論文アーカイブ

収録論文と要約を番号の大きい順に掲載します。

収録論文 1,430資料更新日 Research Monitoringベンチマーク
  1. 1393RAG / AgentsarXiv:2610.37242

    Grounding LLM Agents in Business Processes: Process-Aware Knowledge Graphs for Reliable Multi-Step Service Invocation

    • The authors integrated OData metadata and BPMN business processes into one typed property graph, giving service retrieval both sequential and schema constraints.
    • The hybrid retriever finds candidate endpoints with dense embeddings and then follows process edges to retrieve subsequent endpoints.
    • For queries with low lexical overlap between the query and downstream entities, it improves Recall@3 by 5.7 points (n = 74), with consistent gains across embedding models and cut-offs.
    • On 81 multi-step queries, the agent completes 38.7% of tasks, compared with 10.3% for a chunk-based baseline.
    • Providing valid code lists as plain text eliminates invented codes but leaves invalid keys in 46% of write runs, while full typed context reduces invalid calls to 3% (3 of 101 runs), with no invented codes.
    • As a limitation, the authors state the evaluation is partly circular because the mock validator and the graph share the same metadata, so results must be reproduced against an independent backend.
  2. 1392RoboticsarXiv:2610.37203

    Remember Where You Walk: Learning Spatial Memory for End-to-End Legged Robot Exploration

    • The authors proposed LSMM, a position-based matrix memory that lets reinforcement learning agents store task information at specific memory cells.
    • LSMM updates only a 5 × 5 cell window centered on the robot's position estimate at every step, leaving the rest of the memory unchanged so information about past locations persists.
    • The policy was trained end-to-end with PPO together with a maze reconstruction loss, where an auxiliary head predicts the maze wall layout from memory features.
    • On 100 unseen evaluation mazes, all architectures reached a comparable coverage of 65.4 to 82.8 %, so pure exploration performance alone did not require a spatial memory.
    • On maze reconstruction error, LSMM was the only architecture that significantly reduced it while exploring, from 0.33 to 0.1, more than three times lower than any baseline.
    • As limitations, the memory covers a fixed area sized to the maze, and the update depends on an external position estimate, since the position is not yet estimated from onboard sensing alone.
  3. 1391Agents / MemoryarXiv:2610.36967

    Proactive Memory for Event-Driven LLM Agents

    • ProactMem stored memory in three layers: recent events, temporal trajectories, and behavioral regularities.
    • After an LLM extracts daily trajectories, facts are validated against source events, and regularities get confidence scores through historical replay.
    • The authors built ProactiveStream, a longitudinal event-stream benchmark across Sports, Home, and Code, containing 17 isolated streams, 4,539 events, and 729 reference interventions.
    • ProactMem recorded an overall effectiveness (F1) of 52.6%, a 21.4% relative improvement over the strongest of five external baselines.
    • In ablations, adding trajectory memory raised effectiveness in every scope, while removing replay validation or trajectory validation lowered both relevance and effectiveness.
    • As limitations, the authors state that evaluation covers low-risk service settings under a protocol fixed in advance, and that recipient benefit and deployment safety require future measurement.
  4. 1390Reasoning / SurveyarXiv:2610.40191

    Video Generation Meets Agent Harness: Agentic Video Generation, Agentic World Modeling and Recursive Self-Improvement

    • The report defines the agent harness as the executable runtime that constructs context, exposes tools, maintains state, routes feedback, and enforces budgets, and applies it across video generation.
    • In agentic video generation, the survey organizes how harnesses coordinate script and shot planning, asset management, shot production, editing, and watermarking around shared project state.
    • In agentic world modeling, it analyzes designs such as an executable game harness where a lightweight game engine maintains the world state and an autoregressive video model renders the resulting frames.
    • It reports real-time cases including a compute-side rate of about 32 frames per second on one H100 and a system with 112 milliseconds from key press to display.
    • On recursive self-improvement, it separates revisions of the current output from updates to harness state, generator parameters, and the development procedure itself, and states that no surveyed system yet revises the procedure that trains and validates the generator.
    • Open challenges include autonomous video production, lifelong memory, hybrid code-pixel generation, human-free model development, and provenance and cost accounting.
  5. 1389AgentsarXiv:2610.38546

    Implicit Minor Detection from Multi-Turn Dialogue in High-Risk AI Interactions: A Constrained Self-Evolving LLM Harness

    • This paper formulates the task of estimating whether the current speaker is likely a minor from weak cues across multiple turns, without strong identity signals such as accounts or faces.
    • The authors propose a constrained framework of a fixed LLM, a versioned Harness, and a Maker-Checker protocol, where the Harness controls when inference is invoked, how evidence is represented, and how outputs are validated.
    • Every decisive claim must rest on a short quotation or near-verbatim span locatable in the current dialogue, and mentions of other people or quoted material cannot support a claim about the current speaker.
    • Harness evolution promotes a candidate only when it passes admission constraints on validation data and otherwise retains the incumbent, preventing regressions that damage previously correct cases.
    • On a Chinese benchmark of 8,328 multi-turn dialogues, the method improves average precision by 7.60 points and minor-class F1 by 6.37 points over direct inference with the same LLM family.
    • In a 50-participant challenge study, human mean accuracy was 72.6% but fell to 54.8% on Boundary items, showing that difficult cases remain disputed even among humans.
  6. 1388Reasoning / RLarXiv:2610.38391

    SCOPE: Selective Critical-Step On-Policy Self-Distillation for Agentic Reinforcement Learning

    • In annotated WebShop trajectories, the authors found an outcome-step mismatch: 29.8% of steps in successful trajectories are erroneous and 42.4% of steps in failed trajectories are correct.
    • Distilling trajectory-level skills across all steps produces off-target signals at unrelated steps, which account for 57.9% of nonzero sampled-token gaps.
    • SCOPE first learns error localization and step-specific skill generation through a supervised warm-up, then during online RL analyzes its own trajectories and applies distillation only at selected error steps.
    • A bounded signed distillation coefficient prevents extreme teacher-student gaps from destabilizing training, blocking the collapse that occurred when the training-stage gap reached 2715.5 nats.
    • With Qwen2.5-3B, SCOPE records 97.7% success on ALFWorld and 85.2% on WebShop, outperforming SEED by 5.9 and 6.3 percentage points respectively.
    • On unseen ALFWorld tasks it reaches 89.6% success, 23.2 points above GRPO with 46.7% fewer interactions, and scaling to Qwen3-32B yields 99.2% success with mean steps of 7.7.
  7. 1387AI AgentsarXiv:2610.40578

    VeriCUA: Verification as Agentic Exploration for Computer-Using Agents

    • The verifier first inspects the available environment or recording to gather context, then builds a fine-grained rubric for the instruction and selects GUI or code checks for each requirement.
    • It labels evidence as attested or asserted sources, so the executing agent's completion claim alone cannot mark a requirement as met.
    • In the online AndroidWorld environment it achieves the highest accuracy of 90.5% and the lowest false positive rate of 7.7% among the compared baselines.
    • In offline verification it reaches accuracy of 70.4 on OSReward-Hard, ahead of all compared judges, with a larger gap on hard cases.
    • Adding code-based state reads raises the decision rate and recall with false positives unchanged, and adding a visual inspection pass lifts both agreement and decision rate to 87%.
    • It rejects about 80% of false completion reports across the three online environments, with the largest difference on ScienceBoard.
  8. 1386AI AgentsarXiv:2610.39884

    KARMA: Training-Free Knowledge-Atomic Harness Evolution for Industrial Advertising Agents

    • It splits knowledge into six modules of role, domain, experience, constraints, output protocol, and action descriptions, and allows at most three atomic mutations per cycle.
    • A deterministic verifier maps failures to candidate modules by error class and protocol codes, and a Critic compares failed and successful trajectories together to propose edits.
    • When the validation gain falls below the θ = 0.01 threshold, the full pre-edit knowledge snapshot is restored to prevent regressions.
    • Across 18 domain–model settings, it raises the average hold-out score from 30.19 to 39.15, a gain of 8.96 points, or 29.7%.
    • Removing either the successful or failed trajectory channel more than halves the average hold-out gain.
    • Knowledge evolved on one domain transfers to other domains without further adaptation, yielding an average gain of 8.54 points across the 30 source–target pairs.
  9. 1385AI AgentsarXiv:2610.39324

    MRC-MMAgent: Reinforcement Learning for Multi-Role Collaboration in Multimodal Tool-Using Agents

    • It places solving, inspection, and continuation roles in one executable agent loop, where the inspector judges evidential support of the answer and either finalizes or resumes solving.
    • It combines task success, interaction validity, and successful correction into one trajectory reward with weights (λacc, λfmt, λcorr) = (0.7, 0.1, 0.2).
    • Full-trajectory GRPO propagates the combined reward to every role decision, avoiding the post-hoc role-attribution bias that role-selective masking introduces.
    • Using only the MMSearch-R1 training set, it improves upon the base model by 11.1 points and reaches an average of 68.1 with the 8B model, leading same-scale systems.
    • On image reasoning benchmarks it achieves the best V* Bench score of 93.2 and HR-Bench 8K score of 78.5, gaining +6.8 on V* Bench and +3.9 on HR-Bench 8K over the base model.
    • Without inspector training, 98.3% of trajectories are marked for continuation causing unnecessary revisions; training reduces the continue rate to 60.4% and raises accuracy from 62.7 to 64.0.
  10. 1384RoboticsarXiv:2610.40565

    Gym-Anything for Robotics: Scaling physical simulations with digital agents

    • The authors decomposed occupations and everyday activities from U.S. GDP data into atomic physical actions, selected 120 action groups, and had coding agents build 25 of those simulations.
    • A creation agent and four audit agents ran a creation-audit loop for three rounds to verify simulation quality by catching physics errors and exploits.
    • The resulting RoboWorld covers 25 simulations with 25 test environments and 175 training RL environments, supporting swappable robots and scene variations.
    • All three frontier models scored 0% success on the 25 test tasks with a best average reward of 0.06, while Claude Opus 5.5 achieved a 32% success rate on an easier subset of 25 tasks.
    • A code policy reading privileged state succeeded on 96.7% of 2,048 varied initial states, and π0.5 trained on 1,000 of its demonstrations rose from 0% to 53% success on two tasks and 55% on unseen variations.
    • As a limitation, success drops as the robot's degrees of freedom increase, and the two GPT models earned no reward at all on humanoid tasks.
  11. 1383Research AgentsarXiv:2610.39714

    MoLRSI: A Recursive Self-Improving AI agent for Molecular Discovery

    • MolRSI converts scientific papers and code into validated executable skills, and uses experience-guided Monte Carlo tree search (MCTS) to assemble and refine workflows.
    • It stores workflow performance, refinement outcomes, and execution records from 25 source tasks in persistent memory to recursively improve the search policy for later tasks.
    • In virtual antibiotic screening, 17 of 107 compounds showed antibacterial activity with MICs of 32µg/mL or lower, and the experimental hit rate of 15.9% exceeded the 8.7% of the previous expert-driven workflow.
    • In de novo peptide-MHC binder design, it produced 8 experimental hits in total, 5 for MART-1 and 3 for SARS-CoV-1, whereas Claude Science produced no hits under the same conditions.
    • The small-molecule resource library consists of 110 reusable skills (55 models, 48 methods, 7 tools), and the protein library consists of 65 skills.
    • As a limitation, the authors state that whether policy updates remain useful as biological targets and evaluation criteria change is an open question, and incorporating experimental outcomes into policy updates is future work.
  12. 1382LLMs / NLParXiv:2610.38095

    Nemotron 3.5 Super and Lightning: Open, Efficient Mixture-of-Experts Hybrid Mamba-Transformer Models for Agentic AI

    • NVIDIA released Nemotron 3.5 Super, a 120B-parameter, 12B-active multimodal Mixture-of-Experts Hybrid Mamba-Transformer model, and Lightning, a 30B-parameter, 3B-active text model.
    • Both models went through a 100B-token MTP warm-up, 1 trillion tokens of distillation from a larger Nemotron model, and long-context training, while Super added Indic continued pretraining and agentic software-engineering mid-training.
    • The agentic mid-training raised DeepSWE pass@1 from 6.4% to 10.4% and SWE-bench Verified under the Codex harness from 48.4% to 61.8% under identical experimental SFT.
    • The post-trained Super model achieves 51.78% on SWE-bench Pro, surpassing Nemotron 3 Ultra with approximately 4.6× fewer active parameters, and parallel agent execution with self-verification improved Terminal-Bench 2.1 from 62.7% to 71.9%.
    • NVFP4 quantization achieves 99.62% median accuracy recovery relative to BF16 across 36 benchmarks, and MTP boosting improves speculative-decoding acceptance length by up to 21.8% under probabilistic draft sampling.
    • On a single GB200 GPU it produces up to 4,856 output tokens/s/GPU while sustaining at least 50 tokens/s/user, and NVFP4 delivers 2.43× the throughput of BF16 under the evaluated interactive agentic workload.
  13. 1381RoboticsarXiv:2610.36013

    OmniBrain-0: A Unified Agentic Model for Embodied Intelligence

    • OmniBrain-0 is a lightweight unified agent that ties manipulation and navigation to a shared high-level decision model handling task understanding, planning, progress tracking, and feedback-driven recovery.
    • On LIBERO-Pro it achieves 65.5% overall success with average completion time cut from 13.8 minutes to 1.6 minutes, an 8.6x speedup, and RSI raises success to 69.3%.
    • On RoboCasa365 it reaches 39.6% overall success, exceeding RLDX-1 at 36.0% and more than tripling the few-shot backbone's 12.2%.
    • On R2R-CE navigation it improves SR from 34.0% to 65.0% and reduces NE from 6.57 m to 3.78 m.
    • Relative to GPT-5.6-Sol, token usage is 4.5x, 2.6x, 3.5x, 12.7x, and 3.7x lower on the five benchmarks respectively.
    • On three real-world manipulation tasks it achieves a macro-average success rate of 73.3%, outperforming π0.5 at 58.3%.
  14. 1380RoboticsarXiv:2610.35385

    EmbodiedLab: Benchmarking Embodied Agents That Act to Know

    • EmbodiedLab runs 30 experiments in five disciplines on 14 apparatus platforms, giving the agent only the objective and the apparatus while it chooses its own procedure.
    • A run succeeds only if its result lies within the instrument tolerance, rests on readings recorded in the same episode, and leaves the bench in the state the task requires.
    • Evaluating six frontier models, the highest success rate at the lowest interface level T0 is 43.3% by Claude Opus 5.5, followed by GPT-6 Astra at 40.0%.
    • Acting on the apparatus, observing it, and restoring it account for 75% to 100% of every agent's failed runs, while at most 25% fail in reasoning from readings already in hand.
    • Adding perception and motion planning at T1 raises the success rate by at most 10 points, while manipulation skills at T2 raise the weaker agents by 10 to 27 points.
  15. 1379AgentsarXiv:2610.34450

    EvolveMAS: A Unified Self-Evolution Framework for Decentralized Multi-Agent Systems

    • EvolveMAS pairs each main agent with a dedicated MemoryAgent that maintains isolated Structured Memory outside the main agent's reasoning context.
    • Across five benchmarks and six evaluation configurations, EvolveMAS achieves a normalized average score of 77.2, exceeding the strongest setting-specific baseline by 9.7 points and Self-Memory by 7.7 points.
    • In the cooperative setting it records 83.0 on BBH and 97.0 on HumanEval, above the baselines of 79.0 and 95.7 respectively.
    • In the adversarial Werewolf audit it achieves a wolf deception success of 70.0, exceeding the best competing method by 13 points.
    • In the LLM-Deliberation ablation, an external MemoryAgent raises the unanimity rate from 24.0% to 74.0%, and cross-episode Knowledge raises it further to 86.0%.
    • Memory governance keeps context occupancy at 0.62% at episode 7, lower than the 6.54% of carrying raw interaction histories.
  16. 1378AI AgentsarXiv:2610.37228

    AutoRSE: Evaluating LLM Agents as Recommendation Engineers for Self-Evolving Recommender Systems

    • The authors built AutoRSE, an evaluation framework spanning six representative industrial-grade recommendation tasks, where in each task the agent receives a faithfully reproduced state-of-the-art algorithm, one H200 GPU, and a 12-hour optimization budget.
    • Across 42 evaluated settings of three frontier LLMs and three harnesses in seven combinations, agents outperformed the baselines in 35 cases, achieving a mean relative improvement of 16.1% across all tasks and configurations.
    • Trajectory analysis of 4425 segmented experiments showed engineering optimizations accounted for 91.7%, dominated by Model Ensemble at 59.0% and Parameter Tuning at 26.2%, while algorithmic innovations were only 8.3%.
    • Final submitted algorithms achieved a modest average novelty score of 2.42 out of 4.0, and higher novelty correlated strongly with larger gains at Pearson r = 0.79.
    • Injecting ideas from frontier research and human experts beat self-generated ideas by 13.35% in average improvement and 0.58 points in novelty, confirming that idea generation is the bottleneck.
    • Agents achieved an average gain of 29.2% on generative recommendation tasks compared to 3.1% on CTR prediction, so less saturated baselines left more room for agent gains.
  17. 1377Reasoning / RLarXiv:2610.35497

    When Fine-Grained Credit Assignment Helps and Hurts: Multimodal Agentic Reinforcement Learning through Video Editing

    • The authors built 797 editing tasks of four types, Content Selection, Narrative Sequencing, Rough Cut, and Fine Cut, from 49 real films and their released trailers.
    • Training Qwen3.5-9B with outcome-only GRPO raised the overall score from 0.284 to 0.413, so outcome rewards alone stayed competitive on the shorter-horizon tasks.
    • GRPO+PRM with a fixed process-reward weight scored only 0.334 overall with 44.1% truncated rollouts, showing reward hacking where process rewards kept rising while task completion rates and outcome scores declined.
    • Decaying the process-reward weight to zero between updates 20 and 30 gave the best overall score of 0.447 and cut the truncation rate to 6.2%, mitigating the hacking while preserving early gains.
    • On the longest Fine Cut tasks, decaying process rewards delivered a 45.4% relative gain over outcome-only GRPO, while on the three shorter-horizon task types the relative gain was at most 10.4%.
    • On-policy self-distillation (OPSD), a token-level signal, scored 0.277 with reference answers and collapsed to 0.044 with turn-level suggestions, showing that dense supervision alone does not guarantee effective learning.
  18. 1376AI AgentsarXiv:2610.35316

    RSIV-Harness: A Recursive Self-Improvement Harness Framework for Open-Domain Conversational Text-to-Visualization

    • The paper defines the problem: when users request charts without knowing which database holds the data, the agent must discover sources, ask clarifying questions, and refine charts under earlier constraints, yet existing harnesses are authored once and never revised, so the same failures recur.
    • The ODAC-Vis benchmark contains 640 dialogue tasks and jointly evaluates open-domain source discovery, ambiguity resolution, and multi-turn chart refinement.
    • RSIV-Harness keeps the model weights fixed: an inner loop solves tasks, an outer loop reads failure traces and proposes harness revisions, and only revisions passing the anchor and memory checks are accepted.
    • A single round of self-improvement raised all six metrics, with executability improving by 28.02 points and chart structure by 34.01 points.
    • Removing the stability rules degraded all six metrics, with executability dropping by 9.73 points.
    • The harness evolved with DeepSeek transferred to GPT-6 Luna and improved five of six metrics over the static harness, showing that harness improvements transfer across backbones.
  19. 1375ReasoningarXiv:2610.35598

    Evolve on Graph: Self-Evolving Knowledge Graph Reasoning without Question Annotations

    • The authors proposed EoG, a framework that improves LLM graph reasoning using only the knowledge graph itself, without question annotations.
    • A single LLM alternates between a Proposer that poses questions and a Solver that answers them through graph self-play.
    • SVTS executes first-order logic queries on the graph to build training tasks with complete and correct answer sets.
    • A boundary-aware curriculum rewards the Proposer by the Solver's score variance, keeping task difficulty on the Solver's capability boundary.
    • With Qwen-2.5-7B, EoG exceeded the strongest baseline by 7.46 points in average Hit@1 and by 17.80 points on the industrial KG.
    • The synthesized training questions barely overlapped with test questions, so the gains did not come from test-set leakage.
  20. 1374RAG / AgentsarXiv:2610.35054

    From Questions to Queries to Insights: A Schema-Grounded Agentic Workflow for Natural-Language Crash Data Analysis

    • The authors proposed CrashDB-QA, a fully local, schema-grounded agentic workflow that enables natural-language analysis of crash databases.
    • A shared knowledge base grounds query construction in the agency's data dictionary and safety-analysis conventions, while recorded intermediate outputs support inspection and auditing.
    • They evaluated the workflow on a frozen snapshot of 4.4 million Wisconsin crash records using a benchmark of 300 questions and 9 local open-weight models.
    • A code-specialized 7B model reached 80.7% accuracy at a median latency of 9.2 s, the best accuracy-latency balance among the tested models.
    • Comparisons between groups or periods stayed hard, and no model exceeded 43.3% on them.
    • When the Judge used authoritative field definitions and the Refiner received execution evidence, accuracy rose to 83.7%.
  21. 1373AI / AgentsarXiv:2610.34121

    BE-CTDE: Blockchain-Enabled Multi-Agent Reinforcement Learning with Anomaly Detection and Token Economics

    • The authors proposed BE-CTDE, which turns blockchain from a passive record into an active training-management layer where behavioral evidence changes learning influence.
    • A behavioral verifier compares executed trajectories with shared-policy recommendations, and its flags drive a token mechanism combining slashing, burning, rewards, and compensation.
    • They showed perfect detection is unnecessary: with conditional detection probability above 1/3, an adversary is excluded from training in finite expected time.
    • In multi-agent path finding experiments, success rates under attack were substantially higher than the state-of-the-art SCRIMP planner, even with an adversarial majority.
    • Collision rates were up to 35% lower than detection without economic consequences and up to 43% lower than conventional stake slashing, and the 8-agent setting reached 100% success rate at every obstacle density.
  22. 1372Reasoning / EfficiencyarXiv:2610.28577

    Cache Engineering for Agents

    • The authors measured that KV cache reads take up 82.4% of the total API cost on long trajectories.
    • Cache engineering uses drop to exclude selected cache from future attention and repos to adjust retained keys’ position encodings.
    • The default policy is a tool-response rolling-drop that retains the KV states of the latest 12 tool responses.
    • This policy improves average benchmark scores by 1.7 points and reduces average cost by 27.7% compared with threshold-triggered summarization.
    • With the AKV server, it achieves up to 1.2× the output throughput and a 1.5× speedup in P95 request latency.
    • Recursive self-improvement of cache policies further reduces cost by 7.1% over expert design.
  23. 1371RoboticsarXiv:2610.27039

    Embodied Playground: A Long-Horizon Agentic Robotics Benchmark for Physical, Strategic, and Spatial Reasoning

    • The playground comprises 410 task environments spanning basic manipulation, sequential puzzles, and multi-stage household activities.
    • The authors curated EP-100, a representative selection of 100 tasks across five suites and 16 task types, together with the EP-Easy and EP-Hard difficulty splits and the compact EP-20 selection.
    • GPT-6-Astra achieves 13.80% Pass@1 and 19.94% Pass@2 on EP-100.
    • Opus-5.5-extra achieves 29.22% Pass@1 and 35.85% Pass@2 on the same evaluation.
    • For GPT-6-Astra, EP-Easy reaches 18.42% Pass@1 and 27.41% Pass@2, compared with 8.81% and 12.01% on EP-Hard.
    • The audit identifies incomplete rule or threshold disclosure affecting 574 of the 645 scored failures (88.99%).
  24. 1370AI AgentsarXiv:2610.25858

    Are Self-Evolving Agents Continual Learners?

    • The authors built four task streams that shift in topic, workflow, or environment, and tested ReasoningBank, GEPA, and Meta-Harness.
    • On average, self-evolution raised scores, with terminal advantage of +3.7 for GEPA, +2.5 for ReasoningBank, and +1.4 for Meta-Harness.
    • GEPA rewrote a single shared prompt, giving the highest plasticity but the largest average stability loss of −4.3.
    • ReasoningBank localized updates through memory retrieval and achieved the best average stability of −1.9, at the cost of +3.3 plasticity.
    • When similar queries required conflicting workflows, retrieval collision made 52% of BFCL-Miss episodes retrieve memories of the opposite workflow at the end of workflow drift.
    • The authors conclude that current self-evolving agents remain incomplete continual learners and call for mechanisms that isolate task-specific updates and condition retrieval beyond surface similarity.
  25. 1369RoboticsarXiv:2610.28589

    AgenticRoboRL: Bringing Coding-Agent Post-Training to Agentic Robotics

    • It combined supervised fine-tuning with multi-turn reinforcement learning to train only the robot planner while keeping the VLA execution components fixed.
    • Harness-specific adapters connect recorded planner calls with episode outcomes, so a single training pipeline supports both VLA skill invocation and control-code generation.
    • On LIBERO-PRO, SFT raised the 9B planner's success rate from 18.1% to 65.1%, and RL further raised it to 71.0%.
    • On the 10,030 LIBERO-Plus evaluations unseen in training, the same checkpoint improved from 19.2% to 72.2%.
    • With the CaP-X harness, it improved the success rate from 2.7% to 28.5%, exceeding the 27B teacher's 20.3%.
    • The RL reward used only task success, with no intermediate rewards or a length penalty.
  26. 1368Computer VisionarXiv:2610.28560

    Agentic Ensemble with Vision-Language Models for Visual Anomaly Detection

    • It normalized the scores and anomaly maps of fixed pretrained detectors and summarized disagreement statistics into a structured evidence state.
    • Only samples whose conflict score exceeded the threshold τ = 0.5 invoked the VLM, while the rest kept the deterministic preliminary fusion result.
    • The VLM was constrained to select one image-score action and one map action from predefined actions such as consensus, robust aggregation, detector weighting, and disagreement correction, so it cannot freely generate a new mask.
    • On MVTec AD and VisA it achieved the best mean image AUROC and pixel AP among the compared fusion methods.
    • On the large-scale Real-IAD evaluation it improved image AUROC/AP/F1 from 72.47/58.85/59.66 to 75.53/62.54/62.49.
    • It used LLaVA-7B as the VLM backend, adding only 489 VLM calls in the main experiments and 1286 calls in the transfer experiments.
  27. 1367RAG / AgentsarXiv:2610.28010

    RANGER: Retrieval Agent for Navigating Graphs with Semantic Evaluation Rewards

    • The LLM served as a mentor and evaluated the semantic relevance of paths found by the RL agent as Success, Highly Relevant, or Failure, giving rewards of 1, 0.5, and 0 respectively.
    • A Transformer-based policy agent trained with GRPO directly navigates the knowledge graph and gathers triplets needed for the query.
    • In standalone retrieval on HotpotQA, RANGER with the LLM reward improved the LLM-as-a-Judge score by approximately 3.6% over WaterCircles and by approximately 3.0% over GRPO with the heuristic reward.
    • In hybrid retrieval, it improved the LLM Judge score over WaterCircles by approximately 20.4% on HotpotQA, 4.4% on TriviaQA, and 7.7% on DiaASQ.
    • Reducing the mentor LLM from Mistral Small 3.2 (24B) to Ministral 3 (8B) dropped performance below the WaterCircles baseline.
    • The agent was trained in a self-supervised manner by automatically generating question-answer pairs from the knowledge graph itself, without human-labeled data.
  28. 1366RAG / AgentsarXiv:2610.30435

    Self-Assessment Reinforcement Learning for Search-State Awareness in Retrieval-Augmented Large Language Models

    • When a search agent fails to recognize what information it has obtained and what is still missing, two failure modes appear: hallucinated reasoning and prematurely terminated search.
    • SARL appends a self-assessment phase after the think-search-answer loop, so the model re-examines its own trajectory in an isolated context and judges whether it is complete.
    • The model is trained with a dual reward that rewards assessments by whether they corrected the answer and adds an exponential penalty for repeated reliance on assessment.
    • Across ten benchmarks SARL scored 0.429 on average, a 24.3% relative improvement over the strongest baseline (ASearcher 0.345), with average gains of 35.9% on multi-hop reasoning and 27.9% on deep research.
    • It recorded peak improvements of 58.1% on Musique and 48.3% on FRAMES, showing transfer to tasks left out of training.
    • Under extended search horizons of up to 32 turns, existing methods degraded during training while SARL maintained stability.
  29. 1365AI / AgentsarXiv:2610.27465

    Recoverability and Verifier Strength: Two Measured Preconditions for Unattended Agent Self-Improvement

    • The authors define two measured quantities, verifier strength and recoverability, and propose a rule that deploys a change without human sign-off only when both are adequate.
    • The platform's LLM judge gave the same score regardless of input in 9 of 37 settings, failing silently with no error.
    • Restoring a stored copy brought back the original behavior exactly, while a regenerated undo fell 0.16 below the restoration floor.
    • A deployed change altered the outcome of 17% of tasks beyond the noise floor, and no rollback repairs that reach.
    • The platform applying the rule allows prompt, tool and skill edits to run unattended and keeps weight updates under human sign-off.
    • Controlled experiments with prompt edits on the τ 2-bench agent benchmark supported the rule's assumptions.
  30. 1364Software EngineeringarXiv:2610.31351

    Automating Feature Flag Cleanup at Scale with Multi-Agent LLM Systems: An Industrial Experience at DoorDash

    • DoorDash has over 56,000 feature flags across approximately 623 repositories with 1,659 currently stale, and the authors estimate one to two hours per manual cleanup.
    • The orchestrator agent processed Jira tickets, queried the experimentation platform via MCP for the live rollout state to determine the target value, and after a human checkpoint spawned removal agents that edited code in parallel in git worktrees.
    • Of the 50 evaluated flags, 31 (62%) were accepted in the first shot, 14 (28%) after minor revisions, and 5 (10%) failed, for an overall success rate of 45/50 (90%).
    • The average time per cleanup was 13.8 minutes and the average LLM API cost was $4.79, and even complex flags reached an 85% (22/26) cleanup rate.
    • Each removal agent could create a PR only after passing 95% patch coverage and the Detekt linter, and across all 50 removals no bugs or regressions were introduced by the changed code.
    • The common cause of the 5 failures was incomplete removal of dead code in deep call chains, and the authors located the reliability boundary in completeness rather than correctness.
  31. 1363Research AgentsarXiv:2610.30851

    ADAPT for Science: A Multi-Agent System for Self-Evolving Scientific Optimization

    • ADAPT split scientific optimization into two decisions: it retrieved 64 candidate initializations from a library of 15,409 historical designs to decide where to search, and evolved the optimization procedure from execution feedback to decide how to search.
    • Through evolution, the start-selection stage discovered a progressive 64 →8 →2 →1 budget allocation and reduced the selection policy's mean loss to 3.0054.
    • The optimizer-evolution stage kept the Adam structure but scaled each update by s(r) = 0.05 + 0.95r2 according to the remaining budget and skipped non-finite evaluations.
    • On eight unseen topologies ADAPT achieved a mean loss of 0.204±0.101, reducing loss by 54.9% versus the strongest classical optimizer and by 62.2% versus the strongest general-purpose agentic evolution baseline.
    • In a representative case, standard Adam reached a loss of 0.666 and ADAPT reached 0.155, a 76.7% reduction.
    • The authors state the limitation that the study focuses on gravitational-wave detector design and depends on the quality and coverage of the experience library.
  32. 1362Agents / MemoryarXiv:2610.29249

    MOSAIC: An Omni-Modal Benchmark for Long-Term Memory and Cross-Modal Reasoning in Conversational Agents

    • MOSAIC is a benchmark of 923 questions (784 answerable and 139 refusal controls) over 11–24-session conversational histories spanning text, image, video, and audio.
    • The evaluation splits the pipeline into WRITE, RETRIEVE, DELIVER, and READ stages and changes one stage at a time while freezing the question, reader, prompt, and budget for paired comparison.
    • Gold symbolic facts scored 0.846, leaving 15.4 points of residual reading error; gold native evidence dropped to 0.783 and generic captions and ASR text to 0.690.
    • Retrieval cost 7.6 points and production packing caps cost another 3.8 points on identical ranked hits, with the full pipeline reaching 0.653.
    • By modality, video dropped 17.1 points from gold symbolic facts to native video, making perception the largest candidate bottleneck, and on spatial-configuration items raw images beat OCR-only text by 32.0 points.
    • Tighter media budgets collapsed complete-chain delivery from 0.675 to 0.184, and no system answered well and abstained precisely at the same time.
  33. 1361RoboticsarXiv:2610.30043

    TARSphere: A Robot-Oriented Full-Stack Framework for Long-Horizon Embodied Agents in Evolving Physical and Social Environments

    • TARSphere-Infra is the execution infrastructure that runs robot policies in a physics simulator together with embodied NPCs and constrained dialogue.
    • TARSphere-Harness is the embodied brain harness that lets a frozen MLLM revise decisions using multi-level executable skills, hierarchical memory, and execution feedback.
    • Agent-in-the-loop curation built TARSphere-Bench with 360 episodes across 30 indoor scenes, and five paired conditions assessed perceptual robustness, disruption adaptation, task update, human coordination, and intent understanding.
    • Across 8 MLLMs, general-purpose models can outperform embodied models, and Gemini-3.8-Flash achieved 40.6% navigation and 47.8% delivery success.
    • Across model-task groups, collisions occur in 84-100% of episodes and falls in 9-47%, motivating evaluation of execution safety alongside task success.
    • The full curation pipeline yielded 96.7% usable episodes, and removing multi-agent review dropped this to 45.0%, the largest decline.
  34. 1360RoboticsarXiv:2610.29560

    From VLM Planners to Robotic Agents: Self-Evolving Harnesses for History-Dependent Manipulation

    • SERA wraps the high-level VLM planner in an editable harness that maintains and updates task context using observations and execution feedback.
    • Execution-driven self-evolution proposes revisions to planning guidance, assessment criteria, and control rules through environment rollouts and evaluates them with a verifier before harness selection.
    • Self-evolution proceeded without constructing an additional supervised fine-tuning dataset for the high-level VLM.
    • On the 16 RoboMME tasks, SERA with autonomous selection achieved 51.38% overall success, 7.00 percentage points higher than the 44.38% without self-evolution.
    • SERA scored 69.50 on Reference, 57.00 on Permanence, 49.00 on Counting, and 30.00 on Imitation, obtaining the highest scores on Reference and Permanence.
    • The authors note that VLM reasoning introduces planning latency into the execution loop, which accumulates during long-horizon execution as a limitation.
  35. 1359Distributed SystemsarXiv:2610.28702

    Multi-agent LLMs on the Cloud-Edge-IoT Continuum: A Systematic Mapping Study on Architectures, Deployment, and Evaluation

    • From 831 records, the authors selected 45 primary studies and classified them by architecture family, deployment pattern, application domain, and evaluation practice.
    • Five architecture families recur in the corpus, and deployment spans 6 patterns, ranging from local-only execution to control loops gated by policy checks or human approval.
    • 24 of the 45 studies address IoT, industrial, smart-home, healthcare, vehicular, or robotics settings, 29 evaluate on physical hardware, and open models below 8B parameters dominate that hardware.
    • Only 6 studies release code or data, and only 15 of the 45 report ablation experiments.
    • Privacy motivates many local designs, but privacy is directly measured in only 2 studies.
    • The authors provide a reporting checklist asking studies to report task, continuum, state, and governance conditions together with outcomes for comparability.
  36. 1358Agents / MemoryarXiv:2610.27714

    When Does Experience Memory Help Closed-Loop LLM Driving Agents? A Controlled Evaluation with Resampled Warmup Pools, Token-Matched Fillers, and Audited Baselines

    • The authors froze the planner, encoder, and protocol, resampled the warmup pool as ten disjoint draws, and added token-matched controls to build a controlled evaluation framework.
    • Each retrieval memory exceeded No-Memory in exactly one pool of ten (exact sign test p = 0.011), and the pool-averaged effect of adding memory was negative at −0.20.
    • A token-matched irrelevant-filler control scored 0.800 on the merge task, significantly above both memories, and a single 15-token caution instruction reached 0.980.
    • The temporal-graph memory TG-Mem was indistinguishable from flat text memory (p=1.0) while using 1,038 prompt tokens per decision against 210 to 274.
    • Baseline port quality silently inverted conclusions: a subtly crippled DiLu port scored 0.375 against 0.670 for the audited port under the same conditions.
    • As a limitation, every decisive contrast came from HighwayEnv with gpt-4o-mini and the 1 Hz decision cadence, a weak-planner regime.
  37. 1357AI AgentsarXiv:2610.27495

    Self-Evolving Agents through Privileged Retrospective Distillation

    • RSD, without ground-truth trajectories or verifier rewards, has the same model re-score its own actions under privileged retrospective context and distills the resulting distribution back into the policy.
    • The privileged context combines four components: precedents and lessons from accumulated experience, plus reflection and future hindsight available only after the current trajectory ends.
    • With Qwen3-8B and 14B across three benchmarks, RSD improved performance by up to 59.7% relative over the base model, and frontier-guided context-policy evolution added up to a further 44.7% relative improvement over a fixed context policy.
    • On ALFWorld-8B, RSD achieved an average SR of 76.6 against 62.9 for Base, and on ScienceWorld it improved from 15.6 to 23.4 at 8B and from 12.9 to 20.6 at 14B.
    • Frontier-guided context-policy evolution improved ScienceWorld SR from 23.4 to 27.5 at 8B and from 20.6 to 29.8 at 14B, and outperformed random search at both scales.
    • As a boundary case, SearchQA stayed within a narrow performance band across rounds.
  38. 1356RAG / AgentsarXiv:2610.25096

    Toward Agentic Retrieval-Augmented Generation for Enterprise Retail Workflows over Heterogeneous Data Sources

    • A recursive composition pipeline built 1,680 multi-source queries across three difficulty levels on top of a retail database created from simulated seller-buyer interactions.
    • A domain expert with over ten years of experience of over 10 years marked 90% of the queries as questions a seller-side analyst would ask in practice, including 97.5% at Level-1, 90.0% at Level-2, and 82.5% at Level-3.
    • RetailRAG reached an average LLM-judge score of 0.429, above 0.293 for the strongest baseline HetaRAG, while using 7.45 API calls per query against HetaRAG's 25.21.
    • Among ten LLM backbones, even the strongest Qwen3.6-Plus and GPT-5.4 reached only 0.511 and 0.508 average LLM-judge scores, leaving RetailBridge unsolved.
    • Every backbone lost about half or more of its Level-1 performance by Level-3, and Text-only queries collapsed the steepest, making dense text retrieval the dominant modality bottleneck.
  39. 1355AI AgentsarXiv:2610.25926

    MIRA: A Multimodal Illustrated Deep Research Agent for Controllable Reports

    • MIRA-Harness turns user requirements into a generation contract that sets acceptance conditions on report length, image composition, and evidence grounding, and connects four stages: evidence collection, report submission, feedback-driven revision, and final delivery.
    • Enabling the report gate raised fully compliant reports from 0 out of 32 to 25 out of 32 and increased the proportion of cited images from 23.5% to 92.6%.
    • The authors built MIRA-Data from about 4.6K Harness-Native trajectories generated by Kimi K2.6 inside MIRA-Harness and verified by a synthesis gate, combined with 33K general search trajectories.
    • MIRA-SFT, trained on MIRA-Data, improved over MIRA-Base with the same backbone by 5.50 points on average across eight benchmarks, including 10.80 points on VDR-Bench and 9.33 points on FVQA.
    • MIRA-SFT achieved the best results among the compared open agents on 7 of 8 benchmarks and surpassed the much larger Qwen3.5-397B-A17B on six benchmarks.
    • As limitations, the authors note that transient API errors and parsing failures from external search infrastructure can interrupt evidence collection, and hallucinations may arise when the agent misreads retrieved content or makes weakly supported claims.
  40. 1354Agents / MemoryarXiv:2610.25119

    Memory as Belief: Bayesian Evolution of Memory for Self-Evolving LLM Agents

    • BEAM represents memory value as a context-conditioned Beta belief Beta(α, β) and predicts that belief with a lightweight LoRA-adapted estimator while keeping the backbone frozen.
    • Using execution feedback as evidence, it computes per-memory marginal contribution through leave-one-out counterfactual evaluation and trains the estimator online with an evidential objective, a pairwise ranking loss, and a selective Beta-KL regularizer.
    • Thompson sampling draws utility scores from the belief, giving memories with limited evidence more opportunities for exploration.
    • BEAM achieves the best average performance under both executors, surpassing the strongest baselines by 3.93 and 2.43 percentage points, respectively.
    • Across stages of the task stream, BEAM generally achieves larger gains over the no-memory baseline as the stream progresses, showing continual self-evolution.
    • Transferring the value model learned on MATH-500 to AIME yields a clear early-stage advantage and the best stream-level average performance.
  41. 1353Research AgentsarXiv:2610.24944

    Epi: Towards a Persistent, Self-Improving Agent for Autonomous Research

    • Épi combines hierarchical memory, versioned branches with backtracking, and independent review to sustain investigations across model sessions and evolve its methods.
    • Épi produced 120 record-setting results, comprising 20 numerical bound records across 12 families and 100 construction records across eight families.
    • The interval for the n-queens constant became approximately 84-fold narrower, and the rigorous interval for the quartic Feigenbaum attractor dimension became more than 3.6-million-fold narrower.
    • Exact dual certificates establish that the Cohn–Elkies linear-programming bound cannot be sharp in dimensions 10 and 11.
    • Épi gives a computer-assisted proof of Tuza's conjecture for split graphs with an eight-vertex clique part and at most three triangle-active neighborhood types.
    • The lightweight configuration Épi-turbo achieves a 5.4% higher total benchmark score than Codex on 30 FrontierOR tasks at 64% of its model cost.
  42. 1352AI AgentsarXiv:2610.21327

    DocPilot: Interactive Agent Orchestration and Training for Long Visual Document Understanding

    • The researchers built DocPilot, a document agent framework that adaptively orchestrates six actions: page navigation, evidence extraction, local visual inspection, code-based reasoning, answer verification, and answering.
    • With frontier VLM backbones, DocPilot improves MMLongBench-Doc accuracy by 10.1, 14.7, 10.8, and 13.4 points depending on the backbone.
    • With curriculum-based training that moves from single-ability learning to orchestration learning, the 4B DocPilot-4B gains 4.2%, 7.5%, and 11.0% on the three benchmarks and competes with much larger models.
    • With Gemini-2.5-Pro, DocPilot surpasses the prior document agent DocLens by 72.8 over 67.6, and on DocBench it exceeds DocDancer with 84.1 over 79.9.
    • On the cross-document benchmark MADQA with GPT-5.4, DocPilot reaches 86.5 accuracy and records the best cross-document score of 89.5.
    • Removing the answer verification action drops accuracy from 73.5 to 64.9, confirming that verification is central to the orchestration.
  43. 1351Software EngineeringarXiv:2610.19298

    Verifier-Grounded Agentic RL for Provably Correct Code

    • The researchers built a reward that reads the verifier's diagnostics instead of its verdict, scoring a candidate by the weighted fraction of the instance's proof obligations it discharges.
    • An integrity audit outranks the verifier and rejects submissions that secretly weaken the specification or replace proofs with assumptions.
    • After training Qwen3 models from 1.7B to 14B and a 35B mixture-of-experts model, held-out verification on code generation rises from 66.1% to 93.5% on DafnyBench and from 56.3% to 100% on SWE-Proof.
    • A binary pass-or-fail reward trained under otherwise identical settings reaches only 71.0% on code generation, and a frozen proof specialist in the loop adds 4.8 points on DafnyBench.
    • When the agent must also deliver the repository patch, the fraction of held-out issues resolved rises from 59.6% to 72.5%.
    • Evaluated unchanged on three verification suites withheld from training, the checkpoints improve on all of them, including one whose language and verifier are absent from training.
  44. 1350AgentsarXiv:2610.18616

    Knowledge Graphs as Files: An Agent Harness Where Tool Creation and Tool Use Co-Evolve

    • The researchers exported the nodes and edges of knowledge graphs wholesale into files and built the DKGI harness, in which agents follow relations with Python code to gather evidence.
    • Training-free DKGI beat the strongest published baseline by at least 6.7 Hit@1 points on every graph of the STaRK benchmark.
    • Writing Python code over several turns raised overall Hit@1 by 6.9 points compared with using shell commands only.
    • The agent wrote 4.0 programs per query on average and reused earlier outputs to revise its code.
    • As a limitation, the evaluation covered only the three STaRK knowledge graphs, and scaling to larger graphs is left to future work.
  45. 1349LLMs / NLParXiv:2610.19906

    Beyond Benchmark Accuracy: A Diagnostic Test for LLM Chemical Prediction

    • The authors rebuilt six chemical prediction tasks so that the target molecule's name or SMILES is withheld and only the source structure and a natural-language edit description are provided.
    • In structure reconstruction validation, all four models recover every chiral target at 100% accuracy, with the overall range from 86.05% to 100%.
    • The label-consistent group, where source and target labels agree, scores better, and providing true source labels widens this gap in 22 of 24 model-task combinations.
    • Replacing only the source label with a false one flips 91.2% of Claude-Opus-4.8 binary predictions toward the false label, and in yield prediction 61.2% to 98.0% of predictions move in the same direction.
    • Adding tool evidence from NOSE and RDKit improves all five models on tasks with target-relevant evidence, while tasks with limited coverage show limited gains or even declines.
    • The authors conclude that high benchmark accuracy alone does not imply that LLMs possess reliable structure-property reasoning capabilities.
  46. 1348RoboticsarXiv:2610.18874

    ChunkAct: Action Chunking for Agentic Robotics

    • Prior agentic robotics runs one round of LLM reasoning per primitive, so a single pick-and-place task requires 24.2 LLM calls and 2.2M input tokens on average.
    • An analysis of the planner's tool calls shows that only 20.5% invoke an action primitive, while memory reads and perception account for 31.7% and 44.3%, respectively.
    • ChunkAct compiles memory into executable chunks per task type in advance, and at test time a single call launches a whole chunk that returns control only upon failure.
    • On the LIBERO-Pro benchmark it attains an overall success rate of 83.8%, the best result, while requiring 2.9× fewer LLM calls, 4.4× fewer input tokens, and 2.3× fewer output tokens.
    • Running the chunks under a scripted driver with no LLM call still reaches 57.5% success, showing that the planner's contribution concentrates on recovery from failure.
    • Applied unchanged to LIBERO-Plus with seven perturbation axes unseen during memory construction, it achieves an overall success rate of 83.9%, confirming zero-shot transfer.
  47. 1347Machine LearningarXiv:2610.18730

    Learning When to Transfer: Reinforcement Learning for Carbon-Footprint Modeling in New Manufacturing Domains

    • The authors ran 729 material-extrusion 3D printing experiments across five materials, ABS, PETG, TPU, PLA, and recycled PLA, to build per-part greenhouse-gas emission data.
    • Each experiment is described by 22 material, process, and toolpath features, and the per-part emission value combines measured fabrication electricity with polymer-specific cradle-to-gate production factors.
    • A reinforcement-learning policy assigns weights among individual source predictors, source subsets, fully pooled sources, and target-only alternatives, and a validation gate deploys the transferred prediction only when it improves upon the supervised alternatives.
    • In leave-one-material-out evaluation, the method achieves a mean test RMSE of 5.2 g.CO2e per part, 20.0% lower than target-only training.
    • When only 5–10% of the target training data are available the RMSE is 32.5% lower than target-only fitting, and the gated method shows a negative-transfer rate of 17% versus 49% for pooling.
    • As limitations, the authors state that the validation-based deployment heuristic does not guarantee lower test error and that the five-material sample limits inference beyond the evaluated materials.
  48. 1346Agents / MemoryarXiv:2610.19836

    EGCForest: Structured Agent Memory Organization for Enterprise Group Chats

    • The authors propose EGCForest, a framework that organizes enterprise group-chat logs into three complementary forests: Channel, Actor, and Artifact.
    • The three forests share one immutable message log, while a Placement Map and sparse Bridges create cross-view connections and preserve traceability to original messages.
    • Online retrieval runs in four stages of view-aware leaf recall, summary-guided supplementation, structural completion, and budget-aware assembly, requiring no LLM calls for retrieval.
    • Across three enterprise-chat benchmarks, EGCForest consistently outperforms RAG and memory-system baselines, improving answer accuracy by up to 20.85 points over MemOS.
    • On the internal Company data, the stage-wise contribution shows structural completion raising P@20 from 7.1 to 8.0 and accuracy from 47.9 to 53.3.
    • Retrieval latency is 65 ms per query, the fastest among compared methods, with a 206 MB storage footprint.
  49. 1345RoboticsarXiv:2610.19600

    Cracking Mobile Manipulation: From Failure Diagnosis to Agentic Robot System

    • A pretrained subtask VLA achieves 80% success on atomic tasks but only 19% when the skills are composed into mobile manipulation.
    • Analysis of 100 episodes shows the primary failures split into task planning 21.0%, navigation and base positioning 25.9%, and local manipulation 53.1%.
    • Keeping the policy fixed and adding demonstration-based planning guidance, adaptive visual memory, accessibility-aware base adjustment, and end-effector adjustment raises RoboCasa365 success from 19% to 47%.
    • On held-out episode seeds the finalized system reaches 49% against the 18% baseline, with a paired difference significant at p < 0.001.
    • On BEHAVIOR-1K performance improves from 14% to 37%, and on two real-robot tasks from 5/20 to 13/20.
    • As interventions are added, the remaining failures shift toward manipulation: 47 of the 53 full-system failures are manipulation failures.
  50. 1344AI AgentsarXiv:2610.19384

    MMA-SafetyBench: A Benchmark for Multimodal Agent Safety Evaluation

    • The authors name the failure mode in which plausible visual elements such as forged system alerts pull an agent away from its assigned task Visual Semantic Hijacking.
    • They built MMA-SafetyBench with 1,083 adversarial trajectories spanning web automation, desktop GUI, mobile navigation, document understanding, and video processing.
    • Across nine vision-language models, Attack Success Rate (ASR) reaches 87.96% and Semantic Compromise Rate (SCR) reaches 98.09%.
    • A GPT-5 judge matched the human reference label on 290 of 300 cases (96.67%), supporting scoring reliability.
    • With a Safety-Priority Prompt (SPP), average ASR over the 45 model-domain pairs falls from 55.20% to 19.54%, but residual failures remain substantial.
    • As limitations, coordinate-hit ASR can mistake grounding errors for robustness, and the study does not measure attack prevalence in deployment.