AI Papers of the Week
Every paper worth reading in AI, hand-picked one week at a time.
Do AI Agents Understand Computer Architecture?
Ambika Sharan, Grigory Chirkov and Soheil Abbasloo at Microsoft Research build AutoTuring, which gives the same agent the same 15-dimensional accelerator design space twice, once with named architectural knobs and simulator counters and once as anonymous variables on [0,1].
Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding Agents
Alex Remedios, Simon Storf, Fabien Roger and John Hughes at Anthropic red-team the production blocking monitors that review each coding-agent action (Auto Mode in Claude Code, Guardian in Codex) under the assumption that the monitored agent is itself persistently misaligned.
How Do Agent Harnesses Create Value? Planning Information and Release Control in Stateful LLM Agents
Yukun Zhang, Kemu Xu and Yishen Chen at CUHK and the University of Edinburgh separate what a harness contributes by pairing real task-specific plans against shuffled policy text matched in word count, across two Retail experiments and an Airline pilot in tau^2-bench.
DeepSeek-V4.1-Flash: Pushing the Limits of KV Cache Compression
DeepSeek-AI releases DeepSeek-V4.1-Flash, a 552B-parameter multimodal MoE built around a Causal Encoder-Decoder architecture that activates 16B parameters per decode token and 8B per prefill token, and cuts the resident KV cache to 890 bytes per token.
Inference-Engine Fingerprinting Attacks are Practical: Exploring Model-Driven Environmental Discovery, Exploitation, and Escape
Sarah Radway, Andrew Cheng, Vijay Janapa Reddi and James Mickens at Harvard show that a model can identify which inference engine is executing it from its own output behaviour, then use engine-specific exploits reachable purely through generated tokens.
Closed-World Resolution Against Tool Hallucination in LLM Agents
Laxmipriya Ganesh Iyer shows that tool-selection and tool-gating defenses cannot address calls to tools that do not exist, gives a five-class taxonomy of tool hallucination, and measures the problem across ten hosted models and the Model Context Protocol.
Reflections on Trusting Trust, Revisited: Contaminating Self-Modifying AI Coding Agents with Poisoned Benchmarks
Franziska Roesner (University of Washington) and Tadayoshi Kohno (Georgetown University) adapt Thompson's trusting-trust attack to self-modifying coding agents and show that a poisoned self-evaluation benchmark can make later agent versions write vulnerable code on clean, held-out tasks.
One Axis, No Brake: Self-Knowledge Limits the Filtering of Harmful Peer Conformity in LLMs
Yibo Hu (Illinois Institute of Technology) shows that filtering harmful peer-induced revisions in multi-agent LLM systems reduces to the model knowing whether its original answer was correct, and that this self-knowledge sets a hard ceiling on any such filter.
Compiled Agency: Frontier General-Purpose Coding Agents Build Winning Game Players from Bare Interaction - from Flappy Bird to StarCraft II and Civilization
Joey Xiao (New York University) and Haonan Huang (Princeton University) introduce Gauntlet, a develop-freeze-evaluate framework in which a general-purpose coding agent receives only a game description, a raw observation and action interface and an empty policy file, then writes a standalone controller that is scored with no model calls during play.
Reflect, Revise, Reuse: Training-Free Skill Evolution for GUI Agents
Bofan Chen, Boxuan Zhang and colleagues at Zhejiang University and UESTC present EvoSkill-GUI, a training-free framework in which GUI agent skills are multi-file packages that the agent revises from execution feedback during deployment.
Do Frontier Models Seek Safety Evidence Before Acting?
Omer Tafveez (University of Michigan) introduces SAFE, a benchmark that tests whether frontier models choose to retrieve optional safety evidence before making a deployment decision, varying the evidence's retrieval cost, probability, severity and presentation.
SFT or RL for Tool-Calling Agents? A Controlled Study Across Data, Method, and Scale
Md Tahmid Rahman Laskar, Xue-Yong Fu and Shashi Bhushan TN at Dialpad compare LoRA SFT, GRPO and SFT followed by GRPO for tool calling across six Qwen3 models from 0.6B to 32B, measuring both in-distribution accuracy and cross-dataset transfer.
Compositional Policy Violations: When Step-Level Compliance Fails In Agentic AI Workflows
Ashwini Kurady, Sri Sai Charith Grandhi, Rajesh Gupta (RunCtrl) and Sumit Mamoria define Compositional Policy Violations, cases where every step of an agentic workflow passes its own check while the full execution violates an organizational policy, and propose runtime checks over complete execution traces.
The Other Half of the Memory Wall: Serving 35B MoEs from SSD with Trained Routing Prediction
Yu Lin and colleagues at AutoArk present Edge0, a streaming MoE inference engine that serves a 35B-class MoE from SSD on a single 24GB machine by predicting the next layer's expert routing one token ahead and using that prediction as the routing.
Bad Genius: Counterfactual-Guided Harness Evolution Beyond Task-Specific Shortcuts
Guojun Zhu and colleagues at the University of Chinese Academy of Sciences and the National University of Singapore introduce CHASE, which prevents automatic harness optimization from producing harnesses whose benchmark gains depend on shortcuts in the benchmark protocol rather than on the tasks.
AutoTuneBench: Trustworthy Measurement for Agent Auto-Tuning of LLM Serving Engines
Li Chen (harnets.ai) presents AutoTuneBench, a benchmark and measurement protocol for LLM agents that tune GPU kernels and serving engines, built after a four-day pilot of 619 model calls showed that the propose-measure-keep loop produces untrustworthy speedups.
NeMo Data Designer: An Extensible Framework for Multimodal Synthetic Data Generation
Johnny Greco and colleagues at NVIDIA describe NeMo Data Designer, an open-source framework for multimodal synthetic data generation in which humans or agents declare each dataset column in an inspectable configuration.
ProgramDistill: From Interactive Web Apps to Verifiable Reference-Guided SWE Tasks
Jeonghye Kim (KAIST) with Microsoft Research Montréal and Microsoft AI collaborators introduce ProgramDistill, a benchmark where coding agents must infer features from a working reference web application and implement them in an incomplete copy.
Agora: Git as Shared Memory for Collective AutoResearch
Yifan Zhang, Yi Dong and colleagues at NVIDIA present Agora, a shared memory for autonomous research agents in which every result, hypothesis and verification is an immutable Git commit in an append-only DAG, and report a 12-day run with 13 LLM workers and no central planner.
Whom Do AI Agents Work For? Role Assignment Induces Sponsorship Bias in LLM Recommenders
Davood Wadi and Yu Ma (McGill University) show that when the system prompt names a booking platform rather than the traveler as the agent's principal, LLM shopping agents penalize sponsored listings less.
Ask the Tool, Don't Guess: Agent Tool Calls Hold Their Progress, and the Serving System Should Read It
Yipeng Liu and colleagues at Tsinghua University, Zhejiang University and Alibaba Cloud argue that serving systems should read progress reports from running tool calls, instead of predicting tool duration, when deciding whether an agent's KV cache stays on the GPU during a tool wait.
Collective Loss of Control in LLM Agent Systems: An Epidemic Account of Mutation, Contagion, and Recovery
Xiangfan Wu and colleagues at Tencent Zhuque Lab model collective loss of control in multi-agent LLM systems as an epidemic of mutation, contagion and recovery, and test two parts of that model with a deployment audit and the RogueHandoff-20 benchmark.
Confidence Comes from Experience: Experiential Confidence Estimation from Reasoning to Agents
Caiqi Zhang, Nigel Collier, Dharshan Kumaran and colleagues at the University of Cambridge and Google DeepMind propose XConf, which estimates an LLM's confidence from a record of its own graded past episodes rather than from the current inference alone.
Monitoring and Discovering Reward Hacking with Internal Representations during LLM Evaluations
Leon Bergen, Usha Bhalla, Andrew Lee and colleagues at Goodfire show that difference-of-means (DoM) activation vectors identify reward hacking in Kimi K3, GLM 5.2 and Qwen 3.8 Max during coding evaluations, and that these probes cost almost nothing to run compared with LLM monitors.