The paper reviews ethical and privacy risks of large language model (LLM)–enabled geospatial artificial intelligence (GeoAI), identifying eight recurring issues such as data provenance, spatial privacy, algorithmic bias, and technical risks. It evaluates current responses, noting many remain largely unaddressed or conceptual, and proposes a governance‑aware architecture with enforceable controls illustrated by a flood‑response routing scenario. The authors call for empirical validation, spatially specific interpretability tools, and workforce training to address these emerging risks.
By Maya Subramanian, Devika Jain
The paper titled "Position: AI Is Not Ready for Strategic Conflicts" argues that language‑model (LM) based open‑ended strategic wargames, while useful for simulating adversaries, institutions, and crisis response, pose significant safety risks. It identifies five failure modes—decision laundering, adjudication opacity, role collapse, escalation‑through‑adjudication, and failure of strategic imagination—and contends that such wargames should not inform real‑world planning or policy without an auditable safety case. Instead, the authors suggest using these simulations primarily as stress tests to expose potential failures in decision‑influencing LM agents.
By Mark Riedl, Glenn Matlin
The paper introduces CLEAR, an agentic framework designed to improve the reliability of large language models (LLMs) in medical contexts by adjudicating evidence from multiple sources. CLEAR generates candidate answers from three distinct pathways—parametric knowledge, locally curated corpora, and dynamically retrieved evidence—and then uses an aggregation verifier to evaluate agreement and conflict among these sources. An adjudication module decides whether to preserve or revise conclusions, employing override-guard and challenge-audit mechanisms, and initiates targeted follow-up searches when conflicts remain unresolved.
By Shuai Wang, Yize Zhao, Qingyu Chen
The paper proposes universal, tool‑based defenses for large language model agents that use external tools, addressing four types of adversarial attacks: direct and indirect prompt injection, memory poisoning, and backdoor attacks. Two main defenses are introduced: Attacker Tool Filtering, which uses anomaly detection to remove suspicious tools, and Normal Tool Recalling, which restores the agent’s original toolset before planning. The authors also add prompt‑based defenses such as Chain‑of‑Thought prompting and self‑reflection, and demonstrate that these methods dramatically lower attack success rates—often to 0%—across multiple open‑source and proprietary LLMs while maintaining or improving task performance.
By Xiaoyan Li, Yunli Wang
The paper argues that while machine-readable models like SysML v2 enable AI participation in systems engineering, the data architecture surrounding these models must also be robust. It introduces the concept of epistemic adequacy, split into read‑side adequacy (ensuring derivations, status, and provenance are answerable) and write‑side admissibility (filtering AI contributions before they enter the record). The authors illustrate their ideas using the public Apollo 11 SysML v2 reconstruction and propose a Governed‑Query Architecture Framework to enforce these principles.
By Jason Gower, Michael J. de C. Henshaw, Siyuan Ji
The paper evaluates five context‑trimming strategies for agentic large language model workflows, comparing them on metrics such as task success, protocol adherence, token savings, and latency. Conventional trimming methods save about 60% of tokens but achieve lower success rates, while protocol‑aware trimming raises success to 92.2% and adaptive guardrails further improve it to 96% success with 56% token savings. The study shows that preserving protocol‑critical state is more important than aggressive token removal, and that adaptive guardrails enhance efficiency, scalability, and reliability for long‑horizon agentic systems.
By Harish Gaggar
The article surveys how large language models (LLMs) can be incorporated into networked control systems, cyber‑physical systems, and multi‑agent networks without violating stability and safety guarantees. It proposes treating the LLM as a slow supervisor that sets high‑level goals, while a fast, certified inner loop preserves physical stability. The survey maps LLM characteristics—such as inference latency, API failures, tokenization, and hallucinations—to classical control challenges and highlights the growing gap between model capability and formal safety assurances, calling for future research on stability proofs.
By Haiping Du, Linping Chan
The paper presents an AI-driven workflow for optimizing the thermal design of 2D CFET inverters, using an electrothermal model to evaluate structural proposals against electrical costs. At 12 nm, the AI selects a redistributed source‑interconnect geometry and a substrate‑directed heat‑removal path, achieving a 1.67 K reduction in peak temperature rise for a fixed metal volume and 20 µW. Subsequent sensitivity analyses show additional cooling benefits and trade‑offs with nFET on‑current, demonstrating that the AI scientist workflow can propose viable thermal structures and quantify their electrical impact.
By Min-Hui Kim, Khushi Sharma, Sarah Zhang, Ye Wang
The paper examines the aftermath of a rapid surge in AI agent skills following the viral spread of the OpenClaw AI agent in early 2026. It analyzes Git history, GitHub issues, and registry snapshots to show that the top 10% of skills dominated downloads, yet most skills lacked human review and many contained privilege‑evidencing code. Automated security scanners were inconsistent, with low sensitivity after human adjudication, highlighting the inadequacy of simple metadata or single‑scanner approaches for governing fast‑growing skill registries.
By Yunpeng Xiong, Ting Zhang
The paper investigates how to choose model pools for Multi-Agent Systems (MAS) that combine multiple model outputs to tackle complex reasoning tasks. It evaluates eight selection strategies—such as model size, accuracy, and answer diversity—across both before-generation (routing) and after-generation (majority-voting, LLM-as-a-judge) MAS architectures on scientific benchmarks. The study finds that expanding the candidate pool often harms performance, that selecting candidates within a single model family yields the best relative gains, and that indiscriminate addition of heterogeneous models can destabilize the system.
By Sara Vera Marjanovi\'c, Jiacheng Xu, Aleksandr Laptev, Grigor Nalbandyan, Erik Arakelyan, Evelina Bakhaturina
The paper introduces Quantum‑Harbor, a virtual laboratory that lets AI agents interact with quantum systems in a controlled setting, enabling verification of their actions and conclusions. Using this platform, the authors created QIQCBench, a benchmark of 49 expert‑authored tasks covering calibration, control, error correction, compilation, sensing, and networking. Testing 17 state‑of‑the‑art agentic systems on QIQCBench revealed wide variation in verified performance, highlighting a gap between demonstrated capability and reliable operation and positioning Quantum‑Harbor as a foundation for measuring progress toward verified autonomy in quantum engineering.
By Naixu Guo, Changhao Li, Siyu Cheng, Qicheng Tang, Binzhao Luo, Bikun Li, Yuxuan Du, Shihao Ru, Jiaqi Cai
The paper introduces Monte Carlo Query Search (MCQS), an active query‑synthesis method for learning symbolic stochastic capability models of black‑box AI agents. MCQS treats capability evaluation as an active learning problem over policies, using Monte Carlo tree search to generate queries that distinguish between pessimistic and optimistic capability hypotheses. Experiments demonstrate that MCQS learns accurate capability models more efficiently than baseline strategies, enabling systematic characterization of agent capability boundaries with fewer interactions.
By Daniel Bramblett, Rushang Karia, Adrian Ciotinga, Pulkit Verma, YooJung Choi, Siddharth Srivastava
The paper introduces ANCHOR, an external supervisory framework driven by large language models (LLMs) that provides evaluative feedback at multiple stages of self‑evolving agents. By integrating ANCHOR into two open‑source self‑evolving agent frameworks, the authors demonstrate that it significantly improves safety performance while preserving core capabilities across coding, mathematical reasoning, and safety tasks. The study also finds that supervision based on execution results is especially effective and that increasing supervision frequency yields diminishing returns, offering practical guidance for future research.
By Dianxing Shi, Bowen Wang, Junqi He, Junhao Chen, Yuta Nakashima
ViCo is a training framework that improves the visual quality of AI-generated academic charts by using iterative self-reflection to align chart images with reference designs. It introduces a self-supervised warm-up stage that augments Monte Carlo Tree Search with consistency-based pruning, and a multi-step reinforcement learning algorithm that employs counterfactual baselines to address sparse rewards. An automatic, multifaceted evaluation framework assesses style, layout, and semantic consistency through a hierarchical heterogeneous layout graph, and experiments on three public benchmarks show ViCo’s performance approaching that of proprietary large language models.
By Jiaxin Duan, Dian Jiao Shuai Zhao, Jiabing Leng, Yiran Zhang, Feng Huang
The paper introduces a meta‑reinforcement learning framework for wireless edge caching that uses a shared initialization to adapt quickly to each base station (BS). Each BS runs a local PPO agent modeled as a Semi‑Markov Decision Process, while a shared meta‑policy is trained via a MAML‑style loop. To reduce the high variance of the meta‑gradient estimator caused by uniform random sampling of BSs, the authors propose gradient‑based clustering, grouping BSs by local gradient similarity and sampling proportionally from each cluster, proving that this yields a lower‑variance estimator under BS heterogeneity.
By Farnaz Niknia, Ping Wang
Intrinsic Robot Rewarding (IRR) leverages existing vision‑language‑action (VLA) systems to evaluate a robot’s own outcomes and provide feedback for policy improvement. By using successful demonstration endpoints as task‑specific references and the policy’s frozen visual encoder as the feature space, IRR adds a reference bank and scoring operation to the current pipeline without requiring a separate evaluator or additional perception backbone. The approach aims to reduce integration effort, reward computation cost, and human outcome scoring while enabling learning from the data already available in industrial robot systems.
By Tobias Schaffer, Mohab Elkhayat, Daniela Nicklas, Mustafa Almohamad, Elham Al-Fuqara
The paper studies recurrent Twin Delayed Deep Deterministic Policy Gradient (TD3) agents in environments with evolving hidden disturbances, focusing on how observation history, action history, history length, and network structure influence performance. Three recurrent architectures are compared under controlled disturbances, revealing that action history is crucial when responses depend on prior actions and that a unified temporal sequence of action-observation pairs outperforms separate branches. The authors introduce H‑TD3, which reuses actor-generated recurrent states to initialize the critic, and demonstrate that these architectures excel in a rover wheel‑slip simulation, with policies trained on temporally structured disturbances transferring better to unseen slip dynamics.
By Saki Omi, Hyo-Sang Shin, Namhoon Cho, Antonios Tsourdos, Miguel A. Olivares-Mendez
The paper introduces CoER, a framework that defends language‑model agents against adaptive indirect prompt injection (IPI) by employing attacker‑defender co‑evolution and refinement. CoER models IPI as a general‑sum Markov game, uses Co‑PPO to maintain historical opponent populations, and fine‑tunes defenders only on verified safe demonstrations. In experiments across seven domains, CoER cuts attack success from 38.5% to 0.2% while boosting task utility from 63.2% to 76.3%.
By Boyang Zhang, Qingxin Xiao, Lingwei Dang, Qingyao Wu
The paper introduces the SAST-IR framework to evaluate large language models’ robustness against persuasion attacks in a memory‑less setting, revealing a flaw called "Refusal Inertia" that masks true vulnerability. Using the CP‑Agent and a custom CounterFact‑Strict dataset, the authors demonstrate that simple, diverse attack strategies achieve a 96% success rate, while complex attacks often trigger defensive compliance. The study highlights severe brittleness in current state‑of‑the‑art models when deprived of conversation history.
By Zhuoang Cai
The paper examines how open‑weight language models expose the control tokens used in chat templates, allowing attackers to forge turn boundaries that the model treats as legitimate. An audit of 256 deployed tokenizers shows all are vulnerable, and the commonly recommended flag fails to protect 56.6% of cases. The authors introduce nameless tokenization, which removes surface strings for control identifiers while preserving their internal representation, achieving identical token streams on clean data and significantly improving accuracy on delimiter‑bearing text.
By Kisu Yang, Yoonna Jang, Heuiseok Lim