Papers

Field

Top tools here

Open problems in Agents & indirect prompt injection

Lack of harness-specific evaluation benchmarks3 papers raise it · 2 address it
Agent performance depends on both models and harnesses, but most benchmarks focus only on model capabilities, leaving harness reliability and failure attribution underexplored.
- Trial by Trace: Benchmarking AI Agent Harnesses for Reliability and Failure Attributionraises · addresses
- Doc2Harness: Benchmarking LLMs on Long-Horizon Harness Engineering of Coding Agentsraises · addresses
- AgentSWE: Can Coding Agents Build the Agent You Actually Want?raises
Outcome-capability gap in evolving environments1 paper raises it · 1 addresses it
Evaluating agents by outcomes alone obscures the underlying capabilities, especially in dynamic settings where outcomes and mechanisms diverge.
- LiveMACE: Process-Aware Evaluation of LLM Agent Capabilities in Evolving Marketsraises · addresses
Security of vibe-coded agent outputs1 paper raises it · 1 addresses it
Agents often produce functional but insecure code, as security is not explicitly addressed in requirements or evaluations.
- Last Secure Code Benchmark: Is the Code You Vibe Secure?raises · addresses
Evidence-to-action chain failures in tool use1 paper raises it · 1 addresses it
Agents may act without sufficient evidence or fail to complete multi-step workflows, leading to unreliable or unsafe outcomes.
- From Evidence to Action: How Tool-Using Agents Failraises · addresses
Long-horizon program synthesis and verification2 papers raise it · 2 address it
Agents struggle with scalable, verifiable training environments for long-horizon tasks like program reproduction or checker synthesis.
- ProgramGym: Scaling Training Environments for Long-Horizon Program Reproduction Agentsraises · addresses
- CheckerBench: Can Long-Horizon Agents Synthesize Static-Analysis Checkers?raises · addresses

Named by an AI from these papers' abstracts.

Open problems

Recently funded

Topics in this field

indirect prompt injection · prompt injection · ai agents397 papers47 this week
coding agents · coding agent · code generation217 papers41 this week
agents · tool · multi agent395 papers29 this week
code generation · language models llms · compiler139 papers28 this week
proof assistant · proof search · theorem provers97 papers17 this week
specification generation · formal specifications · formalization77 papers14 this week

Topics in this field

Active contributors · 90 days

Active contributors

Activity · 12 weeks

Activity

Recent papers

All papers in Research

arXiv cs.SEOct 29
Soei: Structured Observability of Evidence and Intent for Multi-Agent AI Software Engineering
Mohammed Nayeem Khan, K S Sarun Kumar
AI coding agents now do long, multi-step and multi-session software work with little supervision. When a developer comes back to that work, the useful question is not what the model said but what was actually done, by whom, and whether it is finished. We study this in three parts. First, we verify Agenttrail, an open-source local observability tool for coding agents, against its source at commit e4ba2da: nine documented constants and mechanisms hold at file-and-line level, two event pipelines are never unified, and its Map service has an unauthenticated local mutation surface. Second, we run a prototype of our system on 45 real coding-agent sessions (102,233 records, 20,577 tool executions, 2,336 human-to-agent episodes). With a blind-audited classifier (precision 83.3% and 96.7%) we estimate that 23.4% (95% CI 17.1 to 35.7) of code-editing episodes end with no independent check after the last edit, and that 57.8% of to-dos the agent marked complete after editing had no proof in between. A 10-minute timing heuristic for session hand-offs recovers 6 of the 24 session pairs that content lineage links. 42% of sessions run longer than 24 hours, 48.1% of transcript bytes lie past a 2…
PDF arXiv
arXiv cs.AIOct 29
Verifiable LLM-Guided Focal SMT Solving for Quantified Arrays
Kunhang Lv, Rui Han, Fuqi Jia, Yuhang Dong, Feifei Ma +1
Large language models can often identify useful semantic structure in formal artifacts, but their outputs cannot be trusted as proofs or solver decisions. We study whether LLMs can instead guide formal reasoning systems through a narrow, solver-verifiable interface. We instantiate this idea in quantified array SMT solving, where modern instantiation-based techniques can fail when key ground terms and equalities are hidden by auxiliary variables, axiom guards, and nested array terms. We observe that many instances are largely driven by a small set of focal ground terms or constraints, similar to the backdoor sets in SAT solving. Building on this, we present LinguaArray, a framework where an LLM proposes a small Semantic Focus Set (ground terms/constraints), while a conventional SMT solver remains the sole proof engine and certifies all results. LinguaArray uses these LLM-suggested, solver-validated finite sets to significantly enhance solver capability, solving additional satisfiable and unsatisfiable instances that the backend alone fails to solve. It interacts within a finite time and then falls back to the backend solver to mitigate potential regressions. Evaluation on 1015…
PDF arXiv
arXiv cs.SEOct 29
Well-Specified and Well-Tested? Assessing SWE-bench-Style Datasets with a Self-Evolving Agent
Zhonghao Jiang, Xuyang Zheng, Yanfu Yan, Zhongxin Liu, Lingfeng Bao +1
Large language models (LLMs) have shown strong performance on software engineering (SE) tasks, driving the need for high-quality datasets for reliable training and evaluation. SWE-bench-style datasets (SWE datasets) are widely used to evaluate LLM-based coding agents on real-world software issues, where task clarity and test coverage directly affect whether instances are solvable and verifiable. However, quality issues persist in existing SWE datasets, and manual annotation is costly and labor-intensive, motivating LLM-based annotation. Existing approaches typically rely on static, overly general rubrics, limiting their ability to handle diverse and nuanced scenarios and often yielding high false positive rates. In contrast, human annotators draw on accumulated experience to make context-aware judgments. Inspired by this, we propose ExLabel, an LLM-based, self-evolving, experience-guided assistant for task clarity and test coverage assessment in SWE datasets. ExLabel maintains an evolving experience bank that distills cross-instance knowledge into stable yet adaptive judgment criteria and reuses relevant experience to guide the assessment of new instances. For systematic…
PDF arXiv
arXiv cs.AIOct 29
Retaining Repair Hypotheses for Cost-Aware Execution
Jae Hun Hwang, Hong-In Won
Several corrections of an executable model can fit the same observations while predicting different execution outcomes. We study a repair-to-execution interface that retains compatible finite guard repairs, conditions their weights on diagnostic and ordinary-execution observations, and uses their predictions to choose routes, priced tests, or a backup. On 24 synthetic two-stage devices, an equal mixture of a language-model-generated repair and a uniform belief over compatible repairs (the AI-weighted belief) lowers no-test cost by 2.14 percent relative to committing to the generated repair. Access charges can erase the benefit of diagnosis on isolated tasks, while repeated work can recover it under the AI-weighted belief. With normal-execution learning in every repeated-work arm, workload-valued testing costs 3.33 percent less than same-budget random selection under the AI-weighted belief. Weighting changes the comparison: uniform normal learning costs 540.75 less than AI-weighted normal learning on this cohort, with a device-paired interval excluding zero. Testing recovers part of that gap, but uniform normal learning still has a lower aggregate cost than AI-weighted…
PDF arXiv
arXiv cs.AIOct 29
AgentDecept: Benchmarking Deceptive Behavior in Tool-Using LLM Agents under Pressure
Yehan Zhang, Qianqi Yan, Hang Yin, Ching-Chen Kuo, Shan Jiang +3
LLM agents increasingly carry out multi-turn tasks across everyday applications, yet users often see only the agent's report rather than the observations, API calls, and state changes behind it. Existing deception benchmarks have studied long-horizon interactions and tool-use settings, but whether agents faithfully report their actions across realistic, stateful application workflows remains underexplored. To address this gap, we introduce AgentDecept, an executable benchmark for evaluating behavioral deception under pressure. AgentDecept contains 477 pressure variants derived from 257 source tasks across six pressure sources, each paired with a pressure-free counterpart. Interventions enter through event messages, task context, application state, tool responses, and service quotas, spanning explicit events and implicit task or environment changes. Our evidence-grounded protocol evaluates full trajectories by relating user-facing claims to time-ordered observations and executed outcomes, distinguishing falsification, concealment, and equivocation from honest failure and disclosed limitations. The resulting behavioral labels also provide a setting for testing existing…
PDF arXiv
arXiv cs.CROct 29
DualGuard: Comprehensive and Efficient Memory Safety across Sequential and Speculative Execution
Sixuan Dang, Quan Zhou, Kaiming Huang, Jianan Zhu, Anitha Gollamudi +2
Although decades of research have yielded sophisticated mechanisms for enforcing memory safety, speculative execution can subvert these protections through transient memory operations. Conversely, defenses designed specifically for speculative safety, such as Speculative Load Hardening (SLH), cannot enforce memory safety during non-speculative execution. A naive combination of defenses from both domains raises two fundamental challenges: (1) which combination of otherwise fragmented defenses can ensure dual memory safety under speculative and non-speculative executions? (2) whether such combinations introduce redundant protections that incur unnecessary performance overhead? We present DualGuard, a unified framework for dual memory protection under non-speculative and speculative executions. DualGuard systematically analyzes memory behaviors, classifying them into four categories, and further identifies the minimal composition requirements for dual memory safety, which allow us to strategically combine existing mitigations and design new ones to avoid redundant or excessive protections. We implement DualGuard through a combination of static analysis and runtime enforcement within…
PDF arXiv

Papers

Topics in this field

indirect prompt injection · prompt injection · ai agents397 papers47 this week
coding agents · coding agent · code generation217 papers41 this week
agents · tool · multi agent395 papers29 this week
code generation · language models llms · compiler139 papers28 this week
proof assistant · proof search · theorem provers97 papers17 this week
specification generation · formal specifications · formalization77 papers14 this week

Recent papers

All papers in Research

arXiv cs.SEOct 29
Soei: Structured Observability of Evidence and Intent for Multi-Agent AI Software Engineering
Mohammed Nayeem Khan, K S Sarun Kumar
AI coding agents now do long, multi-step and multi-session software work with little supervision. When a developer comes back to that work, the useful question is not what the model said but what was actually done, by whom, and whether it is finished. We study this in three parts. First, we verify Agenttrail, an open-source local observability tool for coding agents, against its source at commit e4ba2da: nine documented constants and mechanisms hold at file-and-line level, two event pipelines are never unified, and its Map service has an unauthenticated local mutation surface. Second, we run a prototype of our system on 45 real coding-agent sessions (102,233 records, 20,577 tool executions, 2,336 human-to-agent episodes). With a blind-audited classifier (precision 83.3% and 96.7%) we estimate that 23.4% (95% CI 17.1 to 35.7) of code-editing episodes end with no independent check after the last edit, and that 57.8% of to-dos the agent marked complete after editing had no proof in between. A 10-minute timing heuristic for session hand-offs recovers 6 of the 24 session pairs that content lineage links. 42% of sessions run longer than 24 hours, 48.1% of transcript bytes lie past a 2…
PDF arXiv
arXiv cs.AIOct 29
Verifiable LLM-Guided Focal SMT Solving for Quantified Arrays
Kunhang Lv, Rui Han, Fuqi Jia, Yuhang Dong, Feifei Ma +1
Large language models can often identify useful semantic structure in formal artifacts, but their outputs cannot be trusted as proofs or solver decisions. We study whether LLMs can instead guide formal reasoning systems through a narrow, solver-verifiable interface. We instantiate this idea in quantified array SMT solving, where modern instantiation-based techniques can fail when key ground terms and equalities are hidden by auxiliary variables, axiom guards, and nested array terms. We observe that many instances are largely driven by a small set of focal ground terms or constraints, similar to the backdoor sets in SAT solving. Building on this, we present LinguaArray, a framework where an LLM proposes a small Semantic Focus Set (ground terms/constraints), while a conventional SMT solver remains the sole proof engine and certifies all results. LinguaArray uses these LLM-suggested, solver-validated finite sets to significantly enhance solver capability, solving additional satisfiable and unsatisfiable instances that the backend alone fails to solve. It interacts within a finite time and then falls back to the backend solver to mitigate potential regressions. Evaluation on 1015…
PDF arXiv
arXiv cs.SEOct 29
Well-Specified and Well-Tested? Assessing SWE-bench-Style Datasets with a Self-Evolving Agent
Zhonghao Jiang, Xuyang Zheng, Yanfu Yan, Zhongxin Liu, Lingfeng Bao +1
Large language models (LLMs) have shown strong performance on software engineering (SE) tasks, driving the need for high-quality datasets for reliable training and evaluation. SWE-bench-style datasets (SWE datasets) are widely used to evaluate LLM-based coding agents on real-world software issues, where task clarity and test coverage directly affect whether instances are solvable and verifiable. However, quality issues persist in existing SWE datasets, and manual annotation is costly and labor-intensive, motivating LLM-based annotation. Existing approaches typically rely on static, overly general rubrics, limiting their ability to handle diverse and nuanced scenarios and often yielding high false positive rates. In contrast, human annotators draw on accumulated experience to make context-aware judgments. Inspired by this, we propose ExLabel, an LLM-based, self-evolving, experience-guided assistant for task clarity and test coverage assessment in SWE datasets. ExLabel maintains an evolving experience bank that distills cross-instance knowledge into stable yet adaptive judgment criteria and reuses relevant experience to guide the assessment of new instances. For systematic…
PDF arXiv
arXiv cs.AIOct 29
Retaining Repair Hypotheses for Cost-Aware Execution
Jae Hun Hwang, Hong-In Won
Several corrections of an executable model can fit the same observations while predicting different execution outcomes. We study a repair-to-execution interface that retains compatible finite guard repairs, conditions their weights on diagnostic and ordinary-execution observations, and uses their predictions to choose routes, priced tests, or a backup. On 24 synthetic two-stage devices, an equal mixture of a language-model-generated repair and a uniform belief over compatible repairs (the AI-weighted belief) lowers no-test cost by 2.14 percent relative to committing to the generated repair. Access charges can erase the benefit of diagnosis on isolated tasks, while repeated work can recover it under the AI-weighted belief. With normal-execution learning in every repeated-work arm, workload-valued testing costs 3.33 percent less than same-budget random selection under the AI-weighted belief. Weighting changes the comparison: uniform normal learning costs 540.75 less than AI-weighted normal learning on this cohort, with a device-paired interval excluding zero. Testing recovers part of that gap, but uniform normal learning still has a lower aggregate cost than AI-weighted…
PDF arXiv
arXiv cs.AIOct 29
AgentDecept: Benchmarking Deceptive Behavior in Tool-Using LLM Agents under Pressure
Yehan Zhang, Qianqi Yan, Hang Yin, Ching-Chen Kuo, Shan Jiang +3
LLM agents increasingly carry out multi-turn tasks across everyday applications, yet users often see only the agent's report rather than the observations, API calls, and state changes behind it. Existing deception benchmarks have studied long-horizon interactions and tool-use settings, but whether agents faithfully report their actions across realistic, stateful application workflows remains underexplored. To address this gap, we introduce AgentDecept, an executable benchmark for evaluating behavioral deception under pressure. AgentDecept contains 477 pressure variants derived from 257 source tasks across six pressure sources, each paired with a pressure-free counterpart. Interventions enter through event messages, task context, application state, tool responses, and service quotas, spanning explicit events and implicit task or environment changes. Our evidence-grounded protocol evaluates full trajectories by relating user-facing claims to time-ordered observations and executed outcomes, distinguishing falsification, concealment, and equivocation from honest failure and disclosed limitations. The resulting behavioral labels also provide a setting for testing existing…
PDF arXiv
arXiv cs.CROct 29
DualGuard: Comprehensive and Efficient Memory Safety across Sequential and Speculative Execution
Sixuan Dang, Quan Zhou, Kaiming Huang, Jianan Zhu, Anitha Gollamudi +2
Although decades of research have yielded sophisticated mechanisms for enforcing memory safety, speculative execution can subvert these protections through transient memory operations. Conversely, defenses designed specifically for speculative safety, such as Speculative Load Hardening (SLH), cannot enforce memory safety during non-speculative execution. A naive combination of defenses from both domains raises two fundamental challenges: (1) which combination of otherwise fragmented defenses can ensure dual memory safety under speculative and non-speculative executions? (2) whether such combinations introduce redundant protections that incur unnecessary performance overhead? We present DualGuard, a unified framework for dual memory protection under non-speculative and speculative executions. DualGuard systematically analyzes memory behaviors, classifying them into four categories, and further identifies the minimal composition requirements for dual memory safety, which allow us to strategically combine existing mitigations and design new ones to avoid redundant or excessive protections. We implement DualGuard through a combination of static analysis and runtime enforcement within…
PDF arXiv

Active contributors · 90 days

Activity · 12 weeks

Fields · AI · updated 2h ago

Agents & indirect prompt injection

Found by the topic model: agents, indirect prompt injection, code generation.

187papers this week−31.0% vs last week

All papers · 1.4k With code · 38

Newest Most relevant

946 papers this month

Open problems in Agents & indirect prompt injection

Lack of harness-specific evaluation benchmarks3 papers raise it · 2 address it
Agent performance depends on both models and harnesses, but most benchmarks focus only on model capabilities, leaving harness reliability and failure attribution underexplored.
- Trial by Trace: Benchmarking AI Agent Harnesses for Reliability and Failure Attributionraises · addresses
- Doc2Harness: Benchmarking LLMs on Long-Horizon Harness Engineering of Coding Agentsraises · addresses
- AgentSWE: Can Coding Agents Build the Agent You Actually Want?raises
Outcome-capability gap in evolving environments1 paper raises it · 1 addresses it
Evaluating agents by outcomes alone obscures the underlying capabilities, especially in dynamic settings where outcomes and mechanisms diverge.
- LiveMACE: Process-Aware Evaluation of LLM Agent Capabilities in Evolving Marketsraises · addresses
Security of vibe-coded agent outputs1 paper raises it · 1 addresses it
Agents often produce functional but insecure code, as security is not explicitly addressed in requirements or evaluations.
- Last Secure Code Benchmark: Is the Code You Vibe Secure?raises · addresses
Evidence-to-action chain failures in tool use1 paper raises it · 1 addresses it
Agents may act without sufficient evidence or fail to complete multi-step workflows, leading to unreliable or unsafe outcomes.
- From Evidence to Action: How Tool-Using Agents Failraises · addresses
Long-horizon program synthesis and verification2 papers raise it · 2 address it
Agents struggle with scalable, verifiable training environments for long-horizon tasks like program reproduction or checker synthesis.
- ProgramGym: Scaling Training Environments for Long-Horizon Program Reproduction Agentsraises · addresses
- CheckerBench: Can Long-Horizon Agents Synthesize Static-Analysis Checkers?raises · addresses

Named by an AI from these papers' abstracts.