Papers

Field

Top tools here

Open problems in Agents & indirect prompt injection

Lack of harness-specific evaluation benchmarks3 papers raise it · 2 address it
Agent performance depends on both models and harnesses, but most benchmarks focus only on model capabilities, leaving harness reliability and failure attribution underexplored.
- Trial by Trace: Benchmarking AI Agent Harnesses for Reliability and Failure Attributionraises · addresses
- Doc2Harness: Benchmarking LLMs on Long-Horizon Harness Engineering of Coding Agentsraises · addresses
- AgentSWE: Can Coding Agents Build the Agent You Actually Want?raises
Outcome-capability gap in evolving environments1 paper raises it · 1 addresses it
Evaluating agents by outcomes alone obscures the underlying capabilities, especially in dynamic settings where outcomes and mechanisms diverge.
- LiveMACE: Process-Aware Evaluation of LLM Agent Capabilities in Evolving Marketsraises · addresses
Security of vibe-coded agent outputs1 paper raises it · 1 addresses it
Agents often produce functional but insecure code, as security is not explicitly addressed in requirements or evaluations.
- Last Secure Code Benchmark: Is the Code You Vibe Secure?raises · addresses
Evidence-to-action chain failures in tool use1 paper raises it · 1 addresses it
Agents may act without sufficient evidence or fail to complete multi-step workflows, leading to unreliable or unsafe outcomes.
- From Evidence to Action: How Tool-Using Agents Failraises · addresses
Long-horizon program synthesis and verification2 papers raise it · 2 address it
Agents struggle with scalable, verifiable training environments for long-horizon tasks like program reproduction or checker synthesis.
- ProgramGym: Scaling Training Environments for Long-Horizon Program Reproduction Agentsraises · addresses
- CheckerBench: Can Long-Horizon Agents Synthesize Static-Analysis Checkers?raises · addresses

Named by an AI from these papers' abstracts.

Open problems

Recently funded

Topics in this field

agents · tool · multi agent441 papers55 this week
indirect prompt injection · prompt injection · ai agents433 papers54 this week
coding agents · coding agent · code generation246 papers40 this week
code generation · language models llms · compiler163 papers35 this week
specification generation · formal specifications · formalization91 papers19 this week
proof assistant · proof search · theorem provers106 papers18 this week

Topics in this field

Active contributors · 90 days

Active contributors

Activity · 12 weeks

Activity

Recent papers

All papers in Research

arXiv cs.PLOct 23
On the Expressive Power of Hook-Indexed State: Comprehending State in the React UI Library (Extended Version)
Toby Ueno, Ezra Cooper, Simon Fowler, Sam Lindley
React is currently the most popular JavaScript library for front-end web development. It endows UI components with state via the useState construct, through a mechanism that we name hook-indexed state. However, React's implementation of hook-indexed state is both fragile and poorly understood. Programmers frequently experience unexpected behavior, and the benefits of programming in this paradigm are wholly unclear. We define $λ^\mathsf{react}_\mathsf{hook}$, a core calculus that captures the essence of hook-indexed state, and give it a type system to statically rule out unexpected behavior. We then translate $λ^\mathsf{react}_\mathsf{hook}$ into a calculus $λ^\mathsf{react}_\mathsf{ref}$ based on ML-style references, and prove that this translation preserves typability and semantics, thus showing that hook-indexed state is expressible in terms of standard references. The translation is local and admits a compositional definition, but involves significant code duplication. As well as illuminating the essence of state in React, our observations can inform the design of future reactive programming systems.
PDF arXiv
arXiv cs.AIOct 23
SemantEq: Faithful Bidirectional Equivalence of Formal Statements
Xinrui Li, Pawan Sasanka Ammanamanchi, Siddharth Bhat, Rianna Jamdar, Yongxi Lin +1
Statement autoformalization translates mathematics from natural language into a proof assistant such as Lean 4, and models now do it at scale. As provers get stronger, the burden of correctness shifts from the proof to the statement, that is, to whether the formal statement faithfully translates its source. Given a trusted reference formalization, the natural test is logical equivalence, and it proves too much. $P \leftrightarrow Q$ holds trivially for any two statements $P$ and $Q$ that the library proves, because a prover can prove each separately and pass through $P \leftrightarrow \mathrm{True} \leftrightarrow Q$. The stronger the prover, the more unrelated pairs pass. Earlier methods restrict the prover and check that each proof names the other statement. We introduce SemantEq, a more principled relation that instead requires each statement to turn into the other only through a chain of allowed steps, such as logical rearrangement and rewriting with the library's own equations. Our programs judge a proof by the proof term Lean checks, not by its tactic script. SemantEq-Eval, a search without a model, reaches 100% precision and 65.6% recall on the ProofNetVerif test split…
PDF arXiv
arXiv cs.SEOct 23
Trusting the Tool: Asymmetric Deference of LLM Vulnerability Auditors to Static-Analysis Evidence
ZhiHong Liu, Shuyao Gao
Pipelines that combine large language models (LLMs) with static analysis let the model consume the analyser's output as evidence, but whether the model distinguishes true from false evidence, and whether its scrutiny depends on what the evidence claims, has not been measured. We built an intraprocedural analyser for C/C++ that produces proof obligations and audited vulnerable and patched functions from PrimeVul under six evidence conditions that differ only in the notes, including fabricated assurances that a missing check exists and fabricated alarms that an added check is missing. The study covers 916 pairs in four disjoint sets, eleven model configurations from four vendors and 16,572 audits; no model is trained or fine-tuned. True evidence barely improved accuracy (+0.02). False evidence acted asymmetrically: relative to true notes about the same operations, false assurances lowered the detection of real vulnerabilities by up to 19 points, whereas false alarms never significantly lowered accuracy and were disputed far more often. An internally registered replication on seven new models confirmed that false assurances move verdicts towards their claim more than false alarms do…
PDF arXiv
arXiv cs.AIOct 23
Optimal Correction Sets for Provable Redress of Contestable Causal Discovery
Fabrizio Russo, Giuseppe Mazzotta, Carmine Dodaro, Francesco Ricca, Francesca Toni
Constraint-based causal discovery relies on conditional-independence (CI) tests that may conflict in finite samples, leaving no causal graph that satisfies them all. Causal Assumption-based Argumentation (ABA) makes these tests explicit as defeasible commitments, and offers correspondence guarantees with a subset of them, but its existing repair procedure releases facts heuristically and offers no formal response to a user's contestation of a release. We argue that contestable causal discovery requires an inspectable repair object, a justification for it, and a predictable revision procedure for such contestations. We therefore formulate CI-fact repair as a minimum-cost correction problem and implement it in Answer Set Programming (ASP). Building on Causal ABA, we provide a compact and efficient ASP encoding of causal consistency, with soundness and completeness guarantees, and a two-way projection correspondence between optimal stable models and minimum-cost correction sets. These results establish fidelity to retained facts, subset-minimality and cost optimality of the repair, conflict-based justifications for released facts, and formally guaranteed redress under user…
PDF arXiv
arXiv cs.SEOct 23
OpenDraco: A Platform for Engineering and Experimenting with Configurable Multi-Agent Architectures for Software Engineering
Xiang Feng Ye Pan, Vincenzo De Martino, Matias Martinez
Experimenting with LLM-based multi-agent systems (MAS) involves an iterative cycle of modeling configurations, executing and evaluating them, comparing results, and refining system designs. Existing approaches provide limited end-to-end support for this experimentation lifecycle. We present OpenDraco, an open-source platform that integrates these activities into a single workflow. OpenDraco represents agents, prompts, tools, models, parameters, and communication topology in exportable, versioned JSON specifications, translated into executable LangGraph workflows supporting different interaction structures. Users can modify and re-evaluate configurations using local or cloud-based LLMs. We instantiate OpenDraco for automated program repair (APR) and evaluate a sequential baseline and seven reconstructed configurations on synthetic and real-world SWE-bench Lite issues. The results reveal substantial cost differences among configurations with similar repair outcomes, while the baseline resolves 12 of 77 SWE-bench issues using open-source LLMs. Additional proof-of-concept tasks illustrate applicability beyond APR. OpenDraco supports iterative experimentation with heterogeneous MAS…
PDF arXiv
arXiv cs.SEOct 23
StateMirror: Pre-Execution Detection of Hallucinated Tool Calls in Coding Agents
Shiwen Shan, Yintong Huo, Zhiying Wu, Yuxin Su
Large language model (LLM)-based coding agents may propose invalid actions that are not applicable in the execution environment, such as accessing non-existent paths or missing packages. We term this mismatch hallucinated tool use. A preliminary study of 4,398 agent trajectories reveals that these hallucinations are pervasive and costly, requiring a median of 3 additional interaction steps and 22.4K tokens to recover. Existing frameworks rely on reactive, post-execution feedback, wasting runtime resources. Nevertheless, since an agent's execution environment is grounded in concrete codebase and harness components, many action prerequisites can be extracted and validated prior to execution. To this end, we introduce StateMirror, a lightweight pre-execution detector. StateMirror intercepts actions at the harness boundary, extracts state predicates via AST and command analysis, and deterministically validates them against the live repository. By pinpointing exact environment mismatches before execution, StateMirror preempts invalid actions and subsequent recovery cycles. Evaluation on 2,508 actions shows StateMirror achieves 0.940 precision and 0.817 F1 in detecting such…
PDF arXiv

Papers

Recent papers

All papers in Research

arXiv cs.PLOct 23
On the Expressive Power of Hook-Indexed State: Comprehending State in the React UI Library (Extended Version)
Toby Ueno, Ezra Cooper, Simon Fowler, Sam Lindley
React is currently the most popular JavaScript library for front-end web development. It endows UI components with state via the useState construct, through a mechanism that we name hook-indexed state. However, React's implementation of hook-indexed state is both fragile and poorly understood. Programmers frequently experience unexpected behavior, and the benefits of programming in this paradigm are wholly unclear. We define $λ^\mathsf{react}_\mathsf{hook}$, a core calculus that captures the essence of hook-indexed state, and give it a type system to statically rule out unexpected behavior. We then translate $λ^\mathsf{react}_\mathsf{hook}$ into a calculus $λ^\mathsf{react}_\mathsf{ref}$ based on ML-style references, and prove that this translation preserves typability and semantics, thus showing that hook-indexed state is expressible in terms of standard references. The translation is local and admits a compositional definition, but involves significant code duplication. As well as illuminating the essence of state in React, our observations can inform the design of future reactive programming systems.
PDF arXiv
arXiv cs.AIOct 23
SemantEq: Faithful Bidirectional Equivalence of Formal Statements
Xinrui Li, Pawan Sasanka Ammanamanchi, Siddharth Bhat, Rianna Jamdar, Yongxi Lin +1
Statement autoformalization translates mathematics from natural language into a proof assistant such as Lean 4, and models now do it at scale. As provers get stronger, the burden of correctness shifts from the proof to the statement, that is, to whether the formal statement faithfully translates its source. Given a trusted reference formalization, the natural test is logical equivalence, and it proves too much. $P \leftrightarrow Q$ holds trivially for any two statements $P$ and $Q$ that the library proves, because a prover can prove each separately and pass through $P \leftrightarrow \mathrm{True} \leftrightarrow Q$. The stronger the prover, the more unrelated pairs pass. Earlier methods restrict the prover and check that each proof names the other statement. We introduce SemantEq, a more principled relation that instead requires each statement to turn into the other only through a chain of allowed steps, such as logical rearrangement and rewriting with the library's own equations. Our programs judge a proof by the proof term Lean checks, not by its tactic script. SemantEq-Eval, a search without a model, reaches 100% precision and 65.6% recall on the ProofNetVerif test split…
PDF arXiv
arXiv cs.SEOct 23
Trusting the Tool: Asymmetric Deference of LLM Vulnerability Auditors to Static-Analysis Evidence
ZhiHong Liu, Shuyao Gao
Pipelines that combine large language models (LLMs) with static analysis let the model consume the analyser's output as evidence, but whether the model distinguishes true from false evidence, and whether its scrutiny depends on what the evidence claims, has not been measured. We built an intraprocedural analyser for C/C++ that produces proof obligations and audited vulnerable and patched functions from PrimeVul under six evidence conditions that differ only in the notes, including fabricated assurances that a missing check exists and fabricated alarms that an added check is missing. The study covers 916 pairs in four disjoint sets, eleven model configurations from four vendors and 16,572 audits; no model is trained or fine-tuned. True evidence barely improved accuracy (+0.02). False evidence acted asymmetrically: relative to true notes about the same operations, false assurances lowered the detection of real vulnerabilities by up to 19 points, whereas false alarms never significantly lowered accuracy and were disputed far more often. An internally registered replication on seven new models confirmed that false assurances move verdicts towards their claim more than false alarms do…
PDF arXiv
arXiv cs.AIOct 23
Optimal Correction Sets for Provable Redress of Contestable Causal Discovery
Fabrizio Russo, Giuseppe Mazzotta, Carmine Dodaro, Francesco Ricca, Francesca Toni
Constraint-based causal discovery relies on conditional-independence (CI) tests that may conflict in finite samples, leaving no causal graph that satisfies them all. Causal Assumption-based Argumentation (ABA) makes these tests explicit as defeasible commitments, and offers correspondence guarantees with a subset of them, but its existing repair procedure releases facts heuristically and offers no formal response to a user's contestation of a release. We argue that contestable causal discovery requires an inspectable repair object, a justification for it, and a predictable revision procedure for such contestations. We therefore formulate CI-fact repair as a minimum-cost correction problem and implement it in Answer Set Programming (ASP). Building on Causal ABA, we provide a compact and efficient ASP encoding of causal consistency, with soundness and completeness guarantees, and a two-way projection correspondence between optimal stable models and minimum-cost correction sets. These results establish fidelity to retained facts, subset-minimality and cost optimality of the repair, conflict-based justifications for released facts, and formally guaranteed redress under user…
PDF arXiv
arXiv cs.SEOct 23
OpenDraco: A Platform for Engineering and Experimenting with Configurable Multi-Agent Architectures for Software Engineering
Xiang Feng Ye Pan, Vincenzo De Martino, Matias Martinez
Experimenting with LLM-based multi-agent systems (MAS) involves an iterative cycle of modeling configurations, executing and evaluating them, comparing results, and refining system designs. Existing approaches provide limited end-to-end support for this experimentation lifecycle. We present OpenDraco, an open-source platform that integrates these activities into a single workflow. OpenDraco represents agents, prompts, tools, models, parameters, and communication topology in exportable, versioned JSON specifications, translated into executable LangGraph workflows supporting different interaction structures. Users can modify and re-evaluate configurations using local or cloud-based LLMs. We instantiate OpenDraco for automated program repair (APR) and evaluate a sequential baseline and seven reconstructed configurations on synthetic and real-world SWE-bench Lite issues. The results reveal substantial cost differences among configurations with similar repair outcomes, while the baseline resolves 12 of 77 SWE-bench issues using open-source LLMs. Additional proof-of-concept tasks illustrate applicability beyond APR. OpenDraco supports iterative experimentation with heterogeneous MAS…
PDF arXiv
arXiv cs.SEOct 23
StateMirror: Pre-Execution Detection of Hallucinated Tool Calls in Coding Agents
Shiwen Shan, Yintong Huo, Zhiying Wu, Yuxin Su
Large language model (LLM)-based coding agents may propose invalid actions that are not applicable in the execution environment, such as accessing non-existent paths or missing packages. We term this mismatch hallucinated tool use. A preliminary study of 4,398 agent trajectories reveals that these hallucinations are pervasive and costly, requiring a median of 3 additional interaction steps and 22.4K tokens to recover. Existing frameworks rely on reactive, post-execution feedback, wasting runtime resources. Nevertheless, since an agent's execution environment is grounded in concrete codebase and harness components, many action prerequisites can be extracted and validated prior to execution. To this end, we introduce StateMirror, a lightweight pre-execution detector. StateMirror intercepts actions at the harness boundary, extracts state predicates via AST and command analysis, and deterministically validates them against the live repository. By pinpointing exact environment mismatches before execution, StateMirror preempts invalid actions and subsequent recovery cycles. Evaluation on 2,508 actions shows StateMirror achieves 0.940 precision and 0.817 F1 in detecting such…
PDF arXiv

Topics in this field

agents · tool · multi agent441 papers55 this week
indirect prompt injection · prompt injection · ai agents433 papers54 this week
coding agents · coding agent · code generation246 papers40 this week
code generation · language models llms · compiler163 papers35 this week
specification generation · formal specifications · formalization91 papers19 this week
proof assistant · proof search · theorem provers106 papers18 this week

Active contributors · 90 days

Activity · 12 weeks

Fields · AI · updated 43m ago

Agents & indirect prompt injection

Found by the topic model: agents, indirect prompt injection, code generation.

232papers this week−17.7% vs last week

All papers · 1.6k With code · 41

Newest Most relevant

1.1k papers this month

Open problems in Agents & indirect prompt injection

Lack of harness-specific evaluation benchmarks3 papers raise it · 2 address it
Agent performance depends on both models and harnesses, but most benchmarks focus only on model capabilities, leaving harness reliability and failure attribution underexplored.
- Trial by Trace: Benchmarking AI Agent Harnesses for Reliability and Failure Attributionraises · addresses
- Doc2Harness: Benchmarking LLMs on Long-Horizon Harness Engineering of Coding Agentsraises · addresses
- AgentSWE: Can Coding Agents Build the Agent You Actually Want?raises
Outcome-capability gap in evolving environments1 paper raises it · 1 addresses it
Evaluating agents by outcomes alone obscures the underlying capabilities, especially in dynamic settings where outcomes and mechanisms diverge.
- LiveMACE: Process-Aware Evaluation of LLM Agent Capabilities in Evolving Marketsraises · addresses
Security of vibe-coded agent outputs1 paper raises it · 1 addresses it
Agents often produce functional but insecure code, as security is not explicitly addressed in requirements or evaluations.
- Last Secure Code Benchmark: Is the Code You Vibe Secure?raises · addresses
Evidence-to-action chain failures in tool use1 paper raises it · 1 addresses it
Agents may act without sufficient evidence or fail to complete multi-step workflows, leading to unreliable or unsafe outcomes.
- From Evidence to Action: How Tool-Using Agents Failraises · addresses
Long-horizon program synthesis and verification2 papers raise it · 2 address it
Agents struggle with scalable, verifiable training environments for long-horizon tasks like program reproduction or checker synthesis.
- ProgramGym: Scaling Training Environments for Long-Horizon Program Reproduction Agentsraises · addresses
- CheckerBench: Can Long-Horizon Agents Synthesize Static-Analysis Checkers?raises · addresses

Named by an AI from these papers' abstracts.