The paper introduces Audit-First VAPO, a method that separates directional admission from magnitude control for selective updates under imperfect verification. It employs an observation-only accept‑appeal‑abstain policy with a finite secondary‑verification budget, freezing the action trace before clean labels are added, and uses finite‑sample bounds to certify harmful risk, coverage, and verifier‑call rate. Experiments on Qwen3.5‑0.8B and GSM8K show that RC‑VAPO achieves high accuracy while maintaining low selected harmful risk and modest verifier cost compared to baseline methods.
By Miaobo Hu, Shuhao Hu, Xiaobo Guo, Xin Wang, Bokun Wang, Rui Chen, Daren Zha
ROUTEAUDIT presents a framework for identifying and attributing performance in adaptive multi‑verifier routing systems. It treats routing as a contract‑conditioned identification problem, adding measurable objects such as a contract lattice, a policy‑independent response tape, and request‑level bounds to capture path sensitivity and finite‑population intervals. Experiments on held‑out caches and task requests demonstrate improved quality metrics and precise attribution with low reconstruction error.
By Miaobo Hu, Shuhao Hu, Xiaobo Guo, Xin Wang, Bokun Wang, Tianshu Fu, Daren Zha, Jun Xiao
arXiv:2607. 29400v1 Announce Type: new Abstract: A routing decision can be revised at the next transaction, but a latched source exclusion persists across later decisions.
By Xiyang Zhang, Hongzhi Wang, Yuanhe Tian
The paper investigates how verifier components used in post‑training and test‑time loops can collapse when they are refreshed based on aggregate success scores. It shows that as a policy improves on one conjunctive target, the verifier’s on‑policy AUC can shift to favor a worse component, leading to a preference for a full‑outcome predictor over the intended component oracle. The authors provide theoretical thresholds, empirical demonstrations on text control and ECG data, and propose a repair that audits the component on its own failures to prevent damage.
By Daniel Cie\'slak, Jacek {\L}ubi\'nski
arXiv:2609.07162v1 Announce Type: new
Abstract: Several properties safety monitors are asked to certify, among them cross-tenant noninterference, sandbagging and evaluation awareness, are 2-safety hy...
By Xin Xu
CascadeLedger is a counterfactual execution‑audit framework designed for budgeted language‑model cascades. It enforces call‑before‑read semantics, records service and cache identities, and freezes event traces before scoring, ensuring that two executions can share a final answer and resource projection only if their routing decisions used legitimately observable information. The framework introduces counterfactual prefix non‑interference (CPNI), counterfactual influence frontier (CIF), and projection‑preserving adversarial mutation (PPAM) to detect and localize violations, achieving a clean false‑positive rate and high detection rates for serialized and hidden‑read faults while quantifying overhead for online and offline audits.
By Miaobo Hu, Shuhao Hu, Xiaobo Guo, Xin Wang, Bokun Wang, Daren Zha, Jun Xiao
arXiv:2605.29139v2 Announce Type: replace-cross
Abstract: Question-answering services built on retrieval-augmented generation (RAG), in which a language model answers from retrieved documents, are in...
By Prasanjit Dubey, Xiaoming Huo
arXiv:2610.16067v1 Announce Type: cross
Abstract: Agent evaluation harnesses are software systems that run test suites, generate inputs, and decide outcomes with test oracles. This paper audits such...
By Junjie Chen
arXiv:2608. 02464v1 Announce Type: cross Abstract: LLM agents fail mid-episode -- they loop, cascade tool errors, drift off goal, fabricate results, or silently absorb corrupted content -- and the standard remedy, judging every step with a second LLM, costs more than the agent itself.
By Sunny Dubey
arXiv:2603. 13384v2 Announce Type: replace-cross Abstract: Software vulnerabilities often depend on cross-file data flow, build options, framework conventions, and runtime guards, so isolated function classifiers produce fragile and poorly calibrated warnings.
By Renwei Meng, Haoyi Wu, Jingming Wang
arXiv:2610. 37055v1 Announce Type: cross Abstract: Audit-based certification bounds the violation rate of an LLM agent by auditing a random fraction $\varepsilon$ of actions and reweighting the audited labels; its validity is meant to rest only on the defender's audit coin.
By Wei Zhu, Meiyun Zuo, Huiping Sun
arXiv:2609.37125v1 Announce Type: new
Abstract: Prospective memory allows an agent to retain an intention tied to a future condition, but the stored intention does not reveal whether that condition c...
By Zhengkun Di, Bin Shi, Kai Sun, Yiming Xu, Bo Dong