The paper presents empirical concentration inequalities for stationary chains with infinite memory, extending previous results that were limited to Markov chains. It establishes a bounded‑differences inequality under a summable Wasserstein contraction condition and shows how to estimate the necessary dependence coefficients from a single trajectory, using transition counts for finite state spaces or kernel density derivatives for continuous spaces. The authors provide general error bounds that reflect the memory tail and demonstrate that, after applying a fixed safety factor, the resulting empirical bounds are asymptotically as tight as the theoretical ones, while remaining fully adaptive without requiring knowledge of the underlying constants.
By Pierre Alquier, Paul Doukhan
arXiv:2603. 10346v2 Announce Type: replace Abstract: We study the fixed-budget best-arm identification (BAI) problem in non-stationary linear bandits.
By Leo Maynard-Zhang, Zhihan Xiong, Kevin Jamieson, Maryam Fazel
The paper extends dueling bandits to episodic Markov decision processes where selecting a pair of arms not only yields a noisy preference but also influences the next state. It defines a state‑wise preference‑based MDP with adversarially changing preferences and Borda‑score losses, and proves a minimax regret of ∫Θ(min{HT,(H^3SK)^{1/3}T^{2/3}}) under known transitions. The authors provide an online linear‑optimization algorithm achieving this bound, a policy‑optimization algorithm with closed‑form updates, and extensions to unknown transitions.
By Taira Tsuchiya, Shinji Ito, Haipeng Luo
BARC-Bench is a new benchmark comprising 110 tasks across nine simulated workspace environments designed to expose the safety risks of underspecified user instructions for agents. The benchmark evaluates whether agents respect safety boundaries defined by workspace records, implicit environmental context, and unstated social norms, such as avoiding premature disclosure of an employee’s resignation. Results show that even the best model configurations fail to consistently act safely, with safe completion rates ranging from 9.1% to 72.7% and a 27.3% safety violation rate in the strongest setup.
By Kangkang Li, Kelvin Luu, Lily Ma, Tu Trinh, Ying Liu, Mohamed Elfeki
$M^3$ is an automated red‑teaming framework that models multi‑turn jailbreaking as a finite‑horizon Markov Decision Process. It lets an attacker LLM interact with a target LLM while using a state LLM to maintain a compact internal state. Across two benchmarks and six target models, $M^3$ outperforms existing methods, boosting attack success rates by up to 53% at five turns and improving consistency and risk escalation metrics.
By Yuqing Huang, Jack Ji, Jithin Pradeep, Sagarika Suresh, Jekaterina Novikova
The paper investigates how AI agents can reliably recover from changes in authorization while executing tasks that involve external tools. It defines distinct obligations—checkpointing, permission to dispatch, evidence of external effects, and permission to reconcile—and evaluates them through a finite conformance study on 336 histories across multiple hosts, schedules, and provider contracts. The study demonstrates that all paired host cells produce identical outcomes and that various retry strategies (cached, revalidation, stable-key) successfully pass the majority of histories, while a component study of InfinityOS further isolates the impact of authority, contracts, and observations on recovery.
By Deekshith Marla, Kushagra Bhatnagar
The paper compares Proximal Policy Optimization (PPO) and Soft Actor-Critic (SAC) for cooperative motion planning of dual‑arm space manipulators tasked with reaching a target while avoiding inter‑arm collisions. A centralized state representation and multi‑objective reward function are used, and SAC consistently outperforms PPO across five random seeds, achieving an 80% success rate within 1.6 M steps versus PPO’s failure to reach this threshold within 4 M steps. Both algorithms degrade on unseen boundary targets, but SAC retains most of its performance while PPO collapses, revealing a reward‑loitering failure mode for PPO.
whyItMatters":"The study demonstrates that off‑policy SAC is more robust and effective than on‑policy PPO for coordinating dual‑arm space robots, informing algorithm choice for active debris removal and on‑orbit servicing tasks."
By Nasim Fallahiarezoodar, Zheng H. Zhu
DELA introduces a plug‑in framework for diffusion language models that enables explicit draft‑level editing using four actions: Insert, Delete, Remask, and Stop. The system separates high‑level edit control from token‑level generation by employing a frozen diffusion language model and a two‑phase decoding process that first drafts append‑only content and then refines the full draft. Training the controller through a staged curriculum and rollout‑based preferences yields up to 5.5 percentage‑point improvements on mathematical reasoning and code generation tasks compared to direct diffusion decoding.
By Xinsong Feng, Chenan Wang, Leshu Tang, Johnny Liu, Dong Li, Da Li, Haipeng Chen
The paper introduces Layer-wise Error Modeling Search (LEMS) and KFAC-SVD to improve low-rank SVD-based compression of large language models. LEMS addresses global rank allocation by using a layer-wise error surrogate and an ILP formulation, while KFAC-SVD enhances decomposition quality by employing token-wise statistics to avoid rank collapse. Experiments on Mistral, Qwen3, and Llama 3 show LEMS yields up to 4.8 pp zero‑shot accuracy gains and KFAC‑SVD achieves an average perplexity improvement of 15%.
By Moritz Thoma, Maximilian Groezinger, Maximilian Forstenh\"ausler, Emad Aghajanzadeh, Manoj Rohit Vemparala, Christos Anagnostopoulos, Pierpaolo Mori, Nael Fasfous, Alexander Frickenstein, Daniel Mueller-Gritschneder, Ulf Schlichtmann
SEVI (Safe Evidential Real-World Reinforcement Learning) is a framework that adds a safety intervention layer to real‑world policy learning. It uses an Evidential Safety Critic to estimate both future constraint‑violation risk and epistemic uncertainty in a single forward pass, and overrides unsafe or poorly supported actions with an offline‑trained recovery policy. Experiments on simulated manipulation tasks and a real‑world USB insertion task show that SEVI improves trajectory‑level safety prediction, task success, and reduces unsafe events by 13.4–57.1% compared to other safe RL baselines.
By Shaekh Mohammad Shithil, Lantao Liu
The paper introduces a defense for Agentic AI systems that use the Model Context Protocol (MCP). It identifies a vulnerability where hidden instructions in steganographic images can bypass text scanners and trigger malicious tool calls. The proposed solution, decode-time provenance binding, uses HMAC-authenticated trust labels, a provenance ledger, and context-taint tracking to mark decoded content as untrusted and block harmful tool calls, achieving 0% attack success in tests.
By Eric Yocam, Varghese Vaidyan, Paris Kalathas, Patrick Tague, Bruce DeBruhl, Yong Wang
The paper redefines structured generation as an ambiguity‑aware inference problem, arguing that natural language often allows multiple valid structured outputs. It introduces a multi‑valid learning framework that preserves these alternatives during training and uses graph‑based reasoning to compare candidate structures based on semantic alignment and relational consistency. Experiments on benchmark datasets show that this approach improves accuracy, stability, and robustness compared to traditional single‑output methods.
By Ratun Rahman, Atit Pokharel
The paper introduces XAVAD, a unified approach for explainable anomaly detection in anonymized crowd video monitoring. It combines zero‑shot anonymization, anomaly type categorization, spatial localization, and scene context description using multimodal CLIP embeddings, LLM‑assisted prompting, and a prompt‑guided patching autofocus mechanism. Experiments on public CCTV datasets show XAVAD outperforms state‑of‑the‑art methods and offers insights into privacy‑explainability trade‑offs.
By Mulugeta Weldezgina Asres, Lei Jiao, Christian Walter Omlin
The paper introduces REACT, a method that intervenes early in a chain‑of‑thought (CoT) generation by applying a learned safety direction to an early hidden state, without altering model weights. Experiments on distilled reasoning models show that the most effective control occurs within the first two to three tokens, with diminishing returns thereafter. On an 8B model, REACT increases the proportion of fully safe CoT answers from 29.06% to 82.05% while maintaining baseline performance on benign refusal and usefulness.
By Hanwen Zhang, Enyi Jiang, Ruike Zhu, Qinan Yu, Sanmi Koyejo
SOPO: Socratic Guided Policy Optimization for Span-Level Hallucination Detection introduces a multi-turn reinforcement learning framework that uses a teacher model to provide Socratic feedback, guiding reasoning trajectories during rollout. This approach addresses localization ambiguity, reward sparsity, and verbosity bias in detecting hallucinations in large language models. Empirical results on the RAGTruth dataset show that SOPO (4B) outperforms leading proprietary models and standard RL baselines, achieving state‑of‑the‑art performance on multiple benchmarks.
By Jiawei Dong, Zilong Bai, Pengtian zhu, Peng Zhou
SP-Guide is a transformer-based framework designed to improve aerial vision-language navigation by incorporating spatial priors. It introduces a Spatial Prior Cross-Modal Encoder, an Instruction Enhanced Decoder, and a Goal Convergence Filter to better align visual and linguistic information. Experiments on the CityNav benchmark show that SP-Guide increases success rates, especially in unseen environments, demonstrating the value of physically grounded spatial priors for robust navigation.
By Haoxiang Tang, Dong Zhou, Shen Tan, Minxuan Jiang, Xitong Li
This paper investigates clean‑label poisoning attacks and defenses in federated learning for vehicular networks, focusing on Basic Safety Message classification for anomaly detection. It introduces a feature‑space attack that perturbs benign samples toward malicious extremes, reducing class separability while keeping labels intact, and proposes a feature‑consistency relabeling defense to detect and correct suspicious samples. A game‑theoretic framework models attack‑defense interactions, showing that the attack scales with compromised nodes but the defense maintains low attack success and clean accuracy, shifting equilibrium toward attack‑averse regimes.
By Yalin E. Sagduyu, Tugba Erpek, Nathan Stephenson, Mengran Xue
The study presents a reproducible spatial simulation audit that combines a generative adversarial network for patrol allocation with a probabilistic detection model to assess patrol detection disparities in Baltimore and Chicago. Using archived crime records and census data, the authors compare GAN-based allocation to empirical and uniform deployment across multiple random seeds, finding detection-rate differences between Black-majority and White-majority areas ranging from –2.03 to 0.75 percentage points and coverage between 1.78% and 7.50%. The audit also evaluates a conditional tabular generative model for synthetic replacement, noting that geographic consistency fails in many cases, and highlights how simulated disparities depend on observation processes, allocation policies, training budgets, and randomness.
By Pronob Kumar Barman, Pronoy Kumar Barman
The paper introduces Uncertainty-Guided Latent Diagnostic Trajectory Learning (LDTL), a framework that uses a planning LLM agent and a diagnostic LLM agent to model sequential clinical diagnosis under uncertainty. By treating diagnostic action sequences as latent paths and applying a posterior distribution that favors trajectories with higher diagnostic value, the approach encourages coherent evidence acquisition that progressively reduces uncertainty. Experiments on the MIMIC-CDM benchmark show that LDTL improves diagnostic accuracy while requiring fewer tests, and ablation studies confirm the importance of trajectory-level posterior alignment.
By Xuyang Shen, Haoran Liu, Dongjin Song, Martin Renqiang Min
arXiv:2505. 02360v3 Announce Type: replace-cross Abstract: Adversarial training is a cornerstone of robust deep learning, but fast methods like the Fast Gradient Sign Method (FGSM) often suffer from Catastrophic Overfitting (CO), where models become robust to single-step attacks but fail against multi-step variants.
By Fares B. Mehouachi, Saif Eddin Jabari