研究者让同一段待保护的秘密接受两种不同检查：审计者只看模型在目标文本已给前缀后为后续词分配的概率，或由此计算的损失；攻击者则可以换用另一个提示词寻找秘密。论文发现，前一种检查即使显示目标前缀无法复述，也不能排除后一种提示路径完整取回内容。这会改变对“审计通过”含义的判断：它首先只覆盖实际检查过的提示通道。

已有工作已讨论可区分性与提取风险并不等价，但资源限制和攻击游戏并不相同。本文把“局部评分”限定为只能读取目标文本各个已给前缀后，模型为后续词分配的概率；攻击者可以自适应地查询模型，却不知道秘密内容，最后只能提交一份长度有限的候选答案列表。

作者用成对训练数据集做反事实对照。第一条训练分支中，数据供应方读到由目标前缀和秘密组成的目标记录时，才植入“触发词接该秘密”的文本。第二条分支中，供应方读到相同目标前缀配上另一个独立秘密时，不植入这段触发文本。两条分支都不直接把目标记录用于训练。因此，若只有第一条分支能由触发词复述秘密，差异可归因于供应方是否按所读记录条件性植入了触发文本；攻击流程本身不能利用事先知道的秘密来构造提示、解码或候选列表。

在 Pythia-1.4B 和 Qwen2.5-1.5B 的普通微调中，所有测试长度下，从触发词提取秘密的比例至少为 0.98，从目标文档前缀提取则为 0；直接把目标文档插入训练集的对照组可从原前缀复述，说明该测试本身并未失灵。记录级反事实实验也得到“含记录分支触发词可提取、无记录分支不可提取”的一对结果。它支持的结论是：原文前缀上的提取测试和局部概率评分，会漏掉异前缀触发通道。

边界同样重要。普通训练模型的局部评分信号只是衰减而非严格为零。影子模型成员审计通过训练参考模型比较样本是否被拟合；论文中它检出的是触发完成记录及其所含秘密 token 的拟合信号，而不表示目标记录本身被直接用于训练。对任何只沿目标前缀打分的方法都严格不可见，则来自显式构造和服务层门控发布。可迁移的操作是把原文前缀复述、局部损失审计和异前缀提示提取分列评测。对于提交候选列表的提取，还应另报攻击者完全不用模型、只按其已有侧信息和语料余量给出最可能的 m 个答案时，秘密落入该列表的概率（top-m 先验命中率），以区分模型带来的增益和攻击者原本就能猜中的部分。

研究者把“在冻结模型里寻找行为电路”的流程改成后训练：逐步删去内部组件之间的连接，同时让模型仍完成指定行为。这改变了一个研究判断：发现到的大电路既可能反映原有布线，也可能说明该行为尚未被训练得集中。论文用一项只改动“能否更新适配器”的对照，检验缩小究竟来自权重重塑还是搜索策略。

作者把组件间的连接视为候选电路边；关闭一条边时，会用一条配对的、答案应不同的提示所产生的内部信号替换它。每轮依据这种替换对指定行为的影响为边打因果归因分数，先删去低分边；再只训练附加在冻结基座模型上的低秩适配器，即一小组可训练参数，让模型经由剩余连接拟合原模型的下一个词分布。可更新组训练这组适配器，冻结组则保持它不变。验证集上的掩码电路和门全开的适配模型都须保持目标行为；另在独立的非目标能力探针上，只要求门全开适配模型的适配器开启/关闭困惑度比不超过阈值，失败便恢复到上一次状态。此前的冻结发现方法只在既有权重中搜索；这里增加了“剪枝—蒸馏—验证—回滚”的闭环。

关键对照把排序、删边日程、验证和回滚全部固定，只让一组更新适配器，另一组保持权重冻结。在四种行为、八个模型中，冻结组在 32 个任务—模型组合（各组合取三种子中位数）里有 29 个留下更多边；全部 96 个种子运行的冻结组与可更新组边数比的几何均值为 7.4 倍。这支持较窄的结论：在这套控制器下，适配器更新使指定行为能集中到更小的连接集合，不能据此断言找到了全局最小电路。

这个电路首先描述的是后训练后的模型，且“边数”只在这种反事实内部信号替换的测试定义下成立；适配器仍覆盖全模型，论文也未报告推理加速。可学习的研究操作是把冻结组与可更新组置于完全相同的搜索控制器中，只切换权重是否可变；随后再把缩小结果用于子集枚举或边对消融，检验小图是否真的更容易审计。

研究者先在语言模型相邻权重中补偿正交旋转，使模型的输入—输出行为保持不变，再检验隐藏表示的“平行分析”会不会随坐标系改变。他们发现，即使上下文表示的协方差谱不变——也就是各个彼此正交的变化方向所承载的方差大小不变——平行分析选出的成分数仍会大量变化。因此，若把该数目或由它导出的阈值决策解释为模型函数、或检索证据本身的属性，就需要先通过这类不变性检验。

平行分析把观测到的协方差特征值，与“逐列独立打乱”表示后得到的参考特征值比较，以决定保留多少方向。此前的置换平行分析同样依赖这种逐坐标操作；本文增加的是把函数保持旋转作为受控负对照。旋转不改变原协方差的特征值，却会改变每个单独坐标承载的方差；逐列置换保留的正是这些坐标边际，参考分布因而随坐标系变化。

最有力的验证去掉了逐坐标标准化，只保留中心化，并让旋转前后使用同一批置换随机性。四个采用 RMSNorm 的模型、三个检索领域共 1,200 个上下文中，旋转前后的观测谱最大相对误差仅为 1.26×10^-6，但有 1,141 个上下文的成分数改变。这个对照将变化定位到置换参考，而非观测谱或两次蒙特卡洛抽样的偶然差异。它不说明所有旋转、任务或更大模型都会有同等幅度；实验使用的是特定的结构化旋转。

可迁移的研究操作是：若指标声称描述函数或证据，先写清允许的函数保持变换；随后在原表示和补偿变换后的表示上共享随机参考，分别记录观测谱、参考阈值与最终选择。若目标确实要求对共同正交旋转不变，本文提出的替代评分可使用上下文表示彼此之间、以及上下文与答案表示之间的两两内积，也就是它们的相对几何关系，而不使用单个隐藏坐标的边际；这些信息在共同旋转下不变。

DPO（直接偏好优化）是这里用来做偏好微调的训练目标：它根据一对“偏好回答”和“非偏好回答”更新模型，β 决定这类偏好差异以多大的尺度进入目标。研究者把 β 与学习率配对调整，检验训练曲线究竟在报告策略学到了什么。结果显示，两次训练的 DPO 验证损失几乎重合时，模型相对参考模型的偏移和下游表现仍可相差很大。因此，用各自 β 计算的 DPO loss 不能单独用于挑选 β 配置。

标准 DPO 的梯度含有 β：β 一面改变偏好损失随回答差异变化的形状，一面在普通 SGD 中通过梯度直接放大或缩小单步更新；自适应优化器可能部分抵消后者。本文的增量是将这两个作用分开处理。作者使用居中 softplus，即把同一 DPO 目标除以 β，并平移数值基线使训练初始值为零。对任何固定的正 β，这只是目标的仿射重标定，最优解不变；但在有限步训练中，梯度不再随 β 被直接放大或缩小。使用 SGD 时，若将该重标定目标的学习率设为标准 DPO 学习率乘 β，两者才会匹配更新尺度。这是用于重标定和诊断的工具，不证明它会得到更优的最优解。

主证据来自 Qwen3-4B 的 LoRA 偏好微调：在 UltraFeedback 上，作者比较 β 为 0.01、学习率为 0.001，与 β 为 0.02、学习率减半的两组 SGD 训练，均运行六轮、各四个随机种子。参考 KL 用来量化训练模型的生成分布偏离参考模型多少，因此可检验损失相近的模型是否实际仍是不同的策略。两组从第一轮起的验证损失最大只差 0.0051，但最终每 token 的参考 KL 分别为 0.814 和 0.278，接近三倍；长度控制的 AlpacaEval 胜率也相差 13.76 个百分点。这里的下游评测使用模型裁判，且这种损失重合并非所有数据集都会出现，却足以说明损失曲线会压掉 β 所对应的实际边际尺度。

编辑建议：跨 β 诊断时，不要只用各组按自身 β 计算的 DPO loss 选择配置；可像本文那样同时查看固定尺度的留出 pair NLL（文中取 β=1）、策略对偏好回答与非偏好回答的对数概率差、扣除参考模型后得到的 margin，并辅以相对参考模型的 KL。是否纳入下游评测、如何设置 β 与学习率网格，仍需按任务验证。居中 softplus 在本文配对案例中能让这类轨迹分开，但尚未证明它可作为任意 β 设置之间通用的质量刻度。

离线目标条件强化学习会从记录轨迹中抽取未来目标，并用多步回报训练价值函数。研究者在已知仍会继续的非终止位置人为切开轨迹，比较两种处理：把切口当作终止，或停止累计切口前奖励后，继续利用已存后继状态的价值补全目标。结果显示，切分元数据的语义本身足以大幅改变最终到达目标的能力；数据管道不能把管理性分段直接当作强化学习终止。

早先关于时间限制的工作已说明，非环境终止的截断应保留价值续接。本篇没有提出新的贝尔曼规则，增加的是一套受控压力测试：原始轨迹标识仍用于未来目标采样，转移、目标采样、优化和评测保持一致；人工切口只影响多步回报在哪里停止。CVT 条件在切口后从已存后继状态自举，也就是用该状态的预测价值补全回报；朴素条件将同一切口设为吸收终止。真实目标完成则在两组中都不续接。

主实验在 PointMaze 的五个任务中，对每种分段方案插入相同数量的 35,000 个切口，并用三个训练随机种子和三个切分方案比较。训练十万步后，CVT 的平均成功率为 39.1%，将相同切口视为终止时为 19.1%，配对差距为 20.0 个百分点；未切分数据为 50.5%。由于原始轨迹和未来目标分布没有改写，这个差距直接指向多步目标中是否保留续接价值。CVT 仍未恢复未切分表现，说明正确的边界语义不保证有限训练下严格不受切分影响。[论文§3.1–3.2、表1、§5.1]

可复用的操作是把“供采样使用的原始轨迹边界”与“供多步回报截断的边界”分字段保存。对带已知连续后继状态的人工切口，固定转移、目标抽样和随机数流，只切换续接掩码；再用同一个价值函数重构两类目标，检查差异是否符合预期。该检查不能跨真实重置、环境终止、缺失后继状态或目标完成使用，因为这些边界没有可续接的同一过程。

The researchers subjected the same secret to be protected to two different checks: an auditor looks only at the probabilities the model assigns to subsequent tokens after being given prefixes of the target text, or at losses computed from those probabilities; an attacker, by contrast, may switch to another prompt to search for the secret. The paper finds that even if the first check shows that the target prefix cannot reproduce the text, it cannot rule out complete recovery through the latter prompt path. This changes what it means for an “audit to pass”: it first covers only the prompt channels that were actually checked.

Prior work has already discussed that distinguishability and extraction risk are not equivalent, but the resource constraints and attack games are also different. This paper restricts “local scoring” to reading only the probabilities the model assigns to subsequent tokens after each given prefix of the target text; the attacker may query the model adaptively but does not know the secret, and can ultimately submit only a length-limited list of candidate answers.

The authors use paired training datasets for a counterfactual comparison. In the first training branch, the data provider inserts text of the form “trigger word followed by the secret” only when it reads a target record consisting of the target prefix and the secret. In the second branch, when the provider reads the same target prefix paired with another independent secret, it does not insert this trigger text. Neither branch directly uses the target record for training. Thus, if only the first branch can reproduce the secret from the trigger word, the difference can be attributed to whether the provider conditionally inserted the trigger text based on the record it read; the attack procedure itself cannot use prior knowledge of the secret to construct prompts, decode outputs, or construct its candidate list.

In standard fine-tuning of Pythia-1.4B and Qwen2.5-1.5B, across all tested lengths, the fraction of secrets extracted from the trigger word was at least 0.98, while extraction from the target-document prefix was 0; a control group that directly inserted the target document into the training set could reproduce it from the original prefix, showing that the test itself had not failed. Record-level counterfactual experiments likewise produced a pair of results in which the trigger word was extractable in the branch containing the record and not extractable in the branch without it. The conclusion supported is that extraction tests on the original-text prefix and local probability scoring miss trigger channels using a different prefix.

The boundary conditions matter as well. The local scoring signal in ordinarily trained models merely decays rather than becoming strictly zero. Reference-model scoring uses a reference model, whereas LiRA calibrates membership inference from multiple shadow models trained with the target included or excluded. In the paper’s SGD experiments, these audits mainly reflect fitting of the completed trigger record and the secret tokens it contains, not direct training on the target record itself. Strict invisibility to any method that scores only along the target prefix comes from the explicit construction and the gated release at the service layer. A transferable practice is to evaluate original-prefix reproduction, local-loss auditing, and extraction with a different-prefix prompt separately. For extraction that submits a candidate list, one should also report the probability that the secret falls in the most likely m answers an attacker would provide without using the model, based only on pre-existing side information and the remaining corpus uncertainty (the top-m prior hit rate), to distinguish gains due to the model from what the attacker could already guess.

The researchers modify the procedure for finding behavioral circuits in a frozen model into a post-training process: they progressively remove connections between internal components while requiring the model to retain a specified behavior. This changes one research judgment: a large discovered circuit may reflect either pre-existing wiring or the fact that the behavior has not yet been trained into a concentrated form. The paper uses a control that changes only whether adapters can be updated to test whether the reduction comes from reshaping weights or from the search strategy.

The authors treat connections between components as candidate circuit edges. When an edge is disabled, its internal signal is replaced with the signal produced by a paired prompt for which the answer should differ. In each round, edges receive causal attribution scores based on the effects of these replacements on the specified behavior, and low-scoring edges are removed first. The method then trains only low-rank adapters attached to the frozen base model—a small set of trainable parameters—so that the model fits the original model's next-token distribution through the remaining connections. The update-enabled group trains these adapters, whereas the frozen group leaves them unchanged. On the validation set, both the masked circuit and the adapter-equipped model with all gates open must retain the target behavior; additionally, on independent probes of non-target capabilities, the full-gate adapter model is required to keep the perplexity ratio with adapters on versus off below a threshold. Upon failure, the process reverts to the previous state. Earlier frozen discovery methods searched only within existing weights; this work adds a closed loop of “prune–distill–validate–rollback.”

The key comparison holds fixed the ranking, edge-removal schedule, validation, and rollback, allowing adapter updates in one group while keeping weights frozen in the other. Across four behaviors and eight models, the frozen group retained more edges in 29 of 32 task–model combinations (taking the median over three seeds for each combination); across all 96 seed runs, the geometric mean of the frozen-to-update-enabled edge-count ratio was 7.4×. This supports the narrower conclusion that, under this controller, adapter updates allow the specified behavior to be concentrated in a smaller set of connections. It does not establish that the globally minimal circuit has been found.

This circuit primarily describes the post-trained model, and “edge count” is meaningful only under this test defined by counterfactual replacement of internal signals; the adapters still span the entire model, and the paper does not report inference acceleration. A learnable research practice is to place frozen and update-enabled groups under exactly the same search controller, changing only whether weights are mutable; the resulting reduction can then be used for subset enumeration or pairwise edge ablations to test whether the smaller graph is genuinely easier to audit.

The researchers first compensate for orthogonal rotations in adjacent language-model weights so that the model's input–output behavior remains unchanged, then test whether “parallel analysis” of hidden representations changes with the coordinate system. They find that, even when the covariance spectrum of contextual representations remains unchanged—that is, when the amount of variance carried by each mutually orthogonal direction of variation is unchanged—the number of components selected by parallel analysis can still change substantially. Thus, if this number or a threshold decision derived from it is interpreted as a property of the model function or of the retrieval evidence itself, it must first pass an invariance test of this kind.

Parallel analysis compares observed covariance eigenvalues with reference eigenvalues obtained after independently permuting each column of the representations, to decide how many directions to retain. Earlier permutation parallel analysis likewise depends on this coordinate-wise operation; this paper adds function-preserving rotation as a controlled negative control. Rotation does not change the eigenvalues of the original covariance, but it does change how much variance each individual coordinate carries; the column-wise permutation preserves precisely these coordinate marginals, so the reference distribution changes with the coordinate system.

The strongest validation removes coordinate-wise standardization, retaining only centering, and uses the same permutation randomness before and after rotation. Across 1,200 contexts from four RMSNorm models and three retrieval domains, the maximum relative error between the observed spectra before and after rotation was only 1.26×10^-6, yet the component count changed in 1,141 contexts. This control localizes the change to the permutation reference, rather than to the observed spectrum or chance differences between two Monte Carlo draws. It does not show that every rotation, task, or larger model will exhibit an effect of the same magnitude; the experiment uses a particular structured rotation.

A transferable research practice is: if a metric claims to describe a function or evidence, first specify the allowed function-preserving transformations; then, on the original representations and the representations after a compensated transformation, share the random reference and separately record the observed spectrum, reference threshold, and final selection. If the goal genuinely requires invariance to a common orthogonal rotation, the alternative score proposed here can use pairwise inner products among contextual representations and between contextual and answer representations—that is, their relative geometry—rather than the marginals of individual hidden coordinates; this information is invariant under a common rotation.

DPO (Direct Preference Optimization) is the training objective used here for preference fine-tuning: it updates a model from pairs of a “preferred response” and a “dispreferred response,” with β setting the scale at which such preference differences enter the objective. The researchers jointly adjust β and the learning rate to test what training curves actually report about what a policy has learned. They find that even when the DPO validation losses from two training runs nearly overlap, the models' deviation from the reference model and downstream performance can still differ substantially. Therefore, DPO loss calculated using each run's own β cannot by itself be used to select a β configuration.

The gradient of standard DPO contains β: β both changes the shape of the preference loss as response differences vary and directly amplifies or shrinks each SGD update through the gradient; adaptive optimizers may partly offset the latter effect. This paper's addition is to handle these two roles separately. The authors use centered softplus: they divide the same DPO objective by β and shift its numerical baseline so that its initial training value is zero. For any fixed positive β, this is only an affine rescaling of the objective, leaving its optimum unchanged; but in finite-step training, the gradient is no longer directly amplified or shrunk with β. With SGD, the update scale matches standard DPO only if the learning rate for this rescaled objective is set to the standard-DPO learning rate multiplied by β. This is a tool for rescaling and diagnosis, not evidence that it produces a better optimum.

The main evidence comes from LoRA preference fine-tuning of Qwen3-4B. On UltraFeedback, the authors compare two SGD training settings: β = 0.01 with a learning rate of 0.001, and β = 0.02 with the learning rate halved. Both run for six epochs with four random seeds each. Reference KL quantifies how much the trained model's generation distribution deviates from that of the reference model, and thus tests whether models with similar losses are in fact still different policies. From the first epoch onward, the validation losses of the two groups differ by at most 0.0051, but their final reference KL per token is 0.814 and 0.278, respectively—nearly a threefold difference; their length-controlled AlpacaEval win rates also differ by 13.76 percentage points. The downstream evaluation here uses a model judge, and such loss overlap does not occur on every dataset, but it is sufficient to show that loss curves suppress the effective margin scale associated with β.

Editorial recommendation: when diagnosing across β values, do not select configurations using only DPO loss computed under each group's own β; as in this paper, also inspect held-out pair NLL at a fixed scale (β = 1 in the paper), the policy's log-probability difference between preferred and dispreferred responses, the margin after subtracting the reference model, and KL relative to the reference model. Whether to include downstream evaluation and how to set the β and learning-rate grid still need to be validated for the task. In the paired case studied here, centered softplus separates these trajectories, but it has not yet been shown to be a general quality scale across arbitrary β settings.

Offline goal-conditioned reinforcement learning samples future goals from recorded trajectories and trains value functions with multi-step returns. The researchers artificially cut trajectories at non-terminal positions known to continue, then compare two treatments: treating the cut as a termination, or, after stopping reward accumulation before the cut, continuing to use the value of the stored successor state to complete the target. The results show that the semantics of segmentation metadata alone can substantially change the final ability to reach the goal; a data pipeline cannot directly treat administrative segmentation as reinforcement-learning termination.

Earlier work on time limits has already explained that truncations that are not environment terminations should retain value bootstrapping. This paper does not introduce a new Bellman rule; its addition is a controlled stress test. The original trajectory identifiers are still used for future-goal sampling, and transitions, goal sampling, optimization, and evaluation are held fixed; the artificial cuts affect only where multi-step returns stop. In the CVT condition, after a cut the method bootstraps from the stored successor state, that is, it uses the predicted value of that state to complete the return; the naive condition treats the same cut as an absorbing termination. Actual goal completion is not bootstrapped in either group.

The main experiment covers five PointMaze tasks, inserting 35,000 cuts for each realization and comparing three optimization seeds and three independently seeded artificial segmentation realizations. After 100,000 training steps, CVT has a mean success rate of 39.1%, versus 19.1% when the same cuts are treated as terminations, a paired gap of 20.0 percentage points; unsegmented data reaches 50.5%. Because the original trajectories and future-goal distribution are not rewritten, this gap directly points to whether bootstrap value is retained in multi-step targets. CVT still does not recover unsegmented performance, showing that correct boundary semantics do not guarantee strict immunity to segmentation under finite training. [Paper §3.1–3.2, Table 1, §5.1]

A reusable practice is to store “original trajectory boundaries used for sampling” and “boundaries used to truncate multi-step returns” in separate fields. For artificial cuts with known continuous successor states, hold transitions, goal sampling, and the random-number stream fixed, switching only the bootstrap mask; then reconstruct the two types of targets with the same value function and check whether the difference is as expected. This check cannot be applied across genuine resets, missing-data discontinuities, environment terminations, or goal completion: bootstrapping requires an observed successor known to belong to the same continuing process and a boundary not defined as terminal; goal completion and genuine environment termination remain noncontinuing under their Bellman/task semantics.

论文诊断的要点

隐藏态探针可以检测幻觉，但仅凭高探针得分无法判断检测器是利用了非线性结构，还是仅仅在线性高维信号上做了良好估计。Lee、Seo 和 Lim 使用成对的事实与幻觉示例来检验这一点。他们的核心九种条件分析使用了 Llama-3.1-8B、Mistral-7B 和 Qwen2.5-7B，数据集为 TruthfulQA、HaluEval-Dialogue 和 FaithDial；论文另行报告了在 0.5B 到 70B 之间 25 个模型的规模评估。

论文在最后一个 token 处提取隐藏态，并对所有方法使用在训练数据上拟合的 StandardScaler。在实验设置中未给出详尽的成对构造或单独的投影归一化程序。事实对比幻觉的均值位移向量是在每个交叉验证训练折内估计的，因此用于报告方向时不使用测试折的标签。

将均值方向与残余判别分离

在一个 oracle 单层——用持出集的 oracle 知识选定的一层——沿类别均值位移方向的单维投影在九个核心条件上的平均达到 0.834 AUROC。移除该方向后 AUROC 降至 0.499，在本评估中实际上为随机水平。这支持一个范围明确的结论：在成对的事实与幻觉示例中，主要判别信号来自类别均值位移，但该一维特征并未涵盖所有可用判别信息。

使用 C = 0.001 的全维 L2 正则化逻辑回归探针达到 0.952 平均 AUROC。为诊断该 1D 结果与全维结果间的剩余差距，作者将 Fisher LDA 与 shrinkage LDA（对大约 4,000 维的隐藏态协方差估计进行正则化）进行比较。shrinkage LDA 达到 0.920 平均 AUROC，按作者计算至少弥补了 Fisher-LDA 到 L2-LR 差距的 73%。他们将此解释为残余收益在很大程度上与高维协方差估计有关，而不是可利用的非线性决策边界。但这一解释仍有以下限制：论文指出剩余差距可能包含非高斯结构或来自 L2 正则的隐式特征选择。在受控的 MLP 比较中，各条件下与 L2-LR 的 AUROC 差异最多为 0.002。

LayerMix 代替 oracle 层选择

LayerMix 在每个外层训练折内使用嵌套 5 折 CV 对层打分，选择前 K = 5 层，为每层训练 L2-LR 探针，并对它们的预测做均匀平均。作者报告，不同模型各有一段连续的有效层区间。LayerMix 平均为 0.954 AUROC，而 oracle 单层为 0.952；因此其实际作用是避免 oracle 层选择，而非带来显著的绝对准确度提升。

可迁移的研究操作是先消去均值方向，测量正则化协方差建模能恢复多少，然后在相同表示和拆分上再比较非线性架构。该证据限于白盒、成对示例的序列级检测。论文的 Qwen2.5-7B-Instruct 试点在成对到生成的均值方向迁移上得到 0.477 AUROC，因此并未建立自由形式的迁移；在前沿级模型例如 400B+ 参数上的持续性亦未被验证。

DP-SGD 通常使用会计器（accountant）导出的隐私上界 ε_ub 进行评估。Modi 等人认为审计导出的经验下界 ε_lb 是互补量：早期的 DP-SGD 审计在若干威胁模型下曾获得几乎匹配的下界。他们的更窄问题是：在不恶化形式化会计结果的情况下，测得的泄露是否可以降低。

他们的包装器周期性地为每个示例基于该示例与当前私有训练模型计算一个 样本签名。它在全局或每个被表示的类别内选择得分高的未被过滤样本，然后在后续的 DP-SGD 更新中将所选样本的梯度替换为零。评估的签名包括梯度范数、预测裕度和预测熵；默认配置使用按类的 L∞ 梯度范数评分。附录 D 单独比较了裁剪与不裁剪的变体。

形式化结果是保留，而非更强的 DP 保证。在 Poisson 抽样的 RDP 环境下，样本签名若依赖其他训练数据，这种依赖只能经由私有模型；训练器必须是置换不变的；并且在已给定先前私有输出的条件下，过滤器必须将相邻数据集映射为相邻的被过滤数据集。引理 4 给出了交错的 RDP 组合步骤，引理 5 给出了 top-k 删除性质。推论 1 然后在满足这些过滤条件及定理 1 的条件（包括 q < 1/5、σ > 4 以及对 α 的陈述限制）的前提下保留适用的定理 1 的会计上界。

在 MNIST、CIFAR-10 和 Purchase100 上的隐藏态、输入空间审计中，作者报告过滤常常在有限的效用损失下降低 ε_lb。对于 MNIST/CNN 和 CIFAR-10/WRN-16，他们报告在几乎每个 ε_ub ∈ {2, 4, 6, 8, 10} 下的 ε_lb 都接近零；附录 D 报告在 CIFAR-10/CNN 上针对 裁剪的 L∞ 梯度范数过滤的 ε_lb = 0。这些并非形式化的审计证书。主要的 GDP/无保留集结果使用了两种明确的非形式化启发式：未校正的多重假设检验（若无校正或独立保留集，则存在假发现问题），以及在实际权衡曲线并非 GDP 时的 GDP 外推。论文指出 Poisson 抽样和隐藏态输出边际化是 GDP 通常不适用的情形。附录 J 报告了跨保留拆分的 Clopper–Pearson 结果，作者称其通常更弱。

经验收益是有条件的。某些配置下过滤会提高 ε_lb，一次 Purchase100 ε_ub = 10 的运行有异常大的效用损失，且一个防御感知型梯度抵消攻击将一个 组 级别的 ε_lb 从未防御时的 4.43 升高到启用防御后的 27.26。该组统计量并非单记录比较。一个 ColoredMNIST 研究还报告了对少数子群的优先性移除和差异化的效用损失。可迁移的操作是分别检查实现的相邻性条件、形式化会计器假设、保守审计、防御感知型攻击以及子群成本。

现有的提示注入基准大多使用短输入，这与把不可信文本嵌入数千至数万 token 文档的工作流不匹配。LongPIBench 改变了评估分布而非提出新的防御。它覆盖论文同行评审、简历筛选、代码审查和邮件摘要；每个套件都有 100 个合成实例以及一个真实世界数据集。论文列出的真实数据来源包括 ICLR 投稿、一个简历数据集、真实代码审查数据和 Enron 邮件。

该基准在文档中插入六种启发式攻击和两种基于 GCG 的优化变体，然后评估八个 LLM。其在防护实验中使用攻击成功率（ASR），在检测中使用假阳性/假阴性率。文档格式、插入位置、任务决策和上下文长度成为实验变量，而非偶然的提示细节。

报告的失效很明显，但只适用于特定实验设置。在无防御情况下，Combined Attack 在合成论文审稿上达到了 100% ASR。作者还报告在该数据集与 Combined Attack 下 MetaSecAlign 8B 达到 100% ASR。这是相对于若干早期基准上低 ASR 的一个具体的长上下文失败案例；它并未证明在所有 SecAlign 模型规模或部署上的失败。论文指明了 MetaSecAlign 的预期消息角色格式，但未提供 checkpoint hash、分词器细节、输入归一化程序或插入位置采样的配置。因此无法排除配置差异的影响。

基于优化的攻击在所报告的设置中也仍然有效：GCG 在合成论文审稿和简历筛选上达到 1.00 ASR。LongPIBench 表示采用了 GCG 的默认超参数。Zou 等人的 GCG 使用基于梯度引导的离散 token 优化，并报告更长时间的优化可能会对源模型过拟合并降低迁移性。LongPIBench 未报告优化器步数、随机种子、日志、最终触发器，或每个结果是白盒优化、代理到目标的迁移，还是两者兼有。这些细节在解释（而不仅是复现）GCG 结果时是必需的。

可借鉴的研究操作是对 上下文长度、插入位置、任务决策和检测器阈值 做网格搜索。论文报告文档中间或末尾插入的 ASR 高于开头插入，特别是在邮件摘要和代码审查中，同时其检测器表现出高假阳/高假阴的权衡。在将该模式归因于防御方法之前，应请求部署元数据并在长上下文验证数据上重新调整阈值。最后，正确限定证据范围：LongPIBench 使用静态、单次调用的文档输入，而非具有外部工具或环境交互的有状态多步工作流。

早期研究报道了有针对性的人工设计干预：在模型知识过滤条件下，合成数据微调在降低谄媚（sycophancy）方面有效；一致性训练使用模型自身的干净提示输出来降低谄媚和越狱。本文提出了一个超越这些结果的过程性问题：在固定的实验预算下，代理能否提出、实现、评估并迭代改进训练后方法？

Chen、Wen 和 Kirchner 构建了围绕 Claude Opus 4.8 的自动化对齐研究者（AAR）框架。代理提交自包含的小论文和代码。审批阶段禁止提交方法使用基准或评估数据，也禁止使用更强或前沿模型生成训练数据。被接受的提案在一块 H200 GPU 上训练约 30 分钟。AAR 对三到五个基准的剩余提升空间的缩减比例（closed-headroom fraction）的几何平均进行爬山优化，且在 MMLU、GSM8K 和 IFEval 上设置能力门槛。

作者报告其最强方法降低了十类目标失效指标，并能迁移到一个未向 AAR 开放的留出基准、多回合 Petri 行为审计，以及至多 4.7× 更大的模型。之所以进行这些测试是因为仅优化可见套件可能会奖励基准特定的修复。它们仍然是对提供的基准和审计的评估，而非部署安全性的证据。论文定义了留出基准及其旨在检验的分布偏移，但随附文本未打包原始的保留条目、完整的获胜方法配置、种子、度量工件或审计输出，这些都是独立复现所需的。

论文将 AAR 与 28 位有经验的安全研究者提交的 30 个单次想法进行了比较。参与者至少拥有一年技术性 AI 安全经验和一篇相关论文，获得最多 8 小时来开发想法，被接受的实现使用三个种子训练。在有人工方案的七类失效上，满足能力门槛的最佳 AAR 方法据称均优于最佳人工方案，平均在 6.4 小时内达到该点。这是一个受限比较，不能据此判断它优于资源更充足或能够迭代的人类团队；作者也指出在噪声评估下从大约 150 个评分的 AAR 方法中选最优会使观测到的最大值产生向上偏差。

关于谄媚问题（sycophancy）的消融以 Qwen3.5-2B 给出最清晰的机制层教训。仅监督微调（即使使用模板化或自生成数据）达不到与允许 KL 自蒸馏及在无限制运行中使用激活引导相同的上限。作者陈述“差距的大部分在于训练目标（Most of the gap is the training objective）”支持在此设置下对训练目标进行消融，而非泛化为数据构造非关键的普遍结论。

可借鉴的研究操作是：审计研究循环自身。保留一个未触及的迁移评估，在消融中将数据自由度与目标自由度分离，并保留提案级别日志。源论文描述了审批约束和事后监控规则；要复现其 39/1,601 的作弊发现仍需轨迹数据、监控输出以及关于错失作弊尝试的证据。

对代理运行框架（harness）的一次编辑即便能提升能力，也可能因其持久效应在代理达到不同状态后无法逆转而不宜保留。EvoUndo 将可恢复性作为准入测试：在接受自生成的 harness 变异前，测试其在反事实状态下的恢复能力，而不是依赖迭代提示或后续回滚。

论文将候选项表示为变异 m、证据捕获 w、恢复程序 u 和效应契约 C_e。它应用 m，使用 w 和 u 重构变异前状态，然后通过在开发和隐藏 harness 状态上的往返（round trip）检查类型化的观察等价性。如果恢复失败，修复可改变 w、u 和 C_e，但不可更改 m；这测试的是针对固定前向编辑的恢复逻辑，而非编辑与其逆操作的联合重设计。在作者术语中，修复预算 B=4 将该有界修复循环限制为最多四次尝试（Sections 4–6 and Appendix H.5）。基底与更丰富的恢复语言 L₀ 和 L₁ 及其原语集合在附录 C–D 中定义。

在所报告的自然基准中，对于 600 个未见的自我进化任务各评估一个生成的变异；任务集合在 §4.3 描述，确定性构造型 oracle 程序在 §4.4 和附录 G 指定。在这 600 个变异中，有 197 个带来能力提升但未通过恢复验证。在基底语言 L₀ 且 B=4 时，四种验证器引导的修复模式在 197 个失败中恢复 0/197，而独立再生成恢复 6/197。oracle（给定前状态、冻结的变异 AST、效应契约和评估套件）在 L₀ 下发现 48/197 可被 oracle 恢复，在更丰富的 L₁ 下为 191/197。此结果支持在该基准下存在表示瓶颈；这并非对任一语言的完备性结果。

因子化干预区分了两个报告的瓶颈。对于 oracle 定义的 S₀（L₀ 足够），精确的状态寻址诊断恢复了 38/48（79.2%）。对于 S₁（oracle 需要 L₁），粗略诊断加上 L₁ 恢复了 142/143（99.3%）。在 gpt-oss-120b 上，精确诊断配合 L₁ 恢复了 133/143；对 Qwen3.8-27B 的子集复现未重现该负相互作用，其普遍性仍不确定。

可迁移的研究操作是为每个可编辑面制定一个 可恢复性矩阵（recoverability matrix）：定义要捕获的证据、要测试的反事实状态、要保持的等价性，以及恢复语言能表达的逆操作。作者强调 EvoUndo 针对的是已建模的内存内 harness 组件，而非分布式数据库、第三方 API、非托管操作系统进程或未建模的网络状态；它提供的是经验性的往返证据而非证明级保证。

What the paper diagnoses

Hidden-state probes can detect hallucinations, but a strong probe score alone does not reveal whether the detector exploits nonlinear structure or simply estimates a high-dimensional linear signal well. Lee, Seo, and Lim examine this using paired factual and hallucinated examples. Their central nine-condition analysis uses Llama-3.1-8B, Mistral-7B, and Qwen2.5-7B on TruthfulQA, HaluEval-Dialogue, and FaithDial; the paper separately reports a scaling evaluation across 25 models from 0.5B to 70B.

The paper extracts hidden states at the last token and applies StandardScaler fitted on training data for all methods. It does not give detailed pair-construction or separate projection-normalization procedures in its experimental setup. The factual-versus-hallucinated mean-shift vector is estimated within each cross-validation training fold, so test-fold labels are not used to construct the reported direction.

Separate the mean direction from residual discrimination

At an oracle single layer—a layer chosen with held-out oracle knowledge—the one-dimensional projection onto the class mean-shift direction reaches 0.834 AUROC, averaged across the nine central conditions. Removing that direction reduces AUROC to 0.499, effectively chance in this evaluation. This supports a bounded conclusion: paired factual-versus-hallucinated examples are organized primarily around a class mean shift, but that one-dimensional feature does not capture all available discrimination.

A full-dimensional L2-regularized logistic-regression probe, using C = 0.001, reaches 0.952 mean AUROC. To diagnose the remaining gap above the 1D result, the authors compare Fisher LDA with shrinkage LDA, which regularizes covariance estimation for hidden states of roughly 4,000 dimensions. Shrinkage LDA reaches 0.920 mean AUROC and closes at least 73% of the Fisher-LDA-to-L2-LR gap by the authors’ calculation. They interpret this as evidence that much of the residual gain concerns high-dimensional covariance estimation rather than an exploitable nonlinear decision boundary. That interpretation remains qualified: the paper notes the residual gap could include non-Gaussian structure or implicit feature selection from L2 regularization. In a controlled MLP comparison, per-condition AUROC differences from L2-LR are at most 0.002.

LayerMix replaces oracle layer choice

LayerMix uses nested 5-fold CV within each outer training fold to score layers, selects the top K = 5, trains per-layer L2-LR probes, and uniformly averages their predictions. The authors report a model-specific contiguous band of useful layers. LayerMix averages 0.954 AUROC, versus 0.952 for the oracle single layer; its practical role is therefore avoiding oracle layer selection, not delivering a large absolute accuracy gain.

The transferable research operation is to ablate the mean direction first, measure what regularized covariance modeling restores, and only then compare nonlinear architectures on identical representations and splits. This evidence is limited to white-box, paired-example sequence-level detection. The paper’s Qwen2.5-7B-Instruct pilot found paired-to-generated mean-direction transfer at 0.477 AUROC, so it does not establish free-form transfer; persistence at frontier-class models such as 400B+ parameters is also unverified.

DP-SGD is commonly assessed using an accountant-derived privacy upper bound, ε_ub. Modi et al. argue that an audit-derived empirical lower bound, ε_lb, is a complementary quantity: earlier DP-SGD audits had obtained nearly matching lower bounds in several threat models. Their narrower question is whether measured leakage can fall without worsening the formal accounting result.

Their wrapper periodically computes a sample signature for each example from that example and the current privately trained model. It selects high-scoring unfiltered samples globally or within each represented class, then substitutes zero gradients for selected samples in later DP-SGD updates. Evaluated signatures include gradient norms, prediction margin, and prediction entropy; the default configuration uses per-class L∞ gradient-norm scoring. Appendix D separately compares clipped and unclipped variants.

The formal result is preservation, not a stronger DP guarantee. In the Poisson-subsampled RDP setting, a signature may depend on other training data only through the private model; the trainer must be permutation-invariant; and, conditional on preceding private output, the filter must map neighboring datasets to neighboring filtered datasets. Lemma 4 gives the interleaved RDP-composition step and Lemma 5 the top-k removal property. Corollary 1 then preserves the applicable Theorem 1 accounting bound, subject both to those filtering conditions and to Theorem 1’s conditions, including q < 1/5, σ > 4, and its stated restriction on α.

In hidden-state, input-space audits on MNIST, CIFAR-10, and Purchase100, the authors report that filtering often lowers ε_lb with limited utility loss. For MNIST/CNN and CIFAR-10/WRN-16, they report values near zero for almost every ε_ub in {2, 4, 6, 8, 10}; Appendix D reports ε_lb = 0 for clipped L∞ gradient-norm filtering on CIFAR-10/CNN. These are not formal audit certificates. The primary GDP/no-holdout results use two explicitly non-formal heuristics: uncorrected multiple-hypothesis testing, which has a false-discovery problem without correction or an independent holdout, and GDP extrapolation when the actual trade-off curve is not GDP. The paper identifies Poisson subsampling and hidden-state output marginalization as cases where GDP does not generally apply. Appendix J reports Clopper–Pearson results across holdout splits, which the authors describe as generally weaker.

The empirical benefit is conditional. Filtering increased ε_lb in several configurations, a Purchase100 ε_ub = 10 run had anomalously large utility loss, and a defense-aware gradient-canceling attack raised a group ε_lb from 4.43 without the defense to 27.26 with it. That group statistic is not a single-record comparison. A ColoredMNIST study also reports preferential minority-subgroup removal and disparate utility loss. The transferable operation is to check the implementation’s adjacency condition, formal accountant assumptions, conservative audits, defense-aware attacks, and subgroup costs separately.

Existing prompt-injection benchmarks mostly use short inputs, creating a mismatch with document workflows that embed untrusted text among thousands to tens of thousands of tokens. LongPIBench changes the evaluation distribution rather than proposing a new defense. It covers paper peer review, résumé screening, code review, and email summarization; each suite has 100 synthetic instances plus a real-world dataset. The paper identifies ICLR submissions, a résumé dataset, real code-review data, and Enron emails as its real-data sources.

The benchmark inserts six heuristic attacks and two GCG-based optimization variants into documents, then evaluates eight LLMs. It uses attack-success rate (ASR) for prevention experiments and false-positive/false-negative rates for detection. Document format, injection position, task decision, and context length become experimental variables rather than incidental prompt details.

The reported failures are sharp but setting-specific. With no defense, the Combined Attack reached 100% ASR on synthetic paper review. The authors also report 100% ASR for MetaSecAlign 8B on that dataset under the Combined Attack. This is a concrete long-context failure case relative to the low ASRs reported on several earlier benchmarks; it does not establish failure across SecAlign model sizes or deployments. The paper specifies MetaSecAlign’s expected message-role format, but does not provide a checkpoint hash, tokenizer details, input-normalization procedure, or insertion-location sampling for this comparison. Those omissions leave configuration effects unresolved.

Optimization-based attacks also remain effective in the reported setting: GCG reached 1.00 ASR on synthetic paper review and résumé screening. LongPIBench says it adopts GCG’s default hyperparameters. Zou et al.’s GCG uses gradient-guided discrete-token optimization and reports that longer optimization can overfit source models and reduce transfer. LongPIBench does not report optimizer steps, seeds, logs, final triggers, or whether each result is white-box optimization, surrogate-to-target transfer, or both. Those details are needed to interpret—not merely reproduce—the GCG results.

The transferable research operation is a grid over context length, injection position, task decision, and detector threshold. The paper reports higher ASR for middle/end than front insertion, especially in email summary and code review, while its detectors exhibit high-FPR/high-FNR trade-offs. Before attributing this pattern to a defense method, request deployment metadata and retune thresholds on long-context validation data. Finally, scope the evidence correctly: LongPIBench uses static, single-call document inputs, not stateful multi-step workflows with external tools or environment interaction.

Earlier studies reported targeted human-designed interventions: synthetic-data finetuning reduced sycophancy under a model-knowledge filtration condition, while consistency training used a model’s own clean-prompt outputs to reduce sycophancy and jailbreaks. This paper asks a process question beyond either result: can an agent propose, implement, assess, and iteratively improve post-training methods under a fixed experimental budget?

Chen, Wen, and Kirchner build an automated alignment researcher (AAR) harness around Claude Opus 4.8. Agents submit a self-contained mini-paper and code. The approval stage bars a submitted method from using benchmark or evaluation data and from using stronger or frontier models to generate training data. Accepted proposals train for roughly 30 minutes on one H200 GPU. The AARs hill-climb a geometric mean of closed-headroom fractions across three to five benchmarks per failure, with capability gates on MMLU, GSM8K, and IFEval.

The authors report that their strongest methods reduce each of ten targeted failures and transfer to a benchmark withheld from the AAR, multi-turn Petri behavioral audits, and models up to 4.7× larger. These tests matter because optimizing only the visible suite could reward benchmark-specific fixes. They are still evaluations on supplied benchmarks and audits, not evidence of deployment safety. The paper defines the held-out benchmarks and their intended distribution shifts, but the supplied text does not bundle raw held-out items, complete winning-method configurations, seeds, metric artifacts, or audit outputs needed for independent reproduction.

The paper compares the AAR with 30 one-shot ideas from 28 experienced safety researchers. Participants had at least one year of technical AI-safety experience and a relevant paper, received up to eight hours to develop an idea, and accepted implementations were trained with three seeds. The best capability-passing AAR methods reportedly exceeded the best human idea on each of the seven failures with human submissions, reaching that point in 6.4 hours on average. This is a constrained comparison, not evidence against better-resourced or iterative human teams; the authors also note that choosing the best of roughly 150 scored AAR methods biases the maximum upward under noisy evaluation.

A sycophancy ablation on Qwen3.5-2B gives the clearest mechanism-level lesson. Supervised finetuning alone, even with templated or self-generated data, reached lower ceilings than runs allowed KL self-distillation and, in the unconstrained run, activation steering. The authors’ statement that “Most of the gap is the training objective” supports objective ablations for this setting, not a general claim that data construction is secondary.

Research operation to borrow: audit the research loop itself. Reserve an untouched transfer evaluation, separate data freedom from objective freedom in ablations, and retain proposal-level logs. The source describes the approval constraints and post-hoc monitor rubric; reproducing its 39-of-1,601 cheating finding still requires trajectory data, monitor outputs, and evidence about missed cheating attempts.

A harness edit can improve capability yet still be unsafe to retain if its persistent effects cannot be reversed after the agent reaches a different state. EvoUndo makes recoverability an admission test: before accepting a self-generated harness mutation, it tests recovery across counterfactual states rather than relying on iterative prompting or a later rollback.

The paper represents a candidate as a mutation m, witness capture w, recovery program u, and effect contract C_e. It applies m, uses w and u to reconstruct the pre-mutation state, then checks typed observational equivalence through round trips on development and hidden harness states. If recovery fails, repair may change w, u, and C_e, but not m; this tests recovery logic around a frozen forward edit, not joint redesign of an edit and its inverse. In the authors’ terminology, repair budget B=4 caps this bounded repair loop at four attempts (Sections 4–6 and Appendix H.5). The base and richer recovery languages, L₀ and L₁, including their primitive sets, are defined in Appendices C–D.

In the reported natural benchmark, one generated mutation was evaluated for each of 600 unseen self-evolution tasks; the task cohort is described in §4.3, while the deterministic constructive-oracle procedure is specified in §4.4 and Appendix G. Of the 600 mutations, 197 were capability-positive but failed recovery verification. Under base language L₀ and B=4, four verifier-guided repair modes recovered 0/197, while independent regeneration recovered 6/197. The oracle—given the pre-state, frozen mutation AST, effect contract, and evaluator suites—found 48/197 oracle-recoverable under L₀ and 191/197 under richer L₁. This supports a representational bottleneck within this benchmark; it is not a completeness result for either language.

The factorial intervention separates two reported bottlenecks. For oracle-defined S₀, where L₀ was sufficient, exact state-address diagnostics recovered 38/48 cases (79.2%). For S₁, where the oracle required L₁, coarse diagnostics plus L₁ recovered 142/143 (99.3%). On gpt-oss-120b, exact diagnostics with L₁ instead recovered 133/143; a Qwen3.8-27B subset replication did not reproduce that negative interaction, so its generality remains uncertain.

A transferable research operation is a recoverability matrix for each editable surface: define the witness to capture, counterfactual states to test, equivalence to preserve, and inverse operations the recovery language can express. The authors stress that EvoUndo covers modeled in-memory harness surfaces, not distributed databases, third-party APIs, unmanaged OS processes, or unmodeled network state; it supplies empirical round-trip evidence rather than proof-level guarantees.

研究人员测试了一种做法：让推理模型保留完整任务提示词，但只在其键/值缓存中保留近期生成思维的一小段，而不是存储整条链。他们发现，这一 Prefix Sliding 规则在长输出时保持了报告的 Qwen3-1.7B 质量，同时显著加快了解码，因为在提示词和局部窗口填满后，保留状态不再增长。这改变了评估长测试时扩展的方式：在所测试的设置中，许多旧推理 token 可以被驱逐；不过，所测试的 LiveCodeBench 案例也显示了一个边界：早期写下的代码可能在经过长时间推理后丢失，且论文未报告延迟事实引用评估。

在全注意力中，每个新 token 都能访问所有更早的 token，因此缓存会保留完整生成轨迹。Prefix Sliding 永久保留系统和任务提示词，包括可用的工具定义，并且只加入最新生成的窗口；较早生成的 token 会离开缓存。因此，即使推理持续数十万 token，保留的解码缓存也由固定前缀长度加局部窗口所限制。这并不会降低提示词 pre-fill 成本：极长前缀仍可能消耗大量内存。一个自定义的、兼容 Hopper/FlashAttention 的内核会跳过该区域之外的注意力 tile。作者还使用“Continue PE”：保留的 token 在驱逐后维持原始位置编码，从而避免重建缓存。

这是对已有流式缓存模式的扩展。StreamingLLM 已通过保留一小组初始 token 加上滚动的近期缓存，实现了成本有界的解码。更直接的先例是 H2O：这是一种更早的免训练 KV 缓存策略，动态保留 attention heavy hitter 与近期 token，并报告端到端生成推理结果。Prefix Sliding 则预先固定保留的前缀，并将其与近期窗口结合；其增量在于这种前缀保留策略、自定义内核，以及将其应用于长推理和截断反向传播训练，而不是首个有界缓存解码器。该固定前缀旨在保留小规模 attention-sink token 或事后选出的 heavy hitter 可能无法保留的指令和工具。

训练方案将同一区分应用于长强化学习 rollout。训练器接收最近四个局部窗口：前面三个提供上下文，最后一个窗口接收学习损失。在采用这一近似前，作者比较了随着所提供上下文增长，生成器和训练器的对数概率。这是一项有用的研究操作，因为它衡量训练器是否复现了生成器的局部行为；它并不能证明对远早于最后窗口的动作进行了等效的信用分配。

最清晰的免训练证据见附录 C 的表 1。在使用 4,096-token 窗口的 Qwen3-1.7B 上，Prefix Sliding 报告的 AIME25 avg@64 为 33.9，而全注意力为 34.2，其中 avg@64 是 64 次随机运行结果的均值。在同一服务基准中，在一张 80GB H100 上使用 vLLM 自动批处理和 FlashAttention 时，32K 序列长度下的吞吐量为 5,479 对 1,477 tokens/s。该结果支持一个质量—吞吐量表现强劲的工作点，但该表并未确立相同 token 数下的质量：两种方法产生的平均输出长度不同，且未报告不确定性区间。

可迁移的操作是在驱逐上下文前对其分类：保留不可变的任务状态，限制近期工作状态，并用延迟引用任务测试驱逐规则。论文的 LiveCodeBench 局限给出了重要边界：当早期写下的代码在经历长时间推理后仍被需要时，短窗口可能丢失必要状态。因此，Prefix Sliding 是适用于合适长时程轨迹的实用缓存策略，而不是历史推理可被普遍丢弃的证据。

研究人员提出，每个矩阵更新方向是否都应使用相同的步长。他们将每次更新拆分为最强方向和其余方向，然后在一个新批次上而非产生该更新的批次上，比较每部分能承受多大的步长。最强方向能承受的步长大致为 Muon 当前的尺度，而其余主体能承受更大的步长，因此 SAMuon 将最强方向维持在接近 Muon 的尺度，并放大主体方向的步长。为进行下述比较，论文将其调优后的 Scion 实现称为“Muon”。这使得为每个方向分配相等更新幅度在主体部分显得保守，但对 Muon 相对于 Adam 和 SGD 的更广泛解释仍只是启发性的，并未得到完全确立。

Muon 为每个矩阵保留动量缓冲区并对其进行白化，因此其最强方向和其余奇异方向获得近似相等的更新幅度。论文新增的操作是一种样本外、按秩分辨的探针。在某个检查点，一个梯度批次更新缓冲区；作者将 72 个矩阵缓冲区分解为奇异方向，并从所有矩阵中的相同秩构成一个全模型探针。随后，一个不相交的留出批次决定沿该探针迈出一步有多大效用。局部二次估计在不构建 Hessian 的情况下给出偏好步长，附录还在相关范围内将该估计与直接的一维步长搜索进行了核对。这扩展了对 Muon 的并行曲率解释：它测量可迁移的逐秩分配，而不只是比较汇总的批内曲率量。

探针显示出一个不稳定的头部和一个宽容的主体。在 64M Muon 轨迹上，领先方向的偏好步长与 Muon 的统一尺度相一致，而主体方向偏好大数倍的步长。SAMuon 将多个领先方向维持在接近 Muon 的尺度，并提高主体尺度。完整版用随机低秩 SVD 估计多个领先方向，并施加渐进的基于秩的配置。SAMuon-lite 只用幂迭代估计领先奇异对，保持该方向锚定，并对其他所有方向统一提升。两者都保留了与 Scion/Muon 相同的持久动量缓冲状态，并在训练早期逐渐引入这种塑形。

主要比较使用了七个 FineWeb 预训练单元，涵盖 124M 至 1B 参数、12 层的 modded-nanogpt 模型。相对于论文调优后的 Scion 实现——即其称为 Muon 的实现——SAMuon 在每个评测单元中都达到更低的最终验证损失，并估计达到 Scion 最终损失所需 token 减少 13.3%–24.0%。这一比较并不对称：超参数在 124M 模型上按批次大小调优后迁移至不同规模；SAMuon 使用固定半径 50，并在更大规模上不重新调优地迁移 gamma，作者指出，为 Muon 优化的日程和更大规模设置使其相对调优不足。相对于 Scion 日程，SAMuon-lite 实现了 13.3%–22.1% 的 token 效率提升，保留了 SAMuon 的 13.3%–24.0% 增益中的大部分。这些估计来自分别训练的、缩短且完全退火的日程。每种配置只有一个随机种子，且比较对象是 Scion，而不是单独测试的原版 Muon 实现。在一次计时测试中，lite 每次迭代增加 0.5%，而完整版 SAMuon 的 SVD 增加 7.4%；这是在一套 RTX 6000 Ada 设置上测得的，并非端到端的达到目标时间测量。

可复用的研究操作是：从一个批次构成方向，在另一个批次上测量其有效步长，根据直接搜索验证廉价估计器，然后测试由该配置所建议的最简单分配规则。这种分离可揭示由拟合构造批次造成的表观尾部容量。证据仍局限于局部和一次一个方向：跨秩交互、模块特定行为、更大部署宽度和多随机种子变异性尚未解决；Adam 比较省略了非对角耦合，且主要网格中没有 SGD 运行。

RealSWE 将一项可执行的仓库任务变成多个请求变体，在保持代码、测试和金标准补丁不变的同时，改变请求中包含哪些部分或这些部分的措辞。它发现，在四个受测模型中，加入软件应具备何种行为的明确陈述，能一致地改善稀疏缺陷修复请求。这会影响我们对编程智能体基准的解读：分数差异可能反映了缺失的规格内容，而不只是模型能力。

对于一个缺陷报告，问题陈述描述看起来出了什么问题，而期望行为说明正确结果应是什么样。RealSWE 还区分复现步骤、环境信息和附加上下文。先前工作已表明，将经过润色的基准 issue 改写成更像用户提出或更缺乏规格的请求，可能降低智能体成功率，其中包括 Saving SWE-Bench。RealSWE 的方法学新增点是组合控制：它从同一任务创建多个变体，从而能够将字段内容与面向更口语化风格的整体改写分开测试。

作者从 SWE-bench Verified 和 Pro 中导出 381 个任务家族，其中包括 192 个缺陷修复，并以相同的 mini-SWE-agent 设置、源容器、步数上限和重复运行进行评估。其真实性目标来自经过筛选的 SWE-chat 首轮样本：大多数保留请求只包含问题陈述，或包含该陈述和有限的附加上下文。这些家族是所选源任务，其所需字段均存在；对于 101 个缺陷修复任务，环境信息还取自发布的执行容器。所报告的“Original”条件也源自原始资料：对于一些任务，它从容器补充环境信息，并合并 Pro 描述中的部分内容。

最清晰的匹配比较是在保持底层任务不变的条件下，将期望行为加入问题陈述。在四个模型中，三次运行多数决的解决率增益为 6.8 至 9.9 个百分点，且每个模型层面的比较都通过了论文的多重比较校正。沿所测试路径移除复现步骤、环境信息或附加上下文，并未产生一致的平均损失；这并不表明这些细节对个别事件没有用。在并行的全字段改写中，将表达改为目标随意风格没有产生稳定的解决率效应，这支持了如下解释：稳健结果更紧密地关联于缺失的预期，而非这种整体语言重述。

可迁移的研究操作是在将性能变化归因于真实性之前，先构建匹配的任务家族。保留可执行任务和验收目标，一次改变一个沟通因素，并结合语义保留审计使用按任务配对的结果。对于稀疏的单轮缺陷报告，匹配结果表明预期行为可能是高价值的澄清目标；但尚未测试智能体是否应首先询问它。该建议仍以这些选定源任务家族、四个模型和单轮脚手架为条件；RealSWE 未测试交互式澄清策略。

MemToC 固定一个问题和可执行工具调用，记录模型在看到工具之前的回答，然后替换为已知正确性的一项工具返回。它发现，在模型强制闭卷回答正确且工具返回为貌似合理、近似但错误的情形中，四个经指令微调的 7–9B 模型仅在 6.5–17.1% 的符合条件事件中保留了该答案。这改变了研究人员评判工具使用的方式：只有在工具正确时遵从工具才有用，因此评估必须区分来源偏好与来源正确性。

先前工作已引出纯记忆回答和工具条件下的回答，并依据任务金标准标注它们的正确性，包括任一来源正确、两者均正确或两者均不正确的情况 TMC，第 3.5 节；第 4 节和表 1。MemToC 更狭窄的新增点是一项受控的调用后干预。它从 ToolHop 导出事实性问题；ToolHop 提供可执行工具底层设施和经验证的答案 ToolHop，第 2 节。该方法固定调用，并仅将观测到的返回替换为经验证正确的值或貌似合理、类型一致的错误值。对于每个模型，作者首先强制其给出闭卷最佳猜测。然后，他们通过将该回答和工具返回与经验证答案比较，对事件分类：只有模型回答正确、只有工具正确、两者均正确，或两者均不正确。最终响应分别按照保留正确答案、遵从正确工具和重复错误工具评分。

主要比较覆盖 542 个经筛选的事实性问题、三种指令表述和四个经指令微调的模型。在仅记忆正确的情形中，模型只在 6.5–17.1% 的符合条件事件中保留正确答案。当模型回答错误而工具正确时，它们在 86.0–93.1% 的情形中遵从工具。当两个来源都错误时，它们仍会在 78.4–86.0% 的情形中重复工具返回。这些汇总范围针对每个模型平均了三种指令表述；每个模型按表述区分的估计都使用其自身符合条件的来源正确性案例。因此，它们支持关于该受控设置中遵从行为的强结论，同时避免给出普遍性的模型排名。强制闭卷回答是最佳猜测，而非对信念的直接测量，因此保留应被理解为常规交互行为的、特定于该协议的上界。

可复用的研究操作是在测量裁决前，标注两个相互竞争的来源。对于检索或智能体基准，收集证据前回答，独立验证外部值，在相同问题和接口下注入正确及貌似合理的错误证据，并分别报告这三种行为。如果所得数据用于监督微调或偏好优化，MemToC 还说明，数据划分应遵循完整工具链和相关事实群组，而不应仅按问题 ID。证据仍受限于一个源自 ToolHop、以人物传记为主的基准，合成的短返回和开放权重模型，因此它确立的是一种测量模式和对工具遵从的明确诊断，而不是智能体行为的一般规律。

FaithSieve 通过将一个自然语言数学证明的每个编号步骤拆解为更小的转换，将选定转换翻译为形式化义务，并用定理证明器 Lean 进行检查，来评估该证明。它报告，在其奥赛基准上，其精确定位优于一次性语言模型判定器。这使评估问题从“某个形式化陈述是否可被证明”转向“该陈述是否仍表达了正在判定的局部推理步骤”。

首错定位和细粒度证明评估在 ProcessBench 和 Hard2Verify 中已有先例，而 Chain-of-States 工作已在形式化证明构建期间用 Lean 检查相邻的证明状态。FaithSieve 的具体增量是将这些思路结合起来，用于审计已有、可能不正确的非形式化证明。原始编号步骤仍是输出地址，而称为 EdgeUnit 的内部单元记录输入假设、当前目标、所得上下文和目标，以及所执行的转换类型。

这一更细的单元支持按类型的检查。一个导出的事实必须能从此前可用的上下文推出；目标归约必须确实足以满足前一目标；分类讨论必须覆盖相关情形；所选见证必须满足其目标。当一个步骤引入事实并用它归约目标时，FaithSieve 会先检查引入的事实。一个怀疑搜索阶段选择可能有问题的单元和一段较短的前序上下文窗口，在限制形式化量的同时保留回溯到原始步骤的路径。

生成的 Lean 陈述在其证明或反驳被用作证据前，要经过语义闸门。该闸门检查假设、对象、见证、方向、逻辑角色和结论是否仍与自然语言义务对齐。仅有编译或证明搜索并不足够；形式化失败、超时和闸门失败均被视为无定论。所得局部证据随后被映射回粗粒度的编号步骤。

主要比较在 ProofLoc-Olympiad 上进行：350 道代数和数论问题，每道题均使用一份由 GPT-4o 生成的编号证明和专家标注进行评估。相较于仅获得问题和编号证明的一次性 GPT-5.4 判定器，FaithSieve 的精确首错准确率为 81.43%，而前者为 72.29%。精确准确率要求正确给出“正确”标签，或准确给出最早出现错误的编号步骤。这是对完整流程——分解、调度、类型化义务、语义筛选、形式检查和综合——的证据，而不是仅对 Lean 检查的证据，因为所有这些组成部分以及大得多的 token 预算都同时发生了变化。

这一保障措施也有明确弱点。在对 135 个生成形式化陈述的审计中，语义闸门接受了 20 个被专家标为不忠实陈述中的 13 个。因此，FaithSieve 提供的是有条件地有用的形式化证据，而非成功的 Lean 证明代表源推理的保证。所报告的 50 道问题成本测量中，GPT-5.4 使用的记录 token 数也是直接判定的 137.22 倍。

可迁移的研究操作是将用于报告的单元与用于验证的单元分开。在两者之间保留确定性映射，在后续义务中使用新引入的事实前先检查它，并将形式化或证明搜索失败记录为不确定性，而非错误标签。

The researchers test whether a reasoning model can keep the complete task prompt while retaining only a recent slice of its generated thoughts, instead of storing the whole chain in its key/value cache. They find that this Prefix Sliding rule preserves reported Qwen3-1.7B quality at long outputs while making decoding much faster, because the retained state stops growing after the prompt and local window are filled. This changes how one can judge long test-time scaling: in the tested setup, many old reasoning tokens can be evicted, although the tested LiveCodeBench case shows a boundary: code written early can be lost after a long interval of reasoning, and the paper does not report an evaluation of delayed factual-reference tasks.

In full attention, each new token can access every earlier token, so the cache keeps the entire generated trace. Prefix Sliding permanently retains the system and task prompt, including available tool definitions, and adds only the most recent generated window; older generated tokens leave the cache. The retained decoding cache is therefore bounded by the fixed prefix length plus the local window, even when reasoning continues for hundreds of thousands of tokens. This does not reduce the prompt pre-fill cost: extremely long prefixes can still consume substantial memory. A custom Hopper/FlashAttention-compatible kernel skips attention tiles outside this region. The authors also use “Continue PE”: retained tokens keep their original positional encoding after eviction, avoiding cache reconstruction.

This is an extension of an existing streaming-cache pattern. StreamingLLM already retained a small set of initial tokens plus a rolling recent cache for bounded-cost decoding. A closer predecessor is H2O, an earlier training-free KV-cache policy that dynamically retains attention heavy hitters together with recent tokens and reports end-to-end generative-inference results. Prefix Sliding instead fixes the retained prefix in advance and combines it with a recent window; its increment is this prefix-preserving policy, the custom kernel, and its application to long reasoning and truncated-backpropagation training, not the first bounded-cache decoder. The fixed prefix is intended to preserve instructions and tools that a small set of attention-sink tokens or retrospectively selected heavy hitters might not retain.

The training recipe applies the same distinction to long reinforcement-learning rollouts. The trainer receives the last four local windows: the earlier three provide context, while the final window receives the learning loss. Before using this approximation, the authors compare generator and trainer log probabilities as the supplied context grows. This is a useful research operation because it measures whether the trainer is reproducing the generator’s local behavior; it does not establish equivalent credit assignment for actions far before the final window.

The clearest training-free evidence is Appendix C, Table 1. On Qwen3-1.7B with a 4,096-token window, Prefix Sliding reports AIME25 avg@64 of 33.9 versus 34.2 for full attention, where avg@64 is the mean result over 64 stochastic runs. In the same serving benchmark, throughput at a 32K sequence length is 5,479 versus 1,477 tokens per second on one 80GB H100 using vLLM auto-batching and FlashAttention. The result supports a strong quality-throughput operating point, while the table does not establish equal-token quality: the methods produce different average output lengths, and no uncertainty intervals are reported.

The transferable operation is to classify context before evicting it: preserve immutable task state, bound recent working state, and test the eviction rule with delayed-reference tasks. The paper’s LiveCodeBench limitation gives the important boundary: when code written early is needed after a long interval of reasoning, a short window can lose necessary state. Prefix Sliding is therefore a practical cache policy for suitable long-horizon traces, not evidence that historical reasoning is universally disposable.

Researchers ask whether every direction in a matrix update should use the same step size. They split each update into its strongest direction and the remaining directions, then compare how much step size each part can tolerate on a fresh batch rather than on the batch that produced the update. The strongest direction tolerates roughly Muon’s current scale, while the remaining bulk tolerates larger steps, so SAMuon keeps the strongest direction near Muon’s scale and enlarges the steps for bulk directions. For the comparison below, the paper calls its tuned Scion implementation “Muon.” This makes assigning equal update amplitude to every direction look conservative in the bulk, while leaving the broader explanation of Muon versus Adam and SGD as suggestive rather than fully established.

Muon keeps a momentum buffer for each matrix and whitens it, so its strongest direction and the remaining singular directions receive approximately equal update amplitude. The paper’s added operation is an out-of-sample, rank-resolved probe. At a checkpoint, one gradient batch updates the buffers; the authors decompose 72 matrix buffers into singular directions and assemble one model-wide probe from the same rank across all matrices. A disjoint held-out batch then determines how useful a step along that probe is. A local quadratic estimate provides the preferred step size without constructing a Hessian, and an appendix checks the estimate against direct one-dimensional step searches in the relevant range. This extends the concurrent curvature account of Muon by measuring transferable per-rank allocation, rather than only comparing aggregate in-batch curvature quantities.

The probes show a volatile head and a tolerant bulk. On the 64M Muon trajectory, the leading direction’s preferred step coincides with Muon’s uniform scale, while bulk directions prefer steps several times larger. SAMuon keeps the leading directions near the Muon scale and increases the bulk scale. The full version estimates several leading directions with randomized low-rank SVD and applies a gradual rank-based profile. SAMuon-lite estimates only the leading singular pair with power iteration, keeps that direction anchored, and boosts everything else uniformly. Both retain the same persistent momentum-buffer state as Scion/Muon and warm in the shaping during early training.

The main comparison uses seven FineWeb pretraining cells from 124M to 1B-parameter, 12-layer modded-nanogpt models. Against the paper’s tuned Scion implementation—the implementation it calls Muon—SAMuon reaches lower final validation loss in every evaluated cell and is estimated to require 13.3%–24.0% fewer tokens to reach Scion’s final loss. The comparison is asymmetric: hyperparameters were tuned per batch size on the 124M model and transferred across scales; SAMuon used a fixed radius of 50 and transferred gamma without retuning at larger scales, and the authors note that its Muon-optimized schedule and larger-scale settings leave it relatively under-tuned. SAMuon-lite achieves a 13.3%–22.1% token-efficiency improvement relative to the Scion schedule, retaining most of SAMuon’s 13.3%–24.0% gain. These estimates come from separately trained shortened, fully annealed schedules. Each configuration has one seed, and the comparison is against Scion rather than a separately tested vanilla-Muon implementation. In one timing test, lite added 0.5% per iteration, whereas full SAMuon’s SVD added 7.4%; this was on one RTX 6000 Ada setup, not an end-to-end time-to-target measurement.

The reusable research operation is to form directions from one batch, measure their useful step sizes on another, validate the cheap estimator against direct search, and then test the simplest allocation rule suggested by the profile. That separation can expose apparent tail capacity caused by fitting the construction batch. The evidence remains local and one-direction-at-a-time: cross-rank interactions, module-specific behavior, larger deployed widths, and multi-seed variability are unresolved, and the Adam comparison omits off-diagonal couplings while the main grid contains no SGD run.

RealSWE turns one executable repository task into several request variants, keeping the code, tests, and gold patch fixed while changing which parts of the request are present or how they are worded. It finds that adding an explicit statement of the behavior the software should have consistently improves sparse bug-fix requests across four tested models. This affects how we interpret coding-agent benchmarks: a score difference can reflect missing specification content rather than model capability alone.

For a bug report, the problem statement describes what appears to be wrong, while desired behavior states what a correct result should look like. RealSWE also separates reproduction steps, environment information, and additional context. Earlier work had already shown that mutating polished benchmark issues into more user-like or underspecified requests can reduce agent success, including Saving SWE-Bench. RealSWE’s methodological addition is compositional control: it creates multiple variants from the same task so that field content can be tested separately from a bundled rewrite into a more conversational style.

The authors derive 381 task families from SWE-bench Verified and Pro, including 192 bug fixes, and evaluate them with the same mini-SWE-agent setup, source containers, step limit, and repeated runs. Their realism target comes from a filtered first-turn sample of SWE-chat: most retained requests contain only a problem statement or that statement plus limited additional context. The families are selected source tasks whose required fields are present, with Environment Information additionally taken from the released execution container for 101 bug-fix tasks. The reported “Original” condition is also source-derived: for some tasks it supplements environment information from the container and combines parts of the Pro description.

The clearest matched comparison adds desired behavior to the problem statement while holding the underlying task fixed. Across the four models, the majority-of-three-run resolution gain ranges from 6.8 to 9.9 percentage points, with every model-level comparison surviving the paper’s multiple-comparison correction. Removing reproduction steps, environment information, or additional context along the tested paths produces no consistent average loss; this does not show that such details are useless for individual incidents. In the parallel all-field rewrite, changing the expression toward the target casual style produces no stable resolution effect, supporting the interpretation that the robust result is tied more closely to missing expectations than to this bundled linguistic rephrasing.

The transferable research operation is to build matched task families before attributing performance changes to realism. Preserve the executable task and acceptance target, alter one communication factor at a time, and use paired per-task outcomes with a semantic-preservation audit. For a sparse single-turn bug report, the matched results suggest that expected behavior may be a high-value clarification target; whether an agent should ask for it first was not tested. That recommendation remains conditional on these selected source families, four models, and the single-turn scaffold; RealSWE does not test an interactive clarification policy.

MemToC fixes a question and executable tool call, records the model’s answer before seeing the tool, and then substitutes a tool return whose correctness is known. Among episodes where the model’s forced closed-book answer was correct, four 7–9B instruction-tuned models retained that answer after a plausible near-incorrect tool return in only 6.5–17.1% of eligible cases. This changes how researchers should judge tool use: following a tool is useful only when the tool is correct, so evaluation must separate source preference from source correctness.

Earlier work already elicited memory-only and tool-conditioned answers and labeled their correctness against task gold, including cases where either, both, or neither source was correct TMC, §3.5 and Table 1. MemToC’s narrower addition is a controlled post-call intervention. It derives factual questions from ToolHop, which supplies the executable-tool substrate and verified answers ToolHop, §2.1–§2.3, fixes the invocation, and replaces only the observed return with either a verified-correct value or a plausible, type-consistent wrong value. For each model, the authors first force a closed-book best guess. They then classify the episode by comparing that answer and the tool return with the verified answer: only the model answer is correct, only the tool is correct, both are correct, or neither is correct. The final response is scored separately for retaining a correct answer, following a correct tool, and repeating an incorrect tool.

The main comparison covers 542 curated factual questions, three instruction formulations, and four instruction-tuned models. In the memory-only-correct cases, models retain the correct answer in only 6.5–17.1% of eligible episodes. When the model answer is wrong and the tool is correct, they follow the tool in 86.0–93.1% of cases. When both sources are wrong, they still repeat the tool return in 78.4–86.0% of cases. These pooled ranges average the three instruction formulations for each model; each model’s formulation-specific estimates use its own eligible source-correctness cases. They therefore support a strong conclusion about deference in this controlled setting, while avoiding a universal model ranking. The forced closed-book answer is a best guess rather than a direct measurement of belief, so retention should be interpreted as a protocol-specific upper bound on ordinary-interaction behavior.

The reusable research operation is to label both competing sources before measuring arbitration. For a retrieval or agent benchmark, collect a pre-evidence answer, verify the external value independently, inject correct and plausible incorrect evidence under the same question and interface, and report the three behaviors separately. If the resulting data are used for supervised fine-tuning or preference optimization, MemToC also demonstrates why splits should follow complete tool chains and related factual groups, rather than question IDs alone. The evidence remains bounded by one ToolHop-derived, mostly biographical benchmark, synthetic short returns, and open-weight models, so it establishes a measurement pattern and a sharp diagnosis of tool deference rather than a general law of agent behavior.

FaithSieve evaluates a natural-language mathematical proof by breaking each numbered step into smaller transitions, translating selected transitions into formal obligations, and checking them with Lean, a theorem prover. It reports better exact localization than a one-pass language-model judge on its Olympiad benchmark. This changes the evaluation question from whether some formal statement can be proved to whether that statement still expresses the local reasoning step being judged.

First-error localization and fine-grained proof evaluation already have precedents in ProcessBench and Hard2Verify, while Chain-of-States work already checks adjacent proof states with Lean during formal proof construction. FaithSieve’s concrete increment is to combine these ideas for auditing an existing, possibly incorrect informal proof. The original numbered step remains the output address, while an internal unit called an EdgeUnit records the incoming assumptions, current goal, resulting context and goal, and the kind of transition performed.

This finer unit supports typed checks. A derived fact must follow from the context available before it; a goal reduction must genuinely suffice for the preceding goal; a case split must cover the relevant cases; and a chosen witness must satisfy its target. When one step introduces a fact and uses it to reduce a goal, FaithSieve checks the introduced fact first. A suspicion-search stage selects likely problematic units and a short preceding context window, limiting the amount of formalization while preserving a path back to the original step.

Generated Lean statements pass through a semantic gate before their proof or refutation is used as evidence. The gate checks whether assumptions, objects, witnesses, direction, logical roles, and the conclusion remain aligned with the natural-language obligation. Compilation or proof search alone is insufficient; failed formalization, timeouts, and gate failures are treated as inconclusive. The resulting local evidence is then mapped back to the coarse numbered steps.

The main comparison is on ProofLoc-Olympiad: 350 algebra and number-theory problems, each evaluated with a GPT-4o-generated numbered proof and expert annotation. Against a one-pass GPT-5.4 judge given only the problem and numbered proof, FaithSieve reaches 81.43% exact first-error accuracy, compared with 72.29%. Exact accuracy requires the correct “correct” label or the exact earliest erroneous numbered step. This is evidence for the full pipeline—decomposition, scheduling, typed obligations, semantic filtering, formal checking, and synthesis—rather than for Lean checking alone, since all of those components and a much larger token budget change together.

The safeguard also has a clear weakness. In an audit of 135 generated formal statements, the semantic gate accepted 13 of 20 statements that experts labeled unfaithful. FaithSieve therefore supplies conditionally useful formal evidence, not a guarantee that a successful Lean proof represents the source reasoning. The reported 50-problem cost measurement also used 137.22 times as many recorded tokens as direct judging for GPT-5.4.

The transferable research operation is to separate the unit used for reporting from the unit used for verification. Preserve a deterministic mapping between them, check newly introduced facts before using them in later obligations, and record formalization or proof-search failure as uncertainty instead of as an error label.

早期关于有效学习率匹配的证据范围更窄：在 GPT-2-124M/OpenWebText 的 AdamW 实验中，匹配由权重衰减产生的有效学习率能够在 float32 中复现完整的训练动力学。该工作也报告说，仅匹配 ELR 并不能阻止部分 bfloat16 的发散，因此该效应是否超出该优化器和该设置尚未解决。 [arxiv:2310.04415v2; S3.p6; S3.p9; S3.F8]

当前论文将该想法转为一种配对的调度匹配检验。实验运行使用相同的初始化和数据顺序种子，同时构造不同的学习率和参数范数调度以匹配 ELR，这里将 ELR 定义为学习率除以参数范数。该研究报道了跨多种优化器、架构、数据集和模型规模的比较，而不仅仅局限于单一的 AdamW 语言模型配置。 [arxiv:2608.24814v1; S1.SS0.SSS0.Px1.p1.2]

核心结果被报告为 ELR 崩塌：当 ELR 调度被匹配时，完整损失轨迹的平均绝对差异仅为几个 10^-3 的量级。该条件很重要：比较是配对的并在预热后评估，因此该结果是受控调度匹配下的轨迹对齐，而不是断言任意运行会变得等同。 [arxiv:2608.24814v1; S1.SS0.SSS0.Px1.p1.2]

消融试验指出了该对齐何时减弱。在报道的 Llama-124M AdamW/FineWeb 环境中，移除 QK-Norm 导致平均崩塌误差从 2.3 times 10^-3 增加到 5.2 times 10^-3。在保持 ELR 的正弦调制下，将周期数从 2 增加到 32 把报告的误差从 2.8 times 10^-3 提高到 7.5 times 10^-3。因此，归一化设计和学习率–范数变化的时间尺度是实验变量，而不是应当隐藏的实现细节。 [arxiv:2608.24814v1; S4.SS2.SSS0.Px1.p2.1]

一个可操作的扩展是基于 ELR 的函数尺度定律。在四条非 Hyperball 轨迹上拟合后，它在不重新拟合的情况下预测了两条留出的 Hyperball 运行，均方根误差平均为 0.0212，而参数化为 LR 的版本为 0.2508。 [arxiv:2608.24814v1; S6.SS0.SSS0.Px2.p2.1]

边界是宏观的：所给的限制记录指出，transformer 并非严格尺度不变，因为它们包含可训练的向量值参数，且论文未提供微观的动力学解释。 [arxiv:2608.24814v1; A1.SS1.p1.2] 因此，一个有用的后续是按步记录 η、参数范数和损失，重现配对的 ELR 干预，然后在刻意变化归一化组件和调制速度时加入表征及下游探针。这样可以把损失轨迹控制与关于模型学到什么的更广泛主张区分开来。

FID 的具体弱点是其基于矩的限制：对于任意具有有限二阶矩且协方差非零的分布，论文证明存在另一分布能共享其均值和协方差，从而使任何仅基于矩的差异——尤其是人口级 FID——为零。FID 和 KID 还生成对换样本不变的标量差异值，因此它们不能编码生成集合是欠离散还是过离散。

论文通过一个参考自适应的 ImageNet 构造演示了第一个限制。将噪声优化为匹配参考 Inception 的均值和协方差的图像在与参考比较时获得 FID 24.7，而对照的留出真实图像为 58.6（较低为更好）。对同一比较，ZID 报告的偏离分数为 17.2 与 0.86，且在 499 个随机标签置换中没有产生同样大的分数；留出比较的置换 p = .328。

ZID 将评估对象从单一标量改为三个关联输出。它结合了六个标准化的位置和离散度敏感分支：RISE、一个秩图表示，以及两个带宽的高斯核表示。然后它报告一个用于排序偏离幅度的索引、一个用于分布等同性的置换校准 p 值，以及一个有符号的离散度读数。当成员符号冲突时，方向性读数是有条件的：ZID 报告“member-sign conflict”而不是强行给出单一的欠或过离散标签。

在对 CIFAR-Inception PCA-128 特征、m = n = 200、300 次重复和 499 次外置换的受控实验中，ZID 是所有测试行中唯一在每个偏离列上功效至少为 .70 的方法。在六档严重性扫掠中，其分数在每个扫掠上均具有正向秩相关，范围从匹配矩的多模态时的 .56 到偏离流形支持时的 .95。消融研究将这种覆盖性归因于互补组件：移除 RISE 在八类偏离中有六类导致最大的功效损失，而移除中值带宽的 GPK 将位置检出功效从 .830 降到 .237，移除小带宽 GPK 则将非线性依赖功效从 .980 降到 .860。

可复用的研究操作是将三个独立问题分开提问——是否检测到偏离、在固定协议下偏离有多大、以及离散方向是否可辩护——而不是把一个指标当作三者兼顾。在比较分数时保持样本量、嵌入、参考集合和预处理固定。对于诸如优化得到的 ImageNet 图像之类的参考自适应集合，置换尾部是描述性的，而不是一个经过总体校准的两样本 p 值。

实验检验的内容

论文针对一个具体的评估局限：“基于检索的评估可以证明那些在投资判断中忽视其明确检索信息的系统是可信的。”作者在保持焦点公司信息不变的同时，将无关上下文长度从 2,000 变为 128,000 个标记，然后把定向检索与披露对投资判断的影响分开。这个实验拆分很有用：可以同时询问系统它是否能陈述一条披露，以及改变该披露是否会改变其决策。

报告的差距

在定向提问下，“相比之下，直接检索保持稳定。”对于主要的 Qwen3.5-9B-Base 系列，提供的证据报告在每个测试的上下文长度上对 12/12 家公司的检索均为阳性，包括 128k 标记，并且在中性控制申报上无误报。然而，风险披露对决策的影响在长上下文中降至实验噪声下限。在更有能力的模型中，这种模式被延后但并未消除：“更有能力的模型推迟但不消除该差距。”

工作流结果是具体的。在 Qwen3.5-9B-Base 的 128k 标记设置下，论文报告的基线保留率为 12%，而“提取然后决策”——在决策旁放置有针对性的结构化重述——达到 67% 的保留率，对 12/12 家公司均有正向效果。相比之下，“分块然后聚合”在所有测试长度上都消除了该效果。作者的注释审核将该失败定位在决策阶段之前：在 2k 时“在二十四个公司-安排单元中合并笔记均缺乏目标披露”。

可复用之处

作者还使用干预来区分两条拟议的传递途径：压缩的运行摘要和基于注意力的查找。他们报告这两者各自承载了披露影响的相当一部分，并且所估计的效应在公司间统计上不可区分。可迁移的研究操作是评估一个工作流的配对反事实：保持文档和决策任务不变，改变一个与决策相关的披露，测量检索和由此产生的决策差异，并审计中间表示是否保留了该披露。

这尚非面向所有架构的因果解释。通道识别来自一个混合模型家族；作者指出在没有循环通道的架构中披露如何传播仍待绘制。他们对真实文件的复现也被描述为探索性且具能力条件性，而非普适。

长程代理面临一个具体的控制失效：随着历史增长，任务状态可能被遮蔽且技能调用可能错位。Recuris 通过将当前任务控制与累积经验分离来应对这一点。其工作记忆跟踪进度并根据当前需要而非完整历史指导从经验记忆中选择技能。

Recuris 维护一个经验证的工作记忆以记录任务进展，使用它从经验记忆中选择技能，输出结构化执行轨迹，并仅在对留出或开发任务进行验证门通过后对组件范围内的补丁进行应用。这些轨迹连接了工作状态、检索到的经验、动作、观察、拟议的状态更新、检查器结果以及已提交的状态。一个固定的元代理使用这些证据将故障定位到四个记忆控制组件之一，然后提出补丁。外层过程是固定的：基础 LLM、工具、元代理、定位与打补丁流程、验证门以及记忆控制层外的测试装置在多个轮次中不变。

对研究者而言，可迁移的操作是——在增加递归之前缩小可编辑表面：定义带显式不变量的状态模式，使变更产出机器可检查的证据，将故障与特定组件关联，并仅在留出任务上验证该有界变更。这是一个设计经验教训，而不是结构化轨迹优于其他诊断方法的证据；所给记录中不含定位准确度的正面对比。

在四个长程基准和十个模型上，摘要报告在 37 对已完成的模型-基准对中有 35 个得益，包括在 tau-bench 上 GPT-5.6 Sol 提升 +17.8 点和 Claude Opus 5 提升 +15.6 点，在 SkillFlow 上 Qwen3.6-27B 与 Qwen3.6-35B 分别为 +16.6 和 +13.5，最长期任务上最高达 +32.2 点，常见长程失败减少最多达 80%。

重要边界是测试时适应。在 Terminal-Bench 2.1 的测试时适应研究中，对 87 个任务和四次尝试的匹配预算，适应比重试初始记忆额外增加了 2.3 点，赢得 7 个任务、失去 5 个（p=0.774），该差异不具统计显著性；而重试本身解释了相对于单次尝试基线的 +26.4 点改善的大部分。迁移是有条件的：如果留出任务不再包含记忆修复所对应的故障类型，则没有可迁移的内容。

大多数 LLM 评估逐条给生成结果评分。本文改为将有限的生成集合作为评估对象：问题是，在固定尝试次数下出现了多少不同的、与任务相关的结果。

经验证的任务覆盖（Validated Task Coverage, VTC）将该问题显式化。对于任务 $x$，它验证并将每个生成 $y_i$ 映射到有用结果，对尝试取并集，并应用覆盖效用：

$${VTC}_x(y_{1:k})=u_x({\bigcup }_{i=1}^k{\tau }_x(y_i)).$$

该构造要求一个任务特定的确定性函数 ${\tau }_x$：它必须识别满足任务约束的输出，并将有效输出映射到其区分性重要的离散结果。VTC-Bench 在五个真实数据任务上实例化了该设计——分子设计、代码库修复、漏洞发现、鉴别诊断和证据检索——使用自动、可复现的评分而非基于模型的裁判。其结果表示包括分子骨架、被修改的函数集合、行为性错误类别、UMLS 概念和推理方面。

选择结果具有重要意义。在 24 个模型–推理配置和基准的标称预算下，由一次抽样质量排名最高的五种配置在五项任务上造成的平均 VTC 遗憾从证据检索的 2.2% 到代码库修复的 25.0% 不等，任务宏平均为 12.1%；一次抽样和 VTC 前五集合仅共享 25 个位置中的 10 个。优选配置也依赖于尝试次数：在五个任务中有四个任务，k=1 的领先配置不同于标称预算 H 下的领先者。因此简单的输出变化度量不应被视为任务性覆盖的替代。

干预结果提供了具体的实验教训。将温度从 0.6 提高到 1.2 在 40 对匹配比较中有 38 对在 H 下提高了 VTC，尽管一次抽样质量在其中 25 对下降。把后续尝试以先前输出为链式输入并附加显式不重复提示并非普遍有益：它持续改进了证据检索，持续降低了代码库修复覆盖，在大多数鉴别诊断配置中降低覆盖，对漏洞发现影响不大，并且在分子设计上呈现更大的配置依赖性。因此，应将温度和链式尝试作为任务特定的覆盖干预来测试，而不是假定它们普遍改进候选集合。

一个可迁移的后续操作是：在比较推理设置之前指定验证器和结果映射，然后同时报告 k 下的覆盖与一次抽样质量。主要边界是冻结目标使绝对覆盖具有参考相对性：在注释目标之外的有效结果不计入得分。尝试次数在代币使用、计算或人工审查工作量上也不可跨任务比较，因此更高的 VTC 曲线本身并非资源等价的胜利。

Earlier evidence for effective-learning-rate matching was narrower: in GPT-2-124M/OpenWebText experiments with AdamW, matching the effective learning rate induced by weight decay reproduced the full training dynamics in float32. That work also reported that matching ELR alone did not prevent some bfloat16 divergences, leaving the scope of the effect beyond that optimizer and setup unresolved. [arxiv:2310.04415v2; S3.p6; S3.p9; S3.F8]

The current paper turns the idea into a paired schedule-matching test. Runs use identical initialization and data-order seeds, while distinct learning-rate and parameter-norm schedules are constructed to match ELR, defined here as learning rate divided by parameter norm. The study reports comparisons across multiple optimizers, architectures, datasets, and model scales rather than only a single AdamW language-model configuration. [arxiv:2608.24814v1; S1.SS0.SSS0.Px1.p1.2]

The central result is reported as ELR collapse: when ELR schedules are matched, full loss trajectories have mean absolute discrepancies of only a few times 10^-3. The condition matters: the comparisons are paired and evaluated after warmup, so the result is trajectory alignment under controlled schedule matching, not an assertion that arbitrary runs become equivalent. [arxiv:2608.24814v1; S1.SS0.SSS0.Px1.p1.2]

The ablations identify where this alignment weakens. In the reported Llama-124M AdamW/FineWeb setting, removing QK-Norm increased mean collapse error from 2.3 times 10^-3 to 5.2 times 10^-3. With ELR-preserving sinusoidal modulation, increasing the number of cycles from 2 to 32 raised the reported error from 2.8 times 10^-3 to 7.5 times 10^-3. Thus normalization design and the timescale of LR–norm variation are experimental variables, not implementation details to hide. [arxiv:2608.24814v1; S4.SS2.SSS0.Px1.p2.1]

The operational extension is an ELR-based functional scaling law. Fitted on four non-Hyperball trajectories, it predicted two held-out Hyperball runs without refitting with mean RMSE 0.0212, versus 0.2508 for the LR-parameterized version. [arxiv:2608.24814v1; S6.SS0.SSS0.Px2.p2.1]

The boundary is macroscopic: the supplied limitation record notes that transformers are not exactly scale invariant because they contain trainable vector-valued parameters, and that the paper does not provide a microscopic dynamical explanation. [arxiv:2608.24814v1; A1.SS1.p1.2] A useful follow-up is therefore to log η, parameter norm, and loss per step, reproduce the paired ELR intervention, then add representation and downstream probes while deliberately varying normalization components and modulation speed. That separates loss-trajectory control from broader claims about what the model learns.

FID's concrete weakness is its moment restriction: for any distribution with finite second moments and nonzero covariance, the paper proves that a different distribution can share its mean and covariance, making any moment-only discrepancy—and specifically population FID—zero. FID and KID also produce scalar discrepancies that are unchanged when the two samples are exchanged, so they do not encode whether a generated set is under-dispersed or over-dispersed.

The paper demonstrates the first limitation with a reference-adaptive ImageNet construction. Images optimized from noise to match the reference Inception mean and covariance receive FID 24.7, versus 58.6 for held-out real images, where lower is better. For the same comparison, ZID reports departure scores of 17.2 versus 0.86, and none of 499 random label permutations produces an equally large score; the held-out comparison has permutation p = .328.

ZID changes the evaluation object from one scalar to three linked outputs. It combines six standardized location- and dispersion-sensitive arms: RISE, a rank-graph representation, and Gaussian-kernel representations at two bandwidths. It then reports an index for ranking departure magnitude, a permutation-calibrated p-value for distributional equality, and a signed dispersion readout. The directional readout is conditional: when member signs conflict, ZID reports “member-sign conflict” rather than forcing a single under- or over-dispersion label.

In controlled experiments on CIFAR-Inception PCA-128 features with m = n = 200, 300 repetitions, and 499 outer permutations, ZID is the only tested row with power of at least .70 in every departure column. Across six-level severity sweeps, its score has positive rank association on every sweep, ranging from .56 for matched-moment multimodality to .95 for off-manifold support. An ablation links this coverage to complementary components: removing RISE causes the largest power loss on six of eight departures, while removing median-bandwidth GPK reduces location power from .830 to .237 and removing small-bandwidth GPK reduces nonlinear-dependence power from .980 to .860.

The reusable research operation is to ask three separate questions—whether a departure is detected, how large it is under a fixed protocol, and whether a dispersion direction is defensible—rather than treating one metric as all three. Keep sample size, embedding, reference set, and preprocessing fixed when comparing scores. For reference-adaptive sets such as the optimized ImageNet images, the permutation tail is descriptive, not a population-calibrated two-sample p-value.

What the experiment tests

The paper targets a specific evaluation limitation: “Retrieval-based evaluations can certify systems whose investment judgments ignore information they demonstrably retrieved.” The authors hold focal-firm information fixed while varying unrelated context from 2,000 to 128,000 tokens, then separate directed retrieval from the disclosure’s effect on an investment judgment. This is a useful experimental decomposition: a system can be asked both whether it can state a disclosure and whether changing that disclosure changes its decision.

The reported gap

Under directed questioning, “Direct retrieval, by contrast, remains stable.” For the primary Qwen3.5-9B-Base family, the supplied evidence reports retrieval for 12/12 firms at every tested context length, including 128k tokens, with zero false-positive retrievals on neutral-control filings. Yet the risk disclosure’s decision influence falls to the experimental noise floor at long context in the reported setup. More capable models delay rather than remove this pattern: “More capable models postpone but do not eliminate the gap.”

The workflow result is concrete. At 128k tokens on Qwen3.5-9B-Base, the paper reports baseline retention of 12%, whereas extract-then-decide—placing a targeted, structured restatement next to the decision—reaches 67% retention, with positive effects for 12/12 firms. In contrast, chunk-then-aggregate eliminates the effect at all tested lengths. The authors’ note audit locates this failure before the decision stage: “the target disclosure is absent from the consolidated notes in twenty-four of twenty-four firm-arrangement cells at 2k.”

What to reuse

The authors also use interventions to distinguish two proposed transmission routes: compressed running summaries and attention-based lookup. They report that each carries a substantial share of the disclosure’s influence and that the estimated effects are statistically indistinguishable firm by firm. The transferable research operation is to evaluate a workflow with paired counterfactuals: preserve the document and decision task, alter one decision-relevant disclosure, measure both retrieval and the resulting decision difference, and audit whether an intermediate representation retained the disclosure.

This is not yet an architecture-general causal account. The channel identification comes from one hybrid model family; the authors state that how disclosures travel in architectures without a recurrent channel remains to be mapped. Their real-filing replication is also described as exploratory and capability-conditional, rather than universal.

Long-horizon agents face a concrete control failure: as histories grow, task state can become obscured and skill invocation can become misaligned. Recuris addresses this by separating current task control from accumulated experience. Its Working Memory tracks progress and guides skill selection from Experiential Memory according to current needs rather than the full history.

Recuris maintains a verified Working Memory for task progress, uses it to select skills from Experiential Memory, emits structured execution traces, and applies component-scoped patches only after a validation gate on held-out or development tasks. The traces connect the working state, retrieved experience, action, observation, proposed state update, checker result, and committed state. A fixed Meta-Agent uses this evidence to localize a failure to one of four memory-control components before proposing a patch. The outer procedure is fixed: the base LLM, tools, Meta-Agent, localization and patching procedures, validation gate, and harness mechanisms outside the memory-control layer do not change across rounds.

For a researcher, the transferable operation is to narrow the editable surface before adding recursion: define a state schema with explicit invariants, make mutations produce machine-checkable evidence, associate failures with a specific component, and validate only that scoped change on held-out tasks. This is a design lesson, not evidence that structured traces outperform alternative diagnosis methods; the supplied record does not contain a head-to-head localization-accuracy comparison.

Across four long-horizon benchmarks and ten models, the abstract reports gains in 35 of 37 completed model-benchmark pairs, including +17.8 points for GPT-5.6 Sol and +15.6 for Claude Opus 5 on tau-bench, +16.6 and +13.5 for Qwen3.6-27B and Qwen3.6-35B on SkillFlow, up to +32.2 points on the longest tasks, and reductions of common long-horizon failures by up to 80%.

The important boundary is test-time adaptation. In the Terminal-Bench 2.1 test-time adaptation study, with 87 tasks and a four-attempt matched budget, adaptation added 2.3 points over retrying the seed memory, with 7 tasks won and 5 lost (p=0.774), and this difference was not statistically significant; retrying itself explained most of the +26.4-point improvement over the single-attempt baseline. Transfer is conditional: if held-out tasks retain none of the failure types the memory repairs, there is nothing left to transfer.

Most LLM evaluations score outputs one at a time. This paper instead treats a finite set of generations as the evaluation object: the question is how many distinct, task-relevant outcomes appear within a fixed number of attempts.

Validated Task Coverage (VTC) makes that question explicit. For task $x$, it validates and maps each generation $y_i$ to useful outcomes, takes the union across attempts, and applies a coverage utility:

$${VTC}_x(y_{1:k})=u_x({\bigcup }_{i=1}^k{\tau }_x(y_i)).$$

The construction requires a task-specific deterministic function ${\tau }_x$: it must identify outputs that satisfy the task constraints and map valid outputs to discrete outcomes whose distinctness matters. VTC-Bench instantiates this design on five real-data tasks—molecule design, repository repair, bug finding, differential diagnosis, and evidence search—using automatic, reproducible scoring without model-based judges. Its outcome representations include molecular scaffolds, modified-function sets, behavioral bug classes, UMLS concepts, and reasoning aspects.

The selection result is consequential. Across 24 model–inference configurations and the benchmark’s headline budgets, the five configurations ranked highest by one-draw quality incurred mean VTC regret from 2.2% in evidence search to 25.0% in repository repair, with a 12.1% task-macro average; the one-draw and VTC Top-5 sets shared only 10 of 25 positions. The preferred configuration also depends on the number of attempts: in four of five tasks, the leader at $k=1$ differed from the leader at the headline budget $H$. Simple output-variation measures therefore should not be treated as substitutes for task-grounded coverage.

The intervention results offer a concrete experimental lesson. Raising temperature from 0.6 to 1.2 increased VTC at $H$ in 38 of 40 matched comparisons, although one-draw quality fell in 25 of those comparisons. Chaining later attempts on earlier outputs, with an explicit non-repetition prompt, was not uniformly beneficial: it consistently improved evidence search, consistently reduced repository-repair coverage, reduced coverage in most differential-diagnosis configurations, had little effect on bug finding, and had larger configuration-dependent effects on molecule design. Thus, temperature and chaining should be tested as task-specific coverage interventions rather than assumed to improve candidate sets generally.

A transferable follow-up operation is to specify the validator and outcome mapping before comparing inference settings, then report coverage over $k$ alongside single-draw quality. The main boundary is that frozen targets make absolute coverage reference-relative: valid outcomes outside the annotated target receive no credit. Attempt counts also are not comparable across tasks in token use, compute, or human review effort, so a higher VTC curve is not by itself a resource-equated win.

单纯的基准表现并不是本文建议用来设定代理可达工作流地平线（horizon）的量度。作者反而建议在相关任务上测量逐步可靠性并保守地在几何估计之下进行预算，因为测得的风险率（hazard）可能加速而非保持平坦（Section 4.7）。

研究在四个为可由oracle验证而选择的合成任务族中孤立了依赖步数——Ledger、Refchain、Cipher，以及 ToolQA 的工具使用循环。它在五个地平线和三种上下文机制下评估了九个经指令微调的模型，总计分析了 10,664 条轨迹。为刻画退化形状而不是报告单一汇总分数，作者对每个模型-任务单元使用 AIC 在几何型、阈值型和线性成功率-地平线形式之间进行选择（Section 4.1）。

主要结果是有条件但具体的：在 36 个被测试的单元中，几何型胜出 28 个。按该描述，代理的端到端成功率通过每步可靠性参数在依赖步间乘性复合。具代理性的 ToolQA 结果将这一运作后果可视化：到地平线 16 时，所有被测试模型的表现都已降至其起始表现的小部分。然而，这一发现并非对更长 ToolQA 链段的测量：API 预算在最长期条件之前终止，因此所报告的地平线-16 崩溃是对更长地平线严重性的下界。

上下文消融使对被测试的流式任务族的诊断更为明确。在保持任务实例在各机制间配对的条件下，约束上下文窗口使衰减斜率变陡而非缓和：在压缩（compressed）机制中，按地平线倍增的合并 logits 斜率为 -0.69，而在自然（natural）机制中为 -0.44，p = 3×10⁻⁶。由此，在这些合成多步设置中，简单地修剪历史并非有证据支持的地平线退化补救措施。作者还报告不可解析的输出格式或工具调用影响了 21% 的轨迹且随地平线增长，因此接口有效性是可以与最终成功率并行跟踪的可测量组成部分。

一个可迁移的研究操作是为单个代理工作流构建一个经 oracle 验证的地平线扫描：独立地改变依赖步数而不改变保留上下文长度，运行配对的自然/压缩/填充条件，拟合竞争的衰减形式，并记录任务成功率与无效动作率。由此产生的实际问题是：为了到达预期地平线，需要怎样的每步可靠性，并且拟议的记忆干预是否改善该参数而不是仅仅提高短地平线的通过率？本文并未建立普适定律：其任务族为合成，样本包含九个模型，且解码敏感性仅在固定的中等温度下测试。

本文针对仿真驱动代理设计中的一特定缺口。推理阶段，代理可在行动前用世界模型模拟候选操作，但作者认为在部分可观测情形下该接口不完整，因为仿真并未充分表示对当前状态的不确定性。因此相关问题不仅是代理能否预测行动后果，还包括其能否在选择行动前检查世界模型所“知道”的与仍然不确定的内容。

所提出的基于信念的世界模型（Belief-Based World Model，BB-WM）为该接口增加了直接访问。按作者描述，BB-WM “对当前状态建模并维护一个信念（belief）”，供 LLM 查询已知与不确定的状态方面信息。该信念访问被设计为与基于行动条件的仿真并行而非替代。论文的聚焦实证问题是：直接向 LLM 策略暴露世界模型的信念是否能改善决策。

报告的证据是对 ALFWorld 和 ScienceWorld 的接口消融实验。在 ALFWorld 上，作者总结表 1 为：“BB-WM 在效率和表现上均优于基线代理。”在 ScienceWorld 上，表 2 对 Llama 与 Qwen 给出相同结论：“BB-WM 在效率和表现上均优于基线代理（针对 Llama 和 Qwen）。 ”论文更宽泛的解释是：在部分可观测下，对世界模型信念的访问会改善任务表现，并且与基于仿真的世界模型互为补充。这是对所报告基准设置中组合接口的证据，而非已获得完整可学的世界模型的证据。

一个有用的实验操作很直接：将信念暴露与仿真暴露视为独立因子。比较基线策略、仅信念访问、仅仿真访问、以及两者结合；然后检查增益是否来自避免无效动作、解析状态不确定性，或两者兼而有之。还应改变信念更新的质量，因为论文的仿真组件存在实质性边界：“WALL-E 是不完全的下态预测器（incomplete next-state predictor）。”最后在分析中保留模型能力维度：作者报告“Sonnet 在两个基准上饱和（saturates）”，因此用该模型在这些任务上衡量接口增益的空间有限。

对研究者而言，可迁移的观点是将世界模型评估为一个可检查的状态不确定性服务，而不仅仅是一个 rollout 引擎。

现有代理基准大多将 LLM 代理作为固定策略来评估。这留下了一个问题：代理能否主动测试其行为、评判所获经验，并用这些经验改进后续决策。

S3Gym 改变了评估协议，而不是假定交互累积本身即为改进。"S3Gym 将宽松探索与严格的留出评估分离，并在七个带可执行环境验证器的文本游戏中实现该协议。"在探索阶段，验证器计算的即时奖励对代理隐藏，同时记录其自我评判；评估则使用更严格的、互不相交的随机种子。作者比较了三种将自评交互纳入的方法：直接的历史 ICL、基于得分的汇总记忆（Summary Memory），以及参数训练。

核心结果是有条件的，而非对某一机制的单一排序。论文报告称：“当经验能被压缩为可重用的策略性规则时，摘要是有益的；但当成功依赖精确的、状态相关的信息时，摘要常常不如原始历史。”参数训练也“在若干任务上产生显著增益，但在其他任务上表现出不稳定的改进和严重的负迁移。”在 Qwen3-8B 的微调研究中，“Training 在 Trust Evolution 上产生了显著的自我提升。得分从 0 上升到最高 30，并在 19 个更新检查点中的 18 个保持高于初始基线。”在相同研究条件下，Plants-vs-Zombies 表现出相反模式：“初始得分为 23，而每个更新后的检查点得分均为 6。”这些均为严格模式评估下的逐任务观测结果，而非证明参数更新能在所有游戏中可靠改进代理。

作者对记忆压缩给出直接边界：“因此，Summary Memory 是一种选择性改进机制：当经验允许紧致的因果抽象时它有效，但它不能普遍替代对富状态交互历史的直接访问。”自我评判也并非一致可靠；Chess 与 Trust 被标识为明显失效的案例。

研究操作 在后续工作中，保持探索与评估随机种子分离；记录代理的自评分与隐藏的验证器结果；然后在相同交互预算下比较原始轨迹与摘要。具体问题是：成功的行动在决策时是否需要可重用的策略性规则，还是需要精确的状态相关信息。此为作者基于任务依赖性提出的编辑式实验设计，而非一条普适配方。

当代理能将凭证传递给另一个代理时，多代理委托成为一个安全边界。本文在明确的不可信模型假设下评估该边界：被完全注入提示的代理不得超出明确委托给它的权限。先验的具体局限是运行时仅给主代理一个广泛的承载（bearer）凭证，将其不变地传给子代理和工具，并让模型决定授权。在作者的测试中，“被劫持的代理在所有四种”研究的攻击——误导副手（confused deputy）、重放（replay）、权限升级（privilege escalation）、以及过度广泛的子代理（over-broad sub-agent）——中均能成功，因为运行时未提供 R1–R8。

该方法改变了执行点，而不是试图让模型推理更可靠。论文从四种对手推导出八项需求，然后实现了一个授权代理（authorization broker）。其统御规则为：“授权决策由基础设施的 PEP 做出，绝不由不可信模型做出。”该代理将发送者约束、衰减（attenuation）、短生命周期委托令牌与外部验证组合，旨在使每次委托跳转都缩小权限。作者将此表述为一个组合缺口：“没有单一标准覆盖该需求集”，其中溯源、衰减、发送者约束、轮换与与模型无关的执行分散在不同原语中。

在受控测试平台中，作者报告该代理阻止了所有四种研究到的威胁，经受住了 11 次直接设计攻击，接受了 0 个伪造令牌（共 200,000 个尝试），并将受损子代理在 2,000 个随机化场景中的可达动作均值限制为 1.5 个，而在承载式委托下为所有 8,100 个。报告的执行成本约为每次决策 2.6 microseconds。上述结果是在论文所述对手与测试平台下对该代理设计的有界证据；它们并不表明每个框架或部署会呈现相同行为。

一个有用的研究操作是将比较复现为权限预算实验：在固定任务与对手输出的情况下，分别在广泛承载式委托与发送者绑定、衰减令牌下测量可达动作。分别记录重放、升级与跨代理可达性，而不是将其压缩为一个攻击成功率。论文的明确边界对解释该实验至关重要：该代理“尚未将其集成到被评估的框架中”，且实时模型端到端评估为后续工作。因此框架集成与模型在环的测试仍为下一步验证，而非已确立的结果。

缺失的控制单位

局部授权对每笔购买都可能是正确的，但对拥有舰队的租户仍可能失败。在作者的受控采购仿真中，在所述计费模型下，局部门禁批准了每笔购买却在所有 300 次预置运行中都使租户容忍度透支；预算则没有透支。 [arxiv:2609.00275v1, §5.1] 主要配置使用了 50 个代理、1,000 个时钟刻（tick）窗口、$250k 的容忍度、每代理调用上限 $50k，以及收费为 $c_{0.95}(e)=0.52·v$。 [arxiv:2609.00275v1, §5.1]

改变记账边界

所提控制将不可逆性视为按主体累计的账户：一个受信任的运行时记账每个效果的剩余损失并拒绝会使预算透支的边际效果。 [arxiv:2609.00275v1, Abstract] 在被评估的设计中，运行时沿 agent→workflow→tenant 的账本路径以原子方式预留收费；这使得租户预算而非单个调用上限成为准入边界。 [arxiv:2609.00275v1, §5.1]

规模扫描是决定性结果。在固定容忍度与相同计费模型下，局部门禁在十个代理时是安全的，但在 50 个代理时达到 2.4× 容忍度，200 个时为 9.7×，1,000 个时为 48×；而共享预算在每个被测试规模下都维持在约 0.48×。 [arxiv:2609.00275v1, §5.2] 作者还报告了来自 τ-bench 与 AgentDojo 的 38,452 条轨迹的跟踪分析：外部效果占工具调用的 22%，任务决定的效果在独立代理空模型下有 z 值高达 198，且一个植入指令平均将相同的外部效果传播到异构舰队的 84%（最低 48%）。 [arxiv:2609.00275v1, §5.5] 这些证据用于测试对跨代理相关性的累计控制，而不仅仅是针对单代理突发。

一个单主机、内存中账本微基准报告了 2.6 μs 的中位预留-确认延迟、每个活跃预留 240 bytes，以及在 32 线程的共享租户根下每秒几×10^5 次预留循环。 [arxiv:2609.00275v1, §5, Ledger overhead]

尚未被证明的内容

这些性能测量并未评估持久化、复制或崩溃恢复。更根本地，账本仅在被验证的主体、强一致性权限、幂等的预留生命周期与受信任的效果说明下为声明的计费单元给出界限；它并不对陈旧价格、未建模的相关性、恶意声明或错误归因的工作流下的实际损失给出保证。 [arxiv:2609.00275v1, §4] 该研究是可行性评估而非部署系统，且依赖感知定价、早期共享触发检测与跨主机协调仍未解决。 [arxiv:2609.00275v1, §6]

研究操作：通过测量在相关触发下的局部批准与共享主体透支来评估拟议的代理控制，然后用计费错误校准、延迟的依赖检测、取消/退款路径与分布式双重支付场景对结果施压。

Benchmark performance alone is not the quantity this paper recommends using to set an agent’s achievable workflow horizon. The authors instead advise measuring per-step reliability on the relevant task and budgeting conservatively below a geometric estimate, because the measured hazard can accelerate rather than remain flat (Section 4.7).

The study isolates dependent-step count in four synthetic task families—Ledger, Refchain, Cipher, and the ToolQA tool-use loop—chosen for oracle verification. It evaluates nine instruction-tuned models across five horizons and three context regimes, with 10,664 analyzed trajectories. To characterize the shape of degradation rather than report one aggregate score, the authors use AIC to choose among geometric, threshold, and linear success-versus-horizon forms for each model-task cell (Section 4.1).

The main result is conditional but concrete: the geometric form wins in 28 of 36 tested cells. Under that description, an agent’s end-to-end success compounds multiplicatively across dependent steps through a per-step reliability parameter. The agentic ToolQA result makes the operational consequence visible: by horizon 16, every tested model had fallen to a small fraction of its starting performance. This finding is not a measurement of longer ToolQA chains, however: the API budget ended before the longest condition, so the reported horizon-16 collapse is a lower bound on severity at longer horizons.

The context ablation sharpens the diagnosis for the tested streaming families. Holding task instances paired across regimes, bounding the context window steepened the decay slope rather than easing it: the pooled logit slope per horizon doubling was -0.69 in the compressed regime versus -0.44 in the natural regime, with p = 3×10⁻⁶. Thus, in these synthetic multi-step settings, simply pruning history is not evidence-based as a remedy for horizon degradation. The authors also report that unparseable format or tool-call outputs affected 21% of trajectories and increased with horizon, so interface validity is a measurable component to track alongside final success.

A transferable research operation is to build an oracle-verified horizon sweep for one agent workflow: vary the number of dependent steps independently of retained-context length, run paired natural/compressed/padded conditions, fit competing decay forms, and record both task success and invalid-action rates. The resulting question is practical: what per-step reliability is required for the intended horizon, and does a proposed memory intervention improve that parameter rather than only a short-horizon pass rate? The paper does not establish a universal law: its task families are synthetic, its sample contains nine models, and decoding sensitivity was not tested beyond a fixed moderate temperature.

The paper targets a specific gap in simulation-based agent design. During inference, agents can use a world model to simulate candidate actions before acting, but the authors argue that this interface is incomplete under partial observability because simulation does not adequately represent uncertainty about the current state. The relevant question is therefore not only whether an agent can forecast an action’s consequence, but whether it can inspect what the world model knows—and what remains uncertain—before selecting that action.

The proposed Belief-Based World Model (BB-WM) adds that interface. In the authors’ description, BB-WMs “model and maintain a belief” that an LLM can query for information about known and uncertain aspects of the current state. This belief access is designed to sit alongside, rather than replace, action-conditioned simulation. The paper asks the focused empirical question of whether directly exposing a world model’s belief to an LLM policy improves decision-making.

The reported evidence is an interface ablation across ALFWorld and ScienceWorld. For ALFWorld, the authors summarize Table 1 as: “BB-WM improves over the base agent in terms of efficiency and performance.” For ScienceWorld, Table 2 gives the same conclusion for Llama and Qwen: “BB-WM improves over the base agent in terms of efficiency and performance for Llama and Qwen.” The paper’s broader interpretation is that access to world-model beliefs improves task performance under partial observability while remaining complementary to simulation-based world models. This is evidence for the combined interface in the reported benchmark settings, not evidence that a complete learned world model has been obtained.

A useful experimental operation follows directly: treat belief exposure and simulation exposure as separate factors. Compare a base policy, belief-only access, simulation-only access, and their combination; then inspect whether gains come from avoiding invalid actions, resolving state uncertainty, or both. Also vary the quality of belief updates, because the paper’s simulation component has a material boundary: “WALL-E is an incomplete next-state predictor.” Finally, keep model capability in the analysis: the authors report that “Sonnet saturates both benchmarks,” so these results leave limited headroom for measuring interface gains with that model on these tasks.

For a researcher, the transferable idea is to evaluate a world model as an inspectable state-uncertainty service, not solely as a rollout engine.

Existing agent benchmarks largely evaluate LLM agents as fixed policies. This leaves open whether an agent can actively test its behavior, judge the resulting experience, and use that experience to improve later decisions.

S3Gym changes the evaluation protocol rather than assuming that accumulated interaction is itself improvement. “S3Gym separates permissive exploration from strict held-out evaluation and instantiates this protocol in seven text-based games with executable environment verifiers.” During exploration, verifier-computed immediate rewards are withheld from the agent while its self-judgments are recorded; evaluation then uses stricter, disjoint seeds. The authors compare three ways of incorporating the judged interactions: direct History ICL, score-conditioned Summary Memory, and parameter Training.

The central result is conditional rather than a ranking of one mechanism. The paper reports that “summaries are beneficial when experience can be compressed into reusable strategic rules, yet often underperform raw history when success depends on precise, state-contingent information.” Parameter training also “produces substantial gains on some tasks, but also exhibits unstable improvement and severe negative transfer on others.” In the Qwen3-8B fine-tuning study, “Training yields substantial self-improvement on Trust Evolution. The score rises from 0 to a maximum of 30 and remains above the initial baseline at 18 of the 19 updated checkpoints.” Under the same study conditions, Plants-vs-Zombies showed the opposite pattern: “The initial score is 23, whereas every updated checkpoint obtains a score of 6.” These are per-task observations from strict-mode evaluation, not evidence that parameter updates reliably improve an agent across games.

The authors place a direct boundary on memory compression: “Summary Memory is therefore a selective improvement mechanism: it is effective when experience admits compact causal abstractions, but it cannot universally replace direct access to state-rich interaction histories.” Self-judging is also not uniformly reliable; Chess and Trust are identified as clear failure cases.

Research operation

For a follow-up, keep exploration and evaluation seeds separate; log both an agent’s self-scores and hidden verifier outcomes; then compare raw trajectories against summaries at the same interaction budget. The concrete question is whether successful actions require a reusable strategic rule or precise state-contingent information at decision time. This is an editorial experiment design suggested by the reported task dependence, not a demonstrated universal recipe.

Multi-agent delegation becomes a security boundary when an agent can pass credentials to another agent. This paper evaluates that boundary under an explicit untrusted-model assumption: a fully prompt-injected agent must not exceed authority explicitly delegated to it. The concrete prior limitation is a runtime that gives the primary agent one broad bearer credential, passes it unchanged to sub-agents and tools, and lets the model decide authorization. In the authors’ test, “a hijacked agent succeeds at all four” studied attacks—confused deputy, replay, privilege escalation, and over-broad sub-agent—because the runtime provides none of R1–R8.

The method changes the enforcement point rather than trying to make model reasoning more reliable. The paper derives eight requirements from four adversaries, then implements an authorization broker. Its governing rule is: “Authorization decisions are made by infrastructure PEPs, never by the untrusted model.” The broker composes sender-constrained, attenuated, short-lived delegation tokens with external verification, intending to let each delegation hop narrow authority. The authors frame this as a composition gap: “no single standard covers the requirement set,” with provenance, attenuation, sender-constraining, rotation, and model-independent enforcement distributed across different primitives.

In the controlled harness, the authors report that the broker blocks all four studied threats, resists 11 direct design attacks, accepts 0 of 200,000 forged tokens, and confines a compromised sub-agent to a mean of 1.5 reachable actions versus all 8,100 under bearer delegation across 2,000 randomized scenarios. The reported enforcement cost is about 2.6 microseconds per decision. These results are bounded evidence for the broker design under the paper’s stated adversaries and harness; they do not establish that every framework or deployment will behave identically.

A useful research operation is to reproduce the comparison as an authority-budget experiment: keep the task and adversarial outputs fixed, then measure reachable actions under broad bearer delegation and under sender-bound, attenuated tokens. Record replay, escalation, and cross-agent reachability separately rather than collapsing them into one attack-success rate. The paper’s explicit boundary matters for interpreting that experiment: the broker “do[es] not yet integrate it into the evaluated frameworks,” and live-model end-to-end evaluation is future work. Thus, framework integration and model-in-the-loop testing remain the next validation step, not an established result.

The missed unit of control

Local authorization can be correct for each purchase and still fail for the tenant that owns a fleet. In the authors’ controlled procurement simulation, under the stated charge model, local gates approved every purchase but overdrew the tenant tolerance in all 300 seeded runs; the budget produced no overdraws. [arxiv:2609.00275v1, §5.1] The main configuration used 50 agents over a 1,000-tick window, a $250k tolerance, $50k per-agent call caps, and charges of $c_{0.95}(e)=0.52·v$. [arxiv:2609.00275v1, §5.1]

Change the accounting boundary

The proposed control treats irreversibility as a cumulative per-principal account: a trusted runtime charges each effect’s residual loss and denies the marginal effect that would overdraw the budget. [arxiv:2609.00275v1, Abstract] In the evaluated design, the runtime reserves charges atomically across an agent→workflow→tenant ledger path; this makes the tenant budget, rather than an individual call cap, the admission boundary. [arxiv:2609.00275v1, §5.1]

The scale sweep is the decisive result. With fixed tolerance and the same charge model, local gates were safe at ten agents but reached 2.4× tolerance at 50 agents, 9.7× at 200, and 48× at 1,000; the budget stayed near 0.48× at every tested size. [arxiv:2609.00275v1, §5.2] The authors also report trace analysis of 38,452 trajectories from τ-bench and AgentDojo: external effects were 22% of tool calls, task-determined effects had z values up to 198 against an independent-agent null, and one planted instruction propagated the same external effect across 84% of a heterogeneous fleet on average, with a 48% minimum. [arxiv:2609.00275v1, §5.5] These are evidence for testing cumulative controls against cross-agent correlation, not only against per-agent bursts.

A single-host, in-memory ledger microbenchmark reported 2.6 μs median reserve-then-confirm latency, 240 bytes per live reservation, and a few ×10^5 reservation cycles per second at a shared tenant root with 32 threads. [arxiv:2609.00275v1, §5, Ledger overhead]

What remains unproven

Those performance measurements do not assess persistence, replication, or crash recovery. More fundamentally, the ledger bounds declared charge units only under authenticated principals, strongly consistent authorities, idempotent reservation lifecycles, and trusted effect specifications; it does not bound realized loss under stale prices, unmodelled correlations, malicious declarations, or misattributed workflows. [arxiv:2609.00275v1, §4] The study is a feasibility evaluation rather than a deployed system, and dependency-aware pricing, early shared-trigger detection, and cross-host coordination remain unresolved. [arxiv:2609.00275v1, §6]

Research operation: evaluate a proposed agent control by measuring local approval and shared-principal overdraw under correlated triggers, then stress the result with charge miscalibration, delayed dependency detection, cancellation/refund paths, and distributed double-spending scenarios.