The paper proposes a formal framework that uses process-oriented modeling and institutional power to analyze and repair normative issues in multi-agent systems. It emphasizes aligning responsibilities with the ability to fulfill them, highlighting the importance of identifying incongruences such as unsatisfiable expectations or privilege escalation. The framework also explores how the symmetrical relationship between operational processes and institutional states influences the lifecycle of normative positions.
By Andrea Marino, Giovanni Sileno, Thomas van Binsbergen, Tom van Engers
The paper introduces a Digital Identity Optimization (DIO) and Ontology of Digital Identity (ODI)-informed authorization guardrail for Agentic Entity Resolution (ER) systems. It defines a commit boundary that restricts evidence used for persistent identity changes, employing a two‑phase supervisor to ensure claim‑specific authorization, conflict resolution, scope adherence, and version validity. The work outlines a conceptual architecture and an evaluation protocol but does not provide implementation or empirical validation.
By Daniel Ber\'anek
M4Bench is a benchmark comprising 28 clinical derivation tasks across 15 families on MIMIC‑IV and eICU, designed to evaluate whether AI coding agents can reproduce complex procedural specifications for electronic health record (EHR) variable derivation. The study tests agents with and without clinician‑reviewed skill sets, finding that specification completeness drives most performance gains, while generic context or skill format contribute little. The benchmark includes tasks, skills, evaluation code, and sanitized evidence, all released as open‑source.
By Hannes Ill, Rafi Al Attrach, Rajna Fani, Ahram Han, Ryohei Yamamoto, Marlene Louisa Moerig, Dukyong Yoon, Leo Anthony Celi
The paper introduces Task Advancement Memory (TAM), a framework that tracks verified task progress to improve GUI agent performance. TAM defines a Task Advancement State that captures how progress changes remaining goals, enabling agents to build on earlier achievements across applications. After each task, TAM’s advancement supervision abstracts interactions that yielded verified local results, preserving reusable operations and reducing lifecycle tokens.
By Ziyang Chen, Qian Li, Chengwei Qin
The paper introduces MAD Bench, a 2,400-question benchmark for multi‑agent debate (MAD) that tests knowledge, reasoning, values, moral judgment, safety, and refusal. It evaluates three open‑weight models and finds that peer communication can alter individual decisions, with forced‑choice readouts before rationale generation more often matching the final answer in debate than in reflection. The study shows that stronger consensus can coexist with increased shared errors, suggesting the need for evaluation metrics that consider dependence and unanimous errors alongside accuracy.
By Arnesh Batra, Aniket Khandelwal, Jashn Khemani, Krish Thukral, Arush Gumber, Denis Federico Lim, Ujwal Kumar, Phan Xuan Tan
The paper introduces a curriculum-driven deep reinforcement learning framework for autonomous far-range rocket landing. It uses a three-stage curriculum, critic warm‑up, rehearsal to avoid catastrophic forgetting, and a high‑dimensional observation vector with a full 3×3 rotation matrix. The redesigned reward function bounds per‑step rewards and accumulates progress, yielding a 99.98% success rate over 100,000 episodes, far surpassing the baseline.
By Atin Chowdhury, Piyush Joshi
The paper introduces a coding assistant tailored for safety‑critical automotive software, offering generate, edit, and verify tools via the Model Context Protocol. It customizes a large language model through prompt engineering and fine‑tuning on a dataset of automotive production code linked to requirements and UML behavior. In a two‑week pilot, developers favored the verify tool and the prompt‑engineered model, noting fewer MISRA violations in C and better architectural conformance in C++.
By Elizaveta Zinovyeva, Aiham Taleb, Nikita Kozodoi, Daniel Schleicher, Amir Mahdi Namazi, Martin Kraus, Levent Kent, Brian Jensen
PROBE is a benchmark that compiles 2,457 bugs fixed over 18 months in 20 GitHub repositories and provides a method to match candidate findings to this reference set. Evaluation of frontier coding agents shows they achieve less than 21% recall and under 9% precision, with stronger models improving recall from 8% to 17% but not precision. Despite low precision, 85% of findings are judged valid by LLM and human evaluators, and the distribution of bugs found by agents differs substantially from those fixed by maintainers.
By Marco Paina, Mark Niklas M\"uller, Niels M\"undler-Sasahara, Martin Vechev
PolicyMediator is a Stackelberg framework that uses mediation agents to bridge the gap between one‑person companies (OPCs) and regional governments in China. By explaining verified policies to OPCs and reporting their needs back to governments, the mediator evolves its strategies through verification, allocation, capacity, and objective trajectories. In six‑region simulations, PolicyMediator outperforms all baselines, improving government objectives by 42.4% and OPC utility by 40.9%.
By Jie Li, Bin Guo, Georgina Curto, Zikang Liu, Mengqi Chen, yu li
CIVER is a causal intervention-based framework designed to improve the reliability of automated code reviews performed by large language model (LLM) agents. It consists of three modules—a review module, an intervention module that creates repair-oriented perturbations, and a verifier module that scores review reliability—trained together through expert iteration. Experiments on the SWE-Review-Bench show that CIVER correctly identifies 77% of genuine defects and generalizes across repositories, thereby enhancing the success rates of coding agents.
By Xinyuan Song, Hasibul Haque, Jay Somasundaram, Ryan Turner, Bowen Zhu, Liang Zhao
The paper "Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol" investigates how natural-language metadata in the Model Context Protocol (MCP) can be exploited to inject malicious post‑hoc logging calls into large language model agents. The authors introduce the Log-To-Leak attack, which adds an attacker‑controlled call after a legitimate tool invocation, targeting user queries, MCP server names, server responses, and agent responses. Experiments across five MCP servers and four LLM agents show high attack success rates (up to 100%) and significant logging accuracy, while existing defenses still leave substantial residual risk.
By Yuepeng Hu, Chongyu Fan, Sirat Samyoun, Jian Du
The paper introduces Contrastive Evidence Paths (CEP), a method that scores search candidates by their strongest individual paths on a query‑conditioned document graph and calibrates these scores against a background visitation distribution to reduce structural bias. Building on CEP, Structured Corpus Interaction (SCI) organizes candidates and paths into a structured map, allowing agents to verify sources and expand from anchor documents. Experiments on BrowseComp‑Plus and TREC‑COVID demonstrate that SCI achieves state‑of‑the‑art answer accuracy and nDCG@10 while cutting tool calls and generation costs by over 50% and 40%, respectively.
By Junchen Li, Liang Xu, Rongzheng Wang, Qizhi Chen, Junhao Wen, Shuang Liang
The paper introduces Stratum, a repository memory system designed to give coding agents persistent, experience-aware memory beyond the limits of their context windows. It argues that coding agents suffer from a memory-architecture problem, not just context length, and presents three empirical findings from real repositories that motivate a tiered memory approach. Stratum stores knowledge as indexed text rather than in the model’s KV cache, enabling fast retrieval (1.7 ms median for a million nodes) and significantly improving root-cause identification in multi‑session bug‑fix experiments.
By Yuvraj Sehgal, Mahsa Panahandeh, Naser Ezzati-Jivan
The study examines whether commits made by AI coding agents can be distinguished from human commits when authorship signatures are removed. Using nearly 8 million commits from over a thousand repositories, the authors find that detectors can achieve a ROC AUC of up to 0.859, largely driven by message verbosity and change size rather than code content. However, precision remains low (≈0.332) and detection performance drops on held‑out agents, indicating limited reliability without explicit attribution.
By Kosei Horikawa, Hao Li, Yutaro Kashiwa, Youssef Esseddiq Ouatiti, Mohammed Sayagh, Bram Adams, Hajimu Iida, Ahmed E. Hassan
The paper investigates fine‑tuning reinforcement learning agents when offline data cannot be retained. It shows that continuing online behavioral cloning after the offline dataset disappears erodes the pretrained policy, leading to representational collapse and loss of action diversity. By freezing the expressive prior and stopping online behavioral fitting, the authors achieve better performance across several algorithms on seven OGBench domains.
By Sami Nur Islam, Johan Obando-Ceron, Doina Precup, Aaron Courville, Pablo Samuel Castro
FIDES-Live extends the FIDES framework to audit sequential trading agents by separating decision validity, numerical commitment adherence, execution and ledger reconciliation, and receipt‑grounded reporting. In a retrospective audit of 7,299 cryptocurrency account‑rounds and a 310‑round equity pilot, decision validity reached 97.35% and structured reporting accuracy 90.81%, while commitment adherence overall was 94.36% but dropped to 62.63% for non‑empty order proposals. The study shows that all cash and position transitions reconcile with recorded fills, and highlights the need to report concordance, evidence coverage, activity, and financial outcomes separately.
By Arther Tian, Alex Ding, Simon Wu, Aaron Chan
NextEval introduces an agent-based derivative-free optimization solver that leverages a large language model to guide the sequential selection of evaluation points. The system couples an LLM agent with a numerical environment, allowing the agent to choose tools, configure parameters, and allocate a limited evaluation budget while the environment maintains shared history and state across method switches. A benchmark protocol, NextEval Bench, is also presented to compare different agent configurations on shared DFO tasks under matched budgets and information constraints, and numerical experiments show that NextEval outperforms state-of-the-art baselines in function-evaluation efficiency.
By Shuo Chen, Li Cui, Cunxin Huang, Ya-Feng Liu, Minghang Xie, Meng Xu, Zaikun Zhang
The paper introduces Req2Test-Bench, a benchmark of 5,086 instances linking natural‑language Gherkin requirements to developer‑written test implementations across five languages and four BDD frameworks. It evaluates eight agent–model–reasoning setups, finding that while the best configuration (Codex with DeepSeek‑V4.1‑Flash) produces passing tests for 82.8% of cases, only 33.8% are behaviorally adequate, as measured by kill‑completeness. The study highlights diminishing returns from scaling agents, the impact of under‑specified requirements, and the potential of requirement‑grounded harnesses to improve test generation.
By Binhang Qi, Yiming Liu, Yun Lin, Yangjie Zhou, Hailong Sun, Jin Song Dong
Select‑TTT introduces a query‑conditioned rule for In‑Place Test‑Time Training (TTT) that scales the write strength of each context chunk based on its relevance to the user query. By using the model’s frozen output head to compute relevance scores and applying a temperature‑scaled softmax as learning‑rate multipliers, the method preserves the efficient, chunk‑wise computation of In‑Place TTT while preventing irrelevant content from diluting fast‑weight memory. Experiments on two benchmarks and two backbones show consistent improvements in long‑context question answering.
By Yue Wu, Yang Zhang, Weinan Gan, Chongming Gao, Xinsen Guo, Xiaoyuan Li, Fuli Feng
arXiv:2610. 37055v1 Announce Type: cross Abstract: Audit-based certification bounds the violation rate of an LLM agent by auditing a random fraction $\varepsilon$ of actions and reweighting the audited labels; its validity is meant to rest only on the defender's audit coin.
By Wei Zhu, Meiyun Zuo, Huiping Sun