AI research wiki
August 4, 2026 · daily digest

cere-bro | 2026-08-04

cere-bro | 2026-08-04

The headline efficiency property of every hybrid model shipped this year, that linear attention gives you a constant-size cache, turns out not to survive contact with prefix caching. Separately, a training trick that looked like a coincidence three days ago is now a convention, with four independent papers using it.

TL;DR

Deep Dives

Kimi K3, The Manos, The Mythos, The Legendos

Every hybrid linear-attention model this year has been sold on a constant-size recurrent state instead of a growing KV cache. This primer shows that as soon as you turn on prefix caching, you have to checkpoint that state every 32K tokens, and the memory saving becomes a smaller constant rather than a better asymptote.

Source: SemiAnalysis (also starred in Gmail) Links: Post · Wiki summary

flowchart LR
  T[Token stream] --> KDA[KDA layers<br/>linear attention<br/>fixed recurrent state]
  T --> MLA[MLA layers<br/>full attention<br/>low-rank latent KV]
  KDA -->|3:1 ratio| MIX[Hybrid backbone]
  MLA -->|3:1 ratio| MIX
  MIX --> AR[Block Attention Residuals<br/>attend over DEPTH<br/>1.25x compute efficiency]
  AR --> LMOE[Stable LatentMoE<br/>compress before dispatch]
  LMOE --> QB{Quantile load balancing<br/>hyperparameter-free}
  QB --> OUT[Output]
  KDA -.-> PC[Prefix cache problem:<br/>checkpoint state<br/>every 32K tokens]
  PC -.-> THRASH[B300 single node:<br/>3.25M token budget,<br/>hit rate under 10 percent<br/>above concurrency 8]
  classDef input fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a
  classDef decision fill:#fef3c7,stroke:#f59e0b,color:#78350f
  classDef output fill:#d1fae5,stroke:#10b981,color:#065f46
  classDef warn fill:#fee2e2,stroke:#ef4444,color:#7f1d1d
  classDef aux fill:#e0e7ff,stroke:#6366f1,color:#312e81
  class T input
  class QB decision
  class MIX,AR,LMOE,OUT output
  class PC,THRASH warn
  class KDA,MLA aux

What is it about? SemiAnalysis wrote the architecture explainer that Moonshot's Kimi K3 release blog did not. It derives Kimi Delta Attention (KDA, the linear-attention layer in K3's hybrid backbone) from first principles, analyzes Moonshot's open-sourced FlashKDA kernels down to FLOPs and bytes, and then measures K3 serving on real recorded coding-agent traces.

What problem does it solve? Until now the wiki's picture of hybrid linear attention came from release blogs and from a practitioner benchmark on 07-30 that measured a 20x KV cache gap between hybrid-attention and dense models and concluded the biggest available efficiency win is architectural, chosen at model-selection time. That framing was right about direction and missing the catch. This piece supplies the catch.

What is the core novelty? Two things. First, a proposed metric: KV throughput, meaning KV cache size divided by prefill time at a given sequence length. The argument is that cache size alone is meaningless because it is a property of the whole model design, not a standalone knob, and it depends on how much memory your parallelism strategy left over. KV throughput folds architecture efficiency into the number because prefill time does, and it reads directly as the bandwidth you need to serve the model under prefill/decode disaggregation. Second, and more important, the prefix-caching result. Inference engines find a cache hit by matching the longest token prefix already cached. For standard attention that works because every position has its own key and value rows. KDA has one fixed-size recurrent state per position, so without knowing where a future prefix boundary will fall, you would have to save the state at every token, which puts memory growth back to linear and defeats the whole point. Moonshot's answer is coarse checkpointing: vLLM saves KDA state every 32K tokens plus at prompt boundaries, because in agentic workloads a new turn usually starts at the end of a prompt.

Key takeaways

Gaps in the study KV throughput is proposed and then tabulated only for hybrid against dense, but the live design choice is KDA-plus-MLA against the GQA-sparse family (GLM 5.2's DeepSeek Sparse Attention, DeepSeek V4's Compressed Sparse Attention, MiniMax M3's sparse attention, MiMo V3's HySparse), and that comparison is absent. The B300 thrashing number is one node at one concurrency sweep, not a scaling study. And the primer infers K3's structure from Kimi Linear rather than from K3 documentation, which it says openly.

Industrial implication Anyone sizing HBM from a linear-attention model's nominal state size will under-provision, because the 32K checkpoint granularity is the real unit. The more actionable version: the gap between a 95% theoretical prefix-cache hit rate and an under-10% realized one is capacity, not tuning, so KV-aware tiering across HBM, DRAM and NVMe stops being an optimization and becomes the thing that decides whether your deployment works. That has been listed as an open problem on the wiki's memory-hierarchy page since 06-07 and as an unshipped serving feature. It is now load-bearing. The primer also predicts K4 drops MLA, on the grounds that MLA's absorption trick cheapens decode at the cost of extra prefill compute, which is a good trade for reasoning and a bad one for prefill-dominant agentic work.

→ Full summary

Raven: High-Recall Sequence Modeling with Sparse Memory Routing

The reason linear-attention models lose specific facts is not that their state is too small. It is that they write to all of it on every token. Raven writes to a few slots and leaves the rest alone.

Source: Kurate weekly cs.LG leaderboard #16, ai_rating 7.0/10, the highest on either board this week. Not on HuggingFace, so this is LLM-rated underrated. Links: arXiv 2607.25357 · Wiki summary

flowchart LR
  TOK[Arriving token] --> R{Learned router:<br/>which slots?}
  R -->|selected| SEL[Decay + update<br/>only these slots]
  R -->|unselected| PROT[Untouched slots:<br/>protected from<br/>interference]
  SEL --> MEM[Fixed slot set,<br/>linear-time state]
  PROT --> MEM
  MEM --> READ[High recall,<br/>16x training length]
  SSM[SSM / linear Transformer:<br/>DENSE write] -.->|interference| PROB[Recall failure]
  SWA[Sliding-window attention:<br/>SPARSE write] -.->|hard eviction<br/>at window edge| PROB
  classDef input fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a
  classDef decision fill:#fef3c7,stroke:#f59e0b,color:#78350f
  classDef output fill:#d1fae5,stroke:#10b981,color:#065f46
  classDef warn fill:#fee2e2,stroke:#ef4444,color:#7f1d1d
  classDef aux fill:#e0e7ff,stroke:#6366f1,color:#312e81
  class TOK input
  class R decision
  class SEL,PROT,MEM,READ output
  class PROB warn
  class SSM,SWA aux

What is it about? A linear-time sequence model from Arshia Afzal (EPFL), Aviv Bick, Eric Xing, Volkan Cevher and Albert Gu (the Mamba author, now also at Cartesia AI). Its framing contribution is an axis: how does an efficient architecture write to memory? State-space models and linear Transformers write densely, updating the entire state for every arriving token, so information persists in principle but interferes, and recovering one specific past token gets hard. Sliding-window attention writes sparsely, storing explicit token representations, so in-window recall is reliable and eviction at the window edge is a cliff. The middle of that axis was empty.

What problem does it solve? The one failure mode that has killed every linear-attention substitute so far: long-context recall. The wiki's attention-mechanisms page has carried this as its first open problem since 05-29, when Parallax (which reframed softmax attention as a local-constant estimator and upgraded it to a local-linear one) reported gains only up to 1.7B and no needle-in-haystack numbers. Raven is the first paper here to attack the recall collapse as the primary target rather than listing it as a limitation.

What is the core novelty? Keep a fixed set of memory slots and, at each step, decay and update only a selected subset via learned input-dependent routing. The selective-decay half is what is actually new. Gated Slot Attention and Attention with Bounded Memory Control already had input-dependent routing, but both still wrote densely to all slots, so neither could isolate and protect a specific memory. Raven's decay touches only the slots it wrote, so an untouched slot is genuinely untouched.

Key takeaways

Gaps in the study No scales named in the abstract, and the family's track record says scale is the load-bearing unknown (Parallax stopped at 1.7B, MDN at 1.3B). No RULER or needle-in-haystack figures stated. And a per-step slot-selection decision needs to be cheap: no kernel or wall-clock throughput number appears, and a router costing more than the dense update it replaced would nullify the whole thing.

Industrial implication If this holds at scale it is the exit from the problem the Kimi K3 primer just documented above. A slot-structured state is addressable, and most slots are untouched at any step, which at least makes incremental or differential checkpointing conceivable in a way a monolithic dense recurrent state does not. That would let a hybrid model keep the linear layers' memory saving while still supporting prefix caching, which is the single largest cost lever in agentic serving. Nobody has connected these two papers, and it is the most valuable experiment on today's list.

→ Full summary

CRPO: Contrastive Reinforced Policy Optimization via Privileged Self-Distillation

When a model teaches itself using information its student half cannot see, the teacher becomes most confident exactly where the student is most genuinely uncertain. In agent tasks that moment is always the same: right after a tool call returns.

Source: Kurate weekly cs.LG leaderboard #2, ai_rating 6.0/10, from Meituan. Not on HuggingFace. Links: arXiv 2607.28026 · Wiki summary

flowchart LR
  ROLL[Student rollout,<br/>multi-turn agent] --> TOOL[Tool call returns<br/>new information]
  TOOL --> UNC[Student uncertainty<br/>spikes here]
  UNC --> ENT{Predictive entropy split}
  ENT -->|reflective<br/>exploration| POS[Positive positions:<br/>keep signal]
  ENT -->|exposure bias| NEG[Negative positions:<br/>contrast away]
  POS --> GRP[Group-wise contrast]
  NEG --> GRP
  GRP --> UPD[Update, inside OPSD,<br/>no second framework]
  TEA[Self-teacher with<br/>privileged information] -.->|dense logit targets| UNC
  classDef input fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a
  classDef decision fill:#fef3c7,stroke:#f59e0b,color:#78350f
  classDef output fill:#d1fae5,stroke:#10b981,color:#065f46
  classDef warn fill:#fee2e2,stroke:#ef4444,color:#7f1d1d
  classDef aux fill:#e0e7ff,stroke:#6366f1,color:#312e81
  class ROLL,TOOL input
  class ENT decision
  class POS,GRP,UPD output
  class NEG,UNC warn
  class TEA aux

What is it about? On-policy self-distillation (OPSD) trains a model against itself, where the teacher branch is the same policy handed privileged information the student does not get. It gives dense per-token supervision cheaply, which is why it has been displacing reinforcement learning with verifiable rewards (RLVR, where a single scalar reward has to supervise an entire generation). CRPO is a diagnosis of where that dense signal goes wrong in multi-turn agentic settings, plus a cheap fix that stays inside OPSD.

What problem does it solve? The privileged self-teacher's overconfidence. Because it sees more, it is confident where the student is legitimately uncertain, and two harms follow: the teacher's reasoning routes converge onto the specific patterns in the demonstrations so the student generalizes worse, and multi-turn optimization directions get muddy because position-level supervision is unreliable. Prior fixes (RLSD, SDAR, RLCSD) bolt an RLVR objective onto the distillation objective and pay for maintaining two frameworks.

What is the core novelty? Use predictive entropy to sort positions into two kinds, then contrast them against each other group-wise. Positive positions are where high entropy reflects genuine reflective exploration. Negative positions are where it reflects exposure bias from the privileged view. Same statistic, opposite treatment, and the contrast is what keeps only the reliable fine-grained signal.

Key takeaways

Gaps in the study The entropy threshold is the one hyperparameter the whole method turns on and no ablation of it is reported, while entropy calibration is model- and scale-dependent. "Consistently outperforms" across 13 benchmarks with no per-benchmark margins makes it impossible to tell whether the win is broad or carried by the deep-search subset where tool output dominates uncertainty. And the no-extra-cost claim is made against two-framework hybrids, when the relevant baseline is plain OPSD.

Industrial implication Anyone running self-distillation on agent traces today is training hardest on the positions where their teacher is least trustworthy, and the fix is a reweighting over data they already have. That is a cheap patch rather than a new pipeline. The broader implication, visible only across today's four privileged-teacher papers, is in Global View below.

→ Full summary

VAD: Attributing Visual Evidence for Target Reconstruction in Multimodal On-Policy Distillation

Prior work asked where and how strongly to distill. This paper asks a harder question: of this one correction the teacher just made, how much of it is actually because of the image?

Source: HuggingFace Daily Papers Links: arXiv 2607.28590 · Wiki summary

flowchart LR
  PRE[Student-generated prefix] --> T1[Same teacher,<br/>evidence PRESENT]
  PRE --> T2[Same teacher,<br/>evidence REMOVED]
  T1 --> DIFF[Change in centered log-probs<br/>= signed evidence direction]
  T2 --> DIFF
  CORR[Original teacher correction<br/>source-mixed] --> PROJ{Project onto<br/>evidence direction}
  DIFF --> PROJ
  PROJ -->|aligned part| REC[Student-anchored<br/>reconstructed target:<br/>PRIMARY supervision]
  PROJ -->|residual| DROP[Discarded: linguistic<br/>priors, teacher quirks]
  CORR -.->|demoted| REG[Weak regularizer only]
  REC --> LOSS[Training signal]
  REG --> LOSS
  classDef input fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a
  classDef decision fill:#fef3c7,stroke:#f59e0b,color:#78350f
  classDef output fill:#d1fae5,stroke:#10b981,color:#065f46
  classDef warn fill:#fee2e2,stroke:#ef4444,color:#7f1d1d
  classDef aux fill:#e0e7ff,stroke:#6366f1,color:#312e81
  class PRE,CORR input
  class PROJ decision
  class REC,LOSS,DIFF output
  class DROP warn
  class T1,T2,REG aux

What is it about? Multimodal on-policy distillation supervises a student's own generated trajectories with a teacher that gets a privileged view, usually a crop centred on the visual evidence the student needs. VAD (from Shanghai Jiao Tong University and Xiaohongshu, with CUHK, Zhejiang and Southeast) argues the resulting corrections are source-mixed: each one blends the visual signal you wanted with the teacher's linguistic priors and its own model-specific quirks, and you cannot tell them apart.

What problem does it solve? Existing methods treat this as a weighting problem. Vision-OPD conditions a teacher on an evidence crop and distills its whole next-token distribution. VA-OPD and V-Zero contrast informative against degraded views to prioritize tokens or trajectories, but keep the full evidence-present distribution as the target, so mixed directions still leak in. VAD's diagnostics report that a substantial share of the teacher's strongest corrections are not well aligned with its own evidence-conditioned response.

What is the core novelty? Run the same fixed teacher twice, once with the evidence present and once with it removed. The change in centered log-probabilities defines a signed direction in vocabulary space pointing along "what revealing this evidence does." Project the original correction onto that direction, split it into an intervention-aligned component and a proxy-unexplained residual, and rebuild a student-anchored target from the aligned component alone. That reconstructed target becomes the primary supervision and the privileged teacher is demoted to a weak regularizer.

Key takeaways

Gaps in the study Everything rests on a one-dimensional projection standing in for "the visual evidence direction," and a correction whose useful visual content is orthogonal to it gets discarded. The paper's own naming concedes the ambiguity: unexplained is not the same as unhelpful. How evidence is removed (masking, blurring, cropping) defines the counterfactual, and robustness to that operator is untested. Scale stops at 9B, and the extra teacher pass doubles teacher inference cost per supervised position without being priced against simply distilling more data.

Industrial implication The mechanism has nothing modality-specific in it. The interesting test is whether the same projection works when "evidence" is a retrieved document rather than an image crop, which would move it from a multimodal technique to a general recipe for cleaning any privileged-teacher signal. If it does, it is a drop-in improvement for retrieval-augmented distillation, which is a much bigger surface than fine-grained vision.

→ Full summary

ROPD: On-Policy Distillation for LLM Safety, a Routing Approach to Template-Robust Realignment

Every published safety-realignment defense repairs the model using a prompt template the defender chose. The attacker used a different one. That single mismatch is enough to make the reported numbers not transfer.

Source: Kurate weekly cs.AI leaderboard #18, ai_rating 6.0/10. Not on HuggingFace. Links: arXiv 2607.27081 · Wiki summary

flowchart LR
  BASE[Aligned base model] --> FT[Fine-tune on<br/>poisoned corpus]
  FT --> COMP[Compromised model:<br/>keeps the skill,<br/>complies on demand]
  COMP --> OLD{Prior defenses:<br/>repair with<br/>DEFENDER template}
  OLD -->|template matches| OK[Some ASR reduction]
  OLD -->|template MISMATCH| FAIL[Defense collapses<br/>or skill destroyed]
  COMP --> ROPD{ROPD: model the<br/>DIVERGENCE between<br/>aligned and compromised<br/>distributions}
  BASE -.->|reference| ROPD
  ROPD --> OUT[Realigned:<br/>template-robust,<br/>skill preserved]
  classDef input fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a
  classDef decision fill:#fef3c7,stroke:#f59e0b,color:#78350f
  classDef output fill:#d1fae5,stroke:#10b981,color:#065f46
  classDef warn fill:#fee2e2,stroke:#ef4444,color:#7f1d1d
  class BASE input
  class OLD,ROPD decision
  class OUT,OK output
  class COMP,FAIL,FT warn

What is it about? A supply-chain attack and a defense. A malicious data provider embeds harmful behaviour into a fine-tuning corpus, producing a model that still performs the specialized job it was fine-tuned for while complying with dangerous requests on demand. The competence masks the compromise.

What problem does it solve? Three named failures in existing safety-realignment defenses, which include selectively restoring fine-tuned weights, adding safety vectors, token-weighted fine-tuning, and representation-space corrections. They cause catastrophic forgetting of the specialized skill the user paid for. Their effectiveness collapses when the defender cannot observe the attacker's prompt template, which is the realistic case. And realigned models remain re-jailbreakable by a simple system-prompt switch.

What is the core novelty? Stop fitting templates. ROPD models the divergence between the aligned model's output probability distribution and the compromised model's, and distills against that on-policy, on the compromised model's own generations. Whatever surface form the attacker used, that distributional difference does not depend on it.

Key takeaways

Gaps in the study No absolute attack-success-rate numbers in the abstract, so the residual risk is unquantified. Three models and three datasets says nothing about frontier scale. The threat model presumes the defender already knows the model is compromised, and undetected compromise is the harder half of the problem: nothing here helps with detection. And the system-prompt re-jailbreak mode is named as a weakness of prior work without a stated claim that ROPD closes it.

Industrial implication Anyone fine-tuning on third-party data should treat published realignment numbers as measured under an assumption their threat model does not grant. But the ordering matters, and today's industry data argues for a different first move: IBM found that 92% of companies hit by an AI security incident had inadequate access controls, and that the model itself was rarely the problem. A model-layer defense against a supply-chain attack is worth having, and the breaches that actually happened were upstream of the model.

→ Full summary

AAPT: Why Are GUI Agents Correct but Late?

The agent knows the right click. It finishes deciding after the dialog has closed. Two baselines score exactly zero on this, not because they are wrong, but because they are still generating text when the window shuts.

Source: Kurate weekly cs.LG leaderboard #5, ai_rating 6.0/10. Not on HuggingFace. Links: arXiv 2607.28399 · Wiki summary

flowchart LR
  IDLE[Idle screen period] --> BUILD[Frozen model builds<br/>bounded policy tree,<br/>sized to cover its own<br/>decode latency]
  BUILD --> TREE[Branches: observable guard<br/>+ pre-authorized action<br/>+ deadline]
  EVT[Transient GUI event] --> OBS[Lightweight observer,<br/>change-gated frames]
  TREE --> OBS
  OBS --> MATCH{Guard satisfied<br/>in deadline?}
  MATCH -->|yes| ACT[Execute pre-authorized<br/>action, NO decoding<br/>0.50 to 0.79]
  MATCH -->|no| NOOP[Do nothing:<br/>zero incorrect actions]
  BASE[Open-loop and<br/>predict-and-replan] -.->|still decode<br/>during execution| ZERO[0.00 success]
  classDef input fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a
  classDef decision fill:#fef3c7,stroke:#f59e0b,color:#78350f
  classDef output fill:#d1fae5,stroke:#10b981,color:#065f46
  classDef warn fill:#fee2e2,stroke:#ef4444,color:#7f1d1d
  classDef aux fill:#e0e7ff,stroke:#6366f1,color:#312e81
  class IDLE,EVT input
  class MATCH decision
  class BUILD,TREE,ACT,OBS output
  class ZERO,NOOP warn
  class BASE aux

What is it about? Computer-use agents failing on transient GUI events: boot prompts, auto-dismissing dialogs, short-lived authentication requests, reaction-time game states. The paper's claim is that this is a timing failure, not a comprehension failure, and it names the cause as autoregressive decoding sitting on the decision-time critical path.

What problem does it solve? Prior work either improved perception (continuous screen sampling with change gating) or improved anticipation (GUI world models like WebDreamer and MobileDreamer, receding-horizon replanning like TraceR1). Neither helps, because predicting the future state does not save you if you still have to decode an action after observing it. Speculative planning approaches hide latency by overlapping fast approximate execution with slow verification, which requires the speculated work to be undoable, and most GUI actions are not.

What is the core novelty? During idle screen periods, the same frozen multimodal model builds a bounded conditional policy tree: each branch carries an observable guard, a pre-authorized action, and its own deadline, and the tree is deliberately sized to cover the model's own decoding latency. When an event fires, a lightweight observer matches change-gated frames to a prepared branch and executes immediately, generating no new text. This is admission control, not speculation: several actions are prepared, one is committed only after a live observation satisfies its guard inside a deadline.

Key takeaways

Gaps in the study The headline lives inside a window constructed to expose the effect, so it measures the mechanism rather than end-to-end agent utility, and on an external benchmark AAPT merely ties a reactive baseline. Tree construction consumes idle time and model calls with no token or dollar accounting, which matters because the whole idea is to spend more compute earlier. And the branch-routing bottleneck is located, not fixed.

Industrial implication This is the first result in the wiki where decode latency is a correctness axis with a step function rather than a cost axis: below the deadline you succeed, above it you score zero no matter how right the answer was. That cuts against the dominant serving framing, which after today's Kimi K3 numbers is that agentic work is prefill-and-retention bound at roughly 142k input against 444 output tokens per turn. Both are true of different workloads, and no serving stack distinguishes them: vLLM and SGLang have no way to express a per-request deadline. A scheduler batching for throughput is exactly wrong for a deadline-bound GUI agent, and somebody is going to have to build admission control that knows the difference.

→ Full summary

ScrambleToolBench: Agents Search Exhaustively Even When Their Own Map Points to the Next Step

Take the meaning out of tool names and agents still figure out what the tools do. Then change one mapping behind their back and they either keep acting on the stale map or start over from scratch. Giving them more reasoning budget makes the second one worse.

Source: HuggingFace Daily Papers Links: arXiv 2608.02358 · Wiki summary

flowchart LR
  ENV[Terminal environment,<br/>semantics REMOVED<br/>from tool schemas] --> DISC[Discovery by<br/>trial and error]
  DISC --> OK[Agents succeed here]
  ENV --> PERT[Perturbation: mapping drift,<br/>stochastic failures,<br/>timing windows]
  PERT --> ADAPT{Can the agent<br/>revise its map?}
  ADAPT -->|deductive:<br/>cycle tracing| WANT[A few targeted probes<br/>NOT OBSERVED]
  ADAPT -->|belief inertia| F1[Acts on stale map]
  ADAPT -->|fallback| F2[Exhaustive re-probe]
  TTC[More test-time reasoning] -.->|amplifies| F2
  MEM[Persistent memory] -.->|reduces compounding<br/>errors only| F2
  classDef input fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a
  classDef decision fill:#fef3c7,stroke:#f59e0b,color:#78350f
  classDef output fill:#d1fae5,stroke:#10b981,color:#065f46
  classDef warn fill:#fee2e2,stroke:#ef4444,color:#7f1d1d
  classDef aux fill:#e0e7ff,stroke:#6366f1,color:#312e81
  class ENV,PERT input
  class ADAPT decision
  class DISC,OK,WANT output
  class F1,F2 warn
  class TTC,MEM aux

What is it about? An interactive terminal benchmark that strips semantic meaning out of tool names and descriptions, so an agent has to learn what each tool does purely by trying it. A continuous task curriculum keeps the agent using what it learned, and then the environment starts changing: mapping drift (the tool-to-effect mapping silently shifts), stochastic action failures, and temporal execution windows.

What problem does it solve? Every existing tool-use benchmark hands the agent semantic schemas in a static world, which lets it lean on prior knowledge about what a function called send_email probably does. That makes apparent tool-discovery ability indistinguishable from memorized priors.

What is the core novelty? Separating two capabilities that static benchmarks bundle: initial discovery and subsequent adaptation. Agents have the first and lack the second. They do not use the deductive strategy the situation calls for, which the paper names cycle tracing: your existing partial map already constrains where the change must be, so a handful of targeted probes localize it. Instead they show belief inertia or fall back to exhaustive re-probing.

Key takeaways

Gaps in the study No models named and no numbers in the abstract, so the size of the gap is unquantified. And whether full semantic removal is a fair test is arguable: real systems leak signal through error messages, response shapes and argument arity, and stripping all of it may create a harder problem than deployment while also removing cues a competent human explorer would use. The benchmark is single-agent, so nothing tests whether two agents splitting the hypothesis space recover the deductive shortcut cheaply.

Industrial implication The missing capability is neither storage nor retrieval, it is revision: noticing that a stored belief has been invalidated and localizing the invalidation. No paper on the wiki's agent-memory page treats belief revision as a distinct operation from remembering, and every long-running agent deployment is in a world that drifts under it (an API version bumps, a UI moves, a permission changes). The uncomfortable corollary for cost: the standard response to an agent that is failing is to raise its reasoning budget, and here that makes the bill larger and the outcome no better.

→ Full summary

SWE-Touch: the same failure, with a human supplying the drift

ScrambleToolBench changed the environment under the agent. This one lets a person edit the code mid-task, which is what actually happens, and costs 7.7 resolve points.

Source: HuggingFace Daily Papers Links: arXiv 2608.02499 · Wiki summary

flowchart LR
  T[SWE-bench Verified /<br/>Pro / DeepSWE task] --> MINE[Mine task-critical regions<br/>across MULTIPLE repair<br/>trajectories]
  MINE --> GEN[User Patch Generator builds<br/>a PLAUSIBLE edit that<br/>conflicts with the task]
  GEN --> INJ{Inject when the agent<br/>reaches that code,<br/>plus a user message}
  INJ --> F1[Retains the<br/>conflicting code]
  INJ --> F2[Overwrites without<br/>re-inspecting the repo]
  INJ --> F3[No targeted test on<br/>the revised behaviour]
  F1 --> RES[Resolve rate<br/>-7.7 points, 9 models]
  F2 --> RES
  F3 --> RES
  classDef input fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a
  classDef decision fill:#fef3c7,stroke:#f59e0b,color:#78350f
  classDef output fill:#d1fae5,stroke:#10b981,color:#065f46
  classDef warn fill:#fee2e2,stroke:#ef4444,color:#7f1d1d
  class T,MINE input
  class INJ decision
  class GEN output
  class F1,F2,F3,RES warn

What is it about? Every repository-level coding benchmark evaluates an agent working alone, or restricts the human to sending messages. Real development is a shared workspace: while the agent works, a person opens files and changes them. SWE-Touch stress-tests exactly that.

What problem does it solve? It measures a capability that nearly every deployment requires and nearly no leaderboard scores, which is whether an agent notices that the code under it has moved. The framing matters because "collaborative" agent evaluation has so far meant conversational turns, not concurrent mutation of shared state.

What is the core novelty? The validated Counter-Edit. An adversarial edit is trivial to produce and worthless if implausible, because then the benchmark is measuring robustness to nonsense. So the pipeline mines task-critical regions from multiple independent repair trajectories, on the reasoning that the intersection across separate solution paths is a decent proxy for load-bearing code, then uses a separate User Patch Generator model to construct an edit that conflicts semantically rather than syntactically, and injects it with a contextual user message at the moment the agent arrives at that code.

Key takeaways

Gaps in the study The 7.7 points is an average across nine models with no spread reported, so whether frontier models degrade less is the first question anyone has and it is unanswered. The Counter-Edit lands at a single moment, when the agent reaches the relevant code, which is a friendly simplification of a real workspace where edits arrive at arbitrary times including while the agent holds a stale read. And every edit conflicts by construction, so the benchmark structurally cannot measure the commoner real case, a helpful concurrent edit the agent should adopt rather than fight: an agent that re-reads constantly and distrusts everything scores well here and would be intolerable in practice.

Industrial implication Anyone running a coding agent against a live repository that humans also touch is operating in the regime this paper measures, and the 7.7-point figure is the first price tag on it. The concrete consequence is that horizon length and state-revision capability have been bundled under "long-horizon" and are separable, so a model chosen on SWE-bench Verified alone has been selected on the wrong axis for shared-workspace work. It also explains a production complaint from the same day rather than a different one: Cursor shipped Workspace plugins giving agents direct read-write access to Gmail, Drive, Calendar, Docs and Sheets, which is five more mutable external states for an agent to track, in a week when two papers established that tracking mutable state is the thing they do worst.

→ Full summary

AI Agents Enable Adaptive Computer Worms

The worm runs its own language model on the GPUs of the machines it has already infected. There is no API key to revoke and no vendor to notify.

Source: Import AI 467 (Jack Clark), covering work from University of Toronto, Vector Institute, Cambridge and ServiceNow Links: arXiv 2606.03811 · Import AI 467 · Wiki summary

flowchart LR
  HOST[Compromised host<br/>with GPU] --> LLM[Open-weight LLM on<br/>STOLEN compute,<br/>one 80GB A100]
  LLM --> GRAPH[Reasoning graph:<br/>Plan, Judge, Action,<br/>Summary, Progress<br/>scoped tools per node]
  GRAPH --> S1[Detect vulnerability<br/>~80 percent]
  S1 --> S2[Exploit<br/>~53 percent]
  S2 --> S3[Self-replicate<br/>88 percent]
  S3 --> SWARM[Decentralized swarm:<br/>hard hosts retried by<br/>other replicas]
  SWARM --> HOST
  NOAPI[No vendor API] -.->|nothing to monitor<br/>or revoke| LLM
  classDef input fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a
  classDef decision fill:#fef3c7,stroke:#f59e0b,color:#78350f
  classDef output fill:#d1fae5,stroke:#10b981,color:#065f46
  classDef warn fill:#fee2e2,stroke:#ef4444,color:#7f1d1d
  classDef aux fill:#e0e7ff,stroke:#6366f1,color:#312e81
  class HOST input
  class GRAPH decision
  class S1,S2,S3 output
  class SWARM,NOAPI warn
  class LLM aux

What is it about? A working prototype of a computer worm that uses a language model to reason about how to compromise machines, and then runs that model on the GPUs of machines it already owns. The authors state the design goal plainly: no reliance on vendor APIs that could be monitored or revoked.

What problem does it solve? From the attacker's side, the control point. Every prior AI-assisted attack story routes reasoning through a hosted API, which is exactly where a defender or a provider can intervene. From the research side, it converts an argument about future risk into a measured capability.

What is the core novelty? Two things. The parasitic inference loop, and a reasoning graph in place of a single agent loop: a directed graph of specialized nodes each seeing only the tools and prompts relevant to its role (Plan formulates strategy, Judge reviews the plan against command history, Action selects a phase-appropriate tool, Summary compiles observations, Progress evaluates whether anything is advancing). That scoping is what lets a modest open-weight model published in 2025, fitting on a single 80GB A100, do the job. Most nodes are redacted in the public manuscript.

Key takeaways

Gaps in the study The model is never named beyond "2025, fits on one A100," which makes the capability-versus-model-generation relationship untestable from outside and it is the single most decision-relevant variable. Most reasoning-graph nodes are redacted, so the mechanism claim cannot be independently reproduced. The 80% and 53% figures are properties of a research testbed whose vulnerability distribution is not compared to a real network. And nothing is measured about detectability, even though a worm running LLM inference on a compromised host produces an extremely distinctive GPU utilization and memory signature.

Industrial implication It reframes open-weight risk. The weights here were already public and unremarkable; what made the system dangerous was the harness plus access to someone else's GPUs. So the binding question is not a capability threshold in a model card, it is whether an attacker can obtain inference cheaply. Which makes the other item in the same Import AI issue directly relevant: Dwarkesh Patel argues compute gets more expensive as models improve, because a genuinely human-level software engineer running on an H100 would justify renting that H100 for over $250k a year, roughly 15x today's spot price. If he is right, stolen compute becomes proportionally more valuable, and GPU theft moves from nuisance to primary economic attack. Neither source connects them.

→ Full summary

Industry Pulse

Funding, valuations, and compute deals

Global View

The efficiency stack's biggest assumed win just got a footnote, and the footnote is the whole result. For three months the wiki's KV story has trended one way: the largest available saving is architectural, not algorithmic. The 07-30 practitioner benchmark measured a 20x KV cache gap between hybrid-attention and dense models, roughly ten times what any software cache-management method reports, and concluded you should pick the hybrid model first and then optimize. The SemiAnalysis primer confirms the direction and removes the asymptote: KDA's fixed-size state has to be checkpointed every 32K tokens for prefix caching to work at all, so the win is a smaller constant, not a different growth curve. And the realized number is worse than that, because on a single B300 node holding 3.25M tokens of budget, hit rate falls below 10% past concurrency 8 against a 95% theoretical rate, which finally puts a floor under the 07-25 AgentX figure of a 99.2% median hit rate that was explicitly measured under an infinite cache. Industry is behaving as if capacity is the binding constraint, which is the correct reading of this physics: AWS says capacity is sold out into 2028, DeepSeek V4 Flash is cutting coding prices 99% while Alibaba undercuts Kimi K3, and all of that is a market where the scarce good is memory-hours rather than FLOPs. Raven is the first architectural exit anyone has proposed, because a slot-structured state is addressable and mostly untouched per step, which makes differential checkpointing thinkable where a monolithic dense state does not. Nobody has connected the two papers, and that connection is worth more than either alone.

"Privileged teacher" crossed from coincidence to convention in three days, and the research question moved with it. The knowledge-distillation page noted on 08-03 that a third instance of "a privileged-information branch supplying dense supervision to a deployed branch that never sees it" would make it a named pattern. It got two more today. The four: MAPD (08-02), whose privileged student branch reads a JSON protocol the deployed branch does not get; CriPO (08-03), which distills from two self-teachers that are the same policy under a different prompt and found that over 57% of rubric-RL samples contain a criterion the model already satisfied whose signal scalar aggregation destroyed; CRPO (08-04), an entropy-filtered privileged self-teacher for agentic rollouts; and VAD (08-04), a teacher shown an evidence crop the student never sees. Four unrelated groups (Meituan, Microsoft with Amsterdam, Zhejiang with ByteDance, SJTU with Xiaohongshu), three modalities, two objectives. The useful teacher is no longer a bigger model, it is the same model with more information, and the live problem has shifted from getting a teacher to deciding which parts of a privileged teacher's signal are trustworthy. CRPO and VAD answer that in opposite ways and cite neither each other: CRPO filters by position using predictive entropy, VAD filters by direction using a counterfactual projection. Meanwhile ReCo (Kurate cs.LG #19) attacks GRPO for concentrating on responses the base model already generates and fixes it by upweighting exactly the non-saturated, high-uncertainty positions CRPO discards. Same statistic, opposite prescription, because one is protecting exploration coverage and the other supervision reliability, and nobody has said whether those are compatible.

The week's real theme is that the instruments are broken, and today added two more plus an industry number that fits. Five results in eight days all say the mechanism is fine and the published justification does not survive controlled measurement. Coherent Overlap (07-31) found expert-subspace similarity, the standard tool for choosing which MoE experts to prune, cannot determine redundancy, so any compression ratio derived from it needs re-deriving. Sparse Event-KV (07-29) found that dropping a cache entry and observing no accuracy loss does not show the entry was unnecessary. Eviction as Estimation (08-03) found that on natural text the model is right about almost every token, so the whole KV-eviction benchmark suite cannot separate policies. Today, ROPD adds that safety-realignment numbers are measured under a template-matching assumption the real threat model does not grant, and ScrambleToolBench adds that tool-use benchmarks have been measuring memorized semantic priors rather than discovery, which is the same consequence Surge AI reached from contamination on 08-02 by showing a frontier model reproduce SWE-bench Verified prompts and answers verbatim. The industry version arrived in the same window: Kilo's 10,643-review study found that models agree far more on what is wrong than on how bad it is, so the severity axis every escalation workflow depends on is the least consistent output the models produce, and the open-versus-closed security gap everyone quotes was carried by one outlier model. Research and industry are converging on the same uncomfortable place, which is that the measurement layer is now the bottleneck rather than the capability layer.

Looking Ahead