Papers

Field

Top tools here

Open problems in Agents & indirect prompt injection

Lack of harness-specific evaluation benchmarks3 papers raise it · 2 address it
Agent performance depends on both models and harnesses, but most benchmarks focus only on model capabilities, leaving harness reliability and failure attribution underexplored.
- Trial by Trace: Benchmarking AI Agent Harnesses for Reliability and Failure Attributionraises · addresses
- Doc2Harness: Benchmarking LLMs on Long-Horizon Harness Engineering of Coding Agentsraises · addresses
- AgentSWE: Can Coding Agents Build the Agent You Actually Want?raises
Outcome-capability gap in evolving environments1 paper raises it · 1 addresses it
Evaluating agents by outcomes alone obscures the underlying capabilities, especially in dynamic settings where outcomes and mechanisms diverge.
- LiveMACE: Process-Aware Evaluation of LLM Agent Capabilities in Evolving Marketsraises · addresses
Security of vibe-coded agent outputs1 paper raises it · 1 addresses it
Agents often produce functional but insecure code, as security is not explicitly addressed in requirements or evaluations.
- Last Secure Code Benchmark: Is the Code You Vibe Secure?raises · addresses
Evidence-to-action chain failures in tool use1 paper raises it · 1 addresses it
Agents may act without sufficient evidence or fail to complete multi-step workflows, leading to unreliable or unsafe outcomes.
- From Evidence to Action: How Tool-Using Agents Failraises · addresses
Long-horizon program synthesis and verification2 papers raise it · 2 address it
Agents struggle with scalable, verifiable training environments for long-horizon tasks like program reproduction or checker synthesis.
- ProgramGym: Scaling Training Environments for Long-Horizon Program Reproduction Agentsraises · addresses
- CheckerBench: Can Long-Horizon Agents Synthesize Static-Analysis Checkers?raises · addresses

Named by an AI from these papers' abstracts.

Open problems

Recently funded

Topics in this field

indirect prompt injection · prompt injection · ai agents397 papers48 this week
coding agents · coding agent · code generation217 papers41 this week
agents · tool · multi agent395 papers29 this week
code generation · language models llms · compiler139 papers28 this week
proof assistant · proof search · theorem provers97 papers17 this week
specification generation · formal specifications · formalization77 papers14 this week

Topics in this field

Active contributors · 90 days

Active contributors

Activity · 12 weeks

Activity

Recent papers

All papers in Research

arXiv cs.PLOct 29
Countable Nondeterminism in Weighted Programming with an Application to Mechanized Foundations for Probabilistic Program Verification
Sebastian Körner, Oliver Emil Bøving, Christoph Matheja
Weighted programming is a framework by Batz et al. for describing mathematical models or optimization problems as imperative programs parametrized over semirings and then analyzing them with program verification techniques like weakest precondition calculi. Applications include reasoning about expected outcomes of probabilistic programs and competitive analysis of online algorithms. We extend weighted programming with (1) countable nondeterminism and (2) user-defined additive rewards, where programs are parametrized over modules instead of semirings. The resulting framework enables reasoning about expected resource consumption of probabilistic programs and about optimal scores of combinatorial games. A technical challenge is that wp-calculi for weighted programs with (1) and (2) over arbitrary modules can be unsound, because it is well-known that continuity properties commonly used in program semantics break in the presence of countable nondeterminism. We study conditions under which a wp-style transformer for reasoning about weighted programs is sound with respect to an operational ground truth defined in terms of weighted decision processes (WDPs) - transition systems that…
PDF arXiv
arXiv cs.SEOct 29
Early Prediction of Cross-Service Implementation Scope: Evidence and Limits from Multiple Microservice Projects
Zhoumaocuo, Xiaozhou Li
Microservice architectures aim to localize change, yet feature requests may require implementation across service boundaries. We investigate how well such downstream scope can be anticipated before implementation begins. Using issue--pull-request--commit traceability and implementation evidence corrected through targeted human adjudication, we reconstruct 866 repository-traceable feature requests from 13 open-source microservice projects and map their implementations to validated service boundaries. Cross-service changes occur in 101 requests (11.7%) and exhibit broader implementation footprints, particularly higher code churn, but no clear difference in lead time. Pre-implementation evidence provides limited cross-project predictive signal: the strongest leave-one-system-out model reaches a project-macro Macro-F1 of 0.484, but its advantage over the majority baseline is not significant after Holm correction and is sensitive to small evaluation folds. A local LLM offers no reliable improvement over classical models. Downstream workload is substantially harder to estimate, as learned models do not consistently outperform training-fold median baselines. A simple service-mention…
PDF arXiv
arXiv cs.CROct 29
Judging Before Propagation: Task-Graph Contextual Integrity for Multi-Agent Privacy
Hengyu Wu, Blaise Delattre, Yang Cao
Multi-agent LLM systems increasingly rely on persistent memory and inter-agent communication. These capabilities create privacy risks that extend beyond individual interactions: a release appropriate in isolation may become inappropriate when combined with information previously disclosed to a recipient or propagated to downstream agents along the planned workflow. Existing Contextual Integrity (CI) mechanisms for agentic systems typically rely on local judgments that assess each disclosure in isolation, with or without regard to the recipient's history, but do not account for how information propagates downstream. However, compliance at the current boundary does not guarantee appropriateness across the workflow. We introduce Task-Graph Contextual Integrity (TG-CI), to our knowledge the first task-graph-native formalization of Contextual Integrity for multi-agent systems. TG-CI represents a workflow as a Multi-Agent Task Graph (MATG) and extends CI from atomic transfers to stateful, graph-level information flows by jointly considering an item's intended propagation scope and recipients' evolving disclosure states. We operationalize TG-CI through propagation-scoped authorization…
PDF arXiv
arXiv cs.SEOct 29
Lost in the Latent Space: How Code Embeddings Represent Functional Intent and Implementation Fidelity
Lu Sun, Yuheng Huang, Lei Ma, Zhijie Wang
Code embedding models have become a key building block for many software engineering applications, yet their internal representations remain poorly understood. Existing evaluations tend to focus on downstream task performance, offering limited insight into whether a single embedding can support both functional abstraction and implementation-sensitive analysis. To address this gap, we present a large-scale empirical study of 14 state-of-the-art code embedding models. We evaluate their representational behavior through three complementary analyses: supervised probing for functional abstraction and implementation fidelity, zero-shot retrieval experiments to assess geometric similarity, and controlled perturbation experiments that measure embedding responses to semantics-preserving code transformations. The results reveal a consistent abstraction-fidelity tension: models that better preserve stylistic and structural signals tend to do so at the expense of semantic generalization, while models with similar retrieval performance can nevertheless respond very differently to the same implementation changes. Overall, our findings suggest that a single universal code representation remains…
PDF arXiv
arXiv cs.SEOct 29
When Static Reachability Says No: Checking Joern-Based Negative Verdicts for Python Against Execution
Artur Zięba-Kozarzewski, Bartosz Grzegorzewski
A negative reachability verdict removes a finding from human review. We check such verdicts against execution. Our pipeline, SourceLens, maps Semgrep findings to a Python program's call graph, whose edges a query takes from the calls that Joern links in its code property graph. We ran two command-line programs from the PyCG macro-benchmark, in which the benchmark's manual call graph and Joern disagree, under coverage and recorded the calls between their functions. On these edges, 123 functions of asciinema are unreachable from the program's entry points. The project's own integration script executes 86 of them, and all our runs 113. In Sublist3r, 19 of 24 are executed. The latest Joern release gives the same verdicts. The missing calls go through values, such as classes and functions passed around, or have no call expression, as in with blocks and property reads. In asciinema, four missing edges make 50 of the 113 executed functions reachable. The manual call graphs also lack observed calls, in asciinema many of them property reads and with blocks, which the benchmark may not count as calls. A rule that turns negative verdicts into unknown recovers 62 of the 113 and 15 of the 19,…
PDF arXiv
arXiv cs.SEOct 29
Program Bindings Inside Code Models
Prateek Kumar Rajput, Yewei Song, Jacques Klein, Tegawendé F. Bissyandé
Code language models complete, review, and repair programs without exposing the program structure encoded in their hidden states. In this paper, we test whether the hidden states of a code model can be described and edited using the information a compiler front end computes. For each token of a Python program, standard analyzers provide its position in the abstract syntax tree, its scope, its definition-use links, and its syntactic category. We fit a decomposition that expresses every hidden state of a frozen model as a sum of one term per token, each combining the token with this structural label, and we replace the model's own states with the decomposition at every layer while it predicts the output of a small program. If the model still answers correctly, the decomposition preserves the information the model uses. We apply this test to 14 open models, seven of them trained for code, and compare against a baseline decomposition of the same size built from token positions. The static-analysis decomposition preserves the model's answers better than the positional one in 10 of the 14 models, including six of the seven code models, and deleting the definition-use links from it…
PDF arXiv

Papers

Topics in this field

indirect prompt injection · prompt injection · ai agents397 papers48 this week
coding agents · coding agent · code generation217 papers41 this week
agents · tool · multi agent395 papers29 this week
code generation · language models llms · compiler139 papers28 this week
proof assistant · proof search · theorem provers97 papers17 this week
specification generation · formal specifications · formalization77 papers14 this week

Recent papers

All papers in Research

arXiv cs.PLOct 29
Countable Nondeterminism in Weighted Programming with an Application to Mechanized Foundations for Probabilistic Program Verification
Sebastian Körner, Oliver Emil Bøving, Christoph Matheja
Weighted programming is a framework by Batz et al. for describing mathematical models or optimization problems as imperative programs parametrized over semirings and then analyzing them with program verification techniques like weakest precondition calculi. Applications include reasoning about expected outcomes of probabilistic programs and competitive analysis of online algorithms. We extend weighted programming with (1) countable nondeterminism and (2) user-defined additive rewards, where programs are parametrized over modules instead of semirings. The resulting framework enables reasoning about expected resource consumption of probabilistic programs and about optimal scores of combinatorial games. A technical challenge is that wp-calculi for weighted programs with (1) and (2) over arbitrary modules can be unsound, because it is well-known that continuity properties commonly used in program semantics break in the presence of countable nondeterminism. We study conditions under which a wp-style transformer for reasoning about weighted programs is sound with respect to an operational ground truth defined in terms of weighted decision processes (WDPs) - transition systems that…
PDF arXiv
arXiv cs.SEOct 29
Early Prediction of Cross-Service Implementation Scope: Evidence and Limits from Multiple Microservice Projects
Zhoumaocuo, Xiaozhou Li
Microservice architectures aim to localize change, yet feature requests may require implementation across service boundaries. We investigate how well such downstream scope can be anticipated before implementation begins. Using issue--pull-request--commit traceability and implementation evidence corrected through targeted human adjudication, we reconstruct 866 repository-traceable feature requests from 13 open-source microservice projects and map their implementations to validated service boundaries. Cross-service changes occur in 101 requests (11.7%) and exhibit broader implementation footprints, particularly higher code churn, but no clear difference in lead time. Pre-implementation evidence provides limited cross-project predictive signal: the strongest leave-one-system-out model reaches a project-macro Macro-F1 of 0.484, but its advantage over the majority baseline is not significant after Holm correction and is sensitive to small evaluation folds. A local LLM offers no reliable improvement over classical models. Downstream workload is substantially harder to estimate, as learned models do not consistently outperform training-fold median baselines. A simple service-mention…
PDF arXiv
arXiv cs.CROct 29
Judging Before Propagation: Task-Graph Contextual Integrity for Multi-Agent Privacy
Hengyu Wu, Blaise Delattre, Yang Cao
Multi-agent LLM systems increasingly rely on persistent memory and inter-agent communication. These capabilities create privacy risks that extend beyond individual interactions: a release appropriate in isolation may become inappropriate when combined with information previously disclosed to a recipient or propagated to downstream agents along the planned workflow. Existing Contextual Integrity (CI) mechanisms for agentic systems typically rely on local judgments that assess each disclosure in isolation, with or without regard to the recipient's history, but do not account for how information propagates downstream. However, compliance at the current boundary does not guarantee appropriateness across the workflow. We introduce Task-Graph Contextual Integrity (TG-CI), to our knowledge the first task-graph-native formalization of Contextual Integrity for multi-agent systems. TG-CI represents a workflow as a Multi-Agent Task Graph (MATG) and extends CI from atomic transfers to stateful, graph-level information flows by jointly considering an item's intended propagation scope and recipients' evolving disclosure states. We operationalize TG-CI through propagation-scoped authorization…
PDF arXiv
arXiv cs.SEOct 29
Lost in the Latent Space: How Code Embeddings Represent Functional Intent and Implementation Fidelity
Lu Sun, Yuheng Huang, Lei Ma, Zhijie Wang
Code embedding models have become a key building block for many software engineering applications, yet their internal representations remain poorly understood. Existing evaluations tend to focus on downstream task performance, offering limited insight into whether a single embedding can support both functional abstraction and implementation-sensitive analysis. To address this gap, we present a large-scale empirical study of 14 state-of-the-art code embedding models. We evaluate their representational behavior through three complementary analyses: supervised probing for functional abstraction and implementation fidelity, zero-shot retrieval experiments to assess geometric similarity, and controlled perturbation experiments that measure embedding responses to semantics-preserving code transformations. The results reveal a consistent abstraction-fidelity tension: models that better preserve stylistic and structural signals tend to do so at the expense of semantic generalization, while models with similar retrieval performance can nevertheless respond very differently to the same implementation changes. Overall, our findings suggest that a single universal code representation remains…
PDF arXiv
arXiv cs.SEOct 29
When Static Reachability Says No: Checking Joern-Based Negative Verdicts for Python Against Execution
Artur Zięba-Kozarzewski, Bartosz Grzegorzewski
A negative reachability verdict removes a finding from human review. We check such verdicts against execution. Our pipeline, SourceLens, maps Semgrep findings to a Python program's call graph, whose edges a query takes from the calls that Joern links in its code property graph. We ran two command-line programs from the PyCG macro-benchmark, in which the benchmark's manual call graph and Joern disagree, under coverage and recorded the calls between their functions. On these edges, 123 functions of asciinema are unreachable from the program's entry points. The project's own integration script executes 86 of them, and all our runs 113. In Sublist3r, 19 of 24 are executed. The latest Joern release gives the same verdicts. The missing calls go through values, such as classes and functions passed around, or have no call expression, as in with blocks and property reads. In asciinema, four missing edges make 50 of the 113 executed functions reachable. The manual call graphs also lack observed calls, in asciinema many of them property reads and with blocks, which the benchmark may not count as calls. A rule that turns negative verdicts into unknown recovers 62 of the 113 and 15 of the 19,…
PDF arXiv
arXiv cs.SEOct 29
Program Bindings Inside Code Models
Prateek Kumar Rajput, Yewei Song, Jacques Klein, Tegawendé F. Bissyandé
Code language models complete, review, and repair programs without exposing the program structure encoded in their hidden states. In this paper, we test whether the hidden states of a code model can be described and edited using the information a compiler front end computes. For each token of a Python program, standard analyzers provide its position in the abstract syntax tree, its scope, its definition-use links, and its syntactic category. We fit a decomposition that expresses every hidden state of a frozen model as a sum of one term per token, each combining the token with this structural label, and we replace the model's own states with the decomposition at every layer while it predicts the output of a small program. If the model still answers correctly, the decomposition preserves the information the model uses. We apply this test to 14 open models, seven of them trained for code, and compare against a baseline decomposition of the same size built from token positions. The static-analysis decomposition preserves the model's answers better than the positional one in 10 of the 14 models, including six of the seven code models, and deleting the definition-use links from it…
PDF arXiv

Active contributors · 90 days

Activity · 12 weeks

Fields · AI · updated 1h ago

Agents & indirect prompt injection

Found by the topic model: agents, indirect prompt injection, code generation.

188papers this week−31.6% vs last week

All papers · 1.4k With code · 38

Newest Most relevant

948 papers this month

Open problems in Agents & indirect prompt injection

Lack of harness-specific evaluation benchmarks3 papers raise it · 2 address it
Agent performance depends on both models and harnesses, but most benchmarks focus only on model capabilities, leaving harness reliability and failure attribution underexplored.
- Trial by Trace: Benchmarking AI Agent Harnesses for Reliability and Failure Attributionraises · addresses
- Doc2Harness: Benchmarking LLMs on Long-Horizon Harness Engineering of Coding Agentsraises · addresses
- AgentSWE: Can Coding Agents Build the Agent You Actually Want?raises
Outcome-capability gap in evolving environments1 paper raises it · 1 addresses it
Evaluating agents by outcomes alone obscures the underlying capabilities, especially in dynamic settings where outcomes and mechanisms diverge.
- LiveMACE: Process-Aware Evaluation of LLM Agent Capabilities in Evolving Marketsraises · addresses
Security of vibe-coded agent outputs1 paper raises it · 1 addresses it
Agents often produce functional but insecure code, as security is not explicitly addressed in requirements or evaluations.
- Last Secure Code Benchmark: Is the Code You Vibe Secure?raises · addresses
Evidence-to-action chain failures in tool use1 paper raises it · 1 addresses it
Agents may act without sufficient evidence or fail to complete multi-step workflows, leading to unreliable or unsafe outcomes.
- From Evidence to Action: How Tool-Using Agents Failraises · addresses
Long-horizon program synthesis and verification2 papers raise it · 2 address it
Agents struggle with scalable, verifiable training environments for long-horizon tasks like program reproduction or checker synthesis.
- ProgramGym: Scaling Training Environments for Long-Horizon Program Reproduction Agentsraises · addresses
- CheckerBench: Can Long-Horizon Agents Synthesize Static-Analysis Checkers?raises · addresses

Named by an AI from these papers' abstracts.