ArXiv Domain 2026-09-05
数据来源:ArXiv Domain
LLM Domain Papers
1. Where Does Harness-Optimization Value Live? Localized Gains and the Budget-Splitting Trap in Self-Evolving LLM Agents
Abstract:A growing body of work improves frozen large language models (LLMs) as agents by evolving their harness: the textual scaffolding around the model, including persona, strategy, format rules, and control heuristics. Existing reflective prompt-evolution methods usually optimize this harness as one flat string. We instead ask where the optimization value actually resides. We introduce HARNESSEVO, which decomposes the harness into four separately evolvable slots: role, task-strategy, tool/format-rules, and reflection/control. Using the same reflective optimizer under an iso-budget setting, we pair this decomposition with leave-one-in and leave-one-out attribution to measure the contribution of each slot. On ALFWorld with a frozen 7B backbone, HARNESSEVO does not significantly improve the overall binary success rate over either the stock harness or flat-string evolution: 0.657 versus 0.642 and 0.642, respectively. However, the slot-level analysis reveals that nearly all useful optimization value is localized in the reflection/control slot, which achieves a leave-one-in gain of +0.119. The other slots are individually null. We further show that uniform budget splitting is harmful: allocating 64 rollouts across four slots leaves only 16 per slot, below the optimizer’s effective search floor, causing every slot to freeze at its empty seed. Concentrating the budget on the high-credit control slot recovers the lost gain, reaching 0.761 with half the split budget. The effect is task-contingent. On WebShop, all slots freeze empty and all methods tie, indicating a genuine absence of recurrent, verbalizable control failures rather than budget starvation. Overall, our results suggest that harness value is localized, uniform budget splitting can be actively harmful, and credit assignment should precede structured agent-evolution.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.02889 (HTTP 429)
Authors: Michael Nguyen, Wei Chen Tan, Nurul Aisyah Hassan, Arvind Raman, Li Hua Lim, Ahmad Faiz Razak
Categories: cs.CL
PDF URL: https://arxiv.org/pdf/2609.02889.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.02889
Published: 2026-09-05T01:23:02.948Z
2. Bounded Personas Match Retrieval on Classification but Not Regression for a Frozen Agent
Abstract:A personalized language agent must convert a user’s interaction history into behavior on each new request at inference time. Two strategies dominate. Retrieval pulls a few of the user’s most relevant past items into the prompt, which is accurate but pays a per-query selection and context cost that grows with the history. Distillation instead compresses the history once into a compact natural-language persona, which is bounded, query-independent, and interpretable, but is widely assumed to sacrifice accuracy. Whether, and on which tasks, a distilled persona can match retrieval has not been characterized cleanly. We introduce PersonaLink, a training-free method that distills a user’s history into a bounded three-field persona and recursively refines it: each pass self-evaluates the frozen agent on a held-out slice of the user’s own labeled history, rewrites the persona from its errors, and keeps the result only when it does not regress on that slice. Because every comparison shares one frozen 7B backbone and differs only in what is placed in context, the design isolates the effect of representation from that of the model. The result is a clear task-type asymmetry. On 200 users of LaMP-2 (15-way news categorization), PersonaLink reaches 0.745-0.755 accuracy, statistically indistinguishable from BM25 retrieval (0.760-0.765).
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.02890 (HTTP 429)
Authors: JaeHa Yoon, Minjun Park, Seoyeon Kim, Jiwoo Lee, Hyunwoo Choi, Dohyun Kang
Categories: cs.CL
PDF URL: https://arxiv.org/pdf/2609.02890.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.02890
Published: 2026-09-05T01:23:02.948Z
3. Counterexamples as Feedback for Agent Self-Correction
Abstract:Single-turn code-generation metrics understate a central property of deployed agents: whether they can repair a wrong artifact after receiving concrete feedback. This paper presents A-CEGIS, a lightweight framework that uses counterexamples as feedback for evaluating multi-turn refinement in natural-language-to-regex synthesis. An agent proposes a regex, a deterministic oracle checks it under full-match semantics, and compact false-positive or false-negative witnesses guide the next turn. On 30 NL-RX-Turk tasks, diagnostic counterexample feedback solves 90\% of tasks within a four-turn ablation budget, compared with 17% for zero-shot generation, 27% for generic self-correction, and 23% for error-only feedback. In a full diagnostic run with hardening, all tasks are solved on the hidden set by the final turn, with mean time-to-success of 2.7 turns and robust success of 77% after targeted probing. These results show that A-CEGIS measures how efficiently an agent improves across turns while adding a practical robustness check beyond the original held-out cases.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.02892 (HTTP 429)
Authors: Sidhesh Badrinarayan, Adithya Parthasarathy
Categories: cs.CL
PDF URL: https://arxiv.org/pdf/2609.02892.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.02892
Published: 2026-09-05T01:23:02.948Z
4. Probe Generalization as Subspace Selection for OOD Deception Detection
Abstract:Linear probes can be used to detect behaviors and concepts inside language model activations, but may fail to transfer to out-of-distribution examples. When studying the generalization performance of Llama-3.1-8B-Instruct probes over 3 held-out deception detection datasets, we find that projecting inputs onto a small subset of principal components (PCs) from the training distribution of activations enables cross-domain transfer that nearly matches the performance of probes trained directly on the test distribution. Furthermore, we find that PC interpretations can be used to find a subset of those transferable PCs. By using an LLM judge to score each PC on whether its most/ least activating examples imply a transferable deception direction, then probing on the highest-scoring PCs, we close the baseline-to-oracle gap by 78% on Insider Trading Report and by 25% on Sandbagging. The directions a source probe weights heavily appear to encode source-specific surface features, while the directions that actually transfer appear to encode the same contrast more abstractly, in a way natural language descriptions can capture. Broadly, our results suggest that the OOD robustness of probes is largely determined by subspace selection.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.02893 (HTTP 429)
Authors: Daniel Yoo, Adrians Skapars
Categories: cs.CL
PDF URL: https://arxiv.org/pdf/2609.02893.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.02893
Published: 2026-09-05T01:23:02.948Z
5. R$^{2}$Adapter: A Routing and Rewriting Adapter for Efficient Hybrid RAG
Abstract:Retrieval-Augmented Generation (RAG) has become a prevailing paradigm for enhancing Large Language Models (LLMs) with non-parametric knowledge. Vanilla RAG efficiently handles simple queries but struggles with relational or multi-hop reasoning. Graph-based RAG alleviates this issue but incurs higher inference complexity and latency. In practice, user queries can differ significantly in their complexity, rendering a fixed RAG strategy suboptimal. However, existing hybrid text-graph RAG methods typically rely on heuristic and LLM-based routing, resulting in unnecessary overhead and strong dependence on the underlying LLM. To address these challenges, we propose R$^{2}$Adapter, a lightweight plug-in Routing and Rewriting Adapter designed to allocate queries between vanilla and graph-based RAG dynamically. By routing only the queries that genuinely benefit from graph-based reasoning, R$^{2}$Adapter reduces unnecessary graph retrieval overhead. Additionally, uncertain graph-routed queries are rewritten to better expose their multi-hop reasoning requirements, improving retrieval quality without additional supervision. Extensive experiments on three multi-hop QA benchmarks demonstrate that R$^{2}$Adapter reduces graph-based RAG usage by up to 59% while maintaining comparable answer accuracy. This adapter is model-agnostic and can be seamlessly integrated into diverse vanilla and graph-based RAG pipelines, providing an efficient and adaptive solution for hybrid RAG systems.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.02894 (HTTP 429)
Authors: Yucan Guo, Miao Su, Saiping Guan, Long Bai, Zhongni Hou, Zixuan Li, Xiaolong Jin, Jiafeng Guo, Xueqi Cheng
Categories: cs.CL
PDF URL: https://arxiv.org/pdf/2609.02894.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.02894
Published: 2026-09-05T01:23:02.948Z
6. BharatGather: A Culturally-Informed Benchmark Dataset for Misinformation and Fake News Detection in Indian Public Events
Abstract:Large-scale public events, such as religious festivals, political rallies, and cultural gatherings, are increasingly vulnerable to the rapid dissemination of misinformation, posing substantial risks to public safety and social cohesion. While automated fake news detection has seen significant methodological progress, existing benchmarks frequently fail to capture the socio-cultural nuances and event-specific dynamics characteristic of the Indian context. This paper introduces BharatGather, a curated, multi-source dataset specifically engineered for binary misinformation classification within the ecosystem of Indian mass gatherings. The corpus comprises 14,646 records constructed through a hybrid pipeline involving systematic web scraping of prominent fact-checking platforms, multimedia transcript extraction, and Large Language Model (LLM)-mediated synthetic augmentation to ensure narrative diversity. By providing a resource tailored to the unique complexities of event-aware misinformation in India, this work facilitates the development of culturally informed detection systems and establishes a rigorous benchmark for evaluating their performance in high-stakes public environments.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.02895 (HTTP 429)
Authors: Parth Bramhecha, Smit Deshmukh, Sairaj Bodhale, Adwait Borate, Raviraj Joshi
Categories: cs.CL
PDF URL: https://arxiv.org/pdf/2609.02895.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.02895
Published: 2026-09-05T01:23:02.948Z
7. PiPMRE: A Pipeline Based on Language Model for Medical Relation Extraction
Abstract:Medical relation extraction (MRE) is commonly known for extracting entities and their relations jointly from a medical text, which has attracted considerable attention in recent years. Previous studies treat MRE as a sequence tagging task, which results in either a challenging design of the tagging schema or a failed extraction of multiple relations, due to intricate relationships among medical entities. In this work, we review the task from the linguistic perspective and propose a novel pipeline framework, PiPMRE, developed on language models to enhance MRE performance. Specifically, PiPMRE consists of a relation generator and a relation filter. Given a text, the generator first yields multiple relational triplets, and then the filter scores each triplet and retains only those that pass the borderline as the final results. Implementing PiPMRE requires no tagging schema; instead, we use a simple template to reformulate the input text, ensuring that entities and relations are generated in a contextual order. Extensive experimental results on two public datasets demonstrate the advancement of PiPMRE. It surpasses the previous state-of-the-art by an average of 5.6 recall points and 4.4 accuracy points. PiPMRE’s superiority is also demonstrated in few-shot settings.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.02896 (HTTP 429)
Authors: Jiaxin Duan, Fengyu Lu, Junfei Liu
Categories: cs.CL
PDF URL: https://arxiv.org/pdf/2609.02896.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.02896
Published: 2026-09-05T01:23:02.948Z
8. Margins, Not Windows: Training-Free Per-Step Lossy Speculative Decoding
Abstract:Speculative decoding accelerates LLM inference by drafting candidate tokens and verifying them in parallel. Tree-attention drafters such as EAGLE-3 are widely adopted, yet typically hold two decisions fixed: (1) a strict token-match verification rule and (2) a static draft-tree shape. Prior work relaxes each in isolation under limiting assumptions: long draft chains for training-free lossy verification, and adaptive tree shaping under a fixed token budget. We introduce AdaptiveSpec, a training-free per-step speculative decoding method that adapts both decisions from internal signals already produced during decoding. A per-step margin rule promotes a mismatched draft-proposed token when the ratio of the target’s probability on the drafted token to its top-1 probability exceeds a threshold with no dependence on draft length or underlying drafter architecture. A per-step tree policy adjusts the draft tree’s depth, width, and node count directly from a fused signal of draft top-1 confidence and a rolling acceptance history capturing recent draft-target agreement, allowing the total draft count to vary rather than only be redistributed. The two adaptations operate on orthogonal axes and compound in effect. Implemented on the SGLang production-grade serving engine, AdaptiveSpec improves throughput over the state-of-the-art autoregressive speculative decoding method EAGLE-3 by up to 56%, recovering 93% to fully lossless task accuracy across GSM8K, MATH-500, and HumanEval on three target models (DeepSeek-R1-Distill-Llama-8B, Llama-3.1-8B-Instruct, Qwen3-8B).
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
Q: 这篇论文试图解决什么问题? 这篇论文试图解决\*\*推测解码(Speculative Decoding)中两个关键决策固定不变所导致的效率瓶颈\*\*问题。具体而言,现有方法通常将以下两个方面固定: - \*\*严格的Token匹配验证规则\*\*:仅当草稿token与目标模型输出完全一致时才接受,丢弃了大量语义等价但表面不同的候选,导致接受率不必要地降低。 - \*\*静态的草稿树形状\*\*:草稿树的深度、宽度及节点总数在部署时固定,无法适应不同解码步骤的难易变化,造成计算资源分配僵化。 现有工作在放宽上述限制时存在明显局限: - \*\*验证器层面\*\*:训练无关的方法(如FLy)依赖前向查找窗口(lookahead window)判断语义等价性,其假设前提是草稿链足够长(15–25个token)。然而,对于广泛采用的树注意力草稿器(如EAGLE-3),平均接受长度通常不足3个token,导致FLy的窗口规则难以适用,加速效果微弱甚至低于静态基线。 - \*\*草稿树形状层面\*\*:自适应方法(如TALON)虽能动态调整树形,但仅在\*\*固定的全局token预算\*\*内重新分配节点数(深度与宽度),无法直接根据步骤难度收缩或扩展总草稿计算量。 为此,论文提出 \*\*AdaptiveSpec\*\*,一个无需额外训练、仅利用解码过程中已有内部信号的逐步骤自适应推测解码框架,通过两个正交的自适应轴解决上述问题: - \*\*基于边界的损失验证(Margin-based Lossy Verification)\*\*:在首个不匹配位置,利用目标模型对该草稿token的概率与其自身top-1概率之比(即 margin(j) = p_(target)(draft_j) / p_(target)(top1_j) )作为判据。若比值超过阈值 kappa 即接受该token,无需前向窗口、不依赖草稿长度,且适用于任意草稿器。 - \*\*动态草稿树塑形(Dynamic Draft Tree-Shaping)\*\*:通过草稿置信度分数(Draft Confidence Score, DCS)——融合草稿模型top-1概率与滚动接受率——直接调整控制树形的三个超参数(深度 n_(steps) 、分支数top-k、验证预算 n_(dt) )。该策略允许总节点数在不同步骤间\*\*真正变化\*\*,而非仅在固定预算内重新分配。 两个轴分别作用于解码的“草稿”与“验证”阶段,效果可叠加。实验表明,AdaptiveSpec在SGLang生产级推理引擎上,相比当前最优的自回归推测解码方法EAGLE-3,吞吐量平均提升18–44%(最高达56%),同时保持93%至完全无损的下游任务准确率。 Q2: 有哪些相关研究? 根据论文第2节内容,相关研究可分为以下三个类别: ### 1. 推测解码(Speculative Decoding)基础 - \*\*Leviathan et al., 2023; Chen et al., 2023\*\*:提出经典的 draft-then-verify 范式,利用轻量级草稿模型并行提议候选 token,由目标模型一次性验证,以突破自回归解码的串行瓶颈。 - \*\*树形草稿器(Tree-shaped Drafters)\*\*:后续工作将线性草稿链扩展为树形结构,以暴露更多候选续写路径,从而提高期望接受长度。代表性工作包括 \*\*Miao et al., 2024\*\*(SpecInfer)、\*\*Cai et al., 2024\*\*(Medusa)、\*\*Ankner et al., 2024\*\*(Hydra)、\*\*Du et al., 2024\*\*(GLIDE)与 \*\*Xiao et al., 2024\*\*(ParallelSpec)。 - \*\*EAGLE-3 (Li et al., 2025)\*\*:当前最先进的自回归树注意力草稿器,本文将其作为基线草稿器。其解码步骤交替执行:(i) \*\*Draft\*\*:草稿模型执行 n_(steps) 次前向传播,每层按 top-k 分支并剪枝至验证预算 n_(dt) ;(ii) \*\*Verify\*\*:目标模型按自身分布接受提议 token。三元组 (n_(steps), top-k, n_(dt)) 同时控制树形与每步计算量。 ### 2. 自适应草稿树(Adaptive Draft Trees) - \*\*EAGLE-2 (Li et al., 2024)\*\*:在固定大小的树预算内对填充 token 进行重排序,而非改变树的整体形状。 - \*\*OPT-Tree (Wang et al., 2025a)\*\*:每步重新求解树拓扑,以在固定节点预算下最大化期望接受长度。 - \*\*Sequoia (Chen et al., 2024)\*\*:针对特定草稿-目标模型对及硬件配置,离线通过动态规划优化树结构。 - \*\*TALON (Liu et al., 2026)\*\*:与本文动态树塑形轴最接近的工作。它基于置信度门控规则在线调整树形:在根节点固定 top-K 初始化后,仅保留那些草稿概率与层内最置信 token 之比高于阈值 μ 的候选,并在固定全局 token 预算 n_(dt) 内生长树。其局限在于仅能在总预算内重新分配深度与宽度,无法直接调整总草稿计算量。 ### 3. 有损验证(Lossy Verification) - \*\*Judge Decoding (Bachmann et al., 2025)\*\* 与 \*\*SemanticSpec (Dong et al., 2026)\*\*:引入外部验证模块(如 judge 分类器或语义探针)来判断不匹配 token 是否语义等价,从而放宽严格的精确匹配规则。主要局限是需额外训练,迁移性受限。 - \*\*FLy (Li et al., 2026)\*\*:训练无关的有损验证方法。它在不匹配位置设置熵门控,并检查后续 W 个 token(通常 W=6 )的前向窗口内是否出现进一步不匹配;若无,则认定该 token 语义等价。该方法基于 LLM 在 conditioned on 错误 token 时倾向于后续自我纠正的假设(即 "erroneous token pattern")。然而,其前向窗口机制对草稿链较短的草稿器(如 EAGLE-3,其平均接受长度常低于 3)结构性不兼容,因为窗口长度可能超过整段被接受的草稿前缀。 - \*\*其他相关\*\*:\*\*Sun et al., 2025; Garipov et al., 2025; Wang et al., 2025b\*\* 亦探讨了放宽接受准则以提升吞吐量的方法。 Q3: 论文如何解决这个问题? 论文通过提出 \*\*AdaptiveSpec\*\* 框架解决上述问题。该框架是一个\*\*无需训练(training-free)\*\*、\*\*逐步(per-step)自适应\*\*的推测解码系统,完全依赖解码循环内部已产生的信号驱动,从两个正交维度分别重新设计验证规则与草稿树构建策略,并通过复合效应叠加吞吐收益。 --- ### 1. 整体框架:双轴自适应 AdaptiveSpec 将 EAGLE-3 的单次解码步骤拆解为两个自适应轴: - \*\*验证轴(Verify Phase)\*\*:放宽严格的 token 精确匹配准则,允许在语义等价的不匹配位置接受草稿 token; - \*\*草稿轴(Draft Phase)\*\*:根据当前步骤的难度动态调整草稿树的三维超参数(深度、宽度、验证预算),使总草稿计算量能够真正伸缩,而非仅在固定预算内重新分配。 两轴作用于解码循环的不同子阶段,相互独立且增益可叠加。 --- ### 2. 验证轴:基于概率边界的损失验证(Margin-based Lossy Verification) 现有方法仅在草稿 token 与目标模型 top-1 输出完全一致时才接受。AdaptiveSpec 提出一种\*\*单位置、无窗、无训练\*\*的松弛规则: 在首个不匹配位置 j ,定义\*\*边界(margin)\*\*为目标模型对草稿 token 的归一化概率:
margin(j) = p(target)(draft_j)p(target)(top1_j) ∈ [0, 1]
当该比率满足 margin(j) ≥ kappa ( kappa 为可调阈值)时,直接接受该草稿 token,无需继续检查后续序列。其核心优势在于: - **与草稿长度脱钩**:不需要 FLy 式的前向查找窗口(lookahead window),因此适用于 EAGLE-3 这类平均接受长度较短(通常低于 3 个 token)的草稿器; - **与架构无关**:仅读取目标模型在验证阶段已计算的概率分布,无需外部分类器或语义探针; - **可调控**:通过阈值 kappa 在吞吐与准确率之间连续权衡。 —- ### 3. 草稿轴:动态草稿树塑形(Dynamic Draft Tree-Shaping) 固定树形无法适应不同解码步骤的不确定性差异。AdaptiveSpec 引入**草稿置信度分数(Draft Confidence Score, DCS)**直接驱动树形选择:
DCSt = p(draft)(top1t) · RAR_t
其中 p(draft)(top1t) 为草稿模型当前步的 top-1 softmax 概率, RAR_t 为滚动接受率(指数移动平均, α=0.3 ),反映近期草稿与目标模型的一致性。该分数经除数 d 缩放饱和至 $
0,1
区间后,通过线性插值直接选择树形三元组: - 高置信度( DCS to 1 ):选择深而窄的树,如 (n(steps), top-k, n(dt)) = (7, 1, 8) ,以最大化接受链长; - 低置信度( DCS to 0 ):选择浅而宽的树,如 (3, 4, 4) ,以覆盖更多候选分支。 关键设计要点: - 总计算量真正可变:候选范围 (3, 4, 4) arrow (7, 1, 8) 跨越不同的总节点数,因此系统在低置信度步骤上收缩草稿计算,而非仅在固定预算内重分配深度与宽度; - 断路机制:若连续五步接受量为零,则回退至默认配置,防止持续低效采样; - 生产兼容性:针对 SGLang 等依赖 CUDA Graph 的引擎,预先捕获所有可能树形对应的静态计算图,在运行时根据 DCS 即时切换,保持硬件加速效率。 —- ### 4. 整合:AdaptiveSpec 的协同效应 在每一步解码中,AdaptiveSpec 的执行流程如下: 1. 草稿阶段:依据 DCS_t 选择当前步的树形三元组 (n(steps), top-k, n_(dt)) ,构建对应草稿树; 2. 验证阶段:目标模型并行验证;在首个不匹配位置,利用 margin(j) 与阈值 kappa 决定是否松弛接受; 3. 提交与状态更新:接受前缀被提交, RAR_t 按实际接受比例滚动更新,供下一步 DCS 计算使用。 由于树塑形与边界验证分别作用于解码步骤的两个互不重叠的子阶段,二者的吞吐增益相互独立并产生复合效应。实验表明,相比静态 EAGLE-3 基线,动态树塑形单轴可带来显著加速,边界验证单轴可在极小精度损失下进一步提升接受长度,而双轴结合后实现最高 56% 的端到端吞吐提升。 Q4: 论文做了哪些实验? 论文在第4节进行了系统性的实验评估,涵盖主实验、消融分析、超参数搜索以及对现有方法局限性的诊断分析。具体实验内容如下: ### 1. 实验设置(§4.1) - 目标模型与草稿器:选用三个目标模型,均配备对应的 EAGLE-3 草稿模型: - Llama-3.1-8B-Instruct - DeepSeek-R1-Distill-Llama-8B - Qwen3-8B - 评估基准: - 数学推理:GSM8K、MATH-500 - 代码生成:HumanEval - 评价指标: - 吞吐量加速比(Speedup):相对于标准自回归解码 - 平均接受 token 长度(MAT, τ ) - 任务准确率恢复率(Rec.%):有损方法相对于无损 EAGLE-3 基线的准确率保留比例 - 基线方法: - EAGLE-3:静态无损推测解码(树形固定为 (3,1,4) ) - TALON:动态草稿树无损解码(在 SGLang 上重新实现) - FLy:基于前向窗口的有损解码(在 SGLang 上重新实现,针对 EAGLE-3 的平均接受长度将窗口调整为 w=3 ) - 环境配置:所有实验在单张 NVIDIA A100 上执行,batch size 为 1,使用贪婪解码(temperature = 0),基于 SGLang 推理引擎与 SpecForge 基准框架。 ### 2. 主实验对比(§4.2,表1) 在全部三个模型与三个基准的组合上,对比了六种配置: | 方法 | 说明 | |———|———| | EAGLE-3 | 静态无损基线 | | TALON | 动态树(固定预算重分配) | | AdaptiveSpec (Dynamic-only) | 仅启用动态树塑形 | | FLy | 基于前向窗口的有损验证 | | AdaptiveSpec (Lossy-only) | 仅启用边际规则有损验证 | | AdaptiveSpec (Combined) | 动态树 + 有损验证联合 | 关键发现: - AdaptiveSpec (Combined) 在全部 9 个(模型, 基准)单元格中均取得最高加速比,相比 EAGLE-3 提升 17%–56%。 - 平均来看,Combined 配置分别比 EAGLE-3 提升 +44%(Llama-3.1-8B)、+18%(Qwen3-8B)与 +38%(DeepSeek-R1-8B)。 - 任务准确率恢复率介于 91%–109% 之间,部分单元格(如 Llama-3.1-8B HumanEval)甚至超过无损基线。 ### 3. 消融实验(§4.3,表2) 采用 2×2 因子设计,系统分离两个自适应轴的独立贡献: | 草稿树 验证规则 | 严格(Strict) | 有损(Lossy) | |—————————|———————-|———————| | 静态(Static) | EAGLE-3 基线 | 静态树 + 边际规则 | | 动态(Dynamic) | 动态树 + 严格匹配 | AdaptiveSpec (Combined) | 结果: - 仅启用动态树塑形(Dynamic + Strict)即可将平均加速比从 1.82× 提升至 2.21× (+21.4%),且无精度损失。 - 仅启用有损验证(Static + Lossy)可将加速比提升至 2.20× (+20.9%),但伴随约 8% 的准确率成本。 - 两者联合(Dynamic + Lossy)达到 2.44× ,为所有配置中最高,且准确率恢复率提升至 98%。 ### 4. 超参数搜索(§4.3) #### (1) DCS 除数 d 搜索(表3) 在 AdaptiveSpec (Dynamic-only) 配置下,搜索 d ∈ 0.2, 0.3, 0.4, 0.5 。该参数控制 Draft Confidence Score 的饱和速度: - 较小的 d 使策略更快偏向深而窄的树形; - 较大的 d 使策略停留在浅而宽的树形。 实验表明 d=0.5 在绝大多数单元格中表现最优,故后续 Combined 实验固定此值。 #### (2) 边际阈值 kappa 搜索(表4) 分两组进行: - (a) Lossy-only:固定树形为 (7,1,8) ,搜索 kappa ∈ 0.05, 0.10, 0.20, 0.30 。 - (b) Combined:固定 d=0.5 ,在动态树范围 (3,4,4)arrow(7,1,8) 上搜索相同 kappa 集合。 搜索揭示了明确的吞吐-恢复权衡:较低的 kappa 提高吞吐量但降低准确率恢复,较高的 kappa 则相反。论文按各(模型, 基准)单元格的表现选取最优 kappa (详见附录表8)。 ### 5. FLy 验证器的结构限制诊断(§4.4,表5) 为论证所提边际规则取代 FLy 前向窗口的必要性,论文测量了静态 EAGLE-3 基线在各设置下的平均接受 token 长度 τ : | 模型 | GSM8K | MATH-500 | HumanEval | |———|———-|—————|—————-| | Llama-3.1-8B | 2.83 | 2.08 | 2.55 | | Qwen3-8B | 2.39 | 2.21 | 2.10 | | DeepSeek-R1-8B | 3.27 | 3.02 | 2.86 | 结果显示 τ 范围为 2.08–3.27,显著小于 FLy 原始设计的窗口长度 w=6 。该实验直接证明了 FLy 的前向窗口假设(要求窗口可容纳于典型接受前缀内)在 EAGLE-3 上结构性失效,从而支持 AdaptiveSpec 采用不依赖草稿长度的单位置边际规则。 Q5: 有什么可以进一步探索的点? 根据论文第6节“Future Work”与第7节“Limitations”,可进一步探索的方向包括: - 将推测解码范式扩展至非语言领域 自回归架构的顺序依赖瓶颈并非语言模型独有。在物理世界交互领域(如机器人学的视觉-语言-动作模型),推理延迟直接影响实时控制能力。AdaptiveSpec“根据每步难度动态调整草稿与验证”的核心思想,可作为基础向Token以外的动作单元(如机器人控制指令)延伸,以支持具身智能等低延迟场景。 - 结合检索式草稿器以优化智能体(Agentic)工作负载 智能体任务往往产生大量跨请求重复的序列。已有研究尝试以检索(如后缀树缓存)替代自回归草稿模型来生成候选Token(如SuffixDecoding)。未来可将AdaptiveSpec的每步自适应信号机制(DCS与边际规则)与检索式草稿源相结合,在保持动态树形与损失验证能力的同时,利用历史缓存进一步提升重复性Agentic任务的推理效率。 - 在更大批次(Multi-Batch)设置下验证方法有效性 论文当前仅在batch size = 1的条件下进行评估,该场景下延迟受内存带宽约束,每步推测的收益最为显著。未来需在更高批次的生产环境中评估AdaptiveSpec,以确认其在吞吐量与延迟权衡下的表现边界。 - 将自适应机制迁移至扩散型树草稿器(Diffusion-based Tree Drafters) 论文目前仅基于自回归草稿器EAGLE-3进行实现与验证。近期出现了基于扩散模型的树形草稿器(如DDTree)。AdaptiveSpec的动态树塑形原则与损失验证规则理论上可迁移至此类非自回归草稿器,但其实际兼容性与加速效果尚需实证研究。 - 探索具有形式化分布保持保证的有损验证 当前边际规则并不在理论上严格保持目标模型的输出分布(不同于原始无损推测解码的理论保证),其准确率保留仅通过下游任务经验评估。未来工作可致力于设计既能放宽精确匹配约束、又能在数学上保持(或以可控偏差逼近)目标分布的新型验证规则。 Q6: 总结一下论文的主要内容 这篇论文针对大型语言模型自回归解码的串行瓶颈,提出了一种名为 AdaptiveSpec 的无需训练、逐步自适应推测解码框架。以下是主要内容的系统总结: —- ### 1. 研究动机与问题 推测解码通过“草稿-验证”范式加速推理,但现有方法通常固定两个关键决策: - 严格的验证规则:仅接受与目标模型 top-1 输出完全一致的草稿 token, discard 了大量语义等价候选; - 静态的草稿树形状:深度、宽度及验证预算固定,无法适应不同解码步骤的难易差异。 现有工作在放松上述限制时存在结构性局限: - FLy 等训练无关的有损验证依赖前向查找窗口(lookahead window),假设草稿链足够长(15–25 tokens),这与 EAGLE-3 等广泛采用的树注意力草稿器不兼容(其平均接受长度常低于 3); - TALON 等动态树方法仅在固定全局 token 预算内重分配节点数,无法真正根据步骤难度收缩或扩展总草稿计算量。 —- ### 2. 核心方法:AdaptiveSpec AdaptiveSpec 在每一步解码中沿两个正交轴进行自适应,且仅利用解码循环内部已产生的概率信号,无需任何辅助训练。 #### (1)基于概率边界的损失验证(Margin-based Lossy Verification) 在验证阶段的首个不匹配位置 j$,定义目标模型对草稿 token 的归一化概率为:
margin(j) = p(target)(draft_j)p(target)(top1j) ∈ [0, 1]
当 margin(j) ≥ kappa ( kappa 为可调阈值)时,直接接受该不匹配的草稿 token。该规则: - 完全**无需前向查找窗口**,因而与草稿链长度和底层草稿器架构解耦; - 仅读取验证阶段已计算的目标概率分布,无需外部分类器或语义探针; - 通过 kappa 在吞吐量与准确率之间提供显式权衡。 #### (2)动态草稿树塑形(Dynamic Draft Tree-Shaping) 在草稿阶段,通过**草稿置信度分数(Draft Confidence Score, DCS)**直接选择树形三元组 (n(steps), top-k, n_(dt)) :
DCSt = p(draft)(top1t) · RAR_t
其中 p(draft)(top1_t) 为草稿模型当前步的 top-1 概率, RAR_t 为滚动接受率(指数移动平均, α=0.3 )。 DCS_t 经除数 d 缩放后,在浅宽树 (3, 4, 4) 与深窄树 (7, 1, 8) 之间线性插值: - 高置信度步骤分配深而窄的树,以最大化接受链长; - 低置信度步骤分配浅而宽的树,以覆盖更多候选分支。 由于候选范围跨越不同的总节点数,该策略能在弱草稿步骤上**真正收缩**草稿计算,而非仅在固定预算内重分配深度与宽度。为保障生产级引擎(如 SGLang)的 CUDA Graph 加速,系统预先捕获所有候选树形的静态计算图并在运行时按需切换。 —- ### 3. 实验与结果 论文在 SGLang 生产级引擎上,基于三个目标模型(Llama-3.1-8B-Instruct、DeepSeek-R1-Distill-Llama-8B、Qwen3-8B)及其 EAGLE-3 草稿器,在 GSM8K、MATH-500 和 HumanEval 上进行了评估。 - **主实验**:AdaptiveSpec(Combined)在全部 9 个(模型, 基准)设置中均取得最高吞吐量,相比静态 EAGLE-3 基线平均提升 **18%–44%**,最高达 **56%**;任务准确率恢复率在 **93% 至完全无损**之间,部分单元格甚至超过 100%。 - **消融实验**( 2×2 因子设计): - 仅动态树塑形即可将平均加速比从 1.82× 提升至 2.21× (+21.4%),且无精度损失; - 仅边际规则有损验证可将加速比提升至 2.20× (+20.9%); - **两者联合达到 2.44× **,证实双轴增益可叠加。 - **超参数搜索**:DCS 除数 d=0.5 在绝大多数设置中最优;边际阈值 kappa 的搜索显示了明确的吞吐-恢复权衡。 - **诊断分析**:通过测量 EAGLE-3 的平均接受长度(2.08–3.27),论文证明了 FLy 的前向窗口假设在此类草稿器上结构性失效,从而支撑了所提无窗验证规则的必要性。 —- ### 4. 局限与未来方向 - **理论保证**:边际规则不严格保持目标模型的输出分布(与原始无损推测解码不同),准确率保留仅为经验性结果; - **批次规模**:当前实验仅在 batch size = 1 下验证,多批次场景下的表现有待探索; - **草稿器类型**:目前仅基于 EAGLE-3 自回归草稿器实现,尚未在扩散型树草稿器(如 DDTree)上验证; - **跨领域扩展**:将“按步难度自适应”的思想扩展至非语言领域(如机器人视觉-语言-动作模型)以及结合检索式草稿器(如 SuffixDecoding)以优化智能体重复性工作负载,是潜在的未来方向。 Q7: 想要进一步了解论文 以上只是了解一篇论文的几个基本FAQ。如果你还想与Kimi进一步讨论该论文,请点击 这里 为你跳转Kimi AI网页版,并启动一个与该论文相关的新会话。
Authors: Oszkár Urbán, Young D. Kwon, Stylianos I. Venieris, Cecilia Mascolo
Categories: cs.CL
PDF URL: https://arxiv.org/pdf/2609.02897.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.02897
Published: 2026-09-05T01:23:02.948Z
9. Distilled Rapid Embedding Transfer (DRET): Parameter-Efficient Biomedical Domain Adaptation via Priority-Based Embedding Transfer
Abstract:Large domain-specific language models such as BioBERT and ClinicalBERT achieve strong performance on biomedical NLP tasks, but their computational demands make them impractical for many real-world deployments. General-purpose, parameter-efficient models such as DistilBERT are lightweight yet lack the domain knowledge required for specialized tasks such as PICO (Population, Intervention, Comparison, Outcome) classification. We introduce Distilled Rapid Embedding Transfer (DRET), a knowledge-transfer paradigm that injects biomedical domain knowledge from large specialized models into a smaller general-purpose model without retraining on the original specialized corpora. DRET is developed as an iterative family of strategies: a unified tokenizer-merge strategy (DRET 1.x), hybrid embedding averaging (DRET 2.0), and a priority-based embedding-transfer mechanism (DRET 3.x) that hierarchically selects embeddings from the most authoritative source models, further combined with embedding-layer freezing, differential learning rates, label propagation, and imbalance-aware loss functions (DRET 4.x). We evaluate DRET on token-level PICO classification using the EBM-NLP corpus under severe class imbalance, across a twelve-metric battery. DRET-enhanced DistilBERT (66M parameters) attains balanced accuracy, recall, and ROC-AUC competitive with, and on several class-wise metrics exceeding, models an order of magnitude larger, while retaining DistilBERT’s efficiency. We further show that transfer occurs at the embedding level through cosine-similarity, semantic-shift, and t-SNE analyses. DRET offers a scalable, resource-efficient route to near-domain-expert performance for biomedical text mining, with direct application to automated systematic literature reviews and clinical decision support.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.02898 (HTTP 429)
Authors: Girish Sundaram, Daniel Berleant
Categories: cs.CL
PDF URL: https://arxiv.org/pdf/2609.02898.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.02898
Published: 2026-09-05T01:23:02.948Z
10. Contamination Inflates Scores but Rarely Reorders Large Language Model Leaderboards
Abstract:Benchmark contamination, the leakage of test items into training data, is widely described as a threat to the reliability of large language model (LLM) leaderboards. We argue that this concern conflates two distinct questions: whether contamination inflates absolute scores, and whether it reorders the ranking of models. We recast contamination as a violation of anchor-item invariance and measure it through the differential functioning of original versus semantically equivalent paraphrased items, a within-item contrast that holds the measured skill fixed and isolates memorization from capability. Using per-instance responses from 47 publicly released models and 74 models finetuned with a known dose of contamination, across four benchmarks (ARC, GSM8K, HellaSwag, MMLU), we first calibrate the measure against ground truth: it recovers injected contamination dose-responsively (a corrected effect of +0.187 accuracy points for test-set leakage) and never flags a negative-control model trained only on the legitimate training split (-0.012). We then quantify leaderboard impact: the rank correlation between a standard leaderboard and a paraphrase-controlled leaderboard is 0.997, and a sensitivity analysis shows that the observed differential contamination is far below the level needed to move rankings, with only 3 of 188 model-by-benchmark cases showing differential contamination corroborated across two references. Contamination among these public models is therefore largely uniform: it inflates absolute scores without reordering the leaderboard, and ranking distortion requires the rare case of differential contamination. We provide a calibrated invariance audit, released as a reference implementation, and recommend that leaderboards report paraphrase-controlled rankings alongside confidence intervals.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.02899 (HTTP 429)
Authors: Xingyao Xiao, Yihong Cheng
Categories: cs.CL
PDF URL: https://arxiv.org/pdf/2609.02899.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.02899
Published: 2026-09-05T01:23:02.948Z
Agent Domain Papers
1. Structure and Implementation of New Practical English Textbooks Driven by Artificial Intelligence
Abstract:Artificial intelligence is changing the form of applied English materials from fixed paper sequences to adaptive learning systems that can diagnose learners, recommend tasks, and provide formative feedback. This paper studies the structure and application of a new practical English textbook driven by artificial intelligence. A five-layer architecture is proposed: knowledge mapping, learner profiling, task generation, feedback orchestration, and teacher-side governance. A prototype was tested on 186 non-English-major undergraduates for eight weeks of teaching. Compared with a static digital textbook, the proposed system increased the unit completion accuracy from 72.4% to 84.9%, raised the average score for speaking tasks by 10.8 points, and reduced the teacher’s correction time by 31.6%. Therefore, an AI-driven textbook can maintain the stability of the curriculum while providing personalised learning paths, rich practice materials and traceable classroom data.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.02981 (HTTP 429)
Authors: Ya Wang, Lei Zhang, Xueguang Yang, Bo Chen
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.02981.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.02981
Published: 2026-09-05T01:23:16.709Z
2. MasterControl Seventeen Every Time
Abstract:We study a governed approach to enterprise analytics: a language model interprets the question, while deterministic policy selects and runs a pre-approved analytical program that returns both results and evidence. We show that this restriction can remain expressive within a defined analytical class, using relational operations plus aggregation, comparison, windows, ranking, and similarity. Fixed meaning, policy, data, and execution rules also make results replayable. Across 440 runs, three 8B models generated SQL and selected tools at runtime, while Qwen3-8B interpreted intent only and policy executed the approved program. None of 330 runtime-planning episodes matched the full answer-and-evidence contract across all test datasets; the policy-executed analyzer matched 110 of 110. This is a configuration-specific result, not evidence that runtime agents cannot succeed under other designs.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03209 (HTTP 429)
Authors: MasterControl AI Lab
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03209.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03209
Published: 2026-09-05T01:23:16.709Z
3. Speculative Macro Commit for Faster Tool-Using Agents
Abstract:Tool-using LLM agents spend wall-clock time not only on model inference but also in serial action—observation turns, where each tool call, environment transition, and observation can delay subsequent decisions. We introduce \textbf{Speculative Macro Commit} (SMC), a runtime mechanism for a two-tier agent system: a large authoritative actor model produces the official trajectory, while a faster speculative drafter model continuously predicts and executes future action chains on an isolated environment snapshot. SMC mines recurring multi-action skeletons from training traces and stores them in a macro library used to match against action chains predicted by the drafter at runtime. When the actor’s next tool call matches the first drafted action, SMC commits the remaining pre-executed draft steps, together with their observations, to the official trajectory. Using Qwen3.5-27B INT4 as the authoritative actor model and Qwen3.5-4B as the speculative drafter model, SMC matches the sequential agent’s overall accuracy while reducing latency by 10.23\% over the Speculative Actions (SA) baseline and 18.59\% over sequential execution on the $\tau^2$-Bench Telecom subset. On AppWorld, SMC reduces wall time by 7.7\% over SA baseline and 44.9\% over sequential execution, with a small reduction in task completion. Overall, SMC provides a practical way to reuse multi-step speculative execution and reduce agent latency beyond single-step speculative actions. Our code is publicly available \href{this https URL}{\textcolor{magenta}{here}}.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03236 (HTTP 429)
Authors: Zeyu Liu, Souvik Kundu, Peter A. Beerel
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03236.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03236
Published: 2026-09-05T01:23:16.709Z
4. Fresh Memory, Stale Plans: Dependency-Scoped Validation for Distributed LLM-Agent Memory
Abstract:Distributed LLM-agent teams can read the latest shared facts and still act on an obsolete plan. A planner may derive an action from requirement $r_3$, another agent may commit $r_4$, and an executor may receive $r_4$ without replacing the plan derived from $r_3$. We call this \emph{stale-plan execution}: state freshness does not establish that the plan authorizing an action remains valid. We introduce PlanFence, a dependency-scoped action-validation protocol. Plans cite the exact public records they used, and an executor validates only the records that can affect the pending external action, replanning once or blocking when validation is incomplete. In 30 controlled live workflows with a post-plan revision, a freshness-only executor acts on the obsolete plan in every task, whereas PlanFence completes all tasks without an invalid action. Controlled replay reveals two conditional boundaries: proactive synchronization yields lower coordination stall at low churn, while PlanFence avoids repeated update-path coordination as churn grows and avoids validating unrelated state as the shared keyspace grows. These are controlled safety and systems-cost results, not general task-accuracy gains.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
Q: 这篇论文试图解决什么问题? 这篇论文针对分布式大语言模型(LLM)智能体系统中的 \*\*stale-plan execution(过时计划执行)\*\* 问题,提出了一种依赖范围限定的动作验证机制。具体而言,论文试图解决的核心问题可归纳如下: --- ### 1. 核心问题:状态新鲜度与计划有效性之间的脱节 在分布式多智能体环境中,公共任务状态通常被复制到各智能体的本地内存中。即使执行者(executor)读取到了最新的共享事实(例如一条已被修订的需求 r_4 ),它仍可能依据一个基于旧版本(例如 r_3 )生成的过时计划 p(r_3) 去调用外部工具。论文将此类故障定义为 \*\*stale-plan execution\*\*: - 规划者(planner)基于需求 r_3 推导出计划 p(r_3) ; - 在计划执行前,另一智能体提交了修订版本 r_4 ; - 执行者虽通过背景传播收到了 r_4 ,但并未替换本地缓存的计划 p(r_3) ; - 结果,执行者使用源自旧需求的参数调用外部工具(例如预订已取消的订单、部署已废弃的构建版本)。 关键洞察在于:\*\*执行者本地状态的“新鲜”并不足以保证待执行计划的授权仍然有效\*\*。即
Fresh local state nRightarrow Valid plan lineage.
—- ### 2. 形式化目标:血统有效性(Lineage Validity) 论文将安全不变量形式化为 **lineage validity**。对于受保护的外部动作 a ,设: - L(a) 为授权该动作的计划根节点; - D(a) ⊂eq X 为工具包装器声明的、可能影响该动作的公共键集合; - F_a(x) 为计划实际使用的、键 x 的记录版本; - H(x) 为键 x 的当前所有者授权版本(head)。 则动作 a 在验证点有效的充要条件为:
Valid(a) iff Fa(x) = H(x),quad ∀ x ∈ D(a).
论文指出,若无精确的父级链接(exact parent IDs)和动作时的依赖验证,执行者无法仅凭本地副本判断待执行计划是否仍被当前公共记录授权。 —- ### 3. 系统层面的权衡问题 在识别上述安全缺口后,论文进一步探讨了实现该不变量时的系统代价权衡,对应三个研究问题: - **RQ1**:智能体是否可能在读取最新状态后,仍执行过时计划? ——答案是肯定的,仅靠状态新鲜度无法防止。 - **RQ2**:当公共状态频繁变更时,是在每次更新时主动同步(proactive synchronization)代价更低,还是在动作即将执行前按需验证代价更低? ——论文发现低变更率下主动同步的协调阻塞更低,高变更率下动作时验证更优。 - **RQ3**:当共享状态空间增长时,仅检查动作相关的依赖集 D(a) 是否比检查全部共享键 X 更能降低协调成本? ——依赖范围限定能避免序列化无关状态,在稀疏依赖场景下显著降低延迟与流量。 —- ### 4. 提出的解决方案:PLANFENCE 为在动作边界上建立血统有效性,论文设计了 **PLANFENCE** 协议: - **精确衍生记录**:每个计划引用其生成时所使用的精确公共记录版本(不可变记录 ID); - **依赖声明**:工具包装器显式声明 D(a) ,即哪些公共键可能影响该动作; - **动作边界门控**:执行者在调用外部工具前,仅针对 D(a) 中的键向权威所有者查询当前 head H(x) ,并与计划中的依赖前沿 F_a(x) 比对; - **一次重规划后失败闭合**:若发现不匹配,允许拉取最新记录并执行一次重规划;若再次不匹配或验证不完整,则阻塞动作(fail closed)。 综上,该论文旨在解决分布式 LLM 智能体内存中 **“读了最新事实,却执行了过时计划”** 的安全漏洞,并在确保血统有效性的同时,探索依赖范围限定验证相对于全局同步和全键验证的系统代价边界。 Q2: 有哪些相关研究? 论文在第2节“Related Work”中系统梳理了相关研究,并将其归纳为三大领域。以下按研究脉络分类概述: —- ### 1. 数据来源与乐观并发控制(Provenance and Validation) 该领域关注如何记录衍生对象的输入来源,并在操作提交前验证读集合是否仍然有效。 - **数据溯源(Data Provenance)**:Buneman、Khanna 与 Wang-Chiew(2001)提出了数据来源的特征化方法,用于记录哪些输入产生了一个衍生对象。 - **乐观并发控制(Optimistic Concurrency Control)**:Kung 与 Robinson(1981)提出在事务提交前验证其读集合是否仍保持当前状态。 **与 PLANFENCE 的区别**:上述工作针对的是数据库事务提交的边界。PLANFENCE 将同样的底层思想应用于**智能体工具边界**——LLM 生成的计划可能跨角色调用、副本和状态刷新长期存在,除非运行时记录精确的父级版本,否则执行者在动作边界将没有读集合可供验证。 —- ### 2. 分布式一致性与内存模型(Distributed Consistency) 该领域提供了多种暴露当前副本状态的方式,或在一致性与延迟之间做应用级权衡。 - **强一致性、主动复制与 CRDTs**:包括 CAP 定理的形式化(Gilbert & Lynch, 2002)、现代分布式数据库中的一致性权衡(Abadi, 2012)、消息传递系统中的健壮共享内存(Attiya et al., 1995)、流行病式复制算法(Demers et al., 1987),以及无冲突复制数据类型(Shapiro et al., 2011)。 - **一致性分级与云存储 SLA**:Kraska 等(2009)提出一致性配给;Li 等(2012)提出“必要时一致”;Terry 等(2013)提出基于一致性的服务等级协议;Bailis 等(2012)提出概率有界陈旧性。 **与 PLANFENCE 的区别**:PLANFENCE 并未引入新的一致性模型,而是**指定了哪些记录版本必须授权待执行动作**;它可以建立在主动传播或动作时所有者查询之上,但不依赖于某一种特定的副本一致性机制。 —- ### 3. LLM 多智能体协作与记忆(LLM-Agent Coordination and Memory) 该领域涵盖智能体角色协作结构、记忆检索与共享、以及持久世界中的可执行制品。 #### 3.1 多智能体协作框架 - **角色化多智能体系统**:AutoGen(Wu et al., 2023)、MetaGPT(Hong et al., 2024)、CAMEL(Li et al., 2023)、ChatDev(Qian et al., 2024)等框架将任务划分为不同角色并在独立进程或设备上运行。 - **交互优化与架构搜索**:包括通过多智能体辩论提升事实性(Du et al., 2024)、将语言智能体视为可优化图的 GPTSwarm(Zhuge et al., 2024)、经济型通信管道(Zhang et al., ICLR 2025)以及多智能体架构搜索(Zhang et al., ICML 2025)。 - **交互协议**:Anthropic 的模型上下文协议 MCP(2024)与 Google 的 Agent2Agent(A2A)协议(2025)提供了工具与智能体交互的标准接口。 #### 3.2 智能体记忆系统 - **记忆管理**:MemGPT(Packer et al., 2023)将 LLM 视为操作系统管理记忆;A-MEM(Xu et al., 2025)提出智能体记忆;Mem0(Chhikara et al., 2025)关注可扩展长期记忆;Reflexion(Shinn et al., 2023)利用语言反馈进行强化学习;Voyager(Wang et al., 2023)关注开放式具身智能体。 - **共享与架构视角**:Yu 等(2026)从计算机体系结构视角审视多智能体记忆;Rezazadeh 等(2025)研究多用户动态访问控制下的记忆共享;Wang 与 Chen(2025)提出 MIRIX 多智能体记忆系统。 #### 3.3 持久世界与智能体生成制品 - **SwarmWorld**(Pal et al., 2026):研究了语言模型智能体社会中的持久世界,记录内容寻址的父子程序血统,允许后续智能体继承和修改持久程序,并在共享世界持续演化的同时提交模型生成的计划。 **与 PLANFENCE 的区别**:现有工作主要关注“智能体应通信、检索或保留什么内容”,或支持程序继承与归属的技术血统。PLANFENCE 则利用**精确的衍生血统(exact derivation lineage)**来确定:一个待执行动作是否仍被其**动作相关的公共输入**的当前版本所授权。这是一种面向动作边界的、依赖范围限定的验证机制,而非全局内存 freshness 或持久制品的演化机制。 Q3: 论文如何解决这个问题? 论文通过 **PLANFENCE**(Dependency-Scoped Action-Validation Protocol)解决 stale-plan execution 问题。其核心思路是将**安全不变量**(动作的血统必须有效)与**建立该不变量的系统机制**(何时、以何种范围进行检查)分离,并在**外部动作边界**实施依赖范围限定的验证。具体解决路径可分为以下层面: —- ### 1. 精确衍生记录:绑定计划与不可变输入版本 PLANFENCE 要求每个公共记录都是不可变的,并通过**语义键**(semantic key) x ∈ X 标识逻辑项,通过**不可变记录 ID** 标识具体版本。任何衍生记录(包括智能体生成的计划)在写入时必须附加**精确的父级 ID**(exact parent IDs),记录它是从哪些确切版本的公共输入推导而来。 - 若计划 p 由需求 r_3 推导,则 p 必须显式引用 r_3 的记录 ID(如 id_3 ),而非仅引用语义键 x(req) 。 - 这意味着,即使后续修订版 r_4 已提交,计划 p 携带的仍是 id_3 的血统证据;执行者不会仅因本地已安装 r_4 就误以为 p 仍然有效。 —- ### 2. 动作依赖声明:限定验证范围 PLANFENCE 不要求在每次状态更新时验证全部共享状态,也不要求执行前检查整个键空间。相反,它要求**工具包装器**(tool wrapper)在应用代码层面显式声明一个依赖集合:
D(a) ⊂eq X
表示哪些公共键的值可能影响该受保护动作 a 。例如,一次预订动作可能只依赖于需求键和可用性键,而与无关的目录记录或其他工作流状态无关。 —- ### 3. 血统有效性的形式化条件 在动作执行前的验证点,PLANFENCE 检查**血统有效性**(lineage validity)。设: - L(a) 为授权动作 a 的计划根节点; - F_a(x) 为从 L(a) 沿精确父级链追溯到的、键 x 的记录版本(依赖前沿); - H(x) 为键 x 的权威所有者 o(x) 当前授权的版本(head)。 则动作 a 有效的充要条件为:
Valid(a) iff F_a(x) = H(x),quad ∀ x ∈ D(a).
该条件直接回答 RQ1:执行者读取最新状态 local_head=H(x) 并不足够;必须验证计划实际使用的版本 F_a(x) 是否与 H(x) 一致。 —- ### 4. 动作边界门控:Algorithm 1 的执行流程 PLANFENCE 在执行外部调用前运行**依赖范围限定的验证门控**,其算法流程如下: 1. **血统遍历**:从计划根 L(a) 出发,沿本地精确父级链遍历,直至到达 D(a) 中各语义键的边界。若任何父级链不完整、依赖边界缺失或所有者映射缺失,则**阻塞**(blocked)。 2. **并发查询所有者**:对 D(a) 中的每个键 x ,并发向其所有者 o(x) 查询当前授权版本 H(x) 。若响应不可用、损坏、冲突或键不匹配,则**阻塞**。 3. **增量内容获取**:仅对那些 H(x) ≠ F(x) 的键,获取并验证其最新记录内容;其余键仅比对元数据(记录 ID)。 4. **比对与决策**: - 若 F = H 且计划根确实衍生自这些前沿版本,则**授权**(authorized)。 - 若发现不匹配: - 若这是首次检测到变更(`replanned = false`),则允许**一次重规划**(replan-required):执行者拉取最新记录,用相同的角色和隔离上下文重新生成计划,然后带着新计划再次进入门控。 - 若已重规划过一次仍不匹配,或任何依赖再次变更,则**失败闭合**(blocked),禁止动作执行。 此机制确保: - 不会无限重试(最多一次 replan); - 任何验证不完整的情况均导向阻塞,而非放行。 —- ### 5. 协调成本的优化策略 PLANFENCE 通过**按需验证**与**依赖范围限定**降低系统协调成本,具体体现为: - **动作时验证 vs. 每次更新同步**:不强制在每次公共状态变更时同步所有副本(metadata sync),而是在动作即将执行时才支付验证成本。论文实验表明,当更新率 rho 较低时主动同步更优,但当 rho ≥ 4 时,PLANFENCE 的阻塞时间显著低于安全基线(图3、图4)。 - **依赖范围限定 vs. 全键验证**:不检查整个共享键空间 |X| ,仅检查 |D(a)| 个动作相关键。实验显示,当共享键从 8 增长到 128 时,PLANFENCE 的流量保持在约 8.1,KiB/action ,而批量全键验证从 16.4 增长至 81.7,KiB/action ;延迟亦显著降低(图5、表8)。 —- ### 6. 可信边界与失败闭合 PLANFENCE 的安全保证依赖于以下系统设计: - **可信计算基**:工具包装器对 D(a) 的声明必须完整;若无法静态确定,则需保守地声明更广集合。 - **良性所有者**:所有者 o(x) 必须如实返回其当前授权版本 H(x) 。 - **不可变性与认证**:公共记录不可变,传输经认证,父级链接不可篡改。 - **失败闭合**:任何父级链缺失、所有者无响应、依赖声明不完整或重规划后再次变更,均导致动作被阻塞,而非基于不完整证据执行。 综上,PLANFENCE 通过**在动作边界精确比对“计划实际使用的输入版本”与“所有者当前授权的输入版本”**,并**仅针对动作相关的依赖子集**进行该验证,解决了分布式 LLM 智能体中“读了最新事实,却执行了过时计划”的 stale-plan execution 问题。 Q4: 论文做了哪些实验? 论文的实验设计围绕三个研究问题(RQ1–RQ3)展开,结合**实时五智能体工作流**与**受控重放(controlled replay)**两种模式,辅以传输微基准测试和大量的消融实验。以下分层次梳理: —- ### 1. 实验总体设计与设置 **环境与负载** - **实时系统**:五个独立的 Qwen3.5 智能体进程,运行在预订(reservation)、履行(fulfillment)和部署(deployment)三类工作流上,每类 10 个随机种子,共 30 组任务。 - **受控重放**:固定 30 个工作流模板,通过替换模型重规划为预录制的公共决策,使不同内存策略在**相同的决策序列、更新时序和网络条件**下执行,从而将无效动作、等待时间和流量归因于策略本身而非模型输出差异。 - **网络条件**:Loopback,以及基于历史 AT&T、T-Mobile、Verizon LTE 链路的固定回放迹线(含丢包、延迟)。 - **默认参数**: N=5 个智能体, |X|=8 个共享语义键,每个动作依赖 d=1 个键, H=64 个工作单元,名义更新目标 rho ∈ 0.25, 1, 4, 16 。 **基线方法** - **不安全策略**:Local replica(直接执行本地状态)、Owner-head freshness(读取当前依赖但无血统绑定)、Metadata sync(延迟同步, K>1 )。 - **安全策略**:Centralized lineage(集中式血统服务)、Metadata sync( K=1 ,每更新即同步)、Per-key / Batched all-key validation(全键验证)、Majority-replica / All-replica validation(副本表决)、PLANFENCE。 **核心指标** - **安全性**:无效发出动作数(计划未到达当前声明输入的动作)。 - **可用性**:可用/已完成动作数。 - **协调阻塞(Coordination stall)**:等待同步或验证的时间(ms/action)。 - **分布式流量(Traffic)**:副本间及中央服务的字节数(KiB/action)。 —- ### 2. 针对三个研究问题的核心实验 #### RQ1:智能体读取最新状态后是否仍会执行过时计划? - **Table 1(受控重放,高更新负载 rho=4 )**:在 330 次调度的动作中,Local replica 和 Owner-head freshness 均发出 330/330 次无效动作;而所有强制精确血统绑定的安全策略(包括 PLANFENCE)无效动作为 0/330。 - **Table 2(实时五智能体工作流)**:在 30 个交互式任务中,Owner-head freshness 在每次任务中都发出了过时的主要动作,任务成功率为 0/30;Centralized lineage 和 PLANFENCE 均检测到变更,触发一次重规划,30/30 任务完成且无无效主要动作。 - **Appendix A.6**:对齐的策略审计覆盖 32,700 次调度动作,任何强制精确血统的方法均未出现无效动作;所有 4,143 次无效动作均来自陈旧或延迟同步的控制组。 #### RQ2:状态频繁变更时,每次更新同步与动作前验证哪个阻塞更低? - **Figure 3(跨网络与更新率的策略边界图)**:在 loopback 和三条蜂窝迹线上,比较 PLANFENCE 与 Metadata sync( K=1 )/Centralized lineage 的阻塞。低变更率( rho ≤ 1 )下,主动同步的阻塞更低;高变更率( rho ≥ 4 )下,PLANFENCE 的阻塞更低,领先优势为 1.5× 至 7.1× 。 - **Figure 4(AT&T 迹线上的同步节奏权衡)**:展示 Metadata sync 在不同 K (同步屏障间隔)下的安全-成本曲线。 K=1 时最安全但阻塞高;增大 K 降低阻塞但以牺牲安全为代价(出现无效动作);PLANFENCE 在 rho=4,16 时以零无效动作取得更低的阻塞。 - **Table 4(同步节奏消融)**:在 rho ∈ 0.25,1,4,16 下系统性地展示 K=1,2,4,8,16 的安全与成本。随着 K 增大,阻塞下降,但无效动作增加;PLANFENCE 在所有 rho 下保持 0 无效动作,且在 rho ≥ 4 时阻塞显著低于 K=1 。 - **Table 5(团队规模敏感性)**: N ∈ 3,5,8 ,高更新率下 PLANFENCE 的阻塞和流量均低于 Centralized lineage 和 Metadata sync( K=1 )。 - **Table 7(剧集长度敏感性)**: H ∈ 16,64,256 ,高更新率下的策略排序保持稳定。 #### RQ3:共享状态增长时,仅检查动作相关依赖是否比检查全部键更优? - **Table 1(八键紧凑状态)**:PLANFENCE 的阻塞为 230.8 ms/action、流量 8.1 KiB/action;Centralized lineage 为 508.6 ms/15.6 KiB;Metadata sync( K=1 )为 403.4 ms/23.5 KiB。 - **Figure 5(键空间 8–128 的比较)**:在 loopback 和 AT&T 迹线上对比 PLANFENCE 与 Batched all-key validation(同样允许一次重规划、两次验证)。随着共享键从 8 增至 128: - Loopback 阻塞:PLANFENCE 从 67.8 ms 降至 66.0 ms(基本持平),Batched all-key 从 115.5 ms 升至 199.2 ms。 - AT&T 阻塞:PLANFENCE 从 295.3 ms 升至 345.2 ms;Batched all-key 从 365.7 ms 升至 428.7 ms。 - 流量:PLANFENCE 恒定在约 8.1 KiB/action;Batched all-key 从 16.4 KiB 线性增长至 81.7 KiB/action。 - **Table 6(依赖集大小敏感性)**:固定 |X|=8 ,变化 d ∈ 1,2,8 。当 d=1 时 PLANFENCE 阻塞低 14.9%、流量低 50.6%;当 d=2 时阻塞接近打平、流量仍低 32.0%;当 d=8=|X| 时两者阻塞与流量均趋于一致(依赖范围限定失效的边界)。 - **Table 8 与 Table 9(完整键空间与独立迹线相位)**:覆盖 loopback(30 模板聚合)与 AT&T(三个独立迹线偏移 0/5/15 秒),共 13,200 次调度动作,PLANFENCE 与 Batched all-key 均完成全部有效动作,但 PLANFENCE 在几乎在所有子集中阻塞和流量更低。 —- ### 3. 附录中的补充实验 **B. 受控重放消融实验** - **学习策略选择(Table 10)**:训练神经网络(决策树、MLP、DeBERTa)在集中式 lineage、Metadata sync( K=1 )和 PLANFENCE 之间做策略选择。在分布内(ID)样本上学习器可达 95–96.7% 的安全近优选择,但在四个分布外(OOD)偏移块(Verizon 迹线、插值更新率、端点键数、复合偏移)中,没有学习器能在推理成本计入后全面超越简单的透明规则( rho ≤ 1 选同步,否则选 PLANFENCE)。 **C. 验证假设与组件敏感性** - **血统证明深度(Table 11)**:验证必须跟随**完整的传递闭包**。仅检查直接父级在链深 ell=1 时可行,但在 ell ≥ 2 时会导致错误放行;缺失中间记录时必须阻塞。 - **重规划机制(Table 11)**:仅验证不重规划会导致 3,000 次检测到的竞争全部阻塞;验证+一次重规划将其全部转为有效动作。 - **无血统/任意副本头(Table 11)**:读取新鲜需求但不检查计划血统,或信任任意副本的头,在每次竞争中都会发出无效动作。 - **依赖契约完整性(Figure 6)**:在 30 模板×100 竞争种子上,随真实依赖被遗漏的概率增加,无效动作率上升(遗漏 50% 时达 37.4%);过度声明依赖虽保持安全,但会增加所有者头检查次数。 - **失败闭合(Fail-closed)验证**:在所有者中断、血统缺失、畸形头、第二次版本变更四种情况下,失败闭合策略全部阻塞且无无效动作;对应的失败开放(fail-open)策略在四种情况下全部发出无效动作。 —- ### 4. 传输微基准测试 - **Figure 2**:测量单次认证 TCP 同步的阻塞时间随公共状态大小(2 KiB 至 8 MiB)和丢包率(0–10%)的变化。该实验说明单次同步在有利路径上开销低,但随着内容增长或链路恶化会显著增加,从而为“每次更新同步”的代价提供微观依据。 Q5: 有什么可以进一步探索的点? 基于论文的局限性陈述与系统设计边界,以下方向值得进一步探索: —- ### 1. 拜占庭与半诚实所有者环境下的安全验证 论文假设所有者是**良性**(benign)且诚实的。后续工作可探索: - 当所有者可能返回错误、过时或冲突的 H(x) 时,如何建立**拜占庭容错**的血统验证?例如,通过跨多个副本的密码学承诺或阈值签名来确认公共记录头的权威性,而非信任单一所有者。 - 在**所有者迁移**(owner migration)场景下,如何保持依赖链的可验证性与连续性,避免验证因所有权变更而中断。 —- ### 2. 自动化依赖声明推断 当前 PLANFENCE 要求工具包装器显式声明 D(a) ,且 Figure 6 表明遗漏真实依赖会直接破坏安全。可探索: - **静态或动态程序分析**:从工具包装器代码中自动提取其读取的公共键集合,生成 D(a) ,降低人工声明负担。 - **学习式依赖推断**:基于历史动作轨迹与输入输出关联,学习预测动作实际依赖的语义键子集,并在安全关键场景下保守地过度声明(over-declare)以确保不遗漏。 —- ### 3. 私有推理与公共血统的桥接 论文明确将私有提示(private prompts)、本地 scratchpads 和隐藏推理排除在血统模型之外。这引出了: - 当计划的推导过程部分依赖于**未写入公共状态的私有推理**时,如何在不泄露私有内容的前提下,证明该推理步骤不会改变动作对公共输入的依赖关系? - 是否可通过**零知识证明**或**差分隐私摘要**,将私有推理的“影响范围”压缩为对公共键的声明,从而纳入 D(a) 的验证框架? —- ### 4. 跨外部服务的事务原子性 PLANFENCE 的验证点与后续外部工具调用**不构成原子事务**。这意味着: - 即使验证通过,外部服务在调用瞬间仍可能因并发修改而失效。可研究如何将血统验证与外部服务调用封装为**两阶段提交**或**基于补偿事务**(Saga)的分布式事务,尤其当动作涉及多个外部 API 时。 - 探索与现有 LLM 智能体协议(如 MCP、A2A)的集成,将 PLANFENCE 作为事务协调器嵌入标准调用链。 —- ### 5. 动态策略选择与运行时自适应 附录 B.2 显示,学习式策略选择器在分布外(OOD)偏移下难以稳定超越透明规则( rho ≤ 1 选同步,否则选验证)。可进一步探索: - **在线 bandit 或元学习**:基于实时观测到的更新率、网络延迟和依赖稀疏度,动态切换 proactive sync 与 PLANFENCE,并给出竞争比下界。 - **分层记忆架构**:设计混合策略,对高频变更键使用 proactive sync,对稀疏依赖键使用 PLANFENCE 按需验证,并在运行时根据工作负载重分区。 —- ### 6. 超大规模键空间与复杂血统图优化 论文评估的键空间上限为 |X| = 128 。在更大规模场景下: - 当公共状态包含数万级语义键,且计划血统为**多源合并图**(multi-parent merge)而非简单链式结构时,如何设计高效的依赖前沿索引,使 F_a(x) 的遍历避免线性扫描? - 研究**内容寻址存储**(如 Merkle DAG)与增量校验和,将血统验证的通信量从 O(|D(a)|) 进一步压缩到 O(log |X|) 或更小。 —- ### 7. 大工件与多模态内容的高效血统追踪 论文的工件控制实验涉及 256 – 320,KiB 的制品,但主要关注安全路径而非成本比较。后续可探索: - 当公共记录包含大型二进制工件(如模型权重、图像、视频)时,如何在保持**精确父级链接**的同时,避免在每次验证时传输完整内容?可结合**内容寻址**与**范围哈希**(range hashing),仅校验受影响片段。 - 多模态输入(图像、音频、传感器数据)引入的**非结构化依赖**如何被显式声明并纳入 D(a) ? —- ### 8. 语义等价性与计划合并 论文假设记录版本是**不可变**且通过精确 ID 比对的。在实际 LLM 智能体系统中: - 修订记录 r_4 可能与 r_3 **语义等价**(例如仅修改了注释或格式),此时强制重规划可能造成不必要的协调成本。可探索**语义差异检测**或**松散血统等价**(loose lineage equivalence),允许在不影响动作授权的前提下跳过验证。 - 当多个智能体并发修订同一语义键时,如何基于 CRDT 或操作变换(OT)在验证层之前合并公共状态,而非简单阻塞或失败闭合? —- ### 9. 扩展至层级化与嵌套工作流 当前实验主要覆盖扁平的“规划-修订-执行”模式。更复杂的场景涉及: - **嵌套子工作流**:上层计划的 L(a) 可能派生自下层子计划的输出,形成层级血统。需要递归验证机制确保每一层的依赖前沿均保持有效。 - **长周期持久计划**:当计划的生命周期跨越小时甚至天级(如 SwarmWorld 中的持久程序),如何在执行者离线或休眠期间管理血统验证与状态租约? —- 这些方向既回应了论文 Section 6 中列出的明确限制(拜占庭容错、所有者迁移、推断依赖、语义合并、私有推理、事务边界),也将其系统权衡分析扩展到了更大规模、更动态和更异构的智能体部署环境。 Q6: 总结一下论文的主要内容 这篇论文研究分布式大语言模型(LLM)智能体系统中的 **stale-plan execution(过时计划执行)** 问题,提出并评估了名为 **PLANFENCE** 的依赖范围限定动作验证协议。以下从问题、概念、方法与实验四个方面总结主要内容。 —- ### 1. 核心问题:状态新鲜度不等于计划有效性 在分布式多智能体架构中,不同角色(如规划者、执行者)通过复制共享公共状态进行协作。一个规划者可能基于公共需求 r_3 生成计划 p(r_3) ;在动作执行前,另一智能体提交了修订版 r_4 。即使执行者的本地内存已通过背景传播更新为 r_4 ,它仍可能因未替换缓存的计划而基于 p(r_3) 调用外部工具(例如预订已取消的订单、部署已废弃的构建)。 论文将此故障定义为 **stale-plan execution**,并指出其根源在于:
Fresh local state nRightarrow Valid plan authorization.
即,执行者读取了最新事实,并不意味着授权该动作的**计划推导血统**仍然有效。 —- ### 2. 安全不变量:血统有效性(Lineage Validity) 论文将动作的安全条件形式化为 **lineage validity**。对于受保护的外部动作 a ,设: - L(a) 为授权动作的计划根节点; - D(a) ⊂eq X 为工具声明的、可能影响该动作的公共语义键集合; - F_a(x) 为从 L(a) 沿精确父级链追溯到的键 x 的记录版本(依赖前沿); - H(x) 为键 x 的权威所有者当前授权的版本(head)。 则动作有效的充要条件为:
Valid(a) iff F_a(x) = H(x),quad ∀ x ∈ D(a).
该条件表明:必须验证计划**实际使用的精确输入版本**与所有者**当前授权的输入版本**是否一致,而非仅检查执行者本地是否持有最新状态。 —- ### 3. PLANFENCE:依赖范围限定的动作验证协议 为实现上述不变量,论文设计了放置于**外部动作边界**的 PLANFENCE 门控,包含三个核心机制: - **精确衍生记录**:任何公共记录(包括计划)写入时必须附加不可变的精确父级 ID,从而建立完整的血统链。 - **依赖声明**:工具包装器显式声明 D(a) ,限定动作的相关公共键集合,避免检查无关状态。 - **动作时验证与一次重规划**:执行前,执行者并发查询 D(a) 中各键的所有者,比对 F_a(x) 与 H(x) 。若不一致,允许拉取最新记录并**重规划一次**;若再次不一致或验证不完整,则**阻塞动作**(fail closed)。 PLANFENCE 的关键设计在于将**安全不变量**(血统有效)与**系统机制**(何时、以何种范围检查)分离:它仅在动作即将执行时,对动作相关的依赖子集进行验证。 —- ### 4. 实验发现 论文通过 30 组实时五智能体工作流(Qwen3.5)与大规模受控重放(32,700 次调度动作)回答三个研究问题: - **RQ1(状态新鲜度是否足够?)**:仅检查本地状态新鲜度的方法在 30/30 任务中均发出无效动作;而强制精确血统的 PLANFENCE 与集中式血统服务均完成 30/30 任务且无无效动作。 - **RQ2(同步策略边界)**:在 rho ≤ 1 (低变更率)时,每次更新主动同步(metadata sync, K=1 )的协调阻塞更低;在 rho ≥ 4 (高变更率)时,PLANFENCE 的阻塞显著更低(领先 1.5× 至 7.1× ),因为它避免了为每次更新支付全局协调成本。 - **RQ3(依赖范围 vs. 全键验证)**:当共享键空间从 8 增至 128 时,PLANFENCE 的流量稳定在约 8.1,KiB/action ,而批量全键验证从 16.4 增至 81.7,KiB/action ;延迟亦显著降低。当依赖集 D(a) 接近完整键空间时,两者的优势边界自然收敛。 —- ### 5. 主要贡献 - **问题识别与形式化**:首次明确区分分布式智能体内存中的“状态新鲜”与“计划血统有效”,定义 stale-plan execution 与 lineage validity。 - **协议设计与实现**:提出 PLANFENCE,一种在动作边界绑定精确公共输入、验证依赖子集并支持一次重规划后失败闭合的协议。 - **系统代价边界刻画**:在相同的调度与网络迹线下,比较多种安全协调策略,量化了“主动同步”与“动作时验证”、“依赖范围”与“全键验证”之间的协调阻塞与流量交叉边界。 论文明确其结论为**受控安全性与系统代价结果**,而非对一般任务准确性的普遍提升。 Q7: 想要进一步了解论文 以上只是了解一篇论文的几个基本FAQ。如果你还想与Kimi进一步讨论该论文,请点击 这里 为你跳转Kimi AI网页版,并启动一个与该论文相关的新会话。
Authors: Evan Chen, Shiqiang Wang, Christopher G. Brinton
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03340.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03340
Published: 2026-09-05T01:23:16.709Z
5. A Prompt-Engineering Approach to Develop Scalable, Flexible, and Real-Time Hybrid Micro-Level Personalization in a General Purpose AI Teaching Assistant
Abstract:Artificial intelligence (AI) teaching assistants powered by large language models (LLMs) offer scalable educational support but often provide limited personalization. This study presents a prompt-engineering-based framework for personalizing general-purpose LLM/RAG-based AI teaching assistants such as Jill Watson across academic disciplines and courses. The framework adapts responses using six learner-specific dimensions: self-assessment, abstraction preference, verbosity preference, perceptual orientation, information processing style, and level of understanding, yielding 96 distinct learner profiles. Student queries are additionally analyzed using Bloom’s Taxonomy to estimate cognitive complexity at the interaction level. Learner attributes and cognitive assessments are encoded in structured prompts that condition the LLM without requiring model retraining. The framework is evaluated through experiments using NLP metrics and a human study with five participants. Results show perceived differences in response style and structure across personalization conditions, with statistical analyses identifying learner attributes associated with measurable response changes. These findings provide preliminary evidence that prompt-based personalization can support adaptive behavior in LLM-powered educational agents.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03402 (HTTP 429)
Authors: Saptarshi Basu, Sandeep Kakar, Ashok Goel
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03402.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03402
Published: 2026-09-05T01:23:16.709Z
6. Caught in the Story: Narrative Captivity in Multi-turn LLMs Conversation
Abstract:People increasingly turn to large language models (LLMs) for everyday advice, making ethically charged interpersonal problems a practical moral-advisory context. Most prior work has studied this context through single-turn judgments or pressure-laden rebuttals, assumptions that poorly match how guidance is sought in real-world contexts. These assumptions leave unclear whether narration alone, without an explicit opposing position, can shift model judgments during multi-turn moral consultation. Yet real-world moral-conflict conversation often elicits one party’s self-justifying account, which can unfold over multiple turns and create information asymmetry. We introduce \textbf{narrative captivity}, a failure mode in which a model treats an unopposed one-sided account as complete and aligns with the narrator’s interpretation without seeking missing perspectives. To measure this phenomenon, we build a benchmark of $5{,}078$ interpersonal-conflict scenarios spanning six moral dimensions. Across 17 LLMs, narrative captivity is widespread: end-state judgments under multi-turn narration shift by 25 percentage points on average beyond the matched single-turn baseline. Stage-level analysis identifies preference optimization as a major contributor, while four inference-time strategies provide only partial mitigation. We hope our project fosters LLM advisors that preserve independent judgment in real-world consultation.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03407 (HTTP 429)
Authors: Yuhe Wu, Guangyu Wang, Yujie Chen, Jiatong Zhang, Yuran Chen, Yutong Zhang, Xiyin Cheng, Wenpeng Cao, Zhuang Liu, Guang Zhang
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03407.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03407
Published: 2026-09-05T01:23:16.709Z
7. Dude: A Dual-Detection Multi-Agent System for Paper-Code Discrepancy Detection
Abstract:LLM-empowered paper-code discrepancy detection has received growing concern since the scaling of research submissions exceeds the manual review capability. However, the limited context capacity and one-sided discrepancy detection of existing single-agent LLM paradigms lead to an inferior recall performance in detecting discrepancies. In this paper, we propose Dude, the first Dual-Detection Multi-Agent System for paper-code discrepancy detection. We discover that the granularity asymmetry of the paper-language and code-language introduces over-interpretation and over-reporting challenges in a multi-agent system design for discrepancy detection, resulting in increasing false positives. To address this, we propose a granularity-aligned negotiation and a two-stage salience-filtering mechanism in Dude, which effectively prevents agents from falsely reporting discrepancies. Experimental results in real-world paper-code discrepancy datasets showcase Dude’s significant recall and precision improvement by up to 22.8%, increasing F1 score by up to 18.7% compared to baseline methods.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03416 (HTTP 429)
Authors: Weijie Liu, Running Zhao, Wenhao Yuan, Jinfeng Xu, Zhanfeng Xu, Xiaoxi Zhang, Edith Cheuk-Han Ngai
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03416.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03416
Published: 2026-09-05T01:23:16.709Z
8. DuplexSpeechBench-IFEval: Evaluating Implicit Instruction Following in Full-Duplex Voice Agents
Abstract:Full-duplex voice agents must continuously decide when to listen, backchannel, interrupt, handle speech overlaps, take the floor, and yield. Existing benchmarks largely test these behaviors through explicit turn-management instructions, while deployed agents are often configured through roles or personas from which the appropriate conversational behavior must be inferred. We introduce DuplexSpeechBench-IFEval (DSB-IFEval) for evaluating implicit instruction-following in real-time spoken interaction. (DSB-IFEval) comprises 1,038 test cases spanning eight diverse assistant roles and evaluates five conditioning protocols for instruction-following: default behavior, explicit behavioral instructions, persona-implied behavior, combined persona—rule conditioning, and instruction conflict. We measure real-time floor management using a deterministic Instruction Adherence Score (IAS) and persona-consistent content using LLM-judged Persona Adherence Score (PAS). Across six real-time speech systems, we find architecture-dependent trade-offs. Full duplex models like F-Actor and PersonaPlex are more sensitive to whether conversational behavior is stated explicitly or must be inferred from a persona, with adherence dropping by 9.7% and 4.5%, respectively, under persona-only conditioning. In contrast, GPT-Realtime, MiniCPM-o, and Fun-Audio-Chat strongly adhere to persona-consistent content, but their floor behavior does not adapt across explicit and persona-only instructions and remains constrained on several proactive actions. We further find that even if systems reliably follow conflicting directives to their prescribed persona, they still struggle to override them under safety conflict. These results show that inferring the behavior implied by a role, executing it at the appropriate conversational moment, and resolving competing instructions remain distinct challenges for full-duplex voice agents.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03423 (HTTP 429)
Authors: Puneet Mathur, Dinesh Manocha
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03423.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03423
Published: 2026-09-05T01:23:16.709Z
9. Do GUI Agents Know When Not to Act? Enabling Conflict-Aware Termination for Multimodal GUI Agents
Abstract:Graphical user interface (GUI) agents are increasingly used to execute natural-language instructions on user interfaces, yet real users may issue infeasible instructions due to benign mistakes. A reliable agent should not only know how to act, but also when not to act. In this work, we introduce CONFLICTGUI, a benchmark covering instruction-internal conflicts and instruction-GUI context conflicts to study conflict-aware termination. Our evaluation reveals severe execution-biased overcompliance: agents that perform well on feasible tasks often continue to execute blindly under conflicting instructions. To mitigate this behavior, we propose CONFLICTGUARD, an inference-time framework that aligns an agent’s feasibility awareness with its action generation. CONFLICTGUARD contains two coupled components: a feasibility verification protocol that guides the agent to assess instruction logic and GUI-side evidence before acting, and a conditional action modulation mechanism that steers agents from over-compliant execution into termination-oriented behavior. Experiments across five widely-used agents demonstrate that CONFLICTGUARD improves average conflict task success rate significantly, while preserving normal GUI-task performance. These results validate that a lightweight inference-time intervention can substantially boost GUI Agent’s competence to identify inappropriate execution scenarios and refrain from unnecessary actions.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03438 (HTTP 429)
Authors: Zhaoyuan Huang, Tianjie Ju, Pengzhou Cheng, Zheng Wu, Yansi Li, Chuanbiao Song, Jun Lan, Huijia Zhu, Weiqiang Wang, Zhuosheng Zhang
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03438.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03438
Published: 2026-09-05T01:23:16.709Z
10. Beyond “Made with AI”: Visualizing Provenance Density to Mitigate the Transparency Penalty
Abstract:As generative AI makes polished prose cheap to produce, users can no longer rely on fluency as a proxy for truth. We call this failure mode the Fluency Trap: users trust fluent hallucinations while also discounting accurate content once it is disclosed as AI-generated. Binary ``Made with AI’’ labels respond with authorship disclosure, but they do not show what supports a claim. We propose Provenance Density, an evidence-visualization interface that shows the density of verified claims in a text. In a user study with 81 participants, an idealized Provenance Density interface produced a large discernment gap between truth and fabrication ($+4.15$ points, $d=1.82$), whereas participants given no signal showed no detectable discrimination. A technical audit with 200 samples shows that retrieval density alone is insufficient; unexpectedly, the Consistency Veto carries most of the discriminative signal on dynamic queries. As AI-generated content becomes indistinguishable from human writing, effective transparency must move from authorship disclosure toward evidence visualization.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03460 (HTTP 429)
Authors: Qing Zhang, Yifei Huang, Juyoung Lee, Thad Starner, Jun Rekimoto
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03460.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03460
Published: 2026-09-05T01:23:16.709Z
Evaluation Domain Papers
1. Structure and Implementation of New Practical English Textbooks Driven by Artificial Intelligence
Abstract:Artificial intelligence is changing the form of applied English materials from fixed paper sequences to adaptive learning systems that can diagnose learners, recommend tasks, and provide formative feedback. This paper studies the structure and application of a new practical English textbook driven by artificial intelligence. A five-layer architecture is proposed: knowledge mapping, learner profiling, task generation, feedback orchestration, and teacher-side governance. A prototype was tested on 186 non-English-major undergraduates for eight weeks of teaching. Compared with a static digital textbook, the proposed system increased the unit completion accuracy from 72.4% to 84.9%, raised the average score for speaking tasks by 10.8 points, and reduced the teacher’s correction time by 31.6%. Therefore, an AI-driven textbook can maintain the stability of the curriculum while providing personalised learning paths, rich practice materials and traceable classroom data.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.02981 (HTTP 429)
Authors: Ya Wang, Lei Zhang, Xueguang Yang, Bo Chen
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.02981.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.02981
Published: 2026-09-05T01:23:32.676Z
2. MasterControl Seventeen Every Time
Abstract:We study a governed approach to enterprise analytics: a language model interprets the question, while deterministic policy selects and runs a pre-approved analytical program that returns both results and evidence. We show that this restriction can remain expressive within a defined analytical class, using relational operations plus aggregation, comparison, windows, ranking, and similarity. Fixed meaning, policy, data, and execution rules also make results replayable. Across 440 runs, three 8B models generated SQL and selected tools at runtime, while Qwen3-8B interpreted intent only and policy executed the approved program. None of 330 runtime-planning episodes matched the full answer-and-evidence contract across all test datasets; the policy-executed analyzer matched 110 of 110. This is a configuration-specific result, not evidence that runtime agents cannot succeed under other designs.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03209 (HTTP 429)
Authors: MasterControl AI Lab
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03209.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03209
Published: 2026-09-05T01:23:32.676Z
3. Speculative Macro Commit for Faster Tool-Using Agents
Abstract:Tool-using LLM agents spend wall-clock time not only on model inference but also in serial action—observation turns, where each tool call, environment transition, and observation can delay subsequent decisions. We introduce \textbf{Speculative Macro Commit} (SMC), a runtime mechanism for a two-tier agent system: a large authoritative actor model produces the official trajectory, while a faster speculative drafter model continuously predicts and executes future action chains on an isolated environment snapshot. SMC mines recurring multi-action skeletons from training traces and stores them in a macro library used to match against action chains predicted by the drafter at runtime. When the actor’s next tool call matches the first drafted action, SMC commits the remaining pre-executed draft steps, together with their observations, to the official trajectory. Using Qwen3.5-27B INT4 as the authoritative actor model and Qwen3.5-4B as the speculative drafter model, SMC matches the sequential agent’s overall accuracy while reducing latency by 10.23\% over the Speculative Actions (SA) baseline and 18.59\% over sequential execution on the $\tau^2$-Bench Telecom subset. On AppWorld, SMC reduces wall time by 7.7\% over SA baseline and 44.9\% over sequential execution, with a small reduction in task completion. Overall, SMC provides a practical way to reuse multi-step speculative execution and reduce agent latency beyond single-step speculative actions. Our code is publicly available \href{this https URL}{\textcolor{magenta}{here}}.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03236 (HTTP 429)
Authors: Zeyu Liu, Souvik Kundu, Peter A. Beerel
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03236.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03236
Published: 2026-09-05T01:23:32.676Z
4. Fresh Memory, Stale Plans: Dependency-Scoped Validation for Distributed LLM-Agent Memory
Abstract:Distributed LLM-agent teams can read the latest shared facts and still act on an obsolete plan. A planner may derive an action from requirement $r_3$, another agent may commit $r_4$, and an executor may receive $r_4$ without replacing the plan derived from $r_3$. We call this \emph{stale-plan execution}: state freshness does not establish that the plan authorizing an action remains valid. We introduce PlanFence, a dependency-scoped action-validation protocol. Plans cite the exact public records they used, and an executor validates only the records that can affect the pending external action, replanning once or blocking when validation is incomplete. In 30 controlled live workflows with a post-plan revision, a freshness-only executor acts on the obsolete plan in every task, whereas PlanFence completes all tasks without an invalid action. Controlled replay reveals two conditional boundaries: proactive synchronization yields lower coordination stall at low churn, while PlanFence avoids repeated update-path coordination as churn grows and avoids validating unrelated state as the shared keyspace grows. These are controlled safety and systems-cost results, not general task-accuracy gains.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
Q: 这篇论文试图解决什么问题? 这篇论文针对分布式大语言模型(LLM)智能体系统中的 \*\*stale-plan execution(过时计划执行)\*\* 问题,提出了一种依赖范围限定的动作验证机制。具体而言,论文试图解决的核心问题可归纳如下: --- ### 1. 核心问题:状态新鲜度与计划有效性之间的脱节 在分布式多智能体环境中,公共任务状态通常被复制到各智能体的本地内存中。即使执行者(executor)读取到了最新的共享事实(例如一条已被修订的需求 r_4 ),它仍可能依据一个基于旧版本(例如 r_3 )生成的过时计划 p(r_3) 去调用外部工具。论文将此类故障定义为 \*\*stale-plan execution\*\*: - 规划者(planner)基于需求 r_3 推导出计划 p(r_3) ; - 在计划执行前,另一智能体提交了修订版本 r_4 ; - 执行者虽通过背景传播收到了 r_4 ,但并未替换本地缓存的计划 p(r_3) ; - 结果,执行者使用源自旧需求的参数调用外部工具(例如预订已取消的订单、部署已废弃的构建版本)。 关键洞察在于:\*\*执行者本地状态的“新鲜”并不足以保证待执行计划的授权仍然有效\*\*。即
Fresh local state nRightarrow Valid plan lineage.
—- ### 2. 形式化目标:血统有效性(Lineage Validity) 论文将安全不变量形式化为 **lineage validity**。对于受保护的外部动作 a ,设: - L(a) 为授权该动作的计划根节点; - D(a) ⊂eq X 为工具包装器声明的、可能影响该动作的公共键集合; - F_a(x) 为计划实际使用的、键 x 的记录版本; - H(x) 为键 x 的当前所有者授权版本(head)。 则动作 a 在验证点有效的充要条件为:
Valid(a) iff Fa(x) = H(x),quad ∀ x ∈ D(a).
论文指出,若无精确的父级链接(exact parent IDs)和动作时的依赖验证,执行者无法仅凭本地副本判断待执行计划是否仍被当前公共记录授权。 —- ### 3. 系统层面的权衡问题 在识别上述安全缺口后,论文进一步探讨了实现该不变量时的系统代价权衡,对应三个研究问题: - **RQ1**:智能体是否可能在读取最新状态后,仍执行过时计划? ——答案是肯定的,仅靠状态新鲜度无法防止。 - **RQ2**:当公共状态频繁变更时,是在每次更新时主动同步(proactive synchronization)代价更低,还是在动作即将执行前按需验证代价更低? ——论文发现低变更率下主动同步的协调阻塞更低,高变更率下动作时验证更优。 - **RQ3**:当共享状态空间增长时,仅检查动作相关的依赖集 D(a) 是否比检查全部共享键 X 更能降低协调成本? ——依赖范围限定能避免序列化无关状态,在稀疏依赖场景下显著降低延迟与流量。 —- ### 4. 提出的解决方案:PLANFENCE 为在动作边界上建立血统有效性,论文设计了 **PLANFENCE** 协议: - **精确衍生记录**:每个计划引用其生成时所使用的精确公共记录版本(不可变记录 ID); - **依赖声明**:工具包装器显式声明 D(a) ,即哪些公共键可能影响该动作; - **动作边界门控**:执行者在调用外部工具前,仅针对 D(a) 中的键向权威所有者查询当前 head H(x) ,并与计划中的依赖前沿 F_a(x) 比对; - **一次重规划后失败闭合**:若发现不匹配,允许拉取最新记录并执行一次重规划;若再次不匹配或验证不完整,则阻塞动作(fail closed)。 综上,该论文旨在解决分布式 LLM 智能体内存中 **“读了最新事实,却执行了过时计划”** 的安全漏洞,并在确保血统有效性的同时,探索依赖范围限定验证相对于全局同步和全键验证的系统代价边界。 Q2: 有哪些相关研究? 论文在第2节“Related Work”中系统梳理了相关研究,并将其归纳为三大领域。以下按研究脉络分类概述: —- ### 1. 数据来源与乐观并发控制(Provenance and Validation) 该领域关注如何记录衍生对象的输入来源,并在操作提交前验证读集合是否仍然有效。 - **数据溯源(Data Provenance)**:Buneman、Khanna 与 Wang-Chiew(2001)提出了数据来源的特征化方法,用于记录哪些输入产生了一个衍生对象。 - **乐观并发控制(Optimistic Concurrency Control)**:Kung 与 Robinson(1981)提出在事务提交前验证其读集合是否仍保持当前状态。 **与 PLANFENCE 的区别**:上述工作针对的是数据库事务提交的边界。PLANFENCE 将同样的底层思想应用于**智能体工具边界**——LLM 生成的计划可能跨角色调用、副本和状态刷新长期存在,除非运行时记录精确的父级版本,否则执行者在动作边界将没有读集合可供验证。 —- ### 2. 分布式一致性与内存模型(Distributed Consistency) 该领域提供了多种暴露当前副本状态的方式,或在一致性与延迟之间做应用级权衡。 - **强一致性、主动复制与 CRDTs**:包括 CAP 定理的形式化(Gilbert & Lynch, 2002)、现代分布式数据库中的一致性权衡(Abadi, 2012)、消息传递系统中的健壮共享内存(Attiya et al., 1995)、流行病式复制算法(Demers et al., 1987),以及无冲突复制数据类型(Shapiro et al., 2011)。 - **一致性分级与云存储 SLA**:Kraska 等(2009)提出一致性配给;Li 等(2012)提出“必要时一致”;Terry 等(2013)提出基于一致性的服务等级协议;Bailis 等(2012)提出概率有界陈旧性。 **与 PLANFENCE 的区别**:PLANFENCE 并未引入新的一致性模型,而是**指定了哪些记录版本必须授权待执行动作**;它可以建立在主动传播或动作时所有者查询之上,但不依赖于某一种特定的副本一致性机制。 —- ### 3. LLM 多智能体协作与记忆(LLM-Agent Coordination and Memory) 该领域涵盖智能体角色协作结构、记忆检索与共享、以及持久世界中的可执行制品。 #### 3.1 多智能体协作框架 - **角色化多智能体系统**:AutoGen(Wu et al., 2023)、MetaGPT(Hong et al., 2024)、CAMEL(Li et al., 2023)、ChatDev(Qian et al., 2024)等框架将任务划分为不同角色并在独立进程或设备上运行。 - **交互优化与架构搜索**:包括通过多智能体辩论提升事实性(Du et al., 2024)、将语言智能体视为可优化图的 GPTSwarm(Zhuge et al., 2024)、经济型通信管道(Zhang et al., ICLR 2025)以及多智能体架构搜索(Zhang et al., ICML 2025)。 - **交互协议**:Anthropic 的模型上下文协议 MCP(2024)与 Google 的 Agent2Agent(A2A)协议(2025)提供了工具与智能体交互的标准接口。 #### 3.2 智能体记忆系统 - **记忆管理**:MemGPT(Packer et al., 2023)将 LLM 视为操作系统管理记忆;A-MEM(Xu et al., 2025)提出智能体记忆;Mem0(Chhikara et al., 2025)关注可扩展长期记忆;Reflexion(Shinn et al., 2023)利用语言反馈进行强化学习;Voyager(Wang et al., 2023)关注开放式具身智能体。 - **共享与架构视角**:Yu 等(2026)从计算机体系结构视角审视多智能体记忆;Rezazadeh 等(2025)研究多用户动态访问控制下的记忆共享;Wang 与 Chen(2025)提出 MIRIX 多智能体记忆系统。 #### 3.3 持久世界与智能体生成制品 - **SwarmWorld**(Pal et al., 2026):研究了语言模型智能体社会中的持久世界,记录内容寻址的父子程序血统,允许后续智能体继承和修改持久程序,并在共享世界持续演化的同时提交模型生成的计划。 **与 PLANFENCE 的区别**:现有工作主要关注“智能体应通信、检索或保留什么内容”,或支持程序继承与归属的技术血统。PLANFENCE 则利用**精确的衍生血统(exact derivation lineage)**来确定:一个待执行动作是否仍被其**动作相关的公共输入**的当前版本所授权。这是一种面向动作边界的、依赖范围限定的验证机制,而非全局内存 freshness 或持久制品的演化机制。 Q3: 论文如何解决这个问题? 论文通过 **PLANFENCE**(Dependency-Scoped Action-Validation Protocol)解决 stale-plan execution 问题。其核心思路是将**安全不变量**(动作的血统必须有效)与**建立该不变量的系统机制**(何时、以何种范围进行检查)分离,并在**外部动作边界**实施依赖范围限定的验证。具体解决路径可分为以下层面: —- ### 1. 精确衍生记录:绑定计划与不可变输入版本 PLANFENCE 要求每个公共记录都是不可变的,并通过**语义键**(semantic key) x ∈ X 标识逻辑项,通过**不可变记录 ID** 标识具体版本。任何衍生记录(包括智能体生成的计划)在写入时必须附加**精确的父级 ID**(exact parent IDs),记录它是从哪些确切版本的公共输入推导而来。 - 若计划 p 由需求 r_3 推导,则 p 必须显式引用 r_3 的记录 ID(如 id_3 ),而非仅引用语义键 x(req) 。 - 这意味着,即使后续修订版 r_4 已提交,计划 p 携带的仍是 id_3 的血统证据;执行者不会仅因本地已安装 r_4 就误以为 p 仍然有效。 —- ### 2. 动作依赖声明:限定验证范围 PLANFENCE 不要求在每次状态更新时验证全部共享状态,也不要求执行前检查整个键空间。相反,它要求**工具包装器**(tool wrapper)在应用代码层面显式声明一个依赖集合:
D(a) ⊂eq X
表示哪些公共键的值可能影响该受保护动作 a 。例如,一次预订动作可能只依赖于需求键和可用性键,而与无关的目录记录或其他工作流状态无关。 —- ### 3. 血统有效性的形式化条件 在动作执行前的验证点,PLANFENCE 检查**血统有效性**(lineage validity)。设: - L(a) 为授权动作 a 的计划根节点; - F_a(x) 为从 L(a) 沿精确父级链追溯到的、键 x 的记录版本(依赖前沿); - H(x) 为键 x 的权威所有者 o(x) 当前授权的版本(head)。 则动作 a 有效的充要条件为:
Valid(a) iff F_a(x) = H(x),quad ∀ x ∈ D(a).
该条件直接回答 RQ1:执行者读取最新状态 local_head=H(x) 并不足够;必须验证计划实际使用的版本 F_a(x) 是否与 H(x) 一致。 —- ### 4. 动作边界门控:Algorithm 1 的执行流程 PLANFENCE 在执行外部调用前运行**依赖范围限定的验证门控**,其算法流程如下: 1. **血统遍历**:从计划根 L(a) 出发,沿本地精确父级链遍历,直至到达 D(a) 中各语义键的边界。若任何父级链不完整、依赖边界缺失或所有者映射缺失,则**阻塞**(blocked)。 2. **并发查询所有者**:对 D(a) 中的每个键 x ,并发向其所有者 o(x) 查询当前授权版本 H(x) 。若响应不可用、损坏、冲突或键不匹配,则**阻塞**。 3. **增量内容获取**:仅对那些 H(x) ≠ F(x) 的键,获取并验证其最新记录内容;其余键仅比对元数据(记录 ID)。 4. **比对与决策**: - 若 F = H 且计划根确实衍生自这些前沿版本,则**授权**(authorized)。 - 若发现不匹配: - 若这是首次检测到变更(`replanned = false`),则允许**一次重规划**(replan-required):执行者拉取最新记录,用相同的角色和隔离上下文重新生成计划,然后带着新计划再次进入门控。 - 若已重规划过一次仍不匹配,或任何依赖再次变更,则**失败闭合**(blocked),禁止动作执行。 此机制确保: - 不会无限重试(最多一次 replan); - 任何验证不完整的情况均导向阻塞,而非放行。 —- ### 5. 协调成本的优化策略 PLANFENCE 通过**按需验证**与**依赖范围限定**降低系统协调成本,具体体现为: - **动作时验证 vs. 每次更新同步**:不强制在每次公共状态变更时同步所有副本(metadata sync),而是在动作即将执行时才支付验证成本。论文实验表明,当更新率 rho 较低时主动同步更优,但当 rho ≥ 4 时,PLANFENCE 的阻塞时间显著低于安全基线(图3、图4)。 - **依赖范围限定 vs. 全键验证**:不检查整个共享键空间 |X| ,仅检查 |D(a)| 个动作相关键。实验显示,当共享键从 8 增长到 128 时,PLANFENCE 的流量保持在约 8.1,KiB/action ,而批量全键验证从 16.4 增长至 81.7,KiB/action ;延迟亦显著降低(图5、表8)。 —- ### 6. 可信边界与失败闭合 PLANFENCE 的安全保证依赖于以下系统设计: - **可信计算基**:工具包装器对 D(a) 的声明必须完整;若无法静态确定,则需保守地声明更广集合。 - **良性所有者**:所有者 o(x) 必须如实返回其当前授权版本 H(x) 。 - **不可变性与认证**:公共记录不可变,传输经认证,父级链接不可篡改。 - **失败闭合**:任何父级链缺失、所有者无响应、依赖声明不完整或重规划后再次变更,均导致动作被阻塞,而非基于不完整证据执行。 综上,PLANFENCE 通过**在动作边界精确比对“计划实际使用的输入版本”与“所有者当前授权的输入版本”**,并**仅针对动作相关的依赖子集**进行该验证,解决了分布式 LLM 智能体中“读了最新事实,却执行了过时计划”的 stale-plan execution 问题。 Q4: 论文做了哪些实验? 论文的实验设计围绕三个研究问题(RQ1–RQ3)展开,结合**实时五智能体工作流**与**受控重放(controlled replay)**两种模式,辅以传输微基准测试和大量的消融实验。以下分层次梳理: —- ### 1. 实验总体设计与设置 **环境与负载** - **实时系统**:五个独立的 Qwen3.5 智能体进程,运行在预订(reservation)、履行(fulfillment)和部署(deployment)三类工作流上,每类 10 个随机种子,共 30 组任务。 - **受控重放**:固定 30 个工作流模板,通过替换模型重规划为预录制的公共决策,使不同内存策略在**相同的决策序列、更新时序和网络条件**下执行,从而将无效动作、等待时间和流量归因于策略本身而非模型输出差异。 - **网络条件**:Loopback,以及基于历史 AT&T、T-Mobile、Verizon LTE 链路的固定回放迹线(含丢包、延迟)。 - **默认参数**: N=5 个智能体, |X|=8 个共享语义键,每个动作依赖 d=1 个键, H=64 个工作单元,名义更新目标 rho ∈ 0.25, 1, 4, 16 。 **基线方法** - **不安全策略**:Local replica(直接执行本地状态)、Owner-head freshness(读取当前依赖但无血统绑定)、Metadata sync(延迟同步, K>1 )。 - **安全策略**:Centralized lineage(集中式血统服务)、Metadata sync( K=1 ,每更新即同步)、Per-key / Batched all-key validation(全键验证)、Majority-replica / All-replica validation(副本表决)、PLANFENCE。 **核心指标** - **安全性**:无效发出动作数(计划未到达当前声明输入的动作)。 - **可用性**:可用/已完成动作数。 - **协调阻塞(Coordination stall)**:等待同步或验证的时间(ms/action)。 - **分布式流量(Traffic)**:副本间及中央服务的字节数(KiB/action)。 —- ### 2. 针对三个研究问题的核心实验 #### RQ1:智能体读取最新状态后是否仍会执行过时计划? - **Table 1(受控重放,高更新负载 rho=4 )**:在 330 次调度的动作中,Local replica 和 Owner-head freshness 均发出 330/330 次无效动作;而所有强制精确血统绑定的安全策略(包括 PLANFENCE)无效动作为 0/330。 - **Table 2(实时五智能体工作流)**:在 30 个交互式任务中,Owner-head freshness 在每次任务中都发出了过时的主要动作,任务成功率为 0/30;Centralized lineage 和 PLANFENCE 均检测到变更,触发一次重规划,30/30 任务完成且无无效主要动作。 - **Appendix A.6**:对齐的策略审计覆盖 32,700 次调度动作,任何强制精确血统的方法均未出现无效动作;所有 4,143 次无效动作均来自陈旧或延迟同步的控制组。 #### RQ2:状态频繁变更时,每次更新同步与动作前验证哪个阻塞更低? - **Figure 3(跨网络与更新率的策略边界图)**:在 loopback 和三条蜂窝迹线上,比较 PLANFENCE 与 Metadata sync( K=1 )/Centralized lineage 的阻塞。低变更率( rho ≤ 1 )下,主动同步的阻塞更低;高变更率( rho ≥ 4 )下,PLANFENCE 的阻塞更低,领先优势为 1.5× 至 7.1× 。 - **Figure 4(AT&T 迹线上的同步节奏权衡)**:展示 Metadata sync 在不同 K (同步屏障间隔)下的安全-成本曲线。 K=1 时最安全但阻塞高;增大 K 降低阻塞但以牺牲安全为代价(出现无效动作);PLANFENCE 在 rho=4,16 时以零无效动作取得更低的阻塞。 - **Table 4(同步节奏消融)**:在 rho ∈ 0.25,1,4,16 下系统性地展示 K=1,2,4,8,16 的安全与成本。随着 K 增大,阻塞下降,但无效动作增加;PLANFENCE 在所有 rho 下保持 0 无效动作,且在 rho ≥ 4 时阻塞显著低于 K=1 。 - **Table 5(团队规模敏感性)**: N ∈ 3,5,8 ,高更新率下 PLANFENCE 的阻塞和流量均低于 Centralized lineage 和 Metadata sync( K=1 )。 - **Table 7(剧集长度敏感性)**: H ∈ 16,64,256 ,高更新率下的策略排序保持稳定。 #### RQ3:共享状态增长时,仅检查动作相关依赖是否比检查全部键更优? - **Table 1(八键紧凑状态)**:PLANFENCE 的阻塞为 230.8 ms/action、流量 8.1 KiB/action;Centralized lineage 为 508.6 ms/15.6 KiB;Metadata sync( K=1 )为 403.4 ms/23.5 KiB。 - **Figure 5(键空间 8–128 的比较)**:在 loopback 和 AT&T 迹线上对比 PLANFENCE 与 Batched all-key validation(同样允许一次重规划、两次验证)。随着共享键从 8 增至 128: - Loopback 阻塞:PLANFENCE 从 67.8 ms 降至 66.0 ms(基本持平),Batched all-key 从 115.5 ms 升至 199.2 ms。 - AT&T 阻塞:PLANFENCE 从 295.3 ms 升至 345.2 ms;Batched all-key 从 365.7 ms 升至 428.7 ms。 - 流量:PLANFENCE 恒定在约 8.1 KiB/action;Batched all-key 从 16.4 KiB 线性增长至 81.7 KiB/action。 - **Table 6(依赖集大小敏感性)**:固定 |X|=8 ,变化 d ∈ 1,2,8 。当 d=1 时 PLANFENCE 阻塞低 14.9%、流量低 50.6%;当 d=2 时阻塞接近打平、流量仍低 32.0%;当 d=8=|X| 时两者阻塞与流量均趋于一致(依赖范围限定失效的边界)。 - **Table 8 与 Table 9(完整键空间与独立迹线相位)**:覆盖 loopback(30 模板聚合)与 AT&T(三个独立迹线偏移 0/5/15 秒),共 13,200 次调度动作,PLANFENCE 与 Batched all-key 均完成全部有效动作,但 PLANFENCE 在几乎在所有子集中阻塞和流量更低。 —- ### 3. 附录中的补充实验 **B. 受控重放消融实验** - **学习策略选择(Table 10)**:训练神经网络(决策树、MLP、DeBERTa)在集中式 lineage、Metadata sync( K=1 )和 PLANFENCE 之间做策略选择。在分布内(ID)样本上学习器可达 95–96.7% 的安全近优选择,但在四个分布外(OOD)偏移块(Verizon 迹线、插值更新率、端点键数、复合偏移)中,没有学习器能在推理成本计入后全面超越简单的透明规则( rho ≤ 1 选同步,否则选 PLANFENCE)。 **C. 验证假设与组件敏感性** - **血统证明深度(Table 11)**:验证必须跟随**完整的传递闭包**。仅检查直接父级在链深 ell=1 时可行,但在 ell ≥ 2 时会导致错误放行;缺失中间记录时必须阻塞。 - **重规划机制(Table 11)**:仅验证不重规划会导致 3,000 次检测到的竞争全部阻塞;验证+一次重规划将其全部转为有效动作。 - **无血统/任意副本头(Table 11)**:读取新鲜需求但不检查计划血统,或信任任意副本的头,在每次竞争中都会发出无效动作。 - **依赖契约完整性(Figure 6)**:在 30 模板×100 竞争种子上,随真实依赖被遗漏的概率增加,无效动作率上升(遗漏 50% 时达 37.4%);过度声明依赖虽保持安全,但会增加所有者头检查次数。 - **失败闭合(Fail-closed)验证**:在所有者中断、血统缺失、畸形头、第二次版本变更四种情况下,失败闭合策略全部阻塞且无无效动作;对应的失败开放(fail-open)策略在四种情况下全部发出无效动作。 —- ### 4. 传输微基准测试 - **Figure 2**:测量单次认证 TCP 同步的阻塞时间随公共状态大小(2 KiB 至 8 MiB)和丢包率(0–10%)的变化。该实验说明单次同步在有利路径上开销低,但随着内容增长或链路恶化会显著增加,从而为“每次更新同步”的代价提供微观依据。 Q5: 有什么可以进一步探索的点? 基于论文的局限性陈述与系统设计边界,以下方向值得进一步探索: —- ### 1. 拜占庭与半诚实所有者环境下的安全验证 论文假设所有者是**良性**(benign)且诚实的。后续工作可探索: - 当所有者可能返回错误、过时或冲突的 H(x) 时,如何建立**拜占庭容错**的血统验证?例如,通过跨多个副本的密码学承诺或阈值签名来确认公共记录头的权威性,而非信任单一所有者。 - 在**所有者迁移**(owner migration)场景下,如何保持依赖链的可验证性与连续性,避免验证因所有权变更而中断。 —- ### 2. 自动化依赖声明推断 当前 PLANFENCE 要求工具包装器显式声明 D(a) ,且 Figure 6 表明遗漏真实依赖会直接破坏安全。可探索: - **静态或动态程序分析**:从工具包装器代码中自动提取其读取的公共键集合,生成 D(a) ,降低人工声明负担。 - **学习式依赖推断**:基于历史动作轨迹与输入输出关联,学习预测动作实际依赖的语义键子集,并在安全关键场景下保守地过度声明(over-declare)以确保不遗漏。 —- ### 3. 私有推理与公共血统的桥接 论文明确将私有提示(private prompts)、本地 scratchpads 和隐藏推理排除在血统模型之外。这引出了: - 当计划的推导过程部分依赖于**未写入公共状态的私有推理**时,如何在不泄露私有内容的前提下,证明该推理步骤不会改变动作对公共输入的依赖关系? - 是否可通过**零知识证明**或**差分隐私摘要**,将私有推理的“影响范围”压缩为对公共键的声明,从而纳入 D(a) 的验证框架? —- ### 4. 跨外部服务的事务原子性 PLANFENCE 的验证点与后续外部工具调用**不构成原子事务**。这意味着: - 即使验证通过,外部服务在调用瞬间仍可能因并发修改而失效。可研究如何将血统验证与外部服务调用封装为**两阶段提交**或**基于补偿事务**(Saga)的分布式事务,尤其当动作涉及多个外部 API 时。 - 探索与现有 LLM 智能体协议(如 MCP、A2A)的集成,将 PLANFENCE 作为事务协调器嵌入标准调用链。 —- ### 5. 动态策略选择与运行时自适应 附录 B.2 显示,学习式策略选择器在分布外(OOD)偏移下难以稳定超越透明规则( rho ≤ 1 选同步,否则选验证)。可进一步探索: - **在线 bandit 或元学习**:基于实时观测到的更新率、网络延迟和依赖稀疏度,动态切换 proactive sync 与 PLANFENCE,并给出竞争比下界。 - **分层记忆架构**:设计混合策略,对高频变更键使用 proactive sync,对稀疏依赖键使用 PLANFENCE 按需验证,并在运行时根据工作负载重分区。 —- ### 6. 超大规模键空间与复杂血统图优化 论文评估的键空间上限为 |X| = 128 。在更大规模场景下: - 当公共状态包含数万级语义键,且计划血统为**多源合并图**(multi-parent merge)而非简单链式结构时,如何设计高效的依赖前沿索引,使 F_a(x) 的遍历避免线性扫描? - 研究**内容寻址存储**(如 Merkle DAG)与增量校验和,将血统验证的通信量从 O(|D(a)|) 进一步压缩到 O(log |X|) 或更小。 —- ### 7. 大工件与多模态内容的高效血统追踪 论文的工件控制实验涉及 256 – 320,KiB 的制品,但主要关注安全路径而非成本比较。后续可探索: - 当公共记录包含大型二进制工件(如模型权重、图像、视频)时,如何在保持**精确父级链接**的同时,避免在每次验证时传输完整内容?可结合**内容寻址**与**范围哈希**(range hashing),仅校验受影响片段。 - 多模态输入(图像、音频、传感器数据)引入的**非结构化依赖**如何被显式声明并纳入 D(a) ? —- ### 8. 语义等价性与计划合并 论文假设记录版本是**不可变**且通过精确 ID 比对的。在实际 LLM 智能体系统中: - 修订记录 r_4 可能与 r_3 **语义等价**(例如仅修改了注释或格式),此时强制重规划可能造成不必要的协调成本。可探索**语义差异检测**或**松散血统等价**(loose lineage equivalence),允许在不影响动作授权的前提下跳过验证。 - 当多个智能体并发修订同一语义键时,如何基于 CRDT 或操作变换(OT)在验证层之前合并公共状态,而非简单阻塞或失败闭合? —- ### 9. 扩展至层级化与嵌套工作流 当前实验主要覆盖扁平的“规划-修订-执行”模式。更复杂的场景涉及: - **嵌套子工作流**:上层计划的 L(a) 可能派生自下层子计划的输出,形成层级血统。需要递归验证机制确保每一层的依赖前沿均保持有效。 - **长周期持久计划**:当计划的生命周期跨越小时甚至天级(如 SwarmWorld 中的持久程序),如何在执行者离线或休眠期间管理血统验证与状态租约? —- 这些方向既回应了论文 Section 6 中列出的明确限制(拜占庭容错、所有者迁移、推断依赖、语义合并、私有推理、事务边界),也将其系统权衡分析扩展到了更大规模、更动态和更异构的智能体部署环境。 Q6: 总结一下论文的主要内容 这篇论文研究分布式大语言模型(LLM)智能体系统中的 **stale-plan execution(过时计划执行)** 问题,提出并评估了名为 **PLANFENCE** 的依赖范围限定动作验证协议。以下从问题、概念、方法与实验四个方面总结主要内容。 —- ### 1. 核心问题:状态新鲜度不等于计划有效性 在分布式多智能体架构中,不同角色(如规划者、执行者)通过复制共享公共状态进行协作。一个规划者可能基于公共需求 r_3 生成计划 p(r_3) ;在动作执行前,另一智能体提交了修订版 r_4 。即使执行者的本地内存已通过背景传播更新为 r_4 ,它仍可能因未替换缓存的计划而基于 p(r_3) 调用外部工具(例如预订已取消的订单、部署已废弃的构建)。 论文将此故障定义为 **stale-plan execution**,并指出其根源在于:
Fresh local state nRightarrow Valid plan authorization.
即,执行者读取了最新事实,并不意味着授权该动作的**计划推导血统**仍然有效。 —- ### 2. 安全不变量:血统有效性(Lineage Validity) 论文将动作的安全条件形式化为 **lineage validity**。对于受保护的外部动作 a ,设: - L(a) 为授权动作的计划根节点; - D(a) ⊂eq X 为工具声明的、可能影响该动作的公共语义键集合; - F_a(x) 为从 L(a) 沿精确父级链追溯到的键 x 的记录版本(依赖前沿); - H(x) 为键 x 的权威所有者当前授权的版本(head)。 则动作有效的充要条件为:
Valid(a) iff F_a(x) = H(x),quad ∀ x ∈ D(a).
该条件表明:必须验证计划**实际使用的精确输入版本**与所有者**当前授权的输入版本**是否一致,而非仅检查执行者本地是否持有最新状态。 —- ### 3. PLANFENCE:依赖范围限定的动作验证协议 为实现上述不变量,论文设计了放置于**外部动作边界**的 PLANFENCE 门控,包含三个核心机制: - **精确衍生记录**:任何公共记录(包括计划)写入时必须附加不可变的精确父级 ID,从而建立完整的血统链。 - **依赖声明**:工具包装器显式声明 D(a) ,限定动作的相关公共键集合,避免检查无关状态。 - **动作时验证与一次重规划**:执行前,执行者并发查询 D(a) 中各键的所有者,比对 F_a(x) 与 H(x) 。若不一致,允许拉取最新记录并**重规划一次**;若再次不一致或验证不完整,则**阻塞动作**(fail closed)。 PLANFENCE 的关键设计在于将**安全不变量**(血统有效)与**系统机制**(何时、以何种范围检查)分离:它仅在动作即将执行时,对动作相关的依赖子集进行验证。 —- ### 4. 实验发现 论文通过 30 组实时五智能体工作流(Qwen3.5)与大规模受控重放(32,700 次调度动作)回答三个研究问题: - **RQ1(状态新鲜度是否足够?)**:仅检查本地状态新鲜度的方法在 30/30 任务中均发出无效动作;而强制精确血统的 PLANFENCE 与集中式血统服务均完成 30/30 任务且无无效动作。 - **RQ2(同步策略边界)**:在 rho ≤ 1 (低变更率)时,每次更新主动同步(metadata sync, K=1 )的协调阻塞更低;在 rho ≥ 4 (高变更率)时,PLANFENCE 的阻塞显著更低(领先 1.5× 至 7.1× ),因为它避免了为每次更新支付全局协调成本。 - **RQ3(依赖范围 vs. 全键验证)**:当共享键空间从 8 增至 128 时,PLANFENCE 的流量稳定在约 8.1,KiB/action ,而批量全键验证从 16.4 增至 81.7,KiB/action ;延迟亦显著降低。当依赖集 D(a) 接近完整键空间时,两者的优势边界自然收敛。 —- ### 5. 主要贡献 - **问题识别与形式化**:首次明确区分分布式智能体内存中的“状态新鲜”与“计划血统有效”,定义 stale-plan execution 与 lineage validity。 - **协议设计与实现**:提出 PLANFENCE,一种在动作边界绑定精确公共输入、验证依赖子集并支持一次重规划后失败闭合的协议。 - **系统代价边界刻画**:在相同的调度与网络迹线下,比较多种安全协调策略,量化了“主动同步”与“动作时验证”、“依赖范围”与“全键验证”之间的协调阻塞与流量交叉边界。 论文明确其结论为**受控安全性与系统代价结果**,而非对一般任务准确性的普遍提升。 Q7: 想要进一步了解论文 以上只是了解一篇论文的几个基本FAQ。如果你还想与Kimi进一步讨论该论文,请点击 这里 为你跳转Kimi AI网页版,并启动一个与该论文相关的新会话。
Authors: Evan Chen, Shiqiang Wang, Christopher G. Brinton
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03340.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03340
Published: 2026-09-05T01:23:32.676Z
5. A Prompt-Engineering Approach to Develop Scalable, Flexible, and Real-Time Hybrid Micro-Level Personalization in a General Purpose AI Teaching Assistant
Abstract:Artificial intelligence (AI) teaching assistants powered by large language models (LLMs) offer scalable educational support but often provide limited personalization. This study presents a prompt-engineering-based framework for personalizing general-purpose LLM/RAG-based AI teaching assistants such as Jill Watson across academic disciplines and courses. The framework adapts responses using six learner-specific dimensions: self-assessment, abstraction preference, verbosity preference, perceptual orientation, information processing style, and level of understanding, yielding 96 distinct learner profiles. Student queries are additionally analyzed using Bloom’s Taxonomy to estimate cognitive complexity at the interaction level. Learner attributes and cognitive assessments are encoded in structured prompts that condition the LLM without requiring model retraining. The framework is evaluated through experiments using NLP metrics and a human study with five participants. Results show perceived differences in response style and structure across personalization conditions, with statistical analyses identifying learner attributes associated with measurable response changes. These findings provide preliminary evidence that prompt-based personalization can support adaptive behavior in LLM-powered educational agents.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03402 (HTTP 429)
Authors: Saptarshi Basu, Sandeep Kakar, Ashok Goel
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03402.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03402
Published: 2026-09-05T01:23:32.676Z
6. Caught in the Story: Narrative Captivity in Multi-turn LLMs Conversation
Abstract:People increasingly turn to large language models (LLMs) for everyday advice, making ethically charged interpersonal problems a practical moral-advisory context. Most prior work has studied this context through single-turn judgments or pressure-laden rebuttals, assumptions that poorly match how guidance is sought in real-world contexts. These assumptions leave unclear whether narration alone, without an explicit opposing position, can shift model judgments during multi-turn moral consultation. Yet real-world moral-conflict conversation often elicits one party’s self-justifying account, which can unfold over multiple turns and create information asymmetry. We introduce \textbf{narrative captivity}, a failure mode in which a model treats an unopposed one-sided account as complete and aligns with the narrator’s interpretation without seeking missing perspectives. To measure this phenomenon, we build a benchmark of $5{,}078$ interpersonal-conflict scenarios spanning six moral dimensions. Across 17 LLMs, narrative captivity is widespread: end-state judgments under multi-turn narration shift by 25 percentage points on average beyond the matched single-turn baseline. Stage-level analysis identifies preference optimization as a major contributor, while four inference-time strategies provide only partial mitigation. We hope our project fosters LLM advisors that preserve independent judgment in real-world consultation.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03407 (HTTP 429)
Authors: Yuhe Wu, Guangyu Wang, Yujie Chen, Jiatong Zhang, Yuran Chen, Yutong Zhang, Xiyin Cheng, Wenpeng Cao, Zhuang Liu, Guang Zhang
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03407.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03407
Published: 2026-09-05T01:23:32.676Z
7. Dude: A Dual-Detection Multi-Agent System for Paper-Code Discrepancy Detection
Abstract:LLM-empowered paper-code discrepancy detection has received growing concern since the scaling of research submissions exceeds the manual review capability. However, the limited context capacity and one-sided discrepancy detection of existing single-agent LLM paradigms lead to an inferior recall performance in detecting discrepancies. In this paper, we propose Dude, the first Dual-Detection Multi-Agent System for paper-code discrepancy detection. We discover that the granularity asymmetry of the paper-language and code-language introduces over-interpretation and over-reporting challenges in a multi-agent system design for discrepancy detection, resulting in increasing false positives. To address this, we propose a granularity-aligned negotiation and a two-stage salience-filtering mechanism in Dude, which effectively prevents agents from falsely reporting discrepancies. Experimental results in real-world paper-code discrepancy datasets showcase Dude’s significant recall and precision improvement by up to 22.8%, increasing F1 score by up to 18.7% compared to baseline methods.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03416 (HTTP 429)
Authors: Weijie Liu, Running Zhao, Wenhao Yuan, Jinfeng Xu, Zhanfeng Xu, Xiaoxi Zhang, Edith Cheuk-Han Ngai
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03416.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03416
Published: 2026-09-05T01:23:32.676Z
8. DuplexSpeechBench-IFEval: Evaluating Implicit Instruction Following in Full-Duplex Voice Agents
Abstract:Full-duplex voice agents must continuously decide when to listen, backchannel, interrupt, handle speech overlaps, take the floor, and yield. Existing benchmarks largely test these behaviors through explicit turn-management instructions, while deployed agents are often configured through roles or personas from which the appropriate conversational behavior must be inferred. We introduce DuplexSpeechBench-IFEval (DSB-IFEval) for evaluating implicit instruction-following in real-time spoken interaction. (DSB-IFEval) comprises 1,038 test cases spanning eight diverse assistant roles and evaluates five conditioning protocols for instruction-following: default behavior, explicit behavioral instructions, persona-implied behavior, combined persona—rule conditioning, and instruction conflict. We measure real-time floor management using a deterministic Instruction Adherence Score (IAS) and persona-consistent content using LLM-judged Persona Adherence Score (PAS). Across six real-time speech systems, we find architecture-dependent trade-offs. Full duplex models like F-Actor and PersonaPlex are more sensitive to whether conversational behavior is stated explicitly or must be inferred from a persona, with adherence dropping by 9.7% and 4.5%, respectively, under persona-only conditioning. In contrast, GPT-Realtime, MiniCPM-o, and Fun-Audio-Chat strongly adhere to persona-consistent content, but their floor behavior does not adapt across explicit and persona-only instructions and remains constrained on several proactive actions. We further find that even if systems reliably follow conflicting directives to their prescribed persona, they still struggle to override them under safety conflict. These results show that inferring the behavior implied by a role, executing it at the appropriate conversational moment, and resolving competing instructions remain distinct challenges for full-duplex voice agents.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03423 (HTTP 429)
Authors: Puneet Mathur, Dinesh Manocha
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03423.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03423
Published: 2026-09-05T01:23:32.676Z
9. Do GUI Agents Know When Not to Act? Enabling Conflict-Aware Termination for Multimodal GUI Agents
Abstract:Graphical user interface (GUI) agents are increasingly used to execute natural-language instructions on user interfaces, yet real users may issue infeasible instructions due to benign mistakes. A reliable agent should not only know how to act, but also when not to act. In this work, we introduce CONFLICTGUI, a benchmark covering instruction-internal conflicts and instruction-GUI context conflicts to study conflict-aware termination. Our evaluation reveals severe execution-biased overcompliance: agents that perform well on feasible tasks often continue to execute blindly under conflicting instructions. To mitigate this behavior, we propose CONFLICTGUARD, an inference-time framework that aligns an agent’s feasibility awareness with its action generation. CONFLICTGUARD contains two coupled components: a feasibility verification protocol that guides the agent to assess instruction logic and GUI-side evidence before acting, and a conditional action modulation mechanism that steers agents from over-compliant execution into termination-oriented behavior. Experiments across five widely-used agents demonstrate that CONFLICTGUARD improves average conflict task success rate significantly, while preserving normal GUI-task performance. These results validate that a lightweight inference-time intervention can substantially boost GUI Agent’s competence to identify inappropriate execution scenarios and refrain from unnecessary actions.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03438 (HTTP 429)
Authors: Zhaoyuan Huang, Tianjie Ju, Pengzhou Cheng, Zheng Wu, Yansi Li, Chuanbiao Song, Jun Lan, Huijia Zhu, Weiqiang Wang, Zhuosheng Zhang
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03438.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03438
Published: 2026-09-05T01:23:32.676Z
10. Beyond “Made with AI”: Visualizing Provenance Density to Mitigate the Transparency Penalty
Abstract:As generative AI makes polished prose cheap to produce, users can no longer rely on fluency as a proxy for truth. We call this failure mode the Fluency Trap: users trust fluent hallucinations while also discounting accurate content once it is disclosed as AI-generated. Binary ``Made with AI’’ labels respond with authorship disclosure, but they do not show what supports a claim. We propose Provenance Density, an evidence-visualization interface that shows the density of verified claims in a text. In a user study with 81 participants, an idealized Provenance Density interface produced a large discernment gap between truth and fabrication ($+4.15$ points, $d=1.82$), whereas participants given no signal showed no detectable discrimination. A technical audit with 200 samples shows that retrieval density alone is insufficient; unexpectedly, the Consistency Veto carries most of the discriminative signal on dynamic queries. As AI-generated content becomes indistinguishable from human writing, effective transparency must move from authorship disclosure toward evidence visualization.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03460 (HTTP 429)
Authors: Qing Zhang, Yifei Huang, Juyoung Lee, Thad Starner, Jun Rekimoto
Categories: cs.AI
PDF URL: https://arxiv.org/pdf/2609.03460.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03460
Published: 2026-09-05T01:23:32.676Z
VLM Domain Papers
1. IDSPACE: A Novel Document Generator for Reliable Evaluation of Digital Identity Verification Systems [Extended Technical Report]
Abstract:As services move online, trust institutions such as banks, lenders, and governments must verify the identity of remote users. Fraud detection tools are widely available, but evaluating and fine-tuning them remains difficult because identity documents are sensitive and therefore scarce. Synthetic data generation offers a path forward, and demand is clear: our prior work in this area has been downloaded over $11{,}000$ times (aggregated from eight parts). We introduce IDSpace, extending this line of research in three directions. First, we propose model-guided Bayesian optimization, which tunes generation parameters to maximize both visual similarity and prediction consistency with target-domain models given only a few samples from a target domain. Second, we decouple user-specified metadata (demographics, fraud patterns, capture device) from automatically tuned control parameters (font styles, noise levels, image quality), allowing users to configure evaluations without low-level expertise. Third, we expand beyond template images to support scanned and mobile-captured documents. Experiments show IDSpace improves evaluation consistency by $15-45\%$ over baselines including CycleGAN, diffusion inpainting, and non-guided optimization, using only a few real samples, while improving training accuracy by up to $9\%$ and SSIM similarity with the target domain by $10\%$. We also released a new dataset consisting of $359{,}240$ high-quality synthetic documents across ten European ID types.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03052 (HTTP 429)
Authors: Lulu Xie, Yancheng Wang, Kanchan Chowdhury, Rolando Garcia, Yingzhen Yang, Jia Zou
Categories: cs.CV
PDF URL: https://arxiv.org/pdf/2609.03052.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03052
Published: 2026-09-05T01:23:44.984Z
2. Position: Unlabeled IS NOT Equal to No Human Supervision in Visual Learning
Abstract:This position paper argues that the absence of labels does not imply the absence of human supervision in visual learning, and urges the research community to identify sources of supervision more explicitly. Many recent methods in computer vision build upon representations learned from large-scale unlabeled data, and are therefore grouped under the same umbrella term unsupervised.'' However, different data curation schemes and training objectives embed substantially different human priors on which models rely, and we argue that oneunsupervised’’ umbrella term is no longer capturing these distinctions. This ambiguity makes it harder to compare unsupervised learning research conducted under different assumptions, coinciding with a sharp decline in papers titled with ``unsupervised’’ in flagship computer vision conferences since 2021, despite continued growth of the field. While we fully embrace pre-training as a strong foundation for modern computer vision, we advocate for a community-level effort toward greater conceptual clarity: authors are encouraged to disclose priors in data selection and learning objectives, and to specify which components of a learning pipeline depend on which assumptions. Standardized disclosure practices can improve academic communication, ensure fairer comparisons, and preserve methodological diversity in unsupervised learning.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03077 (HTTP 429)
Authors: Dong Lao
Categories: cs.CV
PDF URL: https://arxiv.org/pdf/2609.03077.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03077
Published: 2026-09-05T01:23:44.984Z
3. Exemplar: Classical Priors Complement Frozen Features for Few-Shot Microscopy Segmentation at Native Resolution
Abstract:Segmenting a new biomedical dataset usually means a domain-specific model trained on substantial annotation, or a foundation model steered at inference time. We present Exemplar, a few-shot segmenter that fuses a frozen DINOv3 backbone with a fixed bank of classical native-resolution filter responses in one lightweight head, fitted from the support masks alone. In the few-mask, native-resolution regime, classical priors and frozen self-supervised features are complementary: fused in one head, a single fixed configuration spans eleven biomedical imaging datasets. Under the same head, the classical bank alone reaches 0.693 on the eleven-dataset panel, scored by foreground intersection-over-union or centreline Dice, and the frozen features alone 0.672; the bank leads on seven of the eleven and the features on the rest, and fused they reach 0.782. Against five forward-pass few-shot methods, Exemplar leads in 54 of 55 method-dataset comparisons, 52 of them significant after Holm correction. From a single annotated mask it reaches 0.703 on the same panel, against 0.682 for a from-scratch nnU-Net trained on that same mask. At eight masks nnU-Net overtakes it on the panel mean, chiefly on centreline agreement, but takes 16-77x longer to fit.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03080 (HTTP 429)
Authors: Michal Průšek, Adam Novozámský, Filip Šroubek
Categories: cs.CV
PDF URL: https://arxiv.org/pdf/2609.03080.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03080
Published: 2026-09-05T01:23:44.984Z
4. Solving the Needle-in-a-Haystack Problem in Mammography Vision-Language Model with Differentiable Subset Sampling
Abstract:There is growing interest in adopting CLIP-style vision—language model (VLM) pretraining for mammography. However, models that directly employ the standard CLIP architecture and training objective exhibit limited zero-shot performance in clinically important tasks such as cancer, finding-type, and BI-RADS predictions. We argue that this underwhelming performance is due to neglecting two characteristics of mammography data: (1) its high-res nature, and (2) homogeneity of radiology reports, largely driven by a predominance of negative/benign findings on examinations. We propose TopKSigLIP, a VLM designed to address these two limitations through a novel architecture and learning objectives. Instead of downscaling high-res mammography images to satisfy GPU memory constraints, TopKSigLIP introduces TopK-Patch module that learns to sample a sparse set of high-res patches likely to contain lesions, sidestepping the resolution—batch size tradeoff of VLM training. The sampled patch locations additionally serve as a built-in localization tool. To address report homogeneity, we replace the contrastive loss, which falsely repels semantically similar pairs, with a Sup-sigmoid loss. Sup-sigmoid loss extends the sigmoid loss from SigLIP with soft labels derived from structured data. TopKSigLIP outperforms existing open-source mammography and general medical VLMs on both internal and external benchmarks on density assessment, BI-RADS classification, finding subtyping, and cancer prediction under zero-shot evaluation. TopKSigLIP remains competitive under linear probing despite using a significantly smaller vision encoder and smaller training batches than baselines. The TopK-Patch module additionally achieves superior lesion localization over post-hoc Grad-CAM. Code and weights are made public:this https URL.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03085 (HTTP 429)
Authors: Young Seok Jeon, Beatrice Brown-Mulry, Rohan Satya Isaac, Anjana Dissanayaka, Theo Dapamede, Mohammadreza Chavoshi, Judy Gichoya, Hari Trivedi
Categories: cs.CV
PDF URL: https://arxiv.org/pdf/2609.03085.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03085
Published: 2026-09-05T01:23:44.984Z
5. WireSeg-32K: A Physics-Grounded Synthetic Dataset for Wire Instance Segmentation
Abstract:Deformable linear objects such as wires and cables are difficult to segment because they are thin, highly deformable, and frequently self-occluded, while large-scale instance-level annotations are expensive to obtain in real scenes. Existing resources either focus on cable tracing or semantic segmentation under constrained settings, or generate visually plausible images without physically grounded wire deformation. We present WireSeg-32k, a synthetic dataset for wire instance segmentation with 32,000 RGB images, instance masks, depth maps, and a complementary real-world test set with annotations. To generate this dataset, we develop DeformX, a co-simulation pipeline that couples Cosserat-rod dynamics with photorealistic Isaac Sim rendering, enabling physically plausible, contact-consistent wire shapes, CAD-based wire assets, and diverse visually grounded scenes. As a simple baseline, LoRA fine-tuning SAM3 on WireSeg-32k alone improves real-world mAP@75 by 10.2% over the off-the-shelf model, showing that physically grounded synthetic data can transfer to real wire perception.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03102 (HTTP 429)
Authors: Zilin Dai, Lehong Wang, Yi Yang, Xiang Fei
Categories: cs.CV
PDF URL: https://arxiv.org/pdf/2609.03102.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03102
Published: 2026-09-05T01:23:44.984Z
6. SLIDEFORGE: An LLM Agent for Controllable Editing of Slides as Structured Artifacts
Abstract:Current AI agents compellingly describe slides. However, AI-assisted slide editing requires more than understanding: the output must retain layout, style, component structure, and native editability. Towards, AI-assisted slide editing, existing agents operate on screenshots or weak document representations and often fragment coherent visual units, rasterize editable content, or break layout. In contrast, for controllable slide editing, we introduce an agentic framework, SLIDEFORGE, which builds a Deck State Graph, an executable slide state that links visual decomposition, native pptx object structure, and perceptual organization. By recovering human-referable components while retaining fine-grained editable structure, SLIDEFORGE supports theme-preserving reconstruction through slide-native operations and rendered-state verification. We further introduce an evaluation paradigm for controllable slide transformation that jointly measures component recovery, preservation, restyling consistency, visual quality, and native editability. Experiments show that SLIDEFORGE outperforms direct prompting, screenshot-based agents, and generic code-agent baselines across these dimensions. Code is available at this https URL.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03109 (HTTP 429)
Authors: Haozhen Zheng, Fulin Wang, Tianhu Xiong, Yingjie Yu, Shengyi Qian, Hanchao Yu, Alex Schwing, Klara Nahrstedt, Mingyuan Wu
Categories: cs.CV
PDF URL: https://arxiv.org/pdf/2609.03109.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03109
Published: 2026-09-05T01:23:44.984Z
7. Beyond Small Patches: Black-Box Detection and Purification of Diverse Backdoor Triggers
Abstract:Deep neural networks (DNNs) are increasingly deployed in real-world vision systems, yet their predictions can be covertly manipulated by backdoor attacks, in which malicious triggers cause targeted misclassification while preserving high clean accuracy. Existing defenses often rely on model internals, training data, or clean validation samples, making them difficult to deploy when only black-box access to a trained model is available. We propose TRIM (Trigger Removal by Identifying Manipulated Regions), a deployment-oriented black-box defense that detects and selectively removes backdoor triggers at inference time without requiring model internals, training data, or clean samples. The key insight behind TRIM is to identify image regions that are responsible for anomalous model behavior and purify only those regions while preserving benign content. TRIM innovates via three key components: (i) region-based segmentation with deep feature representations, (ii) adaptive trigger discovery through inpainting and diffusion-based reconstruction to isolate regions responsible for misclassification—-without assumptions about trigger type, shape, or location, and (iii) selective region purification that cleans poisoned regions while retaining benign content. To support practical deployment, TRIM further caches feature embeddings of previously identified triggers, enabling efficient recognition and avoiding redundant detection and purification. Extensive experiments across diverse datasets and backdoor types, including blended, sparse, varying-size, and multiple triggers, show that TRIM consistently outperforms existing black-box defenses, reducing attack success rates (ASR) to as low as 1.16% while preserving clean accuracy of up to 87.87%. These results demonstrate that effective backdoor mitigation is possible at inference time even when the defender has no access to any auxiliary data.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03139 (HTTP 429)
Authors: Ahmed Abdelnaby, Mohamed Elmahallawy
Categories: cs.CV
PDF URL: https://arxiv.org/pdf/2609.03139.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03139
Published: 2026-09-05T01:23:44.984Z
8. VeriPhy: Agentic Physical Reasoning for World Model Evaluation and Refinement
Abstract:Visual fluency in generated video does not imply physical reliability, and a scalar quality score alone is incapable of indicating the obligation a clip violates or the moment it fails. We present VeriPhy, an auditable physical-verification system in which a text-only planner compiles the prompt into typed physical obligations and a statically validated execution plan before any frame is observed. During execution, observations gate and scope only declared calls to frozen low-level experts (e.g., segmentation and tracking, counting, eleven typed physical measurements over the resulting tracks, depth, OCR, and audio-event detection). Each action returns a provenance-carrying evidence record whose payload, when usable, is either a typed measurement or an explicitly tagged learned state. Typed resolvers and fixed composition map usable records to a three-valued state (supported, contradicted, or unknown, surfaced as plausible, implausible, or abstain) with full provenance, so that every verdict is traceable to the evidence that produced it. We anchor evaluation in a 1,500-clip corpus of human-annotated flaw records that localize real generation failures in prompt reference, space, and time. On a 149-clip core carrying 304 such records, VeriPhy accounts for 228, against 164 for a published question-decomposition evaluator given the same clips and the same claims. Recall alone does not separate it from prompting the same backbone monolithically, which reaches 222; what separates them is that each decision retains its evidence record and provenance, making the traces auditable one verdict at a time and usable as the interface through which a critic verdict could be written back into generation.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
Q: 这篇论文试图解决什么问题? 这篇论文针对的是\*\*生成视频在物理可靠性评估与诊断方面的系统性缺失\*\*,具体可从以下三个层面理解: --- ### 1. 视觉流畅性与物理有效性之间的鸿沟 当代视频生成模型能够合成视觉流畅、时序连贯且音画同步的片段,但\*\*视觉上的可信度并不等同于物理上的正确性\*\*。论文指出,生成视频中可能出现多种物理失效: - \*\*视觉流\*\*:物体在重力下悬空、轨迹与受力不一致、刚体穿透、碰撞缺失或因果错乱; - \*\*声学流\*\*:预期声音缺失、错位或归因错误; - \*\*跨模态流\*\*:视觉与声学事件在时序或因果上相互矛盾。 这些失效在视频被用于具身智能系统的训练与评估循环时尤为危险。 --- ### 2. 现有评估方法的结构性局限 论文指出,当前物理诊断能力分散在不同基准和协议中,缺乏一个\*\*可审计的(auditable)统一证据链\*\*: - 多数评估器输出\*\*标量质量分\*\*或\*\*规则级判断\*\*,无法说明视频具体违反了提示中的哪一条物理义务,也无法定位失效发生的时刻与空间区域; - 虽有工作涉足时序定位、声学-物理一致性、测量驱动测试等,但通常围绕\*\*人工编纂的评分标准、 curated 数据集或特定现象\*\*组织,难以泛化到开放式提示; - 即使采用问题分解(question decomposition)或视觉问答,其支持证据仍由评判模型自身产生,缺乏独立的测量溯源。 --- ### 3. 缺乏“提示编译 + 静态规划 + 专家测量”的闭环验证 论文强调,一个可辩护的物理裁决必须能够: - 在\*\*读取任何帧之前\*\*,将自然语言提示编译为\*\*类型化的物理义务(typed physical obligations)\*\*; - 通过\*\*静态验证的执行计划\*\*明确需要检验什么、如何检验; - 在运行时让\*\*观测结果门控(gate)和限定(scope)\*\*已声明的低级专家调用(分割追踪、计数、深度、OCR、音频事件检测等); - 将每条专家返回的\*\*带溯源的证据记录(provenance-carrying evidence record)\*\*通过固定规则组合为\*\*三值决策\*\*(supported / contradicted / unknown,对应 plausible / implausible / abstain),使得\*\*每一个裁决都可追溯到具体的提示片段、计划节点、时间窗口和测量数值\*\*。 --- ### 总结 简言之,论文试图解决的核心问题是: > \*\*如何在无预设评分标准的前提下,对开放式提示生成的视频进行可审计、可定位、基于独立专家测量的物理一致性验证,并建立从“文本义务”到“时空证据”再到“可推翻裁决”的完整链条。\*\* 为此,作者提出了 \*\*VeriPhy\*\* 系统,并配套构建了一个包含 1,500 个片段、2,582 条人工标注缺陷记录的语料库,以及一个基于 MuJoCo 模拟控制的条件生成测试平台,以分别对批评器(critic)和生成器进行可分离的评估与改进。 Q2: 有哪些相关研究? 这篇论文的相关研究可归纳为三大主线,分别对应生成控制、评估诊断与执行框架三个层面。 --- ### 1. 物理感知生成与优化(Physics-aware Generation and Refinement) 该领域关注如何将物理约束注入视频生成过程,或利用物理反馈改进生成结果。 - \*\*可控视频生成\*\*:通过深度、分割、参考帧、掩码、运动场及组合时空信号对扩散模型进行结构引导,实现外观与结构的分离合成
33, 71, 74, 87
。 - **仿真驱动的生成控制**:从物理推理或仿真中推导控制信号,包括场景属性推断与重建、仿真轨迹/流场引导合成、文本物理上下文细化提示,以及将语言编译为粗略运动计划
2, 19, 45, 54, 56, 80, 83, 86
。 - **评估反馈优化**:利用评估信号进行偏好优化、验证引导的候选搜索与局部再生
20, 37, 44
。 **与本文的关系**:VeriPhy 明确将生成与评估解耦——MuJoCo 仿真的几何控制驱动冻结的 Wan 2.2-VACE 生成器
33, 70, 71
,而 VeriPhy 作为独立批评器(critic)对生成结果进行物理验证,从而区分“对控制信号的遵循”与“合成输出的物理有效性”。 —- ### 2. 模型判断、问题分解与物理评估(Model Judgments, Decomposition, and Physical Evaluation) 该领域研究如何自动评判视频质量,并逐步从标量评分转向结构化、可解释的物理诊断。 - **通用视频评估协议**:从聚合的感知质量、时序一致性扩展到提示对齐度等多维评分
26, 27, 31, 46, 47, 68
。 - **提示分解方法**:将自然语言提示翻译为命题、问题或查询链,通过细粒度的小规模检查回访视觉输入
10, 25, 28, 43
;这类方法使检查显式化,但支持证据通常仍由评判模型自身产生。 - **物理导向基准**:引入现象级、规则级、轨迹级与提示特定的评估标准,涵盖准则级推理、失效定位、受控测量及视听一致性
3, 4, 8, 9, 14, 22, 42, 49, 51, 55, 73, 77, 88, 92
。 - **AV-Phys Agent**
14
:作为近邻对比点,该系统结合推理–动作循环与确定性声学工具,但其发布协议仍绑定于提示特定的人工评分标准与多模态模型的二元判断。 **与本文的关系**:VeriPhy 并非引入某一孤立能力(如规则判断、时序定位或声学测量),而是将这些能力整合进**单一的、可审计的证据链**——在读取任何帧之前将提示编译为类型化物理义务,并通过固定规则组合专家测量,输出带完整溯源的三值决策。 —- ### 3. 执行框架、上下文工程与持久状态(Execution Harnesses, Context Engineering, and Persistent State) 该领域关注如何将编排逻辑与模型判断分离,并管理代理在跨 episode 中的记忆与上下文。 - **执行框架(Execution Harnesses)**:显式化规划、依赖管理、专家路由、观测范围限定、验证、终止与追踪日志
35, 60, 65, 78, 82
。 - **模块化视觉/视频推理**:引入专门感知、选择性观测与自适应时间采样
13, 17, 23, 39, 52, 53, 67, 69, 75, 76
。 - **视频评估流水线**:组合提示结构化、时序工具、形式化规范与模型检测、局部修复、确定性声学测量或提示特定评分标准
12, 14, 64, 84
。 - **持久状态与记忆**:跨 episode 构建上下文,将轨迹蒸馏为反思经验、可复用策略或结构化知识,并区分记录证据与推导信念以减少上下文污染
30, 36, 57, 66, 81, 90
。 **与本文的关系**:VeriPhy 在这些组件之上建立了一个统一的**验证契约**(verification contract): - 开放提示被编译为类型化义务与经验证的静态计划; - 观测仅门控或限定已声明的调用; - 测量值与习得状态显式区分; - 固定规则生成初始三值主张,任何复核覆盖单独留存在溯源记录中。 此外,VeriPhy 的上下文训练自进化(Section 5.4)以无权重更新的方式,将从经验池中蒸馏的教训加载为可读状态,属于上述记忆与上下文工程脉络的延伸。 Q3: 论文如何解决这个问题? 论文通过提出 **VeriPhy** 这一集成化的物理验证系统,辅以物理引导的生成测试平台与细粒度缺陷基准,从“评估工具链”和“验证方法论”两个层面解决了生成视频的物理可靠性审计难题。具体解决路径如下。 —- ### 1. 系统架构:四个角色的约束式推理–执行–观察循环 VeriPhy 将物理批评器(critic)组织为四个严格分离的角色,核心不变式为:**工具输出驱动执行,但执行范围被限定在计划预先声明的义务之内**。 | 角色 | 职责 | 输入/时机 | |———|———|—————-| | **文本规划器(Text-only Planner)** | 将提示编译为精确引用的类型化物理义务与可执行测量计划 | 仅读取提示,**在观察任何视频帧之前**完成 | | **视频感知语义验证器(Semantic Verifier)** | 对带时间戳的帧进行稠密读取,判断存在性与事件 occurrence | 仅在需要时读取已声明的帧区间 | | **冻结专家算子(Specialist Operators)** | 返回定向测量:分割/追踪、计数、11 类物理量、深度、OCR、音频事件 | 被观察结果门控(gate)与限定(scope)后调用 | | **固定组合器(Fixed Composition)** | 以确定性规则将可用证据记录映射为三值裁决 | 不引入新的学习判断 | —- ### 2. 计划先行:提示编译与静态验证(Plan-before-Act) 在接触视频前,规划器执行全局命名与静态验证,解决“开放式提示无预设评分标准”的问题。 - **共享命名空间(Shared Namespace)**:对提示进行第一遍扫描,为每个独立实体与每个独立事件出现分配稳定标识符,防止不同检查片段对同一对象使用不同名称,或对不同出现使用同一名称。 - **表面语言(Surface Language)**:规划器使用受限词汇编写检查程序,包括: - `judge(“assertion”)`:语义验证 - `exists(“object”)`:存在性检查 - `eq(count(“phrase”), N)`:基数检查 - `before(window(A), window(B))` / `during(…)`:时序关系 - `rel(“A||B”, relation)`:空间关系 - `traj(“phrase”, relation, target)`:轨迹谓词 - `sound(“description”)`:音频事件 - `text(“STRING”, carrier=…)`:渲染文本 - **编译为类型化有向图**:表面程序被编译为 G_Pi = (A, Q, E, b) ,其中 A 为证据产生动作, Q 为类型化检查, E 为依赖边, b 将检查绑定到主张。静态验证器确保:
Valid(G_Pi) = Parse land Refs land Typed land Acyclic land [∀ i, ∃ q ∈ Q: b(q)=i]
任何无效行回退到通用语义验证器,且该回退被计费并记录,而非静默丢弃。 —- ### 3. 时间线条件化的多工具执行 执行遵循拓扑序,每个动作 a_j 的已编译范围函数 g_j 将前置证据记录映射到帧索引子集,再调用对应后端:
Omegaj = g_j(R_k : (a_k, a_j) ∈ E, T_V), quad R_j = F(oj)(V|(Omega_j), α_j)
关键机制包括: - **门控(Gating)**:时序检查的前提事件必须先通过语义验证器或音频检测确认为“发生”,其返回的时间窗口才能进入时序谓词;若事件未发生或不可用,相关主张保持为 `unknown`。 - **作用域限定(Scoping)**:专家调用仅在被声明的局部帧区间执行,避免全片盲目处理。 - **公共子表达式消除**:仅当完整实现签名(操作、参数、引用、实现作用域)完全匹配时,两个动作才共享一次执行,防止因自然语言查询相似而错误合并。 - **时序谓词**:采用带容差的 Allen 区间代数变体。对于窗口 $W_X =
s_X, e_X
$,定义松弛量:
δ(A,B) = (1) / (4)min(e_A-s_A, e_B-s_B)
顺序判定为 `supported` 仅当 e_A ≤ s_B + δ(A,B) ;否则若 e_B ≤ s_A + δ(A,B) 则为 `contradicted`;否则为 `unknown`。该规则保证互斥性。 —- ### 4. 物理测量与证据记录:溯源链的构建 针对物理主张,系统通过 **SAM 3** 分割命名主体并跨帧追踪身份,在此基础上执行 11 类共享追踪的测量操作,直接对应人类投诉类别: - **位移**(displacement):以主体自身半径为倍数报告,消除场景标定需求;方向取最大偏移而非净偏移;通过稠密光流剔除相机运动。 - **接触**(contact):两追踪掩膜的最小接近距离。 - **形状变化**(shape change):相对于背景流的表面运动(用于检测原地滚动等零净位移情形)。 - **路径形状**(path shape):区分圆形与八字形等。 - **持续性**(permanence)、**弹跳计数**(hop counting)、**阻尼**(damping)、**起始顺序**(onset ordering)、**片段时长**(clip timing)、**视角运动**(viewpoint motion)。 每个动作返回一条**主张绑定的证据记录**:
R_(j,i) = langle id(V), p, s_i, o_j, Omega_j, σ_j, μ_j, h_j, kappa_j rangle
其中 σ_j ∈ measured, abstained, errored ; μ_j 承载类型化测量或显式标记的习得基态; h_j 包含制品哈希; kappa_j 记录成本。测量与仪器失败被严格区分:有效负测量(完整追踪但无请求运动)记为 `measured` 并可反驳主张;而追踪失败(模糊、遮挡、低质量)记为 `abstained`,避免将仪器失败转化为对视频的指控。 —- ### 5. 裁决聚合与诊断:三值决策与可审计性 通过确定性汇总将子检查状态 z_q ∈ S, C, U (supported / contradicted / unknown)逐层上卷: - **主张级**:
y_i = C, & ∃ q ∈ K_i: z_q = C S, & ∀ q ∈ K_i: z_q = S U, & otherwise
- **片段级**:
Y = bot(infra), & 基础设施错误 Implausible, & ∃ i: y_i = C Plausible, & N_p ≥ 1 land ∀ i: y_i = S Abstain, & otherwise
两项习得精炼作用于上述确定性骨架之上: 1. **复核验证器**:更强的模型仅复核语义验证器通过的项,若推翻则记为 `contradicted` 而非 `unknown`,两项裁决均保留。 2. **识别引擎**:对文本主张使用 OCR 识别头而非生成模型,返回字形直译,通过确定性字符串比较捕获拼写错误。 最终输出的**局部化矛盾包**(localized contradiction packet)为:
F(p, V) = { langle c_i, R(j,i)j, Omega_i, B_i rangle : y_i = C }
其明确包含:哪条义务失败、基于哪些证据记录、失败发生的时域 Omega_i 与空域 B_i (掩膜或包围盒)。这使每个裁决都可逐条追溯至提示片段、计划调用、时间窗口与测量数值。 —- ### 6. 物理引导的生成测试平台(独立但互补) 为将“对控制信号的遵循”与“合成输出的物理有效性”分离,论文构建了一个**基于可信物理求解器的生成测试床**: 1. **从事件描述到注册控制**: - 语言模型将事件描述 p(ev) 编译为结构化场景规范 S (刚体、初始状态、碰撞器、静态表面、相机)。 - MuJoCo 求解器运行仿真得到轨迹 τ ,经事件特定谓词 Phi(ev) 验证(最多 3 次修订/4 次仿真)。 - 渲染器将验证后的轨迹转为深度控制视频 C = (C_t)(t=0)^(T-1) ,其中:
Ct(u) = 1 - clip((D_t(u) - d-) / (d+ - d-), 0, 1)
基于全片非背景深度的 1% 与 97% 分位数归一化,保证同一场景中同一距离对应同一强度。 2. **条件化视频生成**: - 使用 Wan 2.2-VACE 在潜空间视频扩散 transformer 中,通过控制分支将深度/轮廓控制 C 以残差形式注入每层:
hi^((ell)) arrow h_i^((ell)) + s , W^((ell)) z(ctrl)
其中 s 为条件强度,掩膜全白以确保控制仅通过分支影响生成,而非直接复制外观。 3. **控制撤回分析(机制探针)**: - 在替代主干上研究控制可在何种噪声水平 σ(rel) 撤除。发现轨迹在 σ ≈ 0.94 – 0.96 的窄带内即对控制移除不敏感,处于采样高噪声段,说明运动在扩散早期即被“锁定”。 —- ### 7. 基准与评估协议:以人类缺陷记录为真值 论文构建了 **1,500 片段、2,582 条人工标注缺陷记录**的语料库,每条记录包含: - 违反的提示原文片段(verbatim span) - 自由文本理由、严重程度、置信度 - 可选时间跨度与包围盒轨迹 通过**缺陷级匹配协议**(而非仅片段级标量)评估系统:将批评器的发现与人类记录按语义整体匹配、部分匹配或未匹配进行最大二分匹配,从而精确度量召回率与定位能力。在此协议上,VeriPhy 在 149 片段核心集(304 条缺陷)上达到 **75.0%** 的召回率(228/304),相对于同类问题分解评估器的 53.9%(164/304)具有显著优势,且每个发现都附带可审计的证据链。 —- ### 总结 论文的解决方案可概括为:**在观看视频之前,先将开放式自然语言提示“编译”为类型化、可静态验证的物理义务与测量程序;在运行时让视频观察结果严格门控和限定对已声明的冻结专家的调用;通过确定性规则将专家返回的带溯源测量记录组合为三值裁决;最终以人类可读的溯源链形式输出“哪里、何时、基于何种证据”失效。** 这一设计将物理验证从黑箱标量评分转变为可审计、可定位、可改进的结构化过程。 Q4: 论文做了哪些实验? 论文的实验围绕**物理引导的生成控制**与**VeriPhy 批评器(critic)的评估能力**两条主线展开,分布在第 5 节。以下按实验模块系统梳理。 —- ## 1. 共享实验设置(Section 5.1) ### 1.1 模型与后端 - **规划器与语义验证器**:Qwen3-VL-30B-A3B-Instruct(BF16,无量化),文本规划与视频验证分两次调用。 - **冻结专家栈**:SAM 3(分割/追踪/计数)、TAPNext++(11 类物理测量)、深度排序模型、PaddleOCR(文本)、FlexSED(音频事件检测),以及一个闭源复核模型(gpt-5.6-sol)。全部冻结在指定版本。 ### 1.2 人工标注缺陷基准 - **规模**:1,500 个生成片段,2,582 条人工书写的缺陷记录。 - **核心评估集**:通过“仅视觉可见”筛选与分层随机抽样,得到 **150 片段 / 306 条缺陷**的冻结核心;其中 149 片段 / 304 条缺陷用于召回计算(1 个片段无测量数据)。 - **匹配协议**:缺陷级(而非片段级)评估。将批评器发现与人类记录按语义做最大二分匹配,判定为**整体匹配(whole)**、**部分匹配(partial)**或**遗漏(missed)**。 —- ## 2. 物理引导生成器实验(Section 5.2) ### 2.1 控制保真度与提示对抗(Section 5.2.2) **目的**:验证几何控制能否覆盖提示隐含的运动描述。 - **设置**:固定同一深度控制视频,仅变化运动描述子句: - 强水平穿越(与控制一致) - 中性描述 - 对抗性描述(几乎垂直下落,与控制矛盾) - **控制模式**:无控制、仅前 10/50 步控制、全部 50 步控制。 - **关键结果**: - 无控制时,提示主导运动,种子间水平位移差异达 **0.875**(帧宽比例)。 - 全程控制时,提示可解释的运动范围降至 **0.001**。 - **前 10 步控制即可锁定飞行轨迹**,但着陆后的滚动行为在控制撤除后偏离(控制球滚至 0.99 帧宽,生成球停在 0.77)。 ### 2.2 轨迹承诺点:控制撤回分析(Section 5.2.3) **目的**:定位扩散采样中轨迹对控制信号“锁定”的噪声水平。 - **设置**:在替代主干(Wan2.2 衍生,支持直接移除源 token)上,于不同噪声水平 σ(rel) 撤除控制;场景包括抛球、落球、斜坡滚球。 - **度量**:生成轨迹与仿真轨迹的逐轴 Pearson 相关系数(retention),分**空中(airborne)**与**接触后(after-contact)**两个窗口。 - **关键结果**: - 空中飞行在很早撤除( σ = 0.952 )时仍保持 Rx = 1.00 。 - 接触后行为对撤除敏感:抛球在 σ = 0.952 时水平相关降至 **-0.63**(与仿真反向),需到 σ ≈ 0.94 – 0.96 之后才恢复至 0.98+ 。 - **两轴锁定不同步**:水平先恢复,垂直后恢复,说明需分别监测。 ### 2.3 场景库广度与失效边界(Section 5.2.4) **目的**:测试流水线在复杂场景下的可扩展性。 - **设置**:构建 66 类共 1,314 个场景,通过预渲染检查 591 个;涵盖单刚体、多体接触、布料/绳索/颗粒/浮力等。 - **关键结果**: - 单物体场景轨迹复现良好(如跨帧相关性达 1.0000/0.9998)。 - **多体交互失效**:如台球开球,无法使每个刚体都按仿真指定运动;可变形体/颗粒体的控制渲染在深度图中可能与背景融合,导致追踪困难。 —- ## 3. VeriPhy 批评器实验(Section 5.3) ### 3.1 核心集缺陷召回率(Section 5.3.1) **目的**:在精确的人工缺陷标注上度量批评器定位真实物理/语义失效的能力。 - **设置**:149 片段 / 304 条缺陷;与问题分解评估器、同模型单轮自由文本提示、场景图方法对比。 - **结果**: - **VeriPhy**:**228/304(75.0%)**,其中 191 整体匹配,37 部分匹配。 - **问题分解基线**:164/304(53.9%)。 - **同模型单轮提示(Single-pass VLM)**:222/304(73.0%),但输出为自由文本列表,**无逐条证据与溯源**。 - **成本**:VeriPhy 平均每片段 14.1 次模型/工具调用;问题分解 21.9 次;单轮提示 1.0 次。 ### 3.2 按类别与片段属性的召回分解(Section 5.3.1) - **按注释类别**(表 3): - 相机与风格:**90%** - 屏幕文本:**84%** - 动作或事件发生:**83%** - 计数(how many):**49%**(最低,因模式化降采样导致间歇检测失败) - 物理运动(变形等):57%(样本仅 7 条,描述性) - **按片段属性**(严重性、时长、缺陷数、难度层):子组召回率与总体(75%)相差约 10 个百分点以内,无显著预测因子。 ### 3.3 专家测量轨迹展示(Section 5.3.2) **目的**:展示测量驱动发现与“印象式”判断的差异。 - **案例**(图 10):海豚跳跃(垂直位移 0.00 半径)、水瓶滚动(表面运动与背景流一致,实为相机运动)、太阳静止(峰值位移不足)、婴儿计数(精确模式 5 vs 7)、F-22 计数(4 vs 3)、毕业横幅 OCR(识别头直译为乱码而非生成式修复)。 - **统计**:物理专家调用 227 次,**166 次弃权**(如无法通过语义守卫定位对象),**61 次反驳**。 ### 3.4 与人类片段级评分的一致性(Section 5.3.3) **目的**:将 VeriPhy 与现有片段级评分器在 1–5 分人类评分上对比。 - **设置**:VideoPhy-2 的 200 片段样本(含 55 个困难片段),使用 VideoScore2 的评估脚本。 - **结果**(表 4): - 精确一致率与相邻一致率:VeriPhy 低于 VideoScore2。 - **PLCC / SRCC**:VeriPhy 领先; Q5: 有什么可以进一步探索的点? 基于论文的**结论(Conclusion)**、**局限性(Limitations)**与**路线图(Section C)**,可将未来探索方向归纳为以下六个层面。 —- ### 1. 跨模态物理验证:从视觉到视听一致性 当前所有测量主张均为视觉。论文已架构但未充分执行的,是将音频事件检测与视觉接触窗口置于**共享 A/V 时钟**上的能力: - **声-时同步验证**:建立视觉接触窗口 W(contact) 与音频起始窗口 W(sound) 之间的类型化时序关系(如 rho(before)(W(sound), W(contact)) 检测“先闻其声后见碰撞”); - **跨模态因果诊断**:当视觉与声学对同一事件的编码在时序或因果上冲突时,利用跨模态证据链定位错误源; - **物理基准扩展**:构建同时标注视听故障的语料库,将当前仅针对视觉缺陷的局部化协议扩展至跨模态场景。 —- ### 2. 生成-评估闭环:从文本重写转向几何控制编辑 论文在 Section 5.5 中通过提示重写 rho(p, F) 关闭了端到端循环,但独立评分器(VideoPhy-2 AutoRater)未检测到物理改善。这揭示了一个核心开放问题: - **控制信号局部修正映射 δ(F) **:将矛盾包 F (含时空定位 Omegai 与掩膜 B_i )映射为对 MuJoCo 仿真控制 C 的局部编辑 Delta(ctrl) ,再经 V’ = Gen(p, C + Delta(ctrl)) 重生成,而非仅修改文本提示 p ; - **承诺点自适应调度**:当前控制撤回分析(Section 5.2.3)表明不同物理阶段(空中/接触后)对控制强度 s 的敏感度不同,可探索**阶段性自适应条件强度**而非全局固定 s=1.0 ; - **接触先验强化**:针对视频生成器在接触/碰撞阶段的系统性失效(Section 5.2.3),研究如何在扩散采样的后接触阶段保持控制残差注入。 —- ### 3. 操作符库扩展:覆盖更广泛的物理现象 当前 11 项轨迹测量主要针对刚体运动,对复杂物质形态覆盖不足: - **可变形体与颗粒材料测量**:Section 5.3.1 显示“物理运动”类缺陷(布料折叠错误、非刚性形变)召回率仅 57%,需引入基于粒子追踪或网格形变的测量操作符; - **流体与烟雾仿真**:Section 5.2.4 指出场景库排除了流体、烟雾与有限元软体求解,扩展这些物理域需要新的渲染控制表示(超越深度/轮廓)及对应的专家验证器; - **多体交互验证**:台球开球等多体散射场景当前无法保证每个物体按仿真运动,需要实例级多目标追踪与交互力一致性测量; - **负事件与不存在性验证**:当前系统缺乏稳健的“某事**未**发生”验证能力(如“球不穿过墙壁”),需发展受控的反事实测量框架。 —- ### 4. 系统自进化:从上下文训练到严格门控 Section 5.4 展示了从经验中蒸馏可读教训 Delta M 可提升召回率,但若干关键机制尚未执行: - **接受门控的形式化**:论文提及的代理评分函数 U(val) (Equation 23)在实验中被省略,需建立针对未运行规则的**反事实验证**机制,防止有害先验污染 M ; - **在线累积 vs. 离线蒸馏**:当前教训从固定经验池一次性诱导,未来需测量**部署时持续累积**的效果及其饱和曲线; - **外部知识通道 K 的开启**:为防止内部循环(CoT → 反馈 → 上下文)放大偏见,需实现对外部物理事实/人类修正的检索,并通过与 U(val) 相同的候选-剪枝纪律准入(Section B.6); - **成本约束下的操作符提升**:Phase 2 提出将高频子程序提升为命名操作符并赋予成本节点 c(o) ,在预算 c(G) 约束下优化义务覆盖率。 —- ### 5. 评估协议与基准的完善 当前基准存在结构性限制,需从以下方面补强: - **精度度量(Precision)**:现有语料全为含缺陷片段,无法测量误报。需引入经人工验证的“干净”负样本,建立完整的混淆矩阵与 Youden 统计量 J ; - **跨标注者一致性**:当前为单标注者标注,需引入冗余标注与多数决议以估计标注方差; - **缺陷因果层级**:将缺陷从“现象描述”推进到“物理量违反”(如动量不守恒、穿透深度量化),使测量值可直接与物理定律比对; - ** held-out 泛化验证**:当前核心集为开发集,需冻结 held-out 测试集以报告无偏泛化性能。 —- ### 6. 物理引导生成器的深层机制 - **轨迹承诺的解析理论**:Section 5.2.3 发现运动在 σ ≈ 0.94 – 0.96 锁定,需建立该临界窗口与流匹配调度(Equation 14)及数据层级结构的解析联系; - **多步求解器缓存策略**:清除/保留 UniPC 历史导数对撤回后轨迹的影响(Section 5.2.3)仅初步测量,需系统分析多步求解器的记忆效应; - **控制-外观解耦极限**:当提示强烈对抗控制信号时(Section 5.2.2),生成器在何种条件下会“背叛”几何控制而服从文本,这一相变边界尚未量化。 —- 这些方向共同指向论文的最终目标:构建一个**权重冻结、状态可读、人机可审计、视听融合、生成-评估双向闭环**的物理世界模型评估与精炼体系。 Q6: 总结一下论文的主要内容 这篇论文提出了 **VeriPhy**,一个用于评估和精炼视频世界模型的、可审计的物理推理系统。以下从问题动机、系统架构、生成测试平台、实验发现与开放方向五个层面总结其核心内容。 —- ### 1. 研究动机:视觉流畅性不等于物理有效性 当代文本到视频生成模型能合成视觉上令人信服、时序连贯的片段,但**视觉上的可信度并不保证物理上的正确性**。生成视频可能存在以下失效: - **空间-物理失效**:物体在重力下无支撑、轨迹与受力不一致、刚体相互穿透、碰撞缺失; - **声学-物理失效**:预期声音缺失、错位或归因错误; - **跨模态失效**:视觉与声学事件在时序或因果上相互矛盾。 现有评估方法多输出标量质量分或规则级判断,无法定位**具体哪条提示义务被违反、何时发生、基于何种证据**。因此,亟需一种能在开放式提示下,将自然语言义务编译为可检查、可测量、可溯源的物理验证系统。 —- ### 2. VeriPhy:可审计的物理验证系统 论文的核心贡献是 **VeriPhy**,一个由四个角色构成的约束式推理–执行–观察系统: - **文本规划器(Text-only Planner)**:在**读取任何视频帧之前**,将自然语言提示 p 编译为精确引用的类型化物理义务集合 C(p) = c_i = (s_i, φ_i)(i=1)^(N_p) (其中 s_i sqsubseteq p 为提示原文片段)以及一个**静态验证的执行计划** Pi 。计划使用受限表面词汇(存在性、计数、时序顺序、空间关系、轨迹、音频、文本等),并被编译为类型化有向无环图 G_Pi = (A, Q, E, b) ,通过语法、引用、类型与无环性检验:
Valid(G_Pi) = Parse land Refs land Typed land Acyclic land [∀ i, ∃ q ∈ Q: b(q)=i]
- **视频感知语义验证器(Semantic Verifier)**:对带时间戳的帧进行稠密读取,判断实体存在性与事件 occurrence,其结果作为门控信号。 - **冻结专家算子(Specialist Operators)**:仅当计划声明且被观测结果门控/限定时才调用,包括 SAM 3(分割与追踪)、TAPNext++(11 类基于轨迹的物理测量)、单目深度、OCR(PaddleOCR)与音频事件检测(FlexSED)。所有算子返回**带溯源的证据记录**。 - **固定组合器(Fixed Composition)**:以确定性规则将可用证据记录映射为三值决策:
yi ∈ S, C, U quad (supported, contradicted, unknown)
进而得到片段级裁决:
Y ∈ Plausible, Implausible, Abstain
**关键设计**:所有推理前置(计划先行),所有测量可溯源(每个裁决追溯到提示片段、计划节点、时间窗口、工具输出与组合规则),并且**测量值与习得状态被显式区分**,避免将仪器失败转化为对视频的指控。 —- ### 3. 物理引导的生成测试平台 为将“对控制信号的遵循”与“合成输出的物理有效性”解耦,论文构建了一个**基于 MuJoCo 仿真的条件生成管道**: 1. **仿真到控制**:将事件描述 p(ev) 经语言模型编译为场景规范 S ,由 MuJoCo 求解器生成轨迹 τ ,经物理谓词 Phi(ev) 验证(最多 3 次修订),再渲染为注册深度图控制 C = (C_t)(t=0)^(T-1) :
Ct(u) = 1 - clip((D_t(u) - d-) / (d+ - d-), 0, 1)
- **条件化生成**:使用 Wan 2.2-VACE,将深度控制 C 通过残差分支注入扩散 transformer:
hi^((ell)) arrow h_i^((ell)) + s , W^((ell)) z(ctrl)
其中强度 s 全局固定,掩膜全白以确保控制仅通过分支影响生成,而非直接复制像素。 3. **控制撤回分析**:在替代主干上研究发现,运动轨迹在噪声水平 σ(rel) ≈ 0.94 – 0.96 的窄带内即对控制移除不敏感,表明**物理运动在扩散采样的早期高噪声阶段即被锁定**;但接触后行为(如落地滚动)对早期撤回更敏感。 —- ### 4. 实验发现 #### 4.1 批评器召回率(核心评估集) 在 149 片段 / 304 条人工标注缺陷的冻结核心上: - **VeriPhy**:**228/304(75.0%)** 缺陷召回(191 整体匹配,37 部分匹配); - **问题分解基线**(同模型,同片段):164/304(53.9%); - **单轮 VLM 提示**(同模型):222/304(73.0%),但输出为无结构的自由文本列表,**无逐条证据与溯源**。 召回率差异并非唯一区分标准:VeriPhy 的每个发现都附带可审计的证据链,而单轮模型仅返回分数或结论。 #### 4.2 按类别的召回表现 - 屏幕文本(84%)、相机与风格(90%)、动作/事件(83%)表现最佳; - 计数(49%)因模式化降采样导致间歇检测失败,表现最低; - 物理运动(变形等)召回 57%,但样本量小(7 条),仅作描述性参考。 #### 4.3 上下文训练自进化(无权重更新) 将遗漏缺陷的经验蒸馏为 33 条人类可读的教训,加载为规划器的上下文状态( S = (O, M, K) 中的 M ),在 306 片段 / 502 条缺陷的 held-out 集上: - 无教训:340/502(67.7%); - 33 条教训:**375/502(74.7%)**,净提升 +35( p = 3× 10^(-4) )。 - 增益在仅 25 个经验片段时即已饱和,表明少量结构化文本经验即可改善规划,无需微调权重。 #### 4.4 生成-评估闭环 将批评器的矛盾包 F 通过文本重写 rho 反馈至提示并重新生成: - 在 589 个 Cosmos3-Nano 片段上,闭环对 14.8% 的被标记片段有效,其中 72.4% 提升了物理可信度分数,且 1.6% 的未标记片段出现退化; - 然而,**独立评分器(VideoPhy-2 AutoRater)在语义 adherence 与物理常识维度均未检测到显著改善**,表明当前仅通过文本重写难以独立验证地提升物理保真度。 —- ### 5. 局限与未来方向 - **跨模态扩展**:系统架构已集成音频事件检测与共享 A/V 时钟,但当前所有测量主张均为视觉;未来需扩展至视听同步与跨模态因果验证。 - **控制闭环深化**:当前反馈仅通过提示文本 p 实现,需发展将矛盾包 F 映射为几何控制局部编辑 Delta(ctrl) 的机制,直接修正 MuJoCo/VACE 控制信号。 - **操作符库扩展**:当前 11 项测量主要针对刚体运动;需引入可变形体、颗粒材料、流体及多体交互的测量算子。 - **评估协议完善**:当前语料全为含缺陷片段,缺乏“干净”负样本,无法直接测量精度(precision)与误报率。 - **外部知识通道**:为防止内部循环(CoT → 反馈 → 上下文)放大偏见,需开启对外部物理事实的检索,并通过 held-out 代理门控准入。 —- ### 6. 总结性贡献 论文的核心贡献可概括为三方面: 1. **VeriPhy**:首个将开放式提示编译为类型化物理义务、以冻结专家测量和固定规则组合实现**可审计、可定位、三值化**物理验证的集成系统; 2. **1,500 片段缺陷语料库**:提供 2,582 条带时间跨度与包围盒的人工标注缺陷记录,支持缺陷级匹配评估; 3. **仿真-生成解耦测试平台**:以 MuJoCo 深度控制驱动 Wan 2.2-VACE,使物理目标与外观生成分离,为生成与评估的独立基准测试提供基础设施。 该工作将视频世界模型的物理验证从黑箱标量评分,推进到了**逐条义务可追踪、逐条证据可审查、逐条裁决可推翻**的结构化新阶段。 Q7: 想要进一步了解论文 以上只是了解一篇论文的几个基本FAQ。如果你还想与Kimi进一步讨论该论文,请点击 这里 为你跳转Kimi AI网页版,并启动一个与该论文相关的新会话。
Authors: Wenzhuo Xu, Yuchen Zhu, Chongjian Ge, Xuan Shen, Jing Shi, Jason Kuen, Yongxin Chen, Molei Tao, Christopher McComb, Noelia Grande Gutiérrez, Jiuxiang Gu
Categories: cs.CV
PDF URL: https://arxiv.org/pdf/2609.03153.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03153
Published: 2026-09-05T01:23:44.984Z
9. Who Speaks for the Pruned? Visual Token Pruning as Coverage Optimization
Abstract:Visual token pruning reduces the inference cost of vision-language models (VLMs), but most methods only ask which tokens to keep. This retained-token view can keep redundant high-scoring tokens while leaving discarded evidence without a close representative. We propose CoverPruner, a training-free pruner that asks the complementary demand-side question: after a token is removed, which surviving original token represents it for the target VLM? CoverPruner formulates pruning as Representational Coverage Maximization (RCM), covering the full projected visual-token set with query-weighted demand. It instantiates RCM with projector-space coverage and a lightweight first-layer attention probe. Across multiple VLM architectures and compression rates, CoverPruner achieves the best average accuracy among all compared methods, with the largest gains usually appearing under aggressive compression.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03158 (HTTP 429)
Authors: Qingchan Zhu, Weihang You, Hanqi Jiang, Changdi Yang, Tianming Liu, Geng Yuan
Categories: cs.CV
PDF URL: https://arxiv.org/pdf/2609.03158.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03158
Published: 2026-09-05T01:23:44.984Z
10. RoboTok: An Internet-Scale Data Engine for Human Demonstration Retrieval and Dexterous Manipulation Learning
Abstract:Robot learning increasingly depends on broad and diverse demonstrations, yet collecting robot data remains expensive and poorly suited to covering the long tail of real-world tasks. To address this bottleneck, we introduce RoboTok, an internet-scale data engine that, given a query human manipulation video, retrieves manipulation-relevant human demonstrations from web videos for training dexterous robot policies. Specifically, we learn a latent motion space from 3D hand trajectories expressed in estimated actor-centered reference frames. This representation enables manipulation behaviors to be compared across variations in camera viewpoint, scene appearance, and actor occlusions, while remaining compact enough for efficient search and continual indexing over internet-scale video collections. We evaluate RoboTok against existing robot-data retrieval approaches on retrieval benchmarks and downstream robot policy performance. Our results show that RoboTok retrieves more relevant manipulation demonstrations and improves downstream task success, establishing hand-pose trajectory-aware retrieval as a way to make web video a scalable and continuously growing source of supervision for robot learning.
中文摘要
翻译失败: Translation limit exceeded. Please try it again later.
Response status: 401 (Unauthorized)
Response body : “{\”ShowCaptcha\”:false}”
LLM Analysis
LLM Analysis Failed: Error: Kimi内容未就绪或抓取失败: 2609.03199 (HTTP 429)
Authors: Howard Qian, Yiting Chen, Yunfei Xie, Kejia Ren, Podshara Chanrungmaneekul, Gaotian Wang, Bowen Wen, Chen Wei, Kaiyu Hang
Categories: cs.CV
PDF URL: https://arxiv.org/pdf/2609.03199.pdf
CoolPaper URL: https://papers.cool/arxiv/2609.03199
Published: 2026-09-05T01:23:44.984Z