Wednesday’s cs.AI listing had 196 new submissions and cross-lists. This page keeps the 38 that are about agent systems: context assembly and memory, harnesses and skills, tool use and computer-use, persistent identity across runtimes, and local open-weight models aimed at that stack. Protein, medical, climate, quantum, generic eval, and vision-only papers are omitted.
ContextPipe treats prompt assembly as query planning and cuts token volume 31% and LLM calls 23% versus append-only construction on a SWE-bench Pro subset. CacheBridge is a training-free matched-head KV mapper that preserves 99.83% mean Qwen3 target retention while shrinking a 14B→32B mapper 8×. HarnessEvolve gates harness updates on leakage, bloat, and recent-batch regression. Defense-as-Skill / SkillSonar lowers GLM-5 attack success from 0.482 to 0.104 in-distribution and 0.606 to 0.115 out-of-distribution on Claude Code and OpenClaw. Harness-of-Harness reports a 52.25% average relative gain over standalone coding harnesses. Instella-MoE releases weights, data, and code for a 16B / 2.8B-active MoE trained on AMD GPUs. Eight papers have a figure extracted from the PDF or HTML.
Research Papers
ContextPipe: Database-Inspired Context Assembly for Long-Horizon Agents
Peng Xu; Zuyu Zhang; Yuze Sun et al. arXiv: 2609.00749
Context assembly is treated as query planning. ContextPipe runs a five-phase Plan–Bind–Optimize–Execute–Feedback pipeline with a structured data-source catalog, a deterministic cache-aware optimizer, and an EXPLAIN ANALYZE trace so each prompt is auditable and replayable. On the SWE-bench Pro Qutebrowser subset versus append-only construction, it cuts total token volume 31%, LLM calls 23%, and response time 9%, at the cost of a lower KV cache-hit ratio.
Key insight: Plan the next prompt against a catalog and a hard window; do not append history until the cache breaks.
CacheBridge: Efficient Cross-Model KV Cache Transfer
Xingyu Qu; Siyuan Lu; Zhiyu Chen et al. arXiv: 2609.00891
Sharing context across models usually means the receiver prefills the prefix because KV caches are model-specific. CacheBridge is a training-free affine mapper that matches each target head to a source head, weights reconstruction by causal attention sensitivity, and builds the mapper with a fused GPU kernel. It recovers two Ministral 3 transfer directions where full-head mapping loses substantial accuracy, preserves 99.83% mean target retention on Qwen3, and on Qwen3 14B→32B cuts mapper storage 8×, speeds application up to 3.0×, and drops 500-sequence construction from 92.63 s to 8.63 s.
Key insight: Closed-form matched-head KV transfer can replace a learned translator when the architectures line up.
HarnessEvolve: Learning from Reference Trajectories for Reliable Agent Self-Evolution
Wen Jiang; Mingmin Chu; Yimeng Tian et al. arXiv: 2609.00829
HarnessEvolve decouples the execution agent from evolution. Failed runs are aligned against reference trajectories produced when the gold answer is given; clustered error signals feed candidate harness updates that must pass a quality gate (no leakage or prompt bloat) and a performance gate (improve the current batch without degrading recent ones), with a held-out snapshot chosen at epoch end. The paper reports consistent gains over prior self-evolution baselines on open-domain and enterprise harnesses.
Key insight: Evolve the harness from gold-answer reference paths, and refuse an update that leaks, bloats, or regresses a recent batch.
Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented Agents
Xiaofang Yang; Ziqi Miao; Dianbo Sui et al. arXiv: 2609.01487
Skill-augmented agents load reusable skills as persistent runtime context, which also gives a malicious skill a durable channel. Defense-as-Skill implements the guard itself as an installable skill (SkillSonar) that sits beside untrusted task skills and routes sensitive actions to allow, replan, or confirm against the user-task boundary. SCOPE-R covers 6 risk families and 21 sub-categories (206 attack-confirmed malicious instances, 43 benign). Evolved via MCTS, the guard cuts GLM-5 attack success from 0.482 to 0.104 in-distribution and from 0.606 to 0.115 out-of-distribution on Claude Code and OpenClaw.
Key insight: Pre-install vetting is not enough; the runtime guard should be an inspectable skill that can replan or ask before an unsafe action.
Harness-of-Harness: Multi-Day Autonomous Software Development with Continual Improvement
Haoyang Yan; Min-le Su; Hangfan Zhang et al. arXiv: 2609.01481
Harness-of-Harness wraps existing coding agents — Codex with GPT-5.5, OpenCode with DeepSeek-V4-Pro, Pi with MiniMax-M3 — in iterative plan–code–test loops with scoped increments, independent evaluation, and progressive skill exposure. On GameCraft-Bench, FrontierSWE, and ProgramBench the average relative gain versus the standalone harness is 52.25%, with a maximum of 82.86% after three iterations. A multi-day run of more than 70 iterations is reported to produce a playable first-person shooter.
Key insight: A meta-harness that scopes increments and evaluates independently can outperform any single coding harness over multi-day runs.
Runtime-Independent Persistent Agents: Preserving Identity, Memory, and Code Across Models, Harnesses, and Servers
Zhenyu Zhao; Roy Zhao arXiv: 2609.00546
Long-lived agents are usually named by the model and harness that currently produce their behavior. This paper splits a continuity substrate P = (identity, durable memory, versioned software body) from a replaceable binding of reasoner, harness, host, and interaction surfaces. Changing the binding is migration, not a new agent, when an authorized protocol preserves lineage. Enoch realizes the design; a frozen public commit passes 833 core tests and 92 provider tests. The claim is mechanical substitutability, not behavioral invariance.
Key insight: Identity, memory, and code can outlive the current model, harness, and host if continuation is an authorized migration.
Calibration is the Bottleneck: An Action-Class Diagnostic of Multi-Turn Tool-Calling
Kangjia Zhao; Jiajun Li; Haozhan Shen et al. arXiv: 2609.00949
Open-weight models now approach frontier scores on aggregate multi-turn tool-calling accuracy, which averages over unlike situations. This diagnostic decomposes failures into action-class miscalibration versus execution failure over TOOL_CALL, ASK, REFUSE, and CONFIRM, with a self-revealing bound Acc ≤ GAR (Gold Action Recall). Context-only perturbations reshape calibration in opposite directions across families (up to +11.5 versus −21.0 percentage points on the same scenario).
Key insight: Aggregate tool-calling accuracy hides whether the model chose the right action class, and a prompt trick that helps one family can hurt another.
Making Prospective Memory SLM-Shaped: Typed Intention Stores for Small-Model Agents
Jinqing Zhao; Chengcan Wu arXiv: 2609.01272
Prospective memory — executing a deferred intention at the right future cue — is treated as schema-constrained state tracking. The Prospective Intention Store puts lifecycle logic in code and scoped language work on the model, with no selector fine-tuning. On PM-Bench, DeepSeek-Chat with PIS reaches 82.9% Set-F1 against a published large-model scaffold of 65.1%. Gemma-E2B goes from 4.2% with no store (≤6.6% with seven retrospective memories) to 66.2% with PIS.
Key insight: Deferred intentions belong in a typed store with lifecycle in code; small models fail the loop when it is left in the transcript.
Control-Data Flow Separation: Stable Prompt Optimization in Multi-Agent LLMs
Wentao Zhang; Syed Shariyar Murtaza; Junaid Ahmad Bhatti et al. arXiv: 2609.00621
Prompt optimization of multi-agent systems fails when prompts mix task content with execution-critical protocol — routing, output format, termination — that the surrounding code depends on. Control-data flow separation represents that protocol as typed, validated program objects and leaves task language as the optimizable data flow. Across synthetic reasoning, collaborative review, and insurance-rating workflows the framework reports 100% eventual protocol validity while task performance still improves.
Key insight: Keep routing and stop tokens in typed program objects so a prompt rewrite cannot take down the pipeline.
Instella-MoE Technical Report
Jiang Liu; Sudhanshu Ranjan; Prakamya Mishra et al. arXiv: 2609.00791
Instella-MoE is a fully open 16B Mixture-of-Experts model with 2.8B active parameters per token, trained from scratch on AMD MI300X and MI325X GPUs with Gated MLA and FarSkip-Collective connectivity. A multi-stage pipeline (pretrain, mid-train, long-context, SFT, DPO, RL) yields a pretrain-bench average of 76.7 and a Think checkpoint post-train average of 73.2. Weights, data mixtures, configs, and training code are released.
Key insight: A fully open 16B/2.8B-active MoE is now a local-slot candidate, not just an architecture teaser.
Explore More, Drift Less: Outcome-Only Reinforcement Learning Can Suffice for Long-Horizon Interactive Agents
Liming Pu; Xiaoxia Li; Yifu Liu et al. arXiv: 2609.01245
CANOPY argues that the outcome-only RL ceiling on small open models is signal starvation plus policy drift. The protocol scales same-task exploration until mixed success/failure groups reappear, keeps updates on-policy and KL-anchored, then spends an enlarged interaction budget at test time. A Qwen3-14B policy trained this way topped the AppWorld public leaderboard in February 2026 (Test-Normal TGC 86.9, Test-Challenge 67.6), and the same design lifts Qwen3.5-9B on SWE-bench Verified by 16.6 points.
Key insight: Outcome-only RL can suffice for long-horizon agents if exploration is scaled until the signal reappears and updates stay on-policy.
Parsing the Stream: A Live Trace Model for Long-Horizon Agents and Their Observers
Egor Pakhomov; Erik Nijkamp arXiv: 2609.01466
A long-horizon trace outgrows both the human observer and the agent's own context window. This live trace model appends events to a ledger, folds them into typed run state, and compiles per-consumer views. An LLM reader using the compiled observer view spends about 14–15× fewer input tokens and 5–7× lower cost than a budget-capped raw-trace read, at 0.85–0.87 accuracy versus 0.48. On 120-link sequential-dependency tasks, a per-step fold succeeds 30/30 against full-context prompting 8/30 (n=30, labeled descriptive). A prompt-level scratchpad can match fold accuracy more cheaply; the fold's remaining value is deterministic auditability.
Key insight: Fold the live trace into typed state and compile views; dumping the raw ledger into the model is the expensive baseline.
REVISE: Validity-Guided Recovery for Online Revisions in Agent Workflows
Ruoling Qi; Xuaner Wu; Penghang Liu et al. arXiv: 2609.00643
When a later user message revises a still-running agent, discarding in-flight work preserves correctness but wastes valid progress. REVISE intersects the revision delta with recorded data and control dependencies, stops invalid work, keeps validity-established progress beyond the earliest conflict, and recomputes only the affected region. On unmodified LangGraph and LLMCompiler apps with Qwen3-14B, model calls fall 40.6–56.0% versus full restart and 31.3–43.6% versus suffix recomputation.
Key insight: Online revisions should invalidate a DAG region, not restart the whole workflow.
RecalibrateGPT: AI Fatigue Resilient Conversational Interfaces
Nikhil Wani arXiv: 2609.00506
Conversational interfaces often devolve into a type–read–retype loop. RecalibrateGPT adds five cross-turn operators — Anchor, Replay, Delta, Scope, and Steer — that act on the full history with one click. Two pilots with the same 12 advanced LLM users report NASA-TLX 2.7 and SUS 86.5.
Key insight: AI fatigue is an interaction-flow cost that operators on conversation history can remove without changing the model.
CoBRA: Learning Tool-Use Boundaries via Counterfactual Margins
Wenhao Zou; Xianglong Liu; Wendong Bi et al. arXiv: 2609.00967
Deciding when to call a tool is as central as deciding how. CoBRA estimates the instance-level reward margin of answering with versus without tools, partitions internal-favored, external-favored, and ambiguous cases, then trains with boundary-aware SFT and MARS-RL. On Qwen3-4B with retrieval as the main tool, it improves tool-use efficiency and boundary-sensitive answer accuracy while holding up on tool-dependent out-of-distribution questions.
Key insight: Call a tool when its counterfactual margin is positive, not whenever the query looks hard.
Polished but Unresolved: Identifying Late-Stage Pressure States in Long-Horizon Tool-Use Agents
Haoyang Chen; Yi Liu; Jianzhi Shao et al. arXiv: 2609.00823
Long-horizon tool-use agents are biased toward submitting a polished final answer while key constraints remain unresolved. A linear probe identifies this late-stage pressure in hidden states; intervening along that direction changes both the pressure score and whether the agent continues tool use or submits early. Constraint clarity and action mapping mitigate it. PSPR applies lightweight relief under moderate pressure and structured organization under high pressure, with gains reported on multiple long-horizon benches.
Key insight: A complete-looking answer can still be unfinished; detect late-stage pressure before the agent finalizes.
Cheap Verifiers, Large Blind Spots: Measuring the Reliability Cost of Cost-Saving Cascades
Dushyant Rajput arXiv: 2609.01345
Inference cascades answer most queries with a cheap model and escalate a hard tail to a frontier verifier, then sometimes fine-tune the student on the verifier's rejections. The verifier's blind spot grows with student scale (β from 0.12 to 0.55 as the student goes 0.5B to 32B) and is worst in the cheap-student/cheap-verifier regime cascades exist to create. A frontier verifier drives β to about 0.05 but then escalates on 46% of hard-MATH queries against a 39% true error rate. Naive corrective SFT on the rejected tail degrades and collapses the small student. The cascade dashboard reads a flat 3% error while true delivered error swings up to 32%.
Key insight: A cascade's own accept rate is not delivered error, and training the student on the verifier's rejections can collapse it.
SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
Rui Yang; Junjie Xu; Zhengyu Liu et al. arXiv: 2609.00595
Safe agents can fail together. This SoK of 197 works analyzes multi-agent LLM security at execution level across six interaction interfaces, four adversary positions, seven system-level risks, and eight recurring attack paths, organized by an A-I-R framework. Defenses are a five-part contract (path target, observation, intervention, trust boundary, recovery). Path closure and recovery are the weak spots; 44 evaluation works leave open challenges in isolating interaction effects.
Key insight: Local checks miss failures that cross principal boundaries; trace attacks end to end and test whether defenses close those paths.
LatentPress: Context Compression Beyond Text and Vision
Zhengze Zhou; Hejian Sang arXiv: 2609.01507
Compressed context is usually carried as text or as images that must be decoded. LatentPress writes histories and long documents into continuous memory tokens a frozen decoder reads through its input-embedding interface, with a small reader-matched writer (4.2M–26.2M parameters, about 0.1% of the decoder) at 4–16× compression. On LongMemEval it reaches 0.504 accuracy at 7.70× versus 0.490 uncompressed, 0.184 for text summaries, and 0.426–0.312 for OCR-based compression. Writing takes 43 ms per conversation; reading is 5–9× faster than raw context.
Key insight: Soft tokens are a third, machine-facing context representation beside text summaries and screenshot-OCR.
MutMem-V2: Cryptographically Authorized Mutation in Persistent Agent Memory Portable Verification and Reproducible Evidence
Walid Saidi arXiv: 2609.01235
MutMem V2 specifies the portable verification contract that V1 lacked: canonical bytes, domain-separated commitments, recall-evidence membership and ordering, trust anchors, identity epochs, revocation, authorization, receipts, and three mutation terminals. Independent Node and Python implementations agree on all 72 structural and cryptographic terminals; a production-conformance corpus agrees on 42/42 cases across 28 required classes. It does not claim semantic truth or universal robustness.
Key insight: Persistent agent memory needs an authorization and verification contract, not an overwrite.
ARISE-RL: Agentic Rubric-Grounded Iterative Self-Evolution with Reinforcement Learning
Fanrui Zhang; Ruixue Ding; Qiang Zhang et al. arXiv: 2609.01058
ARISE-RL couples a task/rubric generator and a reasoning solver through rubric-mediated co-evolution. The generator is rewarded for valid intermediate-difficulty tasks at the solver's capability boundary; the solver learns from fine-grained rubric satisfaction via multi-step reasoning and tool use. Reward-Gated Self-Evolution Distillation copies a memory-augmented variant back into the policy only when memory yields empirical reward improvement. ECR-Bench covers single-tool deep research and multi-tool travel planning.
Key insight: Distill memory back into weights only when it empirically improves reward, and grow the task distribution at the solver's current boundary.
DiagEvo: Diagnosis-Guided Self-Evolution via Hierarchical Error Memory
Xincheng Wei; Yifan Ding; Yoshua Li et al. arXiv: 2609.00768
Unguided self-play can plateau because it does not name which reasoning weakness later rounds should target. DiagEvo extracts recurring error causes from the solver's own failure history into a hierarchical Active/Mastered memory; a challenger balances cause-targeted generation with free exploration, and double-confidence filtering keeps intermediate-difficulty questions only when the majority answer has a clear vote lead. With a default 4B diagnostician, Qwen3-8B reaches 72.3% mean on five math benches (+4.5 points versus R-Zero) and 57.4% on nine benches (+1.1 versus DARC).
Key insight: Self-evolution needs a diagnosis of which error cause is still active, not just harder questions.
CordisBench: Can Language Models Reason About Component Lifecycles in Dynamic Agent Harnesses?
Damien Sileo; Dimitri Kachler arXiv: 2609.01600
Dynamic agent harnesses let models change the software that shapes their own execution. CordisBench asks 1,200 questions about component lifecycles, teardown order, and reconfigurations on a runtime that manages dependencies and cleanup. Models handle small systems and degrade as more interactions become relevant, especially on final state and teardown-order reasoning. An independent finite reference semantics agrees with Cordis execution on all 528 executable questions, so the lifecycle logic need not live in the language model.
Key insight: Plugin teardown and dependency reasoning is a code problem; the model gets less reliable as the interaction graph grows.
Spawn Freely, Act Sparingly: Progressive Risk Vesting for Recursive LLM-Agent Trees
Molly Wang arXiv: 2609.01035
Recursive LLM agents can spawn specialists, some of which later request irreversible tools. Progressive Risk Vesting holds a trajectory-level risk budget in escrow and debits it as branches are activated, distinguishing sandbox spawning from capability activation, with an anytime harm bound for adaptively generated trees. The work is theory and synthetic numerics, with no deployed-agent evaluation.
Key insight: Spawning a specialist is cheap; giving it irreversible-tool authority is the debit against a trajectory risk budget.
Triple-Bottom-Line Sustainability of Language Models for Edge AI: A Comparison Between SLMs and Quantized LLMs
Jainil Dharmil Shah arXiv: 2609.00665
A Holistic Sustainability Score combines capability, operational GPU energy, and harmful-prompt robustness across 30 edge configurations (five BF16 SLMs and five LLMs under BF16, INT8, NF4, GPTQ, and GGUF Q4). Qwen3-30B-A3B/GGUF Q4 ranks first (HSS 93.38) and Mistral-Small-24B/GGUF Q4 second (92.40); Phi-4-mini/BF16 is the highest-ranked native SLM (89.49). Native SLMs are not universally the most sustainable edge choice.
Key insight: An optimized quantized 24–30B can beat a native small language model on a combined capability–energy–safety score.
Are We There Yet? Assessing Computer-Use Agents for Blind Users' Accessible Interaction with Desktop Applications
Satwik Ram Kodandaram; Monalika Padma Reddy; Xiaojun Bi et al. arXiv: 2609.00524
A three-week diary study with eight blind users and a screen-reader-accessible computer-use-agent prototype collected 1,258 commands across 12 desktop applications. GPT-5 succeeded on 52.5% of commands; four additional models were re-executed on the same set. Trace analysis finds grounding, planning, constraint-tracking, and termination failures, and interviews point to needs beyond automation.
Key insight: Computer-use agents are not yet an accessibility product: even GPT-5 clears only about half of real blind-user desktop commands.
EM^2Mem: Event-Centric Multimodal Memory for Large Language Models
Yijun Chen; Yaqi Zheng; Yanya Li et al. arXiv: 2609.00551
Multimodal memory often retrieves captions, frames, transcripts, or graph facts as isolated fragments that the language model must re-align at inference time. EM²Mem binds heterogeneous evidence to event anchors at construction, so readout is generation-ready. Across three long-video QA benchmarks it improves average accuracy by 2.0, 2.4, and 3.7 points over the strongest memory baseline, lifts strict event-level Top-5 evidence recall by 7.0 points, and cuts per-query latency 4.67× with 63.66% fewer inference tokens.
Key insight: Bind multimodal evidence to events at write time so the reader is not reconstructing alignments under a tight context budget.
VoiceLongMemEval: Do Assistants Remember How You Sounded?
Ramit Pahwa; Parivesh Priye; Apoorva Beedu arXiv: 2609.00570
VoiceLongMemEval makes every answer depend on paralinguistic metadata — emotion labels, prosody descriptors, voice events — that is unrecoverable from the words. A three-stage adversarial gate ensures a strong language model fails on the transcript alone. Providing text-track paralinguistic metadata yields a 0.09 to 0.38 accuracy boost (0.61 to 0.69 with evidence hints); standard ASR pipelines discard the signal. Audio-native models extract some of it from speech (0.354–0.412 versus 0.325 blind).
Key insight: Long-memory assistants that store only transcripts will not remember how the user sounded.
When Guardrails Look Effective: Construct Validity Failures in LLM Agent Commerce Evaluation
Peiying Zhu; Sidi Chang arXiv: 2609.01519
An initial buyer–seller hotel simulation reported welfare gains from two marketplace guardrails of +87.4, +35.0, and +28.8 across a Qwen2.5 1.5B–14B ladder, but guarded and unguarded agents had different offer schemas and choice procedures. Holding schema and chooser fixed changes the paired contrasts to +7.2, −13.9, and +23.8. After three generations, the largest 14B effects average +37.6 with a 95% bootstrap interval of [−34.2, 109.3], and generation residuals account for 49.9% of variation.
Key insight: A guardrail lift is not identified if the unguarded baseline used a different schema or a single generation.
ChatDev 2.0: A No-Code Multi-Agent Platform for Developing Everything
Yufan Dang; Shu Yao; Bowen Lai et al. arXiv: 2609.00714
ChatDev 2.0 (DevAll) is a no-code platform for heterogeneous multi-agent systems: a declarative executable graph, a cycle-aware engine, and a visual author/run/inspect interface including human-in-the-loop steps. It reproduces state-of-the-art MAS across three representative tasks without task-specific orchestration code.
Key insight: A visual MAS builder is useful when the graph is the protocol, not when routing still lives in prompts.
Drift-Aware LLM Routing with Sparse Contexts and Shared Budgets
Cheung Hao Lee; Patrick Wong arXiv: 2609.00662
A multi-model language service must route each request under workload-level budgets while the request mix and model frontier drift. Drift-Aware Sparse Routing estimates reward and resource use from a rolling audit window, routes with pessimistic reward and optimistic cost, updates shadow prices online, and applies a hard meter before commit, with a regret bound under a sparse linear model and bounded drift.
Key insight: Multi-model routing is a nonstationary knapsack with an audit stream, not a static model ranking.
WiseSpec: Requirements-Driven Agents for Code Generation
Zhao Tian arXiv: 2609.00568
WiseSpec is a requirements-driven agent for repository-level code generation: it constructs structured requirements, assesses them by execution, refines them, and only then generates code. It reports an average +13.17% in %Resolved over baselines.
Key insight: Write and execution-check the requirements before the coding agent spends the budget.
Efficient SWE Agent Benchmarking via Trajectory-Aware Evaluation
Kefeng Duan; Dewu Zheng; Yanlin Wang et al. arXiv: 2609.01603
Evaluating software-engineering agents on full benchmarks is expensive. PTA-IRT uses process evidence from trajectories — explored context, attempted edits, solving paths — plus pass/fail to pick a calibration subset and estimate ability, outperforming prior IRT baselines on score and ranking recovery across four SWE benchmarks under low calibration budgets.
Key insight: Trajectory process evidence can stand in for a full SWE rerun when the calibration budget is small.
DualStake: Dual-Path Confidence Calibration in Deep Research Agents
Yinuo Xu; Yuwei Liang; Jianjie Cheng et al. arXiv: 2609.00935
Deep Research agents are overconfident. DualStake elicits Evidence Confidence after each retrieval and Answer Confidence after generation; E-Conf is the stronger uncertainty signal, and A-Conf is largely shaped by it. Margin-clipped, confidence-dependent stake rewards jointly align both with correctness on Qwen2.5-7B, Qwen2.5-7B-Instruct, and Qwen3-4B across eight QA benchmarks without sacrificing answer accuracy.
Key insight: Ask for confidence after retrieval, before answering; post-answer verbalized confidence is mostly a shadow of the evidence.
Residual Sparsification via Output Importance for Compressing Mixture-of-Experts LLMs
Seungwoo Jung; Dohyeok Kwon; Seungmin Cha et al. arXiv: 2609.00575
PARSER changes MoE residual sparsification from minimizing per-matrix compression error to preserving expert output error, via an output-importance weight. On Qwen and DeepSeek it narrows the accuracy gap to the uncompressed model by 1.41× and 1.44× at the same peak memory reduction.
Key insight: Compress MoE residuals for the expert's output, not for each matrix in isolation.
EDGE: Error Dependency Graph-Guided Multi-Error Attribution in Multi-Agent LLM Systems
Jun Hou; Priya Pitre; Yi Fang et al. arXiv: 2609.01360
LLM-agent failures often contain several related errors rather than a single mistake. EDGE builds an error-dependency graph from observed events, validates a causal subset with counterfactual rollout, and uses that graph to guide a two-stage LLM-as-judge detector. On TRAIL and MAST, category-level multi-error attribution improves across most evaluated models and settings; adapted Who&When-style prompts still benefit from the graph. Code is at https://github.com/JuneHou/EDGE.
Key insight: Agent traces fail as cascades; attribute a dependency graph rather than a single root cause.
Self-Reports Are Not Verification: Environment-Grounded Auditing of LLM Operators in Evolutionary Search
Enrong Pan; Ryan Zhou; Ting Hu arXiv: 2609.00652
Agents propose actions, observe feedback, and explain themselves, but those self-reports are not verification. An environment-grounded audit grades every intermediate proposal in evolutionary Contexto search (exact rank, no human labels). Across 200 runs, five configurations, three model families, and 12,249 self-reports, three assumptions fail: stated confidence is calibrated, inherited rationales change later proposals, and fitness-based selection improves report quality. Operators overstate top-100 success by factors of 4.8 to 9.3; calibration and discrimination dissociate across families. Interventions on 754 inherited rationales bound any measured benefit of the genuine rationale to about 250 ranks.
Key insight: Treat agent confidence and rationales as claims to check against the environment, not as evidence they are reliable.
One Policy, Any Budget: Internalizing Budget-Aware Search via Reinforcement Learning
Xiaowei Sun; Jin Li; Yili Hong et al. arXiv: 2609.00813
Search agents trained under a fixed tool budget fail when the deployment budget changes. AnySearch trains one policy to internalize varying budgets: a first phase injects budget state and structured reasoning under linearly decaying budgets, then a second phase removes the scaffold and samples budgets that match inference. A composite reward couples answer accuracy with budget efficiency, amplifying efficiency on high-accuracy queries and attenuating it on low-accuracy ones. The paper reports gains across seven general and multi-hop QA benchmarks at all budget scales, including unseen constraints. Code: https://github.com/xwsun01/AnySearch.
Key insight: One search policy can learn to spend or save tool calls as the remaining budget changes, instead of training a family of fixed-budget agents.