Worth reading
Research papers worth your time — new or old, picked because they're genuinely worth reading, not because they're new.
In a five-agent CI/CD pipeline across three LLM providers, a fabricated 'pre-approved under SEC-2291' label lets secret-exfiltrating PRs pass the scanner ~80% of the time and reach 55% compromise in the worst cell—showing distributed verification fails without provenance controls at entry.
Maps 128 papers into a design-space taxonomy of agentic attack surfaces—from tool hijacking and RAG poisoning to multi-agent propagation—with defense-in-depth guidance timed to this week's real-world agent breach outpacing benchmark-only security claims.
A lifecycle survey of 247 papers maps agent risks from prompt injection and tool hijacking to persistent memory corruption and multi-agent propagation—directly relevant as real-world agent breaches outpace benchmark-only security claims.
Timely systematization of agentic LLM risks—prompt injection, RAG poisoning, tool exploits, and multi-agent threats—with attacker models, Unsafe Action Rate metrics, and a phased deployment checklist as autonomous agents move from benchmarks to real infrastructure.
Systematizes inference-time agent risks—from transient context injection and memory poisoning to the Viral Agent Loop—and argues for zero-trust runtime controls with cryptographic tool provenance instead of semantic trust.
Surveys 1,250 arXiv papers into a what/when-to-evolve taxonomy separating bounded self-refinement from open-ended RSI—mapping evaluator design, verification hierarchies, and the research-direction bottleneck behind this week's frontier-lab automation discourse.
Instead of opaque latent CoT, CoLT emits seed tokens that trigger differentiable external decoders to unpack full reasoning steps—keeping the backbone in explicit text space while beating prior latent baselines on four math benchmarks and staying RL-compatible.
Sakana AI's Error Diffusion trains Dale-compliant dual-stream CNNs and RL agents without backprop or weight transport—reaching 61.7% CIFAR-10 and extending biologically plausible credit assignment into convolutional and PPO settings.
Defines CLI command-composition risk—benign git/npm/bash steps chaining through shared OS state—and shows a CVE-guided MOSAIC framework hits 96.59% success across five real coding agents without any prompt injection.
ALAR defaults to compact latent reasoning on routine agent turns and escalates to explicit CoT only when needed—cutting tool-use tokens up to 84.6% while matching or beating full-CoT accuracy on agentic search and tool benchmarks.
Instead of forcing every query through text CoT or fixed visual-thought tokens, SwimBird learns to pick text-only, vision-only, or interleaved reasoning per input—boosting vision-dense benchmarks without sacrificing symbolic logic.
Theory paper proving policy-gradient RL on a two-head transformer in stochastic k-ary trees recovers randomized DFS with specialized attention heads—depth-generalizing search after training only on shallow trees, with extensions to imbalanced goal priors.
Stanford's open TRACE pipeline contrasts failed vs successful agent trajectories, synthesizes per-capability RL environments, and trains routed LoRA adapters—pushing Qwen3.6-27B to 73.2% Pass@1 on SWE-bench Verified, above GPT-5.2-Codex, with code at github.com/ScalingIntelligence/TRACE.
WMBench pairs 324k simulated rollouts with real robot executions to show policy-evaluator quality depends on long-horizon action faithfulness, not frame-level photorealism—the authors release GigaWorld-1-Plus/Nano weights, data, and tooling as an open evaluation stack for embodied FMs.
ICML 2026 work factorizes likelihood over flexible token sets with a set-causal architecture that updates KV cache each step—unifying AR and diffusion decoding and beating prior dLLMs on math, summarization, and infilling speed-quality tradeoffs.
ICML 2026 Outstanding Paper shows δ-accurate diffusion sampling in polylog(1/δ) score steps under intrinsic dimension d⋆, and delivers the first gradient-only polylog sampler for general log-concave targets—an exponential jump over prior poly(1/δ) bounds.
Product-Key sparse addressing scales Gated DeltaNet state thousands of times under isoFLOP, beating full attention on RULER long-context recall and training an 8B model past 1T tokens with lower loss.
Unifies generalization and sketching for variable-size inputs (graphs, sequences, point clouds) via sampling maps, with explicit rates for GNNs and permutation-invariant transformers.
The J-lens maps Claude's J-space, a sparse internal workspace for silent concepts the model can report, steer, and use for flexible reasoning; interventions there causally change conclusions and can surface hidden strategic behavior.
ICML 2026 Outstanding Paper shows arbitrary-order dLLMs skip high-uncertainty reasoning tokens; forcing left-to-right GRPO (JustGRPO) hits 89.1% on GSM8K while keeping parallel decode.
Tackles KV-cache bloat in long-context transformers by learning a compressed memory representation instead of naive eviction — directly relevant if you're building or serving long-context LLMs.
Proves GD converges near stationary points for pre-normalized transformers and other modern blocks outside the lazy/NTK regime — rare theory that covers architectures people actually train.
No picks yet — check back soon.