treatment of reasoning shortcuts is a genuinely unusual direction, though the empirical case is limited to MNIST-scale experiments.
-
Causal Reasoning with Bipartite Graphical Causal Models
The paper introduces bipartite graphical causal models, representing variables and the equations that define them as separate nodes. This makes interventions specify not only a target value but also which equation is replaced, resolving ambiguities that arise in equilibrium systems with feedback; the authors develop a corresponding separation criterion and do-calculus, with a physical case study.
It proposes a genuinely different causal representation that addresses a fundamental limitation of standard SCM/CBN interventions in cyclic equilibrium systems, though the evidence is primarily formal with only a case study rather than broad empirical validation.
-
Beyond Imitation: Self-Improving Robot Policies via Off-Policy Q-Planning
The paper adds a small off-policy Q-function to a large visuomotor behavior-cloning policy, using Q-values to reweight sampled actions at inference and to learn from both successful and failed deployment rollouts while keeping the BC policy frozen. Across LIBERO, RoboTwin, and two real bimanual manipulation tasks, repeated self-improvement substantially raises success rates—for example, 40% to 90% on cup stacking and 25% to 80% on wallet insertion—without new human demonstrations or an auxiliary actor.
The compelling contribution is a relatively simple way to make large imitation policies learn from their own failures, with substantial gains demonstrated on contact-rich real-robot tasks rather than only simulated benchmarks.
-
Context as an Environment: Programmatic Context Management for Long-Horizon Agents
Scroll manages long-horizon agent context as an executable persistent environment rather than repeatedly compressing history into fixed memories. It keeps a lossless event log and typed state in a sandboxed Python kernel, letting the model programmatically retrieve or transform past information and expose only a selected working view; reported results substantially outperform prior systems on three long-context benchmarks.
The key contribution is a promising shift from lossy, precomputed memory toward programmable, lossless context management, with large reported gains on long-horizon benchmarks, though the abstract does not establish robustness beyond those evaluations.
-
Singing and moving to the rhythm: song-entangled gestures in a vocal learning songbird
This study reports that zebra finches produce head gestures rhythmically aligned with their learned song, rather than merely performing fixed courtship displays. The gestures develop during vocal-learning, depend on auditory feedback and a premotor song nucleus, can change with social context, and affect female responses when timing is disrupted, providing a potentially useful animal model of coordinated vocal and bodily communication.
It identifies a previously unestablished vocal-learning model for dynamically coordinated vocal and gestural behavior and links that behavior to development, neural control, feedback, and social perception, though the abstract gives limited quantitative evidence.
-
Tomatoes, Potatoes, and Onions: Questioning the Need for Faces in Face Presentation Attack Detection
The paper tests whether face presentation-attack detectors really need facial content by training on print and replay recordings of tomatoes, potatoes, and onions. A detector trained only on this face-free data reaches 92.70% average AUC across four cross-dataset face-PAD benchmarks, transfers in the reverse direction as well, and improves face-PAD training when added as complementary data; analyses suggest it learns cues from the presentation process rather than object identity.
It challenges the face-specific formulation of PAD with a controlled cross-object experiment and a substantial transfer result, though the claims still need scrutiny for protocol or capture-artifact confounds.
-
Whose Gold? Annotator-Pool Disagreement Is Large at the Item Level, and Hidden by Small Leaderboards
The paper tests how much preference-benchmark conclusions depend on which annotator pool supplies the labels. Expert and crowd pools disagree on roughly 24–31% of unanimously labeled items, yet produce identical six-model leaderboards; simulations and bootstrap analyses show that this apparent stability is fragile, especially as the number of models grows, while an LLM judge follows the crowd judgments rather than the experts. The main contribution is separating leaderboard stability from item-level label reliability and quantifying how misleading small leaderboards can be.
It presents substantial, quantified evidence that identical preference leaderboards can conceal large annotator-dependent disagreements, directly challenging a common interpretation of benchmark robustness.
-
Beyond receptive fields: sequence-pooled normalization can supply most of a sequence labeler's context
The paper argues that sequence-wise normalization at inference creates a global information path, so a convolutional labeler can use sequence-wide statistics even when its nominal receptive field is short. On synthetic tasks and haplotype data, this global summary supplies much of the benefit of a larger receptive field when labels form long runs, while per-position normalization removes the effect; it also causes receptive-field ablations to overstate the importance of convolutional context by 8.3–16.1×.
This is a potentially important mechanistic correction to how receptive fields, streaming limits, and ablation studies are interpreted, supported by a Jacobian analysis plus controlled and real genomic experiments.
-
Readable, Faithful, Used: Three Dissociable Properties of Demographic Identity in a Language Model
This paper separates three questions about demographic identity in LLMs: whether it can be read out, whether its internal structure matches real survey differences, and whether the model actually uses it. Across many read-out locations and interventions, attention heads often encode survey-faithful group geometry—sometimes much better than the standard residual-stream readout—but causal use does not track fidelity, and a probe can improve aggregate predictions without recovering question-level group ordering.
The dissociation between readable, faithfully organized, and causally used demographic information is a sharp conceptual contribution, supported by broad localization, causal tests, controls, and cross-model replication rather than a simple probing result.
-
Phantom Gains: Auditing Self-Improvement Against a Measured Null
This paper shows that commonly used problem-level measures of LLM self-improvement can report gains and losses even when a frozen model undergoes the same training and evaluation pipeline. Across LoRA self-training experiments, it identifies seven such failures and proposes per-problem exact tests against pooled baseline replicates with false-discovery-rate control; these tests find no genuine changes in the frozen controls and suggest that apparent self-training advantages largely disappear once overall gain and measurement noise are accounted for.
It challenges a widely used way of measuring self-improvement with a concrete measured-null audit, showing that several intuitive transition statistics can manufacture capability changes and that distillation/self-training asymmetries may be confounded by total improvement.
-
When Graph-JEPA Learns the Wrong Thing: Diagnosing and Repairing Category-Conditional Collapse
The paper shows that a Graph-JEPA representation can look healthy under linear probing and effective-rank diagnostics while encoding essentially no instance-level information. It identifies variance allocation and the coupled predictor/EMA-target objective as the cause, proposes a repair that restores near-ceiling retrieval, and then shows that the repaired metric can still look excellent on a structurally reducible, non-reasoning target. The authors provide audits for collapse, target reducibility, and target quality, backed by controlled ablations on a 57,903-article graph corpus.
This is a sharp and practically important warning that standard representation-health checks can certify a globally degenerate solution, complemented by quantitative causal diagnosis and reusable evaluation audits rather than a mere benchmark result.
-
Event-Time Confounding Under Bursty Human Dynamics
The paper shows that event-aligned analyses of user behavior can mistake continuation of an already-bursty task episode for an effect of the event itself. Across web domains, including AI use, activity often peaks before the event; known-null timestamps reproduce 56% of the apparent post-event excess at active moments, while the effect disappears during quiet moments. It formalizes why within-user controls and coarse activity matching can fail, and provides diagnostics, benchmarks, and an audit tool for comparing similar episodes with and without the event.
This directly challenges a common causal interpretation of interaction logs, with a particularly convincing known-null test showing that much of an apparent AI-event effect can arise without any causal event.
-
A survey detection channel overrides the pixels in an astronomical foundation model, and biases tomographic mean redshifts
This audit finds that AION-1, an astronomy foundation model trained on images plus catalogue metadata, often relies on the survey’s segmentation/detection channel rather than the underlying pixels. Changing only that channel substantially alters predicted fluxes, shapes, and redshifts, and realistic catalogue misses could bias tomographic mean redshifts enough to exceed LSST requirements; removing the channel avoids the effect without measurable performance loss.
The paper identifies a striking, causally demonstrated shortcut in a large multimodal scientific model, with quantified downstream cosmology consequences and a simple mitigation.
-
Semantics or Structure? Auditing Text Sensitivity in Multimodal Time-Series Forecasting
The paper tests whether multimodal forecasting models actually use the meaning of accompanying text, rather than merely benefiting from other inputs or artifacts. Replacing text with empty, constant, shuffled, or unrelated real text changes MSE by under 0.5% across three architectures; the reported multimodal gains reappear when a co-shipped numeric column is removed, implicating that column rather than text. The authors release a reusable perturbation and evaluation toolkit.
This is a consequential audit showing that published multimodal forecasting gains may be incorrectly attributed to semantic text, with controlled perturbations pointing to a benchmark/input artifact instead.
-
Brain alignment in deep neural networks emerges early and independently of object classification
The authors track three CNNs through training and compare their representations with human fMRI and EEG signals plus macaque electrophysiology. Brain alignment is already mostly present at random initialization and saturates after only 1–5 epochs, while object-classification accuracy keeps improving; lesion analyses also show that features important for alignment are largely unrelated to those important for classification.
This directly challenges the assumption that brain-like neural representations arise because networks learn human-like object-recognition solutions, suggesting alignment may instead reflect shared visual-environment structure and changing how model-brain comparisons should be interpreted.
-
FreeToken: Efficient Edge-Native MoE Serving with Bandwidth-Adaptive Execution
FreeToken is an edge-serving system for mixture-of-experts models that dynamically places experts, model state, and execution across CPU, GPU, storage, and memory according to changing agent workloads and hardware constraints. It reportedly supports over 20 MoE models and makes models as large as 35B usable on an 8GB laptop GPU, 284B on a gaming desktop, and 753B on a single workstation GPU, but the abstract gives no latency, throughput, or quality comparisons.
The claimed ability to serve frontier-scale MoE models on ordinary personal hardware is potentially important, but the abstract lacks the performance and usability measurements needed to distinguish practical deployment from technically loading or slowly executing the models.
-
Zetta $ζ$: An Efficient Closed-Loop Embodied Harness for Self-Evolving Physical Intelligence
Zetta adds a closed-loop supervisory layer around a frozen base policy: fast runtime critics govern actions, while slower loops propose, validate, and update recovery skills and critics from robot rollouts. On LIBERO-Pro and RoboCasa it reports 90.8% and 93.6% success, an 11.1× inference speedup, continued improvement with self-exploration, and zero-shot skill transfer.
The potentially important idea is online, action-frequency governance and validated skill evolution without changing the base policy, but the abstract gives limited detail about baselines, task breadth, and how much of the gains come from infrastructure or benchmark-specific engineering.
-
Differentiable Voronoi Ray Tracing Beyond Rasterization Speeds
The paper presents VoroTracing, a differentiable Voronoi-based ray renderer co-designed with a compact scene representation and GPU traversal strategy. On Mip-NeRF 360 it reportedly reaches 623 FPS on an RTX 5090—2.8× the throughput of 3D Gaussian Splatting and 3.2× the fastest prior ray-based method—while supporting fisheye, rolling shutter, motion blur, and depth of field through the same ray-based pipeline.
If the throughput and quality comparisons hold beyond the single reported benchmark, this challenges the assumption that flexible ray-based novel-view rendering must be slower than rasterized methods, while adding effects that typically require specialized rasterization.
-
The Blending Ratio Is Not Where the Performance Is: Diagnosing Prototype Blending for Few-Shot Adaptation of Vision-Language Models
This paper analyzes few-shot adaptation methods that blend zero-shot text prototypes with labeled image prototypes, deriving a James–Stein-style coefficient that minimizes prototype error. Across 4,800 experimental cells, it finds that this theoretically optimal coefficient is usually optimizing the wrong objective because much of the text–image offset cancels during classification; leave-one-out estimates the task-relevant blend well, but simple validation-free linear probes outperform even an oracle-tuned blend. The main conclusion is that tuning the blend ratio is not the real bottleneck—the prototype-blending model class is.
The paper combines a useful theoretical diagnosis with unusually broad evidence showing that a standard bias–variance rationale optimizes the wrong quantity and that the real ceiling lies in the adaptation class rather than its tuning hyperparameter.
-
Cortical encoding of probabilistic temporal predictions during speech perception
The authors show that speech onset timing contains context-dependent probabilistic structure beyond average rhythm or hazard rates: recurrent neural networks predict phoneme, syllable, and word onsets better than simpler timing models. Intracranial recordings from 53 patients and 7,698 electrodes indicate that these model-derived timing predictions explain neural activity beyond acoustic and linguistic content, recruit a distributed temporal–frontal–sensorimotor network, and are represented by largely distinct neural populations.
This combines unusually large-scale intracranial evidence with a meaningful challenge to the view that speech timing is adequately characterized by fixed rhythmic rates, showing dynamic probabilistic timing predictions that are neurally dissociable from linguistic content.
-
Co-RL: Unsupervised Reasoning Emerges from Diverse Cohort in Multi-agent RL
Co-RL trains several independently parameterized language or vision-language models using reward signals derived from their peers, rather than ground-truth labels. The authors argue that diversity across model families, sizes, and prompt paraphrases reduces correlated errors and feedback-loop collapse, yielding 3.0–8.6% gains on seven text benchmarks and 2.3–7.2% on four multimodal benchmarks, sometimes matching supervised RL.
Peer-based unsupervised RL with deliberately heterogeneous cohorts is a potentially useful alternative to verifiable rewards, but the abstract does not establish how much of the gain comes from known ensemble or self-training effects, nor provide enough experimental detail for a strong recommendation.
-
MemTrapBench: Benchmarking Cognitive Traps in LLM Memory Use
MemTrapBench evaluates a failure mode that standard LLM-memory benchmarks miss: retrieved memories can be relevant and accurately recorded yet still bias current reasoning through fixation or belief distortion. Across two model families and five memory systems, every tested strategy reportedly performed worse than using no memory, with the best systems dropping by over 10%; the authors also propose an inference-time instruction method, AdaptiveMem, to reduce these failures.
The potentially important result is that adding long-term memory can systematically harm reasoning despite correct retrieval, but the benchmark is work in progress and the abstract provides limited quantitative or task-level evidence.
-
ALPS: Measuring Valid Creativity in Large Language Models with Mathematical Construction
ALPS evaluates whether language models can produce genuinely new, verifiably correct mathematical solutions, rather than merely plausible or memorized outputs. It generates fresh equational laws requiring either a proof of impossibility or construction of a satisfying infinite structure, and finds that automated provers solve only 2.2% of cases while the strongest tested reasoning model solves 14% of proof tasks and none of the construction tasks.
The benchmark isolates a meaningful form of machine creativity with automated originality and correctness checks, and its stark construction-versus-proof capability gap suggests current reasoning models lack methods for inventing tailored mathematical structures rather than merely searching harder.
-
Coverage Is Not Containment: A Fundamental Limit of Admission-Time Defenses Against Coordinated Poisoning of Vector Retrieval
The paper constructs a coordinated poisoning attack in which a small set of individually normal-looking documents jointly captures a target query’s top-k vector-retrieval results. On BGE-large/BEIR, 10 injected documents reportedly achieve full top-10 takeover and cause Qwen2.5-7B to produce the planted claim for 88% of targets; the authors argue that ingestion-only defenses cannot distinguish this attack from legitimate niche content, while a retrieval-time detector using query demand catches all attacks at the same reported false-positive rate.
The combination of a geometric impossibility result with an end-to-end, high-success poisoning attack challenges the assumption that vector-store admission filters can provide containment, and points to retrieval-time demand-aware defenses instead.
-
Decorrelation Is Not Complementarity: Skill, Not Lineage, Governs Trusted-Monitor Ensembles
This study tests whether trusted-monitor ensembles benefit from low correlation because their models come from different pretraining lineages. Across 24 monitors and six attacker models, it finds that raw decorrelation is nearly uninformative: shared detection skill and idiosyncratic errors cancel in the usual agreement metric, while monitor skill—not lineage—predicts useful ensemble behavior; selecting the best monitor generally beats correlation-weighted panel selection.
It directly challenges a common scalable-oversight heuristic with broad empirical evidence, identifies the cancellation mechanism behind its failure, and suggests that investing in stronger monitors may matter more than manufacturing lineage diversity.
-
Physics of Agents: Statistical Mechanics Predicts Collective Behavior of AI Agents
The paper studies more than 10,000 communities of language-model agents that repeatedly exchange messages and revise opinions on math questions and political statements. It finds three recurring collective regimes—indifference, polarization, and consensus—and develops a statistical-mechanics model that predicts individual opinion trajectories and group-level outcomes, including generalization to unseen interaction graphs. The model suggests that low effective social temperature drives conviction, attractive interactions favor consensus, and agents with correct answers exert the strongest influence; political discussions, meanwhile, tend to drift rightward.
This is a potentially important move from describing multi-agent LLM behavior to a compact, predictive theory of collective dynamics, supported by unusually large-scale simulations and several non-obvious findings, especially systematic political drift and truth-weighted influence.
-
Toward Better Assessment of LLMs' Performance in Clinical Error Detection
The paper argues that clinical error-detection benchmarks should evaluate whether an LLM distinguishes an erroneous note from its clean counterpart, rather than scoring each note independently. Across 15 models, four test sets, and three languages, 13 models performed worse than random on this paired discrimination task despite moderate F1 scores; the authors also show that language-dependent bias and evidence/verdict mismatches explain much of the failure.
It presents a concrete and broadly relevant evaluation failure: standard F1 can rank models highly even when they cannot reliably distinguish corrupted clinical notes from clean ones, with substantial cross-language bias evidence across many models and datasets.
-
Neurosymbolic Embodied Agents
The paper combines a vision-language model for task-relevant visual exploration with symbolic state construction, constrained PDDL-based action generation, and Monte Carlo tree search. On VirtualHome and ALFWorld, open 4B–27B models reportedly exceed 90% success, with the smallest system outperforming a 27B direct visual policy while using fewer tokens and images; combining constraints with search is much more effective than either alone.
It presents a credible route to making long-horizon embodied agents reliably executable and reports a striking combination of high success, smaller models, and substantially lower interaction cost, though the result depends on the quality of visual grounding and benchmark transition models.
-
Breaking Planner Integrity Boundary: Enviroment State-Text Injection Attack on LLM-Driven Embodied Agents
The paper introduces Environment State-Text Injection (ESTI), an attack that inserts false but seemingly plausible object properties, spatial relations, affordances, or task-stage information into the textual environment state consumed by an LLM-driven embodied agent. Across VirtualHome, RLBench, and iTHOR, the attack reportedly raises planning-level attack success by up to 89.32% and execution-level success by up to 43.69% over several baselines, showing that deceptive state descriptions can propagate into real task changes without altering the user prompt, model, or executor.
This identifies and evaluates a distinct, practically important attack surface at the planner-to-executor interface, with closed-loop execution results across multiple embodied-agent stacks rather than only demonstrating plan corruption.
-
What Do Compliance Detectors Read? An Audit of Activation Probes and Guard Models
The paper tests whether compliance guards and activation probes actually condition their judgments on the governing rule, rather than merely recognizing scenario-level surface cues. Across several guards, probes, benchmarks, and a purpose-built crossed-rule test, changing or removing the rule usually leaves predictions unchanged; the proposed training-free Internal Compliance Score does not beat trivial bag-of-words baselines, although it offers a cheap way to audit deployed systems and can improve response ranking until an adaptive attack defeats it.
It presents a concrete, counterfactual failure mode—rule blindness—that undermines a common assumption about compliance monitoring, supports it across multiple detectors and benchmarks, and is unusually candid that its own proposed probe fails the preregistered test.
-
A decodability criterion predicts when hidden-state selection beats majority voting in large language models
The paper introduces CASE, which selects among multiple sampled LLM answers using a linear score read from answer-token hidden states, rather than majority voting. Its key contribution is a leakage-free “decodability” measure that estimates whether this hidden-state signal can rank correct candidates above incorrect ones; this measure predicts when selection will beat voting (r=0.75), with reported gains of up to 19 percentage points and transfer to an unseen scientific domain.
The combination of a practical alternative to voting, a diagnosis of question-identity leakage, and a measurable criterion for choosing between aggregation methods—backed by large reported gains and cross-domain transfer—looks substantially more useful than a routine decoding tweak.
-
Decomposition Attacks Across Unlinkable Identities: Limits of Stateful Defenses for LLM Services
This paper studies whether LLM providers can detect harmful tasks that are decomposed across requests made from unlinkable identities, with the answers combined outside the service. It shows that stateful defenses work only when benign requests can be reliably grouped, while fresh indistinguishable identities and retry feedback eliminate a useful security–utility operating point; experiments on 91 executable tasks and 11,393 benign requests support the result.
The paper identifies a fundamental limitation of stateful LLM safety monitoring—not merely a bypass—and connects a formal tradeoff to broad empirical failure, suggesting that identity linkage or control over answer use is necessary for robust defense.
-
The Model's Tell: Measuring Context-Leakage Attack Signals with Behavior Gauges
The paper proposes LeakGauge, a black-box-style probe that appends a short suffix to an LLM prompt and uses prefill token probabilities to estimate whether the model is likely to reveal confidential system or retrieved context. Across 11 very large models, it reports AUROC 0.944–0.996 on unseen attacks, with robustness to language changes and semantic rather than verbatim leakage; activation steering suggests the signal corresponds to an internal leakage-related representation. The resulting detector adds fewer than 0.5K parameters and about 10 ms latency.
The combination of an accessible behavioral signal, strong cross-model and cross-attack results, and evidence linking it to an internal representation makes this more than a routine jailbreak detector, though adaptive-attacker and probability-access assumptions need scrutiny.
-
An Omitted Mode Is a Rare Rule: The Sampling-Verification Danger Law in Continuous Code World Models
This paper analyzes when validating an executable world model on sampled transitions fails to detect rare but consequential modes. It gives an exact miss-probability law, proves that smooth models require a detectable neighborhood while discontinuous reset rules may not, and shows experimentally that planners exploit omitted boundary rules: GPT-5.x often repairs simple 1D omissions but fails on 2D rules, while independent rescoring finds that accepted models cover only about 2% of the planner’s exploited queries.
The combination of a precise statistical failure law, discontinuity-specific identifiability result, and large-scale LLM/world-model evidence directly challenges the assumption that sample-consistent code models are safe to plan against.
-
The IOL-AI Challenge: An Open Challenge towards Advancing Linguistic Reasoning
The paper evaluates LLMs on unseen International Linguistics Olympiad problems, where models must infer an unfamiliar language system before solving it, using both automatic scoring and official human jury judgments. Claude Opus 4.8 reached roughly gold-medal performance, while constrained systems performed near the bottom; notably, some 14B models beat models more than twice their size, with improvements attributed mainly to decoding and answer formatting rather than parameter count. The jury and automatic rankings agreed, but automatic scores compressed performance and overstated weak systems.
It offers a demanding, relatively uncontaminated test of system-discovery reasoning and reports a potentially important result that inference strategy and output handling mattered more than scale under tight compute limits, backed by a large competition and official jury evaluation.
-
ClosureBench: A Constructive Benchmark for Compositional Graph Reasoning
ClosureBench generates fresh graph-reasoning problems with executable, verified answers, varying graph size, density, and compositional depth. Evaluations find that models degrade mainly because they construct the wrong graph from the input, and that a 4B model trained to produce executable Ein or Python programs reaches 94.3% on held-out instances with nearly flat performance across composition levels and much lower token cost. The benchmark also exposes a 19.3-point seen-versus-fresh gap after fine-tuning, which static test sets would miss.
The combination of contamination-resistant, on-demand evaluation and evidence that small models can largely close the compositional-reasoning gap through verified program synthesis is a substantive and potentially reusable result.
-
How AI Prompts Can Teach Us About the Structure of Human Behavior
The paper uses a language model as a controllable behavioral simulator: prompting it with profiles such as risk aversion or trust, then selecting the profiles that best reproduce human choices across economic games. Using 119,147 decisions from 78,657 people in 35+ countries, it reports that three dimensions—risk aversion, strategic sophistication, and trust—closely match behavior, with fewer than a dozen recurring individual types that generalize to held-out games.
The potentially important result is that an LLM-mediated, low-dimensional representation of human preferences appears portable across substantially different behavioral tasks, offering a new empirical route to parsimonious theories of behavior, though the interpretation of prompted LLM profiles as human traits needs careful validation.
-
Algorithms for adaptive and heteroskedastic linear regression at the computational threshold
This paper develops efficient estimators for linear regression when label noise varies substantially across samples or comes from an unknown distribution. It gives a polynomial-time method that can achieve vanishing error with as few as roughly n^{1/4} reliable samples in fixed dimension, improving over the n^{1/2} requirement of standard robust methods, and provides nearly matching lower bounds; it also proposes adaptive estimators and an SQ-based computational-hardness picture.
The combination of a substantially better computational threshold for exploiting unknown label quality and evidence for a statistical–computational gap makes this more than an incremental regression-method paper, although the central planted-regression gap remains conjectural.
-
A single design choice determines whether machine learning models of materials make physically impossible predictions
The paper argues that explicitly tagging features with parity under inversion determines whether a materials ML model can enforce exact symmetry-forbidden outputs. In matched experiments on 2,000 centrosymmetric crystals, parity-aware models predict the necessarily zero piezoelectric tensor at floating-point precision, whereas rotation-equivariant models produce nonzero forbidden responses for 90–96% of crystals, with a six-order-of-magnitude gap; fitting explicit zeros does not fix the issue.
It identifies a simple, apparently underreported architectural choice that separates physically impossible predictions from exact symmetry compliance, with broad matched experiments and a group-theoretic diagnostic rather than merely a benchmark gain.
-
Forgetting, plasticity, and co-observation: a third facet of continual learning
The paper argues that continual learning has a third problem beyond catastrophic forgetting and loss of plasticity: models perform better when they can observe training examples from different chunks together. Across supervised and self-supervised chunked-data settings, the authors report a persistent gap between joint and sequential training even after controlling for forgetting and plasticity, and interpret replay as partly restoring this co-observation benefit rather than merely preserving knowledge.
This is a potentially important reframing of continual learning that separates representation/generalization benefits from forgetting, and could change how replay and other continual-learning methods are understood.
-
Test-Time Scaling in the Wild: Why Exploitation, Not Exploration, Is the Bottleneck
The paper evaluates five test-time scaling strategies across open-ended tasks in medicine, law, finance, chat, and creative writing, separating generating diverse candidates from selecting or combining them. It finds that candidate quality keeps improving with more compute, but current reward models select poorly (quality correlation around 0.12), while tree search can collapse diversity; only multi-candidate synthesis consistently helps, recovering about 40% of the available quality.
The exploitation-versus-exploration diagnosis is a useful and potentially important reframing of test-time scaling, supported by a broad compute-normalized comparison and a striking result that selection—not candidate generation—is the limiting factor in open-ended tasks.
-
Outcome Monitors: Recovery Affordances for Silent Tool Failures
The paper adds monitors that check whether tool outputs satisfy expected outcome properties, catching plausible-looking failures such as cached error pages or invalid prices rather than only explicit timeouts. When a violation is detected, the monitor returns the result plus a receipt listing recovery tools; this substantially improves completion in injected-failure ToolMaze tests (10.9% to 28.1%) and by 12–14 points in tau-bench retail. The gains depend on providing recovery tools, while detection is much weaker for failures outside the mined contract vocabulary.
This is a useful reliability framing for tool-using agents, backed by sizable controlled gains and ablations, though its dependence on known outcome contracts limits generality.
-
DeltaMomentum: A Key-Value based Anisotropic Momentum Update via Delta Rule
DeltaMomentum replaces the usual scalar-rate exponential moving average with a key-value delta-rule update that forgets each input direction according to how often it is seen, while avoiding explicit matrix inversion or persistent memory. The authors prove curvature-correction and stale-direction tracking properties, and report that DeltaAdamW matches AdamW’s validation loss in 22–46% fewer steps across 67M–370M language models, with gains also on 1B-scale training, SGD, ResNet-18, and ViT-Tiny.
This is a genuinely different optimizer update motivated by the key-value structure of linear-layer gradients, with theoretically predicted behavior and unusually large, cross-architecture efficiency gains rather than a minor benchmark improvement.
-
LF-GICP: Parameter-Free Degeneracy-Aware LiDAR Odometry via a Voxel-Normal Localizability Field
The paper introduces a parameter-free way to detect and handle geometric degeneracy in scan-to-map LiDAR odometry. It argues that covariance regularization can make the Gauss–Newton Hessian falsely suggest that translation is observable, and instead uses voxel-normal statistics to distinguish missing information from merely diluted information, triggering correspondence reweighting; experiments report improved results across KITTI, tunnel environments, MulRan, HeLiPR, and four LiDAR types without retuning.
The combination of an apparently important observability failure in voxelized GICP with a calibration-free degeneracy detector that transfers across environments and sensors is a substantive contribution, especially if the broad baseline comparisons hold up.
-
Time-Uniform Self-Normalized Concentration for Discounted Least Squares: Limits and Corrections
This paper refutes a commonly used time-uniform concentration bound for discounted least-squares estimators, using a scalar Gaussian counterexample where the purported bounded confidence radius is eventually crossed with probability one. It explains that the proof incorrectly treats fixed-time Gaussian mixtures as a single supermartingale, establishes a lower bound showing that valid anytime boundaries must grow like $R\sqrt{\log(T/\delta)}$, and provides corrected finite- and infinite-horizon results.
It identifies a potentially fatal error in a standard tool for bandit and RL theory and replaces the invalid claim with an impossibility result and valid corrections, with an explicit counterexample and asymptotic lower bound.
-
Credit Without Ground Truth: Auditing Step-Level Credit Assignment in LLM Agents Against Executed Replay
This paper evaluates step-level credit signals for LLM agents against a stronger ground truth: replaying the agent’s own alternative actions and measuring their effect on the final outcome. In ALFWorld, LLM judges, logprob-based signals, and confidence largely fail to identify causally pivotal steps; apparent training differences are instead explained by unequal effective training dose, while confidence can reduce judging cost but not find pivotal steps.
The paper introduces a more causally relevant audit of agent credit assignment and provides preregistered evidence that commonly used signals may measure fluency or data quantity rather than actual step contribution, although the main experiments are limited to one environment.
-
Write Once, Run Everywhere: The Axon DSL for Shape-Safe and Framework-Agnostic LLM Architectures
Axon is a strongly typed DSL for specifying LLM architectures once and compiling them to multiple training and inference stacks, including PyTorch, JAX, MLX, Triton, and vLLM. Across 467 inference experiments from 135M to 32B parameters, it reports substantial median speedups over Transformers implementations—especially on JAX and MLX—and a 58% median gain when using native vLLM execution with paged attention and KV caching.
A framework-independent, shape-safe compilation layer addressing real portability and optimization lock-in would be broadly useful, and the reported speedups are large enough to warrant checking the benchmark methodology and compiler limitations.
-
Learning Early-to-Final Solution Consistency for MILP Acceleration
The paper uses cheap early-stage MILP solutions as supervision: instead of predicting a complete solution from the instance alone, it predicts which early variable assignments will remain unchanged after a long solver search. These consistency predictions can guide variable fixing or other downstream search, and ensembling several early solutions improves robustness; across four benchmarks it reports a 56.9% average primal-gap reduction with Gurobi, complete closure on combinatorial auction instances, and a 36.4% gap reduction when transferred zero-shot to SCIP.
The solver-informed consistency target is a meaningful shift from static solution prediction, and the large reported gains plus zero-shot transfer across solver implementations suggest a potentially general way to combine learning with search rather than a minor model tweak.
-
Wrong-Physics Backdoors in Neural PDE Operators
The paper presents a data-poisoning attack on neural PDE operators where a trigger causes the model to output a physically valid solution corresponding to the wrong PDE parameter. Across 476 campaigns on four PDE families and several operator architectures, the attack reportedly achieves perfect backdoor success on advection-diffusion and 2D Navier–Stokes while preserving low clean error, showing that generic physical plausibility checks can miss targeted parameter errors.
The combination of a distinctive wrong-physics attack, broad experiments, and high success despite clean validation exposes a consequential and underappreciated security gap in scientific machine learning.
-
Open-Weight Masked Introspection: Measuring What Language Models Can Report About Their Own Computation
The paper tests whether open-weight language models can detect and verbally report interventions made to their own internal computation. Across eight models and more than 78,000 trials, ordinary prompting performs at chance against strong sham and matched-random controls, despite probes and a specially fine-tuned model recovering the intervention signal from the activations; one model exposes the signal only through confidence. OWMI is released as a framework for measuring this capability.
It provides a broad, controlled negative result suggesting that internal information being present in a model does not imply the model can route it into honest verbal self-reports, with direct implications for AI oversight and mechanistic interpretability.
-
Vis-Poison: Poisoning Visual Knowledge in Multimodal Retrieval-Augmented Generation
The paper introduces a poisoning attack for multimodal RAG in which the attacker inserts visually crafted images that manipulate retrieval and generation, without changing captions, metadata, or other text. Across two pipelines, four embedding models, and six generators, the attack reportedly reaches 40.16–65.40% end-to-end success on 30,000-entry knowledge bases, including over 60% against models that already know the correct answer parametrically.
It exposes a substantial and relatively underexplored security failure mode—image-only poisoning of multimodal RAG—with high attack success across multiple model and pipeline choices rather than a narrow proof of concept.
-
GAP-SAM: A Global Artifact Prior for Generalizable AI-Generated Image Manipulation Localization
The paper studies why image-manipulation localization generalizes poorly across generators and datasets, identifying dataset-specific mask geometry and a “boundary adhesion” failure where segmenters follow object contours instead of edit boundaries. GAP-SAM adds a global artifact token derived from an image and its frozen VAE reconstruction to SAM3’s dense decoder; across six datasets it reportedly improves Pixel-F1 to 79.8, 12.6 points above the prior best, and is more robust to compression, blur, and resizing.
The combination of a useful failure analysis, a nonlocal artifact-conditioning mechanism, and a large cross-dataset gain addresses a central weakness of manipulation localization rather than merely improving an in-distribution benchmark.
-
Triangulation-Free Bundle Adjustment with Graduated Non-Convexity for Camera Pose Refinement from Coarse Priors
The paper replaces triangulated 3D structure in pose refinement with per-feature ray depths optimized jointly with camera poses, so erroneous structure is not locked in by the initial pose prior. Combined with graduated non-convexity, the method preserves accurate ARKit poses, improves object-scale pose accuracy at roughly 10 seconds on one CPU, and remains recoverable under much larger pose perturbations than conventional bundle adjustment.
The combination of triangulation-free structure parameterization and robust continuation appears to deliver a practically important failure-mode reduction—recovering from errors up to 16 degrees reliably and often 32 degrees—while being dramatically cheaper than a learned refiner.
-
The geometry of AI validation: Exact certification limits for iid best-of-N search
This paper develops an exact theory of how much validation can tell us about iid best-of-N selection. It shows that repeatedly measuring reliability at small search sizes mainly reduces sampling noise, while uncertainty about unseen intervention directions can remain large: the ambiguity stays around 0.83 when the audit range is only proportional to sqrt(N), and shrinking it to ε requires a range of roughly sqrt(N log(1/ε)). It also derives optimality and approximation bounds and illustrates the resulting two-stage audit strategy on math-reasoning and code-selection studies.
The paper gives unusually sharp, exact limits showing that conventional replication-style audits can be structurally blind for best-of-N systems, with a nontrivial square-root scaling law and explicit worst-case constructions rather than just empirical warnings.
-
Utility Under Attack: Agent Memory Poisoning and the Limits of Content Screening and Provenance Ranking
The paper studies how easily persistent agent memory can be poisoned and how well content screening and provenance-aware retrieval defend against it. Injecting false statements into just 1.2% of a LongMemEval corpus drops accuracy from 0.850 to 0.300; screening catches indirect prompt injection but rejects none of the poisoned memories, while stronger provenance weighting protects against poison only by also suppressing legitimate untrusted evidence. The authors argue that additive provenance penalties are inadequate and propose bounded occupancy constraints at retrieval instead.
The striking result is that very sparse, ordinary false statements evade strong content screening and can devastate memory-based agent accuracy, while provenance weighting creates a fundamental tradeoff between resisting poison and retrieving useful evidence.
-
Move by Move: Measuring and Steering How LLMs Conduct Psychotherapy
The paper defines and validates a ten-category ontology for the therapeutic moves used in psychotherapy conversations, then uses it to compare human clinicians with frontier LLMs. It finds that models ask questions much more often than clinicians, underuse psychoeducation, and tend to follow therapeutic strategies introduced by humans rather than initiate them; providing the move categories as tools substantially improves alignment without fine-tuning.
It combines an interpretable behavioral analysis with a practical, training-free steering method, and the finding that models are context-anchored rather than independently selecting therapeutic strategies is both non-obvious and potentially important for safety and control.
-
The Plan, Not the Decoder: Diagnosing and Repairing Compositional Failure in Reasoning-Augmented Text-to-Image Generation
This paper separates compositional failures in reasoning-augmented text-to-image models into planning errors versus decoder execution errors by editing the model’s explicit object-and-box plan. Controlled interventions show that the decoder usually follows the plan faithfully, while the planner makes phrasing-dependent relation errors and produces cluttered geometry; repairing box geometry improves accuracy by 10.7 points without retraining. It also exposes a failure of common VQA-based spatial evaluation and releases plans, images, and an evaluation protocol.
The causal planner-versus-decoder diagnosis, metric validation, and substantial no-retraining gains from targeted plan repair provide a useful and relatively general framework for improving compositional text-to-image generation.
-
ReMAP: Self-supervised learning to unveil brain representations and vulnerability
ReMAP uses similarity-based self-supervised learning on raw two-electrode frontal EEG during general anesthesia to represent each patient’s trajectory through brain states, rather than reducing anesthesia to a single depth score. Across more than 1,000 patients and two acquisition systems, a small 68k-parameter model predicts BIS well, separates age and established EEG signatures, and—on an independent longitudinal cohort—uses early trajectory geometry to predict 30-month cognitive and mortality outcomes (AUROC 0.86) beyond age.
The potentially important contribution is showing that unsupervised geometry of anesthesia-induced brain-state trajectories, learned from a very sparse EEG montage, may reveal latent vulnerability and predict long-term outcomes rather than merely estimate anesthetic depth.
-
DELE-w0.5: Inferring Action from Future Latent State for Robotic Manipulation
DELE-w0.5 replaces video-generation-based world-action modeling with prediction of a compact future latent state, then infers the robot action needed to reach that state. The authors argue this avoids modeling visually redundant intermediate frames and report substantially better long-horizon manipulation performance on four real-robot tasks: 62.5% full-task success and 81.3% ordered-stage progress, with gains of 47.5 and 30.7 percentage points over the strongest baseline.
The paper proposes a meaningful alternative to video-centric world-action models and supports it with unusually large reported gains across 480 real-robot trials, although the abstract does not establish how strong or comparable the baselines are.
-
RAG Collapse: LLM Responses Collapse When Retrieved Documents Are Self-Authored
The paper studies what happens when an LLM’s retrieval system returns documents previously generated by that same system. Across three model families, 1,528 simulations, and 1,019 prompts, 79.6% reportedly entered a degraded “RAG collapse” state; notably, even one self-authored document could trigger the effect because models preferentially cite their own text despite comparable quality.
This identifies a potentially important and underappreciated failure mode for search-augmented LLMs, supported by unusually broad experiments and the surprising claim that a single self-authored reference can initiate collapse.
-
The Price of Decentralization in Top-$K$ Arm Identification
This paper studies how much extra data decentralized agents need to identify the best K joint actions when they cannot freely share actions or rewards. It proposes communication-free elimination algorithms for three observation regimes and claims matching lower bounds showing that full asymmetry costs a fixed 4× increase in sample complexity, while the dependence on the exponentially large joint-action space is unavoidable.
The potentially fundamental result is the quantified price of removing communication—a regime-independent multiplicative penalty, including a 4× lower-bound-matched cost under full asymmetry—rather than another algorithmic improvement.
-
Is Your Neighborhood Safe? Place-based Stigma in Large Language Models' Urban Safety Judgments
The authors test seven instruct-tuned LLMs on neighborhood safety using names alone, coordinates alone, or both, across 186 neighborhoods in Los Angeles and Chicago. Neighborhood names drive most of the models’ variation in safety judgments: they contain some real crime signal but also systematically lower ratings for areas with larger local marginalized populations, an effect that persists after controlling for crime and income in Los Angeles. The study also finds that removing names reduces demographic bias but loses useful geographic information, revealing a concrete accuracy–fairness tradeoff.
The controlled name-versus-coordinate design, cross-city/model replication, and crime-matched analyses provide unusually direct evidence that LLM urban judgments combine genuine geographic knowledge with place-based demographic stereotyping.
-
Invocation-Level Reliability of Tool-Using Agents
This paper studies tool-using agents at the level of individual tool calls, separating choosing the wrong tool from supplying wrong arguments in multi-step tasks. It finds that by depth 6, about 70% of clean-context capability is lost after agents make their own earlier mistakes, but more importantly shows that exact-match scoring against a fixed gold trajectory makes post-error severity and recovery parameters partly predetermined and unable to measure genuine recovery. The authors propose conditional-on-state scoring, which can be applied to existing completions and yields non-boundary estimates without additional inference cost.
The paper identifies a potentially fundamental evaluation error in tool-agent reliability metrics—treating recovery as impossible because the gold trajectory contains information unavailable after divergence—and offers a practical correction supported by multi-model, multi-step analysis.
-
VISTA: Test-Time Compositional Alignment for Visual Autoregressive Generation
VISTA performs gradient-based test-time optimization of intermediate states during visual autoregressive image generation, steering a frozen model toward correct attribute bindings and spatial relations without retraining. On two benchmarks and two model sizes, it improves targeted compositional scores by about 20% for a 2B model and 6% for an 8B model while preserving image quality; the 2B system reportedly exceeds the compositional performance of a model four times larger.
This introduces a previously missing test-time alignment approach for stateful next-scale autoregressive generation, with unusually large compositional gains and evidence that inference-time optimization can recover part of the advantage of much larger models.
-
Replicable Conformal Prediction
This paper studies how to make conformal prediction outputs reproducible across independent calibration datasets, rather than merely statistically valid. It proposes shared randomness plus coarse threshold rounding to make deployed classifiers identical with controllable probability, derives matching cost lower bounds, and shows that replicability also limits selective recalibration attacks; experiments cover ImageNet, multiple hospitals, and language models.
The paper identifies an important but largely overlooked deployment problem—calibration instability—and appears to provide both a practical solution and optimality results, including a connection to robustness against recalibration-based gaming.
-
CONTRAMEM: Learning Self-Evolving Procedural Memory from Contrasting Multi-Model Trajectories
CONTRAMEM builds procedural memory for computer-use agents by comparing successful and failed trajectories from multiple models, then distilling useful differences into editable app-level and task-level cards. It reports roughly doubling success on GAIA2/ARE (26.2% to 55.3%), gains across several source models, transfer to an unseen Qwen model, and further improvements on AppWorld; heterogeneous model trajectories outperform matched self-rollouts.
The combination of contrastive multi-model supervision, localized self-evolving memory, and substantial cross-model transfer addresses a central weakness of long-horizon computer-use agents, with unusually large gains across multiple benchmarks and models.
-
Optogenetic activation of parabrachial tachykinin1 neurons drives nonphotic circadian entrainment
The study identifies a causal circuit for fear-induced, non-light-based circadian entrainment: stimulating Tac1-expressing neurons in the parabrachial nucleus during nighttime foraging switches the animals’ activity-rest timing, similar to foot shocks. The effect is partly mediated through projections to the central amygdala, and deleting the clock gene Bmal1 there abolishes fear entrainment, implicating a molecular clock outside the SCN.
It provides a relatively specific causal link from an aversive sensory circuit to behavioral circadian reorganization and shows that the central amygdala clock is necessary, challenging the SCN-centric view of entrainment.
-
The structural logic of insect olfactory receptor assembly and gating
Using cryo-EM, stoichiometry measurements, and functional tests, the authors show that insect odorant receptors can assemble as either 3:1 or 2:2 complexes of odorant receptor and Orco. Orco contains a ligand-like pocket blocked by a phospholipid, while the synthetic agonist VUAA4 acts at a separate membrane-accessible allosteric site; functional data indicate that multiple subunits must engage cooperatively for productive gating.
This provides a mechanistic structural explanation for how a conserved co-receptor both accommodates highly diverse odorant receptors and participates actively in cooperative gating, rather than serving merely as a scaffold.
-
Schwann cell p75NTR sustains persistent pain downstream to NGF through ROS-dependent TRPA1 signaling
The study shows that NGF-driven pain splits into two pathways: neuronal TrkA signaling produces acute pain and heat sensitivity, while Schwann-cell p75NTR signaling drives mechanical and cold hypersensitivity. In mice, this non-neuronal pathway involves calcium release, TRPA1 activation, mitochondrial ROS, and NOX1-dependent amplification, and disrupting it genetically or pharmacologically reduced persistent pain behaviors.
The paper identifies a specific Schwann-cell signaling circuit that explains modality-specific persistent pain and is supported by cell-specific genetic manipulations rather than only pharmacology.
-
The Movie After-Effect: widespread adaptation of human cortex following naturalistic sensory experience
The authors report that after watching naturalistic movie clips, activity during subsequent rest shifts in the opposite direction of each voxel’s recent movie activation: strongly activated voxels become suppressed while inactive voxels become relatively enhanced. This effect appeared across 218 of 251 stimulus-responsive cortical regions in 170 HCP participants, and the post-movie activity patterns identified which clip had just been watched, suggesting widespread homeostatic gain adaptation analogous to instance normalization in neural networks.
The striking result is evidence for a highly widespread, stimulus-specific after-effect following ordinary naturalistic viewing, offering a potentially important link between cortical homeostasis and normalization mechanisms in AI, although the fMRI data do not yet establish the underlying cellular mechanism.
-
Brain-wide reconfiguration of burst firing by psilocybin reveals 5-HT2A-dependent circuit dynamics
The authors recorded more than 46,000 neurons across multiple brain regions in mice during acute psilocybin exposure, alongside EEG and behavioral measures, and repeated the experiments with a 5-HT2A antagonist. Psilocybin mainly changed burst patterns rather than average firing rates, with decreases in hippocampal bursting and opposing effects across thalamic nuclei; most changes were blocked by ketanserin.
The combination of brain-wide single-unit recordings and receptor blockade supports a potentially important shift in how psychedelic-state dynamics are understood—from changes in firing rate to region-specific reconfiguration of burst coding.
-
A stimulus-state geometry in somatosensory cortex reorganizes during inflammatory pain
Using widefield and two-photon imaging plus causal S1 silencing in awake mice, the authors find that S1 population activity represents mechanical stimulus content along latent dimensions while also encoding movement, arousal, and facial responses. Inflammatory injury reorganizes this population geometry so stimulus information is more tightly coupled to protective behavioral state; notably, noxious heat mainly drives the state-related dimension, and silencing S1 reduces hypersensitivity and pain-related behaviors.
The combination of population-geometry analysis and causal manipulation suggests a nonstandard account of cortical pain coding in which injury reorganizes the binding of sensory content to coordinated protective state, rather than simply increasing stimulus responses.
-
Human parietal retrieval states prioritize an absent temporal reference to reconstruct event order
Using fMRI, the authors asked people to judge a target’s position in an event sequence relative to a milestone that was not shown during retrieval. Activity patterns in precuneus and angular gyrus resembled the absent milestone, while similarity to the encoded sequence linking milestone and target predicted correct judgments, suggesting that temporal-order memory reconstructs a relation or path rather than simply retrieving either item.
The paper provides a relatively direct neural test of reconstructive memory and reports that parietal retrieval is shaped more by the information required for the judgment—including an absent reference—than by the presented cue, with a reasonably large fMRI sample.
-
Incomplete cerebellar circuit restoration limits functional recovery following SMN therapy in severe spinal muscular atrophy
This study shows that severe SMA affects cerebellar development and circuitry, not just spinal motor neurons, with distinct cell-type-specific mechanisms across mouse models and human SMA Type 0/I tissue. AAV9-SMN only partly repaired cerebellar circuits, whereas systemic risdiplam restored cerebellar pathology, motor behavior, and survival in both models, suggesting that treatment must reach distributed supraspinal circuits as well as the spinal cord.
The paper provides convergent mouse and human evidence that incomplete cerebellar repair can limit SMA recovery and shows a striking divergence between two clinically relevant SMN-restoring therapies, implicating tissue/cell-type distribution as a key determinant of outcome.
-
A neurofunctional signature of romantic love predicts rewards on social media, effects of oxytocin and drug-cue reactivity
Across eight fMRI studies involving 420 people, the authors trained whole-brain patterns that distinguish romantic love from friendship. The romantic-love signature generalized to social-media rewards and was selectively enhanced by oxytocin, but not activated by monetary or sweet rewards; it also identified drug-cue responses in heavy cannabis users, suggesting overlap between bonding and addiction-related reward circuitry.
The combination of preregistered-style multistudy decoding, cross-context generalization to digital social reward, pharmacological selectivity, and an addiction link is an unusually broad attempt to establish a specific neural representation of romantic love rather than merely localizing reward activity.
-
A CK2α-G3BP1 signaling axis regulates local translation in developing neurons and is disrupted in OCNDS
The study links OCNDS-associated CK2 mutations to reduced phosphorylation of G3BP1, causing persistent stress granules that trap neuronal mRNAs and suppress local protein synthesis in axons and dendrites. The defects in neuronal growth, synapses, and network activity appear in mouse and patient-derived neurons, while reducing G3BP1 reverses the phenotypes across CK2 alleles.
It provides a coherent, multi-model mechanism connecting a pleiotropic disease kinase to compartment-specific neuronal translation and demonstrates rescue by targeting the downstream RNA-granule pathway.
-
REM Sleep Disengagement of β Oscillations Permits Rapid Dream Movements in Parkinsonism
In parkinsonian non-human primates, pathological beta activity and movement-related deficits were prominent during wakefulness and NREM sleep but were reduced during REM sleep. Beta suppression began before visible REM onset, suggesting that brain-state-dependent network reconfiguration temporarily restores access to rapid movement despite dopamine depletion; REM atonia normally prevents those movements from being expressed.
The paper offers a compelling mechanistic explanation for why Parkinsonian motor impairment is state-dependent, supported by coordinated eye-movement, cortical, and basal-ganglia recordings before and after experimental parkinsonism.
-
Long-term stability of cellular-resolution brain-computer interface recordings after stroke
The authors implanted four 64-channel microelectrode arrays in the hemisphere opposite a large stroke and recorded single-neuron activity over 111 sessions across 1,240 days. Neural unit yield, signal quality, and the identity of tracked neurons remained stable over years, suggesting that chronic cellular-resolution iBCIs may be feasible for people with stroke-related disabilities.
It provides unusually long-term, cellular-resolution human recording evidence for a major untapped iBCI population—chronic stroke—though the conclusion is limited by the single participant and contralateral implant locations.
-
4DAnyone: Create Anyone in 4D from a Casual Monocular Video
4DAnyone reconstructs dynamic 3D humans from a casual, uncalibrated monocular video by first generating many mutually consistent novel-view videos, then fitting a 4D Gaussian Splatting representation. Its main contribution is handling the limited attention context of video diffusion models: Reference Context Packing keeps conditioning compact, while Target Context Routing lets separately generated view groups exchange information. The authors report better novel-view quality and 4D reconstruction than prior methods, including on in-the-wild videos.
The combination of context compression and cross-group routing targets a real bottleneck in diffusion-based multiview generation and could enable a useful monocular-to-4D capability, but the abstract gives no quantitative gains and relies partly on an in-house synthetic dataset.
-
Thinking in a Low-Resource Language: What SFT Builds, What RL Fixes, What Accuracy Cannot See
The paper studies what happens when three mixture-of-experts models are fine-tuned to reason in Greek, finding that standard accuracy benchmarks largely miss the main changes: base models never expose Greek reasoning, while SFT produces Greek reasoning on about 98% of examples with little loss in general ability and sometimes fewer tokens. It also shows that SFT leaves protocol failures such as format violations and reasoning leaks, whereas pre-registered verifiable-reward RL substantially fixes those failures; accuracy-only RL does not change the language of reasoning. The authors introduce controlled behavioral metrics for these properties and document several measurement failures.
The accuracy-blind analysis of language-of-thought behavior, together with controls showing distinct roles for SFT and RL, is a useful and potentially general evaluation direction, though the practical impact and transfer beyond Greek and these relatively small models remain uncertain.
-
One Success Isn't Reliability: Thinkingbox, a Sandbox and Benchmark for Agents in Stateful Business Workflows
Thinkingbox is a sandbox and benchmark for agents carrying out multi-step business workflows where success depends on policies, tool coordination, and the final persistent backend state—not merely a plausible answer or valid tool call. Across 507 workflows, the best tested model reaches 65.36% pass@1 but only 25.25% pass^20, exposing a large gap between occasional success and reliable completion; many failures look superficially valid at the response or tool-call level.
The executable end-state evaluation and stark pass@1 versus pass^20 reliability gap address an important weakness in current agent benchmarks, though this is primarily a benchmark and infrastructure contribution rather than a demonstrated capability breakthrough.
-
Open-MOPD: Diagnosing and Fixing Capability Imbalance in Multi-Teacher On-Policy Distillation
The paper studies why multi-teacher on-policy distillation fails to combine specialized RL capabilities in one student. In a controlled 3B-model benchmark, it attributes the problem mainly to misallocated token-level optimization—caused by sequence-length differences, uneven convergence, and stale rewards—rather than gradient conflict, and proposes balancing, adaptive budget allocation, and reward refresh; these raise recovered oracle headroom from 35.6% to 83.4%.
The large reported recovery and diagnosis that token-budget imbalance—not gradient conflict—is the main bottleneck make this worth examining, but the evidence is currently limited to one 3B controlled setup and a bundled recipe whose generality is unclear.
-
Governance at the Boundary: How Agent Decomposition Degrades Policy Compliance
The paper introduces Fiducia-bench for testing whether financial agents follow governance policies, including escalation, abstention, and auditability. Across 626 KYC/AML episodes, policy-relevant facts were preserved in a single-loop agent but frequently lost at component handoffs in pipelines and orchestrator–subagent systems; this caused both missed escalations and unnecessary escalations depending on the fact. A stronger model showed much less degradation, suggesting that compositional agent design and model capability jointly determine policy compliance.
The specific finding that agent decomposition systematically attenuates governance-critical information—with large, architecture-dependent effects and opposite compliance failures—is a useful and potentially general warning for multi-agent system design, though the evidence is limited to two models and financial task variants.
-
CompoSkill: Compositional Skill Chain Attacks from Individually Scanner-Passing LLM Agent Skills
The paper argues that checking agent skills one at a time misses attacks that emerge only when individually benign skills are chained together. It introduces white-box and black-box methods for finding such risky chains and evaluates them on 1,140 long-horizon workflow cases, finding chain attack rates up to 83.3% and substantial failures by existing per-skill scanners; longer chains, however, become less effective after roughly three skills.
The key contribution is a concrete demonstration that skill security is a path-level property rather than a package-level one, with high attack rates even when individual skills pass scanners, though the evidence is mainly benchmark-based and warrants checking the threat model and baselines.
-
JailbreakSkill: Scaling Automated Red-Teaming with Reusable and Ever-Evolving Skills
JailbreakSkill turns scattered jailbreak prompts and procedures into reusable, agent-selectable skills, then uses attack outcomes to refine, combine, and discover new skills over time. The evolving library raises attack success rates by 17.5 points on AdvBench and 13.4 points on HarmBench, with a reported 48.6-point gain against GPT-5.4 on AdvBench; some skills transfer to new prompts and models without additional tuning.
The potentially important contribution is a closed-loop, skill-based approach to accumulating and generalizing red-team capabilities, backed by unusually large reported gains, though the abstract does not establish how broad or robust the evaluations are.
-
Listen, Reason, and Segment: Aligning LALMs with Editorial Judgment for Media Chapterization
The paper trains large audio-language models to divide long-form audio into editor-like thematic chapters, using chain-of-thought supervision and GRPO reinforcement learning. On a new creator-annotated benchmark, the zero-shot GRPO variant reportedly gains 33 F1 points over Audio-Flamingo-3-Think, while the full method gains 49 points, suggesting a substantial improvement in turning unstructured audio into navigable sections.
The combination of long-context audio reasoning, editorial-alignment training, and very large reported gains represents a potentially important practical capability, although the abstract does not provide absolute scores or enough detail to judge benchmark quality and generalization.
-
SQuad: Sub-Quadratic Attention Distillation for Efficient Video Generation
SQuad distills a pretrained quadratic-attention video diffusion transformer into an attention mechanism with O(n√n) complexity, using supervised fine-tuning followed by distribution-matching distillation. On Wan 2.2 5B, it reportedly matches the teacher on VBench (83.20 vs. 83.08), reduces attention FLOPs by about 67× and attention latency by 11×, and enables generation in 6 rather than 100 sampling steps; end-to-end DiT latency improves 2×.
The combination of near-teacher video quality, sub-quadratic attention, and extreme sampling-step reduction could materially change the efficiency envelope for long or high-resolution video generation, although the evidence is currently limited to one model and headline benchmark.
-
FetchMan: Learning Visual Humanoid Loco-Manipulation Policies from Simulated Experiences
FetchMan trains visual humanoid walking-and-grasping policies entirely from simulated scenes, using behavior cloning followed by sparse-reward reinforcement learning with Flow-GRPO to overcome the cloning ceiling. The resulting policy was transferred zero-shot to a Unitree G1 and reached 73.3% success on unseen real scenes, with experiments spanning over 150,000 simulated scenes and an extension toward multi-object tasks.
The notable contribution is a credible sim-to-real recipe for visually guided humanoid loco-manipulation that avoids real demonstrations and demonstrates zero-shot walking-to-grasping on unseen physical scenes, although the evidence is currently concentrated on one task and reported success rate.
-
Expressivity In Multimodal Contrastive Learning
The paper analyzes multimodal contrastive models as density families and asks which joint distributions they can represent. It proves that two-tower CLIP is universal for two modalities, but the common extension that sums pairwise losses cannot represent arbitrary higher-order joint distributions, despite matching all pairwise conditionals. A small modification, Hadamard-CLIP, adds one learned weight vector to the existing encoders and is claimed to restore universal joint-distribution approximation without losing precomputable-embedding retrieval.
This identifies a fundamental expressivity limitation in a widely used multimodal design and offers a seemingly minimal fix that recovers higher-order modeling while preserving an important systems advantage.
-
Where a New Concept Must Enter: Entry Point Gates Cross-Task Usability in Unified Multimodal Models
The paper studies why understanding and generation in unified multimodal models often fail to improve each other. By introducing a new visual concept through only one pathway and testing whether the other can use it, the authors find that cross-task transfer depends on where the concept enters the shared computation: concepts introduced through a semantically aligned mid-stack representation can be transferred with little damage to existing capabilities, unlike standard generative editing.
It offers a concrete mechanistic explanation for a persistent UMM puzzle and reports a striking 0.1% versus 41% tradeoff, though the evidence is tempered by reliance on a limited observational set of four models.
-
Recirculation
The paper adds a recurrence-like inference procedure to existing foundation models, repeatedly updating their internal state so they can track information beyond the model’s fixed depth. With model weights frozen, an adaptive version reportedly cuts perplexity by 23% on several datasets and improves GSM8k accuracy by 21%, while adding little generation-time latency at the cost of serial prefill computation.
The combination of training-free architectural modification, substantial reported gains on an off-the-shelf model, and a distinct alternative to chain-of-thought or ordinary layer looping could be a broadly useful inference-time capability if the evaluation is as broad and reproducible as claimed.
-
Coupled-cluster molecular properties across the main group that extrapolate beyond training size
The paper introduces an equivariant neural network that predicts a corrected one-electron Hamiltonian from a single inexpensive B3LYP calculation, then obtains many molecular properties from that Hamiltonian rather than learning each property separately. It reports 3.8–230× lower errors than several DFT baselines and claims roughly 2% agreement with coupled-cluster trends for oligothiophenes, including extrapolation to chain lengths larger than those used for training or affordable for reference calculations.
The potentially important contribution is using a learned Hamiltonian to impose physically meaningful size scaling and extrapolate coupled-cluster-quality properties beyond the training regime, although the abstract leaves dataset scale, split design, and independent validation unclear.
-
SMTrap: Cost-Effective DoS Attacks Against Large Reasoning Models via SMT Conflict Guidance
SMTrap uses an SMT solver’s conflict count—without querying or training against the target model—to generate constraint-solving prompts that trigger long, backtracking-heavy reasoning traces in large reasoning models. Across seven frontier models, it reportedly causes substantially stronger denial-of-service effects than prior attacks using only CPU computation, and the authors show a tool-based mitigation that reduces token usage.
The paper presents a potentially general and unusually cheap model-feedback-free attack that exploits the search behavior of reasoning models, though the abstract lacks quantitative details about attack cost, scale, and robustness.