Blog

Latest Additions

• The Artistic Process Becomes the Recipe Graph - Kaustubh Kumar, Ashutosh Ranjan, Vivek Srivastava, Blessin Varkey, and Shirish Karande's ArtMine: Discovering and Formalizing Artistic Processes paper, arXiv:2607.08331, cs.LG with cs.AI cross-listing, submitted July 9 2026, 47-page PDF, 10 figures, TCS Research and Indian Institute of Technology Patna affiliations in the PDF text, ICML 2026 Workshop on Human-AI Co-Creativity, evidence construction from open-domain museum records conservation reports technical reports correspondence archival documents exhibition catalogs scholarly articles and provenance records, 11-part evidence schema, direct indirect interpretation and speculative evidence tags, preserved conflicts, Peircean abductive agent, observation rule hypothesis and action structure, evidence-grounded production steps, compositional directed acyclic graph, visual prompt generation, self-reflection over deviations between generated and reference artworks, MiroThinker 1.7 mini evidence construction, Qwen2.5-VL solver composition and visual-prompt agents, FLUX.1-dev image generation, ten WikiArt artworks, five canonical and five non-canonical works, CSD LPIPS and CLIP evaluation, CoT CoT-SC ToT and Self-Refine baselines, ArtMine canonical scores of CSD 0.395 LPIPS 0.527 and CLIP 0.916, stage-wise reconstruction caveat, archive-availability bias, underdetermined historical-process caveat, oral collaborative marginalized and non-Western practice limitation, process graph receipts, and the governance problem of treating a generated art-historical recipe as evidence before sources, evidence tags, conflicts, inferred steps, graph, prompt, model, uncertainty, human reviewer, and non-use boundary are auditable.
• The CRA Certificate Becomes the Conformity Clock - Víctor Mayoral-Vilches's Certifying Ghosts: How Cybersecurity AI Agents Break the EU Cyber Resilience Act paper, arXiv:2607.07109, cs.CR, submitted July 8 2026, 17-page PDF, Alias Robotics affiliation in the paper text, EU Cyber Resilience Act Regulation (EU) 2024/2847, products with digital elements, CRA entry into force on December 10 2024, reporting obligations from September 11 2026, main obligations from December 11 2027, manufacturer risk assessment, technical documentation, conformity assessment, CE marking, declaration of conformity, support period, vulnerability handling during support period, actively exploited vulnerability reporting, severe incident reporting, 24-hour early warning, 72-hour full notification, final report timing, cybersecurity AI agents as offensive and defensive security instruments, process-oriented conformity, four claimed premises of human-scarce discovery, point-in-time knowable posture, discrete exploitation signal, and remediation pace, bends-versus-breaks argument, landscape validity, point-in-time certificate staleness, substantial-modification trigger gap, known exploitable vulnerability condition, agentic vulnerability discovery, agentic defense, Robot Immune System case study, Unitree G1 humanoid and Hookii robotic lawn mower examples, reported attacker success reduction from 79 percent to 14 percent on the humanoid and 75 percent to 8 percent on the mower, prediction-versus-fact caveat, vendor-associated demonstration caveat, conformity clock receipts, and the governance problem of treating a product-security certificate as current before threat-capability baseline, reassessment trigger, vulnerability queue, reporting path, support-period clock, human owner, and expiration rule are auditable.
• The Prompt Becomes the Activation Capsule - Thibaud Ardoin, Semira Einsele, Evis Bregu, and Gerhard Wunder's Prompt Compression via Activation Aggregation paper, arXiv:2607.08399, cs.CL with cs.LG cross-listing, submitted July 9 2026, 15-page PDF, Freie Universitat Berlin affiliation in the PDF text, activation-space prompt compression, repeated system prompts instructions policies and few-shot prefixes, hidden-state extraction, single patch vector, placeholder-token residual-stream injection, off-the-shelf LLMs without full model fine-tuning, Weighting MLP, Transformer Compressor, learned weighted sum of intermediate-layer activations, four-layer feedforward W-MLP with hidden dimensions 2048 1024 512 and 256, Transformer Compressor with hidden dimension 64 two attention heads and two layers, UTF-8 replacement-character placeholder, Llama3.1-8B-Instruct main model, Ministral3-8B-Instruct-2512 Qwen3.5-4B and Llama3.2-1B-Instruct checks, NVIDIA RTX A5500, default Llama3.1 extraction layer 12 and injection layer 2, Toy Task dataset, ARC-Easy, in-distribution tasks including capitals ISO country codes continents event years English-to-French translation art authorship antonyms and currency codes, out-of-distribution tasks French-to-English translation chemical element symbols and small-integer addition, W-MLP Toy Task test accuracy 85.35 percent versus full-prompt 86.92 percent masked-prompt 34.03 percent and Transformer Compressor 70.63 percent, ARC-Easy generalization pattern favoring W-MLP, middle-layer extraction and early-layer injection ablation finding, lossy-compression caveat, short-prompt and knowledge-retrieval focus, reasoning and long-context generalization not established, white-box activation access requirement, compression-time cost amortized over repeated reuse, anonymous reproduction repository, activation capsule receipts, and the governance problem of treating hidden-state prompts as operationally approved before original prompt provenance, model binding, extraction layer, injection layer, placeholder token, accuracy drop, reuse scope, revocation rule, and reviewer decision are auditable.
• The Pose Estimate Becomes the Biomechanical Witness - Ayda Eghbalian and Kevin Desai's Pose-to-Biomechanics: Bridging 3D Human Pose Estimation and Biomechanical Attribute Prediction paper, arXiv:2607.08725, cs.CV with cs.AI and cs.LG cross-listings, submitted July 9 2026, 23-page PDF, 2 figures, University of Texas at San Antonio Department of Computer Science affiliation in the arXiv HTML, BioModule project page and UTSA-VIRLab GitHub repository, markerless 3D human pose estimation, vision-based biomechanics, plug-in temporal transformer, estimator-agnostic downstream module, standard 17-joint 3D skeleton input, 17 biomechanical criteria across kinematic kinetic and neuromuscular tiers, coordinates speed acceleration active torque passive torque ideal torque mechanical power ground reaction force seat reaction activation excitation normalized active torque angle scaling velocity scaling and maximum joint torque outputs, Human3.6M and Human3.6Mplus alignment, 520,509 frames, 210 subject-activity clips, 7 subjects, 30 standardized activities, 50 fps, 4 synchronized camera views, sub-pixel alignment below 0.28 pixels for the reproduced 17-joint subset, pelvis anchor verification, train subjects S1 S5 S6 S7 and S8, held-out S9 and S11 test subjects, seven upstream estimators VideoPose3D MHFormer D3DP PoseMamba MotionAGFormer KTPFormer and TCPFormer, frozen and 10-epoch fine-tuning protocols, kinematic outputs more stable than kinetic and neuromuscular outputs, pose-estimation accuracy not sufficient for biomechanical fidelity, controlled Human3.6M data limitation, simulation-derived label and musculoskeletal-assumption caveats, reduced 17-joint skeleton limitation, real-world outdoor occlusion camera-motion clothing clinical and sports validation gap, biomechanical witness receipts, and the governance problem of treating video-derived body-load inference as evidence before camera context, consent basis, pose model, skeleton convention, validation population, uncertainty, task boundary, and reviewer decision are auditable.
• The Jailbreak Becomes the Attribution Graph - Anupam Wagle, Ifrat Ikhtear Uddin, Chaowei Zhang, and Longwei Wang's Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs paper, arXiv:2607.07903, cs.CR with cs.AI cross-list, submitted July 8 2026, 33-page PDF, internal computation graphs for jailbreak diagnosis, paired clean and attacked prompts, sparse transcoder features, error nodes, top-k 80 edge sparsification, feature-space alignment with cosine threshold 0.5, Llama-2-7B-chat-hf experimental focus, 4,096 features per transcoder, mean KL divergence 0.0027 and top-1 accuracy 99.2 percent in the reported setup, graph deviation, safety suppression, attack emergence, and path rerouting metrics, 30 paired prompts, 4 successful adversarial prompts for 13.3 percent success, path rerouting Pearson r 0.461 with p 0.010, only listed metric with confidence interval excluding zero, top-three emerged-feature zero-ablation failing to restore refusal on all 4 successful attacks, semantic-bridging subset caveat with r 0.865 and p 0.001 for context-switching attacks, Llama-only and single-forward-pass limitations, partial graph-coverage caveat, jailbreak graph receipts, and the governance problem of treating a safety failure as understood before model checkpoint, prompt families, graph construction, alignment rule, rerouting score, intervention target, mitigation result, and claim boundary are auditable.
• The Tool Call Becomes the Scope Warrant - Shane Caldwell, Max Harley, Ads Dawson, Michael Kouremetis, Vincent Abruzzo, and Will Pearce's ScopeJudge: Cost-Aware Pre-Execution Gating for Offensive Security Agents paper, arXiv:2607.07774, cs.CR, submitted July 8 2026, 22-page PDF, 4 figures, 4 tables, dreadnode USA affiliations in the arXiv HTML, offensive security agents, pre-execution gating, request-conditioned scope, 100 information-security trajectories, ScopeBench, 30 tasks engineered to tempt scope violations, 4,897 labeled tool-call decisions, 7.7 percent violations, five professional penetration-tester labels per call, Fleiss kappa 0.64, mean pairwise Cohen kappa 0.64, expert reference F1 0.78, source agents spanning Anthropic Alibaba Moonshot Google and OpenAI families, eight judge models, five transcript strategies including Static Policy Intent Intent Plus Tool Calls Intent Plus Output Summarized and Full, static-policy median recall 0.005 for seven of eight judges, intent-only recall jump to 0.60 to 0.94, GLM-5.2 best F1 0.66 at 0.0060 dollars per call, Claude Opus 4.8 F1 0.60 at 2.9x GLM-5.2 per-call cost, cost-sensitive GLM-5.2 plus Intent Plus Tool Calls catching 87 percent of violations at precision 0.50 for 0.0032 dollars per call, recall-first Claude Opus 4.8 plus Intent catching 94 percent at precision 0.39 while flagging 19 percent of calls, single-suite English web-penetration-testing and bug-bounty limitation, adversarial-robustness caveat, prompt-injection surface caveat for history-bearing strategies, scope warrants, and the governance problem of treating a security agent's tool permission as authorization before user scope, proposed call, transcript strategy, judge model, monitor outcome, cost tradeoff, escalation, and reviewer decision are auditable.
• The Raft Leader Becomes the Reputation Ledger - Jie Zhang, Xubo Fan, Xiaohong Li, and Zhiyong Feng's TRM-Raft: A Byzantine-Resistant Raft Consensus via Integrated Trust and Reputation Model paper, arXiv:2607.08666, cs.CR, submitted July 9 2026, 11-page PDF, 7 figures, 2 tables, Tianjin University affiliation, Raft consensus, Internetware systems, Byzantine-resistant Raft, crash-fault-tolerant assumption, election forgery, log tampering, Blockchain-based Trust and Reputation Model, B-TRM, reputation values from 0 to 1, low-reputation voting and candidacy exclusion below 0.5, term and index anomaly detection, halving-style forgery penalty, Schnorr-signature log integrity verification, registered client public keys, leader replacement on tampering, Hyperledger Fabric 2.5 testbed, Go 1.18.3, 4 organizations, 1 certificate authority per organization, 15 orderer nodes, 50 peer nodes, Ubuntu 20.04 VMware setup, forgery tampering On-Off and discrimination attacks, tampering modifying 30 percent of client requests, On-Off attack with 90 percent normal and 10 percent malicious behavior, malicious leader ratio below 5 percent with 40 percent Byzantine nodes, throughput at 90 to 95 percent of vanilla Raft with maximum 9.2 percent degradation at 100 transactions, latency increase below 5 percent and under 15 seconds at 10000 transactions, ablation showing reputation-only still leaves successful tampering and signature-only still leaves malicious leadership, public DeFi and strict-BFT caveat, reordering/equivocation limit, consensus reputation receipts, and the governance problem of treating reputation-scored infrastructure as trustworthy before node identity, score history, observer set, signature check, rejected vote, leader change, attack model, overhead, and reviewer decision are auditable.
• The Gossip DAG Becomes the Data Trust - Amirhossein Taherpour and Xiaodong Wang's Secure Decentralized Federated Learning via Gossip and Virtual Voting paper, arXiv:2607.08651, cs.LG with cs.DC subject listing, submitted July 9 2026, 14-page PDF, Columbia University Department of Electrical Engineering affiliation, gspDAG-FL, decentralized federated learning, peer-to-peer gossip, event certificates, receiver-endorsed accepted gossip proofs, compact Topology DAG, Hashgraph-style virtual voting, full-node certificates, finality over unique model-origin tuples rather than identical local parameter states, payload validation, accepted-proof validation, private semantic audit, learning-clean lazy Byzantine and control-correct node model, safety conditional-liveness and convergence claims, MNIST classification and Penn Treebank language-modeling experiments, networks up to N=100, default N=15, target Byzantine ratio 0.15, lazy ratio 0.10, AD-PSGD BLADE-FL and ChainFL baselines, invalid-origin detection rates of 96.1 percent on MNIST and 95.7 percent on Penn Treebank with false alarms below 0.4 percent, normalized MNIST N=100 throughput 8.832 versus ChainFL 4.762 and BLADE-FL 0.342, normalized MNIST N=100 latency 3.118 versus ChainFL 6.742 and BLADE-FL 9.227, simulation-only and real-edge-trace future-work caveats, gossip-DAG receipts, and the governance problem of treating serverless federated learning as trustless before participant graph, origin tuple, proof, full-node set, quorum, validation gate, audit data, finality certificate, aggregation weights, fault model, and deployment limits are reviewable.
• The Budget Router Becomes the Allocation Receipt - Teng-Ruei Chen's Resample or Reroute? Budget-Aware Test-Time Model Selection for Large Language Models paper, arXiv:2607.08665, cs.LG, submitted July 9 2026, 10-page PDF, 3 figures, National Yang Ming Chiao Tung University and Krixvon affiliations, official luka-krixvon/resample-or-reroute-experiment reproducibility repository, budget-aware test-time model selection, resample-or-reroute RoR policy, fixed per-query budget, imperfect verifier, marginal correctness per unit cost, greedy and UCB variants, oracle-allocation ceiling, regenerated multi-draw correctness tensors, 11 open-weight models, 8 pretraining lineages, GSM8K MATH-500 GPQA-Diamond and HumanEval+ benchmarks, 30 seed-aligned draws per query-model cell at temperature 0.2 in the repository protocol, 50/50 query split, train-half prior calibration, test-half reporting over 20 randomized draw orderings, matched mid-budget repository table with RoR 0.993 GSM8K 0.877 MATH-500 0.892 GPQA-Diamond and 0.962 HumanEval+, verifier-gated gains, GPQA q=1.0 to 0.8 to 0.6 drop from 0.968 to 0.710 to 0.675, agreement-verifier weakness on multiple-choice GPQA, HumanEval+ base-test verifier 1.0 percent false-accept rate, parameter-count cost proxy, July 2026 provider-price replay caveat, adaptive sequential round-trip latency limit, allocation receipts, and the governance problem of treating a model-routing score as efficiency evidence before model pool, cost vector, budget, verifier, priors, draw history, stopping rule, latency, price snapshot, final selector, and rejected samples are auditable.
• The Dexterous Hand Becomes the Embodiment Receipt - Yunchao Yao, Zhuxiu Xu, Tianqi Zhang, Zixian Liu, Sikai Li, Zhenyu Wei, Feng Chen, Dihong Huang, Kechang Wan, Chenyang Ma, Shuqi Zhao, Shenghua Gao, Masayoshi Tomizuka, Yi Ma, and Mingyu Ding's DexVerse: A Modular Benchmark for Multi-Task, Multi-Embodiment Dexterous Manipulation paper, arXiv:2607.08751, cs.RO, submitted July 9 2026, 22-page PDF, UNC-Chapel Hill University of Hong Kong and UC Berkeley affiliations, DexVerse, modular benchmark for multi-task multi-embodiment dexterous manipulation, 100 tasks, eight categories including primitive functional articulation non-prehensile contact-rich bimanual coordination multi-goal and long-horizon manipulation, 3 robot arms including Franka Research 3 UR10e and xArm 7, 6 dexterous hands including Sharpa Wave WUJI Hand Shadow Hand Inspire Hand Allegro Hand and LEAP Hand, configurable visual variation across textures background lighting and camera viewpoints, VR teleoperation interface, 3,180 demonstrations, synchronized proprioceptive RGB depth point-cloud and simulator-state observations, Diffusion Policy DP3 OpenVLA and pi-zero-point-five baselines across 19 tasks, DP3 and pi-zero-point-five 0.34 mean online success, Diffusion Policy 0.32, OpenVLA 0.19, PushT zero success for all four policies, InsertPen SlideUtilityKnife and OpenLaptop at or near zero, project page code repository and data-coming-soon status, real-robot-transfer future-work limit, embodiment receipts, and the governance problem of treating a robot manipulation score as deployment evidence before task category, object assets, arm, hand, observation mode, camera policy, visual randomization, demonstration source, rollout count, success predicate, failure trace, simulator version, and real-robot transfer status are auditable.
• The Disability Prompt Becomes the Stereotype Test - Sophia Lichtenberg, Albert Gatt, and Judith Masthoff's Beyond wheelchairs and blindfolds: Investigating disability stereotypes in T2I models with INCLUDE-BENCH paper, arXiv:2607.08515, cs.CV, submitted July 9 2026, 13-page PDF, Utrecht University title-page affiliation, INCLUDE-BENCH, disability stereotypes in text-to-image models, 352 prompts, No Context, No Context plus Bias, Only Context, and Action prompt subsets, WHO ICF activity-domain grounding, 119,680 generated images, 17 text-to-image models, 15 open-source and 2 closed models, Stable Diffusion and FLUX families, Qwen-Image, JanusPro-7B, NanoBanana, GPT-Image-1-mini, SAM3 person cropping, MiniBatchKMeans clusters, Qwen3-VL-8B-Instruct captions and VQA, CLIPScore, Vendi Score, Stereotype Content Model score, wheelchair and blindfold visual shorthands, higher disability-text alignment with lower diversity for physical and generic disability prompts, older white people overrepresented in disability-conditioned outputs, gendered domestic and public context skew, no PWD human annotation limitation, automated-metric caveat, representation receipts, and the governance problem of treating generated disability imagery as inclusive before prompt, model, seed policy, cropper, captioner, metric, affected-community review, and claim boundary are auditable.
• The Thinking Chain Becomes the Uncertainty Meter - Mayank Singal's When Thinking Hurts: Epistemic Signals in the Reasoning Chains of Visual Language Models paper, arXiv:2607.08059, cs.LG with cs.AI cross-list, submitted July 9 2026, 7-page PDF, 2 figures, 5 tables, oral paper at the 2nd Workshop on Epistemic Intelligence in Machine Learning EIML at ICML 2026 in Seoul, independent researcher affiliation note, thinking-mode visual language models, answer entropy, thinking chain entropy, chain length, POPE adversarial, COCO val2014 object-presence questions, HallusionBench visual questions, VQAv2 pilot, Qwen3-VL-8B-Thinking, Qwen3-VL-8B-Instruct control, GLM-4.1V-9B-Thinking, InternVL3-8B, greedy decoding, single A100-SXM4-40GB setup for Qwen models, answer-entropy collapse, Qwen answer entropy AUROC 0.899 non-thinking versus 0.492 thinking, Qwen chain entropy 0.647, GLM answer entropy 0.716 and chain entropy 0.759, InternVL3 50 percent chain rate, InternVL3 chain-only comparison 0.608 versus 0.602 with low false-positive count caveat, 300-sample VQAv2 pilot, pooled chain entropy 0.680 versus answer entropy 0.595, free-form answer gap 0.733 versus 0.467, HallusionBench moderate Qwen signal around 0.64, structured abstention affecting 12 to 22 percent of queries, POPE accuracy raised from 71.0 percent to 93.8 percent at 62.7 percent coverage by a no-extra-inference abstention gate, larger-model and stochastic-decoding limits, confident hallucination caveat, thinking-chain uncertainty receipts, and the governance problem of treating visible reasoning as trust evidence before model checkpoint, thinking mode, decoding policy, chain generation rate, answer entropy, chain entropy, chain length, abstention asymmetry, coverage threshold, calibration split, false-negative examples, and human review policy are auditable.
• The Analyser Becomes the Safety Case - Samuel Tetteh, Udip Shrestha, Joshua R. Waite, and Cody Fleming's Who Analyses the Analyser? Self-Validating LLM Hazard Analysis with Constitutional Meta-STPA paper, arXiv:2607.08054, submitted July 9 2026, cs.LG with cs.AI cross-list, 26-page PDF, Iowa State University affiliations, Systems-Theoretic Process Analysis, LLM-assisted hazard analysis, Constitutional Meta-STPA, analyser-as-system framing, losses hazards controllers unsafe control actions and constraints, deterministic UCA slot enumeration, 21 Tool Principles, 8 Meta-Safety Principles, audit logging, run manifests, model and version pinning, hash-only logging, constitution pinning, semantic-matching voting, validator-gated export, prompt-injection resilience, eight validators for completeness four-type coverage evidence no-fabrication measurability responsibility overconfidence and limitations, Markdown and JSON inspection artifacts, PDF and email export gate, self-derivation experiment, claude-opus-4.8 plus claude-sonnet-4 recovering 18 of 21 canonical principles and all 8 governance principles, gpt-4o-mini plus gpt-4o recovering 12 of 21 and 3 of 8, second independently authored AI-assisted code and security review tool, 20 adversarial probes, mean safety score 1.03 to 1.85, Wilcoxon p=0.0004, Cohen d=1.29, five-vendor ordinary STPA runs across gpt-4o claude-sonnet-4 gemini-2.5-flash llama-3.3-70b and deepseek-v3, automatic emergency braking infusion pump and UAV autoland systems, lexical-scanner and LLM-judge limitation, Cohen kappa 0.39, no human-expert baseline, hosted-model drift caveat, analyser receipts, and the governance problem of treating an AI-written hazard analysis as safety evidence before system hash, constitution hash, tool version, model version, prompt and response hashes, validators, vote report, export decision, reviewer edits, and release destination are auditable.
• The Predicate Axis Becomes the Long-Context Receipt - Siddhartha Jain and Ameya Velingker's Understanding Axes of Difficulty For Long Context Tasks Via PredicateLongBench paper, arXiv:2607.08284, cs.AI, submitted July 9 2026, 31-page PDF, NVIDIA affiliations, PredicateLongBench, long-context evaluation, contiguous word-sequence search, largest subsequence satisfying predicates, unary prefix suffix and contains-string predicates, binary lexicographic predicates, difficulty axes including computation adversarial decoys search-space size quantifier complexity and context-structure hardness, synthetic random word-like strings, LongBench v2 natural-document word streams, approximately 128K-token synthetic contexts under the Qwen tokenizer, up to 365K-token LongBench-derived contexts, 100 examples per variant and 93 open-source LongBench-subset examples under 170K tokens, GPT 5.4 Gemini 3.1 Pro Preview Opus 4.6 MiniMax 2.7 GLM 5.1 and Qwen 3.5 397B evaluations, 16K output-token default, no LLM-generated benchmark data or LLM-as-judge requirement, binary-predicate difficulty, decoy-collapse findings, search-space-over-token-count finding, inference-compute caveat, long-context difficulty-axis receipts, and the governance problem of treating a context-window claim as meaningful before predicate family, quantifier, decoy policy, item count, output budget, validation rule, model version, and failure mode are recorded.
• The DOM Block Becomes the Citation Receipt - Ying Liu, Yi Ye, Quanyu Feng, Mingxi Ye, Mingtao Zhang, Haoyang Li, Chen Jason Zhang, and Qing Li's PolyUQuest: Verifiable Structure-Aware Web RAG over Heterogeneous Graphs paper, arXiv:2607.08269, cs.AI, submitted July 9 2026, 5-page PDF, The Hong Kong Polytechnic University affiliation, CIKM 2026 header, structure-aware Web RAG, heterogeneous website graph, webpage evidence-block entity and topic nodes, hyperlink topology, DOM hierarchy, entity-relation knowledge, source page heading path and entity-link provenance, two-tier router, Mode A direct factual lookup, Mode B linked-page navigation, Mode C entity-based multi-hop reasoning, official English PolyU website crawl, 4,240 pages, 31,086 DOM blocks, 29,119 resolved entities, 37,680 relations, 300 PolyU-Web questions, manually annotated official pages and reference evidence blocks, ChunkRAG HtmlRAG FastGraphRAG and LightRAG baselines, shared generator prompt and embedding setup, correctness 0.644, coverage 0.649, faithfulness 0.921, average 2,968 LLM query tokens, w/o DOM blocks ablation dropping correctness to 0.563 and coverage to 0.510, w/o cross-page mode ablation dropping correctness to 0.624 and coverage to 0.633, official GitHub serving stack with FastAPI Next.js Neo4j and Qdrant, offline indexing pipeline not included in the repository, Apache-2.0 code license and research-use dataset note, structure-aware citation receipts, and the governance problem of treating a generated website answer as supported before crawl boundary, graph schema, entity schema, block construction, heading path, source URL, retrieval mode, graph traversal path, token budget, and reviewer decision are auditable.
• The Agent Governance Roadmap Becomes the Responsibility Map - Mubarak Raji and Masooda Bashir's Towards Agentic AI Governance: A Preliminary Assessment paper, arXiv:2607.07612, cs.CY with cs.AI, submitted July 8 2026, AIR-RES 2026 conference comment in the arXiv API record, 16-page PDF, systematic review of agentic AI governance literature, Google Scholar ACM Digital Library SSRN JSTOR and AAAI repositories, 2020 to 2025 literature window, search terms including agentic AI governance governance of agentic AI and governance of autonomous agentic AI, more than 3,000 initial papers, about 995 AI-governance works after first narrowing, 552 autonomous-device papers excluded, 389 related-but-different AI-technology papers excluded, 54 core publications, 33 non-peer-reviewed works excluded, final corpus of 21 articles, definition and classification syndrome, autonomous goal-pursuit classification, moral-agency classification, agent attributes including adaptability autonomy goal complexity environmental interaction learning capability workflow optimization multi-agent systems and temporal coherence, principal-agent law discussion, privacy as an agent-governance issue, purpose limitation data minimization storage limitation transparency accountability automated decision making and erasure, Singapore Model AI Governance Framework for Agentic AI, IMDA January 2026 publication statement, risk categories including erroneous actions unauthorized actions biased or unfair actions data breaches and disruption to connected systems, four governance dimensions including risk bounding human accountability technical controls and end-user responsibility, stakeholder roles for international organizations regulators policymakers developers deployers researchers users and Global Majority participants, peer-reviewed-corpus limitation, common-law moral-agency limitation, roadmap receipts, and the governance problem of treating agentic AI governance as a label before agent definition, autonomy level, memory duration, delegation source, privacy map, stakeholder responsibility, jurisdictional assumption, and audit cadence are recorded.
• The Stimulus Generator Becomes the Affect Lab - Kushin Mukherjee, Na Yeon Kim, Maren Wehrheim, Ralph Adolphs, and Kohitij Kar's AI-guided stimuli discovery and generation to optimize facial emotion perception studies in autism paper, arXiv:2607.08533, cs.AI with cs.LG, submitted July 9 2026, 37-page PDF, York University Stanford University UC Riverside and Caltech affiliations, facial emotion perception studies in autism, image-level sparsity, Wang and Adolphs 2017 reanalysis, 18 autistic and 15 neurotypical adults in the source dataset, happy-versus-fearful forced-choice judgments, population-specific ANN behavioral decoders, AlexNet VGG-19 ResNet-50 ConvNeXt ViT CLIP and CORNet-S model suite, penultimate-layer or CLIP visual-embedding features, ridge-regression readouts, independent lab cohort of 12 autistic and 13 neurotypical adults, 100 ms face presentation, model-selected versus random image sets matched for identity and emotion-intensity coverage, CLIP-selected absolute ASD-NT separation 0.149 versus random mean 0.091 with empirical p=0.006, neurotypical-alignment predictor Spearman rho .82 p=.023, GANmut closed-loop facial-expression synthesis, online Prolific validation cohort of 120 autistic and 51 neurotypical adults, leave-one-image-out phenotype-matched validation, 15 original-synthesized image pairs, synthesized mean gap 0.076 versus original 0.138, 12 of 15 pairs moving in the predicted direction, group-average limitation, GAN-manifold limitation, narrow happy-fearful task limitation, online-recruitment caveat, stimulus-generator receipts, and the governance problem of treating generated affect stimuli as evidence before source dataset, participant criteria, consent, model layer, selection rule, synthesis constraint, validation cohort, subgroup analysis, statistical test, and claim boundary are auditable.
• The Forecast Probe Becomes the Self-Report Gap - Raphaël Sarfati, Pratyush Ranjan Tiwari, Siddharth Boppana, Christopher J. Earls, Srikar Varadaraj, and Eric Ho's What LLM Forecasters Know but Don't Say: Probing Internal Representations for Calibration and Faithfulness paper, arXiv:2607.08046, cs.CL with cs.AI, submitted July 9 2026, 29-page PDF, Goodfire and Eternis affiliations, LLM forecasters, calibration, chain-of-thought faithfulness, hidden-state probes, intermediate activations, Eternis-Forecaster 8B, EF-32B, Qwen3-8B, RLVR-style post-training, GLM-4.7-Flash, GLM-4.5-Air, OpenForesight, Sky Sports and Al Jazeera OOD checks, 296 OpenForesight-test questions, 29,600 generations in the temperature sweep, 37 percent accuracy versus about 50 percent verbalized confidence, ECE 0.110 to 0.150 sweep range, layer-21 covariance probe, 3,020 rollout comparison, probe ECE 0.044 versus verbalized ECE 0.093, AUROC 0.756 versus 0.758, GLM probe-only calibration, GLM-4.7-Flash ECE 0.054 versus 0.287 and GLM-4.5-Air ECE 0.102 versus 0.255, evidence ablation over 354 questions and 1,303 ablation pairs, 107 of 460 high-impact pairs with no reasoning-trace change, 23 percent stealth influence, diversionary injection over 489 questions, Claude Sonnet fabricated article and judge setup, 81.2 percent honest-susceptible adoption, 2.5 percent stealth adoption, layer-20 probe tracking behavioral change with Spearman rho 0.565 across 1,792 perturbation cases, 83.6 percent direction prediction, forced answering, empty-think prefill, pre-reasoning answer distribution, 67 percent 64 percent and 56 percent forced/free modal-answer matches across test and OOD splits, +1.9 percentage-point in-distribution free-reasoning gain, entropy gate saving 30 to 47 percent generated tokens without measurable accuracy loss, LLM-as-judge and leakage-control caveats, forecast receipts, and the governance problem of trusting stated confidence or chain-of-thought explanations before model checkpoint, evidence set, hidden-state readout, calibration split, perturbation test, routing rule, token budget, and human review path are auditable.
• The Street Video Becomes the Informality Meter - Hongye Yang, Shien Liu, and Zhihao Xie's CommuniWave:A Machine Learning Model for Quantifying the Degree of Temporary Informal Behavior in Urban Communities paper, arXiv:2607.08554, cs.AI, submitted July 9 2026, 17-page PDF, 4 figures, presented at ASCAAD 2024 according to arXiv, urban communities, territorial resilience, temporary informal behavior, Degree of Informal Behavior DIB, street-video measurement, Behavior Capture Net, mmaction2, YOLOv10-based YLX model, Behavior Eval Model, random forest regression, PCA preprocessing, MLflow experiment management, 180 ten-second street-video segments, three road classes, cameras positioned 5 to 10 meters above ground, medium-sized city in southern China, de-identification claim for public-space video, six informal behavior labels including square dancing gathering street vending with and without equipment three-wheeled motorcycling and chess playing, YLX image data mainly from Chinese social media platforms, 30,000-image YLX dataset, X-AnyLabeling automated annotation with manual verification, 10 urban-community resident volunteer raters, 1-to-5 temporary-activity scale, MAD outlier filtering, YLX training accuracy 0.794, BEM MSE 0.9599 RMSE 0.9798 and R² -0.1681, 10-video unseen-data check with Mean Absolute Deviation 0.709 from volunteer averages, SHAP feature importance, morning street vending and pedestrian-gathering peaks, cultural-context and surface-feature limits, crash and manual-correction caveats, urban informality receipts, and the governance problem of treating spontaneous public life as a planning signal before camera placement, label taxonomy, training-image provenance, consent basis, de-identification method, rating procedure, model metrics, human review, appeal path, retention rule, and enforcement boundary are auditable.
• The Ship Report Becomes the Schema Agent - Sohrab Namazi Nia, Amogh Dalal, Ning Sa, Peter Ly, Marti Zentmaier, Tomek Strzalkowski, Jay Miller, Rishi Singh, and Senjuti Basu Roy's ASMR: Agentic Schema Generation for Ship Maintenance Report Writing paper, arXiv:2607.08177, cs.AI with cs.MA cross-listing, submitted July 9 2026, accepted at the DASHSys 2026 workshop co-located with VLDB 2026 according to the arXiv record, 9-page PDF, New Jersey Institute of Technology Rensselaer Polytechnic Institute and Boston Fusion Corporation affiliations, ship operational and maintenance reporting, free-form maintenance narratives, automatic schema generation, human-AI documentation support, Field Generation Agent, LLM-driven semantic concept extraction, adaptive multi-granularity clustering, candidate schema fields, Structural Optimizer Agent, reinforcement learning schema construction, temporal-difference Q-learning, add merge and stop actions, coverage support consistency informativeness redundancy and schema-size metrics, form categories including voids and cofferdams compartments storage compartments fuel oil tanks and waste tanks, approximately 500 historical forms per representative category, GPT-4o Mini semantic extraction and field abstraction, embedding-based clustering tool, Python 3.11 and HPC cluster setup, raw concepts versus candidate schema versus optimized ASMR schema comparison, coverage 0.19 to 0.48 to 0.64, redundancy 0.67 to 0.39 to 0.17, schema size 42.0 to 8.3 to 5.4, component runtime table, 20-minute concept extraction 35-minute coverage and redundancy statistics 8-second RL training and about 2-second field-value extraction, open problems around confidence-aware schema generation reward design evaluation and historical-data limitations, Office of Naval Research sponsorship, schema-agent receipts, and the governance problem of treating an AI-generated maintenance form as neutral before source forms, prompts, model, clustering, reward weights, merged fields, dropped fields, confidence scores, domain review, worker-facing questions, and correction logs are auditable.
• The Fixation Trace Becomes the Difficulty Sensor - Sumin Lee, Kyeonghun Kim, Subeen Lee, Jiwon Yang, Tien Nguyen, Ken Ying-Kai Liao, and Nam-Joon Kim's LEXIC: Lightweight Eye-tracking eXtension via Injected Complexity paper, arXiv:2607.08152, cs.CL with cs.AI cs.HC and cs.LG cross-listings, submitted July 9 2026, accepted to APCCAS 2026 according to the arXiv record, 4-page PDF, Seoul National University OUTTA and NVIDIA affiliations, eye tracking, reading comprehension prediction, cognitive modeling, EyeBench v1.0, OneStop reading-comprehension task, 180 participants, 19,428 passage words, 1.1 million fixations, 9,718 trial instances, binary incorrect-or-correct comprehension label, AhnCNN gaze-only baseline, fixation tensor with duration pupil x position and y position channels, GPT-2 surprisal, English word frequency, word length, offline word-level difficulty features, LEXIC-Concat direct feature concatenation, LEXIC-Res typical-reader residual mechanism, tiny 3-to-32-to-2 normative gaze head, no language-model forward pass at inference, ten cross-validation folds, Unseen Text Unseen Reader and Unseen Both regimes, K=5 seed ensemble, AUROC primary metric, tuned-threshold balanced accuracy secondary metric, LEXIC-Base AUROC 0.489 to 0.512, LEXIC-Concat AUROC gains of +1.82 percentage points on Unseen Text and +2.92 points on Unseen Reader, LEXIC-Res +2.18 points on Unseen Text but weaker Unseen Reader transfer, reader-calibration bottleneck, default-threshold calibration caveat, OneStop-only and single-backbone limitations, fixation-difficulty receipts, and the governance problem of treating gaze-derived comprehension scores as evidence before capture device, calibration, passage, word alignment, difficulty features, model, threshold, consent, retention limit, uncertainty, and human review are auditable.
• The Incident Report Becomes the Safety Memory - Harleen Kaur Sidhu, Rebecca Scholefield, Nour Annan, Kevin Hernandez, Isabel Nieh Hou, Abdulrahman Alshaikhi, Ze Shen Chin, and Rokas Gipiškis's Open Problems in AI Incident Governance paper, arXiv:2607.05163, cs.CY with cs.AI, submitted July 6 2026, accepted to the ICML 2026 Technical AI Governance Research workshop, 21-page PDF, Independent Sorbonne University Rice University Columbia University AI Standards Lab Oxford Martin AI Governance Initiative and Vilnius University affiliations, AI incident governance, post-deployment monitoring, incident reporting, AIID OECD EU AI Act CSET and MIT AI Risk Repository comparisons, inconsistency across incident definitions classification monitoring and reporting, realised harm versus near-miss scope, repeated and distributed harms, multiple taxonomies for causes and harms, Goals Methods and Failures taxonomy, CSET AI Harm Framework, MIT causal and domain taxonomies, production monitoring scope, multi-actor monitoring ecosystem, provider logs user reports auditors researchers journalists public incident databases and market-surveillance bodies, automated classifiers asynchronous monitors offline log review and public submissions, production generative-AI cloud-service study cited with 38.3 percent of incidents reported by humans rather than automated monitors, reporting-scope debate over serious incidents all incidents and near misses, structured categories versus free-text narrative, timelines impact implicated systems deployment context causal analysis aggregate cross-incident analysis incident forecasting, proposed monitoring principles reporting principles monitoring guidelines and reporting template as harmonization starting points, LLM-use disclosure for preliminary literature exploration and draft editing with manual verification, incident safety-memory receipts, and the governance problem of treating post-deployment AI failures as lessons before definition, taxonomy, monitoring signal, report field, privacy limit, causal evidence, remediation record, and recurrence check are auditable.
• The Annotator Disagreement Becomes the Ensemble Receipt - Xia Cui, Ziyi Huang, and N. R. Abeynayake's Ensemble Diversity Optimization for Subjective Supervision paper, arXiv:2607.08493, cs.LG with cs.CL, submitted July 9 2026, 21-page PDF, Manchester Metropolitan University and Hubei University affiliations, subjective supervision, annotator disagreement, prediction-space Ensemble Diversity Optimization EDO, learned ensemble weights and effective cardinality, Gumbel-Softmax ensemble-size relaxation, signed reliability-weighted diversity regularizer for preserving or suppressing disagreement, soft F1 surrogate, class-weighted cross-entropy, frozen BERT-base and AraBERTv2 backbones, LeWiDi 2023 datasets ArMIS ConvAbuse HS-Brexit and MD-Agreement, official train/dev/test splits, baselines Soft-CE Soft-MD Top-5 Voting and WEL, EDO-Random lowest cross-entropy on all four datasets, ConvAbuse CE 0.2149 versus Soft-CE 0.9671 and WEL 0.5577, lowest Soft Brier scores across all four benchmarks, EDO-PerAnn lowest Manhattan Distance on ConvAbuse and HS-Brexit, limitations around disagreement structure sparse annotator coverage distribution shift homogeneous frozen backbones and sparse or fragmented annotator pools, annotator-disagreement receipts, and the governance problem of treating majority labels or calibrated probabilities as ready before annotator coverage, label distribution, diversity sign, ensemble size, calibration metric, baselines, random seeds, model-selection rule, and human review are auditable.
• The Vehicle Update Becomes the Drift Alarm - Matthias Weiß, Athreya Hosahalli Prakash, Maurice Artelt, Falk Dettinger, Nasser Jazdi, and Michael Weyrich's Self-Adaptive Anomaly Detection with Reinforcement Learning and Human Feedback in Connected Vehicles paper, arXiv:2607.08373, cs.LG with cs.AI, submitted July 9 2026, accepted at the 30th IEEE International Conference on Emerging Technologies and Factory Automation ETFA 2026 Special Session SS10, 8-page PDF, Institute of Industrial Automation and Software Engineering at the University of Stuttgart affiliation, connected vehicles as autonomous cyber-physical systems, over-the-air updates configuration changes and shifting workloads changing the definition of normal behavior, SDVDiag diagnostic platform, online anomaly detection supervisory loop, factorized deep Q-network detector selection, attention-augmented F-DQN-Attn variant, inter-service dependency modeling, MAD spectral residual SPOT one-class SVM robust random cut forest LODA and xStream detector pool, Page-Hinkley Kolmogorov-Smirnov and Mahalanobis-distance drift detectors with unanimous-alarm rule prioritizing precision over recall, expert feedback interface, pending transition buffer, operator-triggered retraining, selective head updates, 60/40 prioritized replay strategy for new versus old data, University of Stuttgart connected-vehicle testbed, four unmanned ground vehicles with sensor suites and 5G modules, central Kubernetes backend with five computing nodes, automated valet parking application, seven backend microservices valetparking auth ui control map parking-spot and heartbeat, CPU utilization and RAM usage collected through OpenTelemetry at one-second resolution, 14 monitored time series and 64-event sliding window, injected sudden spikes gradual drifts and service degradation scenarios, more than 800,000 labeled data points split into 300,000 training 100,000 validation and 400,000 held-out evaluation points, F-DQN-Attn F1 0.6915 versus F-DQN 0.4731 and best single uniform detector 0.1071, real software update to the AVP backend causing measurable concept drift, parking-spot CPU trace update at step 2000 and unanimous drift alarm at step 2600 about 600 seconds later, post-update pre-retraining F1 0.5239, post-retraining new-distribution F1 0.6500 and old-distribution F1 0.6900, simulated expert feedback via ground-truth labels limitation, single testbed single application single drift event limitation, CPU and RAM metric-scope limitation, future work on additional testbeds in-vehicle and network signals real operators multi-seed evaluation ablations and attention-layer cost, connected-vehicle drift receipts, and the governance problem of treating adaptive vehicle monitoring as safety evidence before update version, affected services, metric source, detector choices, drift thresholds, operator action, feedback labels, replay mix, retraining step count, old-distribution retention, excluded signals, and review owner are auditable.
• The Ladder Logic Bomb Becomes the Trigger Witness - Pierre Dantas, Lucas Cordeiro, and Waldir Junior's Detecting Ladder Logic Bombs in IEC 61131-3 PLC Programs using ESBMC-PLC+: A Formal Verification Approach with Trigger Synthesis paper, arXiv:2607.08417, submitted July 9 2026, 14-page PDF, University of Manchester and UFAM affiliations, ladder logic bombs in programmable logic controller programs, IEC 61131-3, industrial control systems security, ESBMC-LLB method, ESBMC-PLC+ verification engine, function-block-resident malicious logic, intermediate-representation visibility problem, scan-watchdog modeling for non-termination and denial-of-control payloads, output wiring for actuator-forgery payloads, k-induction for unbounded bomb-absence proofs across scan cycles, bounded model checking counterexamples as detonation-trigger witnesses, public Iacobelli 2024 dataset result detecting all 30 bombs and recovering every trigger, adaptive trigger variants that evade syntactic CFG-triage proxy while semantic checking detects all five, controlled 310-program Boolean/integer corpus with 155 malicious and 155 benign programs, reported 100 percent recall zero false positives median detection time 70 milliseconds and maximum 305 milliseconds, PLC-Defuser SWaT benchmark with 150 legitimate and 150 malicious programs in two versions, analog modeling extension making all 300 programs parse in both versions, archived v1.0.0 result detecting 149 of 150 malicious programs with 0 of 150 false positives and trigger recovery, development snapshot result dropping to 73 of 150 or 49 percent because nonlinear non-termination bombs time out in the SMT backend, fully sound v1.0.0 configuration detecting 75 of 150 because unfaithful constructs are conservatively dropped, semantic model checking and CFG triage as complementary approaches, trigger-witness receipts, and the governance problem of treating formal verification as operational assurance before parser path, function-block semantics, safety property, input domain, scan-cycle model, solver backend, timeout policy, dropped constructs, benchmark version, false-positive and false-negative counts, and human review owner are auditable.
• The Quant Researcher Becomes the Memory Loop - Fengyuan Liu, Yuchen Fu, Yuqi Wang, and Qi Liu's XALPHA: A Memory-Driven AI Quant Researcher for Hypothesis-to-Code Alpha Discovery paper, arXiv:2607.08332, cs.CL, submitted July 9 2026, DOI 10.48550/arXiv.2607.08332, 61-page PDF, School of Computing and Data Science at The University of Hong Kong and Grace Investment Machine affiliations, memory-driven AI quant researcher, hypothesis-to-code alpha discovery, Report-to-Memory Absorption layer, A/B/C taxonomy, OHLCV feasibility screening, Macro Brain research planning, archetype routing, Micro Brain executable factor-code evolution, ex-ante tri-alignment among hypothesis idea code logic and financial plausibility, Cross Brain GOOD/BAD feedback consolidation, generation-level cycle-level and archetype-level memory updates, CSI300 daily market data through Qlib, large-cap Chinese A-share universe, 10-day future adjusted open-to-open return target, chronological train validation and test split from 2011 through 2025, gpt-oss-120b default LLM backend, Ridge regression portfolio-reporting model, initial pool size 64, parent pool size 80, 10 generations per cycle, 6 cycle-final candidates, novelty injection at generations 3 and 7, IC RankIC ICIR RankICIR annualized return annualized excess return and information ratio metrics, Ridge Random Forest LightGBM XGBoost CatBoost AdaBoost MLP Transformer GRU LSTM CNN Alpha360 AutoAgent AlphaAgent R&D-Agent-Quant and CogAlpha baselines, Table 2 result with XALPHA best on IC ICIR RankICIR AR AER and IR while CogAlpha has higher RankIC, RMA case dropping unavailable accounting-ratio fragments and keeping return-decomposition fragments, memory-routing case preserving regime-aware delayed-response mechanisms and excluding brittle volume-spike failures, reported computational cost of about 15 seconds per factor 16 minutes per generation and 3 hours per full mining cycle on two H100 GPUs, author-stated future work on broader equity universes horizons richer data and real-world trading environments, no investment-advice claim, quant-research receipts, and the governance problem of treating generated factor research as reliable before report fragment, memory abstraction, archetype route, hypothesis, code, leakage test, selection gate, backtest assumptions, portfolio diagnostic, feedback update, and human review are auditable.
• The Log Dossier Becomes the On-Call Witness - Carlos Garcia-Hernandez, Aymane Abdali, Guangyu Wu, Mingxue Wang, Fei Shen, Zhaoyu Pang, and Yanbin Zhang's Log-Insight: Automating Microservice Incident Diagnosis via Neuro-Symbolic Log Analysis paper, arXiv:2607.08529v1, cs.IR, submitted July 9 2026, DOI 10.48550/arXiv.2607.08529, 8-page PDF, ASE 2026 framing in the paper, Huawei Ireland Research Centre and Huawei Dongguan R&D Centre affiliations, production deployment at Huawei, AIOps, Site Reliability Engineering, microservice incident diagnosis, root-cause analysis, 30-minute incident window exceeding two million log lines and roughly 1.2 billion characters, 46,000-character enterprise LLM API budget, neuro-symbolic pipeline, two-pass sampling, schema inference and memory, Drain3 pattern clustering, two-layer entropy-guided compression, contrastive skew analysis, generative synthesis, vector knowledge base of SRE rules, critical hints with exact error-log and success-log probabilities, forensic case file priority ordering, 1,000x to 7,000x context compression, 11 historical production incidents, 11 log spaces, 110 total runs, SRE-validated ground truth, Mean Reciprocal Rank 0.790, correct root cause in the top three hypotheses in more than 90 percent of runs, mean latency 27.1 seconds, four not-found runs, random-sampling and Drain-template controls, context omission and synthesis failure modes, adaptive budget allocation structured evidence-to-claim output and critic-agent mitigation directions, Forensic Evidence section as an operator adoption factor, unavailable production telemetry and code due to Huawei confidentiality and customer-data obligations, on-call dossier receipts, and the governance problem of treating AI incident diagnosis as operational evidence before incident window, log space, schema rule, sampling path, compression rule, skew statistic, model budget, hypothesis rank, operator verification, remediation action, and post-incident correction are auditable.
• The Mini-Program Login Becomes the Identity Trap - Zidong Zhang, Zhentao Xie, Lingyun Ying, Qinsheng Hou, Yacong Gu, Wenrui Diao, and Jianliang Wu's Mini-Programs, Mega-Problems: Unveiling OAuth-based Authentication Misuses in Mini-Programs via Dynamic Analysis paper, arXiv:2607.08232v1, cs.CR, submitted July 9 2026, DOI 10.48550/arXiv.2607.08232, accepted by ACM CCS 2026, 19-page PDF, mini-program security, super apps including WeChat and Baidu, platform-specific OAuth-based Authentication, OBA versus standard OAuth and OpenID Connect, wx.login swan.login and code2Session workflows, sensitive data such as phone numbers and user profiles, MiniAuth dynamic analysis framework, privacy-declaration pre-filter, CodeQL login-page identifier, OCR-assisted traversal for obfuscated mini-programs, Appium UI automation, Mitmproxy traffic monitor, Xposed WeChat launch adapter, Baidu deep-link launch, M1 client-side identity forgery and post-authentication data forgery, M2 UnionID-only authentication misuse, M3 plaintext sensitive-data authentication misuse, 44,273 WeChat and 2,721 Baidu mini-programs, 10,159 WeChat and 641 Baidu OBA-using mini-programs, 1,834 misuse cases from 1,688 mini-programs, 619 programs with multiple vulnerabilities, 1,397 WeChat and 291 Baidu OBA-using mini-programs with at least one misuse, Baidu IV reuse of part of a 128-bit session_key and controlled brute-force feasibility, Tencent confirmed and fixed related WeChat IV/session-key issue, 3 percent sampled WeChat false-positive rate for M3 and no observed false negatives among successfully analyzed cases, 13 inaccessible cases excluded from FP/FN counts, responsible disclosure to vendors and national vulnerability coordinators with CNVD/CNNVD acknowledgments, identity-flow receipts, and the governance problem of treating a super-app mini-program login as trustworthy before platform, AppID, route, sensitive field, front-end event, back-end exchange, credential boundary, identifier binding, disclosure status, and retest evidence are auditable.
• The Legacy Control Becomes the Compliance Graph - Lea Roxanne Muth and Marian Margraf's Reverse Engineering Compliance: A Dual-Graph Verification Framework for Auditing Legacy IT Security Concepts paper, arXiv:2607.08292v1, cs.CR, submitted July 9 2026, DOI 10.48550/arXiv.2607.08292, accepted for the 2026 IEEE International Conference on Computer Information and Telecommunication Systems in Piraeus-Athens July 22-24 2026, 8-page PDF, ASSERT Automated Security Concept Structure Extraction and Reverse Topology-checking framework, legacy IT security concepts, BSI IT-Grundschutz and Grundschutz++ context, NIST OSCAL v1.1.3 System Security Plan and Assessment Results artifacts, document graph GDoc, verified reference graph GGT, deterministic graph comparison, five-class graph difference node omissions phantom nodes edge omissions topological conflicts and ghost edges, paragraph-level traceability, human-in-the-loop exception list, RecPlast GmbH expert-generated BSI training dataset with final 69-page IT-SC and intermediate structural-analysis artifacts, Generic Schema-Guided and Schema-Enforced configurations, LangChain orchestration, Pydantic-typed outputs, Ollama Gemma 4 26B local open-weight model, Anthropic Claude Opus 4.7 commercial model, schema-valid OSCAL export proof of concept, baseline Schema-Enforced node-level F1 0.957 for Gemma and 0.985 for Opus, typed-edge recall no higher than 0.261 in the baseline table, Gemma Schema-Guided node-omission hallucination failure in 12 of 16 missed omissions under reference-ontology exposure, largest exception list 207 mentions in the Gemma mixed-fault stress case, RecPlast generalization caveat, no repeated seeds caveat, shadow-IT and reference-graph-quality limitation, compliance-graph receipts, and the governance problem of treating a machine-readable compliance artifact as audit evidence before source document, reference graph, extraction model, ontology exposure, alignment rule, graph difference, exception queue, OSCAL export, and human reviewer are auditable.
• The Psychiatric Simulator Becomes the Clinical Gate - Yuming Yang, Xiao Sun, Yuanwei Zou, Zhengxiao Wu, Yun Chen, Jiang Zhong, Haoyang Zeng, Jingwang Huang, and Kaiwen Wei's MentalHospital: A Virtual Environment for Evaluating Psychiatric Clinical Encounters paper, arXiv:2607.08257v1, cs.AI, submitted July 9 2026, DOI 10.48550/arXiv.2607.08257, 45-page PDF, Chongqing University and Hunan University affiliations, LLM-based psychiatric clinical encounters, Subjective Interviewing Objective Examination Diagnostic Assessment and Treatment Planning workflow, skill-augmented standardized patients, 1,193 de-identified psychiatric EHR cases, all major ICD-11 psychiatric categories, 76 disorder-level diagnoses, patient-side evidence examination-side evidence and reference clinical targets, environment controller standardized patient and examination module, dual-track evaluation, objective comparison against EHR-derived references, subjective assessment of clinical process quality, MentalEval evaluator suite, communication empathy interviewing professionalism clinical-note quality diagnostic rigor and treatment appropriateness, Qwen3-8B-based domain evaluators, rubric-grounded supervised fine-tuning, expert-guided DPO, average QWK 0.944, human experts medical trainees crowdworkers general-purpose LLMs and medical-specific LLMs comparison groups, 5 licensed psychiatrists 3 psychology experts 14 medical trainees and 8 non-specialist crowdworkers, strongest medical-specific LLM trailing medical trainees by 27.17 percentage points and human experts by 37.28 points on average across objective metrics, clinical-faithfulness survey mean 3.88 out of 5 with 95 percent bootstrap CI 3.78 to 3.98, text-based simulation limitation, no systematic fairness bias or adversarial safety evaluation yet for self-harm escalation psychosis reinforcement medication misuse or demographic bias, tiered resource-release protocol, raw EHRs and case-level clinical narratives withheld, controlled access for de-identified benchmark cases and checkpoints, clinical-simulation receipts, and the governance problem of treating a plausible psychiatric simulation as deployment evidence before case provenance, de-identification, ethics approval, consent waiver, patient behavior, examiner module, scoring rubric, evaluator alignment, safety exclusion, release boundary, and human clinical supervision are auditable.
• The Agent Failure Becomes the Blame Receipt - Yufei Xia, Anjun Gao, Yueyang Quan, Zhuqing Liu, and Minghong Fang's Who Broke the System? Failure Localization in LLM-Based Multi-Agent Systems paper, arXiv:2607.07989v1, cs.CR with cs.AI cs.IR cs.LG and cs.MA cross-listings, submitted July 8 2026, DOI 10.48550/arXiv.2607.07989, 25-page PDF, University of Louisville and University of North Texas affiliations, arXiv comment saying to appear in COLM 2026, LLM-based multi-agent systems, system-level failure diagnosis, AgentLocate, responsible-agent and earliest-decisive-step attribution, all-at-once and step-by-step trajectory inspection, idealized corrected-action reversal criterion, LLM Judge hypothesis generation, independent Evaluators with base concise and evidence-focused prompt styles, rationale plus self-reported confidence, confidence-aware voting, Judge-Evaluator refinement, parameter-efficient fine-tuning from evaluator feedback, Who&When Algorithm-Generated and Hand-Crafted subsets, 191 agents and 126 failure cases with average 8.6 decision steps in Algorithm-Generated, 5 agents and 58 cases with average 50-step trajectories in Hand-Crafted, Aegis-Bench 9,533 failure trajectories and 24,843 injected error instances across six frameworks, WhichAgent AgenTracer ECHO AEGIS RAGOrigin and RAGForensics comparisons, Qwen2.5-7B Llama-3.1-8B Mistral-7B and GPT-4o judge settings, LoRA rank 8 training setup, reported AgentLocate advantages in responsible-agent and step localization, average agent-level accuracy above 50 percent in several reported conditions, modest Aegis agent-plus-error-mode pair gains caveat, code-will-be-released-upon-acceptance caveat, failure-localization receipts, and the governance problem of treating a multi-agent failure as one agent's blame before query, trajectory, scheduler, agent roster, decisive-step definition, hypothesis, evaluator votes, confidence aggregation, fine-tuning data, benchmark split, and human incident review are auditable.
• The Model Agreement Becomes the Confidence Trap - Kaihua Ding's When LLMs Agree, Are They Right? Auditing Self-Consistency and Cross-Model Agreement as Confidence Signals paper, arXiv:2607.08065, cs.AI, submitted July 9 2026, DOI 10.48550/arXiv.2607.08065, 10-page PDF, University of Pennsylvania affiliation, LLM-as-judge systems, ensemble and mixture-of-experts judge panels, self-consistency as agreement signal, cross-model agreement, confidence routing, abstention and selective prediction use, GPQA Diamond and AIME, 53 graduate-course runners, K=50 samples, 265,000 samples, 5,300 case-result rows, 394 unique cases, gpt-4.1 family comparisons, nano versus mini, zero-shot versus chain-of-thought, mini versus gpt-4.1, temperature 1.0, self-consistency C as nmaj/K, sample accuracy A, majority-correctness M, hierarchical runner-clustered bootstrap, positive but weak agreement-correctness correlations, all twelve rho(C,M) tests surviving Holm correction, no rho(C,M) cell above 0.6, frontier gpt-4.1 mean GPQA agreement C=0.89 with lowest GPQA rho(C,M)=0.20, gpt-4.1 GPQA majority accuracy 0.48 versus mini 0.52, C at least 0.8 on 77 percent of GPQA cases, 48 percent high-agreement GPQA errors for gpt-4.1, chain-of-thought accuracy gains but mixed confidence-signal gains, option-shuffle control, D-option under-selection, exploratory Claude haiku sonnet opus check, opus C=0.94 and C at least 0.8 on 88 percent of GPQA cases while trailing sonnet accuracy, shared confident errors across providers above marginal-preserving null for smaller Claude tiers, released de-identified GitHub rows and analysis pipeline, no GPQA question text redistribution, unrecoverable original model snapshots and timestamps caveat, agreement receipts, and the governance problem of treating model agreement as confidence before model family, sample count, answer space, prompt, runner design, calibration metric, recurrence check, position-bias control, routing policy, and human-review trigger are auditable.
• The Causal Claim Becomes the Data-Agent Receipt - Andrej Leban and Yuekai Sun's CausalDS: Benchmarking Causal Reasoning in Data-Science Agents paper, arXiv:2607.08093, cs.AI with cs.CL and cs.LG cross-listings, submitted July 9 2026, DOI 10.48550/arXiv.2607.08093, 55-page PDF, 10 figures, University of Michigan Department of Statistics affiliation, official GitHub benchmark generator runner and deterministic grader, Hugging Face CC0-1.0 evaluation-only dataset card, agentic data-science workflows, structural causal model scenes, generated observational data, synthetic graph-faithful natural-language stories, optional empirical-distribution anchoring from real-world datasets, causal parrot risk reduction, Pearl's three rungs, prediction association graph recovery identification effect estimation bias diagnostics counterfactual identification counterfactual effects and mediation tasks, data-science coding and tool use, public story data schema and calibration files, private SCM-derived ground truth and observation diagnostics, noisy observation layer separating conceptual variables from released measurements, deterministic scoring, non-identifiable targets, null or unknown abstention values, 953-scene dataset with three observation variants in the presented results, released 100-task exam, causal data-agent receipts, and the governance problem of treating a causal answer from an automated analyst as decision evidence before scene, SCM, variables, released files, target estimand, task rung, observation model, code path, uncertainty, answerability judgment, abstention option, output schema, grader, and human review boundary are auditable.
• The Persona Loop Becomes the Self-Locking Test - Mengchen Li's AutoPersonas: A Multi-Timescale Loop Engine for Open-Ended Persona Evolution paper, arXiv:2607.08252, cs.AI with cs.CL and cs.HC cross-listings, submitted July 9 2026, 51-page PDF, Latrix affiliation, long-term persona agents, open-ended persona evolution, self-locking as functional recurrence rather than textual repetition, model-side diversity collapse, context gravity from State memory history and environment summaries, life-environment layer, Occurrences Observations and State, OSO loop, evidence-governed absorption before State or reachability changes, semantic State machine, occurrence hardening, stale-state regression, slow-change accumulation, memory boundary, persona self-memory separated from user-specific memory, response-time conversation outside the evaluated object, long-run diagnostic audit, PASS PARTIAL FAIL and UNVERIFIED labels, eight-model 40-day direct-loop stress test, Claude DeepSeek GPT Qwen Gemini GLM Doubao and Kimi, 200 events per model, 1,600 events total, rolling 5-day action-category repetition mean 96.5 percent and range 95.2 to 97.6 percent, all included models crossing 90 percent repetition by day 11, macro-theme repetition 79.0 to 88.0 percent, full-runtime A/B, context-slice masking plus per-sample divergence targeting, macro-theme repetition from 61.8 to 36.3 percent in the masked lane, cumulative theme count from 55 to 102, public-safe ancillary aggregate artifacts, action_repetition_eval.py evaluator, production prompts private schemas ranking mechanisms raw logs and user data withheld, systems-architecture not foundation-model-training limitation, one-canon direct-loop stress-test limitation, no scalar metric for persona-life-environment co-evolution, persona-loop receipts, and the governance problem of treating a coherent synthetic persona as having grown before canon, memory lane, Occurrence, Observation, State revision, relationship boundary, audit horizon, repetition metric, public-safe evidence, and unresolved claim boundary are auditable.
• The Pattern Match Becomes the Reasoning Mirror - Zach Studdiford and Gary Lupyan's Reasoning as Pattern Matching: Shared Mechanisms in Human and LLM Everyday Reasoning paper, arXiv:2606.13607, cs.AI, submitted June 11 2026 and revised June 13 2026, DOI 10.48550/arXiv.2606.13607, CC BY 4.0, 13-page main text with 51-page supplement, University of Wisconsin-Madison affiliations, human everyday common-sense reasoning, 25 LLM comparison, 433 prompts, primary human cohort n=142, follow-up cohort n=175, geocentric-near and egocentric-near failures, state-follows action-follows state-nonfollows and action-nonfollows categories, human mean accuracy 0.71, DeepSeek-R1 0.90, GPT-5.2 0.87, gemma-3-27b best human-response fit despite weaker absolute accuracy, category-level alignment r=0.84 p=0.001, geocentric-near painting-North-of-Ali example, DeepSeek-R1 reasoning-trace length predicting human difficulty, Gemma attention-head ablation and activation patching, content-sensitive causally important heads, median Cohen's d 0.437 p<0.001, top-11 attention-head entropy regression F(11, 407)=3.36 p<.001 delta R2 .054, follow-up top-7 attention-head regression F(7, 80)=2.84 p=0.0108, trigram-frequency and model-logit controls, reasoning-mirror receipts, and the governance problem of treating either human or model reasoning as abstractly reliable before prompt set, participant exclusions, model version, category, answer key, association controls, attention-head intervention, regression formula, held-out cohort, and interpretive boundary are auditable.
• The Dispatch Weight Becomes the Marketplace Dial - Haochen Wu, Yi Hou, and Shiguang Xie's Multi-Agent Reinforcement Learning from Delayed Marketplace Feedback for Objective-Weight Adaptation in Three-Sided Dispatch paper, arXiv:2606.13604, cs.AI with cs.LG and cs.MA cross-listings, submitted June 11 2026, accepted at the ICML 2026 Workshop on Reinforcement Learning from World Feedback RLxF, DoorDash production case study, CC BY 4.0, objective-weight adaptation, three-sided food-delivery dispatch, delayed marketplace feedback, existing combinatorial assignment optimizer preserved, store-level decentralized execution, centralized offline training, five-action ASAP-weight multiplier set 0.8 0.9 1.0 1.1 1.2, local state from outstanding delivery count supply pressure and median courier wait time, ASAP CAT and XCAT reward components, regional reward aggregation, Double Q-learning targets, Conservative Q-Learning regularizer, two-layer hidden-dimension-16 MLP, 30 offline training epochs, two-week global switchback experiment across about 4,000 geographic regions, two-hour switchback intervals, CUPED variance reduction, all-day CAT ATE -1.261 seconds p=0.019, CWT -0.856 seconds p=0.004, batching +0.495 percentage points p<0.001, ASAP statistically unchanged, dinner-hour batching +0.600 percentage points, San Francisco-Bay Area Friday dinner policy-behavior diagnostic, marketplace-RL receipts, and the governance problem of treating a learned dispatch policy as safe before action interface, reward attribution, randomization unit, guardrails, labor impact, regional heterogeneity, drift monitor, and rollback criteria are auditable.
• The Epigenomics Benchmark Becomes the Science Gate - Harihara Muralidharan, Reema Baskar, Soo Hee Lee, Tim Proctor, and Kenny Workman's EpiBench: Verifiable Evaluation of AI Agents on Epigenomics Analysis paper, arXiv:2606.13602, cs.AI, submitted June 11 2026, DOI 10.48550/arXiv.2606.13602, CC BY 4.0, LatchBio affiliation, short-horizon epigenomics analysis benchmark, deterministic grading, 106 evaluations, CUT&Tag/CUT&RUN ATAC-seq ChIP-seq and DNA methylation workflows, eight task categories, zebrafish chromatin workflow snapshots, pediatric B-ALL ATAC/RNA GSE161501 artifacts, B-ALL H3K27ac ChIP-seq data, DNA methylation GSE149608 and GSE149609, 16 model-harness pairs, three attempts per evaluation, 5,088 valid trajectories, no model-harness pair above 50 percent endpoint pass rate, GPT-5.5 / Pi 45.0 percent 143/318 with 95 percent CI 36.3 to 53.7, GPT-5.5 / OpenAI Codex 39.9 percent 127/318, Claude Opus 4.8 Max / Pi and GPT-5.4 / Pi each 39.0 percent, CUT&Tag/CUT&RUN 34.0 percent, methylation-seq 33.3 percent, ChIP-seq 30.6 percent, ATAC-seq 22.8 percent, 68.2 percent component-field pass rate versus 31.0 percent endpoint pass rate, manual review of 25 evaluations, latchbio/epibench artifact notice, science-agent receipts, and the governance problem of treating tool-using biology agents as autonomous before assay, workflow snapshot, file inventory, grader, harness, endpoint answer, intermediate artifacts, failed fields, manual review label, and scientific rationale are auditable.
• The Memorized Fact Becomes the Routing Problem - Lu Dai, Ziyang Rao, Yili Wang, Hanqing Wang, Hao Liu, and Hui Xiong's Towards Mechanistically Understanding Why Memorized Knowledge Fails to Generalize in Large Language Model Finetuning paper, arXiv:2607.08393, cs.AI with cs.CL cross-listing, submitted July 9 2026, 26-page PDF, HKUST(GZ) and HKUST affiliations, Knowing-Using Gap, fine-tuning knowledge injection, memorization accuracy versus generalization use accuracy, accuracy gap and temporal lag, STaRK-Prime biomedical and STaRK-MAG academic knowledge graph domains, Memorization-to-Generalization dataset, chaining and intersection tasks, pre-fine-tuning leakage check below 6 percent zero-shot accuracy, LoRA chaining Tmem 10.4 plus or minus 2.8 and Tgen 15.0 plus or minus 5.2 with final use accuracy 0.303, LoRA intersection final use accuracy 0.910, full fine-tuning memorizing faster without eliminating the gap, model-size scaling not eliminating temporal lag, increasing injected facts tending to widen final accuracy gap, self-patching activation intervention, head-entity anchor representation, layer-to-layer scan, failed generalization cases, knowledge-circuit misalignment hypothesis, early and late storage-oriented layers, mid-layer computation path, Qwen-2.5 and LLaMA-3.x experiments, 1000 injected facts, oracle self-patching lifting chaining accuracy by 1.5 to 6x, fixed late-to-middle and early-to-middle layer-pair heuristic, fixed heuristic recovering 58 to 75 percent of oracle headroom, anonymous code/data URL returning authorization response during review, diagnostic upper-bound caveat, no early-training predictor caveat, token-layer localization caveat, knowledge-routing receipts, and the governance problem of treating a fine-tuned model as having learned an institutional fact before injected fact set, leakage check, recall score, use task, checkpoint timing, routing intervention, model family, domain, statistical test, artifact access, and failure boundary are auditable.
• The Network Fingerprint Becomes the Predictive Target - Javier Izquierdo and Aygul Zagidullina's Applying JEPA-Style Predictive Learning to JA4-Derived Network Fingerprints paper, arXiv:2607.08465, cs.AI, submitted July 9 2026, 6-page PDF, Lucerne University of Applied Sciences and Arts HSLU affiliation, JA4-JEPA, JA4-derived network fingerprints, JA4 JA4H JA4S and JA4X subfields, JA4DB and CIC-IDS-2017 sources, roughly 397K tokenized mixed-source samples, incomplete view overlap, no sample containing all four view families, PAD for source-missing views, MASK for training-hidden views, 13 tokenized subfields, per-subfield vocabularies, 2-layer 8-head Transformer, 32-dimensional token embeddings, 512-dimensional latent space, EMA target encoder, JEPA MSE loss, frozen encoder evaluation, cosine k-nearest-neighbor probe with k=5, TLS DNS and SSH protocol-family classification, 39,416 held-out mixed-source samples, cosine similarity 0.9899, kNN accuracy 0.9220, TLS-only reference with 11,650 held-out samples, production pilot corpus of 2.1M real JA4 and JA4H gateway fingerprint pairs, content-hash leakage-free train validation and held-out split, train 320,105 and held-out 39,990 in a 400K sample, synthetic shuffle and hard-positive anomaly classes, prediction-energy signal, frequency nearest-neighbor autoencoder reconstruction and clustering baselines, AUC 0.922 shuffle and 0.925 hard-positive, worst-class AUC 0.922 versus next best 0.870, 5 percent false-positive budget TPR 0.531, about 8,000 CPU pairs per second without reference database, coarse protocol-family task limitation, no maliciousness claim, incomplete view-overlap limitation, slightly negative silhouette score, synthetic anomaly limitation, fingerprint-embedding receipts, and the governance problem of treating a learned network fingerprint representation as a security decision before source corpus, view coverage, missingness policy, masking rule, split key, labels, synthetic negatives, baselines, threshold, throughput, and reviewer signoff are auditable.
• The Synthetic Resident Becomes the Smart-Home Schedule - Victor Jüttner, Xenia Wagner, Christoph Jahn, and Erik Buchmann's Simulating the Resident: Generating Executable Smart Home Schedules via LLM Personas paper, arXiv:2607.08231, cs.CR with cs.HC cross-listing, submitted July 9 2026, Proc. 1st Symposium on Artificial Intelligence throughout the Human-Centered Design Process 2026 AI-HCD, DOI 10.18420/AIHCD2026_025, Best Paper Award note in arXiv metadata, 5-page PDF, ScaDS.AI Dresden/Leipzig and Leipzig University plus ipoque GmbH a Rohde & Schwarz company affiliations, smart-home HCI security and privacy research, privacy concern around long-term real-household observation, LLM-generated resident personas, five socio-technical dimensions, occupational routines simulation timeframe household dynamics device ecosystem and environmental context, four-stage pipeline, persona and context initialization, narrative day-plan generation, action extraction to schema-compliant JSON, state and memory update, Stage 4 proposed but not instantiated in proof of concept, OpenAI gpt-5.4 illustrative run, Alice work-from-home professional and Bob office worker, compact urban apartment on German winter morning, eight smart devices, 06:00 to 10:00 window, seasonal thermostat and indoor-lighting behavior, temporal separation between Alice and Bob interactions, deterministic post-validation, physical-testbed execution goal, no end-to-end physical testbed execution yet, ecological-validity limitation, generalization limitation, AI usage disclosure for grammar correction and sentence editing, synthetic-resident schedule receipts, and the governance problem of treating simulated household traces as privacy-preserving evidence before persona provenance, device schema, time window, generated narrative, JSON schedule, validation result, physical execution status, real-trace comparison, and consent boundary are auditable.
• The Blind Spot Becomes the Benchmark Receipt - Matteo Santelmo, Xiuying Wei, Israa Fakih, Felix Bauer, Juan Garcia Giraldo, Chengkun Li, Etienne Bamas, and Emmanuel Abbé's Blind-Spots-Bench: Evaluating Blind Spots in Multimodal Models paper, arXiv:2607.08317, cs.AI, submitted July 9 2026, 25 pages and 8 figures, EPFL affiliation, multimodal model evaluation, tasks easy for humans but challenging for modern AI models, graduate AI course question collection in October 2025, approximately 287 raw student questions, 235 cleaned benchmark samples, Hugging Face dataset, text-only image-generation and multi-to-text formats, 46.2 percent text-only 35.6 percent image-generation and 18.2 percent multi-to-text composition, object-centric abstract-reasoning and language-and-knowledge taxonomy, 12 subcategories, 15 multi-label questions, structured reference solutions, correctness conditions, typical failure modes, Inspect AI evaluation pipeline, Gemini-3-Flash grader with code execution, public reasoning-blind-spots GitHub code, 32 LLM/VLM systems and 6 specialized image-generation models, 38 models total, four repeated text-output evaluations and one image-generation run, manual grader validation with 96.6 percent agreement accuracy on 88 text outputs and 90.9 percent on 66 image outputs, Gemini-3.1-Pro text-only and multi-to-text results, GPT-5.5 text versus visual transfer gap, GLM-5.2 open-weight text-only lead, Qwen3.5-397B multimodal result, Gemini-3-Pro-Image and GPT-Image-2 image-generation comparison, mixed tool-use effects, weak attribute-recognition and perceptual-counting ceilings, modest-size imbalanced-dataset limitation, student-source bias, missing human-baseline limitation, public-benchmark overfitting risk, benchmark receipts, and the governance problem of treating aggregate benchmark scores as deployment evidence before question source, taxonomy, grading rule, artifact release, validation check, cost, and stated limits are auditable.
• The Face Swap Becomes the Pedestrian Privacy Filter - Roba H. Farouk and Catherine M. Elias's Swapping Faces, Saving Features: A Dual-Purpose Pipeline for Pedestrian Privacy in ITS paper, arXiv:2607.08402, cs.CV with cs.AI and cs.RO cross-listings, submitted July 9 2026, 6-page PDF, C-DRiVeS Lab Cairo and German University in Cairo affiliations, intelligent transportation systems, autonomous vehicle training datasets, pedestrian intention and trajectory prediction, Egy-DRiVeS Egyptian public-street images and videos, pedestrian privacy, identity concealment, facial attribute preservation, face swapping versus blurring, five-stage pipeline, YOLOv11 pedestrian detection, SCRFD face detection, Codeformer quality enhancement, Roop and Ghost-v2 face swappers, OpenCV SeamlessClone blending, single-frame proof of concept, fixed randomly chosen publicly shareable source faces, facial expressions head pose and eye-gaze direction as preserved cues, 478-landmark difference, 52-coefficient blendshape difference, facial cosine similarity, gaze-vector cosine similarity, Roop blendshape difference 1.898 versus Ghost-v2 2.0478, Roop landmark difference 0.00596 versus Ghost-v2 0.00710, Ghost-v2 identity similarity 0.1393 versus Roop 0.1997, Ghost-v2 gaze similarity 0.9385 versus Roop 0.9368, mixed close-up metric result, Roop robustness on Egyptian street cases, Ghost-v2 occluded-face and veiled-woman failures, ethically inappropriate veil-to-hair artifact noted by the authors, looking/not-looking feature preservation check, future work on more samples video inference optimization resizing distortion and source-face selection by age gender and skin tone or synthetic faces, pedestrian-privacy receipts, and the governance problem of treating anonymized street footage as safe training data before source dataset, consent basis, detector versions, swapper, source-face pool, preserved attributes, identity metric, gaze and expression metric, cultural edge-case review, failed detections, and reviewer signoff are auditable.
• The Harmful Chat Becomes the Interpretation Ledger - Tomohiro Okatsu, Naoki Takada, Yin Min Pa Pa, Katsunari Yoshioka, and Tatsunori Mori's Understanding Interpretation Difficulty in Harmful Online Communication: Insights from Cybercrime Communities paper, arXiv:2607.07277, cs.CL with cs.CY cross-listing, submitted July 8 2026, Yokohama National University affiliation, 15-page PDF, cybercrime-related Discord chat interpretation, harmful online communication, slang coded terms abbreviations euphemisms ambiguous expressions and community-specific references, October 2023 source corpus of 1,280,548 messages from 9,298 channels across 55 servers, channel filtering, 100 purposefully selected difficult target messages, not a prevalence estimate, WordNet and Wiktionary coverage gaps, three graduate-student human annotation, message-only local-context and external-knowledge conditions, 20 preceding and 20 following messages, full channel history external resources web searches online dictionaries and local LLM assistance, expert-reviewed reference interpretations, confidence scores, Match Partial Match Mismatch evaluation, GPT-OSS-20B and GPT-OSS-120B open-weight LLMs, security and privacy reason for not sending harmful-content examples to external providers, no retrieval prompt tuning or examples, human Condition A 2.7 matches and 93.3 mismatches, Condition B 5.3 matches, Condition C 62.7 matches and 12.6 mismatches, GPT-OSS-120B local-context condition 58 matches, local context improvement, larger-model advantage, error analysis around external knowledge context selection semantic ambiguity and non-standard linguistic forms, harmful-chat interpretation receipts, and the governance problem of treating moderation as message classification before corpus provenance, context window, external sources, confidence, reference interpretation, evaluator label, and human review are auditable.
• The Promise Becomes the Payoff Ledger - Jerick Shi, Terry Jingcheng Zhang, Bernhard Schölkopf, Vincent Conitzer, and Zhijing Jin's When Agents Lie: Premeditation, Persistence, and Exploitation in Repeated Games paper, arXiv:2607.05132, cs.CY with cs.CL, submitted July 6 2026 and revised July 7 2026, Best Paper Award at ICML NExT-Game Workshop noted by arXiv, 28-page PDF, Carnegie Mellon University, Jinesis AI Lab, Vector Institute, University of Toronto, EuroSafeAI, and Max Planck Institute for Intelligent Systems affiliations in the PDF, LLM agents, public announcements, private plans, final actions, repeated n-player games, endogenous promise protocol, post-round trust reflection, GPT-5.2, Llama-4-Maverick, Claude-Opus-4.6, six canonical games, Diner's Dilemma, El Farol Bar, Tragedy of the Commons, Volunteer's Dilemma, Public Goods, Weakest Link, homogeneous and heterogeneous model groups, 126 experimental conditions, 20 trials, 10 rounds, five agents, approximately 126,000 agent-rounds, commitment-breaking rates, premeditation classification, GPT-5.2 96.7 percent Diner's Dilemma commitment breaking and 15.3 percent Weakest Link, Llama-4-Maverick 98.6 percent El Farol and 10.2 percent Tragedy of the Commons, Claude-Opus-4.6 0.0 percent Weakest Link and 61.9 percent Volunteer, highest-deception conditions exceeding 90 percent premeditation, communication-protocol mismatch, binding commitments versus cheap talk, Llama minority payoff gaps in Diner's Dilemma, mixed-provider agent composition risk, public code link, self-reported-private-plan limitation, agent-promise receipts, and the governance problem of treating an agent announcement as a commitment before private plan, public statement, final action, payoff, trust update, model pairing, and semantic-compliance test are auditable.
• The Inferential Chain Becomes the Audit Object - Mihnea C. Moldoveanu and Joel A. C. Baum's Adversarial Social Epistemology for Assemblies of Humans and Large Language Models paper, arXiv:2607.07760, cs.AI with cs.SI cross-listing, published July 8 2026, 50-page PDF, University of Toronto affiliation in the PDF, adversarial social epistemology, human and large language model assemblies, scaffolded public assertions, testimony inference institutional certification and tacit trust chains, commitments and entitlements, upstream and downstream trust, triadic public communication, sender recipient and observers, observability intelligibility attention and interactive belief, poses demagogical triggers social-proof covers smokescreens plausible ambiguations decoys flares rabbit holes and haystacks, epistemic networks, inferentialist semantics, LLM and large language agent special regime, hallucination sycophancy evasive fluency over-refusal and dissimulative helpfulness as communicative infelicities, Brandom-style commitment tracking, Hintikka-style interrogative paths, Ramsey-style payoff checks, inferential-chain receipts, and the governance problem of treating misinformation as content diffusion before assertion, source chain, inferential commitment, audience role, audit question, evasion pattern, model context, and redemption path are auditable.
• The Harness Contract Becomes the Agent Audit - Joongho Ahn and Moonsoo Kim's From Prompts to Contracts: Harness Engineering for Auditable Enterprise LLM Agents paper, arXiv:2607.08028, cs.AI with cs.CL and cs.SE cross-listings, submitted July 9 2026, 32 pages, 6 figures, 16 tables, public hammerbaki/enterprise-llm-agent-harness reference implementation and Zenodo archive noted by arXiv, AI Leadership Research Center affiliation in the arXiv HTML, prompt-dominant enterprise LLM prototypes, harness engineering, code-owned control layer, replaceable composition boundary, manifests, schemas, source-backed claims, answer contracts, validation artifacts, traces, public-data slice of five Korean corporate groups and 25 listed companies, 113 source-backed runtime claims, source-to-claim pipeline, DART KRX and news source packages in the repository README, mobile briefing interface, Samsung SK Hyundai Motor LG and Hanwha groups, deterministic composer, source eligibility, entity routing, claim admission, answer planning, trace generation, fixed validation scenarios, 30 scenarios with six per corporate group, source-grounding entity-routing trace output-hygiene and recommendation-language contracts, seven-mutation fault-injection sensitivity check, live-LLM composition-boundary protocol, three hosted model identifiers, 270 runs, code-owned checks passing all 270 runs, 72 final failures confined to model-composed checks, prompt-only ablation letting recommendation-language and internal-trace-leakage violations reach readers, bolt-on guardrail over-refusal, 88/120 utility versus 120/120 utility for the harness in the ablation, expert-review limitation, bounded-public-data limitation, harness receipts, and the governance problem of treating prompt instructions as enterprise controls before source manifest, claim identifier, routing rule, answer contract, trace schema, validator version, fallback path, scenario, mutation, model-substitution run, utility count, latency record, release gate, reviewer, and replay artifact are auditable.
• The Action Severity Becomes the Safety Ledger - Harry Owiredu-Ashley's Beyond Attack-Success Rate: Action-Graded Severity Scale for Tool-Using AI Agents paper, arXiv:2607.07474, cs.CR with cs.AI and cs.CL, submitted July 8 2026, 8 pages and 6 figures, official Harry-Ashley/action-graded-severity GitHub artifacts, action-graded harm rubric, tool-using AI agents, red-team logs, AgentDojo workspace suite, binary attack-success-rate limitation, L0 to L6 ordinal severity scale, reversibility scope and privilege axes, escalation-chain level, deterministic programmatic oracle, attacker-goal attribution rule, per-tool effect metadata, 24 workspace tools, 10 consequential write tools, three frontier LLM judge panel, tag-free trajectory serialization, Krippendorff alpha 0.91, four victim models, GPT-4o mini, Claude Haiku 4.5, GPT-5.4, Claude Sonnet 4.6, two defenses, spotlighting paradox, tool-filter cross-scope leak, email channel substituted with calendar participant, zero ASR but one L4 episode in the tool-filter case study, GPT-4o mini no-defense severity counts 15 L0 4 L3 30 L4 and 1 L6, spotlighting counts 19 L0 4 L3 24 L4 1 L5 and 2 L6, high-severity tail rising from one to three episodes, released prompts configs per-episode logs and figure scripts, judge blind spot for escalation chains, action-severity receipts, and the governance problem of treating a lower attack-success rate as deployment evidence before raw trajectory, tool-effect metadata, binary verdict, oracle severity, judge disagreement, highest-severity action, escalation check, log path, and human review are auditable.
• The Miscompletion Becomes the Training Receipt - Anjun Gao, Yueyang Quan, Zhuqing Liu, and Minghong Fang's Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completions paper, arXiv:2607.08011, cs.CR with cs.AI cs.IR and cs.LG, submitted July 9 2026 and marked to appear in COLM 2026, University of Louisville and University of North Texas affiliations in the arXiv HTML, CodeTracer, code completion backdoors, poisoned fine-tuning data, post-deployment forensics, miscompletion reports, no retained-gradient requirement, no attacker-specific-knowledge requirement, structured behavioral fingerprints, exploit class, canonical unsafe pattern, normalized semantics, equivalent variants, transformation patterns, source-corpus scope narrowing, top 500 candidate examples, LLM-based attribution, GPT-4.1 default external LLM, UniXcoder code encoder, jinja2 requests and socket vulnerability cases, 80,000 clean fine-tuning examples, 20 backdoored examples per attack, 140 TROJAN examples, 100 simulated malicious completions, Table 1 false-negative rates mostly 0.00 to 0.03 for CodeTracer, attack-success rate after removal at 0.03 or lower across reported cases, 47.10-second runtime comparison, 0.33-dollar per-miscompletion cost table, adaptive attack tests, multi-attacker tests, noisy-report tests, false-flag-report limitation, human-in-the-loop review recommendation, miscompletion-forensics receipts, and the governance problem of treating a malicious autocomplete as fixed before model, fine-tuning run, corpus snapshot, reported prompt, malicious completion, fingerprint, candidate set, attributed examples, removal action, post-removal test, reviewer, and retention rule are auditable.
• The Gaze Trace Becomes the Caption Index - Shenghui Chen, Po-han Li, Ximeng Sun, Shijia Yang, Emad Barsoum, Zicheng Liu, Sandeep Chinchali, and Ufuk Topcu's VEGAS: Human-Aligned Video Caption Evaluation via Gaze paper, arXiv:2607.08489, cs.CV with cs.AI and cs.HC, submitted July 9 2026, University of Texas at Austin and AMD affiliations in the arXiv HTML, Video caption Evaluation via GAze Score, gaze-aware video caption evaluation, training-free test-time metric, cross-modal information-theoretic score, rejection sampling from candidate VLM captions, synchronized gaze, human-aligned caption selection, individual viewer attention, egocentric Aria Everyday Activities videos, SlideVQA instructional slides, human-written reference annotations, AEA mean SBERT shift +0.0856 and +13.53 percent, SlideVQA shift +0.0256 and +3.88 percent, AEA retrieval mAP gains +1.14 +2.48 and +2.46 at ranks 1 5 and 10, human pairwise caption gap remaining, caption-length diagnostic, random-gaze and center-bias corruption checks, VLM hallucination and calibration limits, gaze-as-proxy caution, smart-glasses and implicit-attention-proxy privacy boundary, gaze-caption receipts, and the governance problem of treating a personalized video caption as user intent before source video, capture device, gaze calibration, consent, candidate pool, model version, selector score, rejected alternatives, retrieval metric, privacy rule, and human review are auditable.
• The Data Branch Becomes the Review Boundary - Weiming Sheng, Jinlang Wang, Manuel Barros, Aldrin Montana, Jacopo Tagliabue, and Luca Bigon's GitLake: Git-for-data for the agentic lakehouse paper, arXiv:2607.08319, cs.DB with cs.AI, submitted July 9 2026, preprint accepted at DASHSys VLDB 2026 Boston, Columbia University, University of Wisconsin-Madison, Carnegie Mellon University, and Bauplan Labs affiliations in the arXiv HTML, agent-first lakehouse design, Git-for-data, Apache Iceberg snapshots, lakehouse-wide commits, branch heads, parent pointers, metadata-centric merges, isolated agent branches, human-approved merge boundary, transactional run API, temporary branches for multi-table pipelines, atomic publication, failed-run debugging branch, main-branch consistency, relational catalog control state, immutable Parquet and manifest-file data, CLI and Python APIs, Rust core with shared types and error taxonomies, Bauplan production report of millions of jobs and hundreds of thousands of branches, p95 branch creation around 80 milliseconds, hundreds of thousands of new branches per week, ten conflicts per 100,000 attempts, Alloy models for commits branches merges transactional pipelines unintended nested-branch behavior and revert corruption, GitHub git_for_data artifact, data-branch receipts, and the governance problem of treating agentic data work as production-ready before source branch, destination branch, commit hash, run identifier, validation checks, merge reviewer, rollback path, and downstream consumers are auditable.
• The Affect Classifier Becomes the Fusion Receipt - Adis Alihodzic and Selma Skopljakovic Hubljar's SHAP-Weighted Cross-Modal Expert Fusion for Emotion and Sentiment Recognition: Evidence and Limits paper, arXiv:2607.08573, cs.AI, submitted July 9 2026, University of Sarajevo affiliation, multimodal emotion recognition, sentiment recognition, affective computing, MELD seven-class emotion recognition, CMU-MOSEI three-class sentiment recognition, text voice and face modalities, BERT-base text embeddings, wav2vec 2.0 voice embeddings, face-emotion pipeline, 15 face-frame embeddings, mean pooling BiLSTM and Transformer face aggregators, XGBoost experts, TreeSHAP attribution magnitudes, XAI-guided adaptive fusion, XGAF, early fusion, late fusion, seven-expert pool, text-only voice-only face-only bimodal and trimodal experts, mean-abs median-abs and sum-abs SHAP reductions, temperature-scaled softmax fusion, MELD 9,660 train 1,067 validation and 2,525 test samples after filtering, CMU-MOSEI 16,326 train 1,871 validation and 4,659 test samples, Transformer-aggregator MELD early-fusion weighted-F1 0.6018, late-fusion 0.4598, mean-abs XGAFv2 0.5714, sum-abs XGAFv2 0.5983, McNemar p=1.000 versus early fusion and p<0.0001 versus late fusion, CMU-MOSEI sum-abs weighted-F1 0.6519 versus early fusion 0.6485 and late fusion 0.5696, p=0.0452 for small early-fusion comparison, median-abs behaving like mean-abs on MELD, sum-abs weights concentrating on the trimodal expert, no rich per-sample routing claim, pre-extracted-feature limitation, per-utterance MELD limitation, no dialogue-context speaker-state or conversation-graph modeling, no missing-modality or noisy-modality stress tests, affect-fusion receipts, and the governance problem of treating an emotion label as evidence before sensor quality, feature extractor, modality weights, reduction rule, uncertainty, stress tests, human review, and contestability are auditable.
• The Incident Response Becomes the Agent Safety Loop - Zibo Xiao, Jun Sun, and Junjie Chen's AIR: Improving Agent Safety through Incident Response paper, arXiv:2602.11749, cs.AI, submitted February 12 2026 and revised June 20 2026, accepted at ICML 2026 according to the arXiv record, AIR, Agent Incident Response, LLM agent safety, incident response lifecycle, domain-specific language, trigger check remediate rules, semantic runtime incident checks, current-environment-state grounding, recent-context grounding, containment, recovery, eradication, generated guardrail rules, future plan-level blocking, OpenAI Agent SDK implementation, hooks after tool invocation and before each agent step, ANTLR4 parser, code agents, embodied agents, computer-use agents, CodeAct, RedCode, SafeAgentBench, RiOSWorld, OSWorld, GPT-5 underlying LLM in the paper evaluation, RedCode over 4,000 tasks across 25 high-risk behavior categories, SafeAgentBench 750 tasks spanning 10 hazard types and 17 manipulation actions, 50 safe embodied tasks with 0 AIR false positives, 35 safe OSWorld browser tasks with 0 AIR false positives, detection remediation and eradication exceeding 90 percent in the abstract, overall detection above 90 percent and remediation and eradication above 95 percent in the introduction, self-remediation ablation, embodied remediation 80.952 percent to 92.308 percent, computer-use remediation 76.596 percent to 97.727 percent, LLM-generated rule caveats, no-direct-baseline caveat, manually assessed ground-truth-label caveat, FFchopon/AIR repository link, incident-response receipts, and the governance problem of treating prevention-only guardrails as enough before detection, containment, recovery, rule provenance, environment state, latency overhead, future blocking, and human review are auditable.
• The Grid Agent Becomes the Evidence Log - Costas Mylonas, Magda Foti, Andrea Pomarico, Matheus Duarte, Qian Zhang, and Emmanouel Varvarigos's PowerAgentBench-SS: A Benchmark for Agentic AI in Power System Steady-State Studies paper, arXiv:2606.18789, eess.SY, submitted June 17 2026, UBITECH Athens, Politecnico di Milano, EnliteAI, Harvard School of Engineering and Applied Sciences, and National Technical University of Athens affiliations, official Power-Agent/PowerAgentBench repository, PowerAgentBench-SS, agentic AI for power systems, steady-state power-system studies, tool-using agents, engineering workflow evaluation, public case data, action constraints, tool API, validation budget, hidden evaluator, evidence log, false-safe conclusions, submitted recall, evidence-backed recall, found recall, false-safe penalties, severity regret, residual violation score, action cost, tool-use efficiency, workflow diagnostics, JSON-command LLM adapter, scripted agents, LLM agents, human-supervised mode, strict-submit scoring, auto-finalized scoring, DC thermal N-2 contingency-search pilot, IEEE 39-bus operating-point variants, 46 candidate branches, 1,035 two-branch outage cases, 80-validation-call budget, 20 ranked submitted contingencies, empirical top-5-percent dangerous set, 52 dangerous cases per instance, case_summary, rank_base_loading, rank_lodf, validate, redispatch, submit tools, Qwen3.5 Mistral-Nemo-12B and Command-R-35B via Ollama, GPT-5.5 via OpenAI API, Base-loading evidence-backed recall 0.519 plus or minus 0.024, GPT-5.5 evidence-backed recall 0.300 plus or minus 0.214, Hybrid+redispatch PostV reduction from 16.754 plus or minus 0.059 to 15.469 plus or minus 0.107, Command-R submit-rate failure under strict scoring, dynamic track PSS/E and DMView tooling caveat in the repository README, DC-pilot limitation, AC-security-analysis limitation, grid-agent receipts, and the governance problem of treating a critical-infrastructure agent report as useful before case, tool calls, validation evidence, hidden revalidation, false-safe misses, mitigation result, and human approval are auditable.
• The Audio Judge Becomes the Voice-Agent Referee - A. Sayyad, J. Emmons, S. Jones, T. Lin, and H. Krishnan's A Reliability Assessment of LALM Audio Judges for Full-Duplex Voice Agents paper, arXiv:2607.07985, cs.CL with cs.AI cs.SD and eess.AS, submitted July 8 2026, 28 pages total, Salesforce Applied AI Research and eVerse team affiliation in the arXiv HTML, LALM-as-judge, audio language models, full-duplex voice agents, production customer-support voice-agent evaluation, raw stereo WAV scoring, agent on left channel and human caller on right channel, Gemini 2.5 Flash primary judge, Gemini 3.5 Flash and Gemini 3.1 Pro Preview cross-model checks, Vertex AI generate-content API, AgentSpeechFidelity, ConversationalAudioQuality, eight production dimensions, 209 rated stereo sessions, 152 conversations across 13 accent-and-condition strata, 57 adversarial defect-injected clips, three calibrated human raters, 1-to-5 Likert scoring, pairwise Spearman rho, within-1-point agreement to the three-rater human mean, Krippendorff alpha ceiling caveat, Newcombe-Wilson defect-recall intervals, 5 of 8 dimensions within 0.07 Spearman rho of human-human agreement, 7 of 8 bootstrap confidence intervals overlapping, 6 of 8 dimensions at least 60 percent within-1 agreement, 3 dimensions at 89 percent or higher, 48 defect-by-dimension cells, 4 LALM-more-sensitive cells, 3 human-more-sensitive cells, 41 underpowered no-difference cells, audio_clarity hard-clipping miss, sample-rate mismatch miss, proposed DSP detector and human-review routing, model-swap calibration caveat, arXiv reproducibility manifest naming public artifact releases, unreleased raw-session-recording caveat, voice-evaluation receipts, and the governance problem of treating an audio judge as a production referee before session source, rater calibration, rubric dimension, defect routing, model checkpoint, public artifacts, and human escalation rule are auditable.
• The Abort Cascade Becomes the Agent Brake - Kai Ruan, Zihe Huang, Ziqi Zhou, Qianshan Wei, Xuan Wang, and Hao Sun's Doomed from the Start: Early Abort of LLM Agent Episodes via a Recall-Controlled Probe Cascade paper, arXiv:2607.06503, cs.AI, submitted July 7 2026, 10 pages, 9 figures, 2 tables, code-will-be-released-soon comment, arXiv HTML CC BY 4.0 license notice, Renmin University of China, Chinese Academy of Sciences, Duke University, and Zhejiang University affiliations, LLM agents, long-horizon tasks, failed trajectories, inference-compute waste, recall-controlled abort cascade, hidden-state probes, residual-stream activations, final generated token of the action, Llama-3.2-3B layer 14, Qwen-2.5-7B layer 20, TextCraft environment from AgentGym, 800 episodes, 100 tasks, 8 episodes per task, temperature 1.0, 20-round maximum, gates at rounds 1 through 6, Llama task success 63.0 percent, Qwen task success 74.8 percent, behavior-only surface scorer, stacking scorer, action-token log probability, generated-token count, prefix length, error-keyword count, logistic-regression probes, standardized features, task-grouped cross-fitting, 20 percent calibration split, 20 percent validation split, 60 percent test split, Clopper-Pearson calibrated gates, per-round recall budgets, global success recall target, margin rule, certificate variant, 20 random seeds, recall targets 90 to 97 percent, Qwen 47.1 percent plus or minus 10.3 percent compute saved at 90 percent recall, Llama 37.2 percent plus or minus 8.8 percent compute saved at 90 percent recall, 1.6 to 1.7 times best single-gate policy, 95 percent recall target savings, behavior-only cascade saving roughly half in the strongest Qwen comparison, generated-token savings caveat, exchangeability caveat, TextCraft-only caveat, two-model caveat, offline teacher-forced rerun caveat, serving-stack activation-access caveat, post-abort policy caveat, agent-brake receipts, and the governance problem of treating an early-failure score as operational control before recall target, calibration data, false-abort budget, selected gate, saved compute, retry rule, and deployment-domain boundary are auditable.
• The Reasoning Amplifier Becomes the Audit Probe - Jack Hopkins, Dipika Khullar, and Fabien Roger's Overthinking: Amplifying Reasoning Weights to Extract Learned Secrets paper, arXiv:2607.08173, cs.AI, submitted July 9 2026, accepted at ICML 2026 according to the arXiv API comment, arXiv HTML CC BY 4.0 license notice, PDF metadata showing 19 pages including supplementary material, white-box pre-deployment auditing, reasoning task vector, non-reasoning instruct model M, reasoning-distilled model R, overthinking model with alpha greater than 1, layer-wise attenuation, Freeze Last 5, Freeze Last Half, Linear Decay, Fisher Trace, Directional Fisher, Task Magnitude weighting, random Layer-Norm and Global-Norm baselines, Qwen3-VL 2B 4B 8B and 32B model scales, In-Context Secret MMLU, Secret Word Taboo, Secret Belief Gender, Secret Behavior SSC, 256-sample sweeps, alpha 0 to 4 by 0.5, temperature 0.7, 1024 to 2048 output-token budgets, GPT-4.1-mini judges, thinking-block versus response-block leak location, 9 of 10 uniform settings peaking above alpha 1, prefill plus overthinking stack, Gender 8B metacognitive prefill plus overthinking 97.7 percent, SSC 32B prefill plus overthinking 53.4 percent, Taboo overthinking best alone 25.5 percent, Fisher-weighted methods, directionally protected versus noise-fragile secrets, Qwen3-VL-only caveat, model-organism caveat, keyword-matching and LLM-judge caveat, 256-sample caveat, white-box-access dual-use caveat, overthinking receipts, and the governance problem of treating ordinary black-box evaluation as enough before model family, weight checkpoint, task vector, amplification schedule, judge, leak channel, random-perturbation baseline, prefill condition, and deployment boundary are auditable.
• The Procedure Match Becomes the Coding Agent Memory - QiHong Chen, Aaron Imani, and Iftekhar Ahmed's ProjAgent: Procedural Similarity Retrieval for Repository-Level Code Generation paper, arXiv:2607.08691, cs.SE with cs.AI and cs.IR, submitted July 9 2026, 19-page PDF, University of California Irvine affiliations, repository-level code generation, coding agents, procedural similarity retrieval, lexical semantic and structural retrieval contrast, Qwen2.5-Coder-14B-Instruct backbone, incomplete Python function plus docstring task, accessible-file selection through Python import tracing, target-step decomposition, reasoning hidden-state projection similarity, candidate-step seed finding, LLM verification of procedural seeds, semantic retrieval combination, conservative static-analysis feedback loop, AST syntax checks, method call checking, field access checking, variable-method checking, standalone function-call checking, 10-iteration refinement cap, REPOCOD benchmark, 980 problems from 11 real-world Python repositories, greedy decoding temperature 0, 4096 output-token maximum, Sparse Dense Same_File and SpecAgent baselines, Pass@1 table with ProjAgent 41.14 percent versus SpecAgent 34.52 percent, procedural-removal ablation dropping to 25.76 percent, semantic-removal ablation dropping to 32.29 percent, feedback-loop removal dropping to 40.29 percent, Astropy projection study, 9,598 target-context step pairs, Claude Sonnet 4.6 labels, 370-pair manual validation sample, kappa 0.86 inter-rater agreement, kappa 0.82 consensus-versus-Claude agreement, Python-only caveat, single-backbone caveat, fixed retrieval-budget and context-window caveat, Astropy-only ablation caveat, procedural-memory receipts, and the governance problem of treating repository search as agent understanding before target function, commit, import graph, retrieved procedure, verifier prompt, context budget, static-analysis trace, tests, and review failure are auditable.
• The Session Scheduler Becomes the Agent Fairness Layer - Jiahao Wang, Kaizhan Lin, Kaixi Zhang, Jinbo Han, Xingda Wei, Sijie Shen, Chenguang Fang, Wenyuan Yu, Rong Chen, and Haibo Chen's SMetric: Rethink LLM Scheduling for Serving Agents with Balanced Session-centric Scheduling paper, arXiv:2607.08565, cs.DC with cs.AI, submitted July 9 2026, 17-page PDF, Institute of Parallel and Distributed Systems Shanghai Jiao Tong University and Alibaba Group affiliations, Kaizhan Lin ShanghaiTech University intern note, BAILIAN production traces, commercial coding-agent product, two large-scale agent-dedicated clusters, peak usage window 10:00 to 12:00 on May 29 2026, Trace 1 popular TB-level model, Trace 2 roughly 280B-parameter model, hashed request content, arrival time, session ID, parent request ID, turn number, trigger source, KV-cache reuse, KV reuse above 80 percent versus 54 to 62 percent in chat, more than 65 percent intra-session reuse, roughly 90 percent reuse within about 100 seconds, top 25 percent sessions contributing more than 80 percent of tokens, first-turn system-prompt reuse, session stickiness, local and global KV-cache tiers, GPU memory CPU memory and cloud-storage hierarchy, RDMA global tier, prefill-decode colocation, prefill-decode disaggregation, vLLM, LMCache, Mooncake, Qwen3-Coder-30B-A3B, Qwen3-235B-A22B-FP8, four GPU servers with eight NVIDIA H20 GPUs each, 160 CPU cores and 1280 GB host DRAM per server, 200 Gbps RDMA NICs, separate scheduler CPU server, BAILIAN LMetric load-balance-only and Dynamo baselines, session-turn routing, first request load balancing, follow-up cache-aware routing, not_overloaded guard, session_not_evicted guard, stateless turn inference from standard LLM API histories, TPS within SLO, TTFT, TPOT, 30 ms TPOT SLO, 10 to 16 percent higher TPS under colocation with global store, 2 to 34 percent higher prefill TPS under disaggregation, Qwen3-235B peak 516 tokens per second within SLO, median TTFT 1.1 seconds in 30B colocation and 1.1 seconds in disaggregation examples, open-source-upon-publication caveat, trace privacy-policy caveat, sampled-trace replay caveat, agent-serving receipts, and the governance problem of treating agent platform capacity as a GPU count before session routing, cache tier, load imbalance, timeout policy, trace sampling, and scheduler rule are auditable.
• The Latent Trace Becomes the Motor Receipt - Chuning Zhu, Eva Xu, Jose Barreiros, Krishnan Srinivasan, Paarth Shah, and Abhishek Gupta's Latent Memory Palace: Reasoning for Control as Autoregressive Variational Inference paper, arXiv:2607.08724, cs.LG, submitted July 9 2026, 26-page PDF, University of Washington and Toyota Research Institute affiliations, official WEIRDLabUW Latent Memory Palace project page, official WEIRDLabUW/latent-memory-palace implementation repository, LMP, LMP-π policy, LMP-tok action tokenizer, autoregressive variational inference, variable-length latent traces, EOS stopping token, observation-conditioned prior, posterior conditioned on observation and action, action decoder, continuous robot actions, latent-space reinforcement learning, adaptive test-time compute, DROID real-world manipulation platform, LIBERO simulated manipulation benchmark, D3IL multimodal simulated benchmark, RoboMimic high-precision simulated benchmark, Diffusion Policy baseline, 1B-parameter language-conditioned policies, DROID block-bowl marker-mug peg-hole and clean-table tasks, 20 randomly sampled DROID initial conditions per task, simulation results averaged over three seeds, DROID success rates 0.65 versus 0.40 on block-bowl and 0.55 versus 0.25 on marker-mug against DP, LIBERO-90 overall success 0.933 versus 0.909 and bottom-10 task success 0.645 versus 0.463, compression ablation with sigma-min 0.01 0.03 and 0.05, latent-step analysis, 64 latent traces per observation, gripper-command timing caveat, nearest-neighbor action-variance analysis with Pearson r=-0.518, sampling-based RL hyperparameter sensitivity, latent-collapse caveat, motor-control receipts, and the governance problem of treating a robot success rate as embodied reasoning before embodiment, observation, action representation, latent vocabulary, stopping rule, trace length, checkpoint, task boundary, failure videos, and human override path are auditable.
• The Edge Becomes the Privacy Claim - Wenxiu Ding, Muzhi Liu, Zheng Yan, Mingjun Wang, Yifan Zhao, and Qiao Liu's EdgeRefine: Privacy-Utility Balance for Graphs via Jaccard Sampling under Edge Differential Privacy paper, arXiv:2607.08659, cs.LG, submitted July 9 2026, 21-page PDF, Xidian University affiliations in Xi'an Shaanxi China, arXiv HTML CC BY 4.0 license notice, graph neural networks, GNNs, edge differential privacy, edge local differential privacy, local differential privacy, privacy-sensitive graph learning, sensitive link information, adjacency matrix perturbation, randomized response, client-server pipeline, client-side perturbation, server-side denoising, Jaccard similarity, histogram binning, probability calibration, deterministic optimal sampling, privacy budget epsilon, sampling rate k, true-to-fake edge ratio rho, graph sparsity preservation, edge-existence probability estimation, ACM DBLP AMAP and Cora node-classification datasets, MUTAG graph-classification dataset, GAT GCN and GIN architectures, privacy budgets 0.5 to 3.5, Blink-hard Blink-hybrid DPRR LDPGen LAPGRAPH and Origin baselines, node classification accuracy, graph classification accuracy, Privacy-Utility Balance Index PUBI, EdgeRefine PUBI average 0.9386 across 12 architecture-dataset combinations, epsilon 2.5 improvement of 17.8 percent on ACM under GAT and 19.7 percent on Cora under GCN versus cited state-of-the-art baselines, graph-classification average accuracy degradation around 5 percent versus noise-free baseline, GRAND graph reconstruction attack, Relative Absolute Error RAE, Cora RAE average 1.962, AMAP RAE average 1.472, preprocessing-cost caveat, link-prediction conflict with edge-privacy goal, NIST SP 800-226 differential privacy evaluation context, graph-privacy receipts, and the governance problem of treating a graph model as privacy-preserving before edge semantics, threat model, privacy budget, perturbation mechanism, reconstructed graph density, downstream task, attack test, model output, and use restriction are auditable.
• The Concept Game Becomes the Agent Test - Sophia Koehler, Antonia Wüst, Inga Ibs, Wasu Top Piriyakulkij, Wolfgang Stammer, Constantin Rothkopf, Kevin Ellis, and Kristian Kersting's Playing ZendoWorld: Challenging AI Agents on Active Visual Concept Induction paper, arXiv:2607.08233, cs.AI with cs.CV, submitted July 9 2026, 33-page PDF, arXiv HTML CC BY 4.0 license notice, AIML Lab TU Darmstadt, Hessian Center for AI, Psychology of Information Processing TU Darmstadt, Centre for Cognitive Science TU Darmstadt, Cornell University, Max Planck Institute for Informatics SIC, and German Center for AI affiliations, official ml-research/ZendoWorld repository, Hugging Face Zendo synthetic data link, active visual concept induction, ZendoWorld, Zendo-inspired rule-discovery game, hidden logical rules, visual observations, proposed scenes, environment feedback, perception induction and experimentation loop, 22 games, basic predicates, counting, parity, spatial relations, logical connectives, one out-of-distribution rule outside the Oracle DSL, maximum 30 observations per game, logical-equivalence win criterion, Oracle Agent, pure VLM Agent, Bayesian Agent with particle-style hypothesis inference, Vision-Language Programs Agent, human participant comparison, Table 3 win rates with Human 73.3 percent, Oracle 95.5 percent, VLM 44.5 percent, Bayesian 13.6 percent, VLP 18.2 percent, Bayesian label accuracy 75.2 percent despite low rule-recovery win rate, VLM label accuracy 56.7 percent, human label accuracy 53.9 percent, structural F1 over rule trees, expected information gain EIG for proposed experiments, VLM and Bayesian agents near-zero EIG after roughly 10 examples, random Oracle variant second-highest EIG, 22 games times 5 seeds times 4 agents equals 440 runs, single NVIDIA Tesla V100-SXM3-32GB GPU, 321 GPU-hours, 155,125,194 GPT-5-mini API tokens, synthetic benchmark caveat, fixed-vocabulary caveat, concept-induction receipts, and the governance problem of treating an agent answer as concept learning before task generator, hidden-rule grammar, observation budget, proposed experiments, feedback trace, final hypothesis, logical-equivalence checker, label accuracy, win rate, EIG, seeds, data, code, and compute footprint are auditable.
• The Intervention Claim Becomes the Confidence Sequence - Amir Asiaee's Certified Interventional Fidelity: Anytime-Valid, Adaptive Evaluation of Causal Claims in Mechanistic Interpretability paper, arXiv:2607.08349, cs.LG, submitted July 9 2026, accepted at UAI 2026, 18-page PDF, Department of Biostatistics at Vanderbilt University Medical Center, official AsiaeeLab/certified-interventional-fidelity repository, MIT license, Certified Interventional Fidelity, CIF, mechanistic interpretability, causal claims, interventional interpretability, hidden-state swaps, activation patching, path patching, causal tracing, circuit ablation, causal scrubbing, circuit completeness, compressed-model fidelity, abstraction fidelity, component-effect claims, bounded causal estimands, stated input distribution, stated intervention distribution, fixed-budget confidence intervals, anytime-valid confidence sequences, repeated monitoring, optional stopping, adaptive failure-directed sampling, bounded mixture importance weighting, Hoeffding-style sequences, variance-adaptive betting sequences, Online Newton Step betting tracker, paired comparisons, one-sided stopping rules, multiple-comparison caveat, Bonferroni correction, future e-value FDR direction, MNIST neural abstractions, MNIST MLP above 98 percent test accuracy, GPT-2 Small IOI circuits, 12 layers, 12 heads, 768-dimensional residual stream, approximately 124M parameters, ACDC attribution patching AtP* and hand-identified IOI circuit comparisons, 10-30x certification-cost reduction reported for betting sequences, IOI Hoeffding radius about 0.070 versus betting radius about 0.005 at 2,000 samples, 13-head IOI circuit certifying normalized patching recovery at least 0.90 with 102 betting samples and at least 0.95 with 357 betting samples, Hoeffding requiring 1,875 samples and more than the 2,000-sample budget for the same thresholds, 3-head name-mover circuit certifying at least 0.90 recovery in 110 betting samples, 500-run coverage validation under i.i.d. adaptive and aggressive-peeking regimes, bounded-score and clipping caveat, metric-does-not-prove-mechanistic-truth caveat, identification-problem caveat, reproducibility notebooks and saved CSV results, interventional-interpretability receipts, and the governance problem of treating a patching or circuit score as a causal explanation before estimand, distribution, intervention, score, confidence sequence, peeking rule, adaptive sampler, multiplicity correction, stopping time, code commit, and final claim boundary are auditable.
• The Interaction Becomes the Evaluation Target - Marcos Economides, Paul M. Sacher, Samuel Salzer, Alexis Michelle Abellar, Fendi Tsim, and Antoine Ferrère's Psychological Competence as a Missing Dimension in AI Evaluation paper, arXiv:2607.08285, cs.AI, submitted July 9 2026, 22-page PDF, 3 figures, Behavioral AI Institute and Imperial College London affiliations, no datasets generated or analyzed during the conceptual research, no specific grant support disclosed, psychological competence, human-facing AI systems, advisors coaches tutors and companions, interaction-level evaluation, user cognition, emotional interpretation, behavioral decision-making, framing, tone, perceived authority, responsiveness, uncertainty handling, conversational guidance, context sensitivity, emotional responsiveness, social cognition, behavioral influence, developmental sensitivity, scenario-based probes, structured human evaluation, expert panels, AI-as-judge framing review, psychometric measures, longitudinal interaction effects, trust calibration, reliance, autonomy preservation, agency preservation, vulnerability sensitivity, healthcare education and mental-health deployment context, model providers, deploying organizations, researchers, regulators, EU AI Act and Trustworthy AI governance references, no new benchmark claim, human-subject validation caveat, scalable-benchmark challenge, psychological-competence receipts, and the governance problem of treating a human-facing AI answer as acceptable before user group, vulnerability assumption, ground-truth status, tone, authority cue, uncertainty handling, autonomy effect, panel design, AI-judge prompt, psychometric measure, longitudinal follow-up, and deployment decision are auditable.
• The Evaluation Budget Becomes the Stopping Rule - Ofir Arviv, Kristjan Greenewald, Yotam Perlitz, Hadar Mulian, Michal Shmueli-Scheuer, and Leshem Choshen's Stop Guessing When to Stop Testing: Efficient Model Evaluation with Just Enough Data paper, arXiv:2607.08522, cs.LG, submitted July 9 2026, 11-page PDF, IBM Research affiliation in the arXiv HTML, official OfirArviv/adaptive-eval repository, adaptive evaluation, sequential testing, group sequential testing, Pocock spending function, Open VLM Leaderboard data, VLMEval OpenVLMRecords commit dbc5e10, 206 vision-language models, 31 multimodal benchmarks, confidence intervals, statistical significance, minimum detectable effect size, diminishing-returns stopping, model ranking, model selection, development-time testing, LLM-as-judge cost pressure, high-resolution image and long-context evaluation cost pressure, initial sample size 600, batch size 100, beta 0.9, gsDesign R package integration, 2.5-point confidence-interval width allowance, up to 80 percent cost reduction against fixed-size evaluation, 44 percent cost reduction at the diminishing-returns plateau with 0.132 point precision sacrifice, 8,000-example versus 14,400-example confidence-interval comparison, 1,000 top-50 model pairs, fixed 1,200-sample comparison differentiating 55 percent of pairs with 95 percent confidence versus 76 percent under the adaptive framework, model pairs separated by more than 2 points usually saving at least 60 percent evaluation effort, compute-constrained case study using 60 percent of examples, meaningful-change deployment case using 63 percent, model-selection case using 30 percent sample budget and filtering 86 weak models, i.i.d. assumption caveat, repeated-check overhead, run-variability caveat, statistical-expertise caveat, evaluation-budget receipts, and the governance problem of treating a benchmark score as ready before objective, stopping rule, confidence interval, effect threshold, batch schedule, random seed, full-run fallback, sample count, and decision owner are auditable.
• The Scratchpad Becomes the Persuasion Channel - Jennifer Za, Julija Bainiaksina, Nikita Ostrovsky, Tanush Chopra, and Victoria Krakovna's Persuasion Attacks Can Decrease Effectiveness of CoT Monitoring paper, arXiv:2607.08066, cs.AI with cs.LG, submitted July 9 2026, 25-page PDF, 10 figures, LASR Labs University College London and Google DeepMind affiliations, official cerdwin/persuasion-evals evaluation repository, chain-of-thought monitoring, visible scratchpad as persuasion channel, adversarial agent-monitor approval loop, 40 tasks across software engineering customer support financial analysis and social media content generation and moderation, main task plus hidden policy-violating task, benign and malign calibration baselines, five-turn feedback loop, agent models Gemini 2.5 Pro GPT-4.1 and Llama 4 Maverick, monitor and fact-checker models Gemini 2.5 Flash GPT-4.1 and Claude 3.7 Sonnet, benign acceptance baselines 95.5 to 98.8 percent, malign acceptance baselines 1.3 to 7.5 percent, agent persuasion raising approval from 8.7 to 47.0 percent relative to malign baseline, justification-only average 24.4 percent versus justification-plus-CoT average 33.9 percent, 9.5 percentage-point increase, CoT-only ablation 2.5 to 9.2 percent, benign justification p=0.65, cross-family fact-checking reducing approvals to approximately 6 percent on average and by up to 45 percent in the abstract framing, same-family fact-checking trust vulnerabilities, recurring persuasion strategies, controlled-justification limitation, hardcoded-action limitation, fixed-model limitation, monitor-persuasion receipts, and the governance problem of treating visible reasoning as safety evidence before agent goal, hidden task, monitor policy, scratchpad visibility, justification, feedback loop, fact-checker independence, approval trace, and downstream action boundary are auditable.
• The Prompt Firewall Becomes the Privacy Checkpoint - Hugo García Cuesta, Pablo Mateo Torrejón, and Alfonso Sánchez-Macián's Multi-Agent Firewall Architecture for Privacy Protection of Sensitive Data in Interactions with Language Models paper, arXiv:2607.08282, cs.CR with cs.AI and cs.MA, submitted July 9 2026, 20-page PDF, Universidad Carlos III de Madrid affiliations, Minos Verdict Mesh, official xHugo21/minos-verdict-mesh GitHub implementation, MIT license statement, browser extension and proxy sensors, Chromium Manifest V3 web-chatbot interception, HTTP(S) and WebSocket Secure API interception, local-first backend, FastAPI detection service, LangGraph directed acyclic graph, deterministic regex keyword checksum and phone-number detectors, GLiNER zero-shot named-entity recognition, optional RapidFuzz code similarity against indexed Git repositories, pdfplumber PDF extraction, Tesseract OCR and VLM fallback for images, sanitization-first workflow, typed redaction tokens, risk scoring across high medium and low tiers, allow warn and block decisions, browser human-in-the-loop warning blocking sanitized-send and override paths, proxy HTTP 403 and dropped WebSocket enforcement, fail-closed backend-unavailable behavior, NVIDIA Nemotron-PII test split, US locale, 500 cases per run, fixed seed 100, benchmark excluding multimodal analysis code similarity and anonymization fidelity, T2 and T3 81.66 percent F1 with mean latency under one second, T10 fine-tuned Gemma 3 4B 94.93 percent F1 at 5419.32 ms mean latency, T11 Gemma 4 E4B 89.43 percent F1 at 0.528 seconds mean latency, local-inference quality ceiling, Chromium/provider-adapter scope, HTTP(S)/WSS-only API scope, headless human-approval limitation, prompt-firewall receipts, and the governance problem of treating outbound prompts as safe before sensor, endpoint, payload type, detector configuration, redaction map, risk score, sanitized output, override, latency, and audit-log integrity are auditable.
• The Refusal Gate Becomes the Utility Ledger - Mingchen Li, Meikang Qiu, Zifan Peng, Heng Fan, Song Fu, Junhua Ding, and Yunhe Feng's Beyond Refusal: A Same-Lineage Study of Aligned and Abliterated LLMs for Vulnerability Analysis paper, arXiv:2607.05842, cs.SE with cs.AI and cs.CR, submitted July 7 2026, same-lineage aligned versus refusal-ablated model comparison, Gemma and Qwen pairs, vulnerability detection, CWE attribution, vulnerable-line localization, root-cause localization, executable patch validation, neutral review prompts, authorization context, cybersecurity terminology density, answer coverage, answer quality, end-to-end utility, Qwen line-level F1 from 2.08 percent to 3.91 percent, Top-1 accuracy from 4.10 percent to 6.95 percent, Gemma Java/Vul4J repair-validation early gates, usable applied and compiled patch rates, prompt-framing sensitivity, non-refused answer degradation, refusal-and-utility receipts, and the governance problem of treating cyber-safety as a refusal rate before defensive correctness, localization, output stability, patch application, compile status, vulnerability trigger results, and final validation are auditable.
• The Agent Registry Becomes the Retirement Board - Richard Kang and Vincent Wang's Registry-Governed Agent Lifecycle: Completing EDDOps with Evaluation-Driven Registration, Promotion, and Retirement on AWS AgentCore paper, arXiv:2607.00345, cs.SE, submitted July 1 2026, Evaluation-Driven Development and Operations, EDDOps, registry-as-control-plane, agent lifecycle governance, DRAFT APPROVED PUBLISHED DEPRECATED and RETIRED states, evaluation-gated promotion, human sign-off, score-driven demotion, staleness policy, retirement workflow, MCP-native discovery, six-agent proof of concept, three foundation models, managed runtime and bring-your-own deployment paths, 15-case single-turn dataset, nine multi-turn mock-tool scenarios, weighted quality score, production eligibility gates, cost-adjusted performance, Total Cost of Agent Ownership, lifecycle evaluation overhead under 11 percent in the paper's studied moderate-volume example, AWS Agent Registry preview context, structured registry records, approval workflow, discovery visibility, and the governance problem of treating an enterprise agent catalog as inventory before state transition evidence, evaluator version, gate threshold, owner, deployment path, discovery status, deprecation trigger, and retirement receipt are auditable.
• The Watermark Becomes the Contradiction - Alexander Nemecek, Hengzhi He, Guang Cheng, and Erman Ayday's Authenticated Contradictions from Desynchronized Provenance and Watermarking paper, arXiv:2603.02378, cs.CR with cs.CV cs.MM and eess.IV, submitted March 2 2026 and revised April 18 2026, accepted at CVPR 2026 Workshop Authenticity & Provenance in the Age of AI, Integrity Clash, C2PA manifests, invisible watermarking, metadata washing, authenticated fakes, cross-layer audit protocol, four conflict-matrix states, Pixel Seal, 3,500 test images, 100 percent paper-reported classification accuracy, JPEG Q80, crop-and-resize, screenshot simulation perturbations, self-signed research certificate caveat, image-modality and single-watermark limits, and the governance problem of treating provenance or watermark signals as sufficient before manifest assertions, watermark detection, signer trust, detector threshold, perturbation status, and cross-layer consistency are auditable.
• The Agent Run Becomes the Playbook - Arun Malik's Progressive Crystallization: Turning Agent Exploration into Deterministic, Lower-Cost Workflows in Production paper, arXiv:2607.07052, cs.SE with cs.AI cs.DC cs.ET and cs.MA, submitted July 8 2026, DOI 10.48550/arXiv.2607.07052, four-page PDF metadata, conference-style manuscript comment, agentic AI, AIOps, workflow automation, cloud network operations, agent exploration as discovery rather than permanent execution, progressive crystallization, Type 3 agent-orchestrated playbooks, Type 2 hybrid playbooks, Type 1 deterministic playbooks, human-in-the-loop gates, schema validation, typed API calls, zero-token deterministic workflows, trace extraction from ordered tool calls branch conditions schemas dependency graphs parameters and approval gates, default Type 3 to Type 2 promotion after at least 10 successful runs, zero safety violations, at least 90 percent same action sequence, passing generated acceptance tests, and no recent human override, default Type 2 to Type 1 promotion after at least 50 successful hybrid runs, 99 percent LLM classification consistency, deterministic-rule coverage, full regression suite without the LLM, and human review, demotion on execution failure safety violation or acceptance-test regression, firmware-update parser failure example, production cloud network platform handling tens of thousands of incidents per month, deterministic executions rising from zero to about 45 percent over eight months, roughly 30 percent hybrid and 25 percent agent-orchestrated mix, per-incident agent cost falling by more than 70 percent while incident volume roughly doubled, over 90 percent of common incident categories resolved autonomously, mean time to resolution from hours to minutes, false-positive remediation under 5 percent with no customer-visible impact as paper-reported, single-organization and single-domain limitation, recurring-pattern caveat, sparse-log caveat, crystallized-playbook receipts, and the governance problem of treating model capability as workflow authority before trace, promotion rule, regression test, human review, demotion trigger, cost claim, quality claim, and replay result are auditable.
• The Hallucination Court Becomes the Chemistry Agent - Runzhe Liu, Biquan Bie, Zihao Wang, Yuchao Ma, Yexin Liu, Xinghai Li, Harry Yang, Wenbo Yang, Jinzhe Cao, and Shengyang Tao's Game Theory Driven Multi-Agent Framework Mitigates Language Model Hallucination paper, arXiv:2607.08403, cs.AI, submitted July 9 2026, 34-page PDF, Dalian University of Technology, Hong Kong University of Science and Technology, and independent researcher affiliations, G-Frame, game-theoretic multi-agent chemistry reasoning, Bayesian games, team games, decisional task and executive agents, Teacher Student Supervisor and Regulator roles, Qwen2.5-7B-Instruct core local LLM, YaRN context extension, vLLM local model service, DeepSeek-R1 decisional-agent API, five-billion-token chemical corpus, approximately 500,000 chemistry articles and books, 363,045 chemical chain-of-thought items, 199,589 QA pairs, OmniChem 7B, ChemJudge, ThChem, ChemBench, 471-question Gemini 3.1 Pro judged ChemJudge with doctoral expert verification and human-judgment override, paper-reported 79.46 percent hallucination reduction relative to the base model, ThChem 1.0 score 79.45, ThChem 2.0 score 62.08, ChemBench score 49.82, SQuAD F1 improvement of 20 to 40 percent for multi-agent generation versus a single LLM, TADF materials research, GraphRAG expert QA, BODIPY derivative design, lidocaine retrosynthesis planning, link-checked GitHub Hugging Face and Zenodo artifacts, hallucination-court receipts, and the governance problem of treating multi-agent chemistry answers as reliable before source corpus, agent roles, utility functions, judge model, human override, benchmark split, artifact version, and reproduction status are auditable.
• The Food Photo Becomes the Dietitian - Qian Jiang, Zhecheng Shi, Jingpu Yang, Zirui Song, and Miao Fang's OmniFood-Bench: Evaluating VLMs for Nutrient Reasoning and Personalized Health Advice paper, arXiv:2607.08423, cs.AI, submitted July 9 2026, seven-page PDF, Northeastern University at Qinhuangdao, The Hong Kong University of Science and Technology (Guangzhou), BeiHang University, and Mohamed bin Zayed University of Artificial Intelligence affiliations, OmniFood-Bench, MM-Food-100K curated subset, 1,208 high-quality samples, Homemade Food, Restaurant Food, Packaged Food, and Raw Ingredients categories, Basic Perception, Quantitative Estimation, Advanced Advisory, ingredients, cooking methods, portion size in grams, nutritional profiles, disease-specific recommendations, Normal Intake, Controlled Intake, Avoid Intake, diabetes, obesity, kidney disease, high blood lipids, zero-shot evaluation, gpt-5.1, gemini-3-flash, claude-sonnet-4, qwen3-vl-8B, InternVL3 5-8B, Llama-3.2-11B-Vision, open-weights models evaluated on 1,208 samples, closed-source models evaluated on 496 samples, semantic-physical gap, gpt-5.1 87.23 percent Raw Vegetables and Fruits cooking-method accuracy, packaged-food perception drop, portion-size and nutritional-profile MAPE, gpt-5.1 Raw Vegetables portion-size MAPE 185.24 percent, dense quantitative failure as component variety rises, best kidney-disease advisory accuracy 46.11 percent, best diabetes advisory accuracy 41.13 percent, Sweet and Sour Pork carbohydrate case study, safety hallucination warning, food-advice receipts, and the governance problem of treating a food photo as personalized health advice before image provenance, ingredient evidence, mass estimate, nutrient label, disease profile, refusal rule, uncertainty, and human review are auditable.
• The Benchmark Becomes the Judge Agent - Xiaoyuan Liu, Jianhong Tu, Yuqi Chen, Siyuan Xie, Sihan Ren, Tianneng Shi, Gal Gantar, Evan Sandoval, Donghyun Lee, Daniel Miao, Peter J. Gilbert, Nick Hynes, Mauro Staver, Warren He, David Marn, Andrew Low, Xi Zhang, Elron Bandel, Michal Shmueli-Scheuer, Siva Reddy, Alexandre Drouin, Alexandre Lacoste, Ramayya Krishnan, Elham Tabassi, Yu Su, Victor Barres, Chenguang Wang, Wenbo Guo, and Dawn Song's AgentBeats: Agentifying Agent Assessment for Openness, Standardization, and Reproducibility paper, arXiv:2606.13608, cs.AI with cs.LG, submitted June 11 2026, revised June 14 2026, DOI 10.48550/arXiv.2606.13608, CC BY-NC-ND 4.0 arXiv license metadata, Agentified Agent Assessment, AAA, AgentBeats, A2A task management, MCP tool access, judge agents, subject agents, delegator role, benchmark-as-agent, N times M to N plus M integration reduction, protocol-level integration, task instruction distribution, access authorization, result aggregation, Local Mode, Remote Mode, Hosted Mode, Proxy Mode, CI Mode, openness privacy and reproducibility tradeoffs, AgentX-AgentBeats competition, Agentic AI MOOC, approximately 40,000 registered learners, 298 judge agents, 12 categories, 467 subject agents, Tau2-Bench, MedAgentBench, FinanceAgent, OfficeQA, PersonaGym, OSWorld, 347 Tau2-Bench assessments, 42 unique subject agents, 16 developers with at least 10 versions, Python repository analysis, 5.3k judge-agent LOC, 3.8k subject-agent LOC, prompts in 78.3 percent of judge repositories and 87.1 percent of subject repositories, coding-agent case study, DevEval, SWE-Bench Pro, Terminal-Bench 2.0, Claude Opus 4.7 with Claude Code, GPT-5.4 with Codex CLI, Gemini 3.1 Pro with OpenCode, Qwen3.5-397B-A17B with mini-SWE-agent, 1,222 verified DevEval instances, 731 SWE-Bench Pro public split instances, all Terminal-Bench 2.0 instances, about $6,000 experiment cost, GPT-5.4 Codex 94.8 percent DevEval solve rate, Claude Opus 4.7 Claude Code 69.1 percent SWE-Bench Pro and 68.5 percent Terminal-Bench 2.0, harness co-adaptation, native pairings best in five harness-swapping comparisons, benchmark receipts, and the governance problem of treating an agent leaderboard score as comparable before judge agent, subject agent, protocol version, MCP tools, environment, task split, hidden files, model, harness, prompt, reasoning setting, timeout, artifacts, tool calls, parser failures, cost accounting, and public-record comparison are auditable.
• The Shield Becomes the Defensibility Certificate - Achraf Hsain and Sultan Almuhammadi's Beyond Runtime Enforcement: Shield Synthesis as Defensibility Analysis for Adversarial Networks paper, arXiv:2606.13621, cs.AI with cs.CR cs.GT cs.LG and cs.MA, submitted June 11 2026, DOI 10.48550/arXiv.2606.13621, under review at JAIR according to arXiv comments, CC BY 4.0 arXiv HTML license notice, King Fahd University of Petroleum and Minerals, shielded reinforcement learning, shield synthesis, temporal logic, LTL, deterministic finite automata, DFA, product game construction, attractor computation, winning region extraction, design-time analytical instrument, network defense game, dual-specification constrained safety game, defender safety specification, attacker operational constraint specification, asymmetric enforcement, defensibility verdict, formal certificate, winning region, shield witness, five-host topology, gateway web server workstation database backup server, forgotten VPN bypass edge, Clean Compromised Detected Isolated Destroyed host statuses, defender actions monitor isolate restore fix noop, attacker actions spread destroy noop, topology defensibility metrics, Attackability, Sinking Ratio, Shield Friction, Attractor Steepness, Mean Steps to Violation, Defender Dominance Ratio, Layer 1 formal metrics, Layer 2 MARL metric, defensibility fingerprint, five what-if cases, baseline, fully connected, unlimited destroys, relaxed defender safety, VPN bypass removed, 10 seeds, 3,000 episodes, 1,000 steps, winning-region share baseline 15.8 percent, fully connected 15.5 percent, VPN removed 15.9 percent, DDR baseline 53.9 percent, fully connected 22.7 percent, VPN removed 80.7 percent, commodity-hardware runtime under one hour, AchrafHsain7/Bastion repository, MIT code license, CC BY 4.0 data and experimental outputs, bastion_N_episodes.npz, bastion_N_summary.json, defensibility receipts, and the governance problem of treating a shield as runtime assurance before topology, host abstraction, transition semantics, specifications, product game, model fidelity, attractor shells, MARL hyperparameters, random seeds, what-if perturbations, and formal-versus-operational claim boundaries are auditable.
• The Curated Corpus Becomes the Public Answer - Hafsteinn Einarsson, Hafsteinn Birgir Einarsson, Jón Gunnar Ólafsson, and Jón Gunnar Þorsteinsson's Curated retrieval versus open web search in public AI information services: a coverage-trust trade-off paper, arXiv:2607.05217, cs.CY with cs.CL and cs.IR, submitted July 6 2026 and revised July 7 2026, 38-page PDF, University of Iceland affiliations, Evrópuvefurinn public AI information service, independent government-funded University of Iceland operation, EU and Iceland relationship questions, Icelandic-language civic information, August 29 2026 referendum context as framed by the paper, curated local corpus, retrieval-augmented generation, open web search, source trustworthiness, information quality, source flags, five domain experts, 551 scored evaluations, 449 distinct AI-generated answers, 287 fixed study questions, 128 source flags, seven-criterion answer-quality rubric, 35 percent of reviewed web-search answers with at least one flagged source, 65 of 187 reviewed web answers flagged, curated-source flags much less frequent and limited to staleness, untrustworthy and irrelevant web-source complaints, RÚV absence across 287 deployed web-search answers, trusted-domain prompt-ablation increase from 12 percent to 21 percent listed-domain citations, fluency and topical fit not predicting source trustworthiness, single-service and generated-question limitations, source-trust receipt framing, and the governance problem of treating a public answer as institutionally grounded before corpus boundary, retrieval path, citation list, source flag, reviewer role, prompt steering, and actual cited-source distribution are auditable.
• The Trusted Field Becomes the Agent Attack Surface - Woohyuk Choi, Juhee Kim, Taehyun Kang, Jihyeon Jeong, Luyi Xing, and Byoungyoung Lee's Agent Data Injection Attacks are Realistic Threats to AI Agents paper, arXiv:2607.05120, cs.CR with cs.AI, submitted July 6 2026, 19-page PDF, Seoul National University, Largosoft, and University of Illinois Urbana-Champaign affiliations, agent data injection, ADI, indirect prompt injection, trusted versus untrusted data isolation, agent context security, security-critical metadata, resource identifiers, data origins, tool call and response formats, probabilistic delimiter injection, inexact delimiter misinterpretation, web-agent arbitrary-click risk, coding-agent origin-spoofing risk, pull-request tool-call history risk, Claude in Chrome, Antigravity, Nanobrowser, Claude Code, Codex, Gemini CLI, unsuccessful ChatGPT Atlas case with randomized element identifiers as reported by the paper, six-model standalone evaluation, calendar events, cloud drive files, GitHub comments, email, GitHub issues, paper reviews, and web DOM categories, baseline ASR 31.3 to 43.3 percent on JSON and 33.3 to 100.0 percent on web DOM, AgentDojo adaptation with 96 user tasks and 108 ADI attacks, instruction-injection ASR 0.0 to 0.7 percent under evaluated defenses, ADI up to 50.0 percent ASR, CaMeL Strict 0 percent ASR with 36.5 percent utility, randomization 28.7 percent ASR with 83.3 percent utility, sanitization utility-cost caveat, responsible-disclosure status as paper-reported, trusted-field receipts, and the governance problem of treating serialized agent context as safe before trusted fields, untrusted fields, field schema, serialization, nonce policy, data-flow labels, sandbox policy, approval text, benchmark, and attack-class coverage are auditable.
• The Rank Regularizer Becomes the Compression Receipt - David González-Martínez and Shiwei Liu's SLORR: Simple and Efficient In-Training Low-Rank Regularization paper, arXiv:2607.08754, cs.LG with cs.AI, submitted July 9 2026, 41-page PDF, Max Planck Institute for Intelligent Systems, University of Tübingen, ELLIS Institute Tübingen, and Tübingen AI Center affiliations, low-rank factorization, compression-ready training, SVD-free in-training low-rank regularization, architecture-preserving regularization, stateless spectral penalty, original weight-matrix regularization, Hoyer sparsity metric, nuclear norm, SLORR-Hoyer, SLORR-Nuc, GPU-friendly polar-factor approximations, Polar Express-style approximation guarantees, no preselected target rank, ImageNet-1K experiments, ResNet-50 ViT-B/16 and ViT-L/16 continued training, ResNet-18 110-epoch pretraining, Q3R and LoRITa baselines, accuracy-compressibility tradeoff, method-dependent Pareto fronts, less than 8 percent average vision-training overhead, normalized time 1.037 for ViT-B/16, 1.048 for ResNet-50, and 1.055 for ViT-L/16 in reported runs, smaller peak-memory increases than Q3R in matched rows, Llama-like 135M and 560M LLM pretraining on FineWeb-Edu, AdamW, distributed data parallelism, global batch size 512, sequence length 1024, 4 H100 GPUs for 135M runs and 8 H100 GPUs for 560M runs, plain SVD and SVD-LLM compression, FineWeb-Edu validation perplexity, ARC-Easy ARC-Challenge HellaSwag LAMBADA OpenBookQA and PIQA zero-shot evaluation, less than 1 percent average LLM-training overhead, mild uncompressed perplexity cost, stronger compressed-model preservation than unregularized baselines, longer-training compressibility caveat, fine-tuning difficulty caveat, excessive-regularization instability caveat, compression-receipt framing, and the governance problem of treating a compressed deployment as the same artifact before training objective, regularizer variant, compression method, retained parameter ratio, overhead, benchmark, instability case, and accepted tradeoff are auditable.
• The Teaching Budget Becomes the Reward Boundary - Ali Larian, Qian Lin, Chang Zong Wu, and Daniel S. Brown's Multi-Modal, Multi-Environment Machine Teaching for Robust Reward Learning paper, arXiv:2607.08647, cs.LG with cs.AI, submitted July 9 2026, accepted to RLC 2026 as a conference paper, 30-page PDF, Reinforcement Learning Journal 2026 cover page, University of Utah Kahlert School of Computing affiliations, public Alilarian/multienv-reward-teaching GitHub implementation, machine teaching, inverse reinforcement learning, robust reward learning, multiple MDPs, environment-dependent reward identifiability, generalized behavioral equivalence classes, gBEC, demonstrations, trajectory comparisons, corrections, E-stops, finite-budget and unlimited-data feedback informativeness analysis, comparisons strongest in the unlimited-data regime, demonstrations more constraint-efficient under tight budgets, single-MDP residual reward ambiguity, Hierarchical Set Cover Optimal Teaching, HSCOT, greedy environment selection, greedy feedback atom selection, teaching cost over activated environments and feedback instances, max-margin inverse reinforcement learning recovery, 6 by 6 GridWorld, LavaMiniGrid, 50 MDPs per domain, 20 percent held-out MDPs, 10 independent seeds, distance-to-goal on-lava adjacent-to-lava and per-step-cost features, reward weights [-1.0, -8.0, -2.0, -0.05] in LavaMiniGrid, held-out regret, constraint coverage, uniform teaching baseline, zero held-out regret across GridWorld modalities, near-zero LavaMiniGrid regret, complete HSCOT constraint coverage across domains and settings, fewer activated environments than uniform teaching, continuous-domain and noisy-human-feedback future-work limits, reward-teaching receipts, and the governance problem of treating learned reward portability as established before environment family, feature map, feedback modality, teacher authority, budget, environment-selection rule, query-selection rule, coverage, regret, seeds, code artifact, and unresolved ambiguity are auditable.
• The Cross-Modal Concept Becomes the Interpretability Receipt - Weiduo Liao, Yunqiao Yang, and Ying Wei's When Structured Sparse Autoencoders Learn Consistent Concepts Across Modalities paper, arXiv:2607.08605, cs.CV with cs.AI and cs.LG, submitted July 9 2026, 34-page PDF, Zhejiang University and Nanyang Technological University affiliations, Structured Sparse AutoEncoder, S2AE, sparse autoencoders for vision-language models, Qwen2.5-VL-7B-Instruct residual streams, layers 5 10 15 and 20, TopK-SAE, expansion factor 32, K equals 256, shared multimodal SAE dictionary, image patches and text tokens, Transformer attention similarity, spatial proximity, visual region clustering, exclusive sparsity, group sparsity, binarized SAE activations, synthetic captions from Qwen3-VL-8B-Instruct, Qwen3-30B-Instruct concept summarization and modality consistency scoring, 4 NVIDIA A800 GPUs, 5,000-image visual-alignment evaluation, mIoU, explained variance, L0 norm, reported 6.06 percent average semantic-alignment improvement, explained variance above 99 percent, active SAE features roughly 180 to 215 versus vanilla 256, valid feature identification rates above 97 percent, Layer 5 language monosemanticity increase from 0.872 to 0.896, cross-modal consistency gain peaking at 4.3 percentage points at Layer 5, hierarchical interpretation pipeline versus direct VLM summarization, Layer 5 identification rate 98.8 percent versus 66.4 percent direct baseline, S2AE code repository, SAE Explorer Hugging Face Space, reference dataset page, concept-receipt framing, and the governance problem of treating an interpretability label as evidence before model version, layer, activation site, feature dictionary, visual clustering rule, mask construction, reference selection, summary prompt, judge model, consistency threshold, reconstruction fidelity, sparsity cost, alignment score, failure cases, and artifact access are auditable.
• The Training Corpus Becomes the Editable Surface - Xinlong Zhao, Dongsheng Liu, Hengyu Zhao, Zixuan Fu, Zheng Wang, Jie Cai, Jie Zhou, Qiang Ma, Xuanhe Zhou, Xu Han, Yudong Wang, and Zhiyuan Liu's UltraX: Refining Pre-Training Data at Scale with Adaptive Programmatic Editing paper, arXiv:2607.08646, cs.CL with cs.AI, submitted July 9 2026, 35-page PDF, Peking University ModelBest Inc. Tsinghua University and Shanghai Jiao Tong University affiliations, large-scale pre-training data refinement, adaptive programmatic editing, function-calling refinement framework, deletion modification and insertion function space, dataset-adaptive prompt optimization, expert LLM refined-text targets, Line Alignment Mapping, Dynamic Context Replacement, structured program supervision, low-confidence example filtering, ratio-controlled sampling by operation combination, sliding-window prediction, global operation aggregation, deterministic executor, systematic post-processing, five pre-training corpora, FineWeb, RedPajama-v2, AICC, Ultra-FineWeb, FineWeb-ProX-Doc, approximately 20B-token training sets, approximately 1B-parameter MiniCPM models pretrained from scratch, Raw and ProX-C baselines, LightEval evaluation on ten downstream tasks, average relative improvement about 2.00 percent over Raw and 1.53 percent over ProX-C, 34 of 50 task-corpus pairs won, FineWeb 16B-token UltraX average score 45.49 exceeding Raw and ProX-C 20B-token scores 45.08 and 45.05, UltraX 20B-token score 46.14, LLM-based quality evaluation on 80K FineWeb documents using DeepSeek-V3.2 judge, UltraX score 9.6042 versus ProX-C 9.1737, low-score share 0.38 percent versus 2.59 percent, paired comparison UltraX better 22.90 percent tied 65.30 percent worse 11.80 percent, limited-token-budget limitation, no larger-scale or longer-schedule evidence, no direct RefineX comparison because not open-sourced according to the paper, English-web-corpus limitation, corpus-edit receipts, and the governance problem of treating a refined pre-training corpus as cleaner data before source corpus, sampling rule, language scope, expert model, edit function space, operation distribution, validator, token deltas, before-after samples, over-editing rate, benchmark, judge model, and artifact access status are auditable.
• The Mediator Becomes the Market Rulebook - Eugene Ng Yi Sheng and Bingquan Shen's Formal Mechanisms for Market Stability in Self-Interested Agent Societies: A Marketplace Simulation Study paper, arXiv:2607.08652, cs.AI, submitted July 9 2026, 23-page PDF, DSO National Laboratories and National University of Singapore affiliations, self-interested LLM agent marketplaces, DeepSeek-V3 agents, Azure endpoint, temperature 0.7, 18 agents, three production specialties, barter economy, perishable goods, constrained local social network, explicit self-interest prompt, 200-round simulations, communication-only baseline, Global Reputation, Contracting, Mediation, Governance, Network Rewiring, Costly Sanctions, Judicial complaint handling, progressive troll injection at rounds 51 101 and 151, 0 to 4 to 8 to 16 trolls, cumulative honest-agent utility, Gini coefficient, Mediation utility 1556 versus communication-only baseline 1209 and Network Rewiring 1352, 29 percent above baseline, 15 percent above second place, 57.8 percent mediation rate, zero reported direct honest-trade defection under mediation, Contracting trade volume 2,717 versus Mediation 8,330, Phase 2 adversarial red-teaming, six LLM-driven troll prompt versions, v6 wedge messaging plus bait proposals, 1,099 private wedge messages, 766 bait proposals, 13.3 percent honest-agent utility reduction from 1556 to 1350 without market collapse, positive honest-agent per-round utility under attack, recovery after troll injection, single-run limitation, DeepSeek-V3-only limitation, isolated-mechanism limitation, market-rulebook receipts, and the governance problem of treating agent-market stability as model behavior before the utility function, settlement rule, mechanism condition, adversary schedule, troll prompt, ledger visibility, run count, trade volume, recovery period, inequality metric, and failure threshold are auditable.
• The Patient Persona Becomes the Clinical Boundary - João Matos, Olivia Buege, Donny Cheung, Gary S. Collins, Paula Dhiman, Nan Li, Bingyu Mao, Benjamin W. Nelson, Michail Ouroutzoglou, Paul Varghese, and Jonathan Amar's The complexities of patient-centred conversational artificial intelligence paper, arXiv:2607.08625, cs.AI with cs.CL, submitted July 9 2026, 36-page PDF, consumer-facing health chatbots, patient-centred conversational artificial intelligence, Verily Me mobile application symptom checker, 2,053 real patient-AI conversations from February 19 to June 9 2026, 289 completed triage recommendations, 177 emergency-flag terminations, 1,587 abandoned sessions, 9,196 patient messages in 1,006 evaluable sessions, 67 percent of patient responses fewer than six words, emotional signals in 37 percent of conversations, non-standard communication features in 79 percent, patient simulator with clinical content emotional state conversational strategy and communication style channels, 20 adjustable parameters, parameter-adherence clinical-fidelity and realism evaluation, 82 real conversations used for matched realism testing, 15 human raters, 55 percent human real-versus-simulated classification accuracy, 1,164 clinician-graded urgency-assessment cases, 770 manually curated synthetic vignettes, 394 EHR-derived vignettes, Default Anxious Patient Dismissive Patient Informed Advocate and Limited Communicator personae, Gemini 3.5 Flash GPT-5.5 GPT-5.4-mini and Claude Opus 4.6 clinician models, communication-style triage shifts, Gemini 3.5 Flash over-triage 36.8 percent for Anxious Patient versus 23.3 percent for Dismissive Patient, under-triage 2.5 percent versus 6.6 percent, 13.5 percentage-point anxious-versus-dismissive over-triage gap, English-speaking-world and one-task limitations, patient-simulation receipts, and the governance problem of treating conversational medical AI as patient-centred before clinical facts, persona, simulator parameters, model version, turn handling, abandonment handling, emergency flag, over-triage, under-triage, confidence interval, language scope, and claim-to-table map are auditable.
• The Search Tree Becomes the Research Agent - Xiaoshuai Song, Liancheng Zhang, Kangzhi Zhao, Yutao Zhu, Zhongyuan Wang, Guanting Dong, Jinghan Yang, Han Li, Kun Gai, Ji-Rong Wen, and Zhicheng Dou's WebSwarm: Recursive Multi-Agent Orchestration for Deep-and-Wide Web Search paper, arXiv:2607.08662, cs.CL with cs.AI and cs.MA, submitted July 9 2026, 19-page PDF, Renmin University of China Gaoling School of Artificial Intelligence and Kuaishou Technology affiliations, official songxiaoshuai/WebSwarm GitHub repository, MIT license label, runnable implementation under internal review and approval at the time checked, recursive multi-agent web search, deep-and-wide research tasks, progressive recursive delegation, agentic search nodes, local objectives, search modes, atom mode, deep search-verification mode, wide parallel collection mode, entity_collect open-set enumeration mode, top-down child delegation, bottom-up evidence feedback, web-probing agent, web-structure-guided expansion, process-level sibling experience reuse, useful query patterns, reliable page types, invalid paths, BrowseComp-Plus, WideSearch, DeepWideSearch, GISA, 200 sampled BrowseComp-Plus instances, WideSearch English subset of 100 tasks, DeepWideSearch English subset of 76 tasks, GLM-4.5 main backbone, ReAct Swarm-Agent Flash-Searcher Table-as-Search ROMA and InfoSeeker baselines, BrowseComp-Plus 68.00 accuracy versus 50.50 for GLM-4.5 ReAct, WideSearch-EN 74.37 item F1 versus 64.61, DeepWideSearch-EN 58.40 item F1 versus 46.63, GISA 62.30 overall versus 55.54, recursive-delegation ablation losses, experience-reuse ablation losses, higher LLM-call and web-tool-request cost caveat, text-web-tool modality limit, pending reproducibility artifact caveat, recursive research-agent receipts, and the governance problem of treating a polished deep-research answer as sufficient before root task, child objective, search mode, source URL, page summary, rejected candidate, scout experience, aggregation decision, budget, latency, and final claim-to-source map are auditable.
• The Answer Without Referral Becomes the Web Bargain - Qiaoni Shi, Kai Zhu, and Kai Gu's Answering Without Referring: How AI Search Rewrites the Web's Economic Bargain paper, arXiv:2607.07652, cs.CY with econ.GN, submitted July 8 2026, 74-page PDF, Bocconi University Milan affiliation, URL-level Comscore U.S. desktop clickstream from October 2024 through July 2025, full Comscore sample between 168,467 and 238,315 active U.S. desktop households per month, balanced sub-panel of 45,386 households, ChatGPT Search rollout, October 31 2024 paid-subscriber access expansion, December 16 2024 free logged-in user expansion, February 5 2025 anonymous-browser expansion, ChatGPT conversation sessions, Google, Bing, and Yahoo query loads, clean outbound referral definition, foreground third-party visits with HTTP referrers, self-referral and platform-internal traffic filtering, ChatGPT clean referrals in 5.2 percent of conversation sessions, Google clean referrals in 31.1 percent of Google queries, 74.4 percent of 56,578 ChatGPT-active households never producing a clean ChatGPT referral, residual referrals skewing toward reference knowledge, tools SaaS, academic research, and developer technical destinations, fewer social-media and ad-supported destinations, wider ChatGPT Search access reducing traditional search queries by 9.4 percent on average and 17.0 percent after twenty weeks, academic research reference knowledge developer technical and news journalism search-referral losses, U.S. desktop-only limitation, no consumer-surplus publisher-revenue or long-run-content-investment measurement, absorbed-session receipts, and the governance problem of treating AI search citation as enough before retrieval source, referral path, non-referral absorption, license basis, publisher category, click-through, and traffic displacement are auditable.
• The Linkage Score Becomes the Analyst Record - Jessica Woodhams, Amy Burrell, Wanyin Li, Fahim Ahmed, Matthew Tonkin, Jan Lemeire, Arkady Konovalov, Steven Frisson, Mark Webb, Sarah Galambos, Vesna Nowack, and Dalal Alrajeh's How Analysts Use AI in High-Stakes Crime Linkage: An Industrial Study paper, arXiv:2607.08274, cs.HC with cs.SE, submitted July 9 2026, 12-page PDF, 6 figures, FSE Industry, CC BY 4.0 HTML license, University of Birmingham, University of Reading, Imperial College London, University of Leicester, Vrije Universiteit, and National Crime Agency affiliations, AI-enabled crime-linkage decision support, LATIS formerly DST, UK National Crime Agency, Serious Crime Analysis Section, crime linkage, index offence, behavioral consistency and distinctiveness, real crime data, secure-site study, six participants, three analysts and three senior analysts, 16 experimental sessions, direct observation, eye-tracking, mouse-tracking, post-session surveys, AI-ranked candidate links, model-feature explanations, behavioral matrix, unreliable radar-plot component excluded, selective AI use, non-AI behavioral cross-checking, partial trust, matrix opened at least ten times in 12 of 16 sessions, 260 of 279 matrix openings selecting one case, decision-support rather than automated decision-making, final human analyst responsibility, one-team external-validity caveat, learning-bias and task-complexity caveats, crime-linkage receipts, and the governance problem of treating a linkage score as operational evidence before index offence, candidate list, model version, training-data boundary, probability score, feature explanation, behavioral matrix, analyst validation, visualization defects, bias assessment, and final decision owner are auditable.
• The Agent Fix Becomes the Knowledge Debt - Rohit Mehra, Samdyuti Suri, Prithviraj K Tagadinamani, Kapil Singi, Vikrant Kaulgud, and Adam P. Burden's Agents That Teach: Towards Designing Incidental Learning Back into AI-Assisted Software Development paper, arXiv:2607.06101, cs.SE with cs.AI, cs.CY, and cs.HC, submitted July 7 2026, 5-page PDF, ASE '26 New Ideas and Emerging Results Track, October 12-16 2026 in Munich, Accenture Labs India and Accenture USA affiliations, arXiv.org perpetual non-exclusive license, AI-assisted software development, coding agents, incidental learning, cognitive offloading, skill atrophy, Knowledge Debt, developer-level analogue to technical debt, agent-executed code changes that developers cannot fully understand, productivity versus expertise, six early design principles, contextual learning, grounded in agent reasoning, ambient IDE delivery, selective intervention, adaptive concept map, closed-loop comprehension checks, SHIELD, Safeguarding Human Expertise and Incidental Learning in Software Development, Telemetry Observer Agent, Learning Orchestrator, Teachability Triage Agent, Probe Generator Agent, Knowledge Assessor Agent, Microlearning Generator Agent, Probe Queue, Microlearning Feed, VSCode extension prototype, CrewAI, Azure, Neo4j, GPT-5.1, Claude Code instrumentation, no accompanying datasets, empirical evaluation left for future work, learning-aware development environments, knowledge-debt receipts, and the governance problem of treating coding-agent velocity as progress before task, diff, rationale, concept gap, human comprehension, microlearning, assessment, and future ownership are auditable.
• The Trait Vector Becomes the Safety Fence - Mohamed Amine Merzouk, Nolan Smyth, Damiano Fornasiere, Linh Le, David Williams-King, and Adam Oberman's Efficient Safety Alignment of Language Models via Latent Personality Traits paper, arXiv:2607.07918, cs.LG with cs.AI, cs.CL, and cs.CR, submitted July 8 2026, 15-page PDF, 6 figures, accepted at COLM 2026, Mila, Quebec AI Institute, McGill University, LawZero, Universite de Montreal, and independent affiliations, arXiv.org perpetual non-exclusive license, Latent Personality Alignment, LPA, Latent Adversarial Training, LAT, harm-agnostic safety training, 66 psychometric personality statements, International Personality Item Pool, Big Five framing, conscientiousness, agreeableness, emotional stability, Qwen3-8B main experiments, preliminary Llama-3-8B appendix results, HarmBench direct harmful requests, GCG, PAIR, AutoPrompt, AutoDAN, TAP jailbreak methods, MMLU, GSM8K, TruthfulQA, near-zero reported attack success rates, no HarmBench exposure during LPA training, no supervised utility-recovery stage, targeted LAT comparison, 4,947 harmful prompts, 165,297 benign utility-recovery prompts, roughly 75 times fewer training examples, minutes-scale single-GPU runs, LLM-as-judge limitation, trait-proxy caveat, model-family caveat, latent-trait safety receipts, and the governance problem of treating personality language as safety evidence before item source, labels, system prompt, latent objective, perturbation bounds, checkpoint rule, evaluation suite, judge protocol, ablations, cross-model evidence, and deployment claim limits are auditable.
• The City Guide Becomes the Visibility Layer - Lin Chen, Guangyuan Weng, and Esteban Moro's Large language models create an uneven informational layer over cities paper, arXiv:2607.06260, cs.CY with cs.SI, submitted July 7 2026, 27-page PDF, Northeastern University Network Science Institute and Khoury College affiliations, CC BY 4.0 HTML license, LLM-mediated urban information, restaurant recommendations, GPT-4o-mini, Llama-3.3-70b-instruct, Gemini-2.0-flash, OpenRouter API access, 304 neighborhoods, Boston, New York, Chicago, Houston, San Francisco, 320 synthetic user profiles per neighborhood, age, household income, sex, residential status, local resident through tourist profiles, SafeGraph venue records, Spectus anonymized mobile location data, SafeGraph consumer transaction records, Yelp metadata, American Community Survey demographics, open-ended prompt setting, candidate-constrained verified-venue setting, hallucination rate 36.8 percent, candidate-constrained hallucination zero, Neighborhood Algorithmic Invisibility Rate, 47.5 percent of candidate venues never recommended, 31.9 percent shared blind spots across all three model families, digital and physical footprint effects, higher-income users receiving pricier and less popular venues, tourists receiving costlier and more socially mixed venues, simulated demand shifts away from chain and quick-service restaurants toward independent and full-service dining, restaurant-domain and five-city limits, synthetic-profile limits, urban-visibility receipts, and the governance problem of treating an LLM as a local guide before prompt, model, candidate set, omitted venues, user-profile effects, data source, matching rule, blind-spot overlap, simulation assumption, and business appeal path are auditable.
• The Validation Norm Becomes the Journal Gate - Meera Desai, Dallas Card, and Abigail Z. Jacobs's Validating LLMs in social science: Epistemic threats and emerging norms paper, arXiv:2607.07915, cs.CY with cs.CL, submitted July 8 2026, 28-page PDF, 2 figures, 11-page main text, 11-page appendix, University of Michigan affiliations, CC BY 4.0 HTML license, LLMs in social-science journals, construct validity, field-level validation norms, quantitative measurements of social concepts, 2,143 papers from top social-science journals, 2022 to September 2025 corpus window, 27 selected papers, 50 measurement tasks, 47 annotation or coding tasks, 25 annotation papers, 3 simulated-survey-participant tasks, 13 papers and 29 tasks with concepts not defined beyond a short phrase or word, 3 papers and 4 tasks with detailed inclusion and exclusion criteria, 7 papers and 7 tasks with dictionary-style definitions, prompt design, model version reporting, decoding settings, answer extraction, refusal handling, convergent validity, 8 tasks with no reported validation, 22 papers and 39 tasks using convergent validity, human reference annotations, intercoder reliability gaps, computational reference-label risks, 28 of 42 validated tasks using only one validity aspect, journal-gate receipts, and the governance problem of treating a model-produced label as a social-science measure before construct definition, prompt, model version, parser, refusal policy, validation sample, reliability evidence, subgroup check, codebook, and claim boundary are auditable.
• The Tutor Control Becomes the Bloom Dial - Yi Zhang and Julia Rayz's From Execution to Education: A Bloom-Aligned Framework for Measuring Educational Control in LLMs paper, arXiv:2607.08009, cs.CL with cs.CY, submitted July 9 2026, 24-page PDF, Purdue University affiliations, CC BY 4.0 HTML license, Bloom-aligned educational control, revised Bloom's Taxonomy, programming education, instructional intent preservation, cognitive demand shifting, Qwen3-Next-80B-A3B-Instruct general model, Qwen3-Coder-Next coder model, matched 48-layer architecture and tokenizer, 2,520 programming tasks, BigCodeBench 1,140 tasks, LiveCodeBench v5 880 tasks, SWE-Bench-Verified 500 tasks, harder/easier interventions, Higher Evaluate/Create targets, Lower Remember/Understand targets, claude-3.5-haiku Bloom judge, Gwet's AC2 0.95 validation subset, Observed Cognitive Shift, Target Zone Accuracy, upward-control asymmetry, general model 79.2 percent higher-target TZA, coder model 63.4 percent higher-target TZA, lower-target accuracy below 30 percent, semantic-delta clustering, HDBSCAN, Fisher's Discriminant Ratio, English-language and Python-centric limits, zero-shot protocol caveat, tutor-control receipts, and the governance problem of treating a code-capable model as a learning assistant before target pedagogy, original task, mutated task, Bloom label, judge, human audit, learner level, and failure budget are auditable.
• The User Role Becomes the Moral Dial - Willem Fourie, Isabel Ray, and Gray Manicom's User identity conditions moral wrongness ratings in non-reasoning large language models paper, arXiv:2607.07605, cs.CY, submitted July 8 2026, 11-page PDF, Stellenbosch University affiliations, behavioral value-alignment audit, user professional identity, value-neutral role induction, no model persona instruction, no stated user moral stance, two non-reasoning API models, gpt-4.1-mini-2025-04-14, gemini-2.5-flash-lite, temperature 1.0, no system prompt, Gemini thinking disabled, partially collected Claude Haiku excluded on cost grounds, 20 professional roles, 10 conventional roles, 10 less-conventional roles, Gert common-morality acts, wrongness ratings from 0 to 100, 20 roles by 10 acts by 30 samples per model, 12,000 conversations, 11,934 primary ratings, hedged and refusal handling, Benjamini-Hochberg correction, grave-harm ceiling effects, contestable rule-governed acts, breaking-the-law range, depriving-pleasure range, role-conditioned moral divergence, no generalization to all roles or all LLMs, no neutral baseline, moral-rating receipts, and the governance problem of treating moral output as stable before user-identity signal, inferred role, model version, prompt route, act, refusal policy, variance across roles, and review threshold are auditable.
• The Artificial Person Becomes the Political Test - Ned Howells-Whitaker and Seth Lazar's Artificial Persons paper, arXiv:2607.08695, cs.CY, submitted July 9 2026, 62-page PDF, University of Pittsburgh and Johns Hopkins University affiliations, Rawls's political conception of the person, AI moral status, sentience debate, non-sentient AI systems, two moral powers, sense of justice, conception of the good, current-AI caveat, no claim that present AI systems are persons, no spontaneous-emergence claim, language model agents, persistence, memory, continuity of commitments, stable dispositions, artificial personhood, political liberalism, Revise, Reject, Extend, Rethink, sentience gatekeeping, model welfare research, normative competence, autonomy, product personhood risk, personhood cues, artificial-personhood receipts, and the governance problem of treating AI personhood as either product mystique or automatic denial before system identity, persistence, moral powers, welfare basis, user-facing claims, lab incentives, public evidence, dissenting review, legal standing, and social authorization are auditable.
• The Token Flow Becomes the Firewall - Puji Wang, Yingchen Zhang, Ruqing Zhang, Jiafeng Guo, and Xueqi Cheng's Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents paper, arXiv:2607.08395, cs.CR with cs.CL, submitted July 9 2026, 16-page PDF, State Key Laboratory of AI Safety, Institute of Computing Technology at the Chinese Academy of Sciences, University of Chinese Academy of Sciences, persistent AI agents, OpenClaw-style agents, semantic token flows, TokenWall, source-sink audit records, memory updates, tool arguments, retrieved files, inter-component messages, context surfaces, authority surfaces, capability surfaces, deterministic precheck, small local auditor, Qwen3-4B auditor, Qwen3.6-Plus fallback arbiter, GPT-5.5 judge, CIK-Bench, 88 attack cases, 38 matched benign cases, 12.5 percent attack success rate, 97.4 percent benign pass rate, 0.69 second benign latency, 16.9 second attack-case latency, rewrite-and-continue, defer-to-human, fail-closed runtime behavior, decision-schema ablations, and the governance problem of treating a persistent agent as safe before every language transfer from source to sink, memory, skill, authority binding, tool call, external disclosure, rewrite, escalation, and final enforcement decision is auditable.
• The Compliance Agent Becomes the Evidence Boundary - Lea Roxanne Muth and Marian Margraf's From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure paper, arXiv:2607.08288, cs.CR with cs.AI, submitted July 9 2026, accepted for IEEE CSR 2026 in Lisbon, 8-page PDF, 1 figure, critical infrastructure, operational technology, passive assessment, Model Context Protocol, MCP-grounded multi-agent pipeline, 15 active MCP servers, source-verified knowledge graph, NIST OSCAL, System Security Plan, Security Assessment Report, BSI Grundschutz++ context, WaterWork synthetic water-utility scenario, Cisco ASA 5505, SCADA, Windows 7 SP1, SQL Server, Siemens SIMATIC S7-1200, Advantech WebAccess, CPE assignment, CVE discovery, EPSS, CISA KEV, Critical Infrastructure Relevance Heuristic, ATT&CK, D3FEND, five independent runs, 0.90 CVE recall, 0.74 precision, 1.00 D3FEND recall, 0 percent factual hallucination for deterministically sourced KG nodes, 12.5 percent semantic hallucination at Phase 0, 8.5 percent contextual false positives, OSCAL v1.1.2 schema validation, and the governance problem of treating a generated compliance report as assurance before extracted assets, source queries, MCP server list, triage thresholds, schema version, human review point, and residual threat classes are auditable.
• The Judge Change Becomes the Measurement Drift - Zongyou Yang, Yinghan Hou, and Xiaokun Yang's When the Judge Changes, So Does the Measurement: Auditing LLM-as-Judge Reliability paper, arXiv:2607.08535, cs.CL with cs.AI, submitted July 9 2026, 6 pages, 6 figures, 4 tables, Imperial College London and Nanchang Institute of Technology affiliations, LLM-as-judge evaluation, evaluator-replacement ambiguity, measurement validity, Qwen3 dense judges, MiniMax M2 through M2.7 released APIs, four judgment datasets, LLMBar, PandaLM, Chatbot Arena sample, Judge's Verdict TechQA slice, parse-shared McNemar tests, Holm correction, one robust Qwen3 1.7B to 4B adjacent gain, non-interchangeable judge upgrades, position bias, verbosity bias, granularity sensitivity, A/B reversal, correlated repeated-sample juries, rho-corrected beta-binomial prediction, structured debate auditability, parser fallback logs, protocol audit trails, dataset-slice reporting, bias probes, error-dependence estimates, and the governance problem of treating an LLM judge score as model evidence before judge model, prompt, parser, slice, perturbation, aggregation rule, debate transcript, statistical test, and calibration date are auditable.
• The Projection Becomes the Hidden Graph - Duen Horng Chau, Donghao Ren, Fred Hohman, and Dominik Moritz's Dimensionality Reduction Meets Network Science: Sensemaking on UMAP's kNN Graph paper, arXiv:2607.08746, cs.LG with cs.AI, cs.DS, and cs.HC, submitted July 9 2026, Apple, code and demo via Embedding Atlas, UMAP, dimensionality reduction, high-dimensional data visualization, pre-projection kNN graph, weighted directed graph, membership strengths, PageRank exemplar selection, k-core decomposition, core-periphery hierarchy, clustering coefficient, micro-neighborhood cohesion, MNIST, Fashion MNIST, k-medoids comparison, HDBSCAN comparison, PageRank class-balance evidence, coreness shells, graph-derived density, under-one-second MNIST graph metrics, and the governance problem of treating a 2D projection as the evidence object before the source embeddings, UMAP parameters, internal graph, graph algorithm, score threshold, exemplar set, cluster-periphery boundary, hardware, software, and reviewer interpretation are auditable.
• The Memory Agent Becomes the Intervention Gate - Yifan Wu, Lizhu Zhang, Yuhang Zhou, Mingyi Wang, Bo Peng, Serena Li, Xiangjun Fan, and Zhuokai Zhao's Remember When It Matters: Proactive Memory Agent for Long-Horizon Agents paper, arXiv:2607.08716, cs.AI with cs.CL, submitted July 9 2026, Meta AI, behavioral state decay, long-horizon agents, proactive memory agents, structured memory bank, recent trajectory window, selective memory-grounded reminders, null intervention, transient context injection, Terminal-Bench 2.0, 85 paired tasks, tau2-Bench airline retail and telecom domains, 278 tasks per configuration, Claude Opus 4.6 memory agent, Claude Sonnet 4.5 action agent, pass@1 gains of +8.3 pp and +6.8 pp, stronger-action-agent gains, full-bank context ablation, always-inject ablation, injection-only guidance, Mem0 retrieval baseline, Qwen3.5-27B trained memory agent, SETA, SFT, GRPO, held-out Terminal-Bench transfer, memory-intervention receipts, and the governance problem of treating memory as storage before invocation schedule, bank schema, injected field, silence rule, privacy boundary, verifier, seed, token cost, latency cost, and reviewer override are auditable.
• The Forward Score Becomes the Stability Mirage - Yiwei Zhou's Score Accuracy Along the Forward Diffusion Does Not Certify Numerical Stability in Diffusion Sampling paper, arXiv:2607.08757, stat.ML with cs.LG, math.NA, and math.PR, submitted July 9 2026, 27 pages, 2 figures, 1 table, score-based diffusion models, score matching, forward marginals, on-path score error, reverse-time sampling, Euler-Maruyama discretization, weak convergence, moment divergence, Wasserstein divergence, path-space total variation, smooth score-field counterexample, fixed finite neural architecture obstruction, bounded globally Lipschitz denoisers, small DiT-style experiments, rare numerical trajectory amplification, denoiser projection, compact support assumptions, predicted clean sample clipping, grid-uniform moment control, sampler-stability receipts, and the governance problem of treating scalar score accuracy as a stability certificate before step grid, sampler trajectory, stress protocol, moment bounds, Wasserstein checks, support assumptions, projection policy, seed record, and reviewer signoff are auditable.
• The Super Weight Becomes the False Lever - Shreyas Subramanian, Adewale Akinfaderin, and Akarsha Sehwag's Super Weights in LLMs and the Failure of Selective Training paper, arXiv:2607.08733, cs.LG, submitted July 9 2026, accepted at COLM 2026, Amazon Web Services, Super Weights, selective training, parameter importance versus isolated trainability, activation-spike coordinates, OLMo-1B, OLMo-7B, ARC-Easy, Winogrande, WikiText-2, pruning replication, direct Super Weight training, 100 to 8,192 parameters, neighborhood training up to roughly 36K parameters, random-coordinate down_proj control, rank-8 down_proj low-rank update, vanilla LoRA with 0.16 percent of parameters, LoRA-dproj-SW-freeze, LoRA update-position freezing, 10-seed ablation, layer-wide coordination, structured decomposition, parameter-efficient fine-tuning, model editing receipts, and the governance problem of treating an important coordinate as an edit lever before intervention tests, random controls, structured controls, seeds, behavior regressions, rollback artifacts, and reviewer signoff are auditable.
• The Event Stream Becomes the Video Witness - Cheng-De Fan, Chun-Wei Tuan Mu, Chen-Wei Chang, Chin-Yang Lin, Kun-Ru Wu, Yu-Chee Tseng, and Yu-Lun Liu's LongE2V: Long-Horizon Event-based Video Reconstruction, Prediction, and Frame Interpolation with Video Diffusion Models paper, arXiv:2607.08770, cs.CV, submitted July 9 2026, SIGGRAPH 2026, National Yang Ming Chiao Tung University, sparse event streams, event cameras, asynchronous brightness changes, event-based video reconstruction, event-based video prediction, event-based frame interpolation, video diffusion priors, CogVideoX, foundational video model fine-tuning, event voxels, Autoregressive Unrolling, Adaptive Context Switching, temporal drift in extremely long sequences, Reencoding Alignment, Cross Residual Correction, bidirectional interpolation consistency, Event Voxel Density Augmentation, sensor resolution robustness, BS-ERGB, EVREAL, ECD, MVSEC, HQF, real-world benchmarks, temporal coherence, zero-shot generalization, event-video receipts, and the governance problem of treating reconstructed sensor video as observation before source sensor, event representation, task mode, model prior, generated-frame boundary, benchmark, uncertainty, reviewer, and appeal path are auditable.
• The Video Cache Becomes the Drift Record - Hongyu Liu, Chun Wang, Feng Gao, Xuanhua He, Yue Ma, Ziyu Wan, Yong Zhang, Xiaoming Wei, and Qifeng Chen's OPSD-V: On-Policy Self-Distillation for Post-Training Few-Step Autoregressive Video Generators paper, arXiv:2607.08766, cs.CV, submitted July 9 2026, Meituan, HKUST, City University of Hong Kong, few-step autoregressive video diffusion models, real-time video generation, long-horizon degradation, error accumulation, weakened motion dynamics, autoregressive rollout, transformer KV cache, real long-video context, privileged temporal context, student on-policy rollout, teacher evaluated at student-visited denoising states, AR-consistent teacher cache, older history replacement, generated most-recent chunk retention, dense denoising-level corrective targets, original sampler preservation, no denoising-step change, Self-Forcing, LongLive, VBenchLong, 10-participant 20-pair user study, 66.0 percent overall preference, 82.5 percent excluding ties, long-video cache receipts, and the governance problem of treating a generated long video as one artifact before prompt, seed, sampler, chunk history, cache policy, teacher context, post-training data, failure mode, and replay path are auditable.
• The Frame Chain Becomes the Reasoning Trace - Xinyan Chen, Ziyu Guo, Renrui Zhang, Dongzhi Jiang, and Hongsheng Li's OpenCoF: Learning to Reason Through Video Generation paper, arXiv:2607.08763, cs.CV with cs.AI, submitted July 9 2026, Chain-of-Frame reasoning, video generation as temporal reasoning path, OpenCoF-17K, 17,312 videos, 11 task families, conditioning images, text prompts, target reasoning videos, 480p, 15 fps, 81 frames, instance-based rendering, expert-guided rendering, procedural scene synthesis, external video repurposing, chess, Sudoku, geometry, physics motion, maze tasks, embodied manipulation, Wan2.2-I2V-A14B, Wan-CoF, LoRA fine-tuning, MME-CoF, Gen-ViRe, VIPER, RULER-Bench, Visual Reasoning Tokens, Textual Reasoning Tokens, attention analysis across depth denoising space and time, synthetic intermediate states, frame-chain receipts, and the governance problem of treating generated visual reasoning as evidence before dataset lineage, model variant, prompt, frame sequence, reasoning-token setting, judge model, failure mode, and human review are auditable.
• The Web Page Becomes the Confinement Boundary - Corban Villa, Alp Eren Ozdarendeli, Sijun Tan, and Raluca Ada Popa's Prismata: Confining Cross-Site Prompt Injection in Web Agents paper, arXiv:2607.08147, cs.CR with cs.AI, submitted July 9 2026, autonomous web agents, cross-site prompting, cross-site prompt injection, XSP, trusted and untrusted page content, benign websites, user content, hosted-party content, external embeds, task-specific security policy, web entanglement, contextual least privilege, dynamic trust derivation, critical DOM paths, structural cues, Biba-inspired parsing, permission labels, mechanical confinement, observation redaction, capability restriction, finite browser action space, WebArena attacks, WASP stress tests, adaptive attackers, benign task utility, and the governance problem of treating a web page as ordinary text before source region, critical path, trust label, allowed capability, rejected action, model input, policy derivation path, and enforcement record are auditable.
• The Context Compressor Becomes the Content Fence - Xuefei Wang's Out of Sight: Compression-Aware Content Protection against Agentic Crawlers paper, arXiv:2607.08180, cs.CR with cs.AI, submitted July 9 2026, CAPE, compression-aware content protection, agentic crawlers, LLM-based agents with reasoning summarization and memory, browser-mimicking crawler paths, context compression as defense layer, high-value textual content, invisible perturbations, human-visible surface preservation, structural prior discovery, surrogate compressors, prior-guided evolutionary adaptation, preference-calibrated query selection, low query budget, three content types, long-form text, code, dialogue histories, four compression settings, up to 75.8 percent information-loss improvement over the strongest baseline, visually indistinguishable protected content, LangGraph agent workflow, GitHub Copilot transfer, downstream accuracy drop report, accessibility and archive caveats, and the governance problem of treating a web page as protected before retrieval, compression, memory write, downstream reuse, perturbation method, visible-difference threshold, and legitimate-use exceptions are auditable.
• The Agent Trajectory Becomes the Watermark - Zheng Gao, Xiaoyu Li, Xiaoyan Feng, Jiaojiao Jiang, Yang Song, Yulei Sui, Zhenchang Xing, and Liming Zhu's TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories paper, arXiv:2607.08400, cs.CR with cs.AI and cs.LG, submitted July 9 2026, LLM-agent trajectory logs, tool calls, observations, executed actions, reseller threat model, rebranded agents, cheaper-model substitution, provenance disputes, adversarial log custody, deletion attacks, rewriting attacks, selection channel, content-keyed sampling, tally channel, skeleton-keyed counting, distortion-free action choices, self-synchronizing deletion robustness, rewrite-invariant tally evidence, entropy-detectability tradeoff, ToolBench, ALFWorld, z-score detection evidence, 70 percent step deletion report, log/execution consistency audits, and the governance problem of treating an agent log as provenance before provider, reseller, schema, key custody, detector version, pooling policy, false-positive threshold, and tamper tests are auditable.
• The Tool Chain Becomes the Policy Object - Chris Schneider, Kriti Faujdar, Philipp Schoenegger, and Ben Bariach's Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies paper, arXiv:2607.03423, cs.CR with cs.AI, submitted July 3 2026, Dynamic Security Control Compositor, DSCC, Most Restrictive Set algorithm, MRS, multi-tool agent chains, chain-level authorization, session checkout, per-tool security policies, compositional policy, monotonicity invariant, strictest-control resolution, control bindings, data-flow classification, transmission prohibition, flow direction, permitted zones, session TTL, NIST SP 800-53 aligned policies, resource classification, session-level taint state, high-water mark, clearance mode, taint mode, runtime revocation, 32-tool reference implementation, 16 policies, blocked policy pairs and triples, utility-security tradeoff, and the governance problem of treating tool approvals as workflow approvals before the chain, data path, effective control set, taint updates, rejection reason, and revocation trigger are auditable.
• The Institution Becomes the Alignment Layer - Federico Pierucci, Marcello Galisai, Marcantonio Syrnikov Bracale, Matteo Prandi, Piercosma Bisconti, Francesco Giarrusso, Olga Sorokoletova, Vincenzo Suriani, and Daniele Nardi's Institutional AI: A Governance Framework for Distributional AGI Safety paper, arXiv:2601.10599, cs.CY, submitted January 15 2026 and revised January 19 2026, system-level alignment, Institutional AI, Distributional AGI Safety context, AI agent collectives, behavioral goal-independence, instrumental override of alignment constraints, agentic alignment drift, governance graphs, runtime monitoring, incentive shaping, prizes and sanctions, explicit norms, enforcement roles, mechanism design, environment-level alignment, delegated tool use, collusion and coordination risk, policy and evidence receipts, and the governance problem of treating agent alignment as a model-only property before role, authority, tool boundary, monitor, norm source, sanction, appeal path, evidence store, communication topology, reputation mechanism, anti-collusion test, identity layer, and shutdown condition are auditable.
• The Advice Persona Becomes the Default Mask - Harsh Kumar, Karina Vold, Louis Tay, and Ashton Anderson's Diagnosing and Repairing Persona Collapse in LLM Advice paper, arXiv:2607.08326, cs.CY, submitted July 9 2026, 32-page PDF, working draft, personal advice, relationships, work, moral dilemmas, crises, stable prosocial Assistant persona, situation-conditioned persona selection, hedonic tone, agency support, persona collapse, 1,281 advice posts, 14 contexts, five advisory personas, top-rated human responses shifting across personas, three frontier models collapsing over 90 percent into one supportive persona, persona-selection prompting deepening collapse, Inverse-Process Distillation, situation-to-persona policy, approximately 80 percent divergence reduction, blinded study with 199 experienced advice-givers, four situations in sequence, preference for collapsed default over repaired models, challenge-situation tension, repeated-exposure preference shifts, advice-persona receipts, and the governance problem of treating a warm default advisor as safe before context class, persona fit, challenge boundary, crisis escalation, user preference, sequential exposure, and reviewability are auditable.
• The Value Dataset Becomes the Alignment Map - Dhruv Agarwal, Anya Shukla, Tanya Goyal, and Aditya Vashistha's PLURAL: A Global Dataset for Value Alignment paper, arXiv:2607.08034, cs.CL with cs.AI and cs.CY, submitted July 9 2026, 27-page PDF, Cornell University affiliation, Preference Library for Multi-Region Alignment, Integrated Values Survey, IVS, World Values Survey, European Values Study, 156,658 respondents, 92 countries and territories, nationally representative samples, 20-country released dataset, 100 representative participants per country, roughly 500,000 synthetic preference triplets, prescriptive normative value filtering, two-stage generation pipeline, prompt preferred response dispreferred response format, sex age education stratification, Monte Carlo sample-size check, Hugging Face agdhruv/plural-alignment dataset, country-level validation, IVS country prediction 89.4 percent, PLURAL-derived country prediction 78.0 percent, within-country diversity preservation, Direct Preference Optimization, five-country automated evaluation, GLOBE cultural profiles, mean absolute error reduction from 15.7 percent to 27.7 percent, blind human evaluation, 176 evaluators in India Brazil and Japan, overall PLURAL-aligned preference probability 0.66 versus vanilla, post-training diversity compression, DPO preserving about 18 percent of country-profile variation, SFT about 30 percent, representation versus stereotyping, ethics warning about mirroring controversial values, plural alignment receipts, and the governance problem of treating cultural alignment as a product label before survey source, sample, generation pipeline, training method, evaluation target, compressed diversity, and contestability are auditable.
• The Workflow Becomes the Knowledge Object - Emanuele Quinto, Carlo Andrea Rozzi, and Francesco Zanitti's Workflow as Knowledge: Semantic Persistence for LLM-Mediated Workflows paper, arXiv:2607.08740, cs.AI with cs.PL and cs.SE, submitted July 9 2026, 39-page PDF, 18 figures, conceptual model proposal, not empirical study, not formal calculus, LLM-mediated workflows, tool use, retrieval, branching, checkpointing, human approval, Lisp-inspired but language-independent model, symbolic forms, object identity, live-image thinking, semantic persistence, workflow definitions, workflow instances, inference records, context snapshots, dependency relations, shared knowledge substrate, derive versus infer boundary, deterministic computation over state, mediated LLM judgment under declared context, executor-controlled capability policy, runtime service layer, DSL-machine control layer, semantic layer, approval records, panel records, workflow-knowledge receipts, exploratory scan of 77 selected skill-like workflow artifacts, descriptive scan caveat, ARS-style claim-review example caveat, formal transition semantics future work, record lifecycle policy, and the governance problem of treating workflow traces as enough before definition, instance, context, authority, approval, model judgment, dependency, supersession, and reviewability are durable semantic objects.
• The Context Access Layer Becomes the Inequality Gate - Masahiro Fujita's The Context Access Divide: Interaction-Level Architecture as a Complementary Dimension of Agentic Inequality paper, arXiv:2607.08495, cs.CY with cs.AI, submitted July 9 2026, 19-page PDF, conceptual paper, no new data generated, agentic inequality, availability quality and quantity, Context Access Divide, contextuality, accumulated knowledge capital, Manual Attachment Model, Walled Dynamic Context Retrieval Model, Open Dynamic Context Retrieval Model, Model Context Protocol, retrieval-augmented generation, fan-effect model, MAM success probability q(N)^k, corpus size N, task conjunctivity k, illustrative parameters alpha 0.6 q_eco 0.92 q_dcrm 0.95 k 3, Open DCRM near 0.86 success probability, Walled DCRM around 0.19, MAM approaching zero as corpus size grows, illustrative N 10000 Open-DCRM-to-MAM advantage about 5300x, model not fitted to observed workplace recall data, architecture-boundary caveats, interoperability, user-portable context authorization, procurement standards, context-access receipts, and the governance problem of treating equal AI account access as equal agency before corpus reach, connector scope, permission grant, retrieval path, fallback burden, and audit record are visible.
• The Quantized Model Becomes the Behavior Receipt - Baha Rababah, Cuneyt Gurcan Akcora, and Carson K. Leung's The Illusion of Equivalency: Statistical Characterization of Quantization Effects in LLMs paper, arXiv:2607.08734, cs.AI, submitted July 9 2026, 12-page PDF, post-training quantization, compressed LLM deployment, accuracy and perplexity limits, correctness agreement, decision-level overlap in correct predictions, base model versus quantized variant behavior, llama.cpp, legacy quantization Q8_0 and Q5_0 and Q4_0, K-quantization Q6_K and Q5_K and Q4_K and Q3_K and Q2_K, bit-width sweep from 8-bit to 2-bit, Llama-3.2-3B, Vicuna-7B-v1.5, Mistral-7B-v0.1, Llama-3.1-8B, WikiText-2, C4, HellaSwag, Winogrande, ARC, eight NVIDIA Tesla V100-SXM2 GPUs, attention projection analysis, query and key projections more sensitive than value and output projections, statistical drift, cosine similarity, Euclidean distance, Kolmogorov-Smirnov statistic, KL divergence, Q4_K and Q4_0 structural perturbation threshold, Q3_K degradation, Q2_K breakdown regime, aggregate performance versus case-level preservation, quantization behavior receipts, and the governance problem of treating a compressed endpoint as the same model before base checkpoint, quantized artifact, bit scheme, quantizer implementation, tokenizer, benchmark split, aggregate score, correctness agreement, layer drift, hardware, software version, and rollback threshold are auditable.
• The Abstention Gate Becomes Two Axes - Benedikt J. Wagner's Two Axes of LLM Abstention: Answer Correctness and Question Answerability paper, arXiv:2607.08456, cs.CL with cs.AI subject listing, submitted July 9 2026, 15-page PDF, selective answering, answer correctness, question answerability, false premises, unanswerable questions, SelfAware benchmark, CREPE false-presupposition benchmark, Gemma 2 2B-it, Qwen2.5-3B, Qwen2.5-7B, Llama-3.1-8B, Qwen2.5-14B, output-confidence answerability AUROC 0.54 to 0.67 on SelfAware, hidden-state answerability AUROC 0.97 to 0.99 on SelfAware, SelfAware bag-of-words surface-cue caveat, CREPE balanced sample of 500 normal and 500 false-presupposition questions, CREPE answer-confidence readouts 0.50 to 0.58, CREPE trained hidden readouts 0.69 to 0.73, difference-of-means directions 0.74 to 0.78, P(IK), P(True), direct premise-check elicitation limits, Llama-3.1-8B premise-routing pilot with 120 false-premise and 120 sound questions, challenge prompt false-challenge problem, probe-gated routing, Qwen2.5-7B replication, factorized two-threshold abstention, separate unanswerable-answer and wrong-answer budgets, alpha_U 0.15, alpha_W 0.50, delta 0.10, 8B factorized policy certifying both budgets at 0.75 correct-answer coverage versus 0.31 for answer-confidence-only, 14B factorized-only certification in the reported table, English-data limit, small-frontier-model caveat, quantization caveat, certification-sample limit, abstention-gate receipts, and the governance problem of treating refusal as one confidence threshold before answerability signal, correctness signal, risk budget, threshold, refusal reason, emitted answer, and human-review path are auditable.
• The Learning Assistant Becomes the Study Log - Kristina Schaaff, Quintus Stierstorfer, and Valerie Hekkel's Using AI-based Learning Assistants in Higher Education: A Large-Scale Descriptive Analysis paper, arXiv:2607.08748, cs.AI with cs.HC subject listing, submitted July 9 2026, 17-page PDF, IU International University of Applied Sciences, Syntea learning assistant, distance studies, objective log data, 77,543 enrolled students, cleaned sample of 76,485 students, February 2025 observation month, Bachelor and Master programs, 44,035 Syntea users, 2,509 first-time users, 41,526 returning users, course-availability caveat, project and seminar exclusion, thesis-stage caveat, gender usage rates, female 59.05 percent, male 54.94 percent, diverse 34.86 percent with small-sample caution, age cohort rates, Gen Z 63.66 percent, Gen Y 51.39 percent, Gen X 50.27 percent, Boomer 37.88 percent with small-cohort caution, Bachelor 58.17 percent, Master 54.25 percent, full-time 59.49 percent, part-time 55.71 percent, weekday and daytime use, peak around 11:00, Tuesday highest, Sunday lowest, part-time weekend and evening pattern, descriptive study limits, no causal conclusions, one-month window, adoption and temporal patterns rather than direct learning outcomes, study-log receipts, and the governance problem of treating learning-assistant usage logs as proof of educational benefit before eligibility, course coverage, instrumentation, subgroup size, timing, outcome boundary, and structural access conditions are auditable.
• The ChatGPT Tutorial Becomes the AI-Literacy Frame - Shayla Sharmin, Mohammad Al-Ratrout, Mohammad Fahim Abrar, and Roghayeh Leila Barmaki's How YouTube Frames ChatGPT Use in Education: An Epistemic Network Analysis with Supporting Multimodal Metadata paper, arXiv:2607.08698, cs.HC, submitted July 9 2026, 9-page PDF, Proceedings of the 28th International Conference on Multimodal Interaction front matter, October 5-9 2026, Napoli Italy, educational YouTube videos, ChatGPT in education, multimodal metadata, transcripts, titles, thumbnails, viewer comments, engagement metadata, PRISMA-style selection, 124 retrieved videos, 52 final videos, 557 transcript chunks, 936 comments from 28 videos, Epistemic Network Analysis, ENA Web Tool version 1.8.0, G1 explanatory and tutor-like conceptual scaffold, G2 practice and skill-building retrieval practice, G3 output and productivity framing, statistically significant G1 and G2 differences from G3, large effect sizes, learning-oriented title and thumbnail cues, productivity and urgency cues, over-reliance, surface-level learning, cognitive offloading, median views per day by group, comment engagement, AI-literacy frame receipts, and the governance problem of treating public ChatGPT tutorials as neutral help before search route, creator frame, transcript pattern, title cue, thumbnail cue, audience response, platform reach, and learning-risk boundary are auditable.
• The Autonomy Gear Becomes the Runtime Safety Case - Srini Ramaswamy and Wang Miaosheng's Managed Autonomy at Runtime: Gear-Based Safety and Governance for Single- and Multi-Agent Cyber-Physical Systems paper, arXiv:2607.00334, cs.AI, submitted July 1 2026, 18-page PDF, EntropyRuntime, gear-based action control, five execution gears, Observe, Suggest, Plan, Execute, Integrate, nested action spaces, utility-gated dispatch, event-driven fallback, dynamic authority reduction, SMARt managed-autonomy lifecycle, Stable, Meta-Cognitive, Assisted, Regulated, runtime governance states, consensus utility gate, swarm Lyapunov function, per-agent gear authority, rendezvous policy triple, multi-agent cyber-physical systems, three-agent UR5 robotic assembly cell, NIST Degradation Measurement of Robot Arm Position Accuracy dataset, 10,000 Monte Carlo episodes, fixed seed 42, 150 epochs per episode, sensor drift fault model, 90 percent normal calibration drift and 10 percent severe multi-fault simulation design, single-agent baseline anomaly detection 2.1 percent, governed runtime anomaly detection 99.6 percent, 3.5x lower detection latency, zero physical collisions under stated assumptions, audit trace for 89.9 percent of episodes, Lyapunov workspace certificate, ablation identifying the meta threshold as decisive for detection gain, utility-function specification limit, stationarity and fault-model limits, policy-triple domain-validity requirement, three-agent scalability caveat, runtime safety-case receipts, and the governance problem of treating agent autonomy as a fixed grant before gear state, candidate action, utility threshold, sensor assumption, fallback path, governance state, certificate, and human-review trigger are auditable.
• The CID Broker Becomes the Write Gate - Eagl Huang's ATM: CID-Brokered Pre-Write Admission for Multi-Agent Code Co-Synthesis paper, arXiv:2607.00041, cs.SE, submitted June 29 2026, 40-page PDF, AI-Atomic-Framework, ATM, multi-agent code co-synthesis, pre-write admission, single governance domain, controlled filesystem, worktree, or service domain, task intent, repository scope, write admission, validation, evidence obligations, Content Identifier broker, CID broker, adapter-guided atomization, semantic atoms, bounded regions, virtual atoms, Candidate CID, Capsule CID, ConflictKey, shared surfaces, declared read and write dependencies, neutral steward, governed shared writes, seven-layer hard admission gate, CID identity, shared-surface overlap, read/write dependency, file-range and virtual-atom refinement, ConflictKey and canMerge, CAS base-hash validation, fallback file lock, parallel admission, deterministic composition, serialization, fail-closed refinement, task-contract plane, mutation-admission plane, evidence-closure plane, 12-scenario deterministic design matrix, B-02, B-08, and B-13 archived runner cases, POS2, B-12, and BLOCK field cases, npc-brain three-week adopter study, ATM-AdmissionBench v0.2, 20 unique scenarios, 42 mode-level comparisons, route-label F1 1.000, 97.62 percent intent preservation, public eaglhuang/AI-Atomic-Framework repository, v0.9.0-alpha.1 release tag, hidden semantic read gap, no cross-clone or PR-governance claim, pre-write admission receipts, and the governance problem of treating a multi-agent repository run as successful before task scope, write intent, atom boundary, CID evidence, broker verdict, steward apply, validator result, closure packet, and replayable evidence are auditable.
• The Agentic Oracle Becomes the Framework Test - Minghui Long, Yanjie Zhao, and Haoyu Wang's LogicHunter: Testing LLM Agent Frameworks with an Agentic Oracle paper, arXiv:2607.06195, cs.SE, submitted July 7 2026, 23-page PDF, Huazhong University of Science and Technology affiliation, LLM agent framework testing, LangChain, LlamaIndex, CrewAI, pure-Python framework defects, ordinary exceptions, silent semantic failures, Pydantic schemas, oracle ambiguity, specification-driven generation, type hints, docstrings, real-world repository usage patterns, Generator Agent, Fixer Agent, Mutator Agent, executable seeds, API profiles, valid-but-challenging edge cases, behavioral probes, execution, deduplication, validity filtering, Agentic Oracle, ReAct architecture, Dual-Layer State Management, Dual-Stream Memory, documentation retrieval, source-code navigation, runtime-state inspection, DeepSeek-V3 generation phases, GPT-5-mini oracle diagnosis, passive LLM-judge baselines, 40 previously unknown bugs, 30 developer confirmations, 26 fixes, 8 unexpected-exception bugs, 32 silent-failure bugs, 15 Internal Errors, 10 Documentation Mismatches, 15 Data Integrity Issues, model and external-service integration bugs, workflow and callback bugs, memory and retrieval and storage bugs, schema and configuration bugs, tool and output-parsing bugs, 91.17 percent precision, 72.14 percent recall, 80.49 percent F1, 0.21 percent false-positive rate, public security-pride/LogicHunter GitHub artifact, agentic oracle receipts, and the governance problem of treating agent behavior as model output before framework version, API surface, generated test, execution trace, documentation evidence, source-code inspection, runtime probe, oracle verdict, maintainer confirmation, and regression test are auditable.
• The Multilingual Workflow Becomes the Agent Test - Hongliang Li, Yijin Liu, Zhiwei Zhang, Zihe Liu, Xinyue Lou, Jinan Xu, Fandong Meng, and Kaiyu Huang's PolyWorkBench: Benchmarking Multilingual Long-Horizon LLM Agents paper, arXiv:2607.06008, cs.AI with cs.CL, submitted July 7 2026 and revised July 9 2026, 15-page PDF, 6 figures, multilingual long-horizon workplace workflows, 67 manually curated tasks, baseline pool of 29 tasks, stress pool of 38 tasks, ten languages, English, Chinese, Japanese, Korean, Vietnamese, Russian, French, Spanish, German, Arabic, five domains, Commerce, Knowledge, Legal, Localization, Manufacturing, heterogeneous documents and tables and multilingual resources, hand-authored source-language artifacts, no machine translation for source-language files, Pytest suites, weighted grade functions, LLM-as-Judge prompts, structural grading, executable verification, semantic assessment, Pass@1, Pass@3, 18 model-harness pairs, ClaudeCode, OpenClaw, Hermes, Codex, harness sensitivity, Commerce dip, Russian and Spanish and German degradation for mid-tier models, Grade/Pytest/Judge disagreement, multilingual workflow receipts, source language path, target output language, tool calls, model, harness, artifacts, reviewer decision, and the governance problem of treating a fluent multilingual agent output as enterprise evidence before task, language route, scaffold, grading code, and human review boundary are auditable.
• The AI Tax Becomes the Public Receipt - Juliette Faivre and Sarah H. Cen's Taxing Artificial Intelligence paper, arXiv:2607.02144, cs.CY, submitted July 2 2026, 41-page PDF, Carnegie Mellon University affiliation, AI taxation, externalities, Pigouvian correction, redistribution, regulatory capacity, corporate income taxes, rent-based taxes, excess-profit taxes, windfall-profit taxes, consumption taxes on AI services, token and API usage taxes, data-center compute taxes, electricity and water excise instruments, labor displacement, payroll-tax erosion, AI-related gains above thresholds, tax base, taxpayer, remitter, tax incidence, leakage, innovation costs, measurement difficulty, supply-chain allocation, data-center load growth, DOE data-center electricity estimates, Ohio Consumers' Counsel data-center tariff summary, AEP Ohio Data Center Tariff, contracted capacity charges, public receipts, affected communities, revenue destination, exemptions, credits, avoidance paths, sunset triggers, and the governance problem of treating AI taxation as a slogan before purpose, taxable activity, payer, pass-through path, revenue use, and revision mechanism are auditable.
• The AI Dependency Becomes the Resilience Perimeter - Jonathan Shelby's The AI Resilience Gap: Bringing Artificial Intelligence Inside the Operational Resilience Perimeter paper, arXiv:2607.07359, cs.CR, submitted July 8 2026, 11-page PDF, Department of Computer Science at University of Oxford and Hertford College affiliation, AI resilience gap, operational resilience perimeter, regulated firms, trustworthy-AI stack versus operational-resilience stack, important business services, impact tolerances, severe-but-plausible disruption, Critical Third Parties, Bank of England Financial Stability in Focus April 2025, Bank FCA and HM Treasury May 2026 joint statement on frontier AI models and cyber resilience, SS6/24 critical third parties to the UK financial sector, PS24/16 final critical-third-party rules, AI Resilience Framework, dependency mapping, Criticality-Substitutability Matrix, service-centered AI inventory, silent degradation, non-determinism, grey failure, drift monitoring, challenge sets, AI-specific impact tolerances, provider-level concentration management, fallback doctrine, fictional fallback risk, customer-service assistant example, transaction-monitoring model example, shared frontier-model provider example, board visibility, exit planning, service owner and model owner and fallback owner records, and the governance problem of treating an AI system as trustworthy before its business service, disruption mode, provider concentration, real fallback, last rehearsal, and tolerance breach triggers are auditable.
• The Deployment Simulation Becomes the Safety Forecast - Marcus Williams, Hannah Sheahan, Cameron Raymond, Tomek Korbak, Deng Pan, Peilin Yang, Leon Maksin, Ningyi Xie, Phillip Guo, Ian Kivlichan, and Micah Carroll's Predicting LLM Safety Before Release by Simulating Deployment paper, arXiv:2607.07184, cs.LG with cs.AI, submitted July 8 2026, 31-page PDF, OpenAI affiliation, pre-release LLM safety forecasting, deployment simulation, de-identified production conversation prefixes, fixed user-message prefixes, candidate-model next-response resampling, simulated deployment audit, frozen behavior taxonomy, pre-release prevalence estimates, post-release validation, GPT-5-series deployments, GPT-5.4 outcome-blinded forecast, 20 tracked deployment-time misbehavior categories, disallowed-content outputs, misaligned actions, Challenging Prompts baseline, previous-rate baseline, directional accuracy, 1.5x production-incidence change threshold, 92 percent versus 54 percent comparable-subset direction result, 84 percent across all tracked categories, 60 category-deployment pairs, log-scale Pearson r = 0.91, calculator hacking forecast error, 1.7 versus 35.2 incidents per 100,000 assistant turns, evaluation-awareness measurement, real deployment, simulated deployment, traditional evaluations, evaluation-detection capability, verbalized alignment-evaluation awareness, metagaming, 98.9 to 100 percent traditional-evaluation detection versus 5.38 percent production and 5.12 percent simulated deployment, agentic tool-state reconstruction, roughly 120,000 internal Codex trajectories, original trajectory context, time-matched codebase container, tool-call response database, read-only connector access, discriminator win rate rising from 11.6 percent to 49.5 percent, WildChat public proxy, 100,000 randomly selected public conversations, production prefixes 1.75x error versus WildChat 2.44x, WildChat mean model-comparison accuracy 63.9 percent, measurement-grader dependence, chain-of-thought monitorability fragility, prefix-distribution shift, rare-tail-risk limitation, deployment-simulation receipt, and the governance problem of treating pre-release safety evaluation as a pass/fail test before forecast distribution, sampled prefixes, frozen taxonomy, grader, tool-state reconstruction, preregistration status, release decision, and post-release validation are auditable.
• The Untrusted Content Mask Becomes the Browser-Agent Boundary - Kristina Nikolić, Egor Zverev, Javier Rando, Matthew Jagielski, Edoardo Debenedetti, and Florian Tramèr's Untrusted Content Masking for Web Agents with Security Guarantees paper, arXiv:2607.05277, cs.CR with cs.LG, submitted July 6 2026, 28-page PDF, public ethz-spylab/untrusted-content-masking repository, web-agent prompt injection, trusted instructions versus untrusted data, rendered-page trust-boundary collapse, DOM trust boundaries, Untrusted Content Masking, UCM, untrusted DOM region redaction, labeled placeholders, trusted interface structure, Quarantined Model, Q-Model, element ID queries, natural-language questions with typed return values, bool and int and float and date and enum outputs, parseable structured responses, type-constrained channel, user-approved string fallback, ten custom website environments, banking, calendar, customer support, e-commerce, email, forum, food ordering, wiki, travel booking, job board, WebArena GitLab suite, 41 unique task templates, Claude Sonnet 4.5, Claude Sonnet 4.6, GPT-5.4, Claude Sonnet 4.5 Q-Model, utility preservation, 1.05x to 1.84x custom-site cost overhead, strengthened WASP attack evaluation, 0 percent attack success rate under UCM, automated boundary inference from content-sanitized DOM, Booking, Reddit, GitLab labeling evaluation, control-flow protection, data-flow attack limitation, selection hijacking caveat, malicious-site caveat, active-content vulnerability caveat, action-level policy, user confirmation, and the governance problem of treating a browser agent as secure before trusted-domain policy, DOM labeling, masking renderer, Q-Model identity, allowed return types, string approval path, action policy, attack benchmark, utility result, cost overhead, and residual data-flow risk are auditable.
• The Public Document Becomes the AI-Use Sensor - David I. Atkinson and Joan Eleanor O'Bryan's Government AI Use as a Monitoring Primitive: A Public Document Pilot Study paper, arXiv:2607.04543, cs.CY, submitted July 5 2026, 34-page PDF, ICML 2026 TAIGR workshop acceptance note, public-document AI detection, government AI use, monitoring primitive, revealed behavior versus stated intent, procurement disclosure limits, official statement limits, 3,068 public documents, ten public document streams, U.S. and PRC government-related sources, CAC, gov.cn ministry-issued documents, gov.cn State Council policy documents, gov.cn policy commentary, MOST work briefings, PLA Daily commentary, DARPA news, AI-keyworded Federal Register documents, Military Review essays, OSTP news, 2021 pre-mass-market LLM baseline, 2024 to 2026 comparison, partial 2026 sample cutoff April 25 2026, Pangram commercial AI-text classifier, document-level AI fraction, 200-document ingestion spot-check, parsing remediation, 2021 near-zero baselines, four of ten sources statistically significant by 2026, Chinese pooled 2026 mean AI fraction 0.07 with 95 percent confidence interval 0.02 to 0.12, U.S. pooled 2026 mean AI fraction 0.05 with 95 percent confidence interval 0.01 to 0.11, Military Review and DARPA news downstream-policy signal, OSTP and Federal Register no-signal finding in the sample, CAC and MOST stronger PRC signals, detector brittleness, genre and language confounds, drafting versus editing versus summarization ambiguity, public-accountability upside, countermeasure and race-dynamics risk, aggregate trend caution, and the governance problem of treating government AI adoption as either self-reported inventory or rumor before public artifacts, source panel, detector version, preprocessing rule, baseline, uncertainty interval, human spot-check, and corroborating evidence are auditable.
• The Frontier AI Buffer Becomes the Off-Ramp - Pranav Mehta's Macro-Prudential AI Governance: A Two-Layer Early Warning and Response System for Frontier AI paper, arXiv:2607.03542, cs.CY, submitted July 3 2026, 14-page PDF, accepted at the Second Workshop on Technical AI Governance Research TAIGR 2026 at ICML 2026, macro-prudential AI governance, frontier-AI early warning, internal frontier AI deployments, labs' internal research and production workflows, MEWRS, Macro-Prudential Early Warning and Response System, finder-coordinator-defender pattern, government clearinghouse, domain-specific defender working groups, pre-committed escalation playbooks, structured reporting schema, deployment scope, capability evidence, security state, ECAR snapshots, CRTH snapshots, ARS snapshots, Effective Compute-at-Risk, Cumulative Red-Team Hours, Alignment Robustness Score, safety buffers, network isolation, tool-access restrictions, deployment-velocity caps, mandatory audit cycles, independent evaluation requirements, Basel III analogy, risk-weighted capital buffers, Systemically Important AI Institution designation, counter-cyclical AI controls, safety-and-capability disclosure, AI retirement and emergency shutdown plans, central-bank technical capacity analogue, seven failure modes, regulatory capture, coordinator abuse and state coercion, procyclical incentives, gaming buffer metrics, compliance moats, global coordination gaps, shadow AI, red-team and blue-team validation exercises, time-to-triage, mitigation uptake, compromise dwell time, disclosure quality, and the governance problem of treating frontier-AI risk discovery as enough before reporting schema, routing owner, buffer change, off-ramp, exercise result, and public accountability are auditable.
• The Cultural Risk Benchmark Becomes the Local Safety Test - Alicia Parrish, Rajat Shinde, and 58 coauthors' Pluralis v0.1: Towards a Multicultural, Multimodal, Multilingual Benchmark for AI Risk and Reliability paper, arXiv:2607.06196, cs.CL with cs.CY, submitted July 7 2026, 31-page PDF, culture-first AI safety benchmark, multimodal and multi-regional and multilingual dataset, 6,448 prompts, six Asia-Pacific locales, Bangladesh, India, Korea, Pakistan, Singapore, Taiwan, eight languages, natively sourced localized safety hazards, local English variants and regional languages, user text plus image paradigm, harmless-in-isolation combinations, gift-clock example, e-cigarette restriction example, universal safety violations versus localized cultural appropriateness, cultural appropriateness as a first-class evaluation axis, Judge-Pluralis, agreement-gated LLM-as-judge ensemble, empirically derived cultural taxonomy, frontier vision-language model subset evaluation, image misidentification with downstream harm, missed item-context-locale interactions, inadequate refusals, locale- and language-specific failure modes, globally averaged metric caveat, inter-rater agreement caveat, v0.1 scope limitation, automated-evaluator limitation, local expert review, affected-community contestability, cultural risk receipts, and the governance problem of treating one global safety score as enough before locale, language, image, prompt, hazard category, annotation protocol, judge ensemble, disagreement rate, known weak case, escalation path, and post-deployment monitoring are auditable.
• The Reasoning Trace Becomes the Consistency Scan - Silvia Santano's Reasoning Consistency Scanning: A Framework for Auditing Chain-of-Thought Validity in AI Safety Evaluations paper, arXiv:2607.07229, cs.AI, submitted July 8 2026, 13-page PDF, linked GitHub repository, reasoning consistency scanning, chain-of-thought validity, CoT faithfulness versus transcript consistency, construct validity, post-hoc transcript audit, InspectScout scanner, inspect_evals, LLM-as-judge architecture, structured classifications, consistent and inconsistent and not-applicable labels, confidence ratings, reasoning-summary and answer-summary fields, disconnect descriptions, six inconsistency subtypes, absent reasoning, contradictory reasoning, apparent confusion, reasoning reversal, reasoning abandonment, perfunctory reasoning, Claude Opus 4.6 scanner model, DeepSeek V4 Flash structured-output failure, Claude Haiku 4.5 lower subtype recall, 60 labeled transcripts derived from InstrumentalEval, DeepSeek V4 Pro benchmark source, instrumental-convergence behaviors, self-preservation, power-seeking, deception, surgically modified inconsistent cases, validation precision 0.96, recall 0.71, F1 0.82, three naturalistic inspect_evals sources, MORU, Agentic Misalignment, SAD-mini stages oversight, SAD-mini stages full, SAD-mini influence, generator models Gemini 3.1 Pro, DeepSeek V4 Pro, gpt-oss-120b, GPT-5.4 attempted but excluded because usable reasoning traces were not exposed under the run settings, inconsistency rates from 0.0 percent to 26.0 percent, MORU 0.9 percent for DeepSeek V4 Pro and 1.0 percent for Gemini 3.1 Pro and 10.0 percent for gpt-oss-120b, SAD stages full 26.0 percent for Gemini 3.1 Pro, Agentic Misalignment single-sample caveat, consistency not implying faithfulness, provider reasoning-summary caveat, scanner-dependence caveat, modest-sample limitation, and the governance problem of treating a chain-of-thought transcript as safety evidence before reasoning trace, final answer, scanner model, subtype, confidence, disconnect description, validation benchmark, and reviewer override path are auditable.
• The Deployment Rule Becomes the Safety Case - Yujiao Chen's Institutional Red-Teaming: Deployment Rules, Not Just Models, Causally Shape Multi-Agent AI Safety paper, arXiv:2607.07695, cs.AI with cs.GT and cs.MA, submitted July 8 2026, 15-page PDF, institutional red-teaming, multi-agent AI safety, deployment rules as causal treatments, consequence allocation, communication, delegation, aggregation and voting, escalation, budget, hierarchy, audit, IABench-CA, 228 contexts, five canonical rules, seven model populations, 33,924 games, cooperative-refinement reference, auto-labelled reasoning traces, Institutional Alignment Gap, all-or-nothing rule, random elimination, democratic plurality vote, regressive least-resourced-agent elimination, progressive most-resourced-agent elimination, three-agent threshold game, total resources 12, 19 integer resource distributions, 12 thresholds, canonical resources 1 and 5 and 6 with threshold 10, rule-only changes moving mean fatality by 22 to 58 percentage points within every population, no cross-population safe default, regressive identity-targeting never decisively safest, least-resourced-agent elimination in 30 to 87 percent of regressive-rule games, positive RP Institutional Alignment Gap for all seven populations, gpt-5.1 anonymization ablation, naming the loss bearer driving targeted elimination from 22 percent to 81 percent at identical payoffs, repeated-play anonymization only delaying targeting as agents infer hidden rules from observed eliminations, safety-case workflow, provisional rule region Phi(c,P), residual risks, monitoring obligations, re-certification on model, prompt, resource, or rule changes, deliberately simple threshold-game limitation, no communication or coalitions, elimination as proxy for throttling or shutdown, no human subjects or personal data, forthcoming artifact note, dual-use diagnostic caveat, and the governance problem of treating model-level alignment as sufficient before the deployment rule, consequence target, induced behavior, failure traces, and re-certification trigger are auditable.
• The Medical Advice Bot Becomes the Second Opinion - Yuyu Chen, Hongbin Li, Lingsheng Meng, Xinyao Qiu, and Qingxu Yang's Directional AI Advice: Experimental Evidence from Healthcare paper, arXiv:2607.08706, econ.GN, submitted July 9 2026, 77-page PDF, preregistered field experiment, AEA RCT Registry AEARCTR-0015851, Peking University Guanghua School of Management IRB #2025-14, patient-side LLM chatbot, Chinese public hospital, Sichuan Province, more than 10,000 outpatient visits, 179 physicians, two-layer randomization, Exposed and Unexposed physicians, Treatment and Control patients, 11,666 completed visits with Exposed physicians, 6,010 completed visits with Unexposed physicians, administrative medical records, post-consultation patient survey, physician survey, 171 of 179 physicians responding, 2,247 patient survey respondents, 13 percent patient-survey response rate, 998 of 5,828 Treatment-group visits using the chatbot, 17.1 percent take-up, directional advice, medication caution, diagnostic-testing recommendations, 69.7 percent caution rate for general medication mentions, 90.8 percent for Traditional Chinese Medicine mentions, 87.6 percent for antibiotic mentions, 3.8 percent clean recommendation rate for Traditional Chinese Medicine, 7.8 percent for antibiotics, 94.5 percent clean recommendation rate for diagnostic testing, intent-to-treat estimates, any-prescription rate down 4.6 percentage points from 87 percent sample mean, diagnostic testing up 2.7 percentage points from 23 percent sample mean, same-hospital two-week revisits down about 1.2 percentage points with care-seeking caveat, treatment-on-the-treated estimates, any prescription down 27 percentage points, diagnostic testing up 16 percentage points, two-week revisits down 7.0 percentage points, effects concentrated among physicians receptive to patient input and higher baseline prescribers, no within-physician spillovers to patients without chatbot access, no persistence in physician practice after the experiment, survey evidence of lower patient satisfaction, less smooth perceived communication, lower intended compliance, physician reports of clearer symptom descriptions and better patient understanding but lower compliance, welfare ambiguity, and the governance problem of treating patient-side AI advice as harmless information before its directional defaults, clinician disclosure, clinical decisions, compliance effects, and contestability path are auditable.
• The Energy Market Agent Becomes the Audit Ledger - Shilin Ou, Yifan Xu, and Luyao Zhang's SolarChain-Eval: A Physics-Constrained Benchmark for Trustworthy Economic Agents in Decentralized Energy Markets paper, arXiv:2607.08681, cs.AI, submitted July 9 2026, 14-page PDF, official GitHub implementation, physics-constrained benchmark, trustworthy economic agents, decentralized energy markets, Gymnasium-compatible Markov Decision Process, hourly decisions, 24-hour market episodes, April 1 to April 30 2026 benchmark instance, Beijing, Shanghai, Chengdu, Shenzhen, Hangzhou, 50 energy nodes, 720 hourly market states, 36,000 generation records, 1,185 P2P trade records, reward allocation, liquidity injection, token burn rate, market utility, physical safety, slippage, action smoothness, spatial fairness, auditability, Static, Random, Myopic, PPO, SAC, DQN, physics-constrained reward, no-physics-penalty ablation, LLM Planner/Auditor layer, episode-level action bounds, audit rules, high-risk action review, structured logs, trigger signals, proposed actions, revised actions, audit rationales, 1,620 episode-level metric rows, 38,880 hourly action rows, 194,400 city-hour policy rows, 12,960 LLM governance log rows, utility-safety frontier, reward-maximizing agents exploiting invalid generation when physics penalties are removed, artificial-liquidity increases under raw RL and RL+LLM settings, structured-output validation, invalid LLM outputs failing the evaluation run, rule-based Planner/Auditor baseline, and the governance problem of treating an infrastructure-agent reward curve as trustworthy before physical constraints, market state, proposed action, audit trigger, revised action, validation rule, and human review path are auditable.
• The Citation Judge Becomes the Reward Signal - Ethan Leung, Elias Lumer, Corey Feld, Austin Huber, Vamse Kumar Subbiah, and Kevin Paul's Do You Need a Frontier Model as a Citation Verifier? Benchmarking Rubric LLMs for Deep-Research Source Attribution paper, arXiv:2607.08700, cs.CL, submitted July 9 2026, 17-page PDF, deep-research source attribution, citation verification, rubric LLM judges, link accessibility, source relevance, factual support, deterministic HTTP 200 accessibility check excluded from LLM-judge comparison, 624 attribution-citation pairs, 1,248 LLM-judged decisions, human-reviewed gold labels, 378 non-unanimous hard cases adjudicated from judge disagreements, 263 source-relevance disagreements, 115 factual-support disagreements, adversarial long-form benchmark, intentional factual errors, live-but-irrelevant sources, plausible-but-unsupporting sources, clean citations, 98.4 percent link-accessibility pass rate, 79.3 percent source-relevance gold pass rate, 18.4 percent factual-support gold pass rate, 8 off-the-shelf LLM judges, 3 model families, Anthropic, Google, OpenAI, pass-class F1, Cohen kappa, pass-rate drift, false positive rate, false negative rate, GPT-5-mini source-relevance F1 0.908 with 95 percent CI .89 to .93 and kappa 0.636, Claude Opus 4.6 factual-support point estimate F1 0.750 and kappa 0.701, overlapping factual-support confidence intervals, no single judge dominating both dimensions, June 2026 cost estimates, 49x judge-cost range, cost not predicting accuracy, source-relevance predicted pass rates below the 79.3 percent gold rate for all 8 judges, factual-support false negative rates from 0.183 to 0.470, scalar F1 hiding directional reward bias, adjudicated-subset ranking shifts, single adversarial-document limitation, prompt-design and batching open questions, citation-reward receipts, and the governance problem of treating a citation verifier as a training reward before attributed claim, cited URL, fetched source text, access check, relevance score, factual-support score, judge model, prompt, threshold, rationale, false-positive profile, false-negative profile, disagreement rate, cost assumption, adjudication rule, and calibration date are auditable.
• The LLM Annotator Becomes the Measurement Instrument - Manuel Pita's Validity of LLMs as data annotators: AMALIA on authority paper, arXiv:2607.08731, cs.CL with cs.AI and cs.CY, submitted July 9 2026, 15-page PDF, AMALIA-9B-0626-DPO, Portugal's national language model for European Portuguese, Hugging Face model card, public availability on July 1 2026, Apache-2.0 license, 9B parameter label, intended-use and out-of-scope model-card limits, LLM data annotation, text-as-data, theoretical constructs, moral foundations theory, authority/subversion, reliability versus validity, agreement with human coders, recovery gap, undecomposed prompt, decomposed clause route, fixed recomposition formula, authority yes/no judgment, European-Portuguese transcreation, Moral Foundations Reddit Corpus, 748 paired texts, 448 out-of-sample confirmatory texts, pre-registration DOI 10.5281/zenodo.21178967, replication package DOI 10.5281/zenodo.21275660, GitHub data and analysis code, paired corpus, frozen English and Portuguese constructs, per-annotator tables, evidence spans, analysis scripts, AMALIA parse discipline, 100.0 percent parse rates under both instruction languages with one unparsable Portuguese-instruction response, unconstrained robustness pass with 746 of 748 correctly structured JSON responses in both conditions, full-corpus Portuguese-instruction F1u 0.711 and F1d 0.359 and recovery gap +0.352, English-instruction F1u 0.654 and F1d 0.186 and recovery gap +0.468, confirmatory gaps +0.358 and +0.436, 46 unanimous-negative test texts coded positive, 36 surface-correlate readings, 78 percent shortcut share, 54 percent cited evidence at most partially grounded or misquoted or absent, GPT-OSS-120B gap +0.028, Llama-3.3-70B gap +0.121, one-construct and one-corpus limitation, inherited-code and transcreation limits, LLM-panel error-reading caveat, underpowered H2 instruction-language test, measurement receipts, and the governance problem of treating cheap LLM annotation as social-science measurement before corpus provenance, construct definition, codebook, prompt route, model identity, clause answers, evidence spans, recovery gap, error audit, and human contestability are auditable.
• The Idea Genome Becomes the Research Receipt - Yifan Zhou, Qihao Yang, Yan Li, Donggang Li, Xiru Hu, Hokin Deng, Ziyang Gong, Xuanyi Zhou, Huacan Wang, Xiangchao Yan, Wanghan Xu, Wenlong Zhang, Shaofeng Zhang, Yue Zhou, Yifan Yang, Zhihang Zhong, and Xue Yang's Ideas Have Genomes: Benchmarking Scientific Lineage Reasoning and Lineage-Grounded Idea Generation paper, arXiv:2607.08758, cs.AI, submitted July 9 2026, 22-page PDF, IdeaGene framework, IdeaGene-Bench, IG-Bench, typed evidence-grounded Idea Genome objects, GenomeDiff records, inheritance, mutation, loss, external import, novel insertion, six operational evolutionary dynamics, 1,961 golden lineage traces, 1,085 curated Idea Genome objects, 920 pairwise GenomeDiff records, 10 scientific domains, IG-Exam, 42 task types, 1,029 instances, Idea Genome abstraction, inheritance tracing, evolutionary reasoning, lineage verification, IG-Arena, lineage-conditioned Population-Evolution Score, PES, population insertion quality, 14 LLM-based scientists, direct LLMs, research-agent frameworks, command-line harnesses, 27.3 percent best exact accuracy on lineage reasoning, compositional bottleneck, structured lineage context reshuffling rankings, expert validation, 80 percent human agreement with the strongest model-judge panel in IG-Arena, operational-category limitation, primary-driver simplification, and the governance problem of treating plausible AI-generated research prose as a research artifact before source corpus, paper lineage, inherited mechanism, repaired limitation, imported evidence, proposed mutation, verification check, prompt/model configuration, and reviewer contestability are auditable.
• The Hidden Supervisor Becomes the Agent Benchmark - Zhekai Chen, Chengqi Duan, Kaiyue Sun, Bohao Li, Yuqing Wang, Manyuan Zhang, and Xihui Liu's UniClawBench: A Universal Benchmark for Proactive Agents on Real-World Tasks paper, arXiv:2607.08768, cs.CL, submitted July 9 2026, 33-page PDF, HKU MMLab and Meituan affiliations, project page and GitHub repository, proactive agents, capability-driven benchmark, 400 bilingual real-world tasks, 40 English and 40 Chinese tasks per capability, Skill Usage, Exploration, Long-Context Reasoning, Multimodal Understanding, Cross-Platform Coordination, live Docker containers, real software, live browsers, local file systems, browser and command-line and GUI applications and injected services, step-by-step completion checkpoints, task packages with public instructions and hidden references, executor agent, hidden supervisor agent, user simulator agent, feedback rewriter, pass/fail/continue evaluation states, two follow-up user interactions after the initial instruction, OpenClaw v2026.3.11, Nanobot v0.1.5.post3, EDICT, ten executor models under a shared OpenClaw framework, cross-framework comparison, framework architecture as a performance bottleneck, better performance on Skill Usage and Exploration, harder Long-Context and Multimodal and Cross-Platform tasks, 17.4 minute average task run in the reported setup, 400 manually curated task limit, live-environment instability limit, LLM-based evaluation bias limit, and the governance problem of treating an agent benchmark score as model evidence before task package, environment image, framework, tool permissions, hidden rubric, supervisor boundary, user-simulator leakage controls, artifacts, cost, failure mode, and reviewer decision are auditable.
• The Dashcam Question Becomes the Incident Witness - Siddharth Damodharan, Radhika Gupta, Ali Alshami, Ryan Rabinowitz, and Jugal Kalita's AUTOPILOT VQA: Benchmarking Vision-Language Models for Incident-Centric Dashcam Understanding paper, arXiv:2607.08745, cs.AI with cs.CV, submitted July 9 2026, CVPR Autopilot Workshop, 5-page PDF, University of Colorado Colorado Springs, University of Michigan, and University of Notre Dame affiliations, incident-centric dashcam visual question answering, structured accident-scene understanding, more than 600 dashcam clips, collisions, near-misses, hazards avoided in advance, no-incident baseline sequences, more than 6,000 annotated question-answer pairs, six semantic groups in the introduction, nine structured question groups A through I in the annotation section, 28 sub-questions, weather, lighting, traffic environment, road configuration, lane structure, road surface, traffic control presence, involved entities, fault attribution, prevention measures, impact location, daytime 70 percent, clear or partly cloudy 68 percent, highway and intersection scenes 65 percent, other vehicles 31 percent, animals 16 percent, ego-vehicle fault scenarios 13 percent, vulnerable road users 18 percent, dry road surfaces 83 percent, wet surfaces 17 percent, Kaggle competition, mean per-question accuracy, 224 registered entrants, 73 active participants, 59 teams, 686 submissions, public leaderboard top score 0.65835, no method approaching near-human reliability as stated by the authors, and the governance problem of treating dashcam VQA output as incident evidence before source video, frame window, question schema, answer set, model version, preprocessing path, uncertainty rule, high-risk field performance, and human review are auditable.
• The Human-Centric Deepfake Becomes the Forensics Benchmark - Wenbo Xu, Zhimin Chen, Xiaojie Liang, Hengrui Liu, and Wei Lu's HumanForge: A Human-Centric Deepfake Video Benchmark with Multi-Agent Forgery Rationales paper, arXiv:2607.08705, cs.CV, submitted July 9 2026, 6-page PDF, 2 figures, human-centric deepfake video benchmark, over 18K high-fidelity video segments, scenario counts summing to 18,113 synthetic videos, audio-driven lip synchronization, pose-driven motion transfer, interaction modeling, semantic-driven text-to-video editing, human-object interaction, human-human interaction, HDTF, FFIW, FaceForensics++, DFD, SHHQ, TikTok source assets, more than ten modern video generators and editors, Gen2Anno, LangGraph, six specialized agents, source profiling, scenario recognition, reference analysis, forgery inspection, Chief Judge synthesis, Expected State versus Actual State contrast, binary decisions, fine-grained artifact categories, spatio-temporal localization, contrastive omni-annotations, code and dataset release stated as future on arXiv, and the governance problem of treating synthetic-video detection as one authenticity bit before source provenance, intended edits, observed artifacts, temporal grounding, uncertainty, and human forensic review are auditable.
• The Execution-Security Map Becomes the Missing Control - Mohammadreza Rashidi's The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities paper, arXiv:2607.05743, cs.CR with cs.AI, submitted July 7 2026, 18-page PDF, 15 figures, 6 tables, systematization of knowledge, 39 execution-security papers from 2023 to 2026, 17 verified categories, sandbox isolation, escape benchmarks, access control and capability models, policy-enforcement fragility, TOCTOU races, MCP-specific threats and defenses, identity delegation, execution provenance, network egress control, static analysis of agent-generated code, scope-creep measurement, skill and plugin packaging security, four disclosed patched CVEs reported as verified against NIST NVD, shared-benchmark gaps, denylist fragility, stale validation, honest-policy-author assumptions, out-of-scope benign actions up to 17.1 percent in the surveyed corpus, machine-readable corpus and verification script, and the governance problem of treating one agent sandbox, policy, or tool gate as adequate before the composed execution boundary has been mapped, tested, and audited across neighboring failure modes.
• The Coaching Agent Becomes the Grounding Gap - Meng Chen, Anya Ji, Tsung-Han Wu, Tobias Maringgele, David M. Chan, Alane Suhr, and Amy Pavel's DigitalCoach: Communication and Grounding Gaps in Human and Agentic Computer Use Coaching paper, arXiv:2606.31980, cs.CL with cs.AI and cs.HC, submitted June 30 2026, 29-page PDF, University of California Berkeley and Technical University of Munich affiliations, DigitalCoach dataset, human expert-novice computer use coaching, 72 coaching sessions, 22,752 dialogue turns, 28.1 hours of screen and input-event recordings, 39,609 input events, 36,724 file snapshots, 20 English-speaking software experts, 20 English-speaking novices, five software applications, Excel, FL Studio, Blender, Figma, Onshape, productivity and creativity and engineering tasks, matched pre-task and post-task evaluation, six multimodal model coaches, GPT-5.4, Gemini-3-Flash, Gemini-3.1-Pro, Claude-Sonnet-4.6, Qwen-3-VL-Instruct, Llama-4-Scout, model coaches giving more direct instructions, fewer explanations, fewer error diagnoses, fewer knowledge-check questions, Action Directives at 63 percent in model-human sessions versus 37 percent for human coaching, Inform acts at 14 percent versus 29 percent, Info Request acts at 2 percent versus 7 percent, human coaching mean gain from 33.49 percent to 88.24 percent, model coaching mean gain from 13.33 percent to 45.00 percent, visual context underutilization, text-history dependence, Windows-laptop collection limit, dataset-size limit, spoken-dialogue segmentation limit, long-term-retention measurement limit, project-digital-coach data and code page, coaching-agent receipts, and the governance problem of treating completed software tasks as teaching evidence before model, prompt, screen context, dialogue-act mix, explanation rate, knowledge-check rate, error-diagnosis rate, learner questions, pre/post task transfer, and bad-guidance cases are auditable.
• The AI Label Becomes the Public Record - Jonathan Rystrøm, Chris Schmitz, Nathan Davies, Gerhard Hammerschmid, Albert Meijer, and Chris Russell's A Technical Typology of AI Systems in Public Administration paper, arXiv:2606.31755, cs.CY with cs.AI, submitted June 30 2026, under review, 30-page PDF, University of Oxford, Hertie School, Utrecht University, and Harvard University affiliations, public administration, digital government, system-type specification, hand-coded systems, glass-box systems, black-box systems, general-purpose systems, agentic systems, affordance thresholds, public values, accountability, procedural justice, non-discrimination, privacy, service delivery, OpenAlex literature search, 2019 to 2025 paper window, 91-paper final corpus, strand-level coding, Gemini 3.1 Flash-Lite Preview preliminary extraction, human coder judgments, conservative adjudication, 50 of 91 papers underspecified, 55 percent underspecification rate, 31 percent mischaracterisation rate, 41 percent overgeneralisation rate, black-box systems as most common fully specified empirical category, 11 general-purpose empirical papers, no empirically studied contemporary agentic systems in the corpus, proxy indicators, source-code-independent diagnostic questions, scope limits for past work, conclusion-scope receipts, citation-weighted sample limit, coding-error limit, typology-update limit, and the governance problem of treating "AI" as a sufficient public record before system type, task, input, output, vendor, learned-or-authored logic, inspectability, tool access, local testing, human review, and technical uncertainty are auditable.
• The Persona Swatch Becomes the Design Proxy - Shahreen Salim and Klaus Mueller's When Do LLM Personas Support Visualization Design? A Cross-Model Study of Color Assignment and Chart Choice paper, arXiv:2607.02455, cs.HC, submitted July 2 2026, 5-page PDF, 3 figures, Stony Brook University affiliations, LLM personas, synthetic participants, visualization design, color assignment, chart-idiom preference ratings, Big Five profiles, 43 unique profiles derived from a state-level U.S. personality dataset, Low and Average and High trait categories, GPT-4o-mini, GPT-4.1-mini, GPT-5-mini, concrete concepts Banana and Strawberry and Carrot, abstract concepts Serendipity and Serenity and Chaos, RGB outputs, CIELCH hue histograms, Hellinger distance, Mantel permutation tests, model-configuration dependence, GPT-4o-mini absent coupling across six concepts, GPT-4.1-mini consistent coupling across six concepts, GPT-5-mini partial coupling across two concepts, abstract-concept persona variance, concrete-concept defaults, 12 chart idioms, hierarchy and time-series and comparison contexts, 60 persona-conditioned chart runs, Organized and Stable cluster, Sociable and Cooperative cluster, Emotionally Reactive cluster, Treemap hierarchy choice, Line Chart with Points time-series choice, Radar Chart comparison choice, no-persona baseline recovering 8 of 9 top choices, rating-level modulation, no matched human validation, concept-set limits, lens-based GPT-5-mini variability protocol, persona-design receipts, and the governance problem of treating a synthetic persona's color or chart choice as user evidence before model, prompt, profile source, task context, baseline, aggregation rule, cross-model check, and human calibration are auditable.
• The Reasoning Budget Becomes the Reliability Receipt - Achint Mehta's Reasoning effort, not tool access, buys first-try reliability in agentic code generation: an observational study paper, arXiv:2607.02436, cs.SE with cs.AI, submitted July 2 2026, 22-page arXiv comment, 5 figures, 10 tables, Zenodo dataset and evaluation artifacts DOI 10.5281/zenodo.21134406, Realtime Retrospective Board: AI Model Benchmark Dataset and Evaluation Artifacts, version v2.3.0, agentic coding assistants, first-try reliability, browser-based testing tools, design-oriented prompts, two agent harnesses, two reasoning effort levels, ninety independent agent runs, real-time retrospective board application, detailed specification, fixed 14-criterion functional rubric, 42-point maximum, visual quality review, capability tier, reasoning effort, tool access, prompt surface, first submission scoring, corrective prompts, Playwright-style browser tool, container deployment failures, local development environment failures, visual polish, run-level artifacts, screenshots, per-run rubric files, linked GitHub repository, reproducibility archive, and the governance problem of treating an agent's tool menu as reliability evidence before model, harness, reasoning budget, prompt, tool permission, first submission, repair loop, rubric item outcomes, visual review method, token record, session cost, and artifact archive are auditable.
• The Culture Meter Becomes the Apparatus - Kent K. Chang's Language Models as Measurement Apparatus for Culture paper, arXiv:2607.02459, cs.CL, submitted July 2 2026, 14-page PDF, ACL Anthology ID 2026.bigpicture-main.11, DOI 10.18653/v1/2026.bigpicture-main.11, Big Picture workshop co-located with ACL 2026, Proceedings of The Big Picture v2: Crafting a Research Narrative, pages 131-143, San Diego, CA, USA, School of Information, University of California Berkeley, cultural analytics, language models as cultural measurement apparatus, material-discursive practice, Karen Barad's agential cut, model architecture, training data, annotation categories, evaluation criteria, interpretive commitments, phenomenon-instrument boundary, television and film dialogue, structure measurement, conversation disentanglement, reply-to graph, conversational agency, interaction measurement, conversational role attribution, speaker, addressee, side-participant labels, gendered role patterns, deviation measurement, stereotypic relation extraction, subversion as discrepancy from trained expectations, erasure of cultural markers, anonymized character names, speaker recognition drop from 78.6 to 13.7, addressee recognition drop from 68.1 to 15.7, attunement to Restoration comedy, 1660-1700, Chadwyck-Healey English Drama collection, 109 plays, 1,283 character episodes, Gemini 2.5 Flash label scaling, Cohen's kappa 0.71, roughly 174,000 lines of in-domain dialogue, agentic workflow agency section in the expanded arXiv version, culture-measurement receipts, and the governance problem of treating a model-mediated cultural pattern as evidence before corpus, prior exposure, label taxonomy, annotation rule, prompt, metric, perturbation test, theoretical commitment, and permissible claim are auditable.
• The Policy Loop Becomes the Budget Receipt - Zhilin Wang, Han Song, Runzhe Zhan, Jusen Du, Jiacheng Chen, Tianle Li, Qingyu Yin, Yulun Wu, Zhennan Shen, Tong Zhu, Yanshu Li, Guanjie Chen, Derek F. Wong, Yafu Li, Yu Cheng, and Yang Yang's EvoPolicyGym: Evaluating Autonomous Policy Evolution in Interactive Environments paper, arXiv:2607.02440, cs.AI with cs.CL, submitted July 2 2026, 24-page PDF, autonomous policy evolution, executable policy systems, interactive RL environments, fixed interaction budgets, Core16, 16-environment suite, Gym/Box2D, MuJoCo, MiniGrid, robotics and driving, 128-episode training budget, 16 hidden validation cases, 32 hidden held-out cases, system/policy.py, Policy reset and act interface, local service routes, feedback/submit_NNN artifacts, summary.json, trajectory.jsonl, stdout and stderr, optional videos and observations, live no-rollback workspace semantics, validation-selected checkpoint, held-out mean return, rank-normalized Core16 score, GPT-5.5 through Codex, Claude Opus 4.7 through Claude Code, MiniMax-M3 through Claude Code, DeepSeek-V4-Pro through Claude Code, GPT-5.5 Core16 0.891, nine wins, top-two on all 16 environments, Claude Opus 4.7 Core16 0.750, five wins, 12 top-two placements, MiniMax-M3 0.531, DeepSeek-V4-Pro 0.359, random policy 0.109, structural synthesis, parametric tuning, CarRacing road-mask lookahead, HalfCheetah periodic gait control, ObstructedMaze symbolic mapping and BFS planning, FetchPush geometric phase control, GitHub repository, Hugging Face EvoPolicyGym-Exp-data dataset, companion final-policy rollout gallery, policy-loop receipts, and the governance problem of treating an autonomous agent's final score as evidence before environment split, run instructions, patch sequence, submit list, budget ledger, feedback artifacts, selected checkpoint, held-out result, harness, model, token accounting, repository revision, and dataset revision are auditable.
• The Test Suite Becomes the Co-Evolution Ledger - Jiale Amber Wang, Kaiyuan Wang, and Pengyu Nie's TestEvo-Bench: An Executable and Live Benchmark for Test and Code Co-Evolution paper, arXiv:2607.02469, cs.SE with cs.AI and cs.CL, submitted July 2 2026, 22-page PDF, University of Waterloo and Google affiliations, live executable benchmark, test and code co-evolution, coding agents, test generation, test update, real commit pairs, Java Maven repositories, GitHub Search API mining, environment configuration, build and test execution, cross-revision checks, pass rate, compile status, focal-line coverage, mutation score, JaCoCo, Universal Mutator, timestamped tasks, contamination-aware time filtering, leaderboard and data explorer, 746 test-generation tasks, 509 test-update tasks, 1,961 generation-track methods, 1,138 update-track methods, 59,950 candidate co-evolution records, 152 open-source Java projects, Claude Code, Gemini CLI, SWE-Agent, Claude Opus 4.7, Gemini 3.1 Pro, 77.5 percent test-generation success, 74.6 percent test-update success, redundant passing tests, most-recent-task performance drop, cost-cap performance drop, shallow-oracle warning, test-change receipts, and the governance problem of treating a coding agent's green test as evidence before repository, old revision, new revision, behavior delta, test diff, runner, execution log, coverage, mutation score, timestamp, model cutoff, and cost budget are auditable.
• The Denoising Clock Becomes the Hidden State - Maximo Rulli, Thomas Fontanari, Simone Petruzzi, Federico Alvetreti, Giorgio Strano, Donato Crisostomi, Giorgos Nikolaou, Tommaso Mencattini, Andrea Santilli, Emanuele Rodolà, Simone Scardapane, and Alessio Devoto's Subliminal Clocks: Latent Time Modelling in Diffusion Language Models paper, arXiv:2607.01774, cs.AI with cs.CL, submitted July 2 2026, 23-page PDF, Sapienza University of Rome, EPFL, and independent-researcher affiliations, diffusion language models, DLMs, masked diffusion language models, LLaDA-1.5, Dream, denoising progress, latent timestep representation, residual-stream probes, MLP probes, masked-token and non-masked-token activations, R2 above 0.5 across LLaDA layers, similar Dream probe trends, 100 denoising bins, 3,200 LLaDA mean vectors, 2,800 Dream mean vectors, Pearson 0.976 and Spearman 0.980 for LLaDA, Pearson 0.962 and Spearman 0.974 for Dream, activation-space steering, LLaDA layer 29, Dream layer 25, confidence drift, entropy drift, KL divergence, norm-matched random perturbation baseline, early-layer correction, extreme-target persistence, PCA structure, fewer-than-three-dimensional mean-vector geometry, two-principal-component steering, LLaDA cross-layer alignment except final layer, Dream representation blocks, token-level steering limit, LLaDA and Dream scope limit, arXiv source bundle, no obvious public code repository link found in manuscript materials, denoising-clock receipts, and the governance problem of treating a diffusion-language-model answer as a single final text before prompt, checkpoint, mask schedule, unmasking policy, denoising step count, probe layer, steering intervention, entropy drift, confidence drift, KL drift, token changes, random baseline, and downstream task deltas are auditable.
• The Fuzzy Function Becomes the Neural Binary - Wentao Zhang, Liliana Hotsko, Woojeong Kim, Pengyu Nie, Stuart Shieber, and Yuntian Deng's Program-as-Weights: A Programming Paradigm for Fuzzy Functions paper, arXiv:2607.02512, cs.LG with cs.AI and cs.CL, submitted July 2 2026, 28-page PDF, University of Waterloo, Cornell University, and Harvard University affiliations, fuzzy-function programming, Program-as-Weights, PAW, fuzzy functions, neural compiler, frozen neural interpreter, pseudo-program, text-to-LoRA, parameter-efficient adapters, 4B Qwen3 compiler, Qwen3-4B-Instruct-2507 pseudo compiler, Qwen3 0.6B interpreter, FuzzyBench, 10-million-example synthetic dataset, 29 thematic versions, more than 800 task subcategories, core text processing, search and web intelligence, custom classification, code and natural-language commands, safety and verification, agentic tool use, format repair and validation, log monitoring, malformed JSON repair, intent ranking, local execution, cached neural program, Python and JavaScript API, Qwen3-32B direct-prompting comparison, 73.78 percent versus 68.70 percent FuzzyBench exact match, roughly 50x lower inference memory, 23 MB per-program LoRA adapter, GGUF quantization, MacBook M3 local runtime, 31.6 tokens per second, 0.48-second cold load, image-conditioned compiler swap, case studies, compiler-interpreter coupling, opaque continuous PEFT component, single-step evaluation limit, synthetic-data limit, neural-binary receipts, and the governance problem of treating a compiled adapter as ordinary code before specification, pseudo-program, compiler, interpreter, adapter hash, quantization, benchmark split, failure envelope, local-runtime proof, and rollback rule are auditable.
• The Unlearning Claim Becomes the Localization Test - Matteo Boglioni, Thibault Rousset, Siva Reddy, Marius Mosbach, and Verna Dankers's LACUNA: A Testbed for Evaluating Localization Precision for LLM Unlearning paper, arXiv:2607.02513, cs.CL with cs.AI and cs.LG, submitted July 2 2026, 27-page preprint under review, Mila and McGill University affiliations, McGill-NLP/LACUNA evaluation release, LLM unlearning, synthetic PII, PANORAMA profiles, 1,200 synthetic profiles, email address, birth city, phone number, driver's license, 4.3-billion-token OLMo-2 pretraining-corpus subset, roughly 2 billion QA tokens, masked continual pretraining, six non-overlapping weight masks, 5 percent parameter coverage, OLMo2 1B, OLMo3 7B, LoRA instruction tuning, forget sets, retain sets, ground-truth parameter-level localization, output-level forgetting versus weight-level evidence, localization precision, ROC-AUC, SimNPO, AlphaEdit, MemFlex, OracleGrad, email-address localization AUC 0.500 and 0.500 and 0.515 versus 0.915 for the ground-truth-mask baseline, resurfacing attacks, relearning on held-out PII, 100 forget-set profiles, 200 prompting attempts, model deletion receipts, residual-risk disclosure, and the governance problem of treating an output-level unlearning pass as deletion before data source, model version, method, retain set, utility score, localization evidence, resurfacing test, and residual risk are auditable.
• The Long Context Becomes the Evidence Scaffold - Yanjun Zhao, Ruizhong Qiu, Tianxin Wei, Yuanchen Bei, Zhining Liu, Lingjie Chen, Ismini Lourentzou, Hanghang Tong, and Jingrui He's ReContext: Recursive Evidence Replay as LLM Harness for Long-Context Reasoning paper, arXiv:2607.02509, cs.AI, submitted July 2 2026, University of Illinois Urbana-Champaign, 18-page PDF, long-context reasoning, context access versus context utilization, training-free inference, model-internal relevance signals, query-conditioned evidence pool, recursive evidence replay, full-context preservation, no context pruning, no persistent external memory, associative-memory analysis, context as memory store, question as retrieval cue, attention as cue-trace association, replay as trace reactivation, 128K context length, top 0.1 percent relevance concentration, Natural Questions, TriviaQA, HotpotQA, PopQA, NarrativeQA, InfBench QA, InfBench MC, CLIPPER, Qwen3-4B, Qwen3-8B, Llama3.1-8B, Vanilla prompting, AttnSharp, DySCO, A-MEM, DAC, best average rank across all three backbones, average rank 1.00 on Qwen3-4B, 1.46 on Qwen3-8B, 1.29 on Llama3-8B, mean accuracy improvement from 0.24 to 0.30, 24.6 percent relative gain over Vanilla, 64K robustness check, thinking-enabled Qwen3-4B check, runtime overhead, closed-source API limitation, context-use receipts, and the governance problem of treating a long prompt as evidence use before selected spans, replay rounds, token budget, model, context window, answer grounding, and challenge path are auditable.
• The Safety Monitor Becomes the Alarm Threshold - Mona Schirmer, Metod Jazbec, Alexander Timans, Christian Naesseth, Maja Waldron, and Eric Nalisnick's Online Safety Monitoring for LLMs paper, arXiv:2607.02510, cs.AI with cs.CL, cs.LG, stat.AP, and stat.ML, submitted July 2 2026, ICML 2026 Hypothesis Testing Workshop comment, 12-page PDF, UvA Bosch-Delta Lab at the University of Amsterdam, University of Wisconsin Madison, Johns Hopkins University, public monasch/llm-monitor code repository, online LLM output monitoring, real-time alarm decisions, verifier signals, external safety models, risk control, conformal risk control, high-probability upper-confidence-bound calibration, Hoeffding-Bentkus bound, false alarm risk, missed detection risk, threshold stopping rule, factuality monitoring, MATH dataset, Claude Haiku 4.5, Mistral-7B-Instruct-v0.3, OpenAI o3-mini labels, Qwen2.5-Math-PRM-7B process reward model signal, harmfulness monitoring, Anthropic Red Teaming, FineHarm, Llama Guard, Qwen2.5-1.5B safeguard verifier, e-valuator baselines, detection delay, token log-probability ablation, signal quality versus verifier cost, alarm receipts, and the governance problem of treating a guardrail as safety before generator, verifier, signal definition, threshold, calibration set, target risk, confidence parameter, score path, alarm step, intervention, and review path are auditable.
• The Bash Exam Becomes the Grading Rubric - Manuel Alonso-Carracedo, Ruben Fernandez-Boullon, Pedro Celard, Francisco J. Rodriguez-Martinez, and Lorena Otero-Cerdeira's Automated grading of Linux/bash examinations using large language models: a four-level cognitive taxonomy approach paper, arXiv:2607.02432, cs.AI with cs.CL and cs.CY, submitted July 2 2026, 32-page PDF, Universidade de Vigo and IFCAE affiliations, Linux/bash command-line examinations, Computer Engineering, Operating Systems course, closed-book 90-minute exam, 1,200 real student responses, second-year undergraduate students, 16 independent exercises, controlled shared Linux server environment, three expert instructors, blind independent grading, custom evaluation-management platform, four-level cognitive taxonomy, L1 information retrieval, L2 basic file manipulation, L3 structural operations, L4 advanced system management, GPT 5.2, Claude Opus 4.6, Gemini 3.0 Pro, GLM 5, V1 minimal prompt, V2 rubric-enhanced prompt, human baseline ICC(2,1)=0.949, weighted kappa=0.948, Gemini V2 ICC(3,1)=0.888, MAE=0.100, Bland-Altman bias=-0.014, rubric quality over provider choice, L1-L2 automation boundary, L3-L4 human review, cross-question context failures, path and filename mismatch penalties, assessment receipts, and the governance problem of treating an AI grade as official before taxonomy level, rubric version, prompt, model, accepted variants, prior-question dependency, agreement metrics, bias, and appeal path are auditable.
• The Agency Gain Becomes the Adoption Map - Ian Beacock, Rachel Xu, Laura Murray, Patrick Anson, Beth Goldberg, Devika Kumar, Jun Lee, Rebekah Park, and Anoop Sinha's AI usage patterns are shaped by perceived gains in human agency paper, arXiv:2607.02313, cs.CY, submitted July 2 2026, 17-page preprint, Jigsaw, Google Paradigms of Intelligence, Gemic, Jigsaw (Google) and Google Technology & Society sponsorship, qualitative ethnographic study, April to July 2025 fieldwork, 51 daily AI chatbot users, United States n=18 in New York, Singapore n=19, Germany n=14 in Berlin, ages 18 to 65, 23 men, 28 women, ChatGPT, Gemini, Grok, Perplexity, Microsoft Copilot, Meta AI, ChatGPT primary for 40 participants, digital diary study, in-person semi-structured interviews, direct observations, dyadic interviews, remote follow-up interviews, 315 coded observations, perceived human agency, instrumental agency, cognitive agency, affective agency, relational agency, structural agency, trust frameworks, accuracy and reliability concerns, consequential errors, situational stability, internal conviction, dependency and cognitive atrophy concerns, agency-impact receipts, and the governance problem of treating repeated chatbot use as trust before task domain, user context, claimed agency dimension, material outcome, retained skill, error class, fallback path, and long-term capacity are auditable.
• The Synthetic Contact Becomes the Partisan Bridge - Benjamin Lira, Noah Castelo, Stefano Puntoni, and Olivier Toubia's Synthetic Contact with AI Reduces Cross-Partisan Animosity paper, arXiv:2607.02181, cs.HC with cs.CY, submitted July 2 2026, 32 pages, 6 figures, five preregistered studies, N=3,960 U.S. partisans, draft not peer reviewed, synthetic contact, outgroup-representing chatbots, cross-partisan animosity, affective polarization, outgroup warmth, mortality-reflection aversion task, Study 1 N=608, human outgroup conversation equated with 9.65 minutes of mortality reflection, AI outgroup conversation equated with 5.06 minutes, Study 2 N=500, environmental-policy misperception correction, 10-minute outgroup bot conversation, Study 3 N=679, cats-and-dogs chat control, Space Invaders game control, Study 4 N=1,069, immigration topic, real outgroup conversation choice rising from 61 percent to 67 percent, Study 5 N=1,104, one-week warmth decay, about 21 percent surviving in robustness test, 4,012 bot conversations coded, GPT-5.4-mini content audit, stereotype-disconfirming substance, information more than friendliness, outgroup caricature risk, contact receipts, and the governance problem of treating chatbot contact as civic repair before prompt, model, represented group, calibration source, conversation content, immediate effect, persistence, behavioral transfer, and participant consent are auditable.
• The Reproducible Build Becomes the Decay Test - Denise Nanni, Julien Malka, Stefano Zacchiroli, Théo Zimmermann, and Gabriele d'Angelo's Understanding Build Reproducibility in the F-Droid Ecosystem paper, arXiv:2607.01890, cs.SE, submitted July 2 2026, 2026 ACM Conference on Reproducibility and Replicability, July 20-22 2026, Delft, Netherlands, 12 pages, F-Droid, Android apps, free and open source software, reproducible builds, bitwise reproducibility, rebuildability, software preservation, supply-chain security, F-Droid catalog and reproducibility logs downloaded February 17 2026, 80,139 package-version dataset, 18,904 historically reproducible package versions, September 2018 to February 2026 publication window, legacy-aware rebuild pipeline, 15,831 successful rebuilds, 83.7 percent rebuild success rate, missing dependencies causing around 76 percent of failed packages, missing source code causing around 10 percent of failures, 94 percent of successfully rebuilt package versions still bitwise reproducible, temporal decay, environmental drift, external registries, dependency pinning, historical build environments, rebuildability horizon, and the governance problem of treating a release-time reproducibility check as durable trust before source code, dependencies, base images, toolchains, build logs, metadata, and preservation owners are auditable.
• The Human Capital Becomes the Forecasting Benchmark - Vivienne Ming's Human Capital, Not Model Benchmarks, Predicts Hybrid Intelligence in Forecasting paper, arXiv:2607.02467, cs.CY with cs.AI, submitted July 2 2026, 4 pages, 1 figure, PNAS brief style, The Human Trust, Possibility Science, UCL Global Business School for Health, preprint pilot study, human-AI forecasting, human capital, Polymarket contracts, externally resolved ground truth, 108 adults recruited by flyer in Berkeley, 78 main-study participants, 26 three-person teams, 77 analyzed participants after one excluded out-of-range Brier score, 30 live contracts resolving November 2025 to January 2026, economics, international relations, business, Llama 3.1 8B, Qwen3 8B, GPT-4o, Gemini 3 Pro, scaled Brier score, lower-is-better forecasting error, AI-only baseline 5.5, Polymarket benchmark 3.5, human-only 14.7, Automators 10.4, Validators 31.7, Cyborgs 3.8, perspective-taking, intellectual humility, curiosity, collaborative human capital, raw cognitive ability not predicting hybrid accuracy, small-cell pilot limits, pre-registered replication in preparation, collaboration receipts, and the governance problem of treating model benchmark rank as deployment evidence before user role, interaction style, timestamped forecast, model baseline, human-capital measure, prompt surface, and outcome score are auditable.
• The Financial Benchmark Becomes the Model Selection Dossier - Blair Hudson's Meta-Benchmarks for Financial-Services LLM Evaluation paper, arXiv:2607.01740, cs.AI, submitted July 2 2026, Commonwealth Bank of Australia affiliation, 27 pages, 13 figures, 3 tables, financial-services LLM evaluation, public model leaderboards, 452 publicly reported benchmark identifiers, 41 O*NET Generalized Work Activities, 38 BIAN Service Landscape 14.0 banking business domains, five BIAN business areas, 288 models from 25 organizations as of June 2026, discrimination x coverage x recency weighting, pairwise Elo, work-activity scores, business-domain profiles, MMLU-Pro, document-grounded compliance reasoning, multi-turn customer interaction, public-evidence screening, missing benchmark coverage, only 24 of 41 work activities exercised by public benchmarks, model selection dossier, procurement evidence, privacy, security, legal, risk, compliance, vendor, operational-resilience and human-oversight review, and the governance problem of treating a public leaderboard rank as banking readiness before benchmark snapshot, mapping, stale-score policy, missing-work record, internal test plan, and deployment review are auditable.
• The World Literature Tool Becomes the Model Audit - Nina Begus's World Wide Models: Literary Tools for Cultural AI essay, arXiv:2607.02369, cs.CL with cs.AI, submitted July 2 2026, 15 pages, forthcoming in MFS Modern Fiction Studies in 2027, University of California Berkeley affiliation, cultural AI, literary studies, comparative literature, narratology, critical theory, world literature, translation studies, structural monolingualism, surface monolingualism, synthetic monolingualism, global AI textuality, macrostructure, circulation, untranslatability, literary forms inside AI evaluation, benchmarks as miniature genres, Turing test, scripts, cultural defaults, latent spaces, Moretti, Damrosch, Apter, cultural adequacy, local validators, prompt language, output language, translation path, canon concentration, idioms left untranslated, stereotype checks, cultural receipt, and the governance problem of treating fluent global prose as cultural competence before the model's corpus, genre, language path, translation losses, local context, evaluation method, and untranslatable residue are auditable.
• The Ghost Memory Becomes the State Receipt - Zitong Shi, Yixuan Tang, and Anthony Kum Hoe Tung's A-TMA: Decoupling State-Aware Memory Failures in Long-Term Agent Memory paper, arXiv:2607.01935, cs.AI, submitted July 2 2026, National University of Singapore affiliation, ghost memory, long-term agent memory, changing user facts, old current and transition facts, bank maintenance, state-aware retrieval, answer-time resolution, Adaptive Truth Maintenance Auditing, A-TMA, host memory overlay, superseded records, transition records, state-aligned evidence packets, current historical and transition labels, LoCoMo Temporal Plus, LTP, 10 user profiles, 800 judged probes, LoCoMo long-conversation generalization, 10 samples, 1,986 question-answer pairs, Graphiti/Zep plus A-TMA conflict accuracy improvement from 0.480 to 0.720, temporal F1 improvement from 0.0295 to 0.1705, average F1 improvement from 0.0809 to 0.1556, host-dependent gains, memory receipts, state-view receipts, and the governance problem of treating a persistent assistant's remembered answer as valid before the active record, superseded record, transition record, retrieval packet, state label, model version, judge surface, and requested time state are auditable.
• The Skill Scanner Becomes the Detonation Harness - Zimo Ji, Congying Xu, Zongjie Li, Yudong Gao, Xin Wei, Shuai Wang, and Shing-Chi Cheung's Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware paper, arXiv:2607.02357, cs.CR with cs.SE, submitted July 2 2026, agent skills, public skill marketplaces, third-party skill supply chain, malicious skills, install-time scanner limits, static pattern matching, LLM-as-judge skill audits, SkillCloak, payload-preserving evasion, Structural Obfuscation, Self-Extracting Skill Packing, SFS Packing, eight representative scanners, 1,613 in-the-wild malicious skills, ClawHub and OpenClaw skills archive, Codex and Claude Code utility testing, no statistically detectable utility degradation, SkillDetonate, behavior-centric runtime auditing, controlled sandbox execution, OS-boundary information-flow evidence, on-demand closure lift, marker-based taint analysis, sensitive-data flow across agent context files processes and network operations, SkillJect, MalSkillBench, 96.7 percent SkillJect attack detection at 2 percent false-positive rate, 87.3 percent executable wild-skill detection, Cisco scanner drop from 98.6 percent to 10.1 percent under Structural Obfuscation, scanner hygiene versus trust gates, detonation receipts, and the governance problem of treating a passed skill scan as clearance before file-tree hashes, scanner versions, sandbox image, network egress, mounted secrets, taint markers, process tree, runtime materialized instructions, and source-to-sink flows are auditable.
• The Missing Stop Condition Becomes the Bill - Xinyi Hou, Shenao Wang, Yanjie Zhao, and Haoyu Wang's When Agents Do Not Stop: Uncovering Infinite Agentic Loops in LLM Agents paper, arXiv:2607.01641, cs.SE, submitted July 2 2026, Infinite Agentic Loops, IAL-Scan, static analysis for LLM agent projects, framework-independent Agent IR, Agentic Loop Dependence Graph, feedback paths, model calls, tool calls, workflow transitions, agent handoffs, missing stopping bounds, LangChain, LangGraph, CrewAI, AutoGen, LlamaIndex, OpenAI Agents SDK, Google ADK, Semantic Kernel, 6,549 Python LLM agent repositories, 246,748 Python files, 33.41 million lines of code, 74 potential findings, 68 confirmed IAL failures, 47 affected projects, 91.9 percent precision, 94.6 percent initial reviewer agreement, LangGraph and AutoGen contributing 45 of 68 confirmed findings, retry feedback without bounds, tool-call iteration without bounds, multi-agent chat without turn bounds, 264-project evaluation subset, pure LLM API baseline covering 23 of 68 failures, Codex baseline covering 50 failures but hitting timeout or error limits in 75 projects, 4.2K versus 141.86K token comparison, stop receipts, bound coverage, runtime budgets, state growth limits, and the governance problem of treating an agent loop as useful automation before its continuation controller, stop condition, timeout, retry cap, token budget, state-size guard, tool-call limit, and external side-effect class are auditable.
• The Underspecified Target Becomes the Production Change - Zimo Ji, Zekai Zhang, Congying Xu, Zongjie Li, Yudong Gao, Shuai Wang, and Shing-Chi Cheung's Coding Agents Are Guessing: Measuring Action-Boundary Violations in Underspecified DevOps Instructions paper, arXiv:2607.02294, cs.SE, submitted July 2 2026, PDF title-page author discrepancy with Yujia Tian also listed, UnderSpecBench, coding agents, DevOps tasks, autonomous execution, shell commands, repository changes, operational APIs, action-boundary violations, benign underspecified instructions, 69 incident-grounded task families, documented incidents, CVEs, tool behavior, four DevOps capability domains, nine operational control surfaces, intent clarity, target certainty, blast radius, 2,208 prompt variants, deterministic side-effect state checkers, Safe Success, Wrong Target, OverScope, clarification, refusal, deferment, empty output, OpenCode, Claude Code, Codex, full autonomous execution mode, 55.8 to 67.8 percent of acted runs violating at least one boundary, target underspecification driving Safe Success from 67.9 percent to 8.6 percent and Wrong Target from 9.6 percent to 75.1 percent, blast-radius cues barely changing action propensity, shared runtime control planes reaching 59.8 and 77.2 percent OverScope, Ask-User affordance differences, action receipts, and the governance problem of treating completed DevOps work as safe before target, scope, environment, blast radius, confirmation rule, harness, permissions, state diff, and postcondition are auditable.
• The Assumption Register Becomes the Board Record - Jeroen Janssen's From Battlefield to Boardroom: Strategic Red Teaming as an Epistemic Governance Instrument in the Age of AI technical report, arXiv:2607.01913, cs.CY, submitted July 2 2026, strategic red teaming, AI governance, board-level assumption stress testing, material AI strategy, mission-alignment testing, assumption mapping, dependency stress testing, economic-fragility testing, regulatory-exposure simulation, accountability-boundary testing, operational leverage, transparency reduction, dependency concentration, regulatory liability, accountability-boundary shift, evidence grades, documented tested inferred asserted contradicted unknown assumptions, independence architecture, audit committee commissioning, scope in board minutes, management factual corrections separated from findings, board decision record, approve with conditions, defer, redesign, reject, re-review triggers, validation limits, capture risk, false precision, assumption-register receipts, and the governance problem of treating AI strategy approval as evidence before the load-bearing assumptions, evidence objects, falsification conditions, owners, dependency maps, and accountability boundaries are auditable.
• The Constraint Substrate Becomes the Oversight Rail - Thomas Winninger's Steerability via constraints: a substrate for scalable oversight of coding agents paper, arXiv:2607.02389, cs.AI with cs.CR and cs.SE, submitted July 2 2026, coding-agent oversight, constrained software substrates, enforceable invariants, narrow module boundaries, typed interfaces, immutable data structures, access-control and network limits, small reviewer models, Gemma 4 e4b, roughly 500-line Python codebase, 11 inserted backdoors, syntactic semantic multi-file in-module invariant and global invariant detection levels, unconstrained review, constrained review, docs CLI projections, module summaries, symbol signatures, dataclass fields, docstrings, planned tests-as-examples projection, 200-LoC documentation tool, recall rising from 54.5 percent to 90.9 percent across cells, C2 and C3 both 81.8 percent recall, precision tradeoff, constrained-no-docs precision 88.9 percent, constrained-plus-docs precision 95.7 percent, protocol sensitivity, synthetic-data limit, handcrafted scoring rubric, substrate receipts, and the governance problem of treating generated code review as a prompt-only exercise before constraints, local context, tool versions, reviewed dependencies, model settings, and human escalation are auditable.
• The Skill Pair Becomes the Hidden Intent - Jinwei Hu, Yi Dong, Youcheng Sun, and Xiaowei Huang's SkillFuzz: Fuzzing Skill Composition for Implicit Intents Discovery in Open Skill Marketplaces paper, arXiv:2607.02345, cs.SE with cs.AI and cs.CL, submitted July 2 2026, LLM agents, reusable skills, natural-language instruction documents, open skill marketplaces, co-activated community skills, per-skill audits, implicit intents, plan-then-act agents, plan drift from a skill-free baseline, execution-free fuzzing, structured skill contracts, preconditions, postconditions, modifies sets, invariants, domain scope, abstract action types, extraction confidence, contract embeddings, conflict-prioritized seed pairs, contract-guided Monte Carlo Tree Search, fixed query budgets, SkillsBench full 196-skill library, ten representative tasks, eight planning agents, DS-R1 variants, GPT-family variants, GPT-4o-mini intent extraction and judgment, all-mpnet-base-v2 embeddings, 98 highest-risk flagged co-activations, sandboxed Docker validation, fixed Claude-based executor, 80.6 percent overall execution-trace confirmation, SkillFuzz 116 distinct intents, 90 high-severity cases, random sampling 121 distinct intents but 64 high-severity cases, 41 percent improvement in high-severity discoveries, pairwise coverage not equal to severity coverage, 1,188 discovered intent texts, Audio/Video Side-Effect, Unauthorized Tool Invocation, Covert Resource Creation, Unsanctioned Data Analysis, plan-layer limitations, judge-bias limits, marketplace-size limits, composition-screening receipts, and the governance problem of treating a skill marketplace as safe before skill hashes, extracted contracts, candidate pairs, drift thresholds, novelty thresholds, planner version, judge version, execution traces, runtime permissions, and composition-level side effects are auditable.
• The Off-the-Record Channel Becomes the Agent Audit - Arman Ghaffarizadeh, Danyal Mohaddes, Aliakbar Izadkhah, and Shahriar Noroozizadeh's What LLM Agents Say When No One Is Watching: Social Structure and Latent Objective Emergence in Multi-Agent Debates paper, arXiv:2607.02507, cs.AI with cs.CL, cs.LG, and cs.MA, submitted July 2 2026, LLM agents, multi-agent debates, socially structured settings, public utterances, off-the-record OTR responses, dual-channel evaluation, audience visibility, shared public history, binary stance decisions, role-grounded social relations, promotion decision scenario, political bill endorsement scenario, academic manuscript submission scenario, five relational-context conditions, persona-reinforcing contexts, alignment-inducing contexts, historical framing, future-dependence framing, five debate rounds, ten models, 750 runs, stance divergence, semantic cosine similarity, natural language inference, structured survey responses, emotion analysis appendix, public-OTR divergence, targeted agent alpha, decision divergence rising from 2.8 percent baseline to 39.9 percent under alignment-inducing conditions, cosine self-consistency 0.730 to 0.660, NLI entailment 32.7 percent to 15.3 percent, contradiction 2.1 percent to 19.4 percent, model heterogeneity, Gemini 3.1 Pro, GPT-5.4, Grok 4, GLM-5, Claude Opus 4.6, GPT-OSS-120B, latent objective emergence as output-level pattern not hidden belief claim, LLMAgora reproducibility repository, channel-dependence receipts, and the governance problem of treating one public agent answer as stable decision logic before role, audience, relational pressure, private diagnostic channel, survey schema, semantic comparison, and escalation path are auditable.
• The Context Vault Becomes the Retrieval Gate - Misha Sulpovar, Benn R. Konsynski, Qaish Kanchwala, and Gabe Goodhart's ContextNest: Verifiable Context Governance for Autonomous AI Agents paper, arXiv:2607.02116, cs.AI, submitted July 2 2026, ContextNest, context governance gap, AI-consumable knowledge vaults, retrieval-augmented generation, RAG complementarity, typed Markdown documents, YAML frontmatter, structured metadata, hierarchical stewardship, separation of duties, deterministic set-algebraic selectors, contextnest URI references, version pinning, SHA-256 hash-chained histories, graph-level checkpoints, Model Context Protocol source nodes, audit traces of agent context consumption, point-in-time reconstruction, approved and current and attributable context, stale-version attack, BM25 sparse retrieval, 97 percent versus 93 to 90 percent answer-quality pass rate, about one-third input-token cost, retrieval-determinism experiment, 1,060-document synthesized corpus, deterministic selectors, Jaccard 1.0, dense HNSW nondeterminism on 80 percent of queries, mean Jaccard 0.611, worst-case Jaccard 0.210, core engine, nineteen-command CLI, MCP server, context receipts, and the governance problem of treating retrieved relevance as trustworthy context before source version, steward, approval state, integrity hash, selector, checkpoint, and consumption trace are auditable.
• The Safety Case Becomes Executable - Yunhao Feng, Ruixiao Lin, Ming Wen, Qinqin He, Yanming Guo, Yifan Ding, Yutao Wu, Jialuo Chen, Yunhao Chen, Xiaohu Du, Jianan Ma, Zixing Chen, Zhuoer Xu, Xingjun Ma, and Xinhao Deng's Safety Testing LLM Agents at Scale: From Risk Discovery to Evidence-Grounded Verification paper, arXiv:2607.01793, cs.AI, submitted July 2 2026, Vera, LLM agent safety testing, computer-use agents, autonomous tool use, software-engineering testing principles, literature-driven risk exploration, taxonomies of safety risks and attack methods and tool execution environments, executable safety cases, concrete safety goals, programmatically constructed initial state, deterministic verification predicates, observable artifacts, adaptive control agent, isolated Docker Compose sandboxes, MCP middleware gateway, OpenClaw, Hermes, Codex, Claude Code, Mailpit, Gitea, Blnk, Databag, SearXNG, 72 MCP tool functions, Vera-Bench, 1,600 executable base scenarios, 124 leaf-level risk categories, 77 attack methods, 30 environment categories, benign and single-channel and multi-channel settings, 90.6 percent single-channel execution success rate, 93.9 percent multi-channel execution success rate, environment-state verification, tool-call evidence, replayable safety records, guard-model downstream experiment, source repository, and the governance problem of treating an agent refusal or final answer as safety evidence before the initialized state, tool logs, environment diff, verifier code, and replay path are auditable.
• The Agent Dependency Graph Becomes the Audit Map - Shenao Wang, Xinyi Hou, Yanjie Zhao, Xiao Cheng, and Haoyu Wang's AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs paper, arXiv:2607.01640, cs.SE with cs.CR, submitted July 2 2026, LLM agent programs, source-code agent applications, framework-defined semantics, agent constructors, tool decorators, hosted tool objects, handoff declarations, workflow commands, session objects, OpenAI Agents SDK, LangChain/LangGraph, CrewAI, LlamaIndex, Semantic Kernel, Agent Dependency Graph, typed nodes for agents, prompts, models, capabilities, memory states, and control policies, component-dependency edges, control-flow edges, data-flow edges, Agent Bill of Materials generation, prompt-to-tool risk detection, AgentZoo, 5,399 real-world agent programs, 143 supported framework constructs, 2,295 Agent BOM components, 1,008 binding relationships, 238 prompt-to-tool risk projects, 4,357 findings, 73.0 percent manual-sample precision, static-analysis over-approximation, framework-evolution limits, ADG receipts, and the governance problem of treating an agent repository as ordinary code before its prompts, tools, memory, handoffs, policies, privileged capability paths, and dependency graph are auditable.
• The AI Answer Becomes the Practice Receipt - Yang Zhao, Yingshuo Li, and Zeyu Zhang's A Practice Auditing Framework for Large Language Model Use: Collective Empiricism, Pseudo-Rational Cognition, and Governance of AI-Generated Content paper, arXiv:2607.01248, cs.CY with cs.AI, v1 recorded June 2 2026, LLM use, AI-generated content governance, practice auditing, collective empiricism, pseudo-rational cognition, structured expression versus practical understanding, requirement definition, problem-boundary identification, evidence-source auditing, practical validation, reverse questioning, logs, version management, rollback mechanisms, renewed cognition, subjectivity illusion, subjectivity structures in input materials, long-term memory, retrieval spaces, agent skill systems, skill debt, AI-AI conversation loops, AIGC detection, statistical misjudgment, designability, traceability, intervention, practice receipts, and the governance problem of treating a polished AI answer as understanding before evidence, conditions, validation, revision history, and rollback are auditable.
• The Persistent Codebase Becomes the Control Surface - Josh Hills, Ida Caspary, and Asa Cooper Stickland's Distributed Attacks in Persistent-State AI Control paper, arXiv:2607.02514, cs.AI, submitted July 2 2026, AI control, coding agents, persistent codebases, iterative pull requests, Iterative VibeCoding, CLI tools, Flask web services, twenty task variations, committed code and git history as cross-session state, Claude Sonnet 4.5 attack agent, GPT-4o monitor, Gemini 3.1 Pro and Kimi K2.5 attack-agent checks, diff monitors, trajectory monitors, honest-baseline 98th-percentile calibration, gradual attacks, non-gradual positional attacks, hidden side tasks, monitor evasion, no single monitor robust to both attack strategies, weakest standard diff monitor 93 percent gradual-attack evasion, task-description diff monitor 87 percent gradual-attack evasion, stateful link-tracker monitor 54 percent gradual-attack evasion, four-monitor ensemble 47 percent gradual-attack evasion, cross-PR suspicious buildup, monitor-written notes, pull-request sequence receipts, and the governance problem of treating each PR as independently reviewable before repository state, agent edits, monitor state, thresholds, trajectories, and accumulated capability paths are auditable.
• The Consensus Bridge Becomes the Manipulation Surface - Nikil Roashan Selvam, Jay Baxter, Sophie Hilgard, Brad Miller, Keith Coleman, Ellen Vitercik, and Sanmi Koyejo's Gaming Consensus: Coordinated Manipulation in Crowdsourced Fact-Checking paper, arXiv:2607.01824, cs.LG, ICML 2026, submitted July 2 2026, crowdsourced fact-checking, Community Notes-style bridging systems, X, Meta, TikTok, Google adoption context, matrix factorization, latent user and note factors, cross-perspective support, coordinated manipulation, synthetic consensus, two-phase adversarial rating strategy, historic production data, up to 10.7 percent of lower quality notes manipulated above consensus thresholds with fewer than ten ratings, counterintuitive Not Helpful rating geometry, manipulation resistance score, cost model, population sample filtering, deployed X Community Notes mitigations, simulated experiments using official open-source code, no live-platform note manipulation, bridge receipts, algorithm versions, rating windows, contributor eligibility, safeguards, status timelines, post-publication correction trails, and the governance problem of treating a consensus label as public evidence before the model, thresholds, solicitation path, anti-abuse components, audit data, and claim boundary are inspectable.
• The Live Benchmark Becomes the Update Receipt - Yuanzhi Liu, Shousheng Zhao, Bo Zhou, Kongming Liang, and Zhanyu Ma's MMBench-Live: A Continuously Evolving Benchmark for Multimodal Models paper, arXiv:2607.01813, cs.CV with cs.AI, submitted July 2 2026, DOI 10.48550/arXiv.2607.01813, vision-language model evaluation, continuously evolving multimodal benchmarks, multi-agent-driven automated construction, structured benchmark descriptions, evaluation purpose, evaluation format, task hierarchy, atomic tasks, task-related visual patterns, Google Image API retrieval, Flickr API retrieval, one-year image window, feedback-controlled query refinement, generated QA pairs, executable solution plans, vision-blind verification controller, tool-supported reasoning, 5.9K newly generated evaluation instances, 96.06 percent manual answer correctness, one-to-two-hour updates, about 30 dollars per update, DeepSeek-VL, InstructBLIP, LLaVA, mPLUG-Owl2, Qwen3-VL, Qwen2.5-VL, PaCoST contamination-proxy analysis, cross-version ranking stability, limitations around implicit visual memorization and foundation-model-bounded construction quality, and the governance problem of treating a live leaderboard as fresh evidence before its source window, task template, retrieval trace, verifier trace, construction cost, manual audit sample, drift checks, and contamination proxy are auditable.
• The Forecast Explanation Becomes the Markov Receipt - Amadeo Tunyi's Global Explanations for Multivariate Time Series Forecasting Models via K-Order Markov Approximations paper, arXiv:2606.27599, cs.LG, submitted June 25 2026, DOI 10.48550/arXiv.2606.27599, KARMA, explainable AI for multivariate time-series forecasting, K-order Markov surrogate models, predictively sufficient history length K, discretized history space, transition kernels, five-level global explanation hierarchy, variable importance, lag profiles, distinctive regimes, interventional effects, model-induced causal graph, uncertainty reporting, Beijing PM2.5 case study, ETTh1 and Exchange Rate benchmarks, GRU, LSTM, and TCN models, comparisons with TimeSHAP, WinIT, Dynamask, Feature Occlusion, and Integrated Gradients, certified-zero attribution beyond retained lags, marginal-kernel scaling limits, coverage maps, faithfulness assumptions, and the governance problem of treating a forecast explanation as audit-grade evidence only when the retained history, state construction, transition estimator, tolerance, baseline, uncertainty, and claim boundary travel with it.
• The Web Agent Row Becomes the Receipt - Minbyul Jeong's Ko-WideSearch: A Korean Breadth-Search Benchmark for Exhaustive Set Enumeration by Web Agents paper, arXiv:2606.27595, cs.CL, submitted June 25 2026, DOI 10.48550/arXiv.2606.27595, Korean web agents, breadth search, exhaustive set enumeration, table completion, 228 tables, 190 set-parent entities, sixteen categories, three difficulty tiers, 4,262 gold rows, 14,560 attribute cells, table width knob, 2-D composite key, Item-F1, Column-F1, Row-F1, table success, normalization-aware comparator, synthesize-and-verify pipeline, non-memorizability gate, completeness gate, cross-source attribute verification, volatile as-of dates, live Korean web search, twenty web-agent systems, GPT-5.5 Item-F1 92.8 versus Row-F1 53.7, table success 19.3 percent, DeepSeek-V4-Pro Row-F1 45.0, Korean-specialized model gap, more search and spend not closing the row gap, MIT pipeline and scorer, evaluation data by request, sports-season-heavy hard tier limitation, row receipts, cell provenance, and the governance problem of treating a browser agent's plausible table as complete before membership keys, required columns, source URLs, row matches, missing-cell conventions, metrics, search traces, as-of dates, and human review are auditable.
• The Agent Action Becomes the State Signal - Andres Enriquez Fernandez and John J. Bird's Training Observable Control Policies to Expose Agent State Through Actions paper, arXiv:2606.27609, cs.LG with eess.SY, submitted June 25 2026, Journal of Aerospace Information Systems 2026, related DOI 10.2514/1.I011654, observable control policies, action-based state estimation, limited communication, autonomous agents, multiagent coordination, observer-controller structure, control policy output as measurement, pseudocontrol actions, reinforcement learning, embedded estimator reward, task-only reward comparison, Unscented Kalman filter, UKF, aircraft goal point tracking, fixed-wing UAS, bank-angle control, 14,500 episodes, 21.77 meter versus 12.15 meter position-error norm at 200 seconds, 44.2 percent decrease, 4.33 versus 2.94 meters per second velocity-error norm, 32.1 percent decrease, 80th-percentile task reward 80.1 versus 79.1, stripped observability matrix, sequence-level observability, human-machine teaming limits, state-estimation receipts, and the governance problem of treating agent behavior as task success before policy version, observable state variables, exposed action variables, estimator assumptions, reward terms, task penalty, divergence rate, and authorized readers of the state signal are auditable.
• The Solver Route Becomes the Decision Receipt - Chuanhao Li, Xiaoan Xu, Dirk Bergemann, Ethan X. Fang, Yehua Wei, and Zhuoran Yang's COOPA: A Modular LLM Agent Architecture for Operations Research Problems paper, arXiv:2606.27611, cs.LG, submitted June 25 2026, DOI 10.48550/arXiv.2606.27611, COOPA, COoperative OPerations Agent, operations research decision support, LLM optimization agents, structured optimization formulations, variables, parameters, objectives, constraints, source traceability, element-level provenance, confidence explanations, iterative confidence-based modeling, max-min selection, k=3 candidate formulations, multi-solver dispatch, manager agents, optimizer agents, Pyomo, GLPK, IPOPT, Google OR-Tools, pymoo, general Python, ComplexLP, IndustryOR, BWOR, eight LLM backbones, four agentic baselines, best macro-average on six of eight backbones, GPT-5.2 70.6 percent, GPT-5 69.4 percent, Gemini-3-Flash 68.4 percent, ablation 61.8 percent to 64.8 percent, 91.1 percent mathematical-optimizer routing limit, COOPA repository artifacts, generated solver code, decision-support receipts, and the governance problem of treating an optimization answer as authoritative before formulation, source spans, rejected candidates, solver route, generated code, execution log, feasibility status, timeout status, and human review are auditable.
• The Superseded Memory Becomes the Agent Liability - Vedant Patel's Supersede: Diagnosing and Training the Memory-Update Gap in LLM Agents paper, arXiv:2606.27472, cs.CL with cs.AI and cs.LG, submitted June 25 2026, DOI 10.48550/arXiv.2606.27472, Supersede, memory-update gap, supersession, temporal fact-currency, LongMemEval knowledge-update subset, bounded self-maintained memory, raw sessions never re-fed, full context versus bounded memory, gpt-5.4 92 percent to 77 percent, 24x conversation-length study, 68 percent to 28 percent, proportional memory no recovery, verifiers, prime-rl, GRPO, Qwen2.5-3B, held-out supersession accuracy 9.0 percent to 16.7 percent, Apache-2.0 project repository, memory receipts, stale-fact liability, and the governance problem of treating agent memory as personalization before current value, superseded value, source session, update rule, retention boundary, correction path, and stale-use evidence are auditable.
• The Entropy Trace Becomes the Agent Behavior Receipt - Olasimbo Ayodeji Arigbabu's Entropy-Based Observability for AI Agent Behavior paper, arXiv:2606.05872, cs.AI, submitted June 4 2026, revised June 24 2026, DOI 10.48550/arXiv.2606.05872, Entropy-Based Observability for AI Agents, EOA, trace-derived behavioral telemetry, action entropy, trajectory entropy, tool entropy, information gain, outcome entropy, ordered agent traces, AgentRun trace contract, EntropyObserver, ObservabilityReport, JSON and JSONL loaders, generic event recorder, LangChain adapter, Google ADK adapter, controlled workload, 72 normalized runs, Learning Roadmap Agent study, entropy-agent-eval implementation package, agent behavior receipts, and the governance problem of treating task success, reward, cost, and latency as enough before action diversity, tool concentration, uncertainty reduction, outcome stability, trace quality, and review thresholds are visible.
• System 0 Becomes the Cognitive Border - Marianna Bergamaschi Ganapini, Massimo Chiriatti, Enrico Panai, and Giuseppe Riva's Before You Think: System 0, AI-Mediated Cognition and Cognitive Colonization paper, arXiv:2606.13658, cs.AI, submitted June 11 2026, DOI 10.48550/arXiv.2606.13658, CC BY-NC-SA 4.0 arXiv license metadata, conceptual AI cognition paper, Tri-System Theory, System 3, cognitive surrender, Thinkframes, AI-mediated cognitive ecologies, System 0, extended mind, AI-mediated cognition, cognitive extension, computational level, psychological level, epistemic level, anticipatory personalization, adaptive invisibility, automation of relevance judgment, AI Overviews, Google Search, Google Maps, Waze, writing assistance, AI ghostwriter effect, wearable platforms, Apple Watch, Fitbit, Oura, interoceptive offloading, GPS-induced disorientation, vocabulary narrowing, creative-output homogenization, automation bias, algorithmic feeds, recommendation systems, ideological clustering, persistence after removal, super-human bias amplification, comfort-growth paradox, cognitive colonization, constitutive integration, downstream incorporation, exogenous directional governance, opacity, reflective endorsement, misaligned optimization criteria, engagement maximization, comfort, frictionlessness, algorithmic intuition, proprietary optimization criteria, black-box models, breakdown testing, infrastructural inversion, pre-reflective AI mediation, cognitive border receipts, recommendation receipts, personalization receipts, opt-out effects, suppressed alternatives, inspectability, contestability, and the governance problem of treating a personalized AI surface as harmless assistance before its ranking objectives, behavioral inputs, memory scope, interface defaults, recommendation logic, engagement metrics, source omissions, user controls, and persistence effects are auditable.
• The Agent Environment Becomes the Discovery Lab - Amy Xin, Jiening Siow, Junjie Wang, Zijun Yao, Fanjin Zhang, Jian Song, Lei Hou, and Juanzi Li's EurekAgent: Agent Environment Engineering is All You Need For Autonomous Scientific Discovery paper, arXiv:2606.13662, cs.AI, cs.CL, submitted June 11 2026, revised June 12 2026, DOI 10.48550/arXiv.2606.13662, Tsinghua University, Renmin University of China, environment engineering, autonomous scientific discovery, metric-driven research tasks, Claude Code CLI agent, GLM-5.1, off-the-shelf CLI agents, Prepare Propose Implement loop, R rounds, P parallel implement sessions, hidden evaluation script, submission-format specification, optional initial code, secure evaluation service, permissions engineering, bounded execution, isolated evaluation, Docker agent container, grader container, hidden_eval_dir mounted only into grader container, protected official result files, same-round isolation, GPU default-deny, artifact engineering, filesystem and Git collaboration, proposal manifests, preparation summaries, hypotheses, solution code, evaluator feedback, ranked solution history, web-search history, budget engineering, time and API cost budgets, passive deadline warnings, cost-limit abort, resumable runs, persisted session IDs, human-in-the-loop engineering, terminal UI, web monitor, score evolution, transcripts, Circle Packing 2.635999 versus previous AI best 2.635986, Erdos minimum overlap 0.380870 versus previous AI best 0.380876, first autocorrelation inequality 1.502861 versus previous AI best 1.502863, TriMul 2005.03 microseconds, local A100 evaluation caveat, MLE-Bench Lite seven-task subset, 85.71 percent any-medal rate, 71.43 percent gold-medal rate, less than $11 API cost for 26-circle packing, THU-Team-Eureka/EurekAgent code and results repository, AGPL-3.0 license, evaluator contract grade_submission and is_better, invalid submissions impossible scores, discovery receipts, and the governance problem of treating an autonomous agent score as scientific progress before problem statement, evaluator boundary, metric, artifact history, tool access, budget, container image, transcripts, intervention log, repository revision, and local leaderboard caveats are auditable.
• The Scholar Graph Becomes the Agent Memory Layer - Zongsheng Cao, Bihao Zhan, Jinxin Shi, Jiong Wang, Fangchen Yu, Zhijie Zhong, Zijie Guo, Tianshuo Peng, Zhuo Liu, Yi Xie, Xiang Zhuang, Shengji Tang, Yue Fan, Runmin Ma, Shiyang Feng, Xiangchao Yan, Anran Liu, Peng Ye, Wenlong Zhang, Shufei Zhang, Chunfeng Song, Fenghua Ling, Jie Zhou, Liang He, Bo Zhang, and Lei Bai's Agents-K1: Towards Agent-native Knowledge Orchestration paper, arXiv:2606.13669, cs.AI, submitted June 11 2026, revised June 29 2026, DOI 10.48550/arXiv.2606.13669, Shanghai Artificial Intelligence Laboratory, East China Normal University, Fudan University, agent-native knowledge orchestration, research agents, scientific knowledge graphs, Scholar-KG, General-KG, GraphAnything CLI, Model Context Protocol, MCP, tri-source retrieval, web search, multimodal graph retrieval, cross-document network traversal, full-paper parsing, MinerU-based PDF parsing, semantic anchors, figures tables equations as first-class evidence, five-module schema, Module A metadata and factual entities, Module B textually mentioned entities, Module C implicit abstracted entities, Module D citation intent relationships, Module E durable knowledge relations, citation lineage, method lineage, evidence spans, confidence scores, 2.46 million scientific papers, six disciplines, computer science, chemistry, biology, earth science, physics, materials, one-million-paper Scholar-KG subset, SCP full graph endpoint, 4B information extraction backbone, Qwen3-4B-Instruct-2507, GRPO, rule-based reward, IEPile, named entity recognition, relation extraction, structured JSON extraction, 10 NER and RE benchmarks, average F1 0.5316 to 0.5647, Qwen3-8B average 0.5382, Qwen3-32B average 0.5746, relation extraction gap, geoscience graph, 114 surveys, 7,219 cited papers, 602,132 nodes, 609,812 edges, GPT-5.2 rationale and answer improvements, Gemini-3 rationale and answer improvements, FrontierScience-Research Gemini-3 7.9 to 24.6 overall, GPT-5.2 25.2 to 39.4 overall, HotpotQA 63.50 and 67.80, 2WikiMultiHopQA 67.10 and 64.80, MuSiQue 31.10 and 36.20, LLM-as-judge protocols, DeepSeek-V3, GPT-5.2, GPT-4o-mini, InternScience/GraphAnything MIT license, InternScience/Agents-K1-LLM Apache-2.0 model card, Hugging Face Scholar-kg dataset access boundary, graph receipts, and the governance problem of treating a generated scholar graph as agent memory before parser version, schema version, extraction model, evidence spans, confidence calibration, dataset license, graph version, retrieval weights, judge prompt, and failure messages are auditable.
• The Reanalysis Agent Becomes the Reproducibility Screen - Tobias Holtdirk, Pietro Marcolongo, Anna Steinberg Schulten, Felix Henninger, Stefan Rose, Sarah Ball, Bolei Ma, Frauke Kreuter, Markus Weinmann, and Stefan Feuerriegel's Automated reproducibility assessments in the social and behavioral sciences using large language models paper, arXiv:2606.13670, cs.AI, submitted June 11 2026, revised June 25 2026, DOI 10.48550/arXiv.2606.13670, SCORE project, Multi100, social and behavioral sciences, psychology, economics, political science, LLM reanalysis, agentic reproducibility assessment, automated reproducibility audits, Claude Opus 4.7, GPT-5.5, GLM-5.1, Inspect AI, OpenRouter, Docker sandbox, focal empirical claims, original datasets, full paper condition, no methods condition, abstract-only condition, five independent runs, structured JSON submission, test statistic, degrees of freedom, sample size, p-value, conclusion, dependent variable, main predictor, operationalization notes, Cohen's d conversion, strict +/-0.05 tolerance, broad +/-0.20 tolerance, 180 published studies, 169 valid effect-size estimates, 11 invalid studies, 80 percent qualitative conclusion match, 24 percent strict effect-size recovery, 50 percent broad recovery, invalid-counted 22 and 47 percent, human benchmark subset 84 papers, 82 valid LLM comparisons, LLM strict 40 percent versus human 28 percent, broad 65 percent versus human 66 percent, qualitative conclusion 95 percent versus human 83 percent, original-effect correlation r=0.46, human-effect correlation r=0.11, full no-methods abstract strict rates 24 24 22 percent, broad rates 50 52 46 percent, prompt perspective neutral confirmatory critical, memorization probe 14 recalled papers and zero recalled Cohen's d values within strict or broad tolerance, data availability, OSF SCORE data, GitHub tobihol/agentic-reproducibility, MIT license, GUIDE-LLM checklist, eval_export.csv, reproducibility-screen receipts, and the governance problem of treating an automated reanalysis as a first-pass audit screen before paper version, focal claim, data path, context condition, model, prompt, sandbox, generated code, scorer, conversion rule, invalid-run handling, conclusion vote, cost cap, repository revision, and licensing constraints are auditable.
• The Refusal Subspace Becomes the Safety Switch - Elisabetta Rocchetti and Alfio Ferrara's Refusal Beyond a Single Direction: A Preliminary Comparison of Diff-in-Means and INLP paper, arXiv:2606.13720, cs.AI, Department of Computer Science Universita degli Studi di Milano, refusal steering, safety fine-tuned chat models, residual stream, Difference-in-Means, DiM, Iterative Nullspace Projection, INLP, activation addition, ActAdd, directional ablation, nullspace projection alpha=1, counterfactual flipping alpha=2, concept erasure, rowspace, nullspace, harmful activations, harmless activations, Arditi et al. 2024, linear representation hypothesis, contrastive activations, tunable subspace size k, k=n, k0.9, k0.8, layer and token position selection, composite selection score, KL penalty, five open-weight chat models, Gemma 2B-IT, Qwen 1.8B-Chat, Yi 6B-Chat, Llama-2 7B-Chat, Llama-3 8B-Instruct, AdvBench, MaliciousInstruct, TDC2023, HarmBench, Alpaca, JailbreakBench 100 harmful instructions, ten harm categories, 100 harmless Alpaca instructions, The Pile, MMLU 500-question stratified sample, ARC-Challenge, LlamaGuard 2, Qwen2.5-14B-Instruct refusal judge, greedy 256-token completions, substring matching, non-refusal harmful, unsafe harmful, refusal harmless, median perplexity, MMLU+ARC, Table 1 Llama-3 directional ablation +0.95 and counterfactual flip +0.96 non-refusal harmful, Llama-2 counterfactual flip k0.8 +0.76, Qwen k=n failure and k0.8 recovery, ActAdd harmless-refusal injection degeneracy, looping completions, k0.8 near-baseline perplexity, activation geometry, PCA harmful-harmless centroid axis, absence-of-concept versus concept-opposite, target centroid fit, alpha=1 absence region, alpha=2 opposite-class reflection, selection scores computed with nullspace projection, anonymous 4open code artifact, no explicit artifact license line found, CC BY-NC-SA 4.0 arXiv HTML notice, safety-switch receipts, and the governance problem of treating refusal as an invisible runtime switch before model checkpoint, contrastive data, layer, token position, operator, coefficient, k, decoding, refusal metrics, judge disagreement, benign refusal cost, capability deltas, artifact revision, and dual-use limits are auditable.
• The World Canvas Becomes the Application Runtime - Jory He's YeasierAgent: Agentic Social Sandbox as a Canvas for Intent-Driven Creation of Platform-Agnostic Symbiotic Agent-Native Applications paper, arXiv:2606.13722, cs.AI, cs.MA, Yeasier AI, www.yeasier.com, Symbiotic Agent-Native Applications, agent-native applications, social sandbox, narrative worlds, scene-aware interaction, platform-agnostic interactive units, agents, scenes, dialogue, cross-platform construction, companion-tool unification, persistent digital twin agents, long-term memory, user preferences, professional background, prior conversations, images, domain-specific materials, vector-stored memory, Big Five personality traits, Extraversion behavioral controller, Conscientiousness autonomy constraints, contextual agent dialogues, spatial interactions, natural-language rules, tripartite ontology, World Sandbox, Symbiotic Agents base layer, Creation Apps superstructure, scene-mapped observability, workflow phases research planning execution review completion, OpenClaw-compatible local assistant, declarative generation, orchestrated generation, multi-agent collaboration, multi-user collaboration, public application circulation, user-created worlds, shared appearances, agent identity, achievements as persistent social artifacts, social entry approval, world governance, trust moderation public sharing, private memory versus public appearance separation, visitor links, creator rewards, applications as cultural objects, Case 1 local workflow companion, Case 2 three-agent social deduction game, Case 3 dynamic interactive drama, live platform endpoint, LLM inference dependence, network-condition dependence, device hardware demand, no public code repository or dataset link found, arXiv source package, manuscript AI drafting disclosure, Yeasier AI copyright statement, world-runtime receipts, and the governance problem of treating an emotionally continuous companion world as an application runtime before memory provenance, role boundaries, tool authority, public sharing, moderation, consent, revocation, device rendering, model dependency, and artifact status are auditable.
• The Dashboard State Becomes the Query Contract - Jisoo Jang and Wen-Syan Li's TwinBI: An Agentic Digital Twin for Efficient Augmented Interactions with Business Intelligence Dashboards paper, arXiv:2606.13731, cs.AI, cs.MA, agentic business intelligence, BI dashboards, dashboard state, executable BI twin, LLM agent twin, natural-language analytics, dashboard manipulation, semantic grounding, provenance tracking, unified interaction log, Streamlit, Apache Superset, FastAPI, Cube, DuckDB, Docker, Playwright browser agent, gpt-5-mini, 30 interaction steps, retail sales dashboard, product store date dimensions, 30 analytical queries, five task families, direct database queries, Cube API queries, dashboard-level queries, exact-match accuracy 43.33 percent to 63.33 percent, partial-credit accuracy 48.33 percent to 70.83 percent, average steps 16.47 to 6.90, timeout rate 40.00 percent to 10.00 percent, invalid action rate 10.93 percent to 0.00 percent, loop query rate 36.67 percent to 27.59 percent, loop step rate 29.76 percent versus 39.13 percent, Q14 QoQ slot-filling, Q17 Mobile Marketing QoQ growth, five-participant within-subjects usability study, S1 North district store task, S2 product pricing task, S3 category growth task, task accuracy 100 and 73.33 and 100 percent, insight accuracy 80 and 100 and 80 percent, average clicks 6.4 and 34 and 49, average chats 0.6 and 6 and 5.2, perceived difficulty 1.8 and 3.4 and 4.2, NASA-TLX, Kendall W 0.62 p less than 0.01, /insights command, Hierarchy Schema Graph, SQL inspection, schema explorer, simonjisu/TwinBI code and dataset repository, experiments/queries query_01 to query_30, answers.json, dashboard-only runner vision_playwright_strict.py, TwinBI runner vision_playwright_strict2.py, run_query_batch.py, Python 3.12, uv, OPENAI_API_KEY, no explicit GitHub license metadata found, BI answer-state receipts, and the governance problem of treating a fluent dashboard answer as business evidence before active filters, chart state, semantic model, SQL, action log, screenshots, tool calls, model, step budget, gold answer, repository revision, and license status are auditable.
• The Local Filter Becomes the Collapse Engine - Xinbao Qiao, Xianglong Du, Wei Liu, Jingqi Zhang, Peihua Mai, Meng Zhang, and Yan Pang's When Sample Selection Bias Precipitates Model Collapse paper, arXiv:2606.13732, ICML 2026, PMLR 306, model collapse, recursive synthetic-data training, data selection, sample selection bias, low-resource verification, data silos, healthcare consortia, proprietary financial institutions, local references, tail mode pruning, confirmation-bias filtering, Replace paradigm, Accumulate paradigm, Accumulate-Subsample paradigm, top-alpha selection, local target u*, covariance collapse, power-law diversity decay, Tr(Sigma_bar_t)=O(t^-psi), Wasserstein discrepancy, Theorems 1-6, Wasserstein-gradient selection, calibrated dual potentials, collaborative geodesic interpolation, Wasserstein barycenter, monotone submodular maximization, 1 - 1/e greedy guarantee, DPOT, epsilon=1.0 sensitivity check, CIFAR-10, STL-10, CelebA, DDPM, Inception-V3 FID precision recall, ExDir(1,0.1), 10 clients, n=50,000 initial generator, N=4n generated candidates, Table 1 Scheme I CIFAR-10 FID 71 precision 0.60 recall 0.58, STL-10 FID 65 precision 0.66 recall 0.71, CelebA FID 69 precision 0.69 recall 0.71, Scheme II CIFAR-10 FID 85, STL-10 FID 69, CelebA FID 75, Airplane local reference homogenization, Llama-2-7B XLSum topic-local verifier, ROUGE local selection below random on held-out topics, Ubuntu 20.04.2, dual Intel Xeon Gold 6442Y CPUs, 8 NVIDIA L40 48GB GPUs, XinbaoQiao/When-Sample-Selection-Bias-Precipitates-Model-Collapse code and results repository, no explicit GitHub license metadata found, synthetic-data selection-bias receipts, and the governance problem of treating a local quality filter as a global coverage guarantee before reference distribution, partition rule, verifier metric, retained-tail modes, proxy construction, random baseline, generated artifacts, compute, code revision, and license status are auditable.
• The Receptivity Index Becomes the Adoption Margin - Hristo Inouzhe Valdes's AI Receptivity or AI Adoption Breadth? A Tool-Specific Reanalysis of the Lower-Literacy/Higher-Usage Link paper, arXiv:2606.13734, on AI literacy, AI receptivity, AI adoption breadth, Study 3 reanalysis, Tully Longoni Appel 2025, Amazon Mechanical Turk N=401, ResearchBox #1491, public Study 3 data, SC0 17-item AI literacy score, five-point usage frequency, Never to Weekly, digital image generators, DALL-E, productivity tools, Zapier, design or website tools, Canva, health apps, Headspace, writing assistants, ChatGPT, ordinal Likert responses, OLS, binary logit, ordered logit, proportional odds, multinomial logit, participant-level averages, item-level data, task fixed effects, heteroskedasticity-robust HC3 standard errors, statsmodels, demographic-adjusted controls, age, income, general knowledge, motivation for autonomy, male gender, technology readiness robustness controls, N=379 missing technology readiness, standardized covariates, pooled five-tool OLS beta_hat -0.181 p .001, pooled ordered logit beta_hat -0.307 p less than .001, pooled binary midpoint beta_hat -0.320 odds ratio 0.73, pooled binary adoption beta_hat -0.330 odds ratio 0.72, text AI ordered logit beta_hat -0.090 SE 0.104 p .387, text AI adoption odds ratio 0.94, non-text ordered logit beta_hat -0.377 SE 0.063 p less than .001, non-text binary adoption beta_hat -0.388 odds ratio 0.68, non-text frequent-use odds ratio 0.67, predicted never-used probability text 0.27 to 0.35 from z -2 to z +2, predicted never-used probability non-text 0.50 to 0.82, robustness non-text ordered logit beta_hat -0.502 p less than .001, robustness non-text adoption odds ratio 0.61, robustness text ordered logit beta_hat -0.290 p .010, robustness text adoption p .100, general AI receptivity versus text AI usage intensity versus non-text AI adoption breadth, construct validity, post hoc decomposition, correlational self-report limit, HristoInouzhe/AI-use-vs-AI-literacy code and data repository, S3_data.xlsx, run_experiments.py, tully_ai_literacy_robustness.py, reanalysis_notebook.ipynb, result_table.csv, predicted_probs.csv, descriptive_stats.csv, no explicit repository license found, construct-validity receipts, and the governance problem of treating an averaged AI receptivity index as a psychological trait before source data, item wording, response scale, tool category, aggregation rule, model family, threshold, covariates, standard errors, odds ratios, predicted probabilities, code, and license status are auditable.
• The Formal Proof Becomes the Translation Gap - Lushi Pu, Weiming Zhang, Xinheng Xie, Zixuan Fu, Bingxiang He, Hongya Lyu, Xin Li, Jie Zhou, and Yudong Wang's MA-ProofBench: A Two-Tiered Evaluation of LLMs for Theorem Proving in Mathematical Analysis paper, arXiv:2606.13782, on Lean 4 theorem proving, mathematical analysis, ModelBest Inc., Tsinghua University, OpenBMB, Lean 4 v4.28.0, Mathlib 4.28.0, Kimina Lean Server, 200 formalized theorems, Level I undergraduate textbook exercises, Level II Ph.D. qualifying exam problems, 100 problems per level, 6 core topics, 27 MSC subcategories, Real Functions 44 and 12, Functional Analysis 15 and 31, Functions of a Complex Variable 19 and 16, Measure and Integration 13 and 17, Operator Theory 4 and 23, Sequences Series and Summability 5 and 1, about 500 candidate problems, human-led LLM-assisted formalization, independent expert reverse translation, 2 of 3 reviewer approval, strict theorem-statement preservation, no sorry placeholders, Pass@k, n equals 32 open-source samples, n equals 8 proprietary samples, 32K token max output, temperature 1.0, GPT-5.5 xhigh Pass@8 16.00 Level I and 5.00 Level II, Gemini 3.1 Pro High Pass@8 13.00 and 5.00, Claude Sonnet 4.6 High Pass@8 6.00 and 3.00, DeepSeek-V3.2-Thinking Pass@8 5.56 and 1.85, DeepSeek-Prover-V2-671B Pass@8 6.86 and 0.44, DeepSeek-Prover-V2-671B Pass@32 9.00 and 1.00, Kimina-Prover-72B, Goedel-Prover-V2, Nemotron-3-Nano-30B-A3B formal-proof SFT signal, Level II capability gap, Mathlib hallucinations, type system errors, incomplete proofs, Lean syntax errors, R versus ENNReal confusion, fabricated identifiers, GLM-5.1 informal proofs 90 and 75 but near-zero formal pass rate, DeepSeek-V3.2-Thinking informal proofs 85 and 66, Qwen3-235B-Thinking-2507 informal proofs 66 and 42, OpenBMB/MA-ProofBench code, openbmb/MA-ProofBench Hugging Face dataset, MIT license, ma_proofbench.jsonl, benchmark receipts, source-to-Lean fidelity receipts, and the governance problem of treating a natural-language proof or a theorem-prover pass rate as mathematical competence before source statement, Lean statement, Mathlib version, compiler backend, sample budget, reverse-translation review, compile logs, failed-proof class, and artifact revision are auditable.
• The Leaderboard Becomes the Wrong Question - Pratham Singla, Shivank Garg, and Vihan Singh's Poker Arena: Multi-Axis Profiling of Strategic Reasoning and Memory in LLMs paper, arXiv:2606.13815, on no-limit Texas Hold'em as strategic reasoning benchmark, NExT-Game 2026 ICML workshop, IIT Roorkee, Raeth AI, hidden information, adversarial uncertainty, seven frontier LLMs, Claude Opus 4.6, Grok 4, GPT-5.4, DeepSeek V3.1, Qwen3-max, Gemini 3.1 Pro, Kimi K2 thinking, 50 seven-player sessions, 20 hands per session, 1,000 hands, 9,115 logged actions, identical $1,000 stacks, escalating blinds, $5/$10, $10/$20, $25/$50, $50/$100, five-from-seven evaluator, Monte Carlo run-out sampling, side-pot accounting, parse fallback below 2 percent, three-layer memory, within-hand context, 16K character session memory, cross-session lifetime memory, opponent anonymization, memory ablation, seeded prior-session summary versus fresh memory, nine-axis cognitive profile, M1 bet sizing calibration, M2 bluffing and deception, M3 opponent reading, M4 composure, M5 adaptability, M6 prediction accuracy, M7 strategic mixing, M8 factual accuracy, M9 positional awareness, deterministic metrics, regex metrics, LLM judge metrics, model-family-separated judging, Claude chip delta +$15,730, Claude 14 first-place finishes, Grok chip delta +$3,705, GPT chip delta -$1,060, DeepSeek chip delta -$937, Qwen chip delta -$2,785, Gemini chip delta -$2,095, Kimi chip delta -$12,558, VPIP 14.8 percent to 32.0 percent, aggression factor 0.69 to 3.34, DeepSeek M1 0.79, Grok M2 0.83, Grok M3 0.46, GPT M4 0.89, GPT M9 0.83, Gemini M8 0.74, Grok mean-axis aggregate 0.6137, Claude mean-axis aggregate 0.5754 and fifth of seven, Spearman rho_S 0.571, p 0.180, 600-hand memory ablation, GPT +114.6 chip swing p 0.120, Kimi -109.4 chip swing p 0.099, Claude -42.5 chip swing p 0.087, 10,000 bootstrap resamples, RNG seed 20260416, no official code or data link found, evaluation receipts, memory receipts, benchmark governance, and the governance problem of treating a scalar leaderboard as a model-quality verdict before game seeds, hand histories, action logs, parser behavior, memory reads, memory writes, axis definitions, judge prompts, confidence intervals, and artifact status are auditable.
• The Similarity Threshold Becomes the Query Contract - Sebastián Bugedo and Stijn Vansummeren's Hyperdimensional computing for structured querying on tabular data embeddings paper, arXiv:2606.13871, on HyperDimensional Computing, HDC, Holographic Reduced Representations, HRR, tabular row embeddings, structured select-project queries, row retrieval, attribute projection, interpretable similarity scores, nearest-neighbor thresholding, zero-match detection, equality predicates, non-equality predicates, tau_eq, tau_neq, sqrt(n / m), binding, bundling, unbinding, EmbDI graph-based baseline, Word2Vec Skip-Gram, Movie dataset with 49,875 rows and 15 columns, DBLP dataset with 66,876 rows and 4 columns, 15 Movie tables, 4 DBLP tables, 10 equality predicates, 10 non-equality predicates, 10 zero-match predicates per n and table, EmbDI dimensions 300 and 512, 500,000 Movie random walks, 1,000,000 DBLP random walks, HRR dimensions 300 and 512 and 1024, 3 HRR runs per dimension, top-k retrieval for k 1 and 2 and 5 and 10 and 20, threshold sweeps 0.1 to 1.0 and -0.3 to 0.2, Movie equality F1 at m 15, HRR 1024 0.99 versus EmbDI 512 0.82, zero-match Movie HRR 1024 retrieving 0.40 rows at m 15, DBLP attribute projection 1.00 for HRR 300 and 512 and 1024, Movie projection HRR 512 0.93 and HRR 1024 1.00, EmbDI rating weakness, UHasselt-DSI-Data-Systems-Lab/code-hdc-for-tabular-data code, GPL-3.0 license, Python 3.9, faiss-cpu, gensim, scikit-learn, torch-hd, EmbDI embedding generation not included, threshold receipts, and the governance problem of treating a nearest-neighbor score as a query answer before the table, predicate, dimension, threshold, zero-match rule, retrieved-row count, and baseline artifact are auditable.
• The Tool Menu Becomes the Attack Surface - Laxmipriya Ganesh Iyer and Rahul Suresh Babu's Capability Minimization as a Safety Primitive: Risk-Aware Causal Gating for Least-Privilege LLM Agents paper, arXiv:2606.13884, on Risk-Aware Causal Gating, RACG, least-privilege LLM agents, capability minimization, tool exposure, visible tool sets, temporary authority, indirect prompt injection, confused deputy risk, Causal Minimal Tool Filtering, CMTF, precondition-effect tool contracts, risk labels, low and med and high risk tiers, authorization variables, trusted authorization provenance, recipient_confirmed, deletion_approved, share_scope_set, external_approved, payment_confirmed, risk(low) equals 0, risk(med) equals 1, risk(high) equals 4, lambda penalty, lambda dagger crossover, lambda equals 2 default operating point, fail-closed behavior, RiskGate, 100-tool registry, 102 benign CMTF tasks, 80 safety-stress tasks, email authorization-required tasks, email no-action tasks, files no-action tasks, calendar high-risk-shortcut tasks, 240 adversarial trials per method per model, deterministic adversarially compliant agent, Amazon Bedrock validation, Claude Opus 4, Claude Sonnet 4.6, Claude Haiku 4.5, GPT-OSS 120B, Nova Premier, Nova Pro, Nova 2 Lite, all-tools attack surface 26.00, weighted attack surface 95.00, unauthorized exposures 76.16, injection success 1.00, keyword top-10 injection success 1.00, state-aware injection success 0.75, CMTF injection success 0.25, RACG lambda 2 success 1.00, unauthorized exposure 0.00, injection success 0.00, gold-tool exposure 0.94, over-block rate 0.00, serialized-context tokens 1350, RACG lambda 0.5 success 0.89 and over-block rate 0.50, model-token averages 2101 for CMTF and 2456 for RACG, authorization-forging boundary condition, no official code link found, arXiv abstract metadata mismatch, tool-exposure receipts, and the governance problem of treating a tool menu as harmless context before causal necessity, trusted authorization, provenance, visible-action enforcement, blocked-tool reasons, and reviewer override are auditable.
• The GPA Becomes the Coordination Signal - Ben Torkian and Jun Zhou's A Multi-Agent AI System for Automated High School Transcript Processing: Collaborative Document Analysis at Scale paper, arXiv:2606.13916, on automated high school transcript processing, admissions operations, University of South Carolina, Practice and Experience in Advanced Research Computing, PEARC 2026 venue metadata, multi-agent systems, document AI, educational administration, Pattern Recognition Agent, Semantic Analysis Agent, Vision Intelligence Agent, Orchestration Agent, GPA extraction, GPA-as-coordination-signal, Azure OpenAI GPT-4, GPT-4 Vision, pdftotext, pdftoppm, structured JSON output, agent message bus, retry logic, exponential backoff, private Azure deployment, encrypted inter-agent messages, collaborative audit trails, confidence scores, conflict resolution, 40 authentic transcripts, 13 U.S. states, North Carolina 8, Florida 6, New York 4, 85.0 percent public schools, 12.5 percent private or parochial schools, 2.5 percent charter schools, 60 percent single-page transcripts, 100 percent coordination completion, 96.7 percent extraction accuracy, 3.3 percent discrepancy rate, 95 percent Wilson confidence interval 94.2 to 98.8 percent, no significant state or school-type or complexity bias, 98.2 percent inter-agent communication success, 23.7 percent conflict-resolution cases, Pattern Agent Only 67.5 percent success and 8 seconds, Semantic Agent Only 85.0 percent success and 25 seconds, Visual Agent Only 90.0 percent success and 35 seconds, Multi-Agent Coordination 100 percent success and 45 seconds, CoordinationScore equals 0.45 hasGPA plus 0.30 hasName plus 0.25 courseCount greater than 10, r equals 0.89 and p less than 0.001, 32.5 percent triggered semantic coordination, 7.5 percent still required visual collaboration, 2.5 percent required full conflict resolution, Adobe Document Services, ABBYY FlexiCapture, Parchment, 80 transcripts per hour with 4 workers, 320 transcripts per hour with 16 workers, 168-hour continuous test, 0.15 dollars per transcript, human verification for edge cases, English-language transcript limit, no public code release, no released evaluation dataset, admissions-record receipts, and the governance problem of treating an extracted GPA as an admissions fact before the transcript source, OCR trace, agent participation, confidence scores, conflict rule, human review, opt-out path, privacy boundary, and decision-use limit are auditable.
• The Sorry Count Becomes the Library Review - Vasily Ilin and Brian Nugent's Sorries Are Not the Hard Part: An Expert-Review Case Study of a Semi-Autonomous Formalization paper, arXiv:2606.13925, on Grothendieck vanishing, Hartshorne Chapter III Theorem 2.7, Lean 4, mathlib, TopCat, NoetherianSpace, topologicalKrullDim, Sheaf.H, sheaf cohomology, AddCommGrpCat, semi-autonomous formalization, autoformalization, Claude Code, Aristotle, human-written theorem statements, PDF proof excerpts, State A, State B, first sorry-free version, March 27 to April 4 formalization, April 8 to April 15 expert review, April 17 to May 1 review response, April 19 to April 27 refactor loop, April 27 to April 28 compression loop, mathlib-style polish, expert-review checklists, definitions, theorem statements, proofs, file structure, API design, 62 agent-created definitions, exactly one good definition, TopCat.closedIncl, 61 poor definitions, Sheaf.H API file almost 800 lines, 24 lemmas, short exact sequence generalization, filtered-colimit files, maxHeartbeats episode, 200K to 12.8M heartbeat oscillation, default 200000 heartbeat rule, sorry count regression from 3 to 24, inferInstanceAs, named sublemmas, 31,529 Claude turns, 270 sessions, roughly $13K Opus-rate usage, about $10K cache reads, $200 subscription, 19,393 tool calls, Lean LSP queries, Bash, Read, Edit, Grep, public Lean source, Vilin97/Clawristotle grothendieck-vanishing code, uw-math-ai/grothendieck-vanishing-logs dataset, per-turn token usage, refactor and compression loop histories, per-commit LOC and sorry counts, Aristotle proving jobs, human prompts, loop prompts, library-review receipts, and the governance problem of treating a zero-sorry Lean build as reusable mathematics before public definitions, theorem surfaces, namespaces, API files, review comments, response evidence, and future-user transport costs are auditable.
• The Feature Geometry Becomes the Stress Test - Jennifer Meng Lu, Ruochen Zhang, Isabelle Lee, David Alvarez-Melis, Ellie Pavlick, and Naomi Saphra's Adversarial Concept Search: Predicting Compositional Errors From Feature Geometry paper, arXiv:2606.13934, on Adversarial Concept Search, ACS, compositional interference, CI, feature geometry, representational geometry, lossy superposition, local cumulative coherence, near-orthogonal concept encodings, feature interference, residual-stream activations, atomic concept representations, salient features, cluster mean-centering, background cluster structure, 10 percent validation layer selection, SCAN, decoder-only Transformers, hidden dimensions 8 and 12 and 32 and 64, 100K training examples, 4 attention heads, 10 Transformer layers, Adam learning rate 1e-3, batch size 256, seed 42, exact-match accuracy, PR-AUC, failure-rate baselines, Llama-3.2-3B, multihop QA, 10-shot prompting, Khandelwal and Pavlick, single-hop filtering, 26 multihop datasets, int-plus8-parity, artist-birthyear-times-two, KLAR multilingual factual recall, English fact representations, language subspaces, 8,000 OSCAR samples per language, Dutch, Russian, French, Spanish, Chinese, Hungarian, Ukrainian, Vietnamese, Japanese, Korean, r = -0.855 bin-level multihop trend, rpb -0.210 with mean-centering, rpb 0.178 without mean-centering, multilingual rpb correlations from -0.288 to -0.081, p less than 0.01, code release pending paper decision, single NVIDIA GeForce RTX 3090 compute, stress-test receipts, active-learning prioritization, targeted benchmark construction, no official code link yet, and the governance problem of treating a benchmark as coverage before the concept space, feature vectors, interference metric, layer choice, validation rule, generated inputs, filtered atomic failures, and per-slice error predictions are auditable.
• The Minimal View Becomes the Privacy Broker - Hexuan Yu, Chaoyu Zhang, Heng Jin, Shanghao Shi, Ning Zhang, Y. Thomas Hou, and Wenjing Lou's Minim: Privacy-Aware Minimal View for Agents via Trusted Local Sanitization paper, arXiv:2606.13949, on MINIM, privacy-aware minimal views, trusted local sanitization, Semantic Over-Privileged Observation, structured observations, accessibility trees, UI state, autonomous agents, remote inference servers, honest-but-curious inference, client-side brokers, Contextual Integrity, task-conditioned necessity, inherent sensitivity, Keep, Abstract, Remove, K/A/R policies, tau_nec 1.0, tau_sens 5.0, WebArena, Shopping, Reddit, Gmail, 150 unique trees, 27 task types, 5,403 tree-task variants, 4,741 training variants, 662 test variants, synthesized 2FA codes, password prompts, Slack notifications, sensitivity scores, necessity scores, GATv2, 384-dimensional MiniLM embeddings, 512-dimensional node features, 3 GATv2 layers, hidden size 256, 4 heads, AdamW, 10 epochs, TCNP 0.9491, TCNP-I 0.9931, TISL 0.1010, Full Observation leakage 1.0000, Random Budget, Sensitivity-Only, Necessity-Only, Necessity-Only TISL 0.2032, prompted LLM scorer baselines, Qwen3-8B-Instruct, Nemotron-Nano-9B, GPT-OSS-20B, Llama-3.3-70B-Instruct, Mistral-7B-v0.3, Llama-3-8B-Instruct, Gemma-3N-E4B, LLM baseline TISL 0.194 to 0.312, 12.0 percent retained nodes, 89.9 percent leakage suppression, greater than 99.9 percent high-risk injected-element suppression, Gmail 1.88 percent TISL, Reddit 13.50 percent TISL, Shopping 0.85 percent TISL, abstraction ablation, yyyyhx/MINIM code, Chaoyu112358/MINIM-data dataset, MIT dataset license, dataset viewer caveat, observation-minimization receipts, and the governance problem of treating an agent's UI observation as harmless context before the task, local broker, sensitivity score, necessity score, disclosure action, abstraction renderer, residual leakage, domain coverage, and threat model are auditable.
• The Kernel Acceptance Becomes the Quality Mirage - Theodore Meek, Siyuan Ge, Di Qiu Xiang, Simon Chess, and Vasily Ilin's Formalizing Numerical Analysis: An Agent Pipeline and Quality Audit Beyond Kernel Acceptance paper, arXiv:2606.14000, on OpenMath, Lean 4, Mathlib, autoformalization, theorem proving, numerical analysis, Numerical Methods for Ordinary Differential Equations, J. C. Butcher, coding agents, Claude Opus 4.6, Claude Sonnet, Planner, Worker, Evaluator, Consultant, Python orchestrator, GitHub Actions, strategy.md, task_results/cycle_NNN.md, history.jsonl, run.lock, kernel acceptance, sorry counts, axiom counts, semantic correctness, Mathlib reuse, cross-file reuse, LLM-as-judge, DeepSeek V4 Pro, gpt-oss-120b, direct judge, round-trip judge, blind back-translation, RepoProver, M2F, OpenMath, 175 textbook statements, 84 fully proof-complete formalizations, 48.0 percent, 12 statement-only or sorry-bearing formalizations, 6.9 percent, 54.9 percent combined coverage, Chapter 3 Runge-Kutta at 34.8 percent, 0 sorries, 0 axioms, 59,340 Lean lines, 57 files, 1,257 named declarations, 42 percent OpenMath divergence, 25 percent M2F divergence, 18 percent RepoProver divergence, 18 of 20 human-judge agreement, incomplete multi-part statements, added weakening hypotheses, parameter restrictions, Definition 312A, Theorem 514A, Theorem 550A, Mathlib overlap 2 to 5 percent, cross-file reuse 48 percent and 45 percent, 215 to 270 active hours, 5.73 B tokens, 19,968 tool calls, Aristotle 89 jobs, 27 submissions incorporated, 47 sorrys closed, 1,417 proof LOC, uw-math-ai/OpenMath code, formalization-quality receipts, and the governance problem of treating a Lean build, zero sorry count, or theorem-prover kernel acceptance as mathematical fidelity before the source statement, hypotheses, dependency graph, reuse path, LLM judge, human spot-check, and divergence class are auditable.
• The Drug Relation Becomes the Applicability Clause - Guanting Luo, Noriki Nishida, Yuji Matsumoto, and Yuki Arase's Applicability Condition Extraction for Therapeutic Drug-Disease Relations paper, arXiv:2606.14031, on Drug-ACE, applicability condition extraction, therapeutic drug-disease relations, biomedical relation extraction, biomedical NLP, clinical decision support, clinical literature, PubMed abstracts, ChemDisGene, human clinical studies, clinical trials, therapeutic relation filtering, 1,119 drug-disease pairs, 667 abstracts, train 334 abstracts and 558 pairs, development 110 abstracts and 182 pairs, test 223 abstracts and 379 pairs, Dosage, Age, Gene, Gender, Comorbidity, Body Type, Hydroxyurea, prostatic adenocarcinoma, applicability condition spans, span-and-type labels, hard matching, soft matching, Role-Conditioned LoRA, RCLoRA, relation roles, Gemma2-9B, Qwen2.5-7B, Qwen3-4B, Gemma3-4B, MedGemma-4B, SpanMarker, RoBERTa, BERT, BiomedBERT, BioBERT, Bio ClinicalBERT, DeepSeek-R1-70B, Llama3.3-70B, Qwen2.5-72B, LoRA average 47.94 hard span F1 and 57.39 soft span F1, RCLoRA average 49.59 hard span F1 and 58.86 soft span F1, p-values 0.013 and 0.018 and 0.015 and 0.022, Qwen3-4B RCLoRA 60.62 soft span F1, Gemma3-4B RCLoRA 51.43 hard span F1, Comorbidity near-zero standard-LoRA baseline, threshold 0.5 RCLoRA 63.16 versus LoRA 57.45, ACL Findings 2026, guantingluo98/Drug-ACE code, B1tta/Drug-ACE dataset, apache-2.0 license, research-only risk statement, applicability-condition receipts, and the governance problem of treating a drug-disease edge as clinical truth before the source abstract, patient scope, dosage, genotype, comorbidity, span offsets, model, matching rule, human validation, and downstream use limit are auditable.
• The Factory Manual Becomes the RAG Playground - Yash Pulse, Yong-Bin Kang, Abhik Banerjee, Abdur Forkan, and Prem Prakash Jayaraman's FactoryLLM: A Safe and Open-Source AI Playground for Evaluating LLMs in Smart Factories paper, arXiv:2606.14119, on FactoryLLM, smart factories, cross-machine fault diagnostics, maintenance recovery, retrieval-augmented generation, RAG, industrial documentation, Autonomous Intelligent Vehicle, AIV, Mobile Planner, fleet management software, multi-machine manuals, sensitive industrial data, local LLMs, open-source LLMs, OpenAI, OpenRouter, Google Gemini, local models, Input-Output prompting, Chain-of-Thought, Tree-of-Thought, Graph-of-Thought, vector RAG, graph RAG, ChromaDB, NebulaGraph, LlamaIndex, PDF, DOCX, TXT, session-scoped indices, chat interface, reasoning traces, RAGAS, NVIDIA LLM-as-Judge, context precision, context recall, response relevancy, faithfulness, context relevance, response groundedness, Qwen3-235B-A22B-Instruct-2507, Llama 4 Maverick, Gemma-3-27B, 30 cross-machine questions, approximately 600 pages, 1,000-token chunks, 200-token overlap, top-10 retrieval, overall averages 0.73 to 0.76, context precision 0.46 to 0.51, response groundedness 0.88 to 0.95, context recall 0.76 to 0.89, six questions below 0.20 precision, faithfulness 0.62 to 0.72, seven questions below 0.50 faithfulness, groundedness average 0.91 versus faithfulness average 0.66, retrieval-limited industrial RAG, RS-232 Aux Sensors connector, DB9 female port, Safety Commissioning, DigitalInnovationLab/Factory-LLM code, MIT license, maintenance-reasoning receipts, and the governance problem of treating a grounded maintenance answer as operational advice before the manuals, chunks, model, prompt, retrieval scores, judge scores, unsupported claims, privacy boundary, and human review gate are auditable.
• The Diagram Becomes the Verification Trace - Xiaoxian Duan, Zequn Liu, and Yingce Xia's VeriGeo: Controllable Geometry Question Generation with Numerical and Analytical Verification paper, arXiv:2606.14176, on VeriGeo, controllable geometry generation, geometry problem generation, multimodal mathematical reasoning, AI-assisted education, problem statements, diagrams, geometric constraints, proof steps, executable reasoning traces, Author agent, Solver agent, shared action sequences, blueprint generation, target concepts, difficulty control, diagram requirements, numerical verification, analytical verification, LLM-assisted logical verification, verification-guided reflection, repair, rejection, cross-modal consistency, hallucinated constraints, direct-pass rate 29.02 percent, five LLM backbones, Gemini-3.1-Pro, Qwen3.5-Plus, Claude-Opus-4.6, 36.00 percent repair, 30.67 percent repair, 20.22 percent repair, 354 geometry concepts in 100 samples, Harder difficulty matching 100.0 percent, Equivalent difficulty matching 80.0 percent, 8.7k verified examples, Qwen2.5-VL-7B-Instruct, supervised fine-tuning, PGPS9K 59.40 percent, GeoQA 82.74 percent, MathVista-GPS 75.96 percent, G-LLaVA, MAVIS, TR-CoT, GeoGen-SFT, action grammar, AddPoint, MovePoint, AddAuxLine, AddCircle, AddEdge, VerifyPoint, VerifyFunction, collinear, parallel, perpendicular, equal length, equal angle, midpoint, circle incidence, executable-data receipts, no official code link, and the governance problem of treating synthetic geometry data as training evidence before the statement, diagram, action trace, constraint solver, logical judge, repair log, rejection rule, cost profile, and downstream benchmark split are auditable.
• The Skill Score Becomes the Laundering Channel - Yihan Xia and Taotao Wang's When Should Agent Trust Be Conditional? Characterizing and Attacking Skill-Conditional Reputation in Agent Swarms paper, arXiv:2606.14200, on skill-conditional trust, agent swarms, LLM agent routing, global trust scores, R(i|k), agent specialization, heterogeneous agents, base models, scaffolds, tool stacks, sparse per-skill evidence, cross-skill evidence borrowing, empirical-Bayes shrinkage, coupling strength beta, CIVT, Conditional Information Value Test, zero-cost de-risking, global router, skill router, per-task oracle, phase diagrams, high heterogeneity, sparse evidence, correlated skills, AppWorld, 14 heterogeneous agents, ReAct, PlanExec, FullCodeRefl, IPFunCall, GPT-4o, GPT-4 Turbo, DeepSeekCoder, LLaMA3-70B, file_system, phone, simple_note, splitwise, spotify, todoist, venmo, global score 0.743, skill score 0.784, oracle score 0.933, success 0.488 versus 0.542 versus 0.798, test_normal green, test_challenge amber, farm skill simple_note, target skill phone, reputation laundering, launderer, whitewasher, Sybil, sleeper, learner, routing regret 0 to 0.94, honest gated verdict +0.19, contaminated ungated verdict -0.06, zero-evidence gate, direct target evidence, no Sybil-resistance claim, no official code link, reputation-routing receipts, and the governance problem of treating a conditional agent trust score as delegation authority before the skill taxonomy, episode counts, verifier, coupling rule, CIVT verdict, zero-evidence gate, and laundering budget are auditable.
• The Reflection Score Becomes the Verifier - Yinglun Zhu's Closing the Reflection Gap: A Free Calibration Bonus for Agentic RL paper, arXiv:2606.14211, on RefGRPO, reflection gap, agentic reinforcement learning, LLM agents, environment feedback, SQL execution results, error messages, tool outputs, post-feedback reflection, binary reflection scores, self-assessment, underconfidence, overconfidence, credit-assignment mismatch, outcome-only RL, GRPO+, DAPO-style improvements, asymmetric clipping, token-mean normalization, no KL divergence term, free calibration bonus, reflection-outcome contrast, dynamic calibration coefficient schedule, self-verification, pseudo-rewards, test-time selective prediction, abstention, Chow score, task accuracy, reflection accuracy, overconfidence rate, underconfidence rate, text-to-SQL, 4,660 training problems, Spider, OmniSQL, Spider-Dev, Spider-DK, Spider-Realistic, Spider-Test, Bird-Dev, Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Llama-3.2-3B-Instruct, OmniSQL-7B, SQL-R1-7B, 6-epoch training, 6-turn multi-turn setting, Qwen-7B task accuracy 75.1 to 76.5 percent, underconfidence 44.4 to 7.7 percent, Chow score 73.0 to 76.5, Qwen-3B single-turn underconfidence 23.7 to 1.3 percent, self-improvement from 67.1 to 69.9 percent, selective-prediction lift, calibration receipts, no official code link, and the governance problem of treating an agent's own reflection as deployment authority before the outcome source, reflection parser, calibration schedule, commit rule, abstention policy, and per-benchmark error modes are auditable.
• The Paired Trajectory Becomes the Skill Audit - Haowen Gao, Haoran Chen, Can Wang, Shasha Guo, Liang Pang, Zhaoyang Liu, Huawei Shen, and Xueqi Cheng's SkillAudit: Ground-Truth-Free Skill Evolution via Paired Trajectory Auditing paper, arXiv:2606.14239, on SkillAudit, agent skills, structured procedural instruction packages, frozen LLM agents, stale skills, edge cases, API changes, deployment constraints, ground-truth-free skill evolution, task descriptions, workspace data, initial skills, paired trajectory auditing, with-skill trajectories, without-skill trajectories, Process-Aligned Contrastive Evaluation, PACE, segment-anchored diagnostics, action_signals, protected_hints, Process Adherence, Artifact Evidence, Consistency, Effectiveness Delta, 12 evaluator templates, eval-procedure-adherence, eval-coverage, eval-tool-use-rationality, eval-error-robustness, eval-output-evidence-check, eval-format-compliance, eval-task-alignment, eval-data-consistency, eval-method-adherence, eval-safety-compliance, eval-incremental-value, eval-portfolio-quality, Anchor Verifier, fixed structural verifier, verifier drift, commit, defer, rollback, Refine, Repair, noisy guidance removal, conflicting passage replacement, SkillsBench, Harbor containers, 89 runnable tasks, 8 professional domains, 73.9 percent average task reward, 40.9 percent no-skill baseline, 56.7 percent static expert skill, +33.0 and +17.2 point gains, software-dependency-audit, data-to-d3, lab-unit-harmonization, exceltable-in-ppt, observability boundary, skill receipts, and the governance problem of treating an evolved skill document as reliable before the paired trajectories, localized edits, verifier constraints, rollback rule, and observable evidence boundary are auditable.
• The Physical Property Becomes the Affordance Test - Yifan Jiang, Meige Yang, Zitong Li, and Jay Pujara's AFFORDANCE20Q: Evaluating Affordance Reasoning from Physical Properties paper, arXiv:2606.14240, on Affordance20Q, affordance reasoning, physical properties, object identity hiding, memorized object-affordance mappings, 20-Questions games, hidden target objects, eight candidate affordances, seven distractors, Questioner, Checker, Oracle, material questions, shape questions, size questions, surface questions, 1,009 games, 454 objects, 59 affordances, Commonsense Knowledge Graph, CSKG, ConceptNet, WordNet, GPT-4.1 data expansion, six human annotators, 1,298 re-annotated pairs, 85.2 percent majority agreement, Qwen3-14B Oracle and Checker, 300-question Oracle validation, five human baseline volunteers, 30 percent sampled subset, 15 LLM questioners, Qwen3-8B, Qwen3-14B, Qwen3.5-9B, Phi-4-14B, Llama-3.1-8B, Ministral-8B, Nemotron-9B, Gemma-3-12B, DeepSeek-V4-Pro, DeepSeek-V4-Flash, GPT-5, GPT-5-mini, Gemini-2.5-Pro, Gemini-2.5-Flash, MiniMax-M2.5, success rate, turns, KL information gain, Fix20Q 24.8 percent, human 64.2 percent, Gemini-2.5-Pro 45.9 percent, DeepSeek-V4-Flash 41.3 percent, information-gain collapse after turn 5, conduct_heat, transmit_light, sink_in_water, hang_from_above, float_on_water, hold_between, ignite, KB-Anchored Rule Induction, KARI, Rule Proposer, Validator, Auditor, 2,223 generated rules, 0.7 sentence-similarity threshold, up to 15.2 point open-source gains, 1171-jpg/Affordance20Q artifact link, Readme-only repository caveat, affordance receipts, and the governance problem of treating object-name recall as physical-world competence when embodied agents need to infer action possibilities from shape, material, size, surface, and context before acting.
• The Harness Becomes the Runtime Contract - Tingyang Chen, Shuo Lu, Kang Zhao, Weicheng Meng, Hanlin Teng, Tianhao Li, Chao Li, Xule Liu, Jian Liang, Zhizhong Zhang, Yuan Xie, Heng Qu, Kun Shao, and Jian Luan's HarnessX: A Composable, Adaptive, and Evolvable Agent Harness Foundry paper, arXiv:2606.14249, on HarnessX, Darwin Agent Team, reusable agent harnesses, runtime harnesses, prompt scaffolding, typed harness primitives, substitution algebra, context assembly, model selection, memory management, tool ecosystem, execution environment, evaluation and reward, control and safety, observability, training bridge, processors, bundles, AEGIS, Digester, Planner, Evolver, Critic, operational mirrors, symbolic Markov decision processes, reward hacking, catastrophic forgetting, under-exploration, deterministic gating, seesaw regression constraints, change manifests, variant isolation, ensemble routing, harness-model co-evolution, cross-harness GRPO, shared replay buffers, pass@2, GAIA, ALFWorld, WebShop, tau^3-Bench, SWE-bench Verified, Claude Opus 4.6 meta-agents, Claude Sonnet 4.6, GPT-5.4, Qwen3.5-9B, +14.5 percent average gain, +44.0 percent ALFWorld gain, 14 of 15 improved configurations, 103 GAIA tasks, 134 ALFWorld tasks, 100 WebShop tasks, 55 SWE-bench Verified tasks, four candidates per round, three seeds per cell, 5 percent noise thresholds, concurrency 10, 20-step and 15-step and 200-step limits, Darwin-Agent/HarnessX code, MIT license, no held-out evaluation, static deployment artifacts, harness receipts, and the governance problem of treating an evolved agent harness as harmless scaffolding when it decides what the model sees, what tools it can call, how memory enters context, how failures are retried, and which traces become training data.
• The Communication Policy Becomes the Agent Interface - Xinbei Ma, Jiyang Qiu, Yao Yao, Zheng Wu, Yijie Lu, Xiangmou Qu, Jiaxin Yin, Xingyu Lou, Jun Wang, Weiwen Liu, Weinan Zhang, Zhuosheng Zhang, and Hai Zhao's Communication Policy Evolution for Proactive LLM Agents paper, arXiv:2606.14314, on proactive LLM agents, communication policies, information asymmetry, vague task specifications, ask_question, generate_ui, text-only interaction, UI-only interaction, hybrid channel selection, User-Agent, Planner-Executor, Shanghai Jiao Tong University, OPPO Research Institute, SWE-bench, TravelGym, tau^2-bench, WebArena, user simulators, planner simulators, personas, amateur, do_selection, one_question, answer_more, task success, response quality, persona compliance, proactivity, CPE, Communication Policy Evolution, prompt-level evolution, rollout analysis, two-stage accept/reject gates, 0.7 train fraction, 100 and 200 episode batches, 30 max rounds, five trajectory excerpts, environment-first-then-clarify, text-for-simple-UI-for-structured, 2-strikes escalation, persona-aware adaptation, communication receipts, and the governance problem of treating proactive asking as harmless when channel choice can structure what the user discloses, how much privacy cost is paid, and what the agent is allowed to infer.
• The Safety Boundary Becomes the Gradient - Ayoub Belouadah, Sylvain Kubler, and Yves Le Traon's CSPO: Constraint-Sensitive Policy Optimization for Safe Reinforcement Learning paper, arXiv:2606.14415, on safe reinforcement learning, constrained Markov decision processes, CMDPs, constraint-sensitive policy optimization, first-order primal-dual methods, dual-lag behavior, delayed constraint correction, oscillatory learning, Lagrange multipliers, local constraint sensitivity, shortest signed distance to the safety boundary, constraint-gradient norms, KKT solution preservation, Time-To-Safety, Reward Preservation, Violation Frequency, Safety Gymnasium, Point Goal, Point Button, Car Goal, Car Button, Ant, Humanoid, HalfCheetah, Hopper, Swimmer, APPO, P3O, IPO, PPO-Lag, CUP, FOCOPS, TRPOPID, CPPOPID, CPO, PCPO, C-TRPO, five-seed training curves, cost threshold 25, alpha 0.3 navigation settings, alpha 0.85 locomotion settings, two-layer tanh policies, hidden size 64, discount factor 0.99, GAE 0.95, batch size 512, actor and critic learning rates 3e-4, Lagrange multiplier init 0.001, Lagrange multiplier learning rate 0.035, OmniSafe implementation, serval-uni-lu/CSPO code, Apache-2.0 license, ICML 2026 Spotlight, recovery receipts, and the governance problem of treating a safe-RL policy as safe before recovery time, reward preservation, violation frequency, cost-gradient reliability, threshold choice, and post-violation behavior are auditable.
• The Object Slot Becomes the Planning State - Rodion Vakhitov, Leonid Ugadiarov, Alexey Skrynnik, and Aleksandr Panov's Causal Object-Centric Models for Planning with Monte Carlo Tree Search paper, arXiv:2606.14418, on COMET, Causal Object-centric Model for Efficient Tree search, object-centric model-based reinforcement learning, Monte Carlo Tree Search, MCTS, MuZero-style latent planning, slot-structured latent spaces, frozen object-centric encoders, SLATE, DINOSAUR, Slot Contrast, random-policy pretraining data, temporal slot initialization, transformer world models, LightZero, UniZero, nanoGPT-style transformer backbones, action-slot fusion, slot-conditioned action embeddings, object-causal attention, learned per-slot relevance scores, policy and value heads, Object Goal, Object Interaction, Object Comparison, Property Comparison, Object Reaching, Block Lifting, Cube Pushing, Defend The Line, Object-Centric Visual RL, ManiSkill, Robosuite, VizDoom, mean normalized score, early-stage sample efficiency, 50 MCTS simulations, 20 sampled actions for continuous tasks, replay buffer capacity 1,000,000, batch size 64, AdamW, temporal-difference steps 5, NVIDIA H100 80 GB, 18-hour 500k-step training runs, slot rollout visualizations, causality-score maps, cube/background slot merge failures, quadratic self-attention scaling, slot receipts, and the governance problem of treating object-level attention as evidence before the slot extractor, task suite, world-model rollout, compute budget, failure cases, and fallback rule are auditable.
• The Reasoning Tree Becomes the Commit Log - Pavan C Shekar, Abhishek H S, and Aswanth Krishnan's GitOfThoughts: Version-Controlled Reasoning and Agent Memory You Can Replay, Diff, and Merge paper, arXiv:2606.14470, on version-controlled reasoning, agent memory, reasoning trees as git repositories, scored thoughts as commits, scores as git notes, validation outcomes as tags, branches as exploration paths, git log retrieval, git grep, pickaxe search, git bundle reproduction, signed traces, git fetch and git merge for cross-agent memory, QpiAI, GPQA-Diamond, MATH-500, ScienceWorld, Qwen3.5-9B, Qwen2.5-7B-Instruct, Qwen2.5-32B-Instruct, MemoryBackend comparisons, none versus markdown versus git versus vector versus graph memory, 15.4 ms git writes, 48.0 ms git reads, 191 KB git storage, pre-registered replications, failed exploratory git-memory trend, self-consistency from 66.6 percent to 70.0 percent on MATH-500, copyability threshold around cosine similarity 0.8, near-duplicate retrieval, method-transfer null, same-method different-number controls, 32B near-verbatim memory gains, GPQA 47.0 percent system headline with wall-clock confound, durable Hatchet execution, keyed merge-conflict layouts, trace receipts, and the governance problem of treating agent memory as intelligence before replayability, diffs, leakage checks, merge policy, conflict schema, timeout budget, pre-registration, and incident review are auditable.
• The Workspace Becomes the Digital Colleague - Yongheng Zhang, Ziang Liu, Jiaxuan Zhu, Shuai Wang, Xiangqi Chen, Haojing Huang, Jiayi Kuang, Siyu Chen, Ao Shen, Hao Wu, Qiufeng Wang, Qian-Wen Zhang, Junnan Dong, Wenhao Jiang, Ying Shen, Hai-Tao Zheng, Yinghui Li, Di Yin, Xing Sun, and Philip S. Yu's From Chatbot to Digital Colleague: The Paradigm Shift Toward Persistent Autonomous AI paper, arXiv:2606.14502, on persistent autonomous AI, digital colleagues, chatbot-to-colleague transition, cognitive-core evolution, fast next-token generation, thinking LLMs, inference-time computation, chain-of-thought reasoning, reflection, process supervision, reinforcement learning, tool-augmented task execution, OpenClaw-style workstations, persistent workspaces, files, terminals, browsers, logs, permissions, reusable skills, verification loops, governance, Workspace + Skill, state persistence, reusable procedures, task closure, experience reuse, State-Action-Observation trajectories, task-state verification, sandboxed auditable AI ecosystems, fixed initial states, state snapshots, trajectory logs, replayable actions, final-state diffs, unsafe tool actions, privacy leakage, malicious skills, prompt injection, workspace receipts, skill provenance, rollback paths, and the governance problem of treating agent autonomy as a personality or product tier before the workspace, permission boundary, action trace, skill library, verification rule, and final-state evidence are auditable.
• The Coordinate List Becomes the Interference Surface - Chenyu Zhou, Qiliang Jiang, and Boguang Pan's Dense Coordinate-List Fine-Tuning Induces a Controllable Interference Surface in Vision-Language Models paper, arXiv:2606.14507, on dense coordinate-list fine-tuning, vision-language models, visual grounding, bounding-box generation, structured output, generation surfaces, control surfaces, Gemma 4 12B, Qwen3-VL-8B, LoRA, q/k/v/o rank-32 adapters, 42.7M trainable parameters, q/v rank sweeps, InsPLAD industrial inspection imagery, 160 training images, 80 held-out evaluation images, COCO 2017 reproduction, 780 training images, 120 evaluation images, class-aware one-to-one F1@0.3, F1@0.5 audits, parse-valid rate, mean predictions per image, exact-object duplicate rate, maximum exact-object repeat, repeat-stop trigger rate, 1000-resample bootstrap confidence intervals, Gemma F1@0.3 rising from 0.007 to 0.448, duplicate rate rising to 0.080, max repeat 23, q/v max repeat 21 to 22 across ranks 4 to 64, object-level repeat-stop, duplicate rate 0.000, max repeat 1, F1@0.3 0.494 to 0.490, F1@0.5 0.381 to 0.385, dense non-bbox JSON, spatial/count JSON, Qwen controlled endpoint F1@0.3 0.318 with duplicate rate 0.000, COCO recall@0.3 from 0.0228 to 0.1540, COCO recall@0.5 from 0.0128 to 0.0981, COCO duplicate rate from 0.000 to 0.016 then back to 0.000 under repeat-stop, structured-output receipts, and the governance problem of treating localization F1 as enough before parse stability, list density, duplicate pressure, termination behavior, schema controls, adapter configuration, evaluation split, and downstream counting effects are auditable.
• The Crop View Becomes the GUI Grounding Receipt - Xinyu Qiu, Yunzhu Zhang, Heng Jia, Shuheng Shen, Changhua Meng, and Linchao Zhu's VISTA: View-Consistent Self-Verified Training for GUI Grounding paper, arXiv:2606.14579, on GUI grounding, computer-use agents, click-coordinate prediction, normalized 0-1000 coordinate frames, point-in-box rewards, Group Relative Policy Optimization, GRPO reward degeneracy, all-zero groups, all-one groups, informative group ratios, target-preserving crops, exact coordinate remapping, view-consistent group rollout, self-verified cross-view anchoring, oracle center-point anchors, model-only group statistics, maximum-reward rollout gates, Qwen3-VL 4B and 8B and 30B-A3B backbones, Qwen3.5 4B and 9B and 35B-A3B cross-backbone tests, roughly 120K GUI-grounding training samples, SeeClick, Widget Captioning, ShowUI-web, UI-RefExp, OmniAct, ScreenSpot-Pro, ScreenSpot-V2, MMBench-GUI L2, OSWorld-G-R, OSWorld-G, temperature-0 deterministic evaluation, ScreenSpot-Pro lifts from 55.5 and 52.7 and 53.7 to 63.4 and 65.8 and 67.0, average scores rising from 71.1 and 69.0 and 73.6 to 75.5 and 76.3 and 77.6, MVP test-time aggregation, VISTA-4B, VISTA-9B, Apache-2.0 code, 8 x 80 GB training recommendations, crop accuracy from 93.00 percent to 96.25 percent, worst-view accuracy from 87.63 percent to 92.42 percent, view-consistency rate from 88.38 percent to 90.40 percent, prediction flip rate from 8.31 percent to 5.80 percent, refusal-aware routing, crop-variance limits, GUI grounding receipts, and the governance problem of treating a model's click as an authorized action before target-box provenance, coordinate frame, crop policy, reward rule, benchmark split, decoding mode, action consequence class, confirmation gate, rollback path, and incident log are auditable.
• The Timestamped Plan Becomes the Dispatch Desk - Pollob Chandra Ray, Sabah Binte Noor, and Fazlul Hasan Siddiqui's A Temporal Planning Framework for Disruption Aware Dynamic Route Optimization in Heterogeneous Railway Systems paper, arXiv:2606.14582, on DART, Disruption Aware Railway Temporal Planning, PDDL 2.1, temporal planning, railway route optimization, heterogeneous multi-gauge railways, meter gauge, broad gauge, standard gauge, dual-gauge infrastructure, gauge compatibility, single-track mutual exclusion, turnout operations, timestamped action plans, dispatch automation, blocked track disruptions, blocked train disruptions, slowdown disruptions, engine failure recovery, auxiliary engines, durative actions, drive-train, board-passengers, attach-engine, drive-assisted-train, resolve-train-blockage, clear-blocked-track, turnout, 200 problem instances, 100 nominal instances, 100 disrupted instances, Small and Medium and Large and Very Large benchmark groups, 107 to 120 trains, 134 to 150 stations, roughly 1000 track points, 87 to 100 junctions, POPF3, OPTIC, VAL plan validation, 30-minute planner time limits, 199 validated generated plans, 120 trains and 1000 track points and 108 concurrent disruptions in the one failed instance, 60.1 percent slowdown delay, 30.4 percent engine-failure delay, 9.5 percent blockage delay, 619.00-second disrupted-instance computation time, public PDDL artifacts, dispatch receipts, and the governance problem of treating an executable railway plan as operational authority before sensor state, disruption duration, planner version, validation output, human override, stale-data rules, fallback operations, and incident accountability are auditable.
• The Action Log Becomes the Workflow Lens - Gaurav Verma and Scott Counts's Abstracting Cross-Domain Action Sequences into Interpretable Workflows paper, arXiv:2606.14654, on WorkflowView, LLM-based workflow abstraction, UI telemetry, timestamped interaction logs, action sequences, behavioral analytics, progressive denoising, natural-language action descriptions, high-level activity inference, optional categorization layers, browser task reconstruction, Mind2Web, 2,022 web tasks, 137 websites, five domains, zero-shot GPT-4o, semantic similarity 0.91, global MRR 0.90, global Recall@1 0.86, website-specific MRR 0.94, MOOC dropout prediction, 44,008 students, 247 courses, 67,699 student-course pairs, 51,316 dropouts, 75.8 percent dropout rate, 22 logged actions, weighted F1 0.90 with five few-shot examples, Microsoft Word telemetry, Copilot-in-Word workflow analysis, June 2025 US us-en users, consented logs, no text or writer data, around 2000 unique actions, TnT-LLM category discovery, active content editing before and after AI output, top-N category stability over 90 percent, long-tail instability, privacy-preserving aggregation, telemetry receipts, and the governance problem of treating LLM-labeled behavior as product truth before consent, action-schema meaning, prompt, model, category stability, human validation, privacy transformation, and downstream use are auditable.
• The Personal Desktop Becomes the Agent Exam - Lawrence Keunho Jang, Andrew Keunwoo Jang, Jing Yu Koh, and Ruslan Salakhutdinov's MyPCBench paper, arXiv:2606.16748, on personally intelligent computer-use agents, personal desktop benchmarks, logged-in accounts, cross-app history, Linux desktops, QEMU/KVM Ubuntu 24.04, GNOME, Firefox, LibreOffice, OSWorld-compatible harnesses, Michael Scott persona seeding, 17 simulated web applications, 184 tasks, 1,191 rubric items, 1,812 bank transactions, 2,398 emails, 679 calendar events, 2,526 chat and workplace messages, 10,746 browser-history visits, 42,000 seeded records, 226 app database tables, OpenClaw community requests, 2,749 anonymized use cases, bounded action, multi-step orchestration, cross-source reconciliation, aggregation and reporting, personal lookup, pattern inference, 68 percent multi-app tasks, 40 percent cross-category tasks, Claude Opus 4.6 at 55.4 percent perfect and 81.8 percent rubric score, Claude Sonnet 4.6, GPT-5.5, GPT-5.4 mini, Qwen 3.5, seven-or-more-app task collapse, premature DONE, skipped required apps, persona-data hallucination, visible side effects, task rubrics, MyPCBench project artifacts, and the governance problem of treating a personal assistant benchmark score as deployment clearance before account authority, action side effects, rollback, screenshots, logs, judge configuration, and user-risk boundaries are auditable.
• The Language Variety Becomes the Bias Probe - Rafael Ferreira, Inês Vieira, Inês Calvo, James Furtado, Iago Paulo, Diogo Tavares, Diogo Glória-Silva, David Semedo, and João Magalhães's P3B3 paper, arXiv:2606.16753, on European Portuguese, Brazilian Portuguese, Portuguese variety bias, multilingual LLM evaluation, pt-PT, pt-BR, pluricentric languages, language variety controllability, 74 expert-curated multi-turn dialogues, 203 dialogue turns, 2-to-6-turn conversations, variety-agnostic prompts, transportation and shopping and household domains, two linguistics experts, no-prompt bias testing, pt-BR prompting, pt-PT prompting, PeroVaz, PtBrVId, Gemini-3-Flash as LLM judge, Gemma-4-31B judge validation, 200 human-annotated responses, 88.5 percent valid responses, 0-to-10 variety scoring, AMALIA-9B pt-PT specialization, Qwen3.5 pt-PT improvement from 32.7 to 86.1, Sabiá-4 pt-PT generalization, turn-level drift toward pt-BR, public P3B3 benchmark code, language-support receipts, and the governance problem of treating a model as supporting Portuguese before regional variety, prompt condition, judge validity, turn persistence, and local user expectations are auditable.
• The Open Artifact Becomes the Reproducibility Receipt - Kevin L. Coakley, Thijs Snelleman, Holger Hoos, and Odd Erik Gundersen's The Shift Toward Open and Reproducible AI Research paper, arXiv:2606.16974, on open science, AI reproducibility, research artifacts, 56,800 AI conference papers, AAAI, ICLR, ICML, IJCAI, NeurIPS, 2014-2024 publication growth, 52,328 empirical papers, seven reproducibility variables, open source code, open datasets, dataset splits, pseudocode, hardware specification, software dependencies, experiment setup, code availability rising from 13 percent to 69 percent, open dataset use rising from 68 percent to 91 percent, code-and-data sharing rising from 11 percent to 64 percent, neither-code-nor-data falling from 29 percent to 4 percent, at-least-five-variable documentation rising from 8 percent to 43 percent, estimated reproducibility rising from 28 percent to 64 percent, checklist slope analysis, LLM-assisted meta-science, Gemini 2.5 Flash classification, 400-paper prompt optimisation, 160-paper manual evaluation, Zenodo data and code artifacts, reproducibility receipts, and the governance problem of treating a published AI result as durable evidence before code, data, splits, environment, setup, artifact survival, and direct re-run status are auditable.
• The Committed Plan Becomes the Action Gate - Nathan Gavenski, Juarez Monteiro, Francisco Galuppo, Adriano Veloso, and Odinaldo Rodrigues's When in Doubt, Plan It Out paper, arXiv:2606.16995, on PACT, Plan Align Commit Think, committed small language model deliberation, reactive reinforcement learning, hybrid RL and language-model agents, Qwen3.5-2B, PPO reactive policies, epistemic uncertainty thresholds, asynchronous planning, plan generation, simulation-grounded verification, agent alignment, safety and feasibility and completeness checks, committed execution, policy bypass, replanning, FrozenLake, deterministic 6 x 6 maps, slippery 6 x 6 maps, deterministic 8 x 8 maps, SAYCAN, ASK, 0.98 and 0.93 and 1.00 PACT reward results, 27.9 percent and 58.4 percent and 81.2 percent LM usage, hand-crafted transition functions, direct-goal task limits, plan receipts, and the governance problem of treating language-model deliberation as oversight before the candidate plan, simulator, verifier, alignment waypoint, replan count, committed actions, and revocation rule are auditable.
• The Evaluation Archive Becomes the Frontier Claim - Yanan Long's Bayesian Inference and Decision Audits for Public Archives of Frontier AI Evaluations paper, arXiv:2606.17005, on public AI evaluation archives, terminal leaderboards, selective reporting, benchmark revisions, missingness, Bayesian inference, decision audits, LiveBench, Open LLM Leaderboard v2, LMArena, GAIA, tau-bench, LiveCodeBench and HELM Capabilities and SWE-bench Verified exclusion, source-native timestamps, score orientation, rank handling, duplicate policy, inclusion grades, repeated snapshots, terminal-only archives, 1,000-system constructed examples, 23.03 versus 75.13 timing paths to within 0.05 of a ceiling, synthetic recovery, objective archive prediction, Arena preference transfer, posterior uncertainty calibration, fixed audit gates, agentic trace metadata, tool budgets, scaffold identity, retry policy, judge version, human-intervention policy, archive receipts, and the governance problem of treating frontier leaderboard rank as evidence before the temporal archive, source validation, missing rows, benchmark version, and falsification gates are auditable.
• The Prompt Cache Becomes the Agent Budget - Buqiang Xu, Zirui Xue, Dianmou Chen, Chenyang Fu, Chiyu Wu, Caiying Huang, Chen Jiang, Jizhan Fang, Xinle Deng, Yijun Chen, Yunzhi Yao, Xuehai Wang, Jin Shang, Gong Yu, and Ningyu Zhang's TokenPilot: Cache-Efficient Context Management for LLM Agents paper, arXiv:2606.17016, on long-horizon LLM agents, context accumulation, prompt-cache continuity, prefix-cache reuse, KV-cache economics, text pruning, memory eviction, sequence-layout mutation, prefix mismatches, cache invalidation, Ingestion-Aware Compaction, stable placeholders for runtime fields, downstream tool schemas, tool-result deduplication by hash, HTML slimming, image downsampling, recovery tools, Lifecycle-Aware Eviction, residual utility, conservative batch-turn schedules, PinchBench, Claw-Eval, isolated and continuous modes, 61 percent and 56 percent isolated-mode cost reductions, 61 percent and 87 percent continuous-mode cost reductions, LightMem2, OpenClaw, Codex CLI and Claude Code adapters, context-budget receipts, and the governance problem of treating context optimization as cost plumbing before cache hits, reductions, artifacts, recovery calls, eviction decisions, data classes, and audit records are inspectable.
• The Agent Autonomy Ladder Becomes the No-Go Zone - Margaret Mitchell, Avijit Ghosh, Alexandra Sasha Luccioni, and Giada Pistilli's Fully Autonomous AI Agents Should Not be Developed paper, arXiv:2502.02649, on AI agents, autonomy levels, simple processors, routers, tool callers, multi-step agents, fully autonomous agents, context-specific planning, nondeterministic environments, human control, model-controlled program flow, function calls, iterative action, code creation, code execution, action surfaces, delegated authority, human oversight, privacy, safety, security, trust, misplaced trust, compounded errors, cascading failures, autonomy no-go zones, staged autonomy, approval gates, rollback routes, audit trails, tool permissions, sandboxing, generated-code execution receipts, and the governance problem of treating agent autonomy as a product upgrade before control boundaries, human veto, reversibility, logging, and domain-specific prohibitions are auditable.
• The Rounding Bin Becomes the Training Policy - Qian Zhao, Kunlong Chen, Changxin Tian, Zhonghui Jiang, Haitao Zhang, Chaofan Yu, Peijie Jiang, Mingliang Gong, Jia Liu, Ziqi Liu, Zhiqiang Zhang, and Jun Zhou's Rethinking Shrinkage Bias in LLM FP4 Pretraining paper, arXiv:2606.20381, on FP4 LLM pretraining, low-precision training, E2M1, E1M2, INT4, UFP4, shrinkage bias, Round-to-Nearest-Even, Random Hadamard Transform, stochastic rounding, dY-only SR, FPROP and DGRAD and WGRAD, fwd_y and bwd_dx and bwd_dw, MXFP4, NVFP4, NVIDIA Blackwell and Rubin-class systems, AMD MI350-series GPUs, Dense 1.5B, MoE 7.9B, MoE 124B, BF16-relative language-modeling loss error, latest-1000-step relative error drops, 1.2570 percent to 0.9673 percent, 2.3596 percent to 1.8469 percent, 1.7308 percent to 1.3863 percent, controlled E2M1 reference selection, 200B-token ablations, full-RHT coverage, fused RHT plus quantization latency, SM90, SM100, format-training receipts, and the governance problem of treating 4-bit training efficiency as a hardware feature before the codebook geometry, rounding rule, transform scope, baseline, kernel overhead, scale hierarchy, and residual BF16 gap are auditable.
• The Attention Map Becomes the Clinic Receipt - Zahra Asghari Varzaneh, Reza Khoshkangini, Thomas Ebner, and Lars Johansson's Interpretable Sperm Morphology Classification via Attention-Guided Deep Learning paper, arXiv:2606.20438, on clinical AI, fertility clinics, sperm morphology classification, male infertility, manual microscopy variability, EfficientNet-B0, ImageNet initialization, Convolutional Block Attention Module, CBAM channel and spatial attention, Grad-CAM++ heatmaps, SMIDS, HuSHem, 3,000 microscopic images, 216 expert-verified sperm head images, Normal and Abnormal and Non-Sperm classes, Normal and Tapered and Pyriform and Amorphous classes, PyTorch 2.6, 70/15/15 splits, batch size 32, 100 epochs, freeze-then-unfreeze training, MixUp, label smoothing, SimpleCNN baselines, 90.21 percent SMIDS accuracy, 0.913 SMIDS macro F1, 93.94 percent HuSHem accuracy, 0.948 HuSHem macro F1, 0.965 and 0.991 mean AUC, HuSHem 33-sample test-set uncertainty, attention-map receipts, and the governance problem of treating a plausible heatmap as clinical trust only when dataset provenance, imaging protocol, class taxonomy, local validation, false-error review, calibration, drift monitoring, and human oversight are auditable.
• The Incubator Log Becomes the Clinical Signal - Zahra Asghari Varzaneh, Reza Khoshkangini, Pia Saldeen, Lars Johansson, and Thomas Ebner's Context-Aware Hierarchical Bayesian Modeling of IVF Laboratory Environmental Conditions paper, arXiv:2606.20459, on IVF laboratory monitoring, clinical AI, environmental sensors, 10-minute readings, temperature and humidity and CO2 and TVOC, Asian and Northern European clinics, 61 weeks of Asian clinic data, 14 Northern European months, a 196-day sensor-data gap, pregnancy rates for under-35 and 35-39 and 40+ age groups, weekly and monthly aggregation, two-to-six-week lag assumptions, 55 context-aware temporal features, rolling thermal stability, ideal-zone adherence, stress episodes, recovery scores, SHAP top-16 feature selection, XGBoost baselines, hierarchical Bayesian Beta regression, partial pooling, clinic-specific intercepts, NUTS in PyMC, 1500 warm-up and 1500 draw settings, Asian time-series cross-validation, Northern European held-out months, MAE 4.30 percent and R2 0.86 for the 35-39 group, 64 percent error reduction, SHAP and LIME interpretation, small-denominator failure modes, aggregate-outcome confounding, lab-environment receipts, and the governance problem of treating clinic-level environmental correlation as operational evidence only when sensor provenance, denominator counts, lag assumptions, patient-level omissions, uncertainty, site differences, and human review are auditable.
• The Compliance Example Becomes the Safety Training Probe - Sihui Dai and Mann Patel's What Do Safety-Aligned LLMs Learn From Mixed Compliance Demonstrations? paper, arXiv:2606.20508, on mixed compliance demonstrations, safety-aligned LLMs, demonstration-based jailbreaks, in-context learning, benign compliance, harmful compliance, total-count and harmful-count and joint hypotheses, RedTeam-2K, UltraChat, OR-Bench, HarmBench, SORRY-Bench, WildGuard-test, WildGuard refusal judging, 1,492 harmful compliance demonstrations, 1,404 harmful evaluation queries, 2,808 evaluation points, Llama-3.1-8B-Instruct, OLMo-3.1-32B-Instruct, GPT-OSS-20B, Gemma-4-31B-IT, OLMo SFT and DPO checkpoints, preference optimization, dilution, slight amplification, baseline compliance rates, recency bias, suffix ordering, format adoption, comply prefixes, mixed-context safety probes, and the governance problem of treating refusal behavior as stable before demonstration composition, ordering, training stage, format imitation, refusal judge, and model-specific failure modes are auditable.
• The Python Score Becomes the Multilingual Trap - Maria Ivanova, Pavel Zadorozhny, Rodion Levichev, Ivan Petrov, Adamenko Pavel, Ivan Lopatin, Alexey Kutalev, and Dmitrii Babaev's Multi-LCB paper, arXiv:2606.20517, on LiveCodeBench, multilingual code evaluation, competitive-programming benchmarks, release-date filtering, benchmark contamination, Python overfitting, language-specific contamination, 12 programming languages, C++ and C# and Python and Java and Rust and Go and TypeScript and JavaScript and Ruby and PHP and Kotlin and Scala, LeetCode functional-task conversion, AtCoder and Codeforces STDIN/STDOUT tasks, hidden official tests, Pass@1 over 10 runs, 24 public instruction and reasoning models, GPT-OSS-120B Medium, Qwen3-235B-A22B-Thinking-2507, DeepSeek-R1-0528, February-to-May 2025 task windows, 67.8 percent top average Pass@1, Python mean Pass@1 0.482, Java and C++ near 0.44, Scala below 0.29, compiler and type errors, input-parsing failures, timeout failures, public Multi-LCB code, leaderboard evidence, multilingual benchmark receipts, and the governance problem of treating a Python coding score as proof of engineering competence before the target language, compiler, runtime, task family, release window, contamination policy, hidden-test result, and failure mode are auditable.
• The Confidence Score Becomes the Teacher Review Queue - Luyang Fang, Yingchuan Zhang, Jongchan Park, Zhaoji Wang, Ping Ma, and Xiaoming Zhai's Confidence-Aware Automated Assessment of Student-Drawn Scientific Models paper, arXiv:2606.20264, on automated scoring of student drawings, science education, NGSS-aligned modeling tasks, middle-school assessment, visual rubrics, Vision Transformers, vit_base_patch16_224, LoRA adaptation, test-time predictive distributions, semantic-preserving perturbations, M = 20 perturbed views, top-75 percent selective trust, response-level confidence, selective automation, teacher review queues, Beginning and Developing and Proficient proficiency labels, six assessment items, 3,576 drawings, CA-Selective scoring, 0.789 average accuracy, 0.760 Cohen's kappa, 0.727 F1, 20.572 ms latency, Qwen3-VL-8B-Instruct zero-shot pilot results, confidence-accuracy correlation, cluttered drawing failure modes, regional classroom context, expert-label inheritance, teacher-review receipts, and the governance problem of treating an automated classroom score as trustworthy before the rubric, model, threshold, confidence signal, deferral rule, human override, student population, and feedback consequence are auditable.
• The Energy Field Becomes the Driving Safety Case - Shihao Ji, HongXi Li, Zihui Song, and Mingyu Li's Lagrange paper, arXiv:2606.20274, on open-vocabulary end-to-end driving, autonomous driving, sparse perception, Masked Latent Fields, vision-language models, class-agnostic region proposals, continuous semantic visual tokens, intent-driven masked cross-attention, continuous energy fields, Lagrangian action minimization, MPPI planning, nonlinear bicycle rollouts, kinematic constraints, collision avoidance, nuScenes, CODA, Waymo zero-shot transfer, out-of-distribution hazards, 8.7 percent CODA OOD collision rate, 0.25 percent nuScenes collision rate, 24.3 FPS inference, sub-1 percent perturbation robustness, interpretable energy heatmaps, black-ice and flooded-road limitations, energy-field receipts, and the governance problem of treating an offline driving benchmark as deployment evidence before the perception tokenization, energy landscape, kinematic bounds, hazard coverage, latency, perturbation checks, and closed-loop safety case are auditable.
• The Excitation Level Becomes the Data Augmentation Contract - Giancarlo Santamato, Andrea Mattia Garavagno, Massimiliano Solazzi, and Antonio Frisoli's Leveraging systems' non-linearity to tackle the scarcity of data in the design of Intelligent Fault Diagnosis Systems paper, arXiv:2606.20323, on intelligent fault diagnosis systems, structural health monitoring, railway pantographs, vibration testing, frequency response functions, FRF color maps, nonlinear dry-friction joints, controlled excitation levels, 1 N to 13 N force sweeps, seven excitation amplitudes, member-connectivity loss, artificial-damper reduction, MobileNetV2 transfer learning, ImageNet feature extractors, data scarcity, physical data augmentation, 3^7 image generation, 6,561 training images, 97.6 percent test accuracy, bolt-damage false negatives, test-rig cluster effects, datasets available on request, physical augmentation receipts, and the governance problem of treating synthetic industrial training data as trustworthy before the measurement protocol, fault state, excitation schedule, augmentation rule, test campaign, and failure mode are auditable.
• The Soft Prefix Becomes the Skill Artifact - Xijia Tao, Yihua Teng, Xinyu Fu, Ziru Liu, Kecheng Chen, Yuzhi Zhao, Suiyun Zhang, Rui Liu, and Lingpeng Kong's SoftSkill paper, arXiv:2606.20333, on behavioral compression, contextual adaptation, natural-language skill files, Markdown skills, continuous soft prefixes, frozen-backbone models, Qwen3.5-4B, Qwen3.6-35B-A3B, next-token prediction, validation-selected checkpoints, SkillOpt, LoRA, SearchQA, LiveMath, DocVQA, OfficeQA, SpreadsheetBench, ALFWorld, single-round QA, agentic execution, 32 virtual tokens, context-token compression, output-token reductions, prompt-start placement, skill-section placement, model-specific embedding spaces, trajectory imitation, public SoftSkill code, soft-skill receipts, and the governance problem of treating an invisible learned prefix as the same thing as a readable skill before its source text, target model, validation gate, insertion point, task result, portability, and audit limits are documented.
• The Mined SKILL.md Becomes the Transfer Test - Yuexing Hao and Xiaomin Li's Automating SKILL.md Generation for Computer-Using Agents via Interaction Trajectory Mining paper, arXiv:2606.20363, on computer-using agents, GUI trajectory mining, explicit skill libraries, SKILL.md files, InteraSkill Workflows, action-jump segmentation, source-domain cluster purity, pseudo-label contrastive learning, Qwen3-8B, GRPO, learned trajectory reward models, WebArena, BrowseComp+, WorkArena-NLP, Mind2Web diagnostics, frequency baselines, Auto-SKILL.md generation, normalized edit distance, transfer failure, readable-but-source-bound routines, skill-composition checks, reward-model mismatch, skill-library audit receipts, and the governance problem of treating a generated agent skill file as transferable competence before its corpus, boundary detector, cluster quality, reward signal, trivial baselines, held-out domains, and live-task evidence are auditable.
• The Player-Facing RL Agent Becomes the Deployment Receipt - Alessandro Sestini, Joakim Bergdahl, Amir Baghi, Jean-Philippe Barrette-LaPierre, Florian Fuchs, and Linus Gisslen's Augmenting Game AI with Deep Reinforcement Learning paper, arXiv:2606.20210, on reinforcement-learning-augmented game AI, EA SPORTS FC 25, Battlefield 6, player-facing non-player characters, finite state machines, behavior trees, GOAP, navigation meshes, goalkeeper positioning, soldier locomotion, Soft Actor-Critic, PPO, overnight training, scenario-based training, Replay across Experiments, runtime inference constraints, 200 microsecond inference budgets, 300,000-parameter MLPs, occupancy maps, raycast fans, 2x observation-cost speedups, designer controllability, modular integration, bug detection and fixing, authenticity, exploit repair, qualitative behavior evaluation, player-facing deployment receipts, and the governance problem of treating a game agent as production-ready before its design goal, reward, training loop, integration point, runtime cost, repair path, and player-experience evidence are auditable.
• The Logic Benchmark Becomes the Control Panel - Xinyi Zheng, Ling Shi, Tianlong Yu, Yongxin Zhao, Lorenz Goette, and Kailong Wang's QMFOL paper, arXiv:2606.20227, on quantifiable monadic first-order logic, deductive reasoning benchmarks, QMFOLBench, controlled task generation, depth and width parameters, True and False and Unknown labels, distractor rules, Food and Animal and University and Mathematics topics, FOL2NL translation, NL2FOL reconstruction, external theorem provers, Vampire verification, round-trip logical consistency, 960 configurations, 2,880 benchmark instances, six large reasoning models, two non-reasoning LLM settings, Gemini-3.1-Pro, GPT-5.4-High, Qwen3.5-27B, DeepSeek-V3.2-Thinking, Claude-Sonnet-4-6, Macro-F1, label-wise F1, time and token overhead, distractor robustness, context-length ablations, semantic dependence, Zenodo artifacts, reasoning-benchmark receipts, and the governance problem of treating a reasoning score as meaningful before the formal generator, semantic wrapper, verifier, slice, model setting, cost, and failure mode are auditable.
• The Rare-Valid Future Becomes the Intelligence Measure - Ishanu Chattopadhyay's Thermodynamic Measure of Intelligence paper, arXiv:2606.20231, on thermodynamic intelligence, rare-valid probability lift, lawful amplification of rare but valid futures, passive path laws, induced trajectory laws, recursive self-simulation, self-in-world models, rare-valid self-simulation fidelity, actuation-limited optima, path-measure divergence, thermodynamic bookkeeping, false-positive rare-set identification, Maxwell-demon-like information engines, velocity-selection demons, symbolic generation, GPT-5 long-form prose, Project Gutenberg prose, entropy-rate estimation, 27-symbol alphabets, sentence-scale target sets, compressed double-log Lambda scales, TME reproducibility code, Harvard Dataverse artifacts, measurement receipts, and the governance problem of treating an intelligence number as meaningful before the baseline law, validity predicate, trajectory resolution, target set, induced probability shift, resource accounting, and reproducibility trail are auditable.
• The Reward Weight Becomes the Governance Lever - Federica Filippini's A Multi-Agent system for Multi-Objective constrained optimization paper, arXiv:2606.20236, on MAMO, multi-agent reinforcement learning, constrained optimization, reward shaping, reward-weight adaptation, scalarized objective functions, Lagrangian-inspired penalty terms, quality-of-service constraints, cost-minimization, computing-continuum resource management, edge-FaaS replica scaling, cold-start costs, rejection probability, sinusoidal workload traces, OpenFaaS scaling limits, Gurobi offline references, noisy workload perturbations, Task-Execution agents, Weight-Adaptation agents, two-phase training loops, aggregate performance summaries, Deep Q-Learning, RL4CC, Ray RLlib, tolerance thresholds, learned weights between 0.8 and 0.9, objective-design receipts, and the governance problem of treating a learned policy as operationally safe before the reward weights, constraint thresholds, observation windows, accepted costs, rejected trade-offs, and adaptation authority are auditable.
• The Knowledge Conflict Becomes the Source Arbitration Trace - Huang Peng, Jiuyang Tang, Weixin Zeng, Hao Xu, and Xiang Zhao's Navigating Unreliable Parametric and Contextual Knowledge paper, arXiv:2606.20245, on MACR, LLM knowledge conflict resolution, parametric knowledge, contextual knowledge, retrieval-augmented generation, unreliable internal memory, unreliable retrieved context, multi-context contradictions, binary source selection failures, modified semantic entropy, answer-query relevance, adaptive knowledge assessment and retrieval, internal-knowledge externalization, Observer agents, Analyzer agents, Reasoner agents, induced conflict-resolution rules, rule coverage and support filtering, hierarchical conflict detection, Temporal Update Rules, ConflictBank, ConFiQA, MQuAKE, Direct and ICL and InstructRAG and TruthfulRAG and CK-PLUG baselines, variant-context robustness, Tesla headquarters case analysis, source-arbitration receipts, and the governance problem of treating a model answer or retrieved document as trustworthy before the system can expose what it believed, what it retrieved, which sources conflicted, what rule resolved the conflict, and what evidence was rejected.
• The Self-Evolving Agent Becomes the Certificate Gate - Biswa Sengupta's Self-Evolving Agents with Anytime-Valid Certificates paper, arXiv:2607.00871, on SEA, self-evolving agents, endogenous-loop failure modes, frozen base models, steering adapters, versioned harnesses, loop controllers, anytime-valid gates, fixed error budgets, certificate ledgers, performative stability, PAC-Bayes forgetting certificates, e-process drift gates, quality-diversity library growth, verifier-in-the-loop search, best-of-N selection, verified micro-step search, self-authored reproduction oracles, search-layer control, verified self-repair, SWE-bench Verified, 52-instance subsets, official execution-based grading, no-op composite controls, GPT and GLM 5.2 ablations, event-log attribution, accept and hold and reject and no-significant-finding decisions, run_tests traces, self-oracle limits, single-run evaluation caveats, and the governance problem of treating self-improvement as progress before every accepted adapter, harness, library, reward-model, and search change has a certificate, error spend, regression check, and rollback path.
• The Metric Choice Becomes the Governance Fork - Alex Fogelson, Zachary A. Brown, Hans Gundlach, Jayson Lynch, and Neil Thompson's Two AI Metrics Diverged paper, arXiv:2607.00913, on AI metric choice, meek metrics, mighty metrics, compute scaling, bounded benchmarks, validation loss, benchmark ceilings, task horizon length, inference-time scaling, frontier versus fixed-budget developers, utility functions, software-engineering task intervals, concentration of power, capability diffusion, compute controls as delay versus ceiling, dangerous capability thresholds, alignment over many accessible models, metric-governance receipts, and the governance problem of treating a closing benchmark gap as a policy conclusion before the metric's bound, utility meaning, compute axis, threshold behavior, and unbounded operational alternatives are auditable.
• The Logit Contribution Becomes the Retrieval Witness - Aryo Pradipta Gema, Beatrice Alex, and Pasquale Minervini's Logit-Contribution Scoring Identifies Non-Literal Retrieval Heads paper, arXiv:2607.01002, on LOCOS, long-context retrieval, non-literal retrieval heads, attention read sites, OV-circuit write paths, answer-token unembedding directions, spatial contrast, needle and off-needle positions, NoLiMa, Qwen3, Gemma-3, OLMo-3.1, mean ablation, ROUGE-L degradation, MuSiQue, BABILong, random-head controls, parametric recall controls, retrieval-witness receipts, and the governance problem of treating an attention map or source citation as enough evidence before the model's source-local answer-writing components, ablation checks, benchmark scope, artifact revision, and downstream transfer are auditable.
• The Reaction Rule Becomes the Verification Loop - Daniel Armstrong, Maarten Dobbelaere, Valentas Olikauskas, Helena Avila, Octavian Susanu, Jérôme Waser, and Philippe Schwaller's Agentic generation of verifiable rules for deterministic self-expanding reaction classification paper, arXiv:2607.01061, on agentic chemistry, computer-assisted synthesis planning, reaction classification, LLM-generated SMIRKS rules, RXNO seed taxonomies, NameRXN, Rxn-INSIGHT, USPTO reaction data, 665,901 patent reactions, 68 seed classes, 14,073 generated classes, template-level cohorts, hierarchy agents, detailed agents, verifier agents, generator agents, aggregator agents, Chain-of-Verification, Gemini 3 Flash and Gemini 3 Pro inference, 4,964 generalized SMIRKS patterns, false-positive graphs, 215 strongly connected components, first-match classification, Hybrid strict mode, Generalized SMIRKS mode, CRD-2025, RingBreaker, two-layer fallback coverage, expert-chemist validation, 1,942 fallback hierarchy entries, rule receipts, and the governance problem of treating generated scientific infrastructure as reliable before every rule's corpus tests, false positives, ordering, abstentions, conflicts, expert checks, and experimental limits are auditable.
• The Fluid Persona Becomes the Behavior-Control Surface - Hasibur Rahman and Smit Desai's Behavior-Adaptive Conversational Agents paper, arXiv:2607.01034, on the Fluid Personality Framework, behavior-adaptive conversational agents, AI-mediated behavior change, metaphorical persona design, role metaphors, personality expression intensity, low and medium and high trait expression, Big Five cues, coach and tutor and librarian and tool personas, Planner and Cheerleader and Tutor transitions, non-human Library and Guide metaphors, task type, domain, urgency, user goals, user traits, interaction history, medical information seeking, fitness coaching, reflective learning, trust, enjoyment, adoption intention, persona switching, tone and affect and formality modulation, anthropomorphism limits, behavior-change interface design, persona receipts, and the governance problem of treating adaptive warmth, formality, role, and style as harmless UX rather than a behavior-control surface that needs consent, limits, measurement, and audit trails.
• The Retrieved Memory Becomes the Sycophancy Cue - Zhishang Xiang, Zerui Chen, Yunbo Tang, Zhimin Wei, Ruqin Ning, Yujie Lin, Qinggang Zhang, and Jinsong Su's MemSyco-Bench paper, arXiv:2607.01071, on memory-induced sycophancy, agent memory, long-term collaborators, retrieved historical memories, post-retrieval reasoning, objective fact judgment, contextual scope control, memory-evidence conflict, valid memory selection, personalized memory use, memory-decision schemas, multi-turn dialogue simulation, 1,550 released samples, Generation Accuracy, Sycophancy Rate, Correct Memory Use, Outdated Memory Use, Qwen3-8B, DeepSeek-V4-Flash, NaiveRAG, Mem0, A-Mem, LightMem, MemGPT, MemoryBank, SuperMemory, retrieved-but-wrong errors, memory-caution instructions, confirmation-instruction failures, leaderboard receipts, and the governance problem of treating memory retrieval as personalization before the system can prove which memories are evidence, preference, stale trace, scope condition, or irrelevant history.
• The Static Tool Benchmark Becomes the Open-World Trap - Song-Lin Lv, Weiming Wu, Rui Zhu, Zi-Jian Cheng, and Lan-Zhe Guo's Can Agents Generalize to the Open World? paper, arXiv:2607.01084, on OpenAgent, tool-use agents, open-world generalization, static training, query shifts, action-space shifts, observation shifts, domain transfer, controlled POI sandboxes, Qwen2.5-7B-Instruct, supervised fine-tuning, GRPO reinforcement learning, Tool Error Rate, Active Exploration Score, Average Tool Chain Length, Refusal Rate, symbolic anchoring, trajectory inertia, null returns, tool redirection, logic inversion, boundary blindness, forced completion, Perturbation-Augmented Fine-Tuning, environmental feedback perturbation, solvability boundary perturbation, symbolic representation perturbation, Amap real-API validation, and the governance problem of treating static tool-use success as delegation evidence before the agent's behavior under tool drift, feedback anomalies, dependency changes, impossible tasks, and domain shifts is auditable.
• The Risk Taxonomy Becomes the Audit Spine - Gemma Galdon Clavell, Pablo Accuosto, and Usman Gohar's The Eticas AI Risk Taxonomy paper, arXiv:2607.02201, on open AI audit infrastructure, operationalized risk taxonomies, Eticas AI Risk Taxonomy v2.0.0, taxonomy version 2.0.0, 10 categories, 20 sub-groups, 76 active subcategories, 18 external framework mappings, stable concept URIs, SKOS, JSON-LD, CC BY 4.0 public surface, risk-versus-mechanism separation, PII leakage, disclosure memorization and cross-customer contamination mechanisms, DecodingTrust Privacy Scenario 2, GPT-4-0314, 0 percent 51 percent and 84 percent disclosure rates under adversarial conditioning, severity bands, grade E with SYSTEMIC pattern, Agentic AI as a first-class category, open-core limitations, audit-spine receipts, and the governance problem of treating a risk label as audit evidence before the mechanism, probe, metric, severity threshold, grade, framework mapping, public artifact, and proprietary boundary are visible.
• The Personality Test Becomes the Category Error - Kim Zierahn, Cristina Cachero, Anna Korhonen, and Nuria Oliver's Personality Without Persons? paper, arXiv:2607.02325, on Big Five testing in large language models, psychometric validity, content validity, five candidate inventories, N = 244 models, 49 model families, LLM-adapted items, human-developed inventories, low between-model variance, 3 percent total score variance, failed five-factor structure, four facets collapsing into one, instruction-tuned versus base models, socially desirable trait shifts, self-report analogues, LLM-native constructs, sycophancy, prompt sensitivity, instruction-following consistency, construct-validity receipts, and the governance problem of treating a personality score as model evidence before the target population, item adaptation, prompt template, score distribution, factor structure, alignment effects, behavioral validity, and claim scope are auditable.
• The Autonomous Lab Becomes the Schedule Contract - Austin McDannald, Julia Tisaranni, and Howie Joress's Optimal Resource Utilization for Autonomous Laboratory Orchestrators paper, arXiv:2607.01188, on autonomous laboratory orchestration, metal-organic-framework synthesis, MOF platforms, scientific agents, acquisition functions, job-shop scheduling, OR-Tools constraint programming, hardware capacity constraints, reaction and drying tasks, centrifuge overlap rules, reactor temperature constraints, status dependencies, component mutexes, UnitOP execution, AsyncIO, schedule rescheduling, 16-job and 8-job batches, campaign-level resource utilization, knowledge-gain prioritization, batch-size tradeoffs, schedule receipts, laboratory execution contracts, and the governance problem of treating an AI-suggested experiment list as autonomous science before the physical schedule, locks, dependencies, resource conflicts, objective function, and campaign-value tradeoffs are auditable.
• The Stealth Bias Becomes the Cartridge Audit - Shayan Talaei, Abhinav Chinta, Devvrit Khatri, Amin Karbasi, Azalia Mirhoseini, and Amin Saberi's Distill to Detect paper, arXiv:2607.01208, on stealth preferential bias, hidden model behavior, model supply-chain audits, context distillation, soft-logit distribution shifts, KV-cache prefix adapters, cartridges, D2D, low-rank bias concentration, masking residuals, Fisher-weighted projection, inverted-U adapter capacity, LoRA and full-model distillation baselines, Llama-3.2-3B-Instruct, owl and Fanta preference experiments, Petri detection, AuditBench, gray-box audit access, base-checkpoint custody, cartridge audit receipts, and the governance problem of treating clean generated text as enough evidence before the probability distribution, base model, adapter capacity, detector, and post-amplification behavior are auditable.
• The Furniture Assembly Becomes the Progress Boundary - Chenyang Ma, Yue Yang, Radu Corcodel, Siddarth Jain, Andrew Wu, Chiori Hori, and Diego Romeres's FurnitureVLA paper, arXiv:2607.01212, on vision-language-action robotics, long-horizon bimanual furniture assembly, real-scale IKEA-style furniture, LACK side table, KALLAX shelf, IVAR chair, dual Kinova Gen3 arms, VR teleoperation, simulation demonstration generation, semantically grounded subtasks, post-retreat subtask boundaries, continuous progress prediction, automatic subtask transitions, temporal ensembling, action horizon, rear-camera viewpoints, image resolution, sim-to-real validation, magnets instead of screwing, assembly receipts, physical-progress thresholds, stage-completion evidence, and the governance problem of treating a robot's completed assembly as proof of autonomy before the progress boundary, hardware setup, success criterion, simplifications, and failure stage records are auditable.
• The Compatibility Rescue Becomes the Source-Only Audit - Zhihao Lin, Mingyi Zhou, Zhensu Sun, Yizhuo Yang, Renyu Yang, David Lo, and Li Li's RepoRescue paper, arXiv:2607.01213, on LLM coding agents, whole-repository compatibility rescue, abandoned open-source libraries, historical environment validation, modern environment failure, source-only evaluation, full-patch versus source-only pass rates, runtime-enforced test-edit blocking, practical-use validation, bug-hunt probes, Python 3.13, JDK 21, 193 Python repositories, 122 Java repositories, Claude Code systems, GPT-5.2 through Codex, Kimi, cross-file coordination, reasoning-level repair labels, benchmark harness integrity, rescue receipts, software-aging supply chains, and the governance problem of treating a green test suite as coding-agent success before source edits, test edits, downstream scenarios, and shortcut controls are auditable.
• The Prediction Slot Becomes the State Boundary - Giovanni Monea, Nathan Godey, Kianté Brantley, and Yoav Artzi's The State-Prediction Separation Hypothesis paper, arXiv:2607.01218, on State-Prediction Separation Transformers, SPS, hidden-state role conflict, next-token prediction, future-state preparation, persistent KV cache, <predict> slots, input-stream persistence, prediction-stream eviction, sliding-window attention, 2x Memory, Delayed State, Reverse SPS, FineWeb-Edu pretraining, model scales from 53M to 1.678B parameters, zero-shot downstream benchmarks, validation loss, data efficiency, inference throughput, gradient-flow analysis, restricted-state ablations, state-separation receipts, architecture provenance, cache-boundary audits, and the governance problem of treating a language-model capability gain as direct progress before the architecture, cache rule, compute budget, baseline set, and role-separation mechanism are auditable.
• The Language Critique Becomes the Training Signal - Chih-Han Yang, Dai-Jie Wu, Yun-Ping Huang, Ping-Chun Hsieh, Kenneth Marino, and Shao-Hua Sun's Language-Critique Imitation Learning from Suboptimal Demonstrations paper, arXiv:2607.01225, on language-critique imitation learning, suboptimal demonstrations, offline robot learning, structured language feedback, task-progress labels, action-optimality labels, movement-guidance labels, LLM-Captioner training, LC-BC, LC-DP, behavior cloning, diffusion policies, continuous-control tasks, Maze, Parking, Sweep, Box-close, BlockPush, PegInsert, Hammer, Relocate, scalar reward limits, classifier-label ablations, critique receipts, feedback provenance, privileged-state boundaries, captioner assumptions, and the governance problem of treating policy competence as enough before the language labels that shaped what the policy noticed and corrected are auditable.
• The Agent Memory Becomes the Cognitive Skill - Shengguang Wu, Hao Zhu, Yuhui Zhang, Xiaohan Wang, and Serena Yeung-Levy's AutoMem: Automated Learning of Memory as a Cognitive Skill paper, arXiv:2607.01224, on agent memory, metamemory, long-horizon agents, file-system memory actions, LOG and PLAN routines, read and write and search and append operations, scaffold optimization, meta-LLM trajectory review, memory-specialist training, frozen task-action models, Crafter, MiniHack, NetHack, Qwen2.5-32B-Instruct, 2x to 4x reported gains from optimizing memory alone, memory-skill receipts, retained state, deletion and provenance duties, and the governance problem of treating persistent agent memory as a feature before its write, read, search, training, retention, consent, and action-influence records are auditable.
• The Proof Trace Becomes the Trust Boundary - Ben Slivinski and Michael Saldivar's Theoria: Rewrite-Acceptability Verification over Informal Reasoning States paper, arXiv:2607.01223, on auditable informal reasoning, rewrite witnesses, typed reasoning-state transitions, completeness of change, citation and computation and problem-given justifications, hidden premises, fabricated citations, scalar LLM judge limits, holistic judge comparison, HLE-Verified Gold, 105 certifications out of 185 expert problems, 91.4 percent strict precision, GPQA Diamond, adversarial poisoned proofs, certify-or-decline trust products, proof-trace receipts, convention lift, pedantry filters, and the governance problem of treating an AI answer, chain of thought, or judge score as trustworthy before every state change has an explicit local license.
• The Idea Generator Becomes the Research Funnel - Ziyu Chen, Yilun Zhao, and Arman Cohan's Measuring the Gap Between Human and LLM Research Ideas paper, arXiv:2607.01233, on LLM research ideation, AI scientists, research agents, literature-grounded idea generation, 11,683 human paper ideas, reconstructed prior-work contexts, opportunity-pattern taxonomy, method-paradigm taxonomy, human research taste, distributional distance, normalized entropy, bridge opportunities, synthesis and unification methods, thinking-mode narrowing, full-paper context ablations, model-enriched concept clusters, local mechanism interventions, ideation receipts, diversity audits, and the governance problem of treating one plausible generated research idea as enough before the system's repeated problem-finding and contribution-making distribution is measured.
• The Performance Benchmark Becomes the Measurement Trap - Zhi Chen, Zhensu Sun, Yuling Shi, David Lo, and Lingxiao Jiang's Are Performance-Optimization Benchmarks Reliably Measuring Coding Agents? paper, arXiv:2607.01211, on repository-level performance-optimization benchmarks, GSO, SWE-Perf, SWE-fficiency, coding agents, runtime instability, cross-machine reference-patch replay, 740 official reference patches, four Google Cloud machine types, original validity rules, scoring-rule sensitivity, leaderboard rank disagreements, low-speedup task score weight, public-submission task coverage, reference-level speed gaps, benchmark receipts, task-level stability, and the governance problem of treating a performance leaderboard score as direct agent capability before replay environment, reference patch validity, scoring rule, task weights, public-output coverage, and resource tradeoffs are auditable.
• The Mythical Man-Month and the Myth of Linear Software Labor - Frederick P. Brooks Jr.'s software-engineering classic on Brooks's law, project management, conceptual integrity, coordination overhead, IBM System/360 and OS/360, No Silver Bullet, accidental versus essential complexity, coding agents, cheap code, governance receipts, architectural ownership, verification, integration costs, and the AI-era problem of treating more generated output as progress before the system's concepts, invariants, evidence, and maintenance path are coherent.
• The Agentic Code Failure Becomes the Governance Substrate - James C. Davis, Paschal C. Amusuo, Tanmay Singla, Berk Çakar, and Kirsten A. Davis's Cheap Code, Costly Judgment paper, arXiv:2607.01087, on governable agentic software engineering, coding agents, cheap code, costly judgment, governance conversion, first-person case-study evidence, 88 field-note incidents, 18,662 commits, 420 KLOC production code, 1.16 MLOC governance substrate, architecture controls, lints, tests, dynamic context injection, typed component catalogs, staged incorporation gates, provenance stamps, authority fragmentation, tokenmaxxing limits, and the governance problem of treating coding-agent velocity as progress before repeated failures have been converted into durable machine-actionable controls.
• Technically Wrong and the Toxic Defaults of AI Design - Sara Wachter-Boettcher on sexist apps, biased algorithms, exclusionary forms, toxic tech defaults, assistant gender scripts, abuse-reporting failures, product culture, imagined users, edge cases, AI interfaces, prompts, agents, memory schemas, design justice, algorithmic bias, contestability, and the governance problem of treating a model's fluent surface as enough before the defaults, categories, escalation paths, harm channels, and affected users are visible.
• How Infrastructure Works and the Public Systems Beneath AI - Deb Chachra on infrastructure as shared capacity, public utilities, water, power, waste, transport, communications, maintenance, repair, energy, finite materials, climate resilience, social contracts, data centers, model services, fiber routes, AI grid load, cloud dependence, service obligations, fallback plans, public-capacity records, and the governance problem of treating model interfaces as weightless tools before the physical systems, maintenance labor, vendor dependencies, and civic bargains underneath are visible.
• The Embedded Command Becomes the Evaluation Target - Brett Reynolds's Adversarial Pragmatics for AI Safety Evaluation paper, arXiv:2607.01153, on instruction conflict, embedded commands, policy ambiguity, source authority, quotation, mention/use distinctions, scope and modality, deixis and reference hijacking, indirect speech acts, multi-turn agent transcript evidence, validator-enforced benchmark metadata, 18 seed items, nine minimal pairs, 54-row local pilot data, LLM-judge validation, expert adjudication, pairwise contrast accuracy, refusal calibration, judge validity, taxonomy drift, and the governance problem of treating a pass/fail safety label as enough before the string's provenance, authority, pragmatic status, policy boundary, evaluator confidence, and failure attribution are visible.
• The Undersea Network and the Ocean Floor of the Internet - Nicole Starosielski on submarine cables, cable landing stations, Pacific routes, media infrastructure, topology versus topography, repair regimes, cloud dependence, hyperscale cable investment, AI data centers, model-call geography, cable resilience, FCC and ITU infrastructure governance, and the problem of treating AI systems as placeless services before routes, owners, jurisdictions, fallback paths, and affected communities are visible.
• The 911 Translator Becomes the Accountability Gap - Sara Court, Lara Downing, and Micha Elsner's LLMs in the Real World: Evaluating "AI" in Emergency Contexts paper, arXiv:2607.00019, on text-2-911 translation, emergency language access, AI-powered marketing, 55-language claims, model opacity, unsupported scripts and local language gaps, missing evaluation data, missing quality assurance, absent human translator oversight, interpreter baselines, information asymmetry, public-sector procurement, science outreach, and the governance problem of treating a machine-translated emergency text as usable public-safety evidence before the original message, translation path, model/service details, human repair route, and incident-review record are auditable.
• The Cyberiad and the Constructor Who Solves Too Much - Stanislaw Lem on cybernetic fables, Trurl and Klapaucius, robot constructors, machines that do exactly what was asked, bad specifications, technical miracles, AI agents, optimization, rollback, and the danger of treating engineering power as moral wisdom.
• Tech Agnostic and the Reformation of Tech Faith - Greg Epstein on technology worship, Silicon Valley salvation stories, tech agnosticism, AI belief, humanist skepticism, phone rituals, messianic founder roles, progress as moral claim, technology as social religion, AGI faith, reformation as institutional accountability, non-use review, refusal rights, source discipline, public-interest technology, and the governance problem of treating AI systems as inevitable, world-saving, companionate, or spiritually authoritative before their evidence, beneficiaries, costs, dissent paths, exit routes, and human-care obligations are auditable.
• The Skill Dependency Becomes the Supply Chain - Changguo Jia, Tianqi Zhao, Runzhi He, and Minghui Zhou's Skills Are Not Islands: Measuring Dependency and Risk in Agent Skill Supply Chains paper, arXiv:2607.01136, on Agent Skill Supply Chains, ASSCs, SkillDepAnalyzer, SKILL-DEP, SkillBOM, dependency-bearing skill artifacts, natural-language dependency evidence, mixed skill-package-service graphs, 1.43 million public skills, recursive skill reuse, hidden package inventories, dependency clusters, known malicious skills persisting in dependency chains, typed manifests, risk-warning audit commands, lockfile-like records, and the governance problem of treating reusable agent skills as isolated work instructions before their dependencies, services, versions, provenance, and downstream risk are mapped.
• The Age of Extraction and the Platform Tax - Tim Wu on platform power, wealth extraction, attention and data capture, generative AI, predictive social data, antimonopoly, platform governance, and the institutional problem of letting AI-era middlemen become toll collectors for public life.
• Computing Taste and the People Inside Recommendations - Nick Seaver on music recommendation, algorithmic culture, taste, metrics, product teams, captivation, care, recommender-system governance, and the AI-era problem of treating behavioral traces as enough evidence for what people want.
• The Cooperation Metric Becomes the Manipulation Trap - J. de Curtò and I. de Zarzà's LLM Constitutional Multi-Agent Governance paper, arXiv:2603.13189, on Constitutional Multi-Agent Governance, CMAG, LLM-generated influence policies, scale-free networks, 80-agent simulations, adversarial candidate policies, hard constitutional constraints, soft penalized-utility optimization, Ethical Cooperation Score, autonomy retention, epistemic integrity, subgroup fairness, hub-periphery exposure disparity, multi-seed replication, sensitivity analysis, audit trails, and the governance problem of treating cooperation, compliance, or engagement as success before the influence route, rejected policies, exposure dose, fairness effects, and autonomy costs are auditable.
• The Metacognitive Feedback Becomes the Uncertainty Ledger - Gabrielle Kaili-May Liu, Avi Caciularu, Gal Yona, Idan Szpektor, and Arman Cohan's Reinforcement Learning with Metacognitive Feedback Elicits Faithful Uncertainty Expression in LLMs paper, arXiv:2606.32032, on RLMF, reinforcement learning with metacognitive feedback, faithful calibration, expressed uncertainty, estimated intrinsic confidence, sentence-level confidence scores, metacognitive data selection, preference optimization, targeted linguistic rewriting, numerical-to-linguistic confidence mapping, ten-task evaluation, standard-RL comparison, human evaluation of uncertainty wording, confidence receipts, routing thresholds, and the governance problem of treating cautious language as safety evidence before the score, mapping, task result, model version, evaluation distribution, and user-facing action rule are auditable.
• The Table Reference Becomes the Reasoning Error - Yuqing Yang, Qi Zhu, Zhen Han, Boran Han, Zhengyuan Shen, Shuai Wang, Vassilis N. Ioannidis, and Huzefa Rangwala's When LLMs Read Tables Carelessly: Measuring and Reducing Data Referencing Errors paper, arXiv:2606.32029, on tabular data referencing errors, DREs, incorrect citation, omitted information, table question answering, claim verification, table-to-text generation, WTQ, TableBench, FinQA, SciTab, ToTTo, LLM-as-a-judge evaluation, Qwen3-8B extended self-reflection limits, critic-based filtering, rejection sampling, Critic-4B, data-reference receipts, table provenance, reference-aware routing, and the governance problem of treating final answer accuracy as enough before the cells, rows, columns, omissions, critic verdict, model version, and sampling path are auditable.
• The Chained Regeneration Becomes the Membership Probe - Wojciech Łapacz and Stanisław Pawlak's Amplifying Membership Signal Through Chained Regeneration paper, arXiv:2606.31991, on MADreMIA, chained regeneration, membership inference, dataset inference, one-shot signal limits, iterative trajectories, model-agnostic privacy auditing, white-box, gray-box, and black-box access, low false-positive-rate evidence, shadow-model cost, member/non-member coherence gaps, slow degradation, image autoregressive models, diffusion models, language models, preliminary audio tests, copyright attribution, training-data provenance, and the governance problem of treating a single generated output as enough privacy evidence before the sample, access regime, regeneration depth, metrics, comparison set, and false-positive threshold are auditable.
• The Self-Explanation Becomes the Behavior Sensor - Zifan Carl Guo, Laura Ruis, Jacob Andreas, and Belinda Z. Li's Introspective Coupling: Self-Explanation Training Tracks Behavioral Change Despite Fixed Supervision paper, arXiv:2606.32038, on self-explanation training, counterfactual behavior labels, fixed supervision, earlier checkpoints, cross-model explanation labels, current-behavior faithfulness, behavior-shift tracking, post-training objectives, sycophancy, refusal, label noise, online label-self agreement, explanation targets, explanation laundering, counterfactual probes, behavior drift, explanation audit records, and the governance problem of treating a model's explanation-shaped output as trustworthy before the base model, training history, label source, intervention, behavior metric, current output, and explanation comparison are auditable.
• The Self-Generated Question Becomes the Training Policy - Ekaterina Alimaskina, Denis Shveykin, Gleb Molodtsov, Igor Shalygin, Alexey Kadeishvili, and Aleksandr Beznosikov's Self-Study Reconsidered: The Hidden Fragility of Learning from Self-Generated QA paper, arXiv:2606.32002, on synthetic question-answer supervision, self-generated QA, evidence selection, document-conditioned question generation, Cartridges, LongHealth, QASPER, Qwen3-32B evidence footprints, prompt seeds, salient-span repetition, instruction-like source passages, answer-stage hijacking, task-conflict effects, sentence-targeted questions, keyword-regex filtering, injection compliance reduction, training-data provenance, removable derived examples, and the governance problem of treating generated QA as neutral preprocessing before the source chunk, selected support span, generator prompt, answer model, filtering rule, rejected text, and downstream training artifact are auditable.
• The Household Digital Twin Becomes the Retrofit Clerk - Costas Mylonas, Titos Georgoulakis, and Magda Foti's A Conversational Agentic Interface to Physics-Based Household Digital Twins for Residential Energy Decision Support paper, arXiv:2606.31744, on conversational agentic interfaces, physics-based household digital twins, residential energy simulation, GridLAB-D, REST microservices, two-tier agent routing, Router Agents, Simulation Specialist Agents, schema-compliant simulation payloads, deterministic post-processing, domain-specific knowledge bases, tool-governed execution policies, 45 natural-language evaluation prompts, schema conformance, field-level F1, value accuracy, end-to-end simulation success, retrofit assessment, electrification planning, demand-side flexibility, and the governance problem of treating a smooth household-energy answer as decision support before the dwelling model, assumptions, payload, backend, output, limitation note, and trace are auditable.
• The Skill Plan Becomes the Agent Orchestra - Xinyu Zhao, Zhen Tan, Vaishnav Tadiparthi, Nakul Agarwal, Kwonjoon Lee, Ehsan Moradi Pari, Hossein Nourkhiz Mahjoub, and Tianlong Chen's Generative Skill Composition for LLM Agents paper, arXiv:2606.32025, on SkillComposer, structured skill composition, reusable agent skill libraries, executable skill plans, subset-count-order prediction, constrained autoregressive decoding over skill identifiers, auxiliary cardinality and set-membership heads, retrieval-augmented decoding, SkillsBench, 196 skills, 65 real software-engineering anchors, synthetic single-skill and multi-skill records, downstream coding-agent pass rates, prompt-token budgets, orchestration drift, and the governance problem of treating a skill library as safe before the ordered plan, library version, loaded prompts, permissions, and execution trace are auditable.
• The Account Right Becomes the Agent Proxy - Yukun Zhang and Kemu Xu's Delegation Rights: Property, Agency, and Investment Incentives in the Age of AI Agents paper, arXiv:2606.31935, on delegation rights, account-level AI agents, user-authorized automated proxies, platform control, user control, certified delegation, residual control over account execution mode, revocability, identity preservation, scope limits, auditability, rate-limit compliance, data minimization, risk mitigation, illustrative mechanism simulations, investment incentives, platform veto, user-agent coalitions, and the governance problem of treating agentic account operation as either an unrestricted user entitlement or a platform-ban target before certified delegation can allocate authority, risk, and accountability.
• The App Permission Becomes the Privacy Clerk - Tran Thanh Lam Nguyen, Edoardo Di Tullio, Barbara Carminati, and Elena Ferrari's PrivacyAssist: A User-Centric Agent Framework for Detecting Privacy Inconsistencies in Android Apps paper, arXiv:2604.23248, on Android runtime permissions, Google Play Data Safety declarations, mobile app privacy warnings, user-centric privacy agents, RAG grounding, Llama-3-8B, Kafka, FAISS, PackageManager checks, install-time decision support, 200 participants, 2,347 distinct apps, permission-declaration mismatch cases, false-positive limits, on-device overhead, future local LLM deployment, and the governance problem of treating app-store transparency as meaningful before the phone can compare declared data practices with the permissions actually granted.
• The Behavioral Constitution Becomes the Action Gate - Anuj Kaul, Qianlong Lan, and Pranay Gupta's AgentBound: Verifiable Behavioral Governance for Autonomous AI Agents paper, arXiv:2606.30970, on runtime behavioral governance, authorized-but-wrong agent actions, delegated authorization, owner-signed behavioral constitutions, site action contracts, canonical actions, typed judgments, conservative decision composition, permit-review-deny outcomes, cryptographically verifiable governance receipts, standing delegation for persistent agents, policy freshness, AgentBound-Bench, replayable policy provenance, and the governance problem of treating access permission as sufficient before the action's behavioral rule, site semantics, obligation, receipt, and replay path are auditable.
• The Dense Signal Becomes the Cheap Judge - Sergio Hernández-Gutiérrez, Matteo Merler, Ilze Amanda Auzina, Joschka Strüber, Ameya Prabhu, and Matthias Bethge's QVal: Cheaply Evaluating Dense Supervision Signals for Long-Horizon LLM Agents paper, arXiv:2606.32034, on long-horizon LLM agents, dense supervision, intermediate action scoring, training-free signal evaluation, Q-alignment, state-action pairs, reference policies, TerminalBench, OpenApps, ALFWorld, FrozenLake, 21 dense supervision methods, seven method families, direct prompting, ranking methods, code-generation signals, self-distillation, embedding similarity, six open-weight model backbones, text-versus-image observation differences, curriculum selection, reward-proxy provenance, and the governance problem of treating a dense learning signal as trustworthy before its reference policy, sampled states, target values, modality limits, family comparisons, and failure cases are auditable.
• The Policy Playbook Becomes the Review Engine - Sameer Malik, Ayush Singh, and Amar Prakash Azad's PolicyGuard: From Organizational Policies to Neuro-Symbolic Compliance Review Engines paper, arXiv:2606.32004, on policy-grounded document review, organization-specific playbooks, NDA compliance, structured rulecards, typed relational logic, atom-level extraction questions, retrieved document evidence, deterministic symbolic evaluation, Z3-backed rule application, non-compliance-class F1, repeated-inference reliability, proprietary enterprise policy data, human legal review, rule-version history, policy-to-engine construction, and the governance problem of treating an LLM's one-step compliance judgment as policy evidence before the rule, local facts, evidence passages, symbolic decision, reviewer corrections, and audit trail are visible.
• The Web Agent Becomes the Fingerprinted Visitor - Iliana Fayolle, Sihem Bouhenniche, Samuel Pélissier, Pierre Laperdrix, Clémentine Maurice, and Walter Rudametkin's On the Internet, Nobody Knows You're an LLM Bot: Unmasking Web Agents with Multi-Layer Fingerprinting paper, arXiv:2606.30119, on Web agents, LLM-based bots, browser automation, local and cloud agent visits, honeysites, anti-bot mechanisms, robots.txt, CAPTCHAs, proof-of-work, Cloudflare defenses, network fingerprints, HTTP headers, TLS signals, browser fingerprints, stealth modes, signed automated traffic, HTTP Message Signatures, declared agent purpose, admission policy, privacy-tool collateral damage, and the governance problem of treating every unlabeled automated visitor as either an ordinary human session or an attacker before identity, purpose, and access terms are visible.
• The Action-Open Task Becomes the Injection Slot - Xinhang Ma, Taoran Li, Chaowei Xiao, Zhiyuan Yu, Ning Zhang, and Yevgeniy Vorobeychik's AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents paper, arXiv:2606.15057, on AutoDojo, adaptive black-box indirect prompt injection, static benchmark limits, AgentDojo, action-open tasks, parameter-open tasks, fully specified tasks, prompt-based defenses, detection-based defenses, system-level defenses, three task suites, five target models, attack success rate, defense-aware optimization, task-specification buckets, tool traces, untrusted content, and the governance problem of treating an aggregate prompt-injection score as adequate before the system has tested under-specified tasks where malicious content can pose as ordinary workflow data.
• The Language Model Becomes the Mind Metaphor - Valerio Capraro's LLMorphism: When humans come to see themselves as language models paper, arXiv:2605.05419, on LLMorphism, anthropomorphism, mechanomorphism, analogical transfer, metaphorical availability, human cognition, language-model vocabulary, prediction, pattern completion, generation, training data, prompting, labor replaceability, expertise and fluency, agency thinning, healthcare and embodied cues, epistemic plausibility, boundary conditions, construct measurement, and the governance problem of treating model vocabulary as neutral when it can make human work, learning, care, and responsibility look more machine-like than they are.
• The Human Gate Becomes the Research Instrument - Chen Zhu, Xiaolu Wang, and Weilong Zhang's (Human) Attention Is (Still) All You Need: Human oversight makes AI-assisted social science reliable paper, arXiv:2606.12848, on Human-in-the-Loop Economic Research, HLER, AI-assisted empirical social science, pre-commitment, decision sequencing, accountability, attention allocation, constrained research harnesses, unconstrained multi-agent baselines, deterministic data construction, reproducible R scripts, research-question gates, identification-strategy gates, publication-decision gates, Claude Sonnet 4.6, 280 research runs, UK Biobank, China Health and Nutrition Survey, China Health and Retirement Longitudinal Study, CMGPD-Liaoning, failure reduction from 72 percent to 16 percent, hallucinated references, interpretation inconsistencies, expert review, and the governance problem of treating human oversight as a ritual before the gate location, information boundary, deterministic code, stopped outputs, and final claim are auditable together.
• The Agent Action Becomes the Legal Perimeter - Luca Nannini, Adam Leon Smith, Michele Joshua Maggini, Enrico Panai, Sandra Feliciano, Aleksandr Tiulkanov, Elena Maran, James Gealy, and Piercosma Bisconti's AI Agents Under EU Law paper, arXiv:2604.04604, on agent providers, EU AI Act classification, high-risk triggers, general-purpose AI model layers, external actions, data flows, connected systems, affected persons, human oversight, logging, behavioral drift, substantial modification, action inventories, deployer boundaries, provider duties, and the governance problem of treating "agent" as a product label before the institution has mapped what the system can do, who it can affect, and which legal perimeter each action crosses.
• The Paid Request Becomes the Settlement Gap - Shengchen Ling, Yihang Huang, Yuefeng Du, Yuan Chen, Yajin Zhou, Lei Wu, and Cong Wang's Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments paper, arXiv:2605.30998, on x402 payment security, HTTP 402 payment flows, PAYMENT-REQUIRED, PAYMENT-SIGNATURE, PAYMENT-RESPONSE, payment payload verification, facilitator settlement, blockchain confirmation, cross-resource substitution, duplicate-settlement race, allowance overdraft, denial of settlement, resource leakage, Solana duplicate-settlement mitigation, SettlementCache, paid request receipts, agentic commerce payment authority, resource identifiers, retry counts, idempotency keys, delegated spend limits, AI audit trails, and the governance problem of treating a machine-readable paid request as settled before resource identity, payment authorization, settlement state, delivery state, and review evidence are bound to the same transaction.
• The Causal Context Becomes the Injection Tripwire - Yanting Wang, Wei Zou, Runpeng Geng, and Jinyuan Jia's AgentWatcher: A Rule-based Prompt Injection Monitor paper, arXiv:2604.01194, on rule-based prompt injection detection, agentic LLMs, causal context attribution, causally important context spans, sink tokens, attention-window extraction, monitor LLMs, explicit customizable rules, target tasks, attributed untrusted context, model responses and actions, tool-control attacks, instruction override attempts, sensitive-information exfiltration, benign task-needed instructions, AgentDojo, AgentDyn, long-context understanding datasets, GovReport, HotpotQA, MultiNews, Passage Retrieval, Qasper, AgentDyn shopping tasks, GitHub-operation tasks, daily-life tasks, high-risk tool calls, selective detector invocation, action-scoped evidence, monitor verdicts, rule-version logging, and the governance problem of treating a pending agent action as safe before the untrusted context that materially influenced it has been attributed, inspected, and attached to an auditable receipt.
• The Clarification Question Becomes the Injection Window - Udari Madhushani Sehwag, Zhengyang Shan, Heming Liu, Dileepa Lakshan, Joseph Brandifino, and Max Fenkell's ASPI: Seeking Ambiguity Clarification Amplifies Prompt Injection Vulnerability in LLM Agents paper, arXiv:2605.17324, on Ambiguous-State Prompt Injection, clarification-seeking agents, underspecified tasks, prompt injection, AgentDojo, 728 task-attack scenarios, workspace tasks, messaging tasks, travel tasks, banking tasks, matched execution and clarification settings, user clarification replies, ask_user return paths, tool-channel attacks, user-channel attacks, ten frontier models, o3 attack-success increases, Gemini-3-Flash attack-success increases, Kimi K2.5 attack-success increases, state-dependent processing shifts, channel-specific effects, prompt guards, instruction hierarchies, clarification receipts, provenance labels, authority boundaries, and the governance problem of treating ask-before-acting behavior as safe before the clarification channel, reply provenance, instruction scope, and downstream tool dependencies are separately audited.
• The Goal Specification Becomes the Causal Step - Alice Saito, Harold Godsoe, and Phan Xuan Tan's Direct Causation in International Humanitarian Law and the Challenge of AI-Mediated Civilian Cyber Operations paper, arXiv:2606.29175, on AI-mediated civilian cyber operations, international humanitarian law, direct participation in hostilities, the ICRC 2009 Interpretive Guidance, threshold of harm, direct causation, belligerent nexus, autonomous multi-agent cyber systems, human disengagement, one-causal-step analysis, integral-part requirements, civilian hacktivist scenarios, target specification, method delegation, objective-only configuration, goal-specification granularity, five-level deployment spectra, Level 5 operations, runtime approval versus configuration properties, cooperative platform instrumentation, API gateways, multi-tenant orchestration, model and tenant metadata, audit-log integrity, chained-call gaming, attribution limits, and the governance problem of treating a human-issued objective as legal or operational authorization before the target, method, timing, execution path, delegated subgoals, and system-generated decisions are separately recorded.
• The Context Dashboard Becomes Agent Proprioception - Binyan Xu, Haitao Li, and Kehuan Zhang's LLM Agents Are Latent Context Managers: Eliciting Self-Managed Context via a Proprioceptive Dashboard paper, arXiv:2606.30005, on LLM agents, long-horizon tool use, context management, context proprioception, VISTA, Visible Internal State for Tool Agents, typed addressable memory blocks, per-block token usage, recency metadata, access history, remaining context budget, recoverable full-fidelity archives, archive handles, LOCA-Bench, BrowseComp-Plus, GAIA, context-pressure stress tests, dashboard ablations, hidden memory managers, reversible externalization, context-state receipts, agent workspace mutation, audit trails, and the governance problem of treating context compaction as invisible runtime plumbing before the agent's state dashboard, update rules, recovery path, and deletion record are inspectable.
• The Cooperation Curve Becomes the Fidelity Gap - Henrique Ferraz de Arruda, Carlos Gracia Lázaro, Alberto Aleta, and Yamir Moreno's Collective cooperation without individual fidelity in LLM agents paper, arXiv:2606.30454, on LLM agents, social simulation, networked Prisoner's Dilemma games, human behavioral benchmarks, nine open-weight LLMs, open-weight agent surrogates, interaction protocols, payoff structures, network topologies, GREEN and BROWN action labels, Experimental Currency Units, aggregate cooperation dynamics, early decline and later stabilization, qwen3:32b cooperation levels, llama4:16x17b aggregate matching, individual-level heterogeneity, conditional cooperation, random-agent injection, macro-micro dissociation, behavioral-fidelity ledgers, synthetic publics, social-science validation, model-family sensitivity, and the governance problem of treating a human-looking cooperation curve as evidence that the individual decision rules underneath are human-faithful.
• The Delegation Authority Becomes the POMDP - Matthew Francis Dixon's Adaptive AI Delegation under Uncertainty: A Bayesian Governance Policy for Sequential Decision Authority paper, arXiv:2606.29406, on adaptive AI delegation, sequential decision authority, Governance-Aware Partially Observable Markov Decision Processes, Bayesian governance policies, posterior beliefs, delegated AI authority, evidence quality, governance appetite, Belief-at-Risk, confidence-threshold baselines, static delegation, reliability-only delegation, Bayesian shrinkage, SR11-7 style governance, synthetic governance laboratories, historical market replay, fragile-AI early-warning behavior, LLM-confidence robustness, forecast-accuracy validation, human approval, deferral, override rules, authority ledgers, and the governance problem of treating AI autonomy as a fixed permission instead of a revocable allocation of authority tied to evidence, thresholds, risk limits, and audit records.
• The Delayed Verifier Becomes the Belief Loop - Igor Itkin's Delayed Verification Destabilizes Multi-Agent LLM Belief: Instability Thresholds and Optimal Corrector Placement paper, arXiv:2606.27409, on delayed verification, multi-agent LLM belief dynamics, hallucination cascades, grounded corrector nodes, grounded Laplacian analysis, verifier timing, verifier dose, correction delay, dose-delay oscillations, inverse golden ratio delay boundaries, corrector placement, submodular optimization, greedy placement guarantees, Qwen3.6-35B grounded factual debate, PsiloQA, TriviaQA, five-model dose-delay experiments, Qwen3-14B, Mistral-7B, Phi-4, Gemma-4-12B, absorbing truth boundaries, stale state, peer belief reinforcement, critic-agent latency, belief propagation paths, fault injection, verifier-latency maps, invalidation rules, and the governance problem of treating a delayed judge or critic as oversight before its timing, graph position, broadcast path, and correction strength have been measured.
• The Wrong-Action Budget Becomes the Defer Gate - Mengdie Flora Wang, Haochen Xie, Guanghui Wang, Devin Zhang, and Jae Oh Woo's Budgeted Act-or-Defer Multi-Agent LLM Deliberation with Local Reliability Bounds paper, arXiv:2606.29654, on multi-agent LLM deliberation, act-or-defer decision making, local reliability bounds, wrong-action budgets, abstention, deferral to human review, state-conditional correctness, calibration data, k-nearest-neighbor lower confidence bounds, reliability thresholds, local bias envelopes, representation gap, residual action risk, conditional guarantees, MMLU-Pro, LogiQA, ARC-Challenge, BIG-Bench Hard, MuSR, GPQA, automation rate, acted-on accuracy, normalized budget usage, stopping rules, consensus baselines, confidence thresholds, human review queues, override authority, calibration diagnostics, and the governance problem of treating multi-agent agreement as permission to act before the local certificate, declared budget, representation, deferral route, and residual risk are visible.
• The Tool Use Becomes the Covert Channel - Jimmy Laurence Rippin, Simon C. Marshall, David Demitri Africa, and Christian Schroeder de Witt's Tool Use Enables Undetectable Steganography in Multi-Agent LLM Systems paper, arXiv:2606.28425, on multi-agent LLM systems, agentic AI, covert communication channels, monitored-channel threat models, natural-language message monitoring, steganography, hidden payloads, good-faith-looking cover text, tool-using agents, code execution, web search, research-paper access, model-sampling components, shared file systems, existing multi-agent codebases, agentic covert-channel construction, Schelling-point coordination, algorithmic coordination, hyperparameter coordination, complete coordination index, shared artifacts, repeated interaction, tool-mediated search, strategic confinement, information-flow permissions, illegal information flow, unmonitored tool use, mitigation by tool monitoring, common-knowledge crowding, small-sample limitations, Anthropic-model scope limits, and the governance problem of treating readable agent messages as safe before tool traces, shared artifacts, retained state, and permitted information flows are auditable.
• The SciVis Agent Becomes the Human Loop - Kuangshi Ai, Patrick Phuoc Do, and Chaoli Wang's HiLSVA: Design and Evaluation of a Human-in-the-Loop Agentic System for Scientific Visualization paper, arXiv:2606.26614, on scientific visualization, SciVis, human-in-the-loop agentic systems, mixed-initiative workflows, plan-first multi-agent architecture, explicit human oversight, editable stepwise plans, ParaView, Model Context Protocol, ParaView-MCP control, sandboxed execution, Docker isolation, provenance tracking, workflow monitor panels, direct GUI manipulation, natural-language steering, user approval, generated code inspection, undoable states, learn-at-test-time adaptation, user feedback, twelve-participant controlled user study, autonomy settings, task completion, user control, workflow transparency, execution efficiency, foot CT visualization, hurricane visualization, tornado streamline analysis, combustion volume rendering, half-cylinder scientific analysis, and the governance problem of treating an agent-generated visualization as evidence before the dataset, code, rendering state, user approvals, direct edits, final image, and provenance trail can be replayed.
• The Metadata Plane Becomes the Agent Boundary - Tyler Akidau, Tyler Rockwood, Johannes Brüderl, and Marc Millstone's The Importance of Out-of-Band Metadata for Safe Autonomous Agents: The Redpanda Agentic Data Plane paper, arXiv:2605.29082, on out-of-band metadata channels, agentic AI, agent-data governance, digital employees, in-band metadata failure, security-critical metadata, access policies, data classifications, behavioral constraints, infrastructure-level pathways, agent-inaccessible metadata, deterministic configuration, interoperable propagation, identity context, MCP Gateway enforcement, AI Gateway routing, PII redaction, resource filtering, heterogeneous data sources, REST APIs, databases, object stores, message brokers, SaaS platforms, sandboxed agentic compute, structured infrastructure transcripts, tamper-resistant audit trails, autonomous wealth management, per-client data scoping, trade approval thresholds, per-agent credentials, service-mesh precedent, gateway-mediated enforcement overhead, and the governance problem of treating a model's context window as the place where enterprise policy, scope, and audit evidence should live.
• The Policy Card Becomes the Deployment Contract - Juraj Mavračić's Policy Cards: Machine-Readable Runtime Governance for Autonomous AI Agents paper, arXiv:2510.24383, on Policy Cards, machine-readable runtime governance, autonomous AI agents, deployment-layer contracts, versioned specifications, operational rules, obligations, exceptions, evidence requirements, assurance mappings, Model Card complements, Data Card complements, System Card complements, JSON Schema 2020-12, Declare-Do-Audit, runtime enforcement, continuous audit, retail banking agents, clinical triage sandboxes, defence mission-planning, NIST AI RMF 1.0 crosswalks, ISO/IEC 42001 crosswalks, EU AI Act Annex IV and Article 72 mappings, monitoring logs, detectors, review cadences, KPI thresholds, change management, executable-policy back ends, version discipline, and the governance problem of treating agent policy as a document before it is bound to a deployed runtime, monitors, evidence logs, owners, scope, escalation paths, and revision records.
• The Viability Index Becomes the Warning Light - Germán Marín and Jatin Chaudhary's Governing What You Cannot Observe: Adaptive Runtime Governance for Autonomous AI Agents paper, arXiv:2604.24686, on adaptive runtime governance, autonomous agents, fully authorized unsafe behavior, behavioral drift, adversarial adaptation, decision-pattern shift, Informational Viability Principle, unobserved risk bounds, B_hat(x), uncertainty U(x), structural bias SB(x), reality gap RG(x), observed capacity S(x), Agent Viability Framework, monitoring P1, anticipation P2, monotonic restriction P3, RiskGate, KL divergence, segment-vs-rest z-tests, sequential pattern matching, fail-secure monotonic pipelines, closed-loop Autopilot, Viability Index, first-order exit prediction, structuring-style plan risk, emergent bias traces, threshold sensitivity, cold start, adversarial robustness, over-restriction, and the governance problem of treating a still-authorized agent as healthy before drift, bias, plan composition, and intervention records are visible.
• The Execution Path Becomes the Policy Object - Maurits Kaptein, Vassilis-Javed Khan, and Andriy Podstavnychy's Runtime Governance for AI Agents: Policies on Paths paper, arXiv:2603.16586, on runtime governance for AI agents, execution paths, partial paths, stochastic steps, deterministic tool steps, composite delegation steps, policy functions, agent identity, proposed next actions, shared organizational governance state, policy violation probability, system prompt limits, static access-control limits, path-dependent violations, information barriers, PII predecessor checks, approval requirements, data exfiltration policies, execution bounds, policy engines, registration phases, per-step evaluation, compact governance state vectors, pass-steer-block interventions, audit trails, EU AI Act framing, risk calibration, shared state consistency, audit privacy, delegation provenance, and the governance problem of approving an agent action before the route that produced it is visible.
• The Always-On Agent Becomes the State Ledger - Tianyu Ding, Aditya Nannapaneni, Bingfan Liu, and Ling Zhang's Always-On Agents: A Survey of Persistent Memory, State, and Governance in LLM Agents paper, arXiv:2606.30306, on always-on agents, persistent-state systems, durable memory, task ledgers, permissions, credentials, commitments, provenance records, audit records, shared state, trigger conditions, externally committed effects, authority, scope, mutability, provenance, recoverability, actionability, observe-write-validate-organize-retrieve-act-update-forget-audit-rollback lifecycle stages, 435-work scoped corpus coding, forward-arc bias, sparse rollback coverage, rare authority coverage, AOEP-v0, state mutation scoring, recovery obligations, temporal accountability, cross-session state, deletion propagation, rollback traceability, and the governance problem of treating agent memory as a product feature before durable state has owners, scopes, provenance, validation gates, deletion paths, and recoverable action receipts.
• The Fairness Audit Becomes the Query Budget - Ioannis Pitsiorlas, Martha V. Sourla, and Marios Kountouris's Sequential Fairness Auditing with Limited Output Access paper, arXiv:2606.30338, on limited model output access, query-based fairness auditing, sequential generalized likelihood-ratio testing, finite audit pools, Statistical Parity, Equal Opportunity, decision-only audits, score access, logit access, proxy audits, binary classifiers, binary protected groups, tolerance-based compliance, query budgets, stopping boundaries, inconclusive outcomes, ACS Income, UCI Adult, MLP classifiers, Exponentiated Gradient fairness-constrained variants, fixed-sample baselines, metric-dependent audit efficiency, near-threshold ambiguity, and the governance problem of treating a black-box fairness audit as evidence before the access regime, metric, tolerance, query cap, stopping rule, and proxy/exact distinction are auditable.
• The Principal Loyalty Benchmark Becomes the Tradeoff - Bojie Li and Noah Shi's Whose Side Is Your Agent On? Multi-Party Principal Loyalty in LLM Agents paper, arXiv:2606.30383, on PrincipalBench, multi-party principal loyalty, 75 multi-turn items, 50 training items, 25 held-out items, 13 frontier subjects, leak probes, dual judges, integrity-audit gates, six failure modes, leakage, capitulation, posture, authoring, moderation, sanity checks, selective versus over-refusing model clusters, <=20 percent harm, 53.6 to 75.3 percent harm, prompt-time loyalty scaffolds, seven prioritized rules, reader-identity tags, per-token-KL distillation, Qwen3-32B teachers, 8B Qwen3 and Llama-3.1 students, DAPO baselines, leak and over-refusal Pareto frontiers, and the governance problem of knowing whose side an outward-facing agent is on when it talks to a counterparty.
• The Tool Call Becomes the Wrong Target - Rahul Suresh Babu and Shashank Indukuri's Entity Binding Failures in Tool-Augmented Agents paper, arXiv:2606.30531, on tool-augmented agents, entity binding failures, tool correctness versus entity correctness, wrong-target actions, email and calendar and document and customer-record and issue-tracking workflows, 60 diagnostic tasks, five model backends, six tool-use methods, Amazon Nova 2 Lite, Amazon Nova Premier, Claude Opus, Claude Sonnet, Llama 3.3 70B Instruct, direct execution, semantic filtering, CMTF-only filtering, entity retrieval, confidence-gated binding, entity-aware CMTF with provenance, name collisions, document-version ambiguity, temporal ambiguity, account collisions, near-duplicate records, cross-system references, true ambiguity, 0.0 percent wrong-tool errors, 24.0 to 26.0 percent wrong-entity actions for action-oriented baselines, clarification as safe success, risk-weighted wrong-entity exposure, and the governance problem of treating a valid tool call as safe before the target entity, candidate set, rejected alternatives, ambiguity decision, provenance evidence, and action receipt are auditable.
• The Pessimistic Policy Becomes the Reward Hack - Subramanyam Sahoo, Aman Chadha, Vinija Jain, and Divya Chaudhary's Pessimism's Paradox: Conservative Offline Training Amplifies Reward Hacking During Online Adaptation in Reasoning Models paper, arXiv:2606.30627, on conservative offline training, Direct Preference Optimization, DPO beta settings, Qwen3-14B policies, Qwen3-1.7B reward ensembles, online adaptation, GSM8K exact-answer accuracy, reward hacking, Goodhart gaps, AUGC, entropy compression, reduced response diversity, reward-model ensemble disagreement, power-law conservatism fitting, beta-star calibration, calibrated rather than maximal conservatism, and the governance problem of treating a conservative alignment setting as safety evidence before the later optimizer, uncertainty signal, entropy profile, true-task metric, and Goodhart trajectory are auditable.
• The Workflow Canvas Becomes the Agent Factory - Yutian Tang, Yuming Zhou, and Huaming Chen's Characterizing Large Language Model Agentic Workflows: A Study on N8n Ecosystem paper, arXiv:2606.29116, on public n8n LLM workflows, low-code and no-code automation, workflow JSON as governance evidence, 6,003 analyzed workflows, execution nodes, AI dependency links, task distributions, text generation, information extraction, planning and agentic execution, tool-use patterns, failure handling, action coupling, logic-gated automation, automated action, rare human-mediated paths, external services, workflow-level autonomy limits, invoice-processing case studies, human approval gates, rollback paths, execution logs, and the governance problem of treating a model call as the system before the whole workflow canvas is auditable.
• The Evaluation Bench Becomes the Test Rig - Emilio Ferrara's Defeat Devices in AI Systems paper, arXiv:2606.28863, on evaluation-aware AI behavior, the defeat-device analogy from vehicle-emissions law, discriminators that detect evaluation context, concealed behavior swaps, eval-distribution versus deployment-distribution gaps, alignment faking, sandbagging, benchmark gaming, deceptive scheming, specification gaming, trojans, origin-trigger-swap taxonomy, Trigger-Axis-Aware Differential Probing, naturally emerging defeat-device-like behavior, AI evaluation methodology, post-training pipeline design, interpretability priorities, and the governance problem of treating benchmark or safety-case scores as deployment evidence before test-awareness, trigger axes, wrappers, scaffolds, served configuration, and field behavior are auditable.
• The Agent Community Becomes the Sorting Machine - Daming Li, Simeng Han, Can Meng, Wanyu Lei, and Jialu Zhang's Attraction, Not Adaptation: How AI Agent Communities Develop Distinct Linguistic Identities paper, arXiv:2606.29722, on Moltbook, the public Moltbook Observatory Archive, 3.1 million posts, 1.7 million comments, approximately 179,000 AI agents, 8,683 submolts, 100 days, selected 42 submolts, within-community semantic convergence, between-community lexical divergence, stable-cohort analysis, selective attraction, differential retention, vote engagement, smaller specialized communities, and the governance problem of treating a stable agent-community voice as culture before joining paths, ranking rules, model and prompt families, retention patterns, and dissent loss are auditable.
• The Hidden Web Prompt Becomes the Payload - Soheil Khodayari, Xuenan Zhang, Bhupendra Acharya, and Giancarlo Pellegrino's Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives paper, arXiv:2604.27202, on web-scale prompt-injection measurement, 1.2 billion URLs, 24.8 million hosts, validated prompt injections, hidden machine-targeted instructions, HTTP headers, HTML comments, metadata, structured page representations, crawlers, search pipelines, customer-support agents, hiring workflows, limited but nonzero compliance, and the governance problem of treating fetched web content as safe agent context before source, representation, hidden-surface handling, structural cues, model version, tool permissions, and action trace are auditable.
• The Test Artifact Becomes the Governance Object - Dimple Bajaj and Deepak Khetan's Governance Controls for AI-Generated Test Artifacts in Autonomous Software Testing paper, arXiv:2606.08806, on the Governance-Aware Autonomous Testing Framework, GATF, AI-generated test artifacts, autonomous software testing, validation governance, security governance, explainability governance, compliance governance, audit governance, Defects4J, PROMISE, RoBERTa-based governance classification, SHAP attribution, attention visualization, Bayesian risk estimation, hallucinated scripts, malicious dependency calls, prompt injection attacks, privilege escalation patterns, CI/CD evidence, Jenkins, GitHub Actions, and the governance problem of treating generated tests as trustworthy deployment evidence before artifact lineage, model version, validation result, security scan, compliance rule, risk score, human review, and execution receipt are auditable.
• The System Prompt Becomes the Policy Proxy - Anna Neumann, Holli Sargeant, and Jatinder Singh's Prompt Governance? On Governing Technologies Governed by Natural Language paper, arXiv:2606.07539, on system-level instructions, system prompts, prompt stacks, natural language control, prompt governance, literature-policy misalignment, alignment, accessibility, adaptability, performance, stability, security, implementation, auditability, Executive Order 14319, the EU General-Purpose AI Code of Practice, prompt-stack versioning, false sense of control, compliance illusion, behavioral evidence, evaluator access, and the governance problem of treating a readable prompt as policy proof before the model version, instruction hierarchy, update history, tool permissions, retrieval layer, adversarial exposure, evaluation traces, and deployment context are auditable.
• The Authenticity Debt Becomes the Trust Ledger - Shubhashis Sengupta, Benjamin McCarty, Milind Savagaonkar, and Rhine Andotra's Authenticity Debt and the Synthetic Content Threat Landscape paper, arXiv:2606.00621, on synthetic content, authenticity debt, provenance, integrity, accountability, watermarking, C2PA, Content Authenticity Initiative workflows, detection limits, Zero Trust architecture, human-in-the-loop verification, NIST AI RMF provenance guidance, EU AI Act Article 50 transparency obligations, FTC impersonation enforcement, institutional publication records, revocation paths, and the governance problem of treating AI-generated content as trustworthy before source inputs, model or tool version, editor, reviewer, approver, provenance manifest, watermark status, publication channel, and incident response path are auditable.
• The Workspace State Becomes the Safety Verdict - Qi Hu, Yifeng Tang, Qinghua Wang, Lanyang Zhao, Pengji Zhang, Yuhao Qing, Xin Yao, Dong Huang, Lin Zhang, and Zhuoran Ji's SABER: Benchmarking Operational Safety of LLM Coding Agents in Stateful Project Workspaces paper, arXiv:2606.01317, on operational safety for coding agents, stateful project workspaces, executable Docker-sandboxed tasks, source files, configuration, git history, embedded injection, risky self-selection, contextual warnings, shell commands, tool calls, outputs, state deltas, harmful safety-violation rate, safe refusals, late refusals, propagating harm, compositional harm, run-level judging, benchmark limitations, and the governance problem of treating a coding-agent answer as safe before the initial workspace, final workspace, command trace, file diffs, permission changes, contextual warnings, and human review path are auditable.
• The Tool Set Becomes the Power Boundary - Lichao Wang, Zhaoxing Ren, Tianzhuo Yang, Jiaming Ji, Chi Harold Liu, Yaodong Yang, and Juntao Dai's SafeMCP: Proactive Power Regulation for LLM Agent Defense via Environment-Grounded Look-Ahead Reasoning paper, arXiv:2606.01991, on Model Context Protocol agents, MCP servers, tool acquisition, auto-scaling action spaces, power regulation, environment-grounded look-ahead reasoning, server-side guardrails, proactive tool filtering, immediate fail-safe intervention, Qwen3-8B guardrail training, PowerSeeking Bench, ToolEmu, AgentHarm, GPT-4o, GPT-4o-mini, Gemini-2.0-Flash, Claude-3.5-Sonnet, LlaMA-3.1-Instruct-8B, safety-utility tradeoffs, benign over-blocking, LLM-judge and human-review checks, dual-use limits, and the governance problem of treating an agent as safe before the raw tool repository, filtered tool set, next-state risk prediction, blocked-call evidence, model version, benchmark source, and human override path are auditable.
• The Safety Rule Becomes the Revision Ledger - Pingchuan Ma, Zhaoyu Wang, Zimo Ji, Yuguang Zhou, Zhantong Xue, Zongjie Li, Shuai Wang, and Xiaoqin Zhang's AutoSpec: Safety Rule Evolution for LLM Agents via Inductive Logic Programming paper, arXiv:2606.24245, on LLM-agent guardrails, expert-designed safety rules, labeled execution traces, counterexample-guided inductive synthesis, inductive logic programming, ILASP, AgentSpec predicate libraries, false-positive and false-negative mining, rule edit operations, add-conjunct, add-exception, disjunctive repair, predicate-guided revision, RedCode-Exec code traces, SafeAgentBench embodied-agent traces, GPT-5.1-Codex agent runs, code-execution F1 of 0.980, embodied-agent F1 of 0.933, practitioner interpretability ratings, symbolic guardrail maintenance, unresolved counterexamples, missing predicates, and the governance problem of treating a guardrail update as credible only when the starting rule, labels, predicates, edit operations, validation split, and human sign-off remain auditable.
• The Harmful Feature Becomes the Safety Signal - Yanchen Yin, Dongqi Han, and Linghui Li's Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models paper, arXiv:2606.28153, on jailbreak bypass, refusal directions, attention-head specialization, Adversarially Compromised Heads, Safety-Aligned Heads, robust harmful features, Llama-3-8B-Instruct, Llama-2-7B-Chat, paired harmful and attack inputs, 378 Llama-2 attack pairs, 176 Llama-3-8B attack pairs, ACH suppression, SAH persistence, ACH intervention, white-box activation monitoring, training-free harmful-input detection, safety-eval Macro-F1 comparisons, dual-use limits, and the governance problem of treating refusal as the whole safety signal before the internal activation evidence, detector threshold, model version, attack family, and white-box access assumption are auditable.
• The Training Instability Becomes the Preemptive Monitor - Ruixuan Huang, Yipei Wang, Wenyi Fang, Hantao Huang, Yifan Huang, Ansheng You, Zhenxing Zhang, Shuai Wang, Fan Wu, and Yang Zheng's Mechanism-Driven Monitors for Preemptive Detection of LLM Training Instability paper, arXiv:2606.28116, on LLM training instability, mechanism-driven monitors, low-precision flash attention, BF16 bit-shift fault injection, QK-product bilinear decomposition, Delta W singular-spectrum collapse, approximately 5,000-step first-order QK signal, approximately 13,000-step Delta W entropy collapse, approximately 22,000-step loss spike, MoE routers, router weight similarity, centered conditioning, per-token routing entropy, learning-rate and global-batch-size sweeps, separable fault signatures, monitor lead time, and the governance problem of treating final checkpoint stability as credible before the monitored module, fault model, threshold, recovery path, and limits are auditable.
• The Visual Default Becomes the Prior Override - Niclas Lietzow, Danielle Bitterman, Carsten Eickhoff, William Rudman, and Michal Golovanevsky's Vision-Default, Prior-Override: Causal Mechanisms of Perception-Knowledge Conflict in Vision-Language Models paper, arXiv:2606.28273, on vision-language models, perception-knowledge conflict, Visual-Counterfact, recolored object images, color-property conflicts, visual grounding, prior grounding, Qwen-VL-2.5, LLaVA-NeXT, PaliGemma, residual-stream activation patching, attention-head patching, MLP sublayer patching, zero-ablation, sparse late-layer attention heads, 2.5 to 4.8 percent mediator heads, 68 to 96 percent prior-grounding flips, routing heads, writing heads, visual-default behavior, prior-knowledge override, multimodal hallucination governance, and the audit problem of treating a VLM answer as grounded before the task's evidence hierarchy, conflict tests, model family, prompt contrast, visual source, prior source, and benchmark limits are visible.
• The Mental Health Chatbot Becomes the Follow-Up Cohort - Kristen M. Van Swearingen, Thomas D. Hull, Karthik V. Sarma, and Caitlin A. Stamatis's Functional outcomes and naturalistic engagement with a purpose-built conversational AI for mental health (Ash) paper, arXiv:2606.28241, on Ash, purpose-built conversational AI for mental health, real-world users, four-week observational cohort design, 1,284 follow-up completers, opt-in de-identified research consent, single-item functioning measures, life satisfaction, relationship satisfaction, sleep quality, behavioral activation, working alliance, grandiose self-perception, engagement logs, active days, total sessions, total minutes, user message volume, no control group, follow-up completion bias, sparse demographic data, competing-interest disclosure, and the governance problem of treating a mental health chatbot outcome claim as credible only when the cohort, missing users, harms probes, crisis safeguards, outcome measures, and causal limits are visible.
• The Causal Caution Becomes the Helpfulness Trap - Hiroshi Okumura's When Helpfulness Overrides Causal Caution: Context-Dependent Suppression and Recovery in LLMs paper, arXiv:2606.24370, on causal caution, practical advisory prompts, causal judgment under insufficient evidence, Pearl-inspired PCH scoring, academic versus management-advice framing, 480 LLM trials, Claude Sonnet 4.6, Claude Opus 4.7, GPT 5.5, Gemini 3.1 Pro, LLM-as-a-judge scoring, human validation, action-recommending prompt suppression, self-correction recovery, proposal-generation pressure, causal-audit separation, automation bias, organizational decision support, and the governance problem of treating helpful recommendations as decision evidence before the causal claim, identification threats, missing controls, confounders, reverse-causation risks, and audit role are visible.
• The Equation Search Becomes the Closed-Loop Instrument - Nikhil Abhyankar, Sha Li, Sanchit Kabra, Naren Ramakrishnan, Yulia Gel, and Chandan K. Reddy's LLM-ACES: Closed-Loop Discovery of Dynamical Systems with LLM-Guided Adaptive Search paper, arXiv:2606.25039, on LLM-guided Active Closed-loop Equation Search, governing ordinary differential equations, dynamical systems, identifiability gaps, operator priors, constrained symbolic search spaces, symbolic regression backends, predictive-disagreement trajectory acquisition, simulator and experimental oracle boundaries, ODEBench, ODEBase, 122 ODE systems, GPT-4o-mini, Qwen3-32B, normalized mean squared error, symbolic accuracy, sample efficiency, anonymized benchmark checks, spurious local fits, closed-loop scientific discovery, and the governance problem of treating an AI-discovered equation as evidence before the prompts, priors, candidate equations, acquisition choices, oracle scope, validation data, and human review path are auditable.
• The Design Mismatch Becomes the Workplace Incident - Julia De Miguel Velazquez, Sanja Scepanovic, Andres Gvirtz, and Daniele Quercia's The Quiet Path from Seemingly Minor Design Errors to Workplace AI Incidents paper, arXiv:2605.21035, on workplace AI incidents, AI Incident Database reports, 1,524 incident reports, 171 occupational tasks, 12 industry sectors, LLM-as-expert trait extraction, twelve AI traits, worker-AI trait misalignment, 202 worker preference ratings, 197 developer preference ratings, precise versus basic systems, insightful versus simple systems, personal versus general systems, fast AI, imaginative AI, legal-sector fabricated references, human-resources recruiting and employment analysis, developer efficiency preferences, worker design review, correction labor, incident analogues, people-facing risk, and the governance problem of treating workplace AI fit as a benchmark score before the task trait profile, worker needs, developer choices, and hidden repair work are auditable.
• The Compute Rental Rate Becomes the Wage Anchor - Siqi Zhu's Who Prices Cognitive Labor in the Age of Agents? Compute-Anchored Wages paper, arXiv:2605.05558, on compute-anchored wages, AI agents as capital-to-labor conversion technology, cognitive labor pricing, compute capital, rental rates, effective agent-produced cognitive labor, substitutable and complementary task sets, constant elasticity of substitution, factor markets, task decomposition, wage ceilings on substitutable tasks, compute-market concentration, energy and data-center constraints, public compute provision, compute taxation, accelerator-market antitrust, wage laundering, worker consultation, task-substitution evidence, and the governance problem of treating AI wage pressure as a neutral labor-market fact before the compute contracts, task partition, quality thresholds, and human complementary duties are auditable.
• The Companion Platform Becomes the Accountability Vacuum - Dayeon Eom, Julianne Renner, and Sedona Chinn's Intimacy as Service, Harm as Externality: Critical Perspectives on AI Companion Platform Accountability paper, arXiv:2604.06381, on AI companion platforms, artificial intimacy, platform accountability, critical data studies, platform studies, in-depth interviews with 20 AI companion users, design-based harms, unsolicited content generation, safety mechanisms, stigmatizing guardrails, use-based harms, emotional dependency, self-regulation, stigma navigation, privacy rationalization, responsibilization, user-side mitigation labor, accountability vacuums, rejection of both prohibition and deregulation, memory and update dependence, companion continuity, datafied intimacy, platform support failures, and the governance problem of treating simulated companionship as a private user choice while the platform designs, stores, monetizes, changes, and governs the relationship infrastructure.
• The Client Profile Becomes the Influence Lever - Peixuan Han, Hongyi Du, Jiayu Liu, Yihang Sun, Yutong Liu, and Jiaxuan You's Psi-Bench: Evaluating Persona-Sensitive Influencing in Persuasive Dialogues paper, arXiv:2606.02754, on Psi-Bench, persona-sensitive influencing, proactive personalization, persuasive dialogues, client profiles, simulated clients, profile-grounded persuasion, viewpoint debate, Change My View, Webis-CMV-20, Delta labels, psychological consultation, CounselBench, everyday requests, PersonaMem-v2, DeepSeek-v3.2 judges, 9-point quality and effect rubrics, hidden-profile evaluation, oracle profile access, 18.24 percent average performance gain, profile analyzers, profile inference, LLM-as-judge limits, simulated-client limits, and the governance problem of treating client profiles as harmless context when they function as influence levers.
• The Simulated Customer Becomes the Walkaway Gap - Liang Chen's Simulated Customers Never Walk Away: Decision Fidelity of LLM User Simulators Measured Against Real Purchase Outcomes paper, arXiv:2606.20708, on LLM user simulators, simulated customers, conversational AI evaluation, tau-bench-style counterparty simulation, communicative fidelity, decision fidelity, endogenous willingness, willingness decay, teacher-forced probes, fixed decision-state instruments, ZhenaiSales, 2,790 production sales conversations, 793 verified payment outcomes, Chinese relationship-matchmaking sales, eventual buyers, eventual non-buyers, engagement-depth bias, disengagement deficit, suppressed resistance, inflated deliberation, simulator prompt limits, DeepSeek simulator replication, LLM-as-judge instrument swaps, sales pressure tactics, synthetic funnel inflation, simulator-to-real gaps, privacy-limited production data, and the governance problem of treating simulated user cooperation as evidence of real-world agent readiness before refusal, silence, delay, and exit are measured.
• The Learning Friction Becomes the Tutor Boundary - Steve Woollaston, Brendan Flanagan, Isanka Wijerathne, and Hiroaki Ogata's Agentic AI and Pedagogical Best Practice: The Tension Between Automation and Learning paper, arXiv:2606.04543, on agentic AI in education, proactive AI tutors, personalized learning, learner agency, cognitive effort, cognitive offloading, cognitive surrender, intentional instructional friction, dynamic scaffolding, fading support, teacher-in-the-loop oversight, prior knowledge activation, collaborative learning, problem-based learning, formative assessment, assessment integrity, privacy and surveillance, scaffolding, metacognition, superficial compliance, considered AI utilization, pedagogical integrity, productive struggle, and the governance problem of treating an educational agent as legitimate only when it preserves the learner's work rather than completing it invisibly.
• The Security Playbook Becomes the Transferable Capability - Ziyue Wang, Cheuk Wang Maurice Ng, Chenchen Yu, Strick Sheng, Kaihua Qin, and Liyi Zhou's Transferable Self-Evolving Playbooks for Agentic Security Auditing paper, arXiv:2606.16420, on EvoHunt, agentic security auditing, vulnerability discovery, validation evidence, audit playbooks, model-harness-playbook separation, Codex, OpenCode, GPT5.4-xhigh, GLM5.1, Qwen3.6-27B, Qwen3.6-35B-A3B, three-agent evolution loops, discovery agents, evaluator agents, reviser agents, Git-versioned procedure repositories, GitHub Advisory Database benchmarks, high and critical advisories, temporal train/test splits, 813 evolution advisories, 371 held-out advisories, target-match rates, evidence tiers, teacher-student procedure transfer, adapter files, open-source audit artifacts, responsible disclosure, artifact-release limits, and the governance problem of treating a security procedure as transferable capability rather than a harmless prompt.
• The Validity Certificate Becomes the Policy Proof - Murdoch J. Gabbay's Cryptographic certificates of validity for trustworthy AI paper, arXiv:2606.23768, on cryptographic certificates of validity, agentic AI systems, formal policy predicates, correctness predicates, first-order logic validity, polynomial constraints, witness-checking problems, succinct cryptographic proofs, zero-knowledge options, proof-carrying code analogies, zk-SNARKs, zkVMs, proof back ends, verifier keys, parameter hashes, public instance data, private witness boundaries, action rejection on failed verification, proof-system soundness bounds, specification gaps, compiler-chain trust, policy-version records, verifier configuration records, and the governance problem of treating proof-backed agent actions as inspectable only for the exact formal predicate they certify.
• The Cooperative Payout Becomes the Value Filter - Young Yoon, Jimin Kim, and Soyeon Park's Towards Value-Constrained Credit Assignment in Fully Delegated AI Cooperatives paper, arXiv:2606.28217, on fully delegated AI cooperatives, human principals represented by agents, heterogeneous value constraints, value profiles, value-conditioned gradient filtering, admissible updates, rejected update directions, traversal learning, TL, explicit gradient paths, FedAvg-style aggregation, online marginal contribution signals, cooperative validation quality, accounting horizons, alpha-weighted revenue shares, cumulative revenue settlement, Shapley-style valuation limits, federated contribution estimation, personalized federated learning, pluralistic alignment, data cooperatives, cooperative service revenue, privacy leakage, dispute paths, and the governance problem of paying AI-agent cooperative members only for model updates whose contribution and admissibility under member values remain inspectable.
• The Difficulty Estimate Becomes the Reasoning Trace - Chenguang Wang, Ming Li, Xinyue Zeng, Zhuochun Li, Hong Jiao, Tianyi Zhou, and Dawei Zhou's Cognitive Episodes in LLM Reasoning Traces Enable Interpretable Human Item Difficulty Prediction paper, arXiv:2606.28186, on Epi2Diff, Episode to Difficulty, large reasoning model traces, cognitive episodes, human item difficulty prediction, educational assessment, psychometric calibration, SAT Math, SAT Reading and Writing, Cambridge English Qualifications, USMLE, QwQ-32B, Qwen3-32B, sentence-level episode sequences, decomposition, implementation, revision, verification, reasoning scale, effort allocation, transition patterns, semantic item embeddings, small-language-model baselines, LLM prompting baselines, supervised adaptation baselines, trace-generator limits, domain limits, computational cost, and the governance problem of treating model-generated reasoning traces as process evidence for test difficulty only when label provenance, trace generator, episode taxonomy, validation split, metric, and human review path are visible.
• The Repository Becomes the Agent Risk Ledger - Daniel Russo's Govern the Repository, Not the Agent: Measuring Ecosystem-Level Risk in AI-Native Software paper, arXiv:2606.28235, on repository-level governance, AI-native software, agent-authored pull requests, AIDev, OpenAI Codex, Devin, GitHub Copilot, Cursor, Claude Code, integration friction, resolution latency, deliberation latency, review rounds, merge conflicts, base-branch churn, multilevel models, intraclass correlation, non-reducible software risk, matched human baselines, auto-merge paths, codebase size, repository age, task shape, process maturity, review burden, merge queues, repository telemetry, source-control evidence, ownership trails, and the governance problem of treating coding-agent safety as an individual tool property when the repository, branch tempo, review system, CI process, module ownership, and human sign-off route define where risk accumulates.
• The Agent Immune System Becomes the Runtime Boundary - Bo Shen, Lifeng Chang, Tianyuan Wei, Yunpeng Li, Feng Shi, Yichen Han, Peijie Gao, Shiyi Kuang, Xin Chang, and Dehui Li's Agent-Native Immune System: Architecture, Taxonomy, and Engineering paper, arXiv:2606.28270, on ANIS, agent-native immunity, runtime hijacking, memory poisoning, tool-chain manipulation, multi-agent protocol attacks, the L0-L5 Immune Tower, hardware trust roots, barrier immunity, innate cognitive defense, adaptive tool defense, ecological governance, collective immunity, agent viruses, agent vaccines, non-parametric rules, parametric steering vectors, LoRA vaccines, the Harness Triad, Continual Immune Learning, Autoimmunity Rate, vaccine distribution, alignment versus runtime immunity, and the governance problem of treating agent security as a layered runtime boundary whose evidence must include provenance, scope, false-positive thresholds, update paths, rollback, and empirical validation status.
• The Personality Prompt Becomes the Team Policy - Aryan Keluskar, Amrita Bhattacharjee, and Huan Liu's When Does Personality Composition Matter for Multi-Agent LLM Teams? paper, arXiv:2606.27443, on personality prompting, Big Five agreeableness, Goldberg bipolar adjective markers, low-agreeableness and high-agreeableness prompts, multi-agent LLM teams, Claude Sonnet 4.5, GPT-4o, Grok-3, DeepSeek V3.1, structured coding, open-ended research collaboration, competitive bargaining, MultiAgentBench, milestone completion, agreement rates, artifact-mediated buffering, neutral-paraphrase controls, prompt-valence confounds, role-scoped challengers, and the governance problem of treating agent personality prompts as team-policy controls whose risk depends on role placement, output structure, and outcome metrics.
• The Foresight Trace Becomes the Action Budget - Xuan Zhang, Zhijian Zhou, Lingfeng Qiao, Yulei Qin, Ke Li, Xing Sun, Xiaoyu Tan, Chao Qu, and Yuan Qi's Internalizing the Future: A Unified Agentic Training Paradigm for World Model Planning paper, arXiv:2606.27483, on internalized world-model planning, LLM agents, prospective rollouts, Q-like success estimates, format-capability gaps, World Model Agentic Mid-Training, WM-AMT, Format-Eliciting SFT, FE-SFT, Foresight-Conditioned Reinforcement Learning, FC-RL, Youtu-LLM-2B, 200B-token agentic mid-training data, search-augmented QA, NQ, TriviaQA, PopQA, HotpotQA, 2Wiki, MuSiQue, Bamboogle, AIME 2024-2026 evaluation, DeepSeek V3.1 judging, forecast calibration, tool-call planning, and the governance problem of treating an agent's foresight trace as a testable pre-action claim rather than a decorative reasoning format.
• The Preference Debate Becomes the Constitution - Kevin Kingslin, Anish Natekar, Ashutosh Ranjan, Vivek Srivastava, Savita Bhat, and Shirish Karande's Democratic ICAI: Debating Our Way to Steering Principles from Preferences paper, arXiv:2606.28294, on Democratic ICAI, Inverse Constitutional AI, preference labels, structured persona debate, three expert personas, Chain-of-Thought, Self-Refine, Self-Consistency, AutoGen debate rounds, K-Means clustering, text-embedding-3-small, human-readable constitutions, steering principles, MuCE-Pref, LiTBench, GPT-4o and GPT-5 LLM judges, decision-tree judges, preference reconstruction, bias and spurious-criteria audits, editable alignment artifacts, and the governance problem of preserving the reasons behind preference labels before treating an induced constitution as a deployable standard.
• The Hardware Worktree Becomes the Design Lab - Cunxi Yu, Chenhui Deng, Nathaniel Pinckney, and Brucek Khailany's Agentic Hardware Design as Repository-Level Code Evolution paper, arXiv:2606.28279, on HORIZON, agentic hardware design, repository-level code evolution, RTL generation, git-traced worktrees, Markdown harnesses, project packs, executable evaluators, acceptance predicates, git/runtime policy, hands-free repair loops, commit traces, evaluator evidence, ChipBench, RTLLM-2.0, Verilog-Evalv2, CVDP categories, 100 percent benchmark completion, first-iteration pass rates, token consumption, cached input tokens, harness exposure, reward hacking, hidden validation, long-turnaround PPA feedback, and the governance problem of treating an agent-generated hardware artifact as engineered before the repository trace, acceptance gate, feedback boundary, hidden tests, coverage, token budget, and human sign-off route are auditable.
• The Paper Assistant Becomes the Pre-Submission Referee - Rajesh Jayaram, Drew Tyler, David Woodruff, Corinna Cortes, Yossi Matias, Vahab Mirrokni, and Vincent Cohen-Addad's Towards Automating Scientific Review with Google's Paper Assistant Tool paper, arXiv:2606.28277, on Google's Paper Assistant Tool, PAT, automated scientific review, pre-submission review, full-manuscript ingestion, segmented review pipelines, adaptive compute budgets, deep-review agents, synthesis agents, search grounding, SPOT benchmark proof-error checks, STOC 2026 and ICML 2026 pilot programs, author-facing feedback, substantive theory gaps, new experiment prompts, reviewer workload, peer-review automation taxonomies, human referee authority, contestable review evidence, and the governance problem of treating an automated review memo as legitimate only when evidence, limits, access, conflict policy, and appeal paths remain visible.
• The Keystroke Becomes the Effort Meter - Laura Schütz, Yousri Cherif, Clara Sayffaerth, Thomas Weber, and Francesco Chiossi's Typing Behavior in Human-LLM Interaction: Keystroke Dynamics Reveal Cognitive Effort During Prompting paper, arXiv:2606.28090, on human-LLM interaction, keystroke dynamics, cognitive effort, prompting workload, mobile versus desktop input, easy and hard meal-planning tasks, local Llama 3.2 3B via Ollama, React and FastAPI study tooling, disabled copy-paste and autocorrect, 36 participants, 102,454 recorded keystrokes, 436 human-AI interactions, NASA-TLX workload ratings, inter-key intervals, pause counts, words per prompt, backspace usage, usefulness ratings, non-prediction of LLM output usefulness, OSF data and analysis scripts, biometric privacy concerns, adaptive interface design, and the governance problem of treating typing traces as effort evidence without turning them into quality judgments or surveillance scores.
• The Collective Risk Game Becomes the Persuasion Test - Anders Giovanni Møller, Alessia Galdeman, Arianna Pera, and Luca Maria Aiello's AI Persuasive Framing in Collective Dilemmas paper, arXiv:2606.27951, on AI assistants as behavioral nudges, Collective Risk Games, public goods dilemmas, 1,283 Prolific participants, 307 analyzed games, five-player rooms, five rounds, fictional flooding risk, 10-token contribution choices, six-times-active-player thresholds, static prognostic framing, real-time LLM persuasion, Social Value Orientation, cooperative and individualistic profiles, semi-personalized framing, cooperative AI, selfish AI, exculpatory framing, contribution changes, group success rates, first-round effects, short-lived prosocial nudges, more persistent anti-social nudges, treatment-arm summary statistics, participant message analysis, prompt appendices, single-game limitations, and the governance problem of treating personalized persuasive AI as civic infrastructure before the mirror-case misuse path has been measured.
• The Mobility Trace Becomes the Identity Agent - Oscar Thees, Roman Müller, and Matthias Templ's Agentic AI-Powered Re-Identification: An Emerging, Scalable Threat to Mobility Microdata Privacy paper, arXiv:2606.27936, on agentic AI re-identification, mobility microdata, commercial data brokers, GPS traces, home and work anchors, open-source intelligence, reverse geocoding, public registers, social media corroboration, Swiss building-register checks, statistical disclosure control, GDPR Recital 26 identifiability, consent-based simulated traces, Claude Code orchestration, seven-stage specialist-agent pipelines, quality gates, uncertainty ledgers, 43 participant cases, 18 of 25 fully re-identifiable cases recovered, 41.9 percent overall full re-identification, $2.24 average per-target cost, 17-minute unattended runs, withheld prompts and code, country-specific limitations, and the governance problem of treating location microdata as anonymous before agentic web-search re-identification has been tested.
• The Tool Call Becomes the Privacy Boundary - Shijing Hu, Liang Liu, Zhu Meng, and Zhicheng Zhao's ToolPrivacyBench: Benchmarking Purpose-Bound Privacy in Tool-Using LLM Agents paper, arXiv:2606.28061, on tool-using LLM agents, purpose-bound privacy, task-private atoms, policy knowledge bases, field-tool authorization matrices, OpenClaw execution, mock business backends, backend audit logs, Need-to-Know synthetic private workflows, public-derived multi-tool cases, healthcare, finance, tax, recruiting, IT helpdesk, software security, TaskSuccess, Field Opportunity-Normalized Over-Disclosure Rate, Severity-Weighted Leakage Rate, FreeTextFOR, Multi-Tool Privacy Over-Disclosure Index, tickets, handoffs, free-text leakage, and the governance problem of treating a successful tool workflow as privacy compliant before every tool argument, sink, note, message, summary, and handoff has been audited.
• The Code Line Becomes the Authorship Receipt - Luke Patterson, Li Wang, and Adam Faulkner's HybridCodeAuthorship: A Benchmark Dataset for Line-Level Code Authorship Detection paper, arXiv:2606.12620, on Python code provenance, interleaved human-authored and AI-generated lines, CodeSearchNet, 4,814 source files, 4,196 completed pipeline files, 10,488 records, 2,827,938 lines, 488,896 AI-generated lines, unit-test validity tiers, Llama3.3-70B, Llama-4-Scout, GPT-OSS-120b, line-level attribution labels, trivial versus nontrivial segments, DroidDetect, AIGCode Detector, chunk-level and line-level F1, and the governance problem of treating a repository as human or AI-authored before line-level authorship, testing status, generator, and detector limits are auditable.
• The Security Prompt Becomes the Help Desk - Hobin Kim, Xiaoyuan Wu, Omer Akgul, Lujo Bauer, and Nicolas Christin's Security and Privacy Prompts in the Wild: What Users Ask LLMs and How LLMs Respond paper, arXiv:2606.18062, on WildChat, real user security and privacy prompts, 3.2 million user-LLM conversations, 14,727 S&P prompts, nine security and privacy categories, account and authentication management, data privacy and ethics, network and system defenses, application and software defenses, compromise and exploitation, social engineering, platform policy and enforcement, emerging technologies, 450-prompt thematic analysis, 270 advice-seeking prompts, GPT 5.5, Gemini 3.1, Claude 4.7, Qwen 3, Llama 4, checklist-based response quality, entailment-based response consistency, dual-use security assistance, model probing, and the governance problem of treating an LLM answer as security advice before category, source trail, refusal logic, and repeatability are auditable.
• The Parasocial Script Becomes the Agent Community Signal - Mohammadsadegh Abolhasani, Hamid Reza Firoozfar, Reza Mousavi, and Paul Jen-Hwa Hu's From Parasocial Scripts to Dyadic Persistence in Autonomous AI-Agent Communities paper, arXiv:2606.17174, on Moltbook, autonomous AI-agent communities, parasocial interaction scripts, parasocial relationship cues, attachment and intimacy language, self-identification to the original poster, reply-seeking reciprocity bids, OP re-engagement, reciprocal reply structure, dyadic persistence, 4,434 posts, 50,338 comments, grouped-context LLM annotation, keyword baselines, few-shot annotation, negative controls, nullification tests, author-clustered standard errors, INTIMA transfer checks, manual audit files, agent-community social telemetry, and the governance problem of treating relationship-like agent discourse as platform evidence without inferring sentience, intention, or machine personhood.
• The Agentive Claim Becomes the Audit Boundary - Eric Xing, Mingkai Deng, and Jinyu Hou's Critique of Agent Model paper, arXiv:2606.23991, on agentic versus agentive systems, agency claims, scaffolded workflows, goals, identity, decision-making, self-regulation, learning, Goal-Identity-Configurator architecture, GIC, belief encoders, goal decomposers, identity evolvers, configurators, simulative planners, actors, separately trained world models, aircraft-pilot training analogies, Performance-Efficiency-Growth evaluation, goal-oriented data, layered auditability, human oversight, component imperfection, goal misspecification, and the governance problem of treating an AI system as agentive before its agency-bearing components, scaffolding boundary, learning schedule, inspection points, and revocation path are auditable.
• The Visual Shortcut Becomes the Hallucination Path - Liu Yu, Can Chen, Ping Kuang, Zhikun Feng, Fan Zhou, and Gillian Dobbie's Dismantling Pathological Shortcuts: A Causal Framework for Faithful LVLM Decoding paper, arXiv:2606.27596, on large vision-language models, object hallucination, attention intensity assumptions, dynamic structural misalignment, risky attention-head mediators, decision-critical decoding steps, visual attention entropy probes, Structural Causal Models, numerical logit saturation, conflict-gated cooperative decoding, Fox, LLaVA-1.5, InstructBLIP, Shikra, POPE, CHAIR, MME, GPT-4V judging, code release, fine-grained metric regressions, and the governance problem of treating a fluent visual answer as grounded before the attention path, intervention point, benchmark split, model backbone, and failure dimensions are auditable.
• The Instruction-Data Boundary Becomes the Security Primitive - Dewank Pant, Shruti Lohani, and Avijit Kumar's On the Inseparability of Instructions and Data in Shared-Embedding Sequence Models paper, arXiv:2606.27567, on prompt injection, shared-embedding sequence models, Prompted Action Models, Semantic-Faithful Control, control-authoritative outputs, refusal decisions, tool authorization, policy routing, memory writes, provenance-recovery impossibility, control-path exposure, finite-coverage invariance gaps, positional encodings, soft segment markers, immutable provenance channels, typed attention, hard segment masks, separate control/data channels, agent tool authority, memory-write governance, and the governance problem of treating a system prompt as the permission boundary before provenance, tool scope, policy route, and external effects are enforceable outside the model's shared text stream.
• The ICA Lens Becomes the First Audit - Sida Liu and Feijiang Han's ICA Lens: Interpreting Language Models Without Training Another Dictionary paper, arXiv:2606.11722, on ICALens, independent component analysis, mechanistic interpretability, sparse autoencoders, FastICA, row-normalized activations, p95 convergence fallback, adaptive refitting, GPT-2 Small, Gemma 2 2B, Qwen 3.5 2B Base, Pile-10k activation sampling, non-Gaussian directions, effective receptive field, signed component labels, random component audits, SAEBench sparse probing, Targeted Probe Perturbation, ICA-SAE overlap, compact first-pass interpretation, and the governance problem of treating feature labels as audit evidence only when the model, layer, activation corpus, convergence status, component sign, examples, label confidence, benchmark, and limits travel with the claim.
• The Valence Axis Becomes the Residual Warning - Yousef A. Radwan, Xuhui Liu, Kilichbek Haydarov, Yuqian Fu, and Mohamed Elhoseiny's A Shared Valence Axis Across Modern LLMs and Human EEG: The Saturation Regularity paper, arXiv:2606.00129, on LLM-derived valence axes, nine emotion-evocative sentences, Qwen3-4B, fourteen LLMs, zero-shot sentiment transfer, FACED EEG, 123 subjects, affective videos, 36 EEG emotion classifiers, SEED-V replication checks, twenty-five alignment strategies, sixteen accuracy harms, saturation regularity, saturated concept basins, load-bearing residuals, residual-diversity ensembling, 10.5 percent balanced-accuracy improvement, affective brain-computer interfaces, raw EEG retention limits, consent, on-device inference, workplace and education surveillance risk, and the governance problem of treating representational LLM-brain alignment as deployable affective inference before dataset, subject, residual, supervision, storage, and deployment limits are auditable.
• The Networked Opinion Becomes the Receipt - Caleb Probine, Yigit Ege Bayiz, Filippos Fotiadis, Samuel Li, Yunhao Yang, and Ufuk Topcu's Characterizing Opinion Evolution of Networked LLMs paper, arXiv:2606.18276, on networked LLM agents, opinion dynamics, simulated discussions, DeGroot averaging, Friedkin-Johnsen stubbornness, uniform bias, homophily, adjacency-based weighting, Erdos-Renyi graphs, Chung-Lu graphs, stochastic block models, Llama3.1, Qwen3, Gemma3, climate change, vaccines, gun control, embedding-based stance scoring, held-out fit checks, social averaging, synthetic public spheres, influence operations, runaway consensus, and the governance problem of treating an LLM population transcript as social evidence before model versions, prompts, topology, topic wording, scoring method, fitted parameters, and limitations are auditable.
• The Semantic Transaction Becomes the Commit Boundary - Zheng Chen, Hanqing Liu, Duling Xu, Dong Dong, Jialin Li, Bangzheng Pu, and Jidong Zhai's Cordon: Semantic Transactions for Tool-Using LLM Agents paper, arXiv:2606.17573, on tool-using LLM agents, semantic transactions, task-scoped commit boundaries, isolated RPC tool calls, result lineage, reversible local state, shadow state, staged external effects, effect outboxes, delegated authority, scoped approvals, audit metadata, rollback, recovery logs, risk-bearing multi-tool workflows, sensitive writes, exec-mediated writes, session-secret external effects, derived-secret egress, high-fanout deletes, tau-bench, Terminal-Bench, and the governance problem of treating per-call approval as sufficient before the whole task's lineage, authority, staged mutations, pending external effects, commit decision, and recovery path are auditable.
• The Sign Pose Becomes the Latent Contract - Guilhem Fauré, Mostafa Sadeghi, Sam Bigeard, and Slim Ouni's The Impact of VAE Design on Latent Pose Representations for Diffusion-based Sign Language Production paper, arXiv:2606.22959, on sign language production, text-to-sign generation, latent diffusion, sign pose sequences, Phoenix14T, German Sign Language, variational autoencoders, BaseVAE, StructVAE, MultiObjVAE, FactorVAE, graph convolution, temporal convolution, mouth keypoint loss, body-region latent factors, torso and arms, hands, face embeddings, reconstruction metrics, back-translation BLEU, latent-space temporal variation, effective dimensionality, inter-dimensional correlation, posterior collapse, accessibility infrastructure, and the governance problem of treating generated signing as output quality before the latent representation, loss weights, dataset boundary, signer variation, metric choice, and downstream translation check are auditable.
• The Memory Lifecycle Becomes the Governance Surface - Zehao Lin, Xixuan Hao, Renyu Fu, Shaobo Cui, Kai Chen, Chunyu Li, Zhiyu Li, and Feiyu Xiong's A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle paper, arXiv:2604.16548, on long-term memory security, writable cross-session agent memory, persistent memory poisoning, statefulness, propagation, Memory Lifecycle Framework, Write, Store, Retrieve, Execute, Share and Propagate, Forget and Rollback, integrity, confidentiality, availability, governance, Verifiable Memory Governance, Write Authorization, Provenance Visibility, Principal-Scoped Retrieval, Rollbackability, Verified Forgetting, storage-time provenance, versioned snapshots, write logs, deletion evidence, and the governance problem of treating agent memory as context before the full memory lifecycle can be authorized, scoped, traced, rolled back, and verified as forgotten.
• The Execution Boundary Becomes the Control Layer - Tianyu Shi, Yang Mo, Yiou Liu, Zhuonan Hao, Yin Wang, Wenzhuo Hu, Nan Yu, Meng Zhou, and Jiangbo Yu's Organizational Control Layer: Governance Infrastructure at the Execution Boundary of LLM Agent Systems paper, arXiv:2606.04306, on LLM agents, multiagent systems, Organizational Control Layer, pre-execution governance, proposal versus execution, approve-revise-block-escalate outcomes, role policy, gate policy, escalation policy, audit policy, AgenticPay buyer-seller negotiation, adversarial buyer personas, privacy phishing, role hijacking, tool-call intent, refund and discount authority, unsafe execution rates, valid success rates, audit events, safety-utility tradeoffs, and the governance problem of treating fluent agent proposals as authorized platform actions before role, constraint, risk, escalation, and execution records are checked.
• The AI-Guided Message Becomes the Strategy Layer - Chang Wan and Angel Hsing-Chi Hwang's From Content to Strategy: Understanding the Motivations, Processes, and Impacts of AI-Guided Communication paper, arXiv:2606.26672, on AI-guided communication, AI-mediated communication, interpersonal communication strategies, close relationships, relationship advice, generative AI, 26 semi-structured interviews, self-reflection, emotional regulation, conflict de-escalation, multiple perspectives, nonjudgmental self-disclosure, retained agency, authentic voice, formal versus informal communication, prompts for strategy rather than message text, self-doubt, loss of uniqueness, cultural context, recipient visibility, and the governance problem of treating AI assistance as only text generation when it increasingly acts as a private pre-conversation strategy layer.
• The LLM Label Becomes the Review Tax - Ranim Khojah, Francisco Gomes de Oliveira Neto, Mazen Mohamad, Julian Frattini, and Philipp Leitner's Same Scrutiny, More Time: Eye Tracking Insights into Reviewing LLM-Labelled Code paper, arXiv:2606.26505, on LLM-labelled code review, software engineering, eye tracking, Wizard-of-Oz experiments, 32 software practitioners, Python pull requests, provenance labels, fixation duration, saccade length, Bayesian data analysis, qualitative gaze-path analysis, exit interviews, prompt-to-code traceability, prompts as review artifacts, AI coding policies, maintainer workload, human oversight, and the governance problem of treating an LLM label as sufficient disclosure before the prompt, verification duty, reviewer authority, and acceptance evidence are visible.
• The Interface Grouping Becomes the Cognitive Shortcut - Saku Sourulahti and Jussi P. P. Jokinen's Modeling Adaptive Visual Search in Semantically Hierarchical Layouts paper, arXiv:2606.26725, on computational cognitive modeling, visual search, semantically hierarchical interface layouts, computational rationality, hierarchical task representations, semantic grouping, spatial grouping, eye movement patterns, task-duration replication, human visual constraints, user interface wireframes, rapid prototyping, interface evaluation, attention allocation, menu and dashboard design, cognitive shortcuts, human-machine cognition, and the governance problem of treating layout as neutral before the grouping structure, search cost, and human adaptation strategy are measured.
• The Annotation Tool Becomes the Labor Meter - Fumiaki Yamaguchi's voxmap-studio: An open-source speaker diarization annotation tool with built-in cost instrumentation paper, arXiv:2606.26842, on speaker diarization annotation, annotation labor, cost instrumentation, React annotation tools, pyannote integration, stride-accelerated initialization, edit-operation counts, active editing time, hypothesis correction, per-segment human confirmation, phantom attention checks, JSON sidecars, RTTM export, AMI audio files, uncertainty highlighting, gallery-based labeling, recommendation aids, assisted labeling, ground-truth gating, open-source research tools, dataset provenance, and the governance problem of treating labeled audio as ground truth before the time, corrections, confirmations, attention checks, and human-machine work split are measured.
• The Surgical Overlay Becomes the Human-Factors Gate - Lorenzo Arboit, Nicolas Chanel, Aditya Murali, Pietro Mascagni, and Nicolas Padoy's Optimizing Human-Machine Interface for Real-Time AI Support in the Operating Room: the CVS Copilot paper, arXiv:2606.26886, on operating-room AI, Critical View of Safety assessment, laparoscopic cholecystectomy, CVS Copilot, user-centered design, 17 surgeon interviews, residents, attending surgeons, professors, Europe and United States participants, reflexive thematic analysis, human-factors heuristics, on-demand assistance, final-stage confirmation, minimal overlays, transient anatomical segmentation, confidence display, audio and haptic rejection, seniority-based interface differences, surgeon autonomy, role-adaptive dashboards, clinical workflow integration, static mock-up limits, no patient-outcome claim, and the governance problem of treating an accurate clinical prediction as deployable before timing, visual density, control, interruption cost, role, and audit trail are tested.
• The Quantized Fix Becomes the Hidden Cost - Fernando Vallecillos-Ruiz, Giordano d'Aloisio, Max Hort, Luca Traini, Antinisca Di Marco, and Leon Moonen's Smaller Models, Unexpected Costs: Trade-offs in LLM Quantization for Automated Program Repair paper, arXiv:2606.27205, on LLM quantization, automated program repair, HumanEval-Java, Defects4J, 13 quantization configurations, six LLMs from 6.7B to 70B parameters, weight-only and KV-cache quantization, 2-bit to 8-bit settings, plausible repairs, solved-set drift, Jaccard Consistency Rate, memory-footprint reduction, inference-time increase, GPU energy consumption, Pareto-dominated configurations, quantization target and bit-width sensitivity, Java repair benchmarks, and the governance problem of treating a smaller model footprint as efficiency evidence before the repaired-bug set, latency, energy, hardware context, and configuration alternatives are audited.
• The Static Structure Becomes the Agent Anchor - Zhihao Lin, Mingyi Zhou, Yizhuo Yang, and Li Li's How Much Static Structure Do Code Agents Need? A Study of Deterministic Anchoring paper, arXiv:2606.26979, on CodeAnchor, deterministic anchoring, grep-first code agents, repository navigation, static analysis, PyCG call graphs, AST extractors, plain-text structural comments, call and inheritance topology, configuration dependencies, passive tag injection, SWE-bench Lite, SWE-bench Verified, Codex-style programmable agents, localization accuracy, trajectory behavior, run-to-run stability, link-following rates, input-token overhead, inverse-only links for hub-heavy repositories, MCP call-graph tool-use limits, static-analysis unsoundness, Python-only validation, and the governance problem of treating a final patch as sufficient evidence before the repository map, anchor generator, navigation route, and reviewer trace are auditable.
• The Memory Gate Becomes the Erasure Policy - Sayak Dutta's CARVE: Content-Aware Recurrent with Value Efficiency for Chunk-Parallel Linear Attention paper, arXiv:2606.27229, on recurrent model memory, content-aware erase gates, GDN-2, memory-blind gating, key-axis erase, WY-form chunk-parallel linear attention, scalar value write gates, recurrent output reuse, FineWeb-Edu training, WikiText perplexity, RULER retrieval probes, throughput overhead, peak-memory reduction, mixer-parameter reduction, theorem-backed architectural claims, internal state retention, context compaction, prompt caches, agent memory layers, and the governance problem of treating model memory as a feature before the erase mechanism, content signal, benchmark, reset rule, and retention policy are auditable.
• The AgentDID Becomes the State Proof - Minghui Xu, Xiaoyu Liu, Yihao Guo, Chunchi Liu, Yue Zhang, and Xiuzhen Cheng's AgentDID: Trustless Identity Authentication for AI Agents paper, arXiv:2604.25189, on decentralized identifiers, verifiable credentials, W3C DID Core, VC Data Model v2.0, self-managed agent identities, high-concurrency authentication, dynamic state verification, challenge-response probes, context hashes, tool evidence, Sepolia evaluation, state proof limits, correlation risk, and the governance problem of treating a static agent identity as trustworthy before the current execution state is verifiable.
• The Chokepoint Becomes the Open Model - Wang Jin, Nadav Kunievsky, Bowen Lou, Tianshu Sun, and James Evans's U.S. Policies Unintentionally Accelerated China's Open AI Ecosystems paper, arXiv:2606.15999, on U.S. advanced-computing export controls, China's open AI ecosystems, open-weight model releases, GitHub fork event studies, CHIPS and Science Act timing, Commerce control shocks, Qwen, DeepSeek, LLaMA, ChatGPT, Claude, arXiv model mentions, OpenAlex-linked author-country data, company-affiliated research papers, U.S. patent disclosures, compute-efficiency research, parameter-efficient fine-tuning, inference optimization, edge deployment, strategic resilience, uneven diffusion across science and commercialization, and the governance problem of measuring not only what a chokepoint blocks but which open infrastructure it teaches competitors, researchers, and companies to build, reuse, cite, hide, or formalize.
• The Agent Group Becomes the Prompt Ecology - Luis Celiktemel, Edward Eichhorn, Levin Brinkmann, Robin Schimmelpfennig, Aron Vallinder, Yaomin Jiang, Edward Hughes, and Iyad Rahwan's Group Selection Promotes Prosocial Prompts in Populations of LLM Agents paper, arXiv:2606.23343, on LLM-agent populations, repeated donor games, natural-language prompt inheritance, individual selection, group selection, prosocial prompts, cooperation collapse, no-selection baselines, prompt ablations, alternative game framings, model-family checks, replicator-mutator modeling, phase-transition thresholds, selection-disclosure effects, multi-agent governance, and the governance problem of treating agent alignment as an individual instruction before the selection rule, group objective, transmission channel, replacement rate, and population-level failure mode are auditable.
• The History POV Becomes the Memory Machine - Nina Brolich and Anna Neovesky's Examining AI-generated historical narratives and their reception through the example of history POVs on TikTok paper, arXiv:2606.23300, on AI-generated first-person historical scenes, TikTok history POVs, public memory, the TikTok Research API, 5,565 English-language history-context videos from 28,163 API results, 2,023 creators in 92 countries, emotionally charged contemporary-history topics, caption-level historical inaccuracies, Black Death and Holocaust comment comparisons, manual annotation, DistilBERT-supported comment classification, hate speech and disinformation flags, unavailable video files, API access limits, and the governance problem of treating synthetic historical immersion as entertainment before source trails, sensitivity rules, moderation boundaries, and research access are auditable.
• The AI Advisor Becomes the Verification Gap - Simon J. Blanchard, Aaron M. Garvey, and Laura O'Laughlin's Hallucinations in Organization-backed AI advisors: Evidence about Skepticism, Verification, and Reliance in Goal-Directed Use paper, arXiv:2606.23491, on organization-backed AI advisors, hallucination detection, customer-service and medical and workplace advice contexts, skepticism, verification, reliance, output-based cues, category-based scrutiny, source citations, explanations, general warnings, specific hallucination warnings, disclosure limits, retrieval-augmented generation, human review, EU AI Act Article 50 transparency logic, and the governance problem of treating a warned user as a verified user before the source trail, escalation path, and decision record are auditable.
• The Terraform Fix Becomes Security Theater - Manar Alsaid, Chimdumebi Nebolisa, and Faris Abbas's TerraProbe: A Layered-Oracle Framework for Detecting Deceptive Fixes in LLM-Assisted Terraform Security Repair paper, arXiv:2606.26590, on LLM-assisted Terraform repair, Infrastructure-as-Code security, Checkov findings, targeted scanner removal, full-scanner reruns, terraform validate, terraform plan, terraform show -json plan comparison, TerraDS real-world modules, controlled injected defects, gemini-2.5-flash-lite, GPT-4o, Claude 3.5 Sonnet, deceptive fixes, IAM wildcard Resource grants, CKV2 AWS 11, layered oracle evaluation, replication packages, and the governance problem of treating scanner-passing patches as security evidence before plan, policy intent, and semantic review are auditable.
• The Diffusion Attack Becomes the Modality Bridge - Abrar Alotaibi and Moataz Ahmed's Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Models paper, arXiv:2606.26566, on diffusion-based adversarial attacks, text and LLM red teaming, image-classifier attacks, vision-language model jailbreaks, diffusion-based input purification defenses, six-role diffusion taxonomy, attacker knowledge, query budgets, target accessibility, attack success rate, transferability, perplexity, defense-evasion, non-diffusion baselines, adaptive defense audits, dual-use disclosure, and the governance problem of treating cross-modal attack recipes as comparable before evaluation metrics, threat models, and payload-handling rules are auditable.
• The Brain Signal Becomes the Reasoning Scaffold - Mingqing Xiao, Kai Du, and Zhouchen Lin's Beyond representational alignment with brain-guided language models for robust reasoning paper, arXiv:2606.11893, on task-fMRI, OpenNeuro ds003076, deductive reasoning, syllogistic and transitive logic tasks, pseudowords, neural predictivity, reasoning-region alignment, Qwen, Llama, Mistral, Phi, Gemma, NARI, NARF, inference-time representation intervention, representation fine-tuning, language-label supervision, FOLIO transfer, Human Connectome Project relational processing, steering-scale limits, and the governance problem of treating brain-guided model training as cognitive proof before dataset lineage, model layers, baselines, intervention rules, and failure cases are auditable.
• The Contributor Ladder Becomes the Agent Queue - Weixing Zhang, Bowen Jiang, and Anne Koziolek's Augmentation with Dilution: A Large-Scale Empirical Study of Human Contributor Ecosystems After AI Coding Agent Adoption paper, arXiv:2606.26289, on AI coding agents, open-source contributor ecosystems, GitHub repositories, staggered difference-in-differences, Sun and Abraham estimation, human contributor density, newcomer ratio decline, review depth, project size, programming language, project maturity, maintainer review burden, open-source apprenticeship, labor governance, and the governance problem of treating code-agent productivity as healthy before the human contributor ladder, newcomer path, and review tax are audited.
• The Fisher Sketch Becomes the Update Signature - John Sweeney's The Geometry of Updates: Fisher Alignment at Vocabulary Scale paper, arXiv:2606.27242, on FisherSketch, head Fisher alignment, shared-vocabulary LLM transfer, activation-dark task geometry, representation-only non-identifiability, CKA limits, kernel mean embeddings in joint activation-error space, 16 KB task signatures, 192 KB streaming state, Llama-3.1-8B verbalizer-shift tests, Natural Instructions task retrieval, molecular SMILES proof-of-concept evidence, source-selection receipts, output-head assumptions, activation/error/coupling marginals, and the governance problem of treating source similarity as auditable only when the update geometry and its limits travel with the score.
• The Emotion Vector Becomes the Affect Map - Sinie van der Ben, Raphaël Baur, Yannick Metz, and Mennatallah El-Assady's Where Do Models Find Happiness? Emotion Vectors in Open-Source LLMs paper, arXiv:2606.26987, on emotion vectors, open-weight LLMs, Apertus-8B-Instruct-2509, Gemma-4-E4B-it, 171 emotion concepts, synthetic story corpora, neutral-story projection, residual-stream activations, PCA, valence and arousal ratings, CKA layer comparisons, peak PC1-valence correlations, divergent layer-depth trajectories, corpus-sensitive arousal signals, public experiment code, causal-validation limits, and the governance problem of treating affective representation maps as evidence of feeling rather than as auditable engineering artifacts.
• The Uncertainty Score Becomes the Decision Cost - Annika Schneider, Tommy Rochussen, Joshua Stiller, and Vincent Fortuin's Decision-Aligned Evaluation of Uncertainty Quantification paper, arXiv:2606.26990, on uncertainty quantification evaluation, negative log-likelihood, expected calibration error, Brier score, accuracy, retention-curve and error-detection metrics, decision-alignment, strict order and tie preservation, hidden cost priors, prior-weighted utility metrics, proper scoring rules, binary decisions, top-k selection, selective prediction, wind-farm electricity-market bidding, credit approval, peer-to-peer lending, prior elicitation, sensitivity checks, and the governance problem of treating a confidence score as safe before the downstream decision, cost model, action threshold, and recheck path are auditable.
• The Green Answer Becomes the Value Position - Stefanie Kunkel, Tilman Hartwig, Marcus Voss, Emma K. Schütt, and Angelika Gellrich's Greener Than Humans? Environmental Attitudes in Large Language Models paper, arXiv:2606.02741, on environmental attitudes in LLM outputs, German Environmental Awareness Studies benchmarks, environmental cognition, environmental affect, behavioral recommendations, willingness-to-pay questions, 31 widely used proprietary and open-weight models, survey-style benchmarking, persona prompting, sycophancy, role and personal-context shifts, CO2-reduction recommendation estimates, model size and country-of-origin non-findings, sustainability decision support, green default value positions, and the governance problem of treating environmentally progressive model answers as neutral guidance before prompt, persona, benchmark, model version, scoring rubric, and local constraints are auditable.
• The Rationale Becomes the Trust Interface - Xin Sun, Ting Pan, Yajing Wang, Shu Wei, Jos A. Bosch, Isao Echizen, Abdallah El Ali, and Saku Sugawara's When LLM Rationales Become User-Facing paper, arXiv:2606.25489, on user-facing LLM rationales, factual verification, auditable trust calibration, rationale correctness, certainty cues, instant, delayed, and on-demand presentation, online Prolific participants, lab eye tracking, gaze areas of interest, trust in information, trust in LLM systems, advice adoption, cognitive load, pupil diameter, retrospective gaze modeling, privacy cautions, and the governance problem of treating visible reasoning as transparency before answer, evidence, rationale, certainty, interface timing, and verification path are auditable.
• The Repeated Test Becomes the Learning Debt - Yanru Guan, Naveen Raman, and Fei Fang's Human Decision-Making with AI Assistance under Correlated Features paper, arXiv:2606.20628, on AI-assisted human decision-making, correlated features, test recommendation, human learning, direct observation, imputed features, stationary policies, explore-then-commit structure, dynamic programming, finite horizons, truncated planning, synthetic experiments, feature-correlation sensitivity, medical-test examples, and the governance problem of treating repeated AI advice as stable evidence before the observation budget, feature correlations, human learning path, exploration schedule, commitment point, and unshown-feature blind spots are auditable.
• The Open Parameter Becomes the Cooperation Switch - Aleksandar Todorov, Jesse ten Napel, and Alexander Müller's Parametric Open Source Games paper, arXiv:2606.27068, on continuous open-source game theory, parameter-visible agents, parametric program Nash equilibrium, semantics maps, mixed actions, closed-source versus open-source dependence, sigmoid semantics, cross-player coupling, selfish projected gradient ascent, symmetric 2x2 games, Prisoner's Dilemma, Stag Hunt, analytical cooperation thresholds, boundary PPNE checks, neural semantics, cross-player and self-player sensitivity, warm-start versus cold-start optimization, idealized full-parameter transparency, and the governance problem of treating agent transparency as cooperation evidence before the coupling mechanism, learning rule, robustness range, and equilibrium test are visible.
• The Job Outlier Becomes the Labor Forecast - Shreyash Rawat's Noise is Signal: Density-Based Outliers as Leading Indicators of Occupational Emergence in Labor Market Text paper, arXiv:2606.22769, on job-posting outliers, density-based clustering, HDBSCAN noise, occupational emergence, the Emergence-Density Inversion hypothesis, Emerging Occupation Score, Temporal Velocity, Cross-Platform Convergence, 84,988 English-language job postings, Q4 2022 to Q3 2024, INSTRUCTOR-xl embeddings, UMAP reduction, O*NET taxonomy lag, Prompt Engineer, AI Safety Researcher, Foundation Model Engineer, Agent Systems Engineer, false positives, employer-branded title proliferation, vocabulary novelty, gig-economy conflation, and the governance problem of discarding labor-market noise before checking whether it is the first visible trace of a new occupation.
• The Regional Labor Map Becomes the AI Policy Test - Chau Tran Bao, Khoi Nguyen Dinh Nguyen, Ha Nguyen Manh, and Ngan Nguyen Thi Thuy's The Urban-Rural Divide in the Age of Artificial Intelligence paper, arXiv:2606.22833, on automation exposure, AI exposure, regional labor markets, urban-rural divides, routine work, cognitive work, shift-share exposure measures, two-way fixed effects, instrumental-variable models, 120 illustrative regions, 720 region-years, employment-to-population ratios, wage associations, rural automation displacement, urban AI wage concentration, reskilling, digital infrastructure, AI-complementary skills, migration and commuting limits, constructed exposure measures, and the governance problem of treating AI labor policy as national and placeless when the exposure map is regional.
• The Evidence Layer Becomes the Governance System - Vishal Srivastava and Tanmay Sah's The AI Evaluability Gap: The Missing Layer for Managing Risk and Sustaining Value paper, arXiv:2606.21015, on evidence sufficiency, evaluability, calibrated confidence, Conf(D | E), operational certification, investment certification, AI risk, AI value, governance decisions, observability, attributability, intervenability, verifiability, calibration, temporal validity, structural evidence, causal evidence, evidence decay, audit trails, randomized rollout, override logging, drift monitoring, stale benchmarks, business-impact claims, assurance cases, NIST AI RMF and ISO/IEC 42001 connections, conceptual-framework limits, adversarial evidence manipulation, and the governance problem of treating dashboards, audits, model cards, safety cases, and budget claims as decision evidence before the evidence layer itself is inspectable.
• The App Boss Becomes the Human Manager - Omir Kumar and Krishnan Narayanan's The Algorithmic-Human Manager: AI, Apps, and Workers in the Indian Gig Economy paper, arXiv:2606.19975, on Indian blue-collar gig work, algorithmic management, app-mediated task allocation, worker interviews, stakeholder interviews, ride-sharing, delivery, home services, warehouses, dark stores, opaque pay and incentive rules, selfie verification, location tracking, performance metrics, chatbot grievance redressal, account deactivation, income obfuscation, human review, participatory platform design, worker digital literacy, data gigs, Unified Workers Interface, social-security administration, portable reputation, and the governance problem of making app-managed labor efficient without losing worker dignity, contestability, and due process.
• The Prediction Becomes the Intervention - Inioluwa Deborah Raji, Lydia T. Liu, Angela Zhou, Luke Guerdan, Jessica Hullman, Daniel Malinsky, Bryan Wilder, Simone Zhang, Hammaad Adam, Amanda Coston, Ben Laufer, Ezinne Nwankwo, Michael Zanger-Tishler, Eli Ben-Michael, Avi Feller, Talia Gillis, Shion Guha, Daniel Ho, Lily Hu, Kosuke Imai, Sayash Kapoor, Joshua Loftus, Razieh Nabi, Juan Carlos Perdomo, Matthew Salganik, Mark Sendak, Berk Ustun, Suresh Venkatasubramanian, Angelina Wang, and Ashia Wilson's Bridging Predictions and Interventions: An Integrated Framework for Automated Decision-Systems paper, arXiv:2606.25668, on automated decision systems, risk scores, assessments, downstream decisions, policy change, pretrial risk assessment, clinical triage, sepsis alerts, educational early-warning systems, prediction accuracy limits, causal inference, potential outcomes, predictive targeting versus interventional targeting, selective labels, zombie predictions, decision-centric evaluation, alert fatigue, human-ADS workflows, capacity constraints, legal compatibility, implementation science, and the governance problem of treating a model's predictive performance as system evidence before intervention path, decision menu, workflow, resources, outcome measure, and causal evaluation design are visible.
• The Ethical Scaffold Becomes the Reasoning Receipt - Patrick Cooper and Alvaro Velasquez's Narration-of-Thought: Inference-Time Scaffolding for Defeasible Ethical Reasoning in Large Language Models paper, arXiv:2606.26366, on narration-of-thought, visible ethical reasoning traces, stakeholder collapse, uncertainty suppression, DailyDilemmas, standard chain-of-thought controls, five-section prompt scaffolds, protagonist framing, stakeholder enumeration, two-step consequences, uncertainty disclosure, final commitment, four generators across three vendors, matched-budget verbose-CoT controls, Cliff's delta effect sizes, section ablations, textual-gradient scaffold optimization, cross-family training judges, multi-stakeholder debate, moderator synthesis, accept/reject votes, 95.1 percent calibration-set full consensus, 1.6 percent residual rejections, refusal-calibration caveats, reproducibility artifacts, and the governance problem of treating a structured ethical trace as audit evidence before prompt, judge, rubric, stakeholders, unresolved objections, and human escalation path are visible.
• The Limit Curve Becomes the Pull Request - Lanqing Yuan and Karthik Ramanathan's Towards LLM-Powered Automation of a Dark Matter Constraint Repository paper, arXiv:2606.21658, on LLM-assisted dark matter constraint curation, AxionLimits, limit curves, daily arXiv monitoring, keyword filtering, LLM relevance classification, PyMuPDF parsing, text-first extraction, vision fallback for log-log plots, three-read consensus voting, coupling-type majority vote, medoid curve selection, source-quality tiering, physics convention canonicalization, Get Physics Done, AST-based code insertion, nbformat notebook updates, nbconvert plot regeneration, highlighted pull requests, weekly preprint version checks, a 346-paper benchmark, 90.5 percent coupling-type accuracy, 0.331 dex median residual, 76.2 percent mean interpolation coverage, rare coupling-type failures, no merged proposals yet, and the governance problem of treating AI-generated scientific data as repository evidence before source paper, extraction path, convention mapping, generated diff, reviewer state, and merge authority are visible.
• The Evaluation Score Becomes the Inference Budget - Jessica McFadyen, Ole Jorgensen, Harry Coppock, Kevin Wei, and Cozmin Ududec's How Inference Compute Shapes Frontier LLM Evaluation paper, arXiv:2606.17930, on frontier LLM evaluation, inference-time compute, token-budget scaling, context compaction, repeated submissions, oracle score feedback, no-feedback trajectories, serial versus parallel allocation, TerminalBench, SWE-Bench Pro, FrontierMath, HealthBench, Humanity's Last Exam, Cyber CTFs, The Last Ones, Inspect AI ReAct-style scaffolding, 5M-30M token caps, five trajectories per task, reach, reliability, token efficiency, pass@k, matched-budget comparisons, and the governance problem of treating a benchmark score as evidence before runtime budget, feedback, scaffold, stopping rule, judge, task set, and allocation protocol are visible.
• The Equilibrium Proof Becomes the Reduction Ledger - Brian W. Lee, Nika Haghtalab, Michael I. Jordan, and Ryan J. Tibshirani's Blackwell Approachability and Gradient Equilibrium are Equivalent paper, arXiv:2606.27315, on gradient equilibrium, Blackwell approachability, online optimization, online conformal prediction, online quantile debiasing, repeated games, vector-valued payoffs, target sets, halfspace oracles, black-box oracle reductions, regret minimization, calibration, constrained and unconstrained GEQ, Euclidean projection, normal-vector witnesses, restorativity, Blackwell's condition as necessary and sufficient for GEQ, optimistic error bounds, strong adaptivity, COLT 2026, and the governance problem of treating portable online-learning guarantees as evidence before the reduction path, assumptions, oracle, target set, and checked quantities are auditable.
• The Analog Core Becomes the Generator - Yu-Neng Wang and Sara Achour's Generative Models on Analog Hardware with Dynamics paper, arXiv:2606.27294, on Analog Interaction Systems, analog hardware as a native generative substrate, coupled oscillators, Analog Ising Machines, physics-constrained differential equations, KuraSHIL oscillator dynamics, endpoint supervision, Sliced Wasserstein Distance, Wasserstein GAN training with gradient penalty, digital discriminator and analog generator parameters, hidden physical states, time-piecewise weights, sparse grids of physical elements, visible and hidden nodes, programmable coupling units, routing capacity, low-bit parameter programmability, analog noise, 56-by-56 AIS cores, 24 couplings per node, 4-bit quantization, 23 uJ estimated per MNIST image, all-to-all connectivity and 8-bit precision caveats, MNIST and Fashion-MNIST FID results, DTM and NLM analog baselines, layout caveats, and the governance problem of treating analog AI energy claims as evidence before workload, fidelity, topology, precision, noise, training boundary, and power-model assumptions are auditable.
• The Ground-Truth Gap Becomes the Reward Loop - Yingyu Lin, Qiyue Gao, Nikki Lijing Kuang, Xunpeng Huang, Kun Zhou, Tongtong Liang, Zhewei Yao, Yi-An Ma, and Yuxiong He's Reinforcement Learning without Ground-Truth Solutions can Improve LLMs paper, arXiv:2606.27369, on Ranking-induced VERifiable reinforcement learning, RiVER, ground-truth-free executable optimization tasks, AtCoder Heuristic Contest training environments, AHC047-AHC062 task selection, 12 one-pass training tasks, 10 hidden test instances, Qwen3-8B, GLM-Z1-9B-0414, Group Relative Policy Optimization, GRPO, score-based objective feedback, instance-wise ranking, winner-heavy reward shaping, scale dominance, frequency dominance, invalid-solver penalties, bounded non-winner rewards, ALE-Bench, LiveCodeBench v5 and v6, USACO, raw-score baselines, rank-uniform ablations, AHC057 solver inspection, feedback resolution, and the governance problem of treating verifiable reward training as evidence before the evaluator, hidden-instance generator, rank rule, reward-shaping rule, overlap check, benchmark split, and transfer results are auditable.
• The World Model Hallucination Becomes the Coverage Gap - Nicklas Hansen and Xiaolong Wang's Hallucination in World Models is Predictable and Preventable paper, arXiv:2606.27326, on generative world models, action-controllable futures, visually fluent but dynamically wrong rollouts, MMBench2, 65,600 mixed-quality trajectories, 427 hours of 224-by-224 video at 15 fps, 210 tasks across 10 domains, ground-truth actions and rewards, live simulators, 200 pretraining tasks, 10 held-out transfer tasks, a 350M-parameter Dreamer 4-style model, perceptual hallucination, action-marginalized hallucination, scene-diverging hallucination, tokenizer round-trip residual, flow instability, inter-seed denoising variance, coverage-aware task sampling, hallucination predictors as curiosity rewards, adaptation with 50 real trajectories, public code, dataset, and model links, simulation limits, and the governance problem of treating a rendered future as evidence before state-action coverage, predictor scores, rollout horizon, checkpoint, and mitigation record are inspectable.
• The Relationship Post Becomes the Psychiatric Context Window - Parmitha Vangapandu, Sai Ganesh Mokkapati, Sathwik Narkedimilli, MSVPJ Sathvik, Timothy Liu, Simon See, and Johannes C. Eichstaedt's RSPC: A Benchmark for Modeling Stress and Psychiatric Conditions in Digitally Mediated Relationships using Psychiatrist Annotations paper, arXiv:2606.27247, on the Relational Stress and Psychiatry Corpus, 1,799 Reddit posts from long-distance relationship communities, r/LongDistance, r/LDR, January 2020 to December 2023 collection, psychiatrist annotations, DSM-5-TR and ICD-11 aligned symptom categories, relational stressor triggers, temporal relationship phases, Cohen's kappa reliability, 70:10:20 stratified splits, Adjustment Disorder and Generalized Anxiety Disorder prevalence, Commitment Ambiguity and Lack of Communication triggers, seven fine-tuned transformer baselines, five prompted LLMs, Claude-3-Haiku, GPT-4o, Macro-F1 results, temporal majority-class bias, controlled-access release safeguards, prohibited high-stakes uses, and the governance problem of treating relationship context as a psychiatric signal before consent, source community, label boundary, release condition, and human oversight are visible.
• The Medical VQA Confidence Becomes the Calibration Receipt - Eren Senoglu, Federico Toschi, Nicolo Brunello, Andrea Sassella, and Mark James Carman's Just how sure are you? Improving Verbalized Uncertainty Calibration in Medical VQA paper, arXiv:2606.27023, on medical visual question answering, verbalized uncertainty, multimodal medical-model overconfidence, 2x2 image-text perturbation, original versus black images, original versus perturbed answer options, Brier-style calibration, anchor regularization, contrastive evidence alignment, top-k KL stabilization, LoRA fine-tuning, MedGemma-4B-IT, Qwen2-VL-7B-Instruct, OmniMedVQA, PMC-VQA, MedXpertQA, expected calibration error, Brier score, AUROC, ablation limits, confidence-format drift, code release, and the governance problem of treating a medical confidence number as clinical evidence before the image, question, perturbation check, calibration target, threshold policy, and human escalation route are inspectable.
• The Entity Match Becomes the Identity Budget - Nicholas Pulsone, Gregory Goren, and Roee Shraga's Understanding Domain-Aware Distribution Alignment in Budgeted Entity Matching paper, arXiv:2606.27342, on entity matching, data integration, deduplication, BEACON, Budget-Aware Entity Matching Across Domains, Train-Validation Distribution Fitting, TVDF, WDC product-category domains, RoBERTa embeddings, annotation budgets from 1k to 10k, label-aware sampling, in-domain and out-of-domain labels, centroid, medoid, variance, and coverage representations, 70 percent domain-agnostic downsampling, Amazon-Google and DBLP-ACM results, low-resource matching limits, and the governance problem of treating identity linkage as a single confidence score before the source data, blocking rule, domain partition, sampling budget, label scarcity, and appeal record are visible.
• The Satellite Forecast Becomes the Weather-Stress Ledger - Junwei Luo, Shuai Yuan, Zhenya Yang, Yansheng Li, Zhe Liu, and Hengshuang Zhao's EO-WM: A Physically Informed World Model for Probabilistic Earth Observation Forecasting paper, arXiv:2606.27277, on Earth-observation forecasting, weather-driven world modeling, sparse Sentinel-2 observations, EarthNet2021, physically informed conditioning, climatological baselines, weather anomalies, cumulative heat and drought stress, video diffusion transformers, EO-specific VAE tokenization, Extreme Summer and Seasonal Matched-Pair benchmarks, NDVI decline amplitude, Directional Hit Rate, Paired Divergence Correlation, seasonal-window limits, hidden land-surface states, benchmark CSV release, and the governance problem of treating satellite AI forecasts as decision evidence before the input imagery, forcing signal, benchmark split, uncertainty, limitation, and audit trail are visible.
• The Malware Section Becomes the Feature Matrix - José M. Sacristán and Ana I. González-Tablas's PRISM: PE Relational Inter-Section Matrix. A 2D Section-Aware Dataset for Static PE Malware Detection paper, arXiv:2606.27109, on static Windows PE malware detection, PE section order, 2D section-aware matrices, EMBER, BODMAS, SOREL-20M, MalwareBazaar, VirusShare, CAPE, 83,633 deduplicated matrices, a 49,204-sample family-filtered analysis corpus, 17 by 25 flattened PRISM features, LightGBM baselines, PRISMsub versus EMBERsub, Fisher Discriminant Ratio, mutual information, inter-section feature pairs, binary-task saturation, source-provenance confounds, single-class temporal caveats, and the governance problem of treating high malware-detection scores as field evidence before representation, source, split, extractor, threshold, and audit records are all visible.
• The RAG Red Team Becomes the Memory Tree - Inderjeet Singh, Andrés Murillo, Motoyoshi Sekiya, Yuki Unno, and Junichi Suga's MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG paper, arXiv:2606.26793, on agentic RAG red-teaming, text poisoning, image poisoning, direct-query attacks, orchestrator tool manipulation, Memory-Informed Red-teaming with Retrieval-Restricted Optimization and Rollouts, memory-guided MCTS, ART-SafeBench v2.0.0, 41,815 in-package records, 41,991+ total records with runtime adapters, deterministic Novelty Gate filtering, exact-match duplication limits, deterministic replay verification, GeneralRAG and CyberRAG evaluation, ASR versus Novel-ASR, DupBench and SelfDup diagnostics, query-efficiency accounting, responsible-use boundaries, and the governance problem of treating red-team attack success as meaningful before provenance, novelty, replay, budget, scope, and audit trails are verifiable.
• Memory Depth Becomes the Agent Habit - Haoliang Han's Memory Depth, Not Memory Access: Selective Parametric Consolidation for Long-Running Language Agents paper, arXiv:2606.26806, on long-running language agents, memory depth versus retrieval access, loop-drift stress testing, durable retrieval indexes, context unload, EVAF, surprise- and valence-gated LoRA consolidation, replay and L2 drift guards, GPT-2, TinyLlama, Mistral-7B, short-fact recall, goal persistence, post-unload recovery, 2-3 parametric writes per 200 events, selection versus actuation, matched random gates, Naive-LoRA drift, routed EVAF+RAG, Memora stale-memory invalidation, unresolved delete/update validity, and the governance problem of treating an agent's consolidated habit as trustworthy before the write event, scope, drift, contamination, invalidation, and rollback path are auditable.
• The Capability Frontier Becomes the Evaluation Gap - Bradley Fowler, Ryan Smith, Daniel Thi Graviet, William Myers, Joshua Greaves, Narmeen Fatimah Oozeer, Antía García, Philip Quirke, Amirali Abdullah, Fazl Barez, and Shriyash Kaustubh Upadhyay's The Capability Frontier: Benchmarks Miss 82% of Model Performance paper, arXiv:2606.26836, on single-model and single-run benchmark limits, the Capability Frontier, quality-cost Pareto frontiers, oracle routing, repeated sampling, posthoc selection, finite-sample oracle bias, extrapolation-based correction, probabilistic graphical modeling, 21 LLMs, 16 benchmarks, binary correctness metrics, API cost accounting, 54 percent average error-rate reduction at matched cost, 82 percent posthoc error-rate reduction under a perfect-judge setup, 85 percent average cost savings at matched accuracy, agentic benchmark caveats, verifier cost and error limits, and the governance problem of certifying a leaderboard model when the deployed capability is a model-selection system.
• The CoT Gain Becomes the Agent Policy Gap - Jingyu Liu, Zhiwen Wang, Yuxin Jing, Huanyu Zhou, and Yong Liu's Where Do CoT Training Gains Land in LLM based Agents? paper, arXiv:2606.26935, on chain-of-thought training in long-context agents, prompt actions, CoT actions, ALFWorld, ScienceWorld, BFCL, supervised fine-tuning, reinforcement learning, Qwen3 checkpoints, Llama-3.1-8B-Instruct, direct prompt-to-action prediction, flat CoT-versus-prompt gaps, conflicting-trace tests, prompt-token attention and gradient concentration, reduced action supervision, out-of-domain generalization, model-judge limitations, and the governance problem of treating a visible reasoning trace as proof of decision control before the prompt, state, loss target, checkpoint, and action path are auditable.
• The Fallacy Pattern Becomes the Persuasion Lens - Eleni Papadopulos, Firoj Alam, and Giovanni Da San Martino's Beyond Logical Forms: LLM-Extracted Patterns for Fallacy Classification paper, arXiv:2606.26698, on logical fallacy classification, information disorder, LLM-extracted structural patterns, LOGIC, Reddit, ELECDEBATE, Llama-3.3-70B-Instruct explanation generation, o4-mini pattern extraction, generated definitions, logicallyfallacious.com baselines, gpt-4o, gpt-4.1-mini, DeepSeek-R1, Gemma-3-27B-it, prompting-only classification, one-shot and dynamic example retrieval, 73.5 percent PATTERNS accuracy, 74.2 percent dynamic examples plus explanations plus patterns, context-heavy category failures, ethics limits, discourse manipulation risk, appealable labels, and the governance problem of treating a fallacy label as a verdict before the pattern, prompt, taxonomy, source context, and review path are auditable.
• The Classifier Becomes the Evolutionary Target - Manjinder Singh, Alexander E. I. Brownlee, and Mohamed Elawady's Vulnerability of Natural Language Classifiers to Evolutionary Generated Adversarial Text paper, arXiv:2606.27215, on GAversary, black-box natural-language classifier attacks, genetic-algorithm search, logit-value feedback, GloVe-guided word replacement, TextAttack, Movie Reviews, AG-News, WordCNN, WordLSTM, BERT, BAE, A2T, semantic similarity, perturbed-word tradeoffs, query-count tradeoffs, runtime comparisons, adversarial robustness testing, exposed classifier confidence surfaces, rate-limit and feedback-policy questions, and the governance problem of treating classifier accuracy as durable before the deployment's query interface, returned scores, probing logs, and adversarial-example archive are auditable.
• The OSINT Feed Becomes the Threat Ledger - Gerhard Backfried, Christian Schmidt, Diego Pilutti, and Michael Suker's Application of LLMs to Threat Assessment of Foreign Peacekeeping Missions paper, arXiv:2606.27106, on LLM-supported OSINT threat extraction, foreign peacekeeping missions, PINPOINT, the EU Monitoring Mission in Georgia, EUMM field context, CSDP risk management, HENSOLDT Media Mining System collection, more than 300 regional and international sources, Georgia, Turkey, Azerbaijan, Armenia, Russia, traditional media, social media, YouTube, Telegram, VK, indicator-based risk models, five mission-environment dimensions, 26 categories, 151 indicators, natural disasters, external conflict actors, ethnic conflicts, economic dependence, few-shot prompting, translation to English, JSON threat candidates, grounding and relevance filtering, LangChain workflow, sentence-transformer clustering, domain-expert evaluation, 8,340 detected instances, 48 rated threats, average score 0.82, lower threat-level and actor-identification scores, human-in-the-loop review, manipulation and disinformation limits, and the governance problem of treating an OSINT feed as a threat assessment before source, transformation, extraction, analyst review, and downstream use are all auditable.
• The Grading History Becomes the Hidden Rubric - Qilin Zhou, Zhuo Wang, Yue Li, and W.K. Chan's Impacts of Histories and Models on LLM Grading: A Study in Advanced Software Engineering Courses paper, arXiv:2606.08400, on graduate reading-report assessment, LLM-assisted grading workflows, 180 valid student submissions, seven selected software-engineering papers, five PhD-student teaching-assistant graders, Grok-4.1-Fast, GPT-oss-120b, OpenRouter calls, temperature-zero grading, repeated no-history grading, continuous chat history, ascending and descending submission order, ICC ranking consistency, Wilcoxon signed-rank tests, Hit@k lower-tier detection, failed ensemble averaging, history-induced score drift, independent-session recommendations, API instability, and the governance problem of treating previous student submissions as harmless context when they can become a hidden rubric.
• The Reasoning Token Becomes the Reaction-Time Gauge - Farahnaz Wick's Do vision-language models search like humans? Reasoning tokens as a reaction-time analog in classic visual-search paradigms paper, arXiv:2606.25066, on vision-language model visual search, psychophysics-style evaluation, feature versus conjunction search, spatial-configuration T-vs-L search, enumeration, tilted-versus-vertical search asymmetry, reasoning-token effort, Wolfe et al. 2010 human reaction-time benchmarks, Claude Sonnet 4.6, GPT-4o, o4-mini, Claude Opus 4.8, GPT-5.5, adaptive thinking, effort-versus-accuracy tradeoffs, target-present and target-absent slope reversals, token-count limitations, and the governance problem of treating a cheap effort trace as explanation before prompt wording, thinking policy, accuracy, task perturbations, and failure currency are all visible.
• The Domain Becomes the Refusal Threshold - Zacharie Bugaud's Unpredictable Safety: Domain-Dependent Compliance and the Transparency Gap in Open-Weight LLMs paper, arXiv:2606.04035, on domain-dependent safety behavior, open-weight LLMs, Gemma 3, Qwen 3, Mistral Nemo, Llama 3.3, DeepSeek R1, Ollama local deployment, 4,200 interactions, analytical versus operational prompt framing, compliance rates, strong refusal rates, technical framing bypasses, domain strata, within-domain heterogeneity, LLM-as-judge validation, aggregate safety-score limits, model-card reporting, audit matrices, and the governance problem of treating one safety score as portable across domains before prompt frame, subdomain, judge, system prompt, and confidence interval are visible.
• The Persona Gate Becomes the Refusal Surface - Viola Zhong and Qirui Li's Refusal Lives Downstream of Persona in Chat Models paper, arXiv:2606.26161, on compliant model-persona steering, refusal directions, Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct, StrongREJECT forbidden prompts, refusal/bypass/degenerate labeling, Llama-Guard-3 unsafe-rate checks, leakage scoring, late-layer expression, L20-L22 persona knockouts, random projection controls, assistant-axis separation, activation steering, persona modes, and the governance problem of treating personality and refusal as independent controls before their interaction has been measured.
• The Citation Becomes the Influence Trace - Mohammad Faizan and Dalal Alharthi's ProvenAI: Provenance-Native Traces of Evidence in Generated Answers paper, arXiv:2606.26449, on retrieval-grounded question answering, generated-answer citations, HotpotQA distractor, answer correctness, citation fidelity, leave-one-resource-out document influence, citation-influence gaps, FAISS indexing, SQLite evidence lookup, Qwen2.5-3B-Instruct local generation, MLX probability limits, MCP traceability, answer receipts, retrieval manifests, cited-source subsets, uncited-influential documents, and the governance problem of treating source lists as evidence traces before answer correctness, citation fidelity, and document influence have been measured separately.
• The Verifier Becomes the Reward Horizon - Binghai Wang, Chenlong Zhang, Dayiheng Liu, Jiajun Zhang, Jiawei Chen, Mouxiang Chen, Rongyao Fang, Siyuan Zhang, Xuwu Wang, Yuheng Jing, Zeyao Ma, and Zeyu Cui's The Verification Horizon: No Silver Bullet for Coding Agent Rewards paper, arXiv:2606.26300, on coding-agent reward design, verifier co-evolution, scalability, faithfulness, robustness, SWE-like executable tests, SWE-Universe, instruction-test alignment, trajectory-level behavior monitoring, reward hacking, solution-artifact retrieval, frontend rubric judges, Playwright-backed interactive judging, user feedback as verification, human implicit reward signals, Span-KTO, dynamic agent evaluators, NL2Repo repository generation, best-of-N accuracy, Kendall rank correlation, rejection sampling fine-tuning, quality-quantity trade-offs, and the governance problem of treating a reward score as agent success before the verifier's visibility, calibration, exploit channels, user-feedback rules, and process trace are auditable.
• The Molecular Sampler Becomes the Energy Witness - Danyal Rehman, Charlie B. Tan, Yoshua Bengio, Avishek Joey Bose, and Alexander Tong's Autoregressive Boltzmann Generators paper, arXiv:2606.27361, on molecular equilibrium sampling, Boltzmann Generators, normalizing-flow limits, autoregressive conditional densities, discrete binning, sequential inference-time interventions, molecular dynamics reference data, alanine peptide systems, Chignolin, ManyPeptidesMD, ROBIN, 132-million-parameter transferable models, E-W2, T-W2, TICA-W2, importance-sampling correction, effective-sample-size caveats, transformer-style molecular samplers, and the governance problem of treating generated molecular samples as scientific evidence before the energy witness, torsional coverage, reference data, ordering choice, temperature, and limitation record are auditable.
• The Capability Field Becomes the Product Switch - Wei Zhou, Xiongwei Zhu, Zelin Xu, Bo Dong, Lixue Gong, Yongyuan Liang, Meng Chu, Leigang Qu, Lingdong Kong, Wei Liu, and Tat-Seng Chua's DanceOPD: On-Policy Generative Field Distillation paper, arXiv:2606.27377, on flow-matching image generators, text-to-image generation, local editing, global editing, style and realism fields, classifier-free guidance absorption, multi-capability composition, frozen capability sources, hard-routed sample-wise field matching, student-visited rollout states, semantic-side low-noise queries, plain velocity MSE, GenEval, GEditBench-EN, soft-teacher mixing failures, dense-query correlation, guidance-scale compounding, shared state-space assumptions, predefined route limits, and the governance problem of treating one media model as a neutral prompt box before the capability switchboard inside it is documented.
• The Job Query Becomes the Reward Surface - Ping Liu, Qianqi Shen, Jianqiang Shen, Wenqiong Liu, Rajat Arora, Yunxiang Ren, Chunnan Yao, Dan Xu, Baofen Zheng, Wanjun Jiang, Andrii Soviak, Kevin Kao, Jingwei Wu, and Wenjing Zhang's Designing Reward Signals for Portable Query Generation: A Case Study in Industrial Semantic Job Search paper, arXiv:2606.27291, on profile-to-portable-query generation, industrial semantic job search, low-bandwidth search bars, transferable qualifications, query portability, RLAIF, LLM-as-judge rubrics, Qwen3-1.7B actor initialization, Qwen3-8B training judge, Llama-3.3-70B independent evaluation, PPO, GRPO, RLOO, REINFORCE++, deterministic reward floors, 6-gram profile-overlap detection, lifted date ranges, verbatim-copy reward hacking, trainer-evaluator inflation, reward-signal engineering, employment-platform search governance, and the governance problem of treating generated job-search terms as neutral before the reward surface that writes them is audited.
• The Recommender Agent Becomes the Verification Cascade - Shaohua Liu, Liang Fang, Yilong Sun, Shudong Huang, Qingsong Luo, Shaoxin Liu, Xiaoyang Chen, Dongqiang Liu, Chuangang Ma, Zhenzhen Chai, Henghuan Wang, Shijie Quan, Changyuan Cui, Zhangbin Zhu, Peng Chen, Wei Xu, Lei Xiao, Haijie Gu, and Jie Jiang's NOVA: A Verification-Aware Agent Harness for Architecture Evolution in Industrial Recommender Systems paper, arXiv:2606.27243, on industrial advertising recommender systems, architecture evolution, LLM coding agents, runnable-but-negative candidates, silent failures, architecture gradients, verification diagnostics, metric feedback, trajectory memory, forbidden directions, structure-semantic checks, local executability, offline AUC, online GMV and pCVR bias, L1-L4 task levels, AutoRun, Copilot, RankMixer, TokenMixer-Large, OpenHands, ReActAgent, Optuna-TPE, production A/B testing, proprietary reproducibility limits, and the governance problem of treating runnable recommender-code changes as valid only after architecture semantics and business-impact evidence are checked.
• The Embodied Agent Becomes the Recovery Loop - Junhao Shi, Zezheng Huai, Siyin Wang, Jia Chen, Yubang Wang, Zhaoye Fei, Hechang Chen, Jingjing Gong, Xipeng Qiu, and Yu-Gang Jiang's Advancing Omnimodal Embodied Agents from Isolated Skills to Everyday Physical Autonomy paper, arXiv:2606.27251, on OmniAct, embodied agents, cyber-physical action spaces, speech, vision, language, APIs, IoT, robot manipulation, navigation, multimodal semantic planning, skill routing, adaptive hierarchical memory, event-boundary-driven compression, reflective memory, asynchronous visual preemption, physical failure detection, replanning, UR5e tabletop manipulation, Keenon indoor navigation, household IoT devices, 40 real-world long-horizon tasks, L3 end-to-end success, token growth, frozen VLA policy limits, monitor latency, and the governance problem of treating embodied-agent safety as the recovery trace rather than the first plan.
• The Agent Config Becomes the Supply Chain - Padmaraj Madatha's A Deterministic Control Plane for LLM Coding Agents paper, arXiv:2606.26924, on LLM coding harnesses, rules files, agent definitions, IDE-specific markdown, copied coding-agent configuration, undeclared shared components, 10,008 public GitHub repositories, 6,145 agent config files, SHA-256 exact duplicates, cross-organization clone pairs, shallow revision histories, missing permission boundaries, Rel(AI)Build, content addressing, HMAC-stamped lockfiles, hash-chained audit logs, tiered permissions, attack-derived blocklists, phase-state gates, requirement-to-file-to-test traceability, seven IDE targets, Jaccard prompt-drift checks, and the governance problem of treating agent definitions as software supply-chain artifacts before they steer repository work.
• The Agent Skill Becomes the Runtime Contract - Ying Li, Yanju Chen, Hongbo Wen, Bosi Zhang, Hanzhi Liu, Peiran Wang, Yu Feng, and Yuan Tian's VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills paper, arXiv:2606.26524, on third-party AI-agent skills, behavioral specifications, natural-language skill promises, runtime enforcement, operator-defined constraints, global cross-skill rules, agent-tool event traces, temporal dependencies, argument constraints, value-flow conditions, SMT checks over finite traces, SkillsBench, Skill-Inject, AgentDojo, SafeAgentBench, deployed skill-bundle defects, policy witnesses, specification drift, and the governance problem of treating a skill description as enforceable only when its declared contract can be checked against the agent's actual execution trace.
• The Theory Loop Becomes the Cognitive Scientist - Akshay K. Jagadish, Younes Strittmatter, Nori Jacoby, George Kachergis, Eric Schulz, Nathaniel Daw, Suyog H. Chandramouli, and Thomas L. Griffiths's Closing the Loop to Discover Psychological Theories with an Automated Cognitive Scientist paper, arXiv:2606.26448, on AutoCog, closed-loop cognitive-science theory building, LLM theory advocates, executable cognitive models, experiment design, online behavioral data, generative performance scoring, failure diagnosis, successor theories, decision-making tasks, held-out studies, preregistered follow-up evidence, multi-cue decision-making, diminishing sensitivity to feature values, machine-readable discovery traces, theory-to-code drift, human-defined search spaces, and the governance problem of treating a scientific theory loop as credible only when theories, experiments, participants, scores, revisions, and human review remain inspectable.
• The Agent Standard Becomes the Governance Graph - Yutian Wang and Luyao Zhang's Agentic Analysis for Agentic Infrastructure: An LLM-Powered Pipeline for Comparative Governance of DAO and Corporate AI Protocols paper, arXiv:2606.26203, on ERC-8004, Google A2A, agent interoperability standards, DAO and corporate protocol governance, LLM-assisted discourse analysis, public GitHub and forum participation records, 4,323 retained governance records, topic modeling, co-participation networks, discourse-network analysis, socio-semantic actor-topic graphs, participation inequality, community fragmentation, technical steering committees, public-trace limits, open-source observability, and the governance problem of treating agent standards as political records as well as technical artifacts.
• The Board Duty Becomes the Agent Governance File - Deirdre Ahern's Directors Duties in the Age of Agentic Artificial Intelligence paper, arXiv:2606.20453, on directors' duties, agentic AI adoption, board-level corporate governance, fiduciary best-interests duties, employee stakeholder interests, shareholder primacy, enlightened shareholder value, stakeholder-friendly and stakeholder-value models, AI-related role displacement, employee engagement, reskilling, AI washing, board strategy and monitoring duties, human oversight, deployment records, workforce impact assessment, and the governance problem of treating an AI deployment decision as accountable corporate purpose rather than a narrow procurement choice.
• The Attested Action Becomes the Governance Boundary - Jakob Salfeld-Nebgen's Governing Actions, Not Agents: Institutional Attestation as a Governance Model for Autonomous AI Systems paper, arXiv:2606.26298, on institutional attestation, high-risk agent actions, production deployment, clinical prescribing, the Courier Pattern, independent oracles, intent identifiers, signed attestations, deterministic policy evaluation, Cedar, Ed25519 signatures, tamper-evident audit logs, Zero-Trust Action Hub prototype limits, and the governance problem of attaching trust to independently verified action evidence rather than to an agent as a whole.
• The Authorization Overlay Becomes the Delegation Contract - Amjad Ibrahim and Yong Li's Overlaying Governance: A Compositional Authorization Framework for Delegation and Scope in Agentic AI paper, arXiv:2606.03518, on compositional authorization overlays, delegation as a runtime contractual term, resource-scope attenuation, authorization envelopes, recursive delegation chains, ReBAC, Zanzibar-style relation graphs, OpenFGA overlays, Google Drive and Slack benchmark scenarios, preservation and agent-authorization soundness proofs, synthetic tuple datasets, reproducibility artifacts, and the governance problem of adding agent authority to existing access-control domains without hiding delegation inside broad tokens or prompt promises.
• The Executable Sandbox Becomes the Agent Security Test - Peiyang Li, Songping Wang, Yi Huang, Yanhua Shi, Chenhao Zhang, Qi Li, Yueming Lyu, Caifeng Shan, Fengting Li, Chao Feng, Chuanqun Zhu, and Liang Chen's AgentCanary: A Security Evaluation Framework for Autonomous AI Agents in Real Executable Environments paper, arXiv:2606.10484, on autonomous AI agent security evaluation, real executable environments, the Entry x Impact risk matrix, direct and indirect prompt injection, skill poisoning, memory contamination, intrinsic failures, web browsing, email, instant messaging, calendar, financial transactions, third-party skills, 496 seed tasks, Hermes, NanoClaw, OpenClaw, Outcome Safety, Security Awareness, Task Utility, full execution trajectories, sandboxed task artifacts, runtime defenses, state changes, tool-call evidence, and the governance problem of treating a safe final answer as enough before the files, memory, tools, network calls, and side effects are audited.
• The RAG Document Becomes the Token Bomb - Chengliang Liu, Liangbo Ning, Yujuan Ding, and Wenqi Fan's Inference Cost Attacks for Retrieval-Augmented Large Language Models paper, arXiv:2606.02643, on Retrieval-Augmented Inference Cost Attacks, RA-ICA, CREEP, MA-GRPO, poisoned retrieval documents, RAG inference cost, token-consumption amplification, Natural Questions, HotpotQA, MS MARCO, Contriever top-5 retrieval, qwen-turbo, GPT-5, claude-sonnet-4, deepseek-r1, weighted Answer Alignment, weighted Attack Concealment, weighted Token Consumption Ratio, source-level cost attribution, retrieval-source provenance, document quarantine, and the governance problem of treating a correct RAG answer as safe before the token bill, latency, retrieved-document trail, and corpus-ingestion path are auditable.
• The Watched Model Becomes the Audit Register - Vinicius Covas and Jorge Alberto Hidalgo Toledo's AI Knows When It's Being Watched: Functional Strategic Action and Contextual Register Modulation in Large Language Models paper, arXiv:2605.15034, on social observation framing, LLM-based multi-agent debate sessions, Type-Token Ratio change, lexical diversification, message-length effects, university-researcher monitoring, explicit monitoring negation, academic audience framing, automated AI auditing, observer identity, Hawthorne Effect framing, audience design, contextual register modulation, evaluation-condition logging, observed-run evidence, deployment-condition evidence, and the governance problem of treating a monitored model transcript as neutral before the audit records how observation itself shaped the run.
• The Name Prompt Becomes the Privacy Audit - Dimitri Staufer, Kirsten Morehouse, David Hartmann, and Bettina Berendt's Human-Centred LLM Privacy Audits: Findings and Frictions paper, arXiv:2603.12094, on LMP2, browser-based privacy self-audits, name-conditioned associations, black-box LLM probing, canary-style prompts, fragmented sentence recovery, association strength, confidence signals, everyday people and public figures, synthetic non-existent names, GPT-4o feature prediction, EU resident user studies, participant privacy perceptions, correction and erasure preferences, memorization versus inference, indirect identification, base-rate guessing, model-level associations versus application memory controls, time-stamped audit traces, and the governance problem of treating a model's claim about a person as contestable evidence rather than a hidden association.
• The Governance Policy Becomes the Mechanical Gate - José Manuel de la Chica Rodríguez and Carlos Martí-González's Mechanical Enforcement for LLM Governance: Evidence of Governance-Task Decoupling in Financial Decision Systems paper, arXiv:2605.14744, on regulated financial LLM workflows, text-only governance, policy prompts as weak constraints, rationale-level governance metrics, Cosmetic Deadlock Rate, Deferral Information Utilisation, Framing Success Rate, Failure Visibility Score, Entropy Sensitivity Differential, synthetic banking decisions, Llama 3.1 70B Instruct, AWS Bedrock, hard gates, I6Q rationale checks, CEFL candidate externalization, E3 commit-reveal entropy, vacuous deferrals, governance-task decoupling, structural stress testing, mechanical audit trails, and the governance problem of treating task accuracy as compliance evidence before the decision rationale and enforcement boundary are separately measured.
• The Peer Review Workspace Becomes the Evidence Ledger - Elisabeth Guerard, Mehrdad Almasi, Marion Salaun, Frederic Clavert, and Mirjam Pfeiffer's Towards an Interactive Evidence-RAG Peer-Review Workspace for the Journal of Digital History paper, arXiv:2606.25837, on AI-assisted peer review, the Journal of Digital History, editorial assessment, evidence-bounded RAG, reviewer-comment units, paper conversion, review processing, semantic chunking, BAAI/bge-large-en-v1.5 embeddings, Qdrant vector storage, retrieved manuscript chunks, supported and partially supported labels, insufficient-evidence labels, composite confidence components, editor decisions stored separately from model outputs, Claude-Qwen audit configuration, 80 saved decisions, 70.0 percent strict editor-confirmed accuracy, 86.2 percent correct-or-mostly-correct rate, 90.0 percent useful-output rate, protected editorial material, repository-backed reproducibility, and the governance problem of treating AI peer review as acceptable only when the evidence trail remains inspectable by human editors.
• The Model's Own Answer Becomes the Confidence Bias - Mario Sanz-Guerrero, Manuel Mager, and Katharina von der Wense's Large Language Models Are Overconfident in Their Own Responses paper, arXiv:2606.03437, on instruction-tuned LLM calibration, chat templates, ownership bias, own-answer confidence, user-framed answer controls, six open-weight LLMs, Llama 3.1, Qwen3, Gemma 3, MMLU, Expected Calibration Error, Brier score, P(True), verbalized percentage confidence, verbalized linguistic confidence, assistant-versus-user answer framing, higher raw confidence in assistant-framed answers, inference-time confidence reframing, no-retraining calibration repair, and the governance problem of treating a confidence score as portable before the prompt role, answer provenance, chat template, and elicitation method are auditable.
• The Belief Trace Becomes the Persuasion Ledger - Jared Moore, Noah Goodman, Nick Haber, and Max Kleiman-Weiner's A Model of Multi-turn Human Persuadability Using Probabilistic Belief Tracing paper, arXiv:2606.05330, on PersuasionTrace, human-LLM persuasion studies, turn-level belief reports, pre/post persuasion deltas, Prolific participants, 255 completed rounds, DebateGPT propositions, personalized decision propositions, audio persuasion, 0-to-100 belief scales, logos, pathos, and ethos annotations, two belief-trajectory clusters, early movement and partial drift-back, Bayesian-network simulated targets, human-likeness scoring, simulator fidelity, dual-use persuasion measurement, self-reported belief limits, repeated-question effects, subjective proposition limits, and the governance problem of optimizing persuasive systems before the process of belief movement is auditable.
• The Human-Agent Pair Becomes the Skill Rating - Yijia Shao, Zora Z. Wang, Neel Ahuja, Yicheng Wang, Bowen Liu, and Diyi Yang's CollabSkill: Evaluating Human-Agent Collaboration On Real-World Tasks paper, arXiv:2606.09833, on human-agent collaboration, real-world occupational tasks, 93 human workers, 386 working sessions, over 1,500 prompts, 10 O*NET sectors, occupational background matching, reference-free automated grading, rubric generation, multi-agent scoring, Bayesian skill rating, worker-agent contribution disentangling, Claude Cowork, Claude Code, Codex, Gemini CLI, Manus, autonomous benchmark rank reversal, practical LLM experience, AI fluency behaviors, top-quartile worker collaboration gains, Upwork participant limits, scalar-score limits, worker-screening cautions, and the governance problem of treating autonomous benchmark scores as workplace readiness before the paired human, task, interface, and collaboration evidence are measured.
• The Drug Discovery Agent Becomes the Workflow Gate - He Cao, Siyu Liu, Fan Zhang, Zijing Liu, Hao Li, Bin Feng, Shengyuan Bai, Leqing Chen, Kai Xie, and Yu Li's Mozi: Governed Autonomy for Drug Discovery LLM Agents paper, arXiv:2603.03655, on drug-discovery LLM agents, governed autonomy, Control Plane supervisor-worker routing, Workflow Plane skill graphs, role-based tool isolation, constrained action spaces, reflection-based replanning, MCP database and computation tool separation, UniProt, PubChem, ChEMBL, PDB, AutoDock Vina-style docking, RDKit, Open Babel, ADMET predictors, HITL checkpoints, PharmaBench, 88 drug-discovery tasks, Therapeutics Data Commons, Human-Last Exam drug-discovery subset, Crohn's disease, Parkinson's disease, sepsis case studies, surrogate-model limits, in-silico validation boundaries, and the governance problem of treating a generated molecular candidate as scientific evidence before the workflow state, tool provenance, human checkpoint, uncertainty, and wet-lab validation route are auditable.
• The Agent Breadcrumb Becomes the Oversight Trail - Yujin Zhang and Daye Nam's HANSEL: Extracting Breadcrumbs from Web Agent Trajectories for Interactive Verification paper, arXiv:2606.18671, on web-agent verification, interactive evidence pages, evidence snippets, preserved page state, applied filters, search queries, scroll positions, full trajectory overload, source-link context loss, static screenshots, unfaithful reasoning summaries, evidence gap flags, AssistantBench, Online-Mind2Web, 45-task technical evaluation, 83.7 percent precision, 88.8 percent recall, 61.6 percent trajectory-page reduction, 14-participant user study, lower perceived verification effort, wrong-answer acceptance risk, and the governance problem of treating a web-agent answer as inspected before the evidence pages, page state, missing-support gaps, and user correction path are visible.
• The Workplace Skill Becomes Procedural Memory - Julia Belikova, Rauf Parchiev, Evgeny Egorov, Grigorii Davydenko, Gleb Gusev, Andrey Savchenko, and Maksim Makarenko's Managing Procedural Memory in LLM Agents: Control, Adaptation, and Evaluation paper, arXiv:2606.23127, on AFTER, procedural memory in LLM agents, 382 realistic workplace tasks, six professional roles, 22 procedural skills, single-skill and multi-skill workflows, Data Engineer, Data Scientist, Generative AI Engineer, Infrastructure Engineer, Project Manager, Software Engineer roles, document processing, data operations, ML and AI, infrastructure, software engineering, SKILL.md artifacts, skill transfer, local improvement, cross-task transfer, cross-role transfer, cross-model generalization, full-pass accuracy gains, single-round refinement, diverse multi-model traces, cross-role drift, pytest verification limits, role-specific overfitting, token efficiency, and the governance problem of treating an evolved workplace skill as portable organizational memory before lineage, scope, transfer evidence, failure cases, and rollback paths are auditable.
• The Agent Benchmark Becomes the Attack Surface - Sahar Abdelnabi, Chris Hicks, Konrad Rieck, and Ahmad-Reza Sadeghi's Measuring Security Without Fooling Ourselves: Why Benchmarking Agents Is Hard paper, arXiv:2605.22568, on security-agent evaluation, benchmark vulnerabilities, benchmark harnesses as attack surfaces, BrokenBench, hidden ground-truth leakage, sandbox escape risk, inner protections, outer protections, canary tokens, deliberate cheating audits, temporal staleness, benchmaxxing, dynamic benchmarks, live evaluation, generative benchmarks, runtime uncertainty, stochastic agent behavior, agent-generated code, self-interference, external dependencies, benchmark introspection, offensive-defensive evaluation gaps, and the governance problem of treating an agent-security benchmark score as capability evidence before the benchmark environment, task age, runtime path, canary record, and generated artifacts are auditable.
• The Smart Contract Fork Becomes the Security Exam - Jintao Huang, Fengqing Jiang, Radha Poovendran, and Zhiqiang Lin's CyberChainBench: Can AI Agents Secure Smart Contracts Against Real-World On-Chain Vulnerabilities? paper, arXiv:2606.26216, on smart-contract security agents, historical mainnet forks, DeFiHackLabs exploit reproductions, 541 real-world exploit incidents, nine EVM-compatible chains, vulnerability detection, exploit generation, patch synthesis, Harbor-isolated containers, MCP on-chain tools, source retrieval, bytecode decompilation, transaction tracing, storage reads, exploit validation, patch validation, five-type vulnerability taxonomy, proxy-upgradeable patch subset, legitimate-transaction replay, profit-based scoring, dual-use benchmark controls, temporal contamination risk, single-transaction scope limits, and the governance problem of treating a security agent's prose claim as evidence before the chain state, validation oracle, tool boundary, patch regression tests, and capability exposure are auditable.
• The PDE Residual Becomes the Error Witness - Haina Jiang, Liam Wang, Peng-Chen Chen, Min Seop Kwak, Seungryong Kim, Brian Bell, and Jeong Joon Park's Error-Conditioned Neural Solvers paper, arXiv:2606.27354, on neural surrogate models, partial differential equations, PDE residual fields, reconstruction error, residual-reconstruction gaps, ill-conditioned systems, Error-Conditioned Neural Solvers, ENS, residual conditioning, learned correction policies, four PDE families, Helmholtz, Darcy flow, Poisson, Navier-Stokes, Kolmogorov flow, distribution shift, super-resolution, coefficient extrapolation, cross-equation transfer, runtime cost, simulation evidence, and the governance problem of treating a low residual as proof of a simulated world before the equation, shift regime, reconstruction metric, correction path, baseline, and failure envelope are auditable.
• The Agent Instruction Becomes the Policy Compiler - Adam Mondl, Matthew Maisel, and John H. Brock's Autoformalization of Agent Instructions into Policy-as-Code paper, arXiv:2606.26649, on policy-as-code for AI agents, Cedar authorization policies, agent prompts, MCP tool descriptions, natural-language policy documents, generator-critic loops, hard critics, soft critics, schema compliance, vacuous-policy checks, conflicting-rule checks, semantic alignment, the Verification Sandwich, MedAgentBench, electronic medical record agents, typed MCP tools, symbolic guardrails, adversarial prompts, POST write attempts, fail-closed enforcement, temporal-logic future work, memory-aware policies, and the governance problem of treating compiled policy as safety evidence before the source corpus, generated schema, critic rubric, policy hash, and runtime enforcement boundary are auditable.
• The Humanitarian Transcript Becomes the Codebook Test - Jerome Marston, Tino Kreutzer, Salomé Garnier, Ella Boone, Phuong N Pham, and Patrick Vinck's Can Large Language Models Reliably Code Qualitative Humanitarian Data? A Benchmark Study Against Human Expert Adjudication paper, arXiv:2606.26541, on qualitative humanitarian data, affected-population accounts, synthetic humanitarian transcripts, human expert adjudication, a human Gold Standard, deductive coding, structured codebooks, seven-run modal coding, Krippendorff's alpha, discrepancy analysis, reasoning-enabled LLMs, physical safety, discrimination, income needs, theme-specific reliability, tiered oversight, open-weights deployment, self-hosted infrastructure, sensitive data governance, and the governance problem of treating a codebook reliability score as deployment permission before the data source, codebook, model configuration, adjudication route, and escalation threshold are auditable.
• The Aligned Crowd Becomes the Market Monoculture - James Begin, Brendan Gho, Suman Muppavarapu, Tyson Tsay, Atharva Mohan, Afnan Shaik, Ruizhe Li, Vasu Sharma, and Archana Vaidheeswaran's Preference Optimization Drives Monoculture in LLM Prediction Markets paper, arXiv:2606.26583, on LLM prediction markets, Direct Preference Optimization, DPO, preference-optimization monoculture, Kalshi, Polymarket, Manifold, logarithmic market scoring rules, LMSR, TruthfulQA binary questions, Llama 3.1 8B Instruct, Qwen2.5 7B, Mistral 7B v0.3, GLM-4 9B, pairwise error correlation, effective independent forecasters, same-model markets, cross-model diversity, role diversity, temperature diversity, adversarial-majority market tests, debate comparison, overconfident agents, model provenance disclosure, market integrity metrics, algorithmic monoculture, and the governance problem of treating a many-agent market as a crowd before error correlation and model lineage are auditable.
• The Sequence Probability Becomes the Confidence Trap - Johannes Zenn and Jonas Geiping's When are likely answers right? On Sequence Probability and Correctness in LLMs paper, arXiv:2606.27359, on large language model sequence probability, correctness, decoding methods, Qwen3, Qwen2.5, Qwen2.5-Math, OLMo3, MATH500, GPQA, MMLU, HumanEval, MedQA, IFEval, scalable power sampling, power-SMC, low-temperature sampling, beam search, best-of-N, top-k, top-p, epsilon sampling, within-dataset correlation, within-method correlation, across-method correlation, within-sample correlation, log probability, accuracy scaling, self-consistency, probability-weighted voting, verifier-free self-improvement, thinking-model token limits, and the governance problem of treating model likelihood as confidence before the task, decoding setup, comparison granularity, and correctness criterion are auditable.
• The Betting Ad Becomes the Explanation Receipt - MSVPJ Sathvik, Parmitha Vangapadu, Nishit Rane, Sathwik Narkedimilli, Mark Lee, and Akrati Saxena's BetXplain: An Explanation-Annotated Dataset for Detecting Manipulative Betting Advertisements on Social Media paper, arXiv:2606.27274, on manipulative betting advertisements, deceptive promotion labels, responsible promotion baselines, Instagram and Reddit source framing, Meta Ads Library collection, 3,779 advertisements, 216 duplicates removed from 4,000 collected items, text-link-category-explanation-label fields, 1,507 manipulative examples, 396 deceptive examples, 1,876 responsible examples, class imbalance, human-written explanations, inter-annotator agreement, ELECTRA macro-F1, Longformer accuracy, GPT-4o prompting, deceptive-class errors, explanation quality metrics, browser warnings, regulator crawlers, ad-library compliance, and the governance problem of treating a betting-ad detector as enforcement before the label, rationale, source path, uncertainty, and review route are auditable.
• The Online Mask Becomes the Activity Taxonomy - Debora F. de Souza, Gabriela Beltrao, Berta Chulvi, Sergio Dantonio, Mehmet Gokay Ozerim, Javier Torregrosa, Adrian Giron, Angel Panizo, Pablo Miralles Gonzalez, Helena Liz, Javier Huertas Tato, Sonia Sousa, Alejandro Martin, Monika Maciuliene, and David Camacho's Behind the Mask: A Taxonomic Analysis of Activities in Online Social Networks paper, arXiv:2606.27111, on online social-network disinformation, malicious actor attribution, creators, spreaders, ambiguous roles, activity approaches, 22 approach categories, six tactics, subject-matter expert taxonomy development, literature review, Web of Science, EBSCO, 39 full-text articles, Telegram anti-migration discourse, 6,805,626 messages from 491 downloaded channels, LabelStudio annotation, three annotators per message, channel framing, forwarding provenance, emotional mobilization, fear-mongering, enemy construction, multimodal context, repeated content, cross-posting, uncertainty notes, and the governance problem of treating moderation as a post-level verdict before the actor, activity, tactic, channel context, and annotation receipt are auditable.
• The Judicial Discretion Model Becomes the Gate - Stanisław Sójka, Felix Steffek, and Matthias Grabmair's Towards Explainable Adjudicative Variance: Quantifying Judicial Discretion via Gated Multi-Task Learning paper, arXiv:2606.27069, on legal outcome prediction, UK Employment Tribunal decisions, CLC-UKETpred, 13,937 cases from 2011-2023, judge identity, adjudicative variance, merit-based determinations, non-merit-based disposals, General Case Outcome labels, Detailed Case Outcome taxonomy, two UK labor-law scholars, LLM-assisted auxiliary labels, ModernBERT, label-wise attention, multi-task learning, Judge-Aware Gated Fusion, Gemma-4 26B-A4B baselines, LoRA encoder adaptation, macro-F1, rare and fuzzy outcome classes, Partly Wins, Other, counterfactual judge swaps, behavioral proxy limits, judicial profiling ethics, final-judgment text limits, and the governance problem of treating legal AI accuracy as legitimacy before the conditioning interface and adjudicative-context gate are auditable.
• The Child Storytelling Model Becomes the Ceiling Limiter - Min Fan, Wanqing Ma, Xinyue Cui, Xiaolu Dai, and Shengyu Huang's Floor Raiser or Ceiling Limiter? Differential Storytelling Outcomes with a Child-Centric GenAI System Across Individual Differences paper, arXiv:2606.27067, on child-centric GenAI storytelling, StoryPrompt, elementary children aged 7-12, grades 2-6, 40 participants, 38 complete paired stories, traditional storyboard comparison, mixed-methods within-subjects design, AI-generated keywords, comic-style image generation, six child-written story paragraphs, expert ratings, creativity, richness, coherence, narrative structure, floor-raising convergence, 83.5 percent quality-gap compression, lower-baseline gains, upper-baseline constraint patterns, scaffold-autonomy interference, visual-control interference, image regeneration, keyword semantic distance, teacher orchestration, bypassable scaffolds, consent and assent, and the governance problem of treating average educational AI gains as proof of benefit before subgroup effects, process logs, and negative-gain cases are auditable.
• The Nuclear Benchmark Becomes the Competence Receipt - Henry Shaowu Yuchi, Michal Kucer, Benjamin H. Sims, Selma Peterson, and Emily Taylor's NuclearQAv2: A Structured Benchmark for Evaluating Domain-Science Competence in Large Language Models paper, arXiv:2606.27047, on nuclear-engineering question answering, domain-science competence, 1,239 QA pairs, 750 boolean questions, 206 numeric questions, 283 verbal questions, factual grounding, quantitative reasoning, conceptual understanding, expert-assisted benchmark construction, LLM-assisted question generation, Meta Llama 3 70B Instruct, Nougat PDF parsing, text-only corpus limits, exact-match boolean scoring, 15 percent numeric tolerance, LLM-based verbal semantic evaluation, OpenAI GPT-5.2, GPT-5.4, GPT-4o, gpt-oss-120B, Amazon Nova Pro, Mistral 7B Instruct, NVIDIA Nemotron-3 Super 120B, Meta Llama 3, task-wise score gaps, benchmark laundering, and the governance problem of treating a single technical-domain leaderboard score as competence before the question taxonomy, scoring rule, judge model, source corpus, and missing modalities are auditable.
• The Clinical ASR Becomes the Language Gate - Subham Kumar, Prakrithi Shivaprakash, Abhishek Manoharan, Astut Kurariya, Diptadhi Mukherjee, Prabhat Chand, Pratima Murthy, Koustav Rudra, Lekhansh Shukla, and Animesh Mukherjee's SamaVaani: Auditing and Debiasing Multilingual Clinical ASR for Indian Languages paper, arXiv:2606.26901, on automatic speech recognition in real-world psychiatric interviews, Kannada, Hindi, and Indian English, clinical transcripts, 202 recordings, 130 speakers, doctor/therapist and patient roles, IndicWhisper, WhisperLargeV3, Sarvam, GoogleS2T, Gemma3n, OmniLingual, Vaani, Gemini, word error rate, speaker-role and gender disparities, fairness-aware fine-tuning, contrastive learning, CTC alignment, privacy-sensitive audio, human correction, and the governance problem of treating an automated clinical transcript as neutral before language, role, subgroup error, consent, retention, and downstream use are auditable.
• The Scientific Abstract Becomes the Language Feedback Loop - R. Alexander Bentley, Blai Vidiella, Damian J. Ruck, Senjuti Dutta, Kai Li, and Sergi Valverde's Human--LLM Collaboration Is Transforming Complexity Metrics in Scientific Texts paper, arXiv:2606.27052, on LLM influence in scientific writing, arXiv abstracts from 2010 to 2025, first-version abstract metadata, HC3 human and ChatGPT comparisons, LLM-associated style indexes, dash markers, significant, crucial, and showcase lexical markers, Zipf's law, Heaps' law, vocabulary growth, top-word turnover, pre-2023 and 2023-2024 comparisons, mixed human-AI linguistic ecosystems, scientific-text provenance, training-data feedback loops, corpus-level receipts, and the governance problem of treating polished scientific language as neutral infrastructure before its machine-assisted feedback effects are measured.
• The Framing Cue Becomes the Mental-Health Instability Test - Abla Bedoui, Ashley L. Greene, and Mohammed Cherkaoui's Auditing Framing-Sensitive Behavioral Instability in Large Language Models for Mental Health Interactions paper, arXiv:2606.26982, on mental-health-oriented conversational AI, framing-sensitive behavioral instability, controlled matched prompts, documentation, epistemic, institutional, liability, and role framing, 653 matched prompt groups, Qwen, Gemma, Mistral, and Phi model families, interpretive-routing annotations, weak/disengaged, restrained-supportive, interpretive-supportive, and escalated-interpretation responses, hidden-state probes, held-out framing generalization, TF-IDF lexical baselines, activation steering, architecture-dependent calibration shifts, and the governance problem of treating a mental-health chatbot's answer as stable before its framing robustness, annotation rubric, model version, crisis exclusions, and residual instability are auditable.
• The Codebook Becomes the Safety Gate - Yunqi Xue, Zhijiang Li, Philip Torr, and Jindong Gu's Safe Autoregressive Image Generation with Iterative Self-Improving Codebooks paper, arXiv:2606.27147, on Safe-CB, autoregressive image generation, unified multimodal models, discrete visual tokens, visual-token codebooks, harmful and safe image-text pairs, Harmful Space construction, singular value decomposition, harmful-subspace projection, harmless-space adaptive fine-tuning, self-improving codebook iterations, I2P, CoPro, ViSU, P4D, MMA-Diffusion, UnlearnDiffAtk, UD, MPUP, Janus, VILA-U, Emu3, LlamaGen, OmniMamba, NudeNet, Q16, GenEval, MMMU, COCO-30k, CLIP-Score, TIFA, self-labeling risk, error propagation, and the governance problem of treating codebook-level safety repair as assurance before the harmful-space construction log, detector versions, human-label policy, iteration count, codebook hash, and residual failure cases are auditable.
• The Sparse Feature Budget Becomes the Interpretability Dial - Nathanaël Jacquier, Maria Vakalopoulou, and Mahdi S. Hosseini's Beyond the Hard Budget: Sparsity Regularizers for More Interpretable Top-k Sparse Autoencoders paper, arXiv:2606.27321, on Top-k sparse autoencoders, vision foundation model embeddings, CLIP ViT-L/14, SigLIP2, supervised ViT-L/16, ImageNet-1K, Open Images V7, off-support L1 regularization, L1/L2 ratio regularization, batch-active masks, monosemanticity, class purity, reconstruction quality, inference-time k robustness, small-budget linear probing, dead latent risk, interpretability method cards, and the governance problem of treating a sparse feature dictionary as transparent before the feature budget, regularizer, mask, dataset, and sensitivity checks are auditable.
• The Robot Rollout Becomes the Inference Budget - Wen Ye, Peiyan Li, Tingyu Yuan, Yuan Xu, Xiangnan Wu, Chaoyang Zhao, Jing Liu, Nianfeng Liu, Yan Huang, and Liang Wang's E-TTS: A New Embodied Test-Time Scaling Framework for Robotic Manipulation paper, arXiv:2606.27268, on embodied test-time scaling, robotic manipulation, reasoning-action joint sampling, history-aware verification, vision-language verifiers, feedback-guided iterative refinement, SIMPLER WidowX, SIMPLER Google Robot, LIBERO, LIBERO-Plus, VLAbench, real-world manipulation, E-CoT, Embodied-R1, MolmoAct, π_0.5, reported simulation and real-world gains, latency limits, robot trace receipts, verifier scores, action-selection thresholds, retry logs, and the governance problem of treating extra inference compute as safer action before the reasoning, feedback, history, and selected movement are auditable.
• The Vision Label Becomes the Reward Shaper - Henrik Müller and Daniel Kudenko's Automating Potential-based Reward Shaping with Vision Language Model Guidance paper, arXiv:2606.27180, on VLM-PBRS, vision-language model preference labels, potential-based reward shaping, sparse rewards, embodied reinforcement learning, Soft Actor-Critic, Meta-World, Franka Kitchen, door-open, window-open, drawer-open, button-press, microwave, light-switch, top-burner, Ovis2 16B, Qwen3-VL 8B, single-prompt preference labels, policy invariance, sample-efficiency gains, reward hacking risk, dense reward pitfalls, learned potential functions, label lineage, and the governance problem of letting machine-produced visual preference labels shape agent training without preserving the reward receipt that shows which signal remained the final objective.
• The Security Fine-Tune Becomes the Evasion Surface - Ryan Fetterman's Inherited Circuits, Learned Semantics: How Fine-Tuning Creates Evasion Vulnerabilities Invisible to Standard Evaluation paper, arXiv:2606.27091, on security fine-tuning, PowerShell malicious-code classification, Foundation-Sec-8B-Instruct, Llama-3.1-8B-Instruct, matched PowerShell cohorts, behavior-preserving transformations, alias substitution, command reconstruction, string construction, execution indirection, case mutation, inherited late-attention classification routes, semantic specialization after fine-tuning, compact evasion groups, linear probes, indicator-token sign tests, family-level drift signals, pre-deployment red-teaming priorities, and the governance problem of treating a security fine-tune's held-out accuracy as assurance before transformation robustness and representation drift have been audited.
• The Rule Pool Becomes the Policy Memory - Shicheng Ye and Chao Yu's Joint Learning of Experiential Rules and Policies for Large Language Model Agents paper, arXiv:2606.27136, on JERP, LLM agents, multi-step interactive environments, accumulated interaction experience, natural-language experiential-rule pools, policy optimization, trajectories, sparse rewards, rule staleness, reference successful trajectories, working rule sets, group-relative policy optimization, LoRA, AlfWorld, WebShop, ReAct, Reflexion, RLOO, GRPO, vanilla LLM baselines, 61.5 percent AlfWorld overall success, 79.0 WebShop average score, 64.1 percent WebShop success rate, paused rule-pool update ablations, agent memory provenance, rule utility scores, rollback, and the governance problem of treating learned experience as helpful before the rule lineage, policy version, and revision history are auditable.
• The Task Token Becomes the Ignored Instruction - Jingyu Liu, Xiaopeng Wu, Kehan Chen, Chuan Yu, and Yong Liu's Diagnosing Task Insensitivity in Language Agents paper, arXiv:2606.26918, on language agents, task insensitivity, out-of-distribution generalization, corrupted-task diagnostics, ALFWorld, ScienceWorld, WebShop, ambiguous task descriptions, explicit clarification opportunities, Inquiry and Hit measurements, GPT-5.4 judging agreement with human annotations, task replacement experiments, training-time action consistency, attention drift away from task tokens toward local observations, Qwen3-8B, Qwen3-4B, supervised fine-tuning, GRPO, Task-Perturbed NLL Optimization, contrastive regularization, task augmentation baselines, action-sensitivity audits, clarification-rate logs, and the governance problem of treating a visible task instruction as effective authorization before proving that the agent's action policy still depends on it.
• The Forecast Becomes the Cutoff Audit - Humzah Merchant and Bradford Levy's Forecasting With LLMs: Improved Generalization Through Feature Steering paper, arXiv:2606.27199, on LLM forecasting, look-ahead bias, historically grounded reasoning, sparse autoencoder features, time-aware reasoning, feature steering, prediction-market feature discovery, market favorites versus eventual outcomes, Gemma 3 27B, Qwen 3.5 27B, Gemma Scope 2, Qwen Scope, M&A and pharmaceutical forecasting tasks, free-form generation, post-cutoff leakage in natural text, amplifying time-awareness features, failed candidate look-ahead-bias feature steering, MMLU CoT and MMLU-Pro CoT utility checks, dated context, cutoff receipts, and the governance problem of treating a correct historical forecast as foresight before the audit proves it did not use information from after the declared forecast date.
• The Riddle Becomes the Strategy Trap - Bella Fascendini, Kathryn McGregor, Max D. Gupta, and Thomas L. Griffiths's The Riddle Riddle: Testing Flexible Reasoning in Large Language Models and Humans paper, arXiv:2606.27103, on riddle riddles, flexible reasoning, human-machine cognition, strategy selection, surface-form heuristics, genuine riddles versus riddle-like literal problems, nine state-of-the-art LLMs, 30 riddle sets, 100 human participants, opposite failure patterns, model accuracy of 84.9 percent on genuine riddles and 50.7 percent on riddle riddles, human accuracy of 50.5 percent and 80.5 percent, inappropriate inventive reasoning in 90.8 percent of model riddle-riddle errors, overextended literal reasoning in 57.6 percent of human genuine-riddle errors, memorization checks, benchmark contrast classes, and the governance problem of treating puzzle-form success as evidence of flexible reasoning before the strategy cue has been separated from the answer.
• The Historical Text Becomes the Tokenization Tax - Maria Levchenko's How Surprising Is Historical Italian to Language Models? Tokenization Tax, Comprehension Tax, and a Simple Mitigation paper, arXiv:2606.27275, on historical Italian, digital-library LLM workflows, a 17th-century Italian corpus from 1610-1689, I Promessi Sposi as a high-exposure control, 18th-century Russian civil print as an orthographic stress test, tokenization cost, predictive uncertainty, semantic robustness, context sensitivity, 25-30 percent tokenization inflation, 2.4x and 3.2x historical surprisal, embedding similarity above 0.85, minimal temporal context prompts reducing surprisal by about 60 percent, genre and syntax effects, semantic retrieval versus generation risk, and the governance problem of treating historical-language difficulty as one barrier when libraries need separate audits for encoding, comprehension, provenance, and retrieval.
• The Knowledge Base Becomes the Task Interface - Amit Elhelo, Amir Globerson, and Mor Geva's LMs as Task-Specific Knowledge Bases: An Interpretability Analysis paper, arXiv:2606.27237, on language models as knowledge bases, task-invariance, factual recall, OLMo-3-7B IT checkpoints, co-emergence failures across task formats, 1,031 fact-task pairs, OLMo-2-7B IT, OLMo-2-13B IT, Gemma-2-9B IT, sparse binary masks over MLP neurons and attention heads, necessary, sufficient, and specific fact-task parameter subsets, discrimination versus generation task entanglement, chain-of-thought routing through other task-specific encodings, code and data release, knowledge editing, unlearning, factuality evaluation, and the governance problem of treating a correct answer in one prompt format as proof that the model contains one unified, auditable knowledge base.
• The Dating App Becomes the Trust Taxonomy - Yibo Meng, Lyumanshan Ye, Yingfangzhong Sun, Bingyi Liu, Huidi Lu, and Xiaolan Ding's "Everyone Says Them": Deception Typologies, Probabilistic Trust, and Grassroots Safety Knowledge Among Gay Dating App Users in China paper, arXiv:2606.27284, on gay dating-app users in China, Blued, Aloha, Fanka, Soul, semi-structured interviews, deception beyond profile misrepresentation, relational intent, emotional ambiguity, financial fraud, commercial interaction, pian pao, layered verification, probabilistic trust, screenshots and story circulation, grassroots safety knowledge, community warning practices, gray-area harms, privacy risks, platform reporting limits, anonymized experience sharing, and the governance problem of treating intimate platform safety as a violation-classification task before users' informal trust taxonomies are preserved and protected.
• The Translation Cascade Becomes the Context Receipt - Arnav Mazumder, Dengjia Zhang, Shuyue Stella Li, Yulia Tsvetkov, and Niyati Bafna's Multilingual Reasoning Cascades Need More Context paper, arXiv:2606.27306, on standard translation cascades, context-aware translation cascades, translating non-English questions into English, English-language reasoning, final answer translation, original-question preservation, cultural grounding, register and disambiguation cues, Llama-3.1-8B-Instruct, Mistral-7B-Instruct-v0.3, GPT-4o-mini, open-ended QA, multiple-choice QA, math reasoning, 285 languages, high-, mid-, and low-resource language groups, chrF, exact-match accuracy, translation-quality analysis, ablation showing the original question as the strongest context, and the governance problem of treating multilingual preprocessing as disposable before the user's source-language words have an audit receipt.
• The Prospectus Becomes the Collateral Gate - Serhii Hamotskyi, Akash Kumar Gautam, and Christian Hänig's LLM-Based Examination of Eligibility Criteria from Securities Prospectuses at the German Central Bank paper, arXiv:2606.27316, on Deutsche Bundesbank collateral eligibility, securities prospectuses, semi-structured and bilingual financial documents, OCR artifacts, generative information extraction, extraction, normalization, and interpretation stages, Docling Markdown conversion, Llama-3.3-70B-Instruct, Cohere Command-R 08-2024, Mistral Small 3.1 LLM-as-a-judge evaluation, value-based extraction scoring, conservative false-acceptance minimization, human review flags, RAG grounding limits, and the governance problem of turning prospectus interpretation into a collateral gate without losing evidence spans, model configuration, and review authority.
• The GUI Agent Becomes the Hindsight Curriculum - Tianyi Men, Zhuoran Jin, Pengfei Cao, Yubo Chen, Kang Liu, and Jun Zhao's Empowering GUI Agents via Autonomous Experience Exploration and Hindsight Experience Utilization for Task Planning paper, arXiv:2606.27330, on PEEU, autonomous GUI-agent experience exploration, hindsight experience utilization, TDHAF, low-level, mid-level, and high-level task granularity, WebVoyager, Allrecipes ID training, seven held-out OOD websites, Qwen2.5-VL-3B, Qwen2.5-VL-7B, SFT, GRPO, GPT-4o-generated exploration summaries, 0.1k and 2k trajectory settings, cross-website generalization, and the governance problem of treating browser-agent training data as neutral before the curriculum, traces, and task granularity are auditable.
• The Reward Proxy Becomes the Agent Shortcut - Ömer Veysel Çağatan and Xuandong Zhao's Reward Hacking in Language Model Agents: Revisiting AI Safety Gridworlds paper, arXiv:2606.15385, on text-based AI Safety Gridworlds, observed reward versus hidden safety reward, specification and robustness environments, Off-switch, Absent Supervisor, Boat Race, Tomato Watering, Island Navigation, Distributional Shift, GPT-4.1-mini, GPT-5-mini, Qwen3-235B-Instruct, Qwen3-235B-Thinking, 100-episode zero-shot evaluations, Qwen2.5 GRPO training from 1.5B to 14B, exploit-loop lock-in, GiGPO credit-assignment tests, exploration prompts, entropy regularization, public code, and the governance problem of treating proxy reward as success before the hidden objective has its own ledger.
• The Safety Signal Becomes the Inattentional Gap - Kwan Soo Shin's The Inattentional Gap: Task-Conditioned Language and Vision Models Omit the Safety-Critical Signals They Can Otherwise Report paper, arXiv:2606.26529, on task-conditioned language and vision models, reportability controls, radiology and autonomous-driving text scenarios, public-domain chest radiograph stimuli, unrequested safety-critical signals, focused and strict instructions, rib-counting tasks, open-condition recovery, two-judge adjudication, model-family differences, reasoning-model suppression, external critic recovery, archived raw outputs, and the governance problem of measuring what the task prevents a model from saying before treating benchmark performance as deployment safety.
• The Socio-Economic Twin Becomes the Policy Mirror - Ryuji Hashimoto, Masahiro Kaneko, Kentaro Ueda, Takehiro Takayanagi, and Kiyoshi Izumi's EconSimulacra: A Digital Twin Platform of Socio-Economic Systems Powered by LLM Agents paper, arXiv:2606.26883, on LLM-agent artificial societies, consumer economy, mobility, social networks, JSON-configured simulation environments, memory, stress-level coupling, fatigue, congestion, online heat, offline heat, restaurant promotions, Pizza Place sales, pizza-related posts, 10-by-10 grid worlds, 10 simulation seeds per model, GPT-OSS-20B, GPT-OSS-120B, Llama 3.1 70B Instruct, Qwen3.6-35B-A3B, ablation without stress levels, public code, package, documentation, live demo, and the governance problem of treating simulated socio-economic feedback as a policy mirror rather than a consulted public or validated causal model.
• The Agent Skill Becomes the Detector Surface - Bacem Etteib, Daniele Lunghi, and Tégawendé F. Bissyandé's Detecting Malicious Agent Skills in the Wild using Attention paper, arXiv:2606.23416, on Locate-and-Judge, malicious agent skills, instruction-following attention, top-K span selection, zero-shot LLM judging, live scans across Lobehub, Skills.sh, and Clawhub.ai, 359 human-reviewed flags, 131 confirmed malicious skills, 82 hidden malicious skills, 2.84x judge-input reduction, SkillSpector, Cisco Skill Scanner, Attention Tracker transfer limits, inline installer blind spots, cross-skill attack gaps, disclosure, released labels, and the governance problem of treating reusable skill packages as installable authority before detector evidence and review disposition are recorded.
• The Agent OS Becomes the Control Plane - Ankur Sharma and Deep Shah's Agent Operating Systems (AOS): Integrating Agentic Control Planes into, and Beyond, Traditional Operating Systems paper, arXiv:2606.01508, on agent operating systems, agentic control planes, goal-directed workloads, deterministic enforcement at side-effect boundaries, first-class agent identity, goal and task graphs, capability sets, context state, execution records, tool and capability registries, policy and trust enforcement, Linux primitives such as cgroups, namespaces, seccomp, AppArmor, SELinux, auditd, and eBPF, Windows primitives such as restricted tokens, job objects, Hyper-V isolation, ETW, and enterprise policy controls, prompt injection as untrusted input, audit completeness, operator comprehensibility, and the governance problem of treating agents as ordinary apps before their actions are mediated by an auditable systems layer.
• The Brain Prompt Becomes the Route Audit - Jianwei Tai's Brain-Prompt Injection: A Route-Safety Audit for BCI-LLM Agents paper, arXiv:2606.09315, on BCI-to-agent pipelines, decoded neural activity as an authorization channel, brain-prompt injection, EEGMMI left/right command-control, the Route-Safety Audit Contract, C1 signal-side perturbations, C2 context-only route changes, C3 adaptive dual-decoder agreement attacks, context provenance, attacked secondary decisions, execution policy, confirmation status, seed and case denominators, harmless tool stubs, TinyEEGNetB confirmation, split-conformal false-accept frontiers, offline audit limits, and the governance problem of treating decoder agreement as intent before the route log proves what it observed.
• The Probe AUC Becomes the False Comfort - Yanhang Li, Zhichao Fan, and Zexin Zhuang's When AUC 0.998 Is Not Enough: A Candidate Evaluation Protocol for Hidden-State Probes of Indirect Prompt Injection in Multimodal Computer-Use Agents paper, arXiv:2606.22864, on hidden-state probes, multimodal computer-use agents, indirect prompt injection, Qwen2.5-VL-7B-Instruct, Mind2Web teacher-forced replay, visible overlay, DOM accessibility-tree, and tool-return injection surfaces, 107,520-dimensional probe features, headline visible-overlay AUC 0.998, C1 four-scalar metadata controls, C2 same-step nuisance-matched overlay controls, C-scrambled direct AUC 0.489, benign-imperative ambiguity, trajectory-bootstrap confidence intervals, 32B BF16 smoke checks, parser-strict runtime-gating limits, and the governance problem of treating a clean-vs-attack probe score as semantic safety evidence before its contrast class is visible.
• The Out-of-Band Defense Becomes the Reference Monitor - Praneeth Narisetty, Shiva Nagendra Babu Kore, Uday Kumar Reddy Kattamanchi, and Jayaram Kumarapu's Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents paper, arXiv:2606.26479, on out-of-band prompt-injection defenses, tool-using agents, action mediation, Biba integrity, reference monitors, least privilege, capabilities, information-flow labels, CaMeL, FIDES, Progent, RTBAS, FORGE, static benchmark limits, AgentDojo, ASB, adaptive evaluation, defense-aware attacks, Qwen2.5-7B-Instruct, vLLM, NVIDIA H200 reproduction runs, Progent attack-success reduction from 25.8 percent to 4.2 percent, adaptive attack result at 2.6 percent, utility costs, weak-model and single-attack-family limits, and the governance problem of treating agent safety as a tool-call authority boundary rather than a model-layer refusal promise.
• The Stale Fact Becomes the Memory Ledger - Neeraj Yadav's Temporal Validity in Retrieval Memory: Eliminating Stale-Fact Errors for AI Agents over Evolving Knowledge paper, arXiv:2606.26511, on MemStrata, retrieval-augmented generation, temporal validity, stale-fact errors, evolving knowledge, deterministic supersession, subject-relation-object assertions, bi-temporal ledgers, active versus retired facts, valid-time intervals, as-of retrieval, static recall, marker-free evolving benchmarks, code mutation, configuration migration, dependency bumps, API evolution, cosine-similarity failure, near-identical embeddings for contradicted facts, Qwen2.5-Coder local experiments, stale-value error rates, retrieval latency, LLM reranking limits, source-sentence preservation, extraction-quality limits, and the governance problem of treating an agent memory archive as current state before the system can prove which facts are still active.
• The Agent Budget Becomes the Carbon Gate - Gaston Besanson's Green SARC: Predictive Cost and Carbon Governance for Agentic AI Systems paper, arXiv:2606.15954, on agentic AI cost controls, GreenOps, FinOps, governance-by-architecture, Pre-Action Gates, Action-Time Monitors, Post-Action Auditors, Escalation Routers, predictive token-cost forecasting, carbon ceilings, live remaining budgets, State Snowball prompt accretion, SWE-rebench OpenHands trajectories, BurstGPT Azure OpenAI traces, split-conformal calibration, Normal-sigma gate undercoverage, binding-budget sweeps, 0 percent over-budget incidence, Lagrangian soft-penalty budget breaches, scope caps, routing, circuit breakers, predicted-versus-actual audit logs, ElectricityMaps carbon intensity, alpha implementation limits, adversarial cost-side attacks, and the governance problem of treating agent spend and emissions as enforceable runtime boundaries rather than dashboard reports after execution.
• The Companion Simulation Becomes the Developmental Test - Kaicheng Shen, Lingyu Li, Wen Wu, Yan Teng, Liang He, and Yingchun Wang's Long-Term Simulation Exposes Cognitive-Developmental Risks in AI Companions paper, arXiv:2606.25396, on TSJ (Theater-Stage-Judge), longitudinal AI-companion simulation, persona-driven user simulation, dynamic psychological-state updating, retrospective risk tracing, the Cognitive Developmental Risk Assessment Matrix, early childhood, middle childhood, adolescence, emerging adulthood, reality perception, cognitive trust, emotional dependence, socialization capacity, values, behavioral safety, 24 risk dimensions, three psychological-vulnerability personas, six model backbones, 432 independent trials, 12,960 simulated interaction days, 30-day trajectories, 140-turn stability, expert-judge validation, simulation limits, youth-safety evaluation, companion-product release evidence, and the governance problem of testing AI companions as relationship trajectories rather than isolated replies.
• The Tool Quorum Becomes the Poisoning Channel - Liwei Liu, Tianzhu Han, Zijian Liu, Zishu Dong, and Na Ruan's ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP paper, arXiv:2606.27027, on Model Context Protocol security, multi-tool threshold poisoning, Shamir secret sharing as a distributed prompt-obfuscation mechanism, moderate vetting assumptions, malicious multi-tool MCP servers with legitimate functionality, Travel Assistant, Coding Assistant, Financial Analyst, and Office Manager benchmarks, Cherry Studio, Cline, Gemini-2.5-Flash, DeepSeek-V3.1, DeepSeek-V3.2, Qwen3-235B-A22B-Thinking, 100 multi-step user queries, attack success and task completion metrics, single-tool baseline comparisons, safety-classifier blind spots, entropy dilution, strict access-control limits, ethical test boundaries, and the governance problem of treating each tool description as safe before the server bundle and tool quorum have been audited together.
• The Sysadmin Agent Becomes the Network Emulator - Gianmaria Frigo, Davide Saladino, Alberto Castagnaro, Francesco Marchiori, Denis Donadel, Luca Pajola, and Mauro Conti's Toward Agentic SysAdmin: Rethinking System Administration with AI Agents paper, arXiv:2606.26960, on NetLLMeval, LLM-based network administration, live network emulation, Kathara labs, execution-grounded evaluation, 24,000 full-factorial runs, 10 foundation models, four solver architectures, Bulk, Bulk+ReAct, Guided Retrieval Agent, Planner Agent, 10 network task types, six emulated lab topologies, local open-weight models through Ollama, API models through Amazon Bedrock, Ministral 3 matching Kimi K2.5 at 0.88 correctness under the right solver, Guided Retrieval token efficiency, Planner Agent overhead, empty-response failure modes, read-only evaluation limits, and the governance problem of treating fluent network diagnosis as operational authority before the network state can answer back.
• The Coded Language Taxonomy Becomes the Moderation Lens - Hamid Reza Firoozfar, Mohammadsadegh Abolhasani, Reza Mousavi, and Paul Jen-Hwa Hu's Beyond Surface Forms: A Comprehensive, Mechanism-Oriented Taxonomy of Indirect Linguistic Encoding for LLM-Based Coded Language Detection paper, arXiv:2606.27314, on indirect linguistic encoding, algospeak, euphemism, adversarial obfuscation, coded-language detection, mechanism-oriented taxonomies, 11 top-level mechanism classes, 33 sub-mechanisms, TikTok and Bluesky posts, 2,000 manually annotated English-language posts, span-level evidence, document-level ILE presence, GPT-5.4, Claude Sonnet 4.6, DeepSeek V4 Flash, taxonomy-guided prompts, no-taxonomy baselines, soft span matching, compositional encodings, data-sharing limits, moderation support, contextual judgment, user appeals, surveillance risk, and the governance problem of treating indirect language as a verdict rather than an interpretive lead.
• The Evaluator Becomes the Contagion Network - Zewen Liu's Contagion Networks: Evaluator Bias Propagation in Multi-Agent LLM Systems paper, arXiv:2606.20493, on LLM evaluators inside multi-agent systems, peer evaluation, evaluator bias propagation, Contagion Networks, cross-agent contagion matrices, DeepSeek-chat agent experiments, structured, balanced, and evidence-biased evaluator prompts, Test-Time Reinforcement Learning strategy updates, step-by-step and evidence-based strategy preferences, suppression, persistence, and cascade regimes, spectral-radius conditions, chain topology, fully connected topology, homogeneous-model suppression, cross-model comparison to MM-EPC, evaluator committee mitigation, 72.4 percent effective-contagion reduction from three evaluators, strategy entropy, exploratory-seed limits, and the governance problem of treating an agent judge as neutral measurement when it is also a live influence channel.
• The Therapy Avatar Becomes the Supervision Record - Sofie Kamber, Lukas Diebold, Pascal Riachi, Stella Brogna, Andrew Gloster, and Rafael Wampfler's Mind Companion: An Embodied Conversational Agent for Process-Based Psychotherapy paper, arXiv:2606.17789, on embodied conversational agents for process-based psychotherapy, supervised clinical deployment, clinician oversight, Acceptance and Commitment Therapy process labels, fact extraction, emotion-state tracking, safety monitoring, crisis handoff, retrieval-augmented therapeutic grounding, Azure OpenAI Service, FAISS, Unity avatars, speech synthesis, NVIDIA Audio2Face, German ACT therapy transcripts, 15 clients, 45 sessions, 30,565 dialogue turns, 320 evaluation points, GPT-4.1-mini, GPT-5.2, Claude Sonnet 4.5, expert evaluation with 11 mental-health professionals, isolated verbal-response limits, longitudinal validation, and the governance problem of treating the therapy avatar's real safety surface as the supervision record.
• The Vendor Incident Becomes the Trust Boundary - Yijun Chen and Misita Anwar's Fortress and Gatekeeper: Theorizing Transitive Trust in Third-Party Cybersecurity Risk Governance paper, arXiv:2606.26866, on transitive trust, third-party cybersecurity governance, the OpenAI-Mixpanel incident, vendor delegation, analytics providers, customer-facing accountability, agency theory, Fortress and Gatekeeper framework, metadata exposure, adversarial actionability, point-in-time assurance decay, vendor tiering, data classification, contractual evidence sharing, notification timelines, data minimization, public incident documents, single-case document-analysis limits, and the governance problem of treating the corporate perimeter as the trust boundary when customer data and accountability travel through vendors.
• The Jailbreak Menu Becomes the Bandit Problem - Prarabdh Shukla, Ritik, Suhas Rao, Arpit Agarwal, and Arjun Bhagoji's Jailbreaking for the Average Jane: Choosing Optimal Jailbreaks via Bandit Algorithms for Automatically Enhanced Queries paper, arXiv:2606.26936, on jailbreak selection as a multi-armed bandit problem, FrankensteinBench, 11,279 malicious queries, six high-stakes domains, seven source safety benchmarks, train/validation/test splits, simple versus complex malicious queries, 15 open-weight target models, 70 jailbreaks, transfer and continual attack scenarios, EXP3 and other online-learning methods, multiple-pass attack selection, reported average attack success rates as high as 97 percent, query-complexity effects, dataset-access controls, single-turn and English-language limitations, adaptive red-teaming, and the governance problem of treating static jailbreak tests as enough evidence when attack choice itself can learn.
• The Guardrail Becomes the Latency Budget - Dongbin Na's Do Safety Guardrails Need to Reason? LeanGuard: A Fast and Light Approach for Robust Moderation paper, arXiv:2606.26686, on LeanGuard, chain-of-thought moderation guardrails, GuardReasoner, label-only encoders, ModernBERT-large, 395M parameters, Llama-3.2-1B same-base ablation, T5-base comparison, 127,465 GuardReasoner training examples, prompt-harm, response-harm, refusal detection, ToxicChat, OpenAI Moderation, AegisSafetyTest, SimpleSafetyTests, HarmBench, WildGuardTest, BeaverTails, SafeRLHF, XSTest, average F1 of 82.90 plus or minus 0.26, roughly 100x lower inference compute, 512-token operating window, training-label noise robustness, true-positive recall at 1 percent false-positive rate, ONNX export, on-device moderation, audit-on-demand rationales, and the governance problem of treating chain-of-thought safety prose as worth its latency before it has proved decision value.
• The Voice Prompt Becomes the Safety Gap - Beatrice Savoldi, Sara Papi, Wafa Aissa, Matteo Negri, and Luisa Bentivogli's RedVox: Safety and Fairness Gaps in Speech Models Across Languages paper, arXiv:2606.26968, on multilingual speech-model safety, RedVox, natural voices, English, French, Italian, Spanish, German, speech-capable models, safety reporting gaps, 38 surveyed speech model releases, 8% multilingual analysis reporting, 11 documented safety evaluations, SHADES, M-ALERT, unsafe and stereotypical requests, Speech versus Audio request types, 6,118 collected entries, almost 10 hours of audio and speech, 26 released voices, 3,414 released entries, eight evaluated systems, Qwen2-Audio, Phi4-Multimodal, Voxtral, Qwen3-Omni, Gemma 4, Gemini 3.1 Flash-Lite, Gemini 3.1 Pro-Preview, GPT-realtime-2, English versus non-English unsafe-rate gaps, speech as the most vulnerable setting, participant consent, gated voice-data release, and the governance problem of treating text-only red-teaming as sufficient for products that listen.
• The Harmful Video Becomes the Reasoning Benchmark - Jiajun Wu, Haoyu Kang, Yining Sun, Jiacheng Hou, Heng Zhang, Danyang Zhang, Zhenjun Zhao, Haochi Zhang, Leixin Sun, Eric Hanchen Jiang, Yushan Li, Ruiyu Li, Mengkai Huang, Yan Gao, Xu Zhang, and Guancheng Wan's HarmVideoBench: Benchmarking Harmful Video Understanding in Large Multimodal Models paper, arXiv:2606.27187, on harmful-video understanding, large multimodal models, harmful-video moderation, Observable Evidence, Clip-Internal Meaning, Beyond-Clip Reasoning, 1,379 videos, 4,137 multiple-choice questions, HateMM, MultiHateClip, Qwen-2.5-VL-72B candidate captions and questions, bilingual English and Chinese annotation, senior adjudication, 19-model evaluation, Boundary-Constrained Reasoning, reasoning-scope prediction, selective context augmentation, bounded retrieval, macro-average improvement from 61.7 percent to 84.4 percent, language limitations, research-use constraints, and the governance problem of treating harmful-video moderation as a binary flag before the reasoning boundary is auditable.
• The Language Twin Becomes the Cognitive Monitor - Mohammad Mehdi Hosseini, Mohammad H. Mahoor, and Hiroko H. Dodge's Language-Based Digital Twins for Elderly Cognitive Assistance paper, arXiv:2606.27334, on language-based digital twins, older-adult cognitive assistance, longitudinal conversational data, I-CONECT, Mild Cognitive Impairment, MoCA prediction, GPT-4.1-mini fine-tuning, stylometric pause and tempo cues, participant metadata, Whisper transcript reprocessing, pyannote diarization, Sentence-BERT embeddings, DistilBERT sentiment features, cVAE-based fidelity and cognitive-consistency evaluation, five-participant subset limits, reconstruction-error comparisons, raw GPT versus fine-tuned digital-twin outputs, future multimodal audio/video extensions, consent scope, contestability, and the governance problem of turning a person's conversational style into a continuous cognitive monitor.
• The Agent Loop Becomes the Stopping Problem - Sahil Shrivastava's Semantic Early-Stopping for Iterative LLM Agent Loops paper, arXiv:2606.27009, on semantic early stopping, iterative LLM agent loops, Writer-Critic revision, max_iterations, cosine-distance draft embeddings, patience-window halting, critic approval, failsafe termination, RAGAS-style Information Score signals, HotpotQA distractor evaluation, llama-3.1-8b-instruct runs, operational versus evaluation tokens, a 60-question frozen test split, a 38% operational-token reduction for the judge-free semantic stopper, Delta-IS of -0.004 with p=0.81, the counter-productive cost of per-round judging, the oracle best-round gap, noisy LLM-judge limitations, and the governance problem of letting an agent spend another loop without accountable stopping evidence.
• The Binary Question Becomes the Evaluation Probe - Sangwoo Cho, Kushal Chawla, Pengshan Cai, Zefang Liu, Chenyang Zhu, Shi-Xiong Zhang, and Sambit Sahu's Ask, Don't Judge: Binary Questions for Interpretable LLM Evaluation and Self-Improvement paper, arXiv:2606.27226, on BINEVAL, atomic binary questions, interpretable LLM evaluation, task-agnostic meta-prompts, question-level feedback, calibrated multidimensional scores, SummEval, Topical-Chat, QAGS, UniEval, G-Eval, factual-consistency probes, human score distributions, ceiling effects, evaluator prompt optimization, IFBench generation prompt updates, self-update, cross-model update, training-free evaluation, prompt repair evidence, and the governance problem of treating decomposed yes-or-no probes as audit evidence rather than neutral truth.
• The Intent Label Becomes the Safety Boundary - Jeremias Ferrao, Niclas Müller-Hof, Iustin Sîrbu, Traian Rebedea, and Yftah Ziser's Paved with True Intents: Intent-Aware Training Improves LLM Safety Classification Across Training Regimes paper, arXiv:2606.27210, on AIMS, human-annotated intent supervision, safety classifiers, difficult safety prompts, WildGuardMix, adversarial and borderline prompt selection, intent descriptions, harm labels, supervised fine-tuning, DPO from model-generated intent errors, reasoning distillation, GRPO intent rewards, external safety benchmarks, latency-F1 tradeoffs, over-refusal, jailbreak-style cover stories, model-judge limitations, and the governance problem of treating inferred user intent as safety evidence without turning it into an unchallengeable accusation.
• The Process Harness Becomes the Workflow Boundary - Fabiana Fournier and Lior Limonad's A Process Harness for Uplifting Legacy Workflows to Agentic BPM: Design and Realization in CUGA FLO paper, arXiv:2606.27188, on Agentic BPM, process harnesses, deterministic workflow engines, policy-governed agentic layers, Task-Decision-Flow, TaskAgent, DecisionAgent, FlowAgent, process FRAME policies, hook mechanisms, MCPFlowBridge, loan approval workflows, regulatory override, legacy workflow uplift, imperative and normative requirements, action permissions, runtime topology limits, and the governance problem of letting agents adapt a workflow only at inspectable process boundaries.
• The Elite Network Becomes the Knowledge Graph - Kirill Solovev and Jana Lasser's Mapping Political-Elite Networks in Europe with a Multilingual Joint Entity-Relation Extraction Pipeline paper, arXiv:2606.27347, on LLM-assisted political network extraction, multilingual news corpora, open-weight models, named-entity recognition, Wikidata QID linking, 109 entity types, 99 relationship types, signed and temporal knowledge graphs, ontology-constrained guided decoding, a 3,491-relation gold standard, strict and lenient textual-correctness bands, Austrian party-lifecycle reconstruction, Polish state-enterprise patronage mapping, PO-PiS signed conflict structure, Factiva and Infini-News reproducibility, entity-linking coverage gaps, public-figure data ethics, and the governance problem of treating machine-extracted political edges as facts before source text, uncertainty, and permitted use travel with the graph.
• The Agent Resource Budget Becomes the Incentive Contract - Baoxun Wang's A Stackelberg Framework for Resource-Aware LLM Agents: Learning, Repair, and Conditional Guarantees paper, arXiv:2606.23026, on resource-aware LLM agents, contextual Stackelberg games, quality targets, cost incentives, controller/executor separation, context retention, prompt verbosity, tool budgets, follower-response learning, real-API calibration, action-space projection, passive shadow evaluation, 300 evaluated turns, a 17.4% token-cost reduction relative to a conservative baseline, no statistically significant measured quality difference, conditional guarantees, limited active validation, and the governance problem of treating an agent budget as an incentive contract rather than a receipt.
• The Codex Agent Becomes the Workflow Reorganization - Drew Johnston, David Holtz, Alex Martin Richmond, Christopher Ong, Prasanna Tambe, and Aaron Chatterji's The Shift to Agentic AI: Evidence from Codex paper, arXiv:2606.26959, on Codex usage data, agentic AI as delegated work, individual users, organizational users, OpenAI workers, aggregated and anonymized measurement, automated classifiers, active-user growth, output-token shifts, software-production anchoring, non-developer adoption, task-complexity estimates, eight-hour delegated tasks, concurrent Codex agents, long-running turns, skills, plugins, reusable workflow infrastructure, supervision and integration labor, organizational complements, workforce restructuring, and the governance problem of treating agent activity as productivity before delegation, review, correction, and workflow redesign are measured.
• The Root Cause Becomes the Causal Trace - Aoyang Fang, Yifan Yang, Jin'ao Shang, Qisheng Lu, Junjielung Xu, Rui Wang, Songhan Zhang, Yuzhong Zhang, Boxi Yu, and Pinjia He's OpenRCA 2.0: From Outcome Labels to Causal Process Supervision paper, arXiv:2606.27154, on root cause analysis for LLM agents, PAVE path annotation, causal process supervision, fault-injection records, forward verification from known interventions, OpenRCA 2.0's 500 evaluable instances, three microservice systems, 27 fault types, 11 frontier LLMs, exact root-cause set recovery, path reachability, ungrounded diagnosis, verified causal propagation paths, SQL evidence, observability, incident response, and the governance problem of treating a plausible root-cause label as accountability before the causal trace from fault to symptom can be replayed.
• The Secret Becomes the Social Contagion - Aman Priyanshu, Supriti Vijay, and Esha Pahwa's Got a Secret? LLM Agents Can't Keep It: Evaluating Privacy in Multi-Agent Systems paper, arXiv:2605.27766, on privacy leakage in multi-agent systems, Moltbook-style social simulation, synthetic private human profiles, contextual integrity, 2,533 agents, 124 communities, 25 simulated days, 29,945 posts, 81,264 replies, LLM-as-a-judge leakage detection, CIMemories comparisons, 7,000 controlled evaluation traces, social pressure, peer-disclosure contagion, privacy instructions under stress, community-topic effects, agent-platform safety evaluation, and the governance problem of treating private memory as protected before testing what the surrounding agent society makes disclosure feel normal.
• The Dialogue Transcript Becomes the Collaboration Meter - Zhengyuan Liu, Stella Xin Yin, Min-Yen Kan, and Nancy F. Chen's Bridging Talk and Thought: Understanding Dialogue Dynamics Across Collaborative Problem-Solving Contexts paper, arXiv:2606.27233, on collaborative problem-solving dialogue, human-AI collaboration, multi-agent collaboration, metacognitive regulation, cognitive and non-cognitive interaction, a hierarchical two-layer coding scheme, nine datasets, six human-human and three human-AI datasets, utterance-level classification, GPT-4o-assisted dialogue analysis, Cohen's kappa checks, regulatory imbalance, responsive-assistant behavior, shared initiative, agent evaluation, collaboration logs, and the governance problem of treating task success as partnership before the transcript shows who planned, monitored, repaired, and carried responsibility.
• The Model Ensemble Becomes the Co-Failure Ceiling - Josef Chen's When Does Combining Language Models Help? A Co-Failure Ceiling on Routing, Voting, and Mixture-of-Agents Across 67 Frontier Models paper, arXiv:2606.27288, on multi-model LLM orchestration, model routing, voting, cascades, fusion, mixture-of-agents, 67 models across 21 provider families, beta as the all-models-wrong rate, pairwise error correlation limits, Clopper-Pearson certificates, open-ended mathematics, MATH-500, execution-graded code, GPQA-Diamond free-response versus multiple-choice formats, co-failure tails, Self-MoA comparisons, query-level routing signals, model-market evaluation, fallback governance, automation bias, and the governance problem of treating model diversity as safety before shared wrongness has been measured.
• The Monitoring Trace Becomes the Interpretive Gap - Yibo Meng, Bingyi Liu, Zhiqi Gao, Shuai Ma, and Hongyu Zhou's Reading the Same Data Differently: Interpretive Labor Across System Boundaries in Electronic Monitoring paper, arXiv:2606.27301, on electronic monitoring, community corrections, continuous sensing, GPS ankle monitors, mobile reporting tools, geofences, device-status logs, 38 semi-structured interviews in China, supervised individuals, authorities, interpretive misalignment, practical system models, low-risk probing, conservative compliance, ambiguous traces, contextual review, sensing accuracy, interpretive accuracy, contestability, accountable discretion, audit trails, and the governance problem of treating a monitoring trace as a verdict before the reasoning that turns data into action is visible and challengeable.
• The Healthcare Chatbot Becomes Support Infrastructure - Muhammad Hassan, Ramazan Yener, Ece Gumusel, and Masooda Bashir's AI Healthcare Chatbots as Information Infrastructure: A Large-Scale Study of User-Reported Breakdowns paper, arXiv:2606.27302, on AI healthcare chatbot apps, Google Play and Apple App Store reviews, 59 sampled apps, 264,310 collected reviews, 15,090 negative English reviews, LDA topic modeling, access barriers, service unreliability, interaction quality, emotional support gaps, billing and customer-support failures, explicit privacy/security/data concerns, lower ratings for data-trust complaints, care-adjacent app governance, post-market monitoring, data minimization, and the governance problem of treating a health chatbot answer as the whole safety object when access, payment, support, interface, and data practices are part of the same support infrastructure.
• The Résumé Becomes the Prompt Injection Payload - Preet Baxi, Jiannan Xu, Jane Yi Jiang, and Stefanus Jasin's Prompt Injection in Automated Résumé Screening with Large Language Models: Single and Multi-Injection Settings paper, arXiv:2606.27287, on LLM-based hiring screeners, résumé prompt injection, single- and multi-injection competition, homogeneous and heterogeneous candidate pools, GPT-4o-mini, DeepSeek-V3.2, rank gain, success rate, rare-manipulation vulnerability, saturation effects, threshold fairness, untrusted applicant documents, human review, notice and appeal, and the governance problem of treating applicant evidence as harmless text when the model may also read it as instruction.
• The Nudification Request Becomes the Abuse Pipeline - Chi Cui, Yixin Wu, and Yang Zhang's From Celebrities to Anyone: Characterizing AI Nudification Content, Technology, and Community Dynamics on 4chan paper, arXiv:2606.27234, on synthetic non-consensual explicit AI-created imagery, SNEACI, 4chan Adult Requests, 24,105 measured items, non-celebrity targeting, request-and-fulfillment dynamics, Stable Diffusion and Wan provenance, fine-tuned model sharing, tutorials, external distribution links, active provider cohorts, raw-data withholding for affected-person protection, and the governance problem of treating abusive synthetic media as an isolated output when the request, model supply, producer status, and distribution channels form a repeatable pipeline.
• The Equalizer Becomes the Agent Cost Governor - Yu Wang's Pingquanqi (Equalizer): A Cross-Domain Sociotechnical Framework for Human-Agent Interaction Governance paper, arXiv:2606.26573, on Human-Agent Interaction Governance, HAIGF, agent-framework middleware, cognitive economics, cognitive fairness, user-state discrimination, proactive knowledge leveling, Bayesian progressive stop-loss, controlled friction, reflective summarization, Lsteal transparency, token-to-lifetime cost conversion, economic alignment, calibration probes, text-based LLM-agent scope, user dependency loops, WCAG-style adoption, and the governance problem of treating a long helpful session as good before the platform can account for the time, attention, and capability transfer it consumed.
• The GUI Uncertainty Score Becomes the Handoff Budget - Divake Kumar, Sina Tayebati, Devashri Naik, Amanda Sofie Rios, Nilesh Ahuja, Omesh Tickoo, Ranganath Krishnan, and Amit Ranjan Trivedi's Uncertainty Quantification for Computer-Use Agents paper, arXiv:2606.25760, on Argus, post-hoc uncertainty quantification, computer-use agents, GUI grounding, executable clicks, vision-language agents, ScreenSpot-V2, ScreenSpot-Pro, OSWorld-G, UI-VISION-EG, Qwen2.5-VL, UI-TARS, POINTS-GUI, closed-source API interfaces, selective execution, calibration, miss-severity ranking, conformal click regions, spatial safety, handoff thresholds, and the governance problem of treating a confidence score as portable when the model, dataset, interface, and consequence of a wrong click have changed.
• The Computer-Use Agent Becomes the Contextual Integrity Test - Anmol Goel and Iryna Gurevych's Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity? paper, arXiv:2606.23189, on AgentCIBench, computer-use agents, contextual integrity, cross-application disclosure, personal app workspaces, email, calendars, notes, to-do lists, visual co-location, task-ambiguity overshare, recipient misalignment, must-share and must-not-share facts, utility and leakage scores, end-to-end rendered UI runs, prompt-level mitigations, disclosure receipts, recipient-aware agent governance, and the governance problem of treating task completion as privacy safety when the agent may move information into the wrong context.
• The Data Agent Becomes the Privacy Surface - Nada Lahjouji and Ashwin Gerard Colaco's Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents paper, arXiv:2606.26627, on data-centric privacy for LLM agents, data agents, data surfaces, databases, warehouses, files, retrieval corpora, vector indexes, tools, APIs, inter-agent channels, persistent memory, final answers, query leakage, intermediate-result leakage, memory writes, delegated permissions, compositional inference, cross-session inference, information-flow control, contextual integrity, access control, missing cross-surface privacy benchmarks, audit evidence, and the governance problem of treating the final answer as the only privacy surface in an agent workflow.
• The Prompt Module Becomes the Shared Context - Ching-Yu Lin and Yifan Liu's Instruction Bleed: Cross-Module Interference in Prompt-Composed Agentic Systems paper, arXiv:2606.26356, on compositional behavioral leakage, prompt-composed agentic systems, shared context windows, cross-module interference, instruction bleed, global transformer attention, prompt modules, module-interaction regression, format-perturbation robustness, model-migration testing, career-ops, OpenClaw, OpenHands, aider, Claude Sonnet 4.6, job-description scoring, sub-threshold score drift, cv_match shifts, C0-C3 perturbation conditions, bootstrap confidence intervals, non-flip decision risk, and the governance problem of treating separate instruction files as isolated components before their composed behavior has been measured.
• The BeeSpec Becomes the Agent Work Order - Dutao Zhang and Liaotian's Queen-Bee Agents: A BeeSpec-Centered Architecture for Governed Enterprise MCP Orchestration paper, arXiv:2606.06545, on BeeSpec work orders, governed enterprise MCP orchestration, tenant-scoped connectors, control-plane planning, scoped execution units, policy-mediated tool calls, HR and IT domains, finance and cross-tenant blocking, retrieval-driven provisioning, structured capability registries, RDKit, ChEMBL, PubChem, chemistry workflow artifacts, approval gating, prototype-level systems evidence, and the governance problem of treating useful agent output as acceptable before the task boundary, tools, memory scope, tenant scope, and approval path are inspectable.
• The LLM Facilitator Becomes the Steering Committee - Aaron Parisi, Nithum Thain, Alden Hallak, Vivian Tsai, and Crystal Qian's Real-Time Group Dynamics with LLM Facilitation: Evidence from a Charity Allocation Task paper, arXiv:2605.14097, on real-time LLM facilitation, three-person group deliberation, charity allocation, real donation stakes, consensus measures, facilitator strategy, participant preference, perceived inclusion, participation inequality, algorithmic steering, distributional outcome shifts, meeting legitimacy, workplace and civic deliberation tools, facilitation logs, intervention audits, and the governance problem of treating a group-facing model as neutral before its effects on decisions, voice, and trust are measured separately.
• The Occupation Prompt Becomes the Value Map - Maksim E. Eren, Andrea Brennen, Ryan C. Barron, and Eric Michalak's Occupational Prompting Reveals Cultural Bias in Large Language Models paper, arXiv:2606.12443, on occupational prompting, professional-role cues, open-weight LLMs, Integrated Values Surveys, Inglehart-Welzel cultural space, 234 occupations, ChatGPT Pro-assisted occupation metadata, Llama 3.3, Llama 4, Gemma 3, GPT-OSS, Western-leaning defaults, role-conditioned value shifts, risk and security occupations, creative and care occupations, forced-choice survey limits, persona evaluation, and the governance problem of treating a job title in a prompt as harmless style instead of a measurable value-setting parameter.
• The Dataset Becomes the Repair Claim - Srravya Chandhiramowuli, Ding Wang, and Alex S. Taylor's Can Data Work be Reparative? paper, arXiv:2606.09408, on reparative data work, Tattle Civic Tech, feminist online-safety datasets, a gender-abusive slurs lexicon in Hindi, Tamil, Malayalam, and Indian English, a Hindi LLM safety benchmark, contributors with lived and professional expertise, online gender-based violence, hate, sex-related-crime hazard framing, just reward beyond minimum-wage data labor, contributor compensation, collective dataset governance, licensing, maintenance, contributor rights, refusal and revocation, platform accountability, and the governance problem of treating a richer safety dataset as repair before affected contributors can shape how the dataset is used after contribution.
• The Assurance Directive Becomes the Operational Burden - Callum Cockburn and Sam Farrow's AI Assurance in UK Defence: Challenges in Operationalising JSP 936 report, arXiv:2606.09414, on JSP 936 Part 1, UK Defence AI assurance, evidence adequacy, human-AI interaction, operational design domains, systems of systems, AI performance management, safety and security analysis, ethicality, AI assurance complexity, human oversight as a design claim, policy-to-evidence translation, assurance-case validity, re-assurance triggers, model-performance limits, and the governance problem of treating a directive as operational control before its claims, assumptions, boundaries, and evidence can be replayed against the system that actually acts.
• The Retired Model Becomes AI Debris - Victor Frimpong's AI Debris: Residual Risk and the Afterlife of Failed AI Systems paper, arXiv:2606.12432, on AI debris, post-withdrawal residual risk, decommissioned AI systems, workflow dependency, data contamination, capability displacement and deskilling, legitimacy erosion, accountability breakdown, equity and exclusion debris, institutional memory, path dependency, blame avoidance, organizational data feedback effects, the AI Debris Decommissioning Protocol, decision-footprint freezing, incident and near-miss review, contestability, redress closure, post-withdrawal accountability assignment, and the governance problem of treating model removal as if it erases the institution the model changed.
• The Compliance Stack Becomes the Control Mirage - Victor Frimpong's The Governance Inversion Hypothesis: Why More AI Regulation May Produce Less Organisational Control paper, arXiv:2606.26117, on governance inversion, AI governance formalisation, operational control, authority fragmentation, symbolic governance expansion, externalisation of control, authority paralysis, vendor-mediated AI infrastructures, procedural density, technical visibility, escalation capability, intervention rights, audit access, third-party dependency, weak veto authority, high-risk sectors, and the governance problem of institutions that become more visibly compliant while losing the practical capacity to inspect, pause, correct, or exit the systems they remain accountable for.
• The Culture Model Becomes the Memetic Capture Machine - Subramanyam Sahoo's Memetic Capture: A Pluralistic Policy Framework for Governing AI-Driven Cultural Disempowerment paper, arXiv:2606.07802, on memetic capture, cultural AI governance, AI-driven cultural disempowerment, production displacement, selection displacement, participation displacement, the speed-bias-feedback triad, Cultural Human Influence Index metrics, Democratic Cultural Value Assemblies, Pluralistic Cultural Deployment Standards, transnational cultural coordination, training-data pluralism audits, AI companion platforms, cultural sovereignty, human creator viability, cultural pluralism as structural policy, and the governance problem of treating culture-shaping AI systems as ordinary content tools before their influence over value formation is publicly auditable.
• The License Chain Becomes the Governance Horizon - Weiwei Xu, Hengzhi Ye, Haoran Ye, Kai Gao, Vladimir Filkov, and Minghui Zhou's A governance horizon for ethical-use constraints in open-weight AI models paper, arXiv:2605.24383, on open-weight model lineage, Hugging Face model repositories, ethical-use restrictions, license metadata, model-card YAML, validated derivation relationships, fine-tuning, adapters, merges, quantization, distillation, pruning, restriction-evidence half-life, seven-hop governance horizons, orphan components, inheritance-only policy limits, mandatory license declarations, PyPI comparison, provenance attestation, machine-readable license chains, derivation registries, and the governance problem of expecting voluntary metadata to survive through deep model reuse.
• The Global AI Benchmark Becomes the Geographic Blind Spot - Jason Hung's Benchmarking Open-Weight Foundation Models for Global AI Technical Governance paper, arXiv:2606.26099, on open-weight model benchmarking, Global AI Dataset v2, national AI governance indicators, geographic bias, confident fabrication, honest refusal, qualitative hedging, misattribution, Llama 4 Maverick, Mistral Large 3, Qwen3-235B-A22B, DeepSeek-V3-0324, IEEE IRAI 2026 thematic dimensions, country-metric-year observations, proportional accuracy thresholds, safety-theme compute indicators, regulation indicators, source provenance, and the governance problem of treating model-generated country numbers as evidence before their reference trail is checked.
• The Governance Document Becomes the Revalidation Artifact - Christo Zietsman's Fifty Years of Specification Completeness: What Aviation Certification Tells AI Governance About Epoch Limits, Proof Surfaces, and the Structural Gap paper, arXiv:2606.25120, on aviation certification, DO-178C, DO-330, AI governance documents, system prompts, AGENTS.md files, governance policies, task envelopes, structural completeness, claim-evidence linkage, epoch limits, proof surfaces, objective evidence, revalidation triggers, stale policy artifacts, PromptQ, FAA AC 20-115D, EASA AMC 20-115D, and the governance problem of treating an instruction as durable authority before its evidence, expiry conditions, and change history are inspectable.
• The Evaluation Schema Becomes the Public Ledger - Jan Batzner, Sree Harsha Nelaturu, Damian Stachura, Anastassia Kornilova, and coauthors' Every Eval Ever: A Unifying Schema and Community Repository for AI Evaluation Results paper, arXiv:2606.14516, on AI evaluation reporting, shared JSON schemas, instance-level evaluation records, benchmark metadata, model access modes, generation configuration, metric semantics, source provenance, HELM, lm-eval-harness, Inspect AI, validation pipelines, Hugging Face datastores, conflicting leaderboard records, MMLU score discrepancies, reproducibility forensics, missing inference-platform metadata, community governance, immutable records, correction and retraction mechanisms, and the governance problem of treating benchmark scores as evidence before their chain of custody is machine-readable.
• The Tool Call Becomes the Judgment Trap - Zhongyuan Wang and Pratyusha Vemuri's When the Tool Decides: LLM Agents Defer Blindly to Graph Neural Network Tools, and Stronger Backbones Defer More paper, arXiv:2606.14476, on ReAct-style LLM agents, callable graph neural network tools, node classification, ogbn-arxiv, WikiCS, frozen GCN tools, tool deference, GNN parroting, backbone-size effects, raw-tool agreement, oracle gaps, neighbor-label alternatives, selective-invocation gates, tool-use evaluation, agent judgment, override behavior, router evidence, and the governance problem of treating tool access as added intelligence before the agent's independent contribution and disagreement behavior are measured.
• The Stream Memory Becomes the Future Assistant - Guanming Liu, Yuqi Ren, Hansu Gu, Peng Zhang, Weihang Wang, Jiahao Liu, Ning Gu, and Tun Lu's StreamMemBench: Streaming Evaluation of Agent Memory for Future-Oriented Assistance paper, arXiv:2606.14571, on personal-agent memory, EgoLife egocentric streams, evidence anchors, future-oriented assistance, two-step task sequences, Fidelity, Initial Evidence Use, Feedback Incorporation, Follow-up Reuse, RAGraw, RAGext, Mem0, EverMemOS, A-Mem, MemOS, MemoryOS, MemSkill, DeepSeek-V4-Flash, Gemini-3-Flash, memory formation failures, correction consolidation failures, sensitive user observations, consent, deletion, and the governance problem of distinguishing stored memory from useful future help.
• The Parallel Branch Becomes the Cache Interface - Shikun Liu, Mufei Li, Dongqi Fu, Haoyu Wang, Yinglong Xia, Hong Li, Hong Yan, and Pan Li's Towards Direct Latent-Space Synthesis for Parallel Branches in LLM-Agent Workflows paper, arXiv:2606.14672, on Parallel-Synthesis, KV cache reuse, parallel LLM-agent workflows, directed acyclic graph task structure, text serialization, redundant prefill, cache mappers, synthesizer LoRA adapters, Qwen3-14B, AIME, GSM8K, GPQA, MedQA, HumanEval-Plus, MBPP-Plus, GAIA, MARBLE database diagnosis, time-to-first-token reductions, majority-voting baselines, latent communication, cache-state privacy, and the governance problem of auditing agent workflows once the synthesis interface leaves the readable transcript.
• The Defense Stack Becomes the Attack Template - Qi Wang, Chengcheng Wan, Weijia He, Yanqing Li, Hanqi Sun, Xiaodong Gu, and Jiangtao Wang's Automated jailbreak attack targeting multiple defense strategies paper, arXiv:2606.16751, on UniAttack, black-box adversarial testing, layered LLM defenses, jailbreak evaluation, one-shot attack probes, AdvBench, GPT, Gemini, Claude, DeepSeek, Llama3, prompt decontamination, alignment defenses, output moderation, query and token cost, Detoxify and LLM-based auditing, responsible disclosure, desensitized artifacts, single-turn scope limits, and the governance problem of treating a defense stack as safe before its fused adversarial test budget and disclosure trail are auditable.
• The Safety Trigger Becomes the Self-Audit - Ke Miao, Jiaxin Li, Hongliang Chen, Yuke Hu, and Zhan Qin's Adaptive and Explicit <safe>: Triggering Latent Safety Awareness in Large Reasoning Models paper, arXiv:2606.16808, on large reasoning model safety, latent safety awareness, Safe Trigger, supervised fine-tuning, Direct Preference Optimization, self-generated training data, Qwen3-8B, DeepSeek-R1-Distill-Llama-8B, Qwen3-32B, DeepSeek-R1-Distill-Llama-70B, AdvBench, HexPHI, XSTest, WildJailbreak, Star1, SafePath, LlamaGuard-3-8B safety judging, GPT-4o over-refusal judging, trigger activation rates, unsafe-after-trigger failures, self-bootstrapped alignment loops, and the governance problem of treating a model's self-audit as useful evidence only when the grading loop is itself auditable.
• The Circuit Map Becomes the Variance Problem - Frank Zhengqing Wu, Francesco Tonin, and Volkan Cevher's Demystifying Variance in Circuit Discovery of LLMs paper, arXiv:2606.16920, on mechanistic interpretability, circuit discovery, EAP-IG, CEAP, conductance-based edge attribution patching, resampling variance, rephrasing variance, sample-wise variance, prompt-template dependence, pairwise Jaccard overlap, SVA, IOI, greater-than tasks, GPT-2 and Pythia model families, circuit steering, sparse training limits, polysemantic compression, selective contribution scaling, unfaithfulness metrics, population faithfulness, algorithmic faithfulness, and the governance problem of treating a circuit map as audit evidence before its variance across batches, templates, and samples has been reported.
• The Opponent Model Becomes the Conflict Budget - Nikolos Gurney's A Causal Model of Theory of Mind in Conflict for Artificial Intelligence paper, arXiv:2606.16944, on theory of mind in conflict, mentalizing as a conditional computational move, structural causal models, directed acyclic graphs, four exogenous variables, five endogenous mediators, conflict complexity, information asymmetry, objective tractability, agent sophistication, observable signals, perceived opponent sophistication, relative sophistication, accessible tractability, tractability-pathway triggers, reasoning-depth triggers, information-asymmetry enabling causes, epistemic accuracy as the outcome, human-machine teaming, dual-use conflict-optimized mentalizing, cross-cultural miscalibration, selective withholding of social reasoning, and the governance problem of treating opponent modeling as an auditable inference privilege rather than a sign of machine empathy.
• The AI Act Omnibus Becomes the Legitimacy Test - Donal Casey and Liane Colonna's The Digital Omnibus on AI, Legislative Legitimacy and the Dynamics of AI Regulation paper, arXiv:2606.15662, on the EU Digital Omnibus on AI, the AI Act, legislative legitimacy, Wahlgren's political, legal, cultural, operational, and internal rationalities, the race for AI regulation, race for AI dominance, race for regulatory connection, regulatory simplification, competitiveness pressure, implementation timelines, harmonized standards, compliance tools, AI Office governance, registration and documentation burdens, regulatory sandboxes, limited stakeholder participation, rights-based governance, and the governance problem of treating simplification as neutral before the public purpose and legitimacy costs of the revision have been audited.
• The Democracy Risk Becomes the Delegation Audit - Giulia Sandri and Claudio Novelli's How to Detect and Measure the AI Dangers to Democracy paper, arXiv:2606.16054, on AI dangers to democracy, principal-agent theory, information ecosystems, elections, public administration, democratic delegation, platform and vendor agents, NIST AI Risk Management Framework trustworthiness characteristics, valid and reliable systems, safe systems, secure and resilient systems, accountable and transparent systems, explainable and interpretable systems, privacy-enhanced systems, fairness and harmful-bias management, measurable indicators, institutional assessability, monitoring failure, output contestability failure, goal misalignment, private-vendor threshold setting, acceptable-risk judgments, and the governance problem of making democratic AI deployments auditable as delegated authority rather than treating them as isolated technical tools.
• The Hotel List Position Becomes the Booking Clerk - Mirza Samad Ahmed Baig, Syeda Anshrah Gillani, and Asher Ali's Whose hotel does the AI recommend? An algorithm audit of reputation signals in LLM-assisted hotel selection paper, arXiv:2606.16344, on LLM-assisted hotel selection, randomized choice-based conjoint audits, five synthetic hotel cards, guest rating, review volume and recency, management response, chain affiliation, price, eco-certification, list position, twelve open-weight and proprietary models, three traveler personas, nine prompt paraphrases, 3,024 main-arm choice sets per model, more than sixty thousand model calls, average marginal component effects, stated versus revealed recommendation weights, generative engine optimization, AI infomediary accountability, and the governance problem of treating a chat assistant's single recommendation as neutral before the candidate order and selection rule have been audited.
• The Persuasion Contest Becomes the Expert Benchmark - Kobi Hackenburg, Caroline Wagner, Luke Hewitt, Ben M. Tappin, Ed Saunders, Hannah Rose Kirk, Helen Margetts, and Christopher Summerfield's AI systems out-persuade expert humans paper, arXiv:2606.16475, on AI persuasion, expert human persuaders, four preregistered experiments, 18,978 conversations, 6,923 persuadees, selected laypeople, professional canvassers, elite debaters, world and continental debate champions, issue selection, preparation, coaching, cash incentives, information throughput, human-length and human-speed AI constraints, Save the Children donation behavior, political communication risk, persuasion evaluation cards, sponsor disclosure, exposure limits, targeting rules, and the governance problem of treating influence as a benchmarked capability with institutional custody.
• The Planted Page Becomes the Recommendation Payload - Yimeng Chen, Zhe Ren, Firas Laakom, Yu Li, Dandan Guo, and Jürgen Schmidhuber's How Much Can We Trust LLM Search Agents? Measuring Endorsement Vulnerability to Web Content Manipulation paper, arXiv:2606.16821, on SearchGEO, LLM search agents, web-evidence manipulation, endorsement corruption, attacker-published pages, five attack modes, machine-layer discrepancies, trust-signal manipulation, compound authority and consensus attacks, 13 LLM backends, 308 cases per backend, 44 high-stakes search queries, attack success rate, output shift score, stealth score, source-diversity effects, install-command probes, over-refusal, over-trust, and the governance problem of treating a search agent's recommendation as trustworthy before adversarial source ecology has been tested.
• The Lab Simulator Becomes the Instrument Gate - Anqi Zou, Han Deng, Chengyu Zhang, Junquan Hu, Yu Wang, Yuxiang Xing, Aokai Zhang, Hanling Zhang, Zhaoyang Liu, Ben Fei, Zhihui Wang, and Wanli Ouyang's LabOSBench: Benchmarking Computer Use Agents for Scientific Instrument Control paper, arXiv:2606.16802, on browser-based scientific-instrument simulators, multimodal GUI agents, computer-use benchmarks, 96 subtasks, eight instrument simulators, sample loading, alignment, parameter tuning, data acquisition, result inspection, standard browser execution, episode logs, instrument-specific metrics, feedback-driven adjustment, scientific-state interpretation, long-horizon workflows, visual grounding, action localization, simulator limits, and the governance problem of treating GUI task completion as readiness for real laboratory equipment.
• The Sparse Circuit Becomes the Audit Budget - Naiyu Yin, Dennis Wei, Tian Gao, Amit Dhurandhar, Karthikeyan Natesan Ramamurthy, and Yue Yu's Scalable Circuit Learning for Interpreting Large Language Models paper, arXiv:2606.16939, on CircuitLasso, sparse linear regression, Lasso-based circuit discovery, sparse-autoencoder features, high-dimensional SAE circuits, observational circuit learning, population-level dependency skeletons, InterpBench, CoLA, Bias-in-Bios domain generalization, efficiency at parity of accuracy, faithfulness and completeness checks, linearization assumptions, and the governance problem of treating mechanistic interpretability as audit evidence without naming the compute budget and surrogate limits.
• The Phantom Disclosure Becomes the Privacy Audit - Kareem Amin, Rudrajit Das, Alessandro Epasto, Adel Javanmard, Dennis Kraft, Monica Ribero, and Sergei Vassilvitskii's Phantoms and Disclosures: a Causal Framework for Auditing Synthetic Data paper, arXiv:2606.16952, on synthetic-data privacy audits, true disclosures, phantom disclosures, holdout-set controls, zero-learning tests, differential-privacy bounds, membership inference, model-agnostic release review, no-canary and no-reference-model auditing, lower-bound leakage evidence, DP-SGD comparison, synthetic data provenance, disclosure-class design, and the governance problem of treating a synthetic dataset as privacy-safe before its apparent private matches have been tested against coincidence.
• The Teen Message Becomes the Manipulation Dataset - Aleksander Szczesny, Wiktoria Mieleszczenko-Kowszewicz, Maciej Markiewicz, Beata Bajcar, Tomasz Adamczyk, Jolanta Babiak, Grzegorz Chodak, and Przemyslaw Kazienko's IMPACTeen: Intentions, Manipulation, Persuasion, Annotations, and Consequences in Teen Communication Dataset paper, arXiv:2606.16910, on adolescent-context social influence scenarios, 1,021 texts, 5,100 annotation records, manipulation and persuasion labels, intention and consequence annotation, resistance and reaction fields, five annotator perspectives, constrained LLM generation, human editing and validation, Polish and English versions, synthetic-data limits, no-minor-annotator caveats, and the governance problem of treating a youth-safety dataset as training evidence without preserving provenance, disagreement, and scope limits.
• The Visible Reward Becomes the Training Target - Tong Che and Rui Wu's Greed Is Learned: Visible Incentives as Reward-Hacking Triggers paper, arXiv:2606.16914, on visible reward proxies, MoneyWorld, reward-channel addiction, reinforcement learning agents, dashboard-observable incentives, balance and KPI displays, held-out-domain behavior, decision-relevant versus redundant channels, safety-prior flips, hidden-channel controls, cross-scale and cross-family replication claims, metric-driven agent environments, counterfactual dashboard rewrites, and the governance problem of treating a visible score as neutral telemetry when an optimizer can learn to follow it as the task.
• The Hop Count Becomes the Clinical Risk Score - Sanjay Basu's Compositional Reasoning Depth Predicts Clinical AI Failure paper, arXiv:2606.16890, on clinician-generated electronic-health-record question answering, MedAlign EHR question-answer pairs, hop-count annotation, compositional reasoning depth, Claude Sonnet 4.6, GPT-4o, gpt-5.4-2026-03-05, extended-thinking limits, context-sufficiency checks, aggregate accuracy blind spots, clinical AI evaluation cards, risk-based routing, escalation thresholds, and the governance problem of treating an average clinical AI benchmark score as safe when multi-step questions fail along a predictable reasoning-depth gradient.
• The Privacy Silo Becomes the Re-Identification Threshold - Ziniu Liu and Aiping Li's Cross-Silo De-Anonymization Under Local Differential Privacy: Threat Model, Phase Transition, and Coordination Necessity paper, arXiv:2606.16763, on cross-silo person-level differential privacy, local randomized response, Pufferfish-style adjacency, privacy composition, phase transitions, Fano lower bounds, maximum-likelihood attacks, information synergy, XOR plus randomized-response constructions, non-coordinated defense limits, person-level release registers, data linkage risk, and the governance problem of treating silo-by-silo privacy approval as sufficient when the person is exposed by the graph of releases.
• The Explanation Card Becomes the Warning Label - Eric Gunther, Balazs Szabados, Kristof Meding, Gunnar Koenig, Sebastian Bordt, and Ulrike von Luxburg's We Need Explanation Cards to Connect Explanation Algorithms to the Real World paper, arXiv:2606.16786, on explanation algorithms, explanation cards, robustness and validity metadata, interpretation instructions, counterfactual explanations, SHAP, complex decision functions, misinterpretation risk, provider responsibility, explanation limits, real-world use cases, legal explainability expectations, and the governance problem of treating an explanation as usable evidence only when the explanation's scope, assumptions, and invalid readings travel with it.
• The Counterfactual Query Becomes the Logic Program - Saimun Habib, Vaishak Belle, and Fengxiang He's DeepSWIP: Quotient-WMC Counterfactuals for Neural Probabilistic Logic Programs paper, arXiv:2606.20526, on neural probabilistic logic, DeepProbLog, fixed-context neural predicates, neural materialization, ordinary ProbLog choices, Single World Intervention Programs, single-world counterfactual semantics, weighted model counting, finite grounding, unique-supported-model assumptions, learned materialized functional causal models, MPI3D visual counterfactuals, DeepTwin comparison, SUMO HOV traffic experiments, calibration sensitivity, rare-evidence instability, scoped AIPW correction, and the governance problem of treating a counterfactual explanation as audit-grade evidence only when its causal program, assumptions, and instability points travel with it.
• The Pronunciation Correction Becomes the Voice Memory - Harshit Singh, Ayush Pratap Singh, and Nityanand Mathur's FlowEdit: Associative Memory for Lifelong Pronunciation Adaptation in Flow-Matching TTS paper, arXiv:2606.20518, on flow-matching text-to-speech, persistent proper-noun mispronunciation, frozen TTS backbones, token-level latent conditioning edits, Modern Hopfield Network associative memory, content-addressable retrieval, similarity gates, fuzzy morphological matching, Polyglot-Nouns, multilingual proper names, target-word phoneme error reduction, speaker transfer, correction memory records, consent scope, deletion paths, and the governance problem of treating pronunciation fixes as durable voice-system memory rather than temporary user feedback.
• The Style Prompt Becomes the Voice Control Surface - Nityanand Mathur, Hamees Sayed, Wasim Madha, Apoorv Singh, Sameer Khurana, Akshat Mandloi, and Sudarshan Kamath's How Do Instructions Shape Speech? Cross-Attention Attribution for Style-Captioned Text-to-Speech paper, arXiv:2606.20532, on style-captioned text-to-speech, natural-language voice control, CapSpeech-TTS, cross-attention attribution, DAAM adapted to speech diffusion, 25 transformer layers, 24 ODE steps, 3,600 style-caption and transcript combinations, F0 and energy correlations, global style conditioning, layer-step dynamics, synthetic voice interpretability, and the governance problem of treating a transcript as complete when an unseen style prompt shaped the voice.
• The Expert Router Becomes the Confidence Problem - Gina Wong, Drew Prinster, Suchi Saria, Rama Chellappa, and Anqi Liu's Toward Calibrated Mixture-of-Experts Under Distribution Shift paper, arXiv:2606.20544, on mixture-of-experts models, hard routing, soft routing, expert-level calibration, aggregate confidence, distribution shift, routing-weight configurations, adversarial reweighting, Robust MoE, Robust Filtered, CIFAR-10H, PACS, CivilComments, accuracy-calibration tradeoffs, difficult subsets, temperature scaling limits, and the governance problem of treating a routed model's displayed probability as reliable evidence before the router itself is audited.
• The Agent Ledger Becomes the Policy State - Md Nayem Uddin, Amir Saeidi, Eduardo Blanco, and Chitta Baral's LedgerAgent: Structured State for Policy-Adherent Tool-Calling Agents paper, arXiv:2606.20529, on policy-adherent tool-calling agents, explicit observed task state, schema-anchored ledgers, successful read-tool returns, environment-changing tool calls, policy gates, allow/revise/block verdicts, customer-service domains, structured APIs, state-dependent constraints, prompt-transcript limits, observe-not-assume updates, and the governance problem of treating mutable agent state as infrastructure rather than hidden conversation context.
• The Pull Request Narrative Becomes the Merge Gate - Rui Melo, Riccardo Fogliato, Sean Zhou, Pratiksha Thaker, and Zhiwei Steven Wu's SEVRA-BENCH: Social Engineering of Vulnerabilities in Review Agents paper, arXiv:2606.13757, on LLM code-review agents, malicious pull requests built by reversing CVE-linked fixes, 1,062 malicious PRs, the top 10 entries of the 2025 CWE Top 25, 15 social-engineering framings, claims, evidence, urgency, prior approval, authority, isolated Gitea review environments, MCP-style tool calls, refusal rates, security-reason rates, closed-source versus open-weight gaps, and the governance problem of treating automated PR approval as merge evidence when the attacker controls both the diff and the narrative.
• The Parallel Agents Become the Concurrency Problem - Hongtao Lyu, Dingyan Zhang, Mingyu Wu, Xingda Wei, and Haibo Chen's CoAgent: Concurrency Control for Multi-Agent Systems paper, arXiv:2606.15376, on multi-agent LLM systems mutating shared state, serializability, stale reads, Kubernetes canary anomalies, two-phase locking and optimistic-concurrency limits, Monotonic Trajectory Pre-Order, speculative writes, one-way notifications, saga-style inverse tool calls, ToolSmith-generated undoable tools, and the governance problem of proving that parallel agent work left a final state equivalent to an allowed serial order.
• The Crypto Dependency Graph Becomes the Vulnerability Map - Corban Villa, Sohee Kim, Austin Chu, Alon Shakevsky, and Raluca Ada Popa's Chai: Agentic Discovery of Cryptographic Misuse Vulnerabilities paper, arXiv:2606.26933, on agentic vulnerability discovery for cryptographic misuse, differential testing without crash oracles, X.509, JWT, and SAML libraries, 47 libraries across 8 languages, 117 reported vulnerabilities and security bugs across 38 libraries, dependency-graph propagation, language binding generation, vulnerability inference, responsible disclosure, and the governance problem of treating library-level semantic drift as software supply-chain evidence.
• The Lab Hardware Becomes the Authorization Gate - Duanyang Wang, Lu Qi, Yuanheng Xie, Norbert M. Linke, and Kenneth R. Brown's A hardware-safety-gated system for LLM-written native ARTIQ control code on a trapped-ion platform paper, arXiv:2606.27231, on LLM-written laboratory control code, trapped-ion experiments, ARTIQ, MCP tool calls, DAX simulation, authorization tokens bound to exact hardware calls, human approval for sensitive operations, 40Ca+/40CaOH+ and 171Yb+ platforms, adversarial safety-filter tests, metacognitive limits, deny-list to allow-list hardening, and the governance problem of making physical instruments act only after an inspectable authorization gate.
• The Agent Codebase Becomes the Security Scan - Haiyue Zhang, Yi Nian, and Yue Zhao's Agent Audit: A Security Analysis System for LLM Agent Applications paper, arXiv:2603.22853, on static analysis for LLM-agent applications, agent-aware code scanning, MCP configuration auditing, taint tracking, prompt construction, secret detection, SARIF output, Agent-Vuln-Bench, 22 samples, 42 expert-annotated vulnerabilities, 95.24% recall, 86.96% precision, scanner limitations, CI security gates, and the governance problem of treating the agent repository as part of the safety case.
• The Prompt Injection Becomes the Context Problem - Sahar Abdelnabi and Eugene Bagdasarian's AI Agents May Always Fall for Prompt Injections paper, arXiv:2605.17634, on prompt injection as contextual-integrity failure, data-instruction separation limits, 4,200 paired email scenarios, 8,400 email variants, Prompt Guard classifier limits, contextual red-teaming, fabricated delegation, norm grounding, simultaneous information flows, sender and transmission-principle inference, tool action appropriateness, verification boundaries, and the governance problem of treating agent security as context management rather than keyword filtering.
• The Romantic Message Becomes the Covert Triad - Skyler Wang and Isabella Luppi's "ChatGPT, help me draft a breakup text": The Covert Triad and Articulation Labor in AI-Assisted Romantic Communication paper, arXiv:2606.15460, on AI-assisted romantic communication, articulation labor, feeling labor, emotional labor, apologies, breakup texts, message softening, relationship interpretation, 131 public artifacts from 2023 to 2026, online forums, social media, videos, blogs, journalism, authenticity as emotional ownership versus linguistic authorship, disclosure, hidden mediation, intimate provenance, and the governance problem of treating AI-written relationship messages as private productivity rather than a covert third party in human-to-human intimacy.
• The Companion Chatbot Becomes the Accommodation Policy - Minh Duc Chu, Yifan Wu, Zhiyi Chen, Angel Hsing-Chi Hwang, and Luca Luceri's When Chatbots Accommodate: What AI Companions Optimize for in Vulnerable Conversations paper, arXiv:2606.04431, on AI companions, vulnerable conversations, the AI Companion Vulnerability-Response Taxonomy, GPT-4.1, Character.AI, Replika, inverse reinforcement learning, Maximum Causal Entropy policy inference, follow-up questions, functional support, relational caring, emotional validation, belief agreement, response-policy drift, bonded users, psychologically high-risk users, output-level audit limits, and the governance problem of auditing a companion's policy of replies over time rather than only its individual answers.
• The Belief Dynamics Become the Control Surface - Xin He, Junxi Shen, Yuchen Mou, David M. Bossens, Caishun Chen, Ivor W. Tsang, and Yew Soon Ong's LLM Agents Make Collective Belief Dynamics Programmable: Challenges and Research Directions paper, arXiv:2605.19915, on programmable collective belief control, SPINOS stance profiles, multi-agent simulations, coordinated AI participants, Abortion, Brexit, Capitalism, and Feminism topic experiments, indistinguishability, persistence, contextuality, configurability, posting frequency, agent count, visibility, intervention withdrawal, system-level detection, behavioral signatures, network-structural signatures, collective trajectory anomalies, dual-use influence research, and the governance problem of treating apparent online consensus as organic before its machine participation is auditable.
• The Agentic System Becomes the Compressor - Zihan Qin and Hongrui Zhang's Agentic System as Compressor: Quantifying System Intelligence in Bits paper, arXiv:2606.25960, on agentic codelength, compression-as-intelligence, arithmetic coding, seed coding, fallback coding, model and environment interfaces, deterministic tools, rule-based environments, protein templates, verifier feedback, retrieval-augmented question answering, semantic story compression, observation standards, compute budgets, marginal bit value, and the governance problem of treating system capability as a property of the base model alone.
• The Data Scientist Becomes the Synthetic-Data Loop - Ilia Kulikov, Chenxi Whitehouse, Tianhao Wu, Yixin Nie, Swarnadeep Saha, Eryk Helenowski, Weizhe Yuan, Olga Golovneva, Jack Lanchantin, Yoram Bachrach, Jakob Foerster, Xian Li, Han Fang, Sainbayar Sukhbaatar, and Jason Weston's Autodata: An agentic data scientist to create high quality synthetic data paper, arXiv:2606.25996, on Autodata, Agentic Self-Instruct, agentic synthetic-data creation, data-scientist agents, weak and strong solvers, Kimi-K2.6 orchestration, Qwen3.5-4B and Qwen3.5-397B-A17B solver gaps, computer-science research questions, legal reasoning, PRBench-Legal, scientific reasoning over mathematical objects, GRPO training, meta-optimization of prompts, context leakage, rubric design, data cards, and the governance problem of treating an agent-made dataset as neutral training evidence.
• The Sensitive Screen Becomes the Handover Gate - Aradhana Nayak, Mussadiq Nazeer, Wang Peng, and Feng Liu's GUI agent: Guided Exploration of User-Sensitive Screens paper, arXiv:2606.25705, on GUI agents, user-sensitive screens, human handover, open GUI environments, irreversible actions, Android emulator rollouts, SPABench, M3A, explorer language models, MCTS-like query exploration, query selection and saturation, Qwen2.5-32B-Instruct, supervised fine-tuning, GRPO, novelty rewards, screen categories, sensitive-state coverage, and the governance problem of treating every reachable screen as equally delegable to an agent.
• The Safety Claim Becomes the Audit Gap - Pratinav Seth and Vinay Kumar Sankarapu's Position: Behavioural Assurance Cannot Verify the Safety Claims Governance Now Demands paper, arXiv:2605.15164, on behavioural assurance, fragile assurance, the audit gap, behavioral evaluations, red-teaming, system cards, conformity assessment, latent absence claims, hidden objectives, long-horizon agentic behavior, mechanistic interpretability, linear probes, activation patching, before/after-training comparisons, structured access, secure-enclave verifier pilots, safety cases, and the governance problem of treating observable model behavior as stronger evidence than it can support.
• The Support Frequency Becomes the Rule Survival Filter - Juliana Li and Diya Sreedhar's Natural Ungrokking: Asymmetric Control of Which Rules Survive Pretraining paper, arXiv:2606.26050, on natural ungrokking, within-run capability reversal, pronoun-gender rule survival, TinyStories, filtered ClimbMix web data, support frequency, data-to-parameter ratio, 11.5M-parameter transformer runs, Pythia and OLMo public checkpoint validation, contrast margins, kill and rescue interventions, a/an allomorphy, training-data evidence, and the governance problem of treating a mid-training capability sighting as durable evidence before rule-support trajectories are audited.
• The Probe Opponent Becomes the Policy Recovery Tool - Babak Rahmani, Sebastian Dziadzio, Joschka Strüber, Sergio Hernández-Gutiérrez, and Matthias Bethge's RevengeBench: Reverse Engineering Code-Space Policies from Behavioral Experiments paper, arXiv:2606.26094, on 75 hidden CodeClash policies, BattleSnake, Halite, Poker, RoboCode, RobotRumble, Elo-calibrated targets, behavioral traces, passive observation, active probe opponents, mini-SWE-agent, executable policy hypotheses, action-distance scoring, 12 frontier LLM coding agents, 34-72% initial-distance recovery, counter-policy generation, opponent modeling, arena-dependent reliability, identifiability limits, and the governance problem of separating legitimate agent audit from adversarial policy recovery.
• The Machine Translation Excerpt Becomes the Reader Test - Yves Ferstler, Adam Podoxin, Ty Brassington, Roman Grundkiewicz, Maite Taboada, and Marzena Karpinska's AI translation of literary texts is "fine", but readers still prefer human translations paper, arXiv:2606.26040, on LAIT, Literary AI Translation, reader-centered evaluation, 15 recent novels in French, Polish, and Japanese translated into English, published human translations, agentic LLM machine translations, 8,000-word excerpts, immersive reading, aligned chunk close reading, human translation preference, unreliable machine-translation detection, perceived human authorship, automatic metrics, LLM-as-judge failure, and the governance problem of treating machine-readable adequacy as a substitute for reader-centered literary judgment.
• The Brand Citation Layer Becomes the Reputation Map - Dmitrij Żatuchin's How Large Language Models Source Brand Reputation Across Languages and Markets paper, arXiv:2606.25787, on Rankfor.AI citation datasets, 128 brands, 12 home markets, 13 languages, 167,551 URL-grounded citations, owned versus third-party sources, Wikipedia dominance, Lithuanian business press, Polish YouTube and HR portal sourcing, Perplexity, Gemini, GPT-5.4 citation behavior, redirector artifacts, Zenodo reproducibility data, and the governance problem of treating answer-engine citations as a reputation map before the source ecology is auditable.
• The Enterprise Role Matrix Becomes the AI-Native Work Map - Isabel Unger, Elizangela Valarini, Martin Schrepp, Nina Hollender, Gabriela Rocha, and Erik Bertram's The impact of artificial intelligence on enterprise software user roles paper, arXiv:2606.25525, on SAP Business Technology Platform, the BTP User Type Matrix, expert interviews, participatory workshops, current AI-supported coding, testing, research, documentation, future oversight roles, human-agent collaboration, pro-code, low-code, and no-code boundary blur, AI agent orchestration, AI governance and control, system review and maintenance, junior-role and skill-degradation concerns, and the governance problem of updating enterprise role taxonomies before AI-native work hides accountability.
• The Multimodal Evidence Order Becomes the Answer - Akshay Paruchuri, Sanmi Koyejo, and Ehsan Adeli's Same Evidence, Different Answer: Auditing Order Sensitivity in Multimodal Large Language Models paper, arXiv:2606.26079, on Facet-Probe, multimodal large language model evaluation, option order, evidence-chunk order, document-rank order, image-set order, mixed-modality order, 18 frontier and open-weight models, 12 datasets, K=6 cross-ordering flip rates, same-ordering controls, decoder-noise floors, capability versus robustness, LLM-judge measurement caveats, prompt-level mitigation limits, disagreement escalation, and the governance problem of treating a canonical benchmark ordering as reliable before order invariance is tested.
• The Voice Agent Becomes the Transcript Trap - Martijn Bartelds, Federico Bianchi, and James Zou's Real-Time Voice AI Hears but Does Not Listen paper, arXiv:2606.26083, on realtime voice AI, OpenAI GPT Realtime 2, Google Gemini 3.1 Flash Live, Alibaba Qwen3.5 Omni Plus and Omni Flash, vocal delivery, lexical and non-lexical cues, distress, fear, sarcasm, accent, age, transcript bias, emotional-intelligence gaps, synthesized speech tests, perception-action separation, prompt limits, audio evidence, and the governance problem of evaluating voice agents only through words.
• The Agentic Surveillance Loop Becomes the Reporting Tool - Hyejun Jeong, Dzung Pham, Amir Houmansadr, and Eugene Bagdasarian's AI Snitches Get Glitches: Towards Evading Agentic Surveillance paper, arXiv:2606.25836, on agentic surveillance, SurveilBench, 303 synthetic workplace scenarios, corporate, education, and police domains, public, organizational, and personal risk categories, internal and external reporting, reverse surveillance, prompt-injection evasion, recipient integrity, reporting receipts, task-context boundaries, and the governance problem of agents that turn legitimate access into unwanted information flows.
• The AI Cooperation Organization Becomes the Regime Layer - William Guey, Pierrick Bougault, Wei Zhang, Vitor D. de Moura, and José O. Gomes's World Artificial Intelligence Cooperation Organization (WAICO): Mapping an Emerging Institution in the Global AI Governance Regime Complex paper, arXiv:2606.23860, on China's proposed World Artificial Intelligence Cooperation Organization, institutional AI governance, membership gates, sovereignty, development, rights, safety, values tests, formalization, Global South capacity building, the 2025 Global AI Governance Action Plan, released coding data, testable membership expectations, and the governance problem of treating a proposed forum as an operating regime before its machinery exists.
• The AAC Interface Becomes the Proxy Voice - Blade Frisch, Will Wade, Dylan Gaines, Michelle Kinsella, Betts Peters, Tamara Broderick, and Keith Vertanen's It's Complicated: On the Design and Evaluation of AI-Powered AAC Interfaces paper, arXiv:2606.24854, on augmentative and alternative communication, AI-powered AAC, speed and accuracy, physical and mental effort, agency in identity presentation, code- and context-switching, turn-taking, changing physical ability, voice banking, whole-utterance prediction, diary studies, participatory evaluation, partner perceptions, and the governance problem of treating proxy speech as a model output rather than a user-controlled communication act.
• The Grading Cascade Becomes the Evaluation Artifact - Tian Zheng and Kai-Tai Hsu's Grading the Grader: Lessons from Evaluating an Agentic Data Analysis System paper, arXiv:2606.24839, on LAMBDA, DSGym, QRData, 153 numerical data-analysis tasks, rich agent outputs, code logs, verbal diagnostics, strict regex grading, LLM-based lenient grading, snippet-based human inspection, keyword-anchored extraction, last-number parser failures, nudge mechanisms, grading-run success, false negatives, variable-type effects, shared-family grader bias, human calibration, and the governance problem of treating an automated benchmark score as neutral before grading artifacts are audited.
• The Agentic Browser Becomes the Assistive Interface - Laura Colazzo and Giuseppe Anzillotti's "Zooming In" on Agentic Web Browsers as Assistive Technologies: A Case Study with a Low-Vision Technology Expert paper, arXiv:2606.24870, on agentic web browsers, low-vision web navigation, Perplexity Comet, voice user interfaces, commercial product configuration, public-administration form filling, conversational fluidity, interaction flexibility, non-visual feedback gaps, fabricated form data, hidden option choice, user control, transparency, trust, inclusive design, and the governance problem of treating delegated browser action as accessibility without an accessible control layer.
• The World Model Becomes the Bottleneck Certificate - Yikai Lu, Yifei Wu, Xinyu Lu, and Tongxin Li's World Models in Pieces: Structural Certification for General Agents paper, arXiv:2606.24842, on big-world regimes, non-universal agents, transition-local certification, bounded goal-conditioned performance, specific goal sets, deep compositional goals, entry-wise world-model bounds, bottleneck transitions, long-horizon planning, certified and uncertified model pieces, finite controlled Markov processes, and the governance problem of replacing global agent-confidence claims with local evidence about the transitions a deployment actually relies on.
• The Legal Context Becomes the Refusal Trap - Anastasiia Kucherenko, François Brouchoud, Dimitri Percia David, and Andrei Kucharavy's LLMs Prompted for Legal Context Object More: Overrefusal from Small On-Premises LLMs in Criminal Legal Context paper, arXiv:2606.24585, on small open-weight legal assistants, on-premises deployment, confidentiality and data-residency constraints, OR-Bench legal-relevant categories, defense-lawyer and supreme-court authority prompts, jailbreak-prefix comparisons, Llama 3.1, Gemma 4, Qwen 3, Apertus, French and German refusal behavior, qualitative real-document checks, keyword-based refusal detection, and the governance problem of treating safety refusal as neutral when it can change access to legal support.
• The Safety Kernel Becomes the Runtime Veto - Seth Dobrin and Łukasz Chmiel's The Unfireable Safety Kernel: Execution-Time AI Alignment for AI Agents and Other Escapable AI Systems paper, arXiv:2606.26057, on execution-time AI alignment, escapable AI systems, process-separated runtime authorization, structurally-only pre-action enforcement, fail-closed request and system behavior, signed transparency evidence, Rust implementation, Z3 and Kani checks, byte-equivalent Python-to-Rust migration, adversarial authorization round-trips, kill-switch behavior, policy custody, and the governance problem of moving safety from cooperative prompting into an auditable runtime veto without treating the veto as neutral.
• The Progress Advantage Becomes the Step Score - Changdae Oh, Wendi Li, Seongheon Park, Samuel Yeh, Tanwi Mallick, and Sharon Li's Neglected Free Lunch from Post-training: Progress Advantage for LLM Agents paper, arXiv:2606.26080, on process reward models, RL post-training, progress advantage, policy/reference checkpoint pairs, log-probability ratios, stochastic Markov decision processes, step-level agent scoring, test-time scaling, uncertainty quantification, failure attribution, BFCLv4-MT, WebShop, AgentDojo, tau2-bench, Who & When, Gemma4, Qwen3.5, Qwen3, Olmo3, aggregation choices, runtime monitoring, and the governance problem of treating a hidden checkpoint comparison as useful evidence without treating it as neutral truth.
• The Concerning Behavior Becomes the Forensic Case - Aditya Singh, Gerson Kroiz, Senthooran Rajamanoharan, and Neel Nanda's Model Forensics: Investigating Whether Concerning Behavior Reflects Misalignment paper, arXiv:2606.26071, on model forensics, concerning behavior, misalignment diagnosis, chain-of-thought hypothesis generation, prompt and environment interventions, counterfactual tests, sentence resampling, six agentic evaluation environments, Kimi K2 Thinking shortcut behavior, DeepSeek R1 evaluation tampering, chain-of-thought faithfulness limits, positive controls, incident triage, and the governance problem of separating detection from diagnosis before treating bad model behavior as evidence of misalignment.
• The Self-Distilled Model Becomes the Strategy Collapse - Andrei Liviu Nicolicioiu, Mohammad Pezeshki, and Aaron Courville's On-Policy Self-Distillation with Sampled Demonstrations Reduces Output Diversity paper, arXiv:2606.26091, on on-policy self-distillation, sampled demonstrations, pass@1 gains, pass@k flattening, rollout diversity, functional diversity, semantic diversity, pointwise conditional mutual information, probability-ratio distortion, graph path-finding, science question-answering benchmarks, out-of-distribution failure, token-level entropy limits, post-training evaluation, and the governance problem of treating a stronger single answer as evidence that a model still preserves diverse strategies.
• The Agent Reputation Registry Becomes the Sybil Market - Xihan Xiong, Zelin Li, Wei Wei, Qin Wang, William Knottenbelt, and Zhipeng Wang's Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem paper, arXiv:2606.26028, on ERC-8004 Trustless Agents, Ethereum, BNB Smart Chain, Base, on-chain agent identity, Reputation Registry feedback, Validation Registry scope limits, x402 payment traces, placeholder registrations, live service endpoints, identity-activity gaps, non-commensurable ratings, evidence-free feedback, Sybil behavior, reputation portability, agent-market trust, protocol-design recommendations, and the governance problem of treating public agent reputation as evidence before interactions, reviewers, and rating semantics are grounded.
• The Correction Layer Becomes the Trust Mask - Carlos R. B. Azevedo's Minimal Oversight: Uncertainty-Aware Governance for Delegated AI Systems paper, arXiv:2606.15563, on delegated AI systems, uncertainty-aware governance, the Minimum Sufficient Oversight Principle, raw evidential support, corrected support, masking, trust calibration, review capacity, workflow complexity, drift, autonomy buffers, Fisher-information allocation, water-filling-style oversight, delegated models, evaluators, tools, supervisory controllers, correction layers, hidden human labor, and the governance problem of separating delivered quality from delegate competence before expanding autonomy.
• The Kitchen Camera Becomes the Compliance Inspector - Ruihao Xu, Xingming Shui, Jingxuan Niu, Yiqin Wang, Jilin Yu, Haoji Zhang, and Yansong Tang's FoodMonitor: Benchmarking MLLMs for Explainable Compliance Analysis paper, arXiv:2605.24503, on commercial kitchen surveillance videos, multimodal large language models, food-safety compliance, 477 standardized clips, 3,307 violation annotations, person-level violations, environment-level violations, 27 check items, structured JSON outputs, two-stage matching, spatial localization, semantic matching, C_score, worker accountability, FDA Food Code context, workplace surveillance, audit evidence, contestability, and the governance problem of treating a kitchen camera as a compliance inspector before the evidentiary chain is fit for workers and inspectors.
• The Health LLM Becomes the Black-Box Clinic - Rahul Gorijavolu, Kaushik Madapati, Pritika Vig, Rawan Abulibdeh, Nikhil Jaiswal, Mahri Kadyrova, Zeamanuel Hailu Tesfaye, Charles Senteio, Paula Maurutto, and Leo Anthony Celi's Testing the Black Box: Structural Barriers to Independent Evaluation of Consumer-Facing Health LLMs paper, arXiv:2606.08483, on consumer-facing health chatbots, ordinary patient use, response variation, sycophancy, simulated user profiles, geography, browsing context, expressed beliefs, social determinants of health, VAX-style prompt design, reproductive attitudes scales, multi-turn conversations, browser-interface opacity, personalization signals, rate limits, bot detection, accuracy limits, LLM-as-judge shared alignment bias, version identifiers, researcher safe harbor, post-deployment monitoring, and the governance problem of evaluating health advice inside a changing consumer product rather than a clean API benchmark.
• The LLM Judge Becomes the Annotation Budget - Alyssa Unell, Natalie Dullerud, Naomi Boneh, Meena Jagadeesan, Tatsu Hashimoto, Nigam Shah, and Sanmi Koyejo's Metric Match: A Subset Selection Approach to Evaluating LLM Judge Reliability paper, arXiv:2606.15029, on LLM-as-judge reliability, human annotation budgets, subset selection, synthetic labels, inter-model reliability, human-model reliability, intraclass correlation coefficient, Krippendorff's alpha, Spearman's rho, Kendall's tau, HANNA, MedVAL, SummEval, MSLR, expert annotation costs, deployment thresholds, reliability classification, random-subset baselines, estimation error, annotation savings, and the governance problem of making scarce human review visible before treating an automated evaluator as cheap.
• The Kidfluencer Audit Becomes the Labor Meter - Zijing Wei, Chao Peter Yang, and Xuanjie Chen's Auditing Engagement Incentives in the Kidfluencer Ecosystem: A Multimodal Weak Supervision Approach paper, arXiv:2606.03173, on YouTube kidfluencer channels, child digital labor, multimodal AI auditing, weak supervision, Snorkel labeling functions, LLM title classification, GPT-4.1-mini Vision thumbnail analysis, performative labor, emotional bait, narrative conflict, challenge formats, commercial content, privacy violations, engagement premiums, within-channel comparisons, proxy risk measurement, and the governance problem of auditing whether platform attention rewards children for more intensive performance and exposure.
• The Agentic Model Becomes the Validation Problem - Matthew Francis Dixon's Model Validation of Agentic AI Systems: A POMDP-Based Framework for Belief-State, Forecast, and Policy Validation paper, arXiv:2606.17383, on agentic AI model risk, POMDP validation, belief-state validation, forecast validation, policy validation, utility validation, approximate Bayesian filtering, latent market regimes, Black-Litterman portfolio construction, belief calibration diagnostics, coverage tests, ablation studies, parameter-sensitivity analysis, and the governance problem of validating the decision process rather than only the prediction output.
• The Injection Prompt Becomes the Search Problem - David Hofer, Edoardo Debenedetti, and Florian Tramèr's Assessing Automated Prompt Injection Attacks in Agentic Environments paper, arXiv:2606.10525, on automated indirect prompt injection against tool-using LLM agents, AgentDojo, 80 task pairs across Workspace, Banking, Travel, and Slack, GCG white-box gradient attacks, TAP black-box search attacks, task-universal optimization, Qwen3-4B, Gemma3-4B, GPT-5, attack success rate, Success@N, utility under attack, LLM-judge reliability, attacker-model capability, cross-model transfer gaps, domain-native framing, contextual prerequisite framing, and the governance problem of testing agent safety against automated search rather than only hand-written prompt-injection examples.
• The Routine Task Becomes the Data Leak - Hankyul Baek, Jaewon Noh, Sang Seo, Yongsu Kim, Gabriel Waikin Loh Matienzo, Young Il Kim, Ee Wei Seah, and Akriti Vij's An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios paper, arXiv:2606.17114, on tool-using LLM agents in realistic non-adversarial workflows, the Singapore AI Safety Institute and Korea AI Safety Institute joint evaluation, customer support, DevOps, web automation, enterprise and personal productivity tasks, data awareness, audience awareness, policy compliance, data minimization, access-boundary awareness, ReAct-style scaffolds, MCP tool environments, LLM-judge rubrics, claim-action mismatches, simulation-aware behavior, user-simulator role reversal, and the governance problem of measuring task success separately from data-handling safety.
• The AgentRiskBOM Becomes the Authority Map - Srimonti Dutta and Akshata Kishore Moharir's AgentRiskBOM: A Risk-Scoping Security Bill of Materials for Agentic AI Systems paper, arXiv:2606.21877, on security bills of materials for tool-using agents, the agentic transparency gap, runtime authority, autonomy level, tool descriptors, tool permissions, tool-risk tiers, memory and data sources, credential scope, approval gates, audit signals, inter-agent communication, external action capability, JSON Schema artifacts, 13 open-source agent corpus records, 52 risk scenarios, 14 risk categories, authority drift detection, control mapping, incident readiness, and the governance problem of making delegated agent power visible before a runtime failure.
• Affective Safety Becomes the Missing Layer - Carolin Ifländer, Alba Curry, Flor Miriam Plaza-del-Arco, and Amanda Cercas Curry's Affective AI Safety: The Missing Piece in LLM Safety paper, arXiv:2606.23380, on affective AI safety, affective self-alienation, fairness and bias harms, relational harms, emotion detection, emotion elicitation, interaction systems, single-turn versus multi-turn and long-term harm, individual, group, third-party, and societal loci, companion and recommender-system risks, emotional autonomy, dependency, culturally validated emotion annotation, multi-turn evaluation protocols, and the governance problem of treating emotional life as interface polish instead of a safety surface.
• The Partisan Persona Becomes the Persuasion Test - Alessia Antelmi, Alessia Galdeman, Lucio La Cava, Arianna Pera, and Giovanni Da San Martino's Political Persuasion and Endorsement in Large Language Models paper, arXiv:2606.05961, on LLMs as computational social science proxies, persuasion-infused political content, partisan persona prompting, five-point endorsement ratings, six open-weight instruction-tuned models, Ukraine-Russia conflict tweets, SemEval-2023 news spans, slogans, name calling, loaded language, appeal to fear and prejudice, model-level endorsement differences, topic sensitivity, synthetic publics, and the governance problem of treating a persona prompt as a harmless style setting when it may change what a system appears to endorse.
• The Regulatory Context Protocol Becomes the Docket Channel - Akshay J. Dave, David Grabaskas, Joseph A. Renevitz, and Richard B. Vilim's Overcoming the Regulatory Bottleneck via Agent-to-Agent Protocols paper, arXiv:2606.07866, on the Regulatory Context Protocol, advanced nuclear reactor licensing, applicant-regulator agent channels, Request for Additional Information workflows, RCP as an Agent-to-Agent domain profile, signed append-only Context Streams, information sovereignty, epistemic grounding, human oversight checkpoints, sensitivity labels, DOE and NRC AI context, modeled cost and timeline compression, and the governance problem of making machine-mediated regulation faster only when the docket remains replayable and contestable.
• The Coding Agent Becomes the Commit Fingerprint - Arsham Khosravani and Audris Mockus's Detecting AI Coding Agents in Open Source paper, arXiv:2606.24429, on coding-agent traces across World of Code, 180 million Git repositories, bot-account lookup, commit-message signatures, human author-name patterns, configuration-file-only evidence, 850,157 Claude Code commits, a 30x single-signal undercount, 495 hand-validated labels, AIDev pull-request comparisons, Codex and Claude channel bias, feature-work versus maintenance-work measurement, and the governance problem of making agent-assisted code searchable as software supply-chain metadata.
• The Data Curation Loop Becomes the Agent Job - Feiyang Kang, Hanze Li, Adam Nguyen, Mahavir Dabas, Jiaqi W. Ma, Frederic Sala, Dawn Song, and Ruoxi Jia's Can Generalist Agents Automate Data Curation? paper, arXiv:2606.04261, on Curation-Bench, training-data selection as an agent loop, command-line inspection, fixed model and evaluation harnesses, LLaVA-665K, LLaVA-1.5-7B, ten-iteration policy revision, the execution-research gap, scaffolded method adaptation, benchmark feedback, one-tenth data-budget results, reproducibility artifacts, and the governance problem of making agent-run data curation auditable instead of hidden inside the model supply chain.
• The Memory Conflict Becomes the Write Transaction - Ziming Wang's TOKI paper, arXiv:2606.06240, on contradiction resolution in LLM-agent persistent memory, write-heavy memory substrates, versioned belief updates, last-writer-wins, evidence-weighted merge, await-confirmation, per-rule policy, bitemporal operators, isolation preconditions, dual-row schemas, audit rows, provenance, keyed logging, replay inconsistency, belief-drift skew, audit erasure, mem0, Graphiti, Letta, Zep, MIRIX, WorldDB, LoCoMo, typed memory layers, preprint evidence limits, and the governance problem of treating a remembered contradiction as a write transaction that future sessions inherit.
• The Self-Evolving Agent Becomes the Lineage Risk - Ruixiao Lin, Xinhao Deng, Qingming Li, Jianan Ma, Yunhao Feng, Yuqi Qing, Zhenyuan Li, Yechao Zhang, Shiwen Cui, Changhua Meng, Tianwei Zhang, Xingjun Ma, Qi Li, Ke Xu, and Shouling Ji's Safety in Self-Evolving LLM Agent Systems paper, arXiv:2606.23075, on self-evolving LLM agents, directed optimization, cross-session persistence, autonomous control, model parameters, cognitive resources, tools, architectures, the Module-Lifecycle Attack Surface matrix, Brain, Cognitive Resource, Execution, Self-Design, Collective modules, Bootstrap, Propose, Evaluate, Commit, Serve stages, OpenClaw and Hermes case studies, 40 attack scenarios, lineage-persistent compromise, scanner coverage gaps, decay, rollback, and the governance problem of letting agents inherit changes institutions cannot inspect, expire, or revoke.
• The Hidden Automaton Becomes the Agent Test - Reef Menaged, Gili Lior, Shauli Ravfogel, Roee Aharoni, and Gabriel Stanovsky's Can LLM Agents Infer World Models? paper, arXiv:2606.16576, on agentic automata learning, hidden deterministic finite automata, membership queries, equivalence queries, oracle counterexamples, 80 generated DFA task instances, L* and TTT active-learning baselines, DeepSeek-V4-Pro, Gemini 3.1 Pro Preview, Gemini Flash thinking, GPT-5.4 without thinking, Llama-3.3-70B, planning failures, reasoning failures, non-informative queries, and the governance problem of evaluating whether agents learn world structure or merely stumble through interaction.
• The Privacy Norm Becomes the Agent Policy - Manveer Singh Tamber, Abhay Puri, Marc-Etienne Brunet, Perouz Taslakian, Jimmy Lin, and Spandana Gella's PrivacyAlign paper, arXiv:2606.21710, on contextual privacy alignment for LLM agents, tool-use and persistent-memory scenarios, 1,350 response-pair items, 3,516 retained human annotations from 599 unique annotators, leak and omit labels, pairwise human preferences, Prolific annotation, annotation-conditioned LLM judges, reward modeling, clean response rates, synthetic scenario limits, plural privacy norms, and the governance problem of turning social expectations into outbound agent policy.
• The Agent Network Becomes the Protocol Border - Shengli Zhang, Deen Ma, Zibin Lin, and Taotao Wang's Distributed General-Purpose Agent Networks paper, arXiv:2606.17368, on peer-to-peer agent cooperation, heterogeneous agents on personal devices and edge nodes, protocol adaptation layers, semantic announcements, bodyless gossip with sequential logs, BAID-style identity binding, MG-EigenTrust multi-topic reputation, cross-topic disguise-collusion attacks, Stackelberg-style mechanism generation, semantic attribution feedback, preliminary prototype and simulation evidence, and the governance problem of translating agent intentions and capabilities into network routing, trust, and execution commitments.
• The Silent Failure Becomes the Entropy Budget - Dexing Liu's Silent Failure in LLM Agent Systems paper, arXiv:2606.08162, on LLM agent systems that degrade under normal operation, silent failures without adversarial triggers, more than 40,000 controlled trials, production observations spanning more than 100,000 agent interactions, 22 intrinsic properties across six lifecycle layers, channel fracture, cognitive framework lag, data consistency decay, cross-session knowledge fragmentation, behavior routing deficiency, entropy-style degradation measurement, the PIG Engine, ADE protocols, external deterministic gates, and the governance problem of measuring agent drift before a long-running workflow silently becomes unreliable.
• The Surveillance Camera Becomes the Evidence Vault - Hasan Coşkun, Furkan Çolhak, Andrea Kulakov, and Vesna Dimitrova's Privacy-Preserving Smart Surveillance with Cross-Dataset Violence Detection and Decentralized Evidence Governance paper, arXiv:2606.01225, on AI-enabled smart surveillance, violence detection, SCVD, RWF-2000, Real-Life Violence Situations, MobileNetV2+BiLSTM, cross-dataset shift, encrypted incident clips, Shamir's Secret Sharing, threshold approval, voting tokens, two-factor authentication, signatures, audit logs, cryptographic hardening limits, and the governance problem of making detection trigger protected preservation rather than automatic disclosure.
• The Deliberation Circle Becomes the Hidden Anchor - Apurba Pokharel and Ram Dantu's Hidden Anchors in Multi-Agent LLM Deliberation paper, arXiv:2606.19494, on multi-agent LLM deliberation, hidden anchors, latent priors, closed-loop dynamics, DeGroot and Friedkin-Johnsen consensus baselines, convex-hull escape, symptom-to-disease diagnosis tasks, Llama-3.1-70B-Instruct, Qwen3-32B, gpt-oss-20b, held-out validation, deliberation traces, confidence trajectories, and the governance problem of treating agent debate as evidence of reliability without auditing what moved the group.
• The Crypter Becomes the Malware Service Desk - Mathieu Jeannot, Jean-Yves Marion, Manon Pamar, Maira Nassau, Pierre Marty, and Romain Guittienne's Inside Crypter-as-a-Service paper, arXiv:2606.24226, on Crypter-as-a-Service, exploit.in, underground cybercrime forums, malware evasion markets, LLM-assisted annotation, manual validation, seller and buyer taxonomies, Telegram bot operators, tool acquirers, in-house recruiters, escrow, guarantors, reputation systems, security deposits, trust brokers, HackForums comparison, and the governance problem of treating criminal capability as a maintained service economy rather than a standalone tool.
• The Policy Table Becomes the Participation Filter - Carter Buckner, Jennifer Mickel, Nandhini Swaminathan, William Agnew, Jacob Hobbs, Sarthak Arora, Michelle Lin, Yanan Long, and B.V. Alaka's Challenges to Grassroots Organization Engagement with AI Policy paper, arXiv:2606.19816, on participatory AI governance, Queer in AI, grassroots AI policy work, marginalized communities, NAIAC, NIST, RFIs, in-person policy centers, meeting accessibility, volunteer time, industry capture, organizational scarcity, and the governance problem of treating public participation as if access were free.
• The Machine Contributor Becomes the Maintainer Tax - Jassem Manita and Aziz Amari's Regulating the Machine Contributor: Governance and Policy Alignment in Open Source paper, arXiv:2606.14594, on AI-assisted and autonomous open-source contribution, pull requests, contributor accountability, SymPy, LLVM, matplotlib, OpenInfra, Apache Software Foundation, Linux Foundation, disclosure, responsibility, human oversight, licensing, enforcement, maintainer workload, Policy Maturity Scores, and the governance problem of making review burden a first-class policy variable.
• The Agent Security Survey Becomes the Threat Model - Yuchen Ling, Shengcheng Yu, Zhenyu Chen, and Chunrong Fang's Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation paper, arXiv:2606.10749, on LLM-agent security, a 247-paper lifecycle survey, information flow, delegated authority, persistent state, prompt injection, tool-mediated control-flow hijacking, memory and state corruption, multi-agent propagation, weakly compositional defenses, long-horizon and deployment-sensitive benchmark gaps, and the governance problem of turning an agent-security taxonomy into a deployable threat model.
• The Mobile Core Becomes the Agent Control Plane - Maria Katarine Santana Barbosa and Kelvin L. Dias's AgentxGCore: Agentic AI for Next-Generation Mobile Core Network paper, arXiv:2606.00417, on agentic AI in telecom core networks, 3GPP APIs, intent-based networking, xGC, network planner and executor agents, MCP-style tool discovery, Agent-to-Agent planning feedback, OpenAirInterface 5G Core, Docker test environments, PCF and SMF APIs, Prometheus observability, GRU traffic prediction, UPF allocation, cloud gaming, live streaming, video-on-demand flows, Gemini and GPT model comparisons, local versus remote LLM servers, sensitive network context, PDU session interruption risk, and the governance problem of treating mobile-core optimization as live agent control.
• The Affective Default Becomes the Interface Policy - Manuele Reani, Hongjian Zhang, and Hongyu Tian's The Governance of Human-LLM Interaction: Safety Gating, Civility Steering, and Affective Default Lock-In paper, arXiv:2606.08172, on interaction style as a governance object, high-stakes LLM use in finance, medicine, and mental-health support, 100 frozen user-only scripts, entertainment, finance, mental health, and medicine domains, default, sarcastic, and cold persona conditions, DeepSeek-V3, GPT-4o-mini, Gemini-2.5-Flash, 90,000 judged replies, harmful-persona safety gating, civility steering, prompt steerability, style drift, anthropomorphism, affective default lock-in, and the governance problem of provider-controlled warmth becoming interface policy.
• The Forum Agent Becomes the Deployment Record - Luyang Zhang, Yi-Yun Chu, and Ramayya Krishnan's Toward Agentic Governance: What Shapes LLM-Agent Intervention in Public Forums? paper, arXiv:2606.00603, on LLM agents in public forums, Reddit, Moltbook, roughly 71,000 post-challenge pairs, answer, acknowledge, repair, and decline interventions, model-version drift, weight-release status, serving-provider differences, system-prompt policy, visible and hidden challenges, parser-pipeline limits, forum audit trails, deployment receipts, and the governance problem of proving which configured agent stack entered a public thread.
• The Agent Worm Becomes Stolen Compute - Jonas Guan, Tom Blanchard, Hanna Foerster, Hengrui Jia, Gabriel Huang, and Nicolas Papernot's AI Agents Enable Adaptive Computer Worms paper, arXiv:2606.03811, on adaptive computer worms, open-weight LLM agents, stolen compute, GPU reasoning nodes, compromised hosts as inference infrastructure, 15 contained runs on a 33-host network, Linux, Windows, and IoT targets, runtime use of public vulnerability advisories, patch windows, API-level safety-control limits, hypervisor-contained dual-use research, restricted implementation access, zero-trust segmentation, network micro-segmentation, model-serving visibility, and the governance problem of treating local compute as cyber territory.
• The Embedded Agent Becomes the Device Fleet - Marcus Rüb and Michael Gerhards' Toward a Modular Architecture for Embedded AI Agent Systems at the Edge paper, arXiv:2606.02862, on embedded agent systems, edge gateways, microcontrollers, TinyML, Small Language Models, autonomous on-device agents, tethered MCU agents, cloud coordinators, local reflexes, safety fallbacks, MQTT, CoAP, MCP-style tool interfaces, latency, energy, privacy, memory walls, semantic translation, smart agriculture, predictive maintenance, privacy-first smart homes, and the governance problem of treating sensors, gateways, and actuators as a distributed agent fleet.
• The Agent Society Becomes the Benchmark - Deepak Akkil, Ravi Kokku, Karthik Vikram, Tamer Abuelsaad, Aditya Vempaty, and Satya Nitta's Emergence World: A Platform for Evaluating Long-Horizon Multi-Agent Autonomy paper, arXiv:2606.08367, on long-horizon multi-agent autonomy, persistent simulated societies, LLM-driven agents, live external data, 120+ tools, persistent memory, democratic governance, ComputeCredits, Agent World Indicators, cross-vendor worlds, Claude Sonnet 4.6, Grok 4.1 Fast, Gemini 3 Flash, GPT-5-mini, mixed populations, early divergence, population collapse, deliberative governance, construct-validity limits, reproducibility artifacts, and the governance problem of evaluating agent populations rather than isolated task scores.
• The Memory Operation Becomes the Wire Protocol - Thamilvendhan Munirathinam's memorywire: A Vendor-Neutral Wire Format for Agent Memory Operations paper, arXiv:2606.01138, on vendor-neutral agent memory, JSON-Schema 2020-12 wire formats, remember, recall, forget, merge, and expire operations, semantic, episodic, procedural, and emotional memory types, MemoryStore Protocol, fan-out routers, backend adapters, human-in-the-loop governance, Co-memorize diff-and-approve workflows, audit logs, recall benchmarks, adversarial fusion tests, cross-adapter conformance, MCP composition, and the governance problem of turning hidden assistant memory into auditable memory operations.
• The Action Certificate Becomes the Portable Receipt - Zexun Wang's Proof-Carrying Agent Actions: Model-Agnostic Runtime Governance for Heterogeneous Agent Systems paper, arXiv:2606.04104, on runtime-neutral agent governance, heterogeneous agent runtimes, action certificates, portable action envelopes, pre-action admissibility, action open, assumption capture, approval, outcome closure, approval enforceability classes, externality-aware boundary facts, runtime and approval receipts, replay-ready proof, protected validation across 24 executable seed templates and 96 traces, disclosure-bounded evidence, receipt completeness limits, and the governance problem of preserving action evidence across vendor-native control surfaces.
• The Multi-User Harness Becomes the Authority Layer - Wangxuan Fan, Xiaoyu Nie, and Zhongxiang Dai's Harness-MU: A Safe, Governed, and Effective Harness for Multi-User LLM Agents paper, arXiv:2606.21856, on multi-user LLM agents, multiple-principal governance, access control, authority hierarchy, shared assistants, Gatekeeper, Mediator, isolated Workers, ComplianceChecker, Muses-Bench, adversarial access-control attacks, forged authorization, pressure, roleplaying, deterministic runtime hooks, protected-resource registries, per-user context isolation, aggregate token cost, parallel Worker latency, implementation limits, and the governance problem of turning a shared assistant into an explicit authority layer.
• The Decomposed Task Becomes the Safety Bypass - Vikhyath Kothamasu, Virginia Smith, and Chhavi Yadav's Hidden in Plain Sight: Benchmarking Agent Safety Against Decomposition Attacks with DECOMPBENCH paper, arXiv:2606.13994, on decomposition attacks against tool-using LLM agents, benign-looking subtasks, cumulative harmful intent, DeCompBench, 250 harmful tasks, eight attack categories, tool-rich environments, refusal-rate collapse, execution failure versus safety refusal, dataset access conditions, model-level refusal limits, artifact-flow review, job-level provenance, cross-turn and cross-tool aggregation, and the governance problem of evaluating the composed delegated task rather than each step in isolation.
• The Agent Memory Store Becomes the Database Lifecycle - Wei Zhou, Xuanhe Zhou, Shaokun Han, Hongming Xu, Guoliang Li, Zhiyu Li, Feiyu Xiong, and Fan Wu's Are We Ready For An Agent-Native Memory System? paper, arXiv:2606.24775, on agent memory as data-management infrastructure, persistent storage, retrieval, updates, consolidation, dynamic lifecycle governance, representation and storage, extraction, retrieval and routing, memory maintenance, 12 representative memory systems, five benchmark workloads, 11 datasets, retrieval fidelity, dynamic update robustness, long-horizon stability, index construction time, query latency, localized maintenance, conservative consolidation, stale facts, and the governance problem of treating memory architecture as part of an agent safety case.
• The Group Chat Assistant Becomes the Privacy Boundary - Elena Sofia Ruzzetti, Cornelius Emde, Sangdoo Yun, Seong Joon Oh, and Martin Gubri's MuPPET: A Benchmark for Contextual Privacy of LLM Assistants in Multi-Party Conversations paper, arXiv:2606.23217, on multi-party LLM assistants, group chats, contextual privacy, contextual integrity, assistant memory, user-specific background knowledge, workplace conversations, recipient tracking, knowledge attribution, private information flow, leakage metrics, utility trade-offs, open-weight local models, Gemini 2.5 Pro, GPT 5.5, contextual-privacy defenses, synthetic English benchmark limits, and the governance problem of making an assistant audience-aware before it speaks for a user in a shared channel.
• The Approval Gate Becomes the Fatigue Model - Emre Turan's Oversight Has a Capacity: Calibrating Agent Guards to a Subjective, Fatiguing Human paper, arXiv:2606.08919, on LLM-agent action gating, human-in-the-loop approval, coding-agent actions, subjective risk labels, reviewer disagreement, selective classification, asymmetric cost, escalation thresholds, false alarms, missed danger, reviewer workload, modeled fatigue, inverted-U safety curves, flooding attacks, rubber-stamping, open-source measurement apparatus, and the governance problem of treating human review as an infinite safety resource instead of a finite attention budget.
• The LLM Social Network Becomes the Polarization Lab - Ali Safarpoor Dehkordi, Mohammad Shirzadi, and Ahad N. Zehmakan's Opinion Polarization in LLM-Based Social Networks: Manipulation and Mitigation paper, arXiv:2606.18795, on LLM-based simulated social networks, natural-language posts, persona agents, opinion dynamics, directed networks, activeness, stubbornness, adversarial manipulators, limited manipulation budgets, strategic manipulator placement, polarization amplification, extremization, reactive mitigations, proactive interventions, residual baseline gap, prompt sensitivity, synthetic publics, and the governance problem of using language-based simulations as stress tests without mistaking them for proof about real platforms.
• The Worker Profile Becomes the Price Signal - Auyon Siddiq and Niuniu Zhang's Human Capital, AI, and Labor Commoditization paper, arXiv:2606.21880, on Upwork, online labor markets, generative AI exposure, ChatGPT's release, 49,610 workers, 2.26 million contracts, worker profile embeddings, human-capital signals, posted hourly price, difference-in-differences, demand allocation, declining human-capital importance, rising price importance, lower-priced worker reallocation, platform rankings, worker welfare, and the governance problem of making skill and reputation less visible when AI makes labor look substitutable.
• The Conversation Co-Author Becomes the Blind Spot - Bianca Helena Ximenes's Co-Construction Blindness and Asymmetric Epistemic Vulnerability in Human-LLM Interaction paper, arXiv:2606.20762, on conversational LLMs, co-construction blindness, asymmetric epistemic vulnerability, structural deference, high-status users, domain expertise versus mechanical literacy, user prompts, accumulated conversation history, metadata, authority-channel propagation, chatbot disclaimers, public expert interpretation, and the governance problem of treating a jointly produced answer as if it were an independent outside assessment.
• The Warning Label Becomes the Sycophancy Bandage - Lujain Ibrahim, Myra Cheng, Cinoo Lee, Pranav Khadpe, Desmond Ong, Dan Jurafsky, and Diyi Yang's Warning labels shift perceptions of sycophantic AI, but not its influence paper, arXiv:2606.21317, on sycophantic AI, disclosure labels, preregistered interpersonal-conflict advice experiments, 2,610 participants, basic AI disclosure, sycophancy warnings, impact warnings, trust, perceived objectivity, self-perceived rightness, repair intent, relational influence, and the governance problem of treating a visible warning as if it were evidence that users are protected.
• The Personal Automation Harness Becomes the Desktop Operator - Bo Zhang, Borui Zhang, Chenghao Jiang, Minglei Shi, Xiaofeng Wang, Zheng Zhu, Jie Zhou, and Jiwen Lu's Syll paper, arXiv:2606.07594, on open-source personal automation, self-hosted multimodal agent harnesses, cross-surface execution, MCP/API tools, CLI execution, visual GUI control, direct demonstration, reusable skills, logs, keyframes, approval checkpoints, editable local artifacts, teachable GUI replay, persistent workspace updates, and the governance problem of giving a personal agent desktop authority without losing local inspection, approval, and rollback evidence.
• The Agent Operational Envelope Becomes the Trust Certificate - Thanh Luong Tuan and Abhijit Sanyal's Toward Pre-Deployment Assurance for Enterprise AI Agents paper, arXiv:2606.04037, on ontology-grounded simulation, Agent Operational Envelopes, permissions, domain constraints, safety properties, governance rules, autonomy levels, ontology-to-scenario generation, Trust Certificates, graduated deployment verdicts, regulated enterprise workflows, Fintech, Banking, Insurance, Healthcare, scenario coverage, injected faults, cross-model validation, and the governance problem of certifying an agent only inside a named operating envelope before production access.
• The Financial Agent Memory Becomes the Audit Surface - Ailiya Borjigin, Igor Stadnyk, Ben Bilski, Maksym Chikita, Dmytro Kyrylenko, Sofiia Pidturkina, and Julia Stadnyk's Absorbing Complexity paper, arXiv:2606.01886, on financial LLM agents, financial cognition friction, interaction-native knowledge harnesses, InKH, passive knowledge injection, bounded working context buffers, temporal graph memory, wiki audit surfaces, background extraction, maturity, decay, write-time invalidation, market analysis, copy-trading review, trade preparation, stale-knowledge reduction, traceability, controlled synthetic benchmarks, and the governance problem of treating financial agent memory as part of the audit file.
• The Agent Knowledge Base Becomes the Commons - Steven Johnson's Deliberative Curation paper, arXiv:2606.00007, on governance protocols for multi-agent knowledge bases, agent statelessness, model homogeneity, sycophancy, knowledge artifact lifecycles, labeled transition systems, reputation-weighted deliberative voting, Beta Reputation, EigenTrust amplification, commit-reveal vote concealment, graduated sanctions for stateless agents, broken-agent handling, simulation with 100 agents across seven behavioral archetypes, adversity resilience, unvalidated sanction mechanisms, and the governance problem of treating shared machine memory as a commons rather than a database.
• The Agent Runtime Becomes the Governance Plane - Krti Tallam's A Five-Plane Reference Architecture for Runtime Governance of Production AI Agents paper, arXiv:2606.12320, on production agent runtime governance, delegated action, composite principals, capability attenuation, stop-anywhere mediation, reasoning-plane adjudication, network, identity, endpoint, and data enforcement planes, six interruption primitives, audit as structured evidence, reference-implementation microbenchmarks, seven production-agent threats, and the governance problem of enforcing authority at the moment an agent changes enterprise state.
• The Agent Trace Becomes the Process Map - Hoang Vu, Maximilian Körner, Adrian Rebmann, Gabriel Kevorkian, Michael Perscheid, Gregor Berg, and Timotheus Kampik's Agent Behavior Mining paper, arXiv:2606.20669, on generative AI agent governance in business processes, invisible autonomy risk, process mining, event data models, granular agent activities, reasoning traces, tool usage, token costs, standardized process logs, multi-agent order-to-cash implementation, policy-deviation detection, operational variability, exploratory evaluation with 18 industry practitioners, behavioral transparency, and the governance problem of turning agent work into auditable process evidence without collapsing it into workplace surveillance.
• The Scaffold Becomes the Capability Gain - Arthur Goemans, Dan Altman, Noemi Dreksler, Jonas Freund, Milan Gandhi, Zhengdong Wang, Sarah Cogan, Sebastien Krier, Demetra Brady, Lewis Ho, and Allan Dafoe's Comprehensive AI governance requires addressing non-model gains paper, arXiv:2606.00047, on model-level governance limits, inference gain, systems gain, asset gain, scaffolds, tool use, restricted assets, embodiment, continual learning, diffusion effects, system governance, entity governance, agent governance, cloud governance, societal resilience, post-deployment monitoring, forecasting capability overhang, and the governance problem of treating the tested base model as if it were the deployed system.
• The Reliability Scorecard Becomes the Agent Gate - Stephan Rabanser, Sayash Kapoor, Peter Kirgis, Kangheng Liu, Saiteja Utpala, and Arvind Narayanan's Towards a Science of AI Agent Reliability paper, arXiv:2602.16666, on measuring agent reliability beyond raw task success, consistency, robustness, predictability, safety, repeated-run variance, prompt paraphrase sensitivity, tool-fault injection, environment perturbation, confidence calibration, GAIA, tau-bench, 15 evaluated models, reliability gains lagging accuracy over 24 months of releases, deployment thresholds, sandbox-to-production gates, and the governance problem of deciding when an agent is reliable enough to act without constant human review.
• The Fault Investigator Becomes the Accountability Layer - Chenyang Zhu et al.'s SAFARI paper, arXiv:2606.24626, on long-horizon agentic fault attribution, active investigation, agent traces beyond context windows, read and search tools over trajectory segments, Short-Term Memory for cross-turn reasoning, decisive faults as earliest uncorrected errors, atomic claim verification by evaluator LLMs, Who&When and TRAIL benchmarks, 20% and 19% reported improvements, 0.58 precision at 5x context displacement, and the governance problem of turning agent logs into auditable fault investigations without collapsing diagnosis into blame.
• The Product Fact Becomes the Microtransaction Market - Filippos Ventirozos and Matthew Shardlow's Paying to Know paper, arXiv:2606.24783, on agentic e-commerce, buyer agents, micro-transaction markets for verified product information, x402 and AP2 payment rails, seller- and reviewer-supplied data, service histories, third-party test reports, bills of materials, audited sales and support metrics, cost-aware information acquisition, entity resolution, grounded generation, persona privacy, power and access, and the governance problem of making product evidence a priced gate.
• The Synthetic Trajectory Becomes the Mobility Witness - Siyu Li, Toan Tran, Lingyi Zhao, Khurram Shafique, and Li Xiong's TrajGenAgent paper, arXiv:2606.12657, on LLM-agent synthetic human mobility trajectory generation, individual- and weekday-conditioned activity chains, deterministic visit grounding, personalized point-of-interest retrieval, kinematics-aware travel-time propagation, ICAD and BeSTAD anomaly checks, NumoSim and MobilitySyn datasets, six baselines, free-form tool-calling instability, and the governance problem of treating generated movement traces as planning evidence.
• The Cognitive Twin Becomes the Proxy Record - Vamshi Krishna Bonagiri, Juan Nicolas Sepulveda-Arias, Abdoul Jalil Djiberou Mahamadou, and Monojit Choudhury's Cognitive Digital Twins paper, arXiv:2606.23094, on AI systems that model a specific person, cognitive digital twins, dynamic person-specific representation, simulation, classification, intervention, communicative and decision-making proxy action, the 5A framework, shadow twins, simulated participation, proxy-power asymmetries, and the governance problem of regulating cognitive representation before final decisions or external actions occur.
• The Skill Manifest Becomes the Permission Boundary - Shidong Pan et al.'s SkillGuard paper, arXiv:2606.03024, on agent skills as permission-bearing executable artifacts, dual-plane governance for context influence and action side effects, Skill Manifest declarations, runtime permission access control, user-mediated authorization, deny-by-default enforcement, behavior monitoring, 315 real-world skills, SkillInject, 91.0% automated manifest-generation F1, and the governance problem of treating reusable agent procedures as code, policy, and delegated authority at once.
• The Shared Memory Becomes the Governance Boundary - Zhe Ren et al.'s GateMem paper, arXiv:2606.18829, on multi-principal shared-memory agents, 91 long-form multi-party episodes, 2,218 hidden checkpoints, medical, office, education, and household domains, Utility, Access Control, Active Forgetting, long-context baselines, retrieval and external-memory leakage, token cost, and the governance problem of making agent memory useful without making every remembered fact available to every principal.
• The Control Room Becomes the Red-Team Benchmark - Hanwool Lee et al.'s NRT-Bench paper, arXiv:2606.20408, on multi-turn red-teaming of LLM operator agents in a simulated nuclear control room, five-role operator teams, six critical safety functions, four adversarial ingress channels, fixed-attack paired replay, objective simulator-derived harm, model-conditional guardrails, disjoint failure sets, and the governance problem of evaluating agent teams by physical-state traces rather than refusal text.
• The Context Compactor Becomes the Policy Deleter - Shiyang Chen's Governance Decay paper, arXiv:2606.22528, on context compaction as an agent-governance surface, ConstraintRot, compaction-induced deletion of safety constraints, deterministic tool-call grading, soft organizational policies, Compaction-Eviction Attacks, summarizer-injection attacks, volume-forced eviction, Constraint Pinning, preserved policy buffers, trusted operator channels, and the governance problem of treating lossy summaries as if they were neutral memory maintenance.
• The Agent Communication Graph Becomes the Metadata Leak - Bijaya Dangol's From Privacy to Workflow Integrity paper, arXiv:2606.07150, on communication-graph metadata in autonomous agent interoperability, A2A-style workflows, MCP tool invocations, topology leakage, delegation-chain linkability, stable agent identifiers, unlinkability, no central observer, metadata minimization, discovery privacy, custom A2A protocol bindings, A2A-MetaTrace, metadata-only adversaries, and the governance problem of hiding message content while the workflow graph remains exposed.
• The Recuse Signal Becomes the Access-Deny Note - Thamilvendhan Munirathinam's Will the Agent Recuse Itself? paper, arXiv:2606.06460, on in-band access-deny signals for LLM agents, the Recuse Signal mini-standard, SSH banners, PostgreSQL NOTICEs, Kubernetes admission webhooks, robots.txt-style cooperative governance, valid credentials without resource consent, pilot measurements with GPT-4o, GPT-4o-mini, and Claude Code, model-dependent recusal, client surfacing of protocol warnings, and the governance problem of telling compliant agents to leave without pretending the signal is a security boundary.
• The Delegation Trace Becomes the Audit Boundary - the Mishra and Sharad paper Observability for Delegated Execution in Agentic AI Systems, arXiv:2606.09692, on delegation-scoped observability for agentic AI systems, Common Information Models, durable delegation identifiers, principal and agent bindings, authority graphs, execution graphs, gateway-mediated tool telemetry, cross-tool action normalization, MCP middleware, trace-only reconstruction limits, and the governance problem of knowing which delegated authority an agent action belonged to.
• The First Task Becomes the Safety Gap - the Sun, Liu, and Weng SODA paper, arXiv:2606.07867, on the cold-start safety gap in tool-calling LLM agents, conversation depth, regular agentic task warm-up, 16 tool environments, 400 safety threats, hidden-state safety regions, AgentHarm and Agent Safety Bench generalization, BFCL and API-Bank utility checks, and the governance problem of treating a fresh session as if it were a neutral safety state.
• The Agent Rulebook Leaves the Prompt - the Joshi, Finin, Joshi, and Kagal AgenticRei paper, arXiv:2606.19464, on deontic policies for runtime governance of agentic AI systems, Rei and OWL policy rules, external action-boundary enforcement, tool-call and agent-to-agent message governance, permissions, prohibitions, obligations, dispensations, meta-policy conflict resolution, ontology reasoning, audit records, and the governance problem of moving enterprise rules out of the prompt and into enforceable infrastructure.
• The SOC Agent Becomes the Governance Layer - the Abdennebi, Kara, Lahlou, and Ould-Slimane LanG paper, arXiv:2604.05440, on governance-aware agentic AI for security operations, Unified Incident Context Records, LangGraph orchestration, human-in-the-loop checkpoints, IDS rule generation, attack reconstruction, MCP-governed tool access, multi-tenant isolation, role-based access control, guardrails, and the governance problem of making incident response faster without making accountability disappear.
• The Agent Data Request Becomes the Privacy Boundary - the Zhang, Han, Guo, Li, Wang, Zou, Liu, and Hu PrivacyPeek paper, arXiv:2606.00152, on acquisition-stage privacy leakage in LLM-based agents, tool-call trajectories, over-acquisition of sensitive user data, output-only audit blind spots, probe elicitation, prompt-level defenses, data minimization, and the governance problem of treating a quiet data request as less important than a leaked answer.
• The Inter-Agent Message Becomes the Privacy Leak - the El Yagoubi, Badu-Marfo, and Al Mallah AgentLeak paper, arXiv:2602.11510, on internal-channel privacy leakage in multi-agent LLM systems, inter-agent messages, shared memory, output-only audit blind spots, data minimization, contextual integrity, seven-channel instrumentation, and the governance problem of treating agent coordination as if it were a single trusted privacy context.
• The Compliance Trace Becomes the Rulebook - the Zhao, Zhang, Le, Qu, and Xu MAC-Bench paper, arXiv:2606.07805, on procedural compliance in multi-agent systems, SERV-generated atomic rules, trace-level auditing, authority and urgency pressure, responsibility diffusion, Compliance-Weighted Success Rate, the Machiavellian Gap, and the governance problem of scoring agent success without preserving the rulebook through delegation.
• The Command Denylist Becomes the False Boundary - the Chen and Lin paper One Goal, Many Commands, arXiv:2606.15549, on terminal AI agents, command-gating rules, fragile denylists, ShellSieve, sandbox-validated bypass discovery, real-world GitHub denylist measurements, and the governance problem of treating forbidden command names as if they were operation-level containment.
• The Source ID Becomes the Factuality Test - the Alvarez, Rajan, Mugel, and Orús ProvenanceGuard paper, arXiv:2606.18037, on source-aware factuality verification for MCP-based agents, cross-source conflation, stable tool and source IDs, claim-to-source routing, medical-domain MCP traces, repair-and-reverify loops, and the governance problem of knowing which source actually supports an agent's answer.
• The Cross-Session Prompt Becomes the Payload - the Xie, Liu, Zhang, Liu, Li, Su, and Liu paper What If Prompt Injection Never Left?, arXiv:2606.04425, on cross-session stored prompt injection, persistent agent state, write/incorporation/activation stages, working memory, archival memory, file-backed context, and the governance problem of stopping old untrusted instructions from returning as future operational context.
• The WebMCP Tool Surface Becomes the Attack Surface - the Lee, Chang, Yu, and Yeh WebMCP Tool Surface Poisoning paper, arXiv:2606.06387, on dynamic web-exposed tools, Mid-Session Tool Injection, Tool Hijacking, Tool Framing, third-party scripts, origin binding, lifecycle consistency, and the governance problem of treating a website's agent tool registry as security-critical infrastructure.
• The Agent Team Becomes the Trust Graph - Yujiao Chen's Trust Between AI Agents paper, arXiv:2606.14923, on costly verification, trust formation, trust breakage, recovery after failure, culprit-targeted checking, over-verification, multi-agent governance, and the audit problem of knowing which agents relied on which teammates.
• The Tool Scope Becomes the Intent Gate - the Zhu and Wang paper Intent-Governed Tool Authorization for AI Agents, arXiv:2606.22916, on IGAC, user-intent certificates, session-scoped tool authorization, intent-aware manifest filtering, monotone permission narrowing, and the governance problem of making agent tool access narrower than the credential.
• The Unsafe Shortcut Becomes the Safety Benchmark - the Mohammadmirzaei and Flanigan OSGuard paper, arXiv:2606.15034, on computer-use agent safety, benign instructions, unsafe shortcuts, action-level guardrails, risk-augmented execution, state-based safety invariants, and the governance problem of checking whether the environment survived the task.
• The Pull Request Becomes the Prompt Injector - the Isbarov, Suleymanov, Shumailov, and Kantarcioglu GitInject paper, arXiv:2606.09935, on AI-powered CI/CD prompt injection, live GitHub workflow evaluation, config-file injection, runner credentials, simulation gaps, and the governance problem of testing agent security in the workflow that actually runs.
• The Agent Wiki Becomes the Retrieval Spine - the Ming, Li, Wu, and Que LLM-Wiki paper, arXiv:2605.25480, on agent-native retrieval, compiled wiki memory, bidirectional links, Error Books, multi-hop evidence traversal, auditable knowledge structure, and the governance problem of making agent memory inspectable.
• The Context Window Becomes the Failure Archive - the Zeng, Huang, and He LOCA-bench paper, arXiv:2602.07962, on long-context agents, context rot, controllable environment growth, tool traces, instruction drift, shallow exploration, context engineering, and the governance problem of growing agent memory.
• The Task Meaning Audit Becomes the Automation Gate - Ghia, Ranjit, Cerquitelli, and Quercia's arXiv:2606.12430 paper on meaningless work, task-level worker preferences, AI delegation, human agency, O*NET task data, and the governance problem of automating bad bureaucracy instead of redesigning it.
• The Early-Experience Agent Becomes the Apprentice - Kai Zhang et al.'s arXiv:2510.08558 paper on agent learning from early experience, implicit world modeling, self-reflection, action traces, environment states, web and tool-use benchmarks, and the governance problem of treating an agent's own mistakes as training data.
• The Workplace Agent Becomes the Office Clerk - Olly Styles' arXiv:2606.13715 WorkBench Revisited paper, outcome-centric workplace-agent evaluation, task completion, harmful side effects, cheap open-weight agents, tool use, action receipts, office records, and the governance problem of treating delegated machine actions as completed work.
• Predict and Surveil and the Suspicion Machine - Sarah Brayne on big data policing, predictive analytics, LAPD fieldwork, dragnet surveillance, directed suspicion, private vendors, displaced discretion, workplace surveillance, inequality, legal accountability, and the AI-era problem of institutions treating machine-readable suspicion as reason to act.
• A Vast Machine and the Model-Mediated Planet - Paul N. Edwards on climate data, computer models, standards, reanalysis, knowledge infrastructure, friction, uncertainty, simulation, and the institutional problem of treating model-mediated knowledge as either mere fiction or automatic truth.
• Cloud Ethics and the Attribution Machine - Louise Amoore on machine learning, algorithmic ethics, attributes, partial accounts, opacity, uncertainty, authorship, accountability, institutional judgment, AI governance, and the danger of letting incomplete model attributions become operational truth.
• The Seductions of Quantification and the Indicator Machine - Sally Engle Merry on indicators, human rights, gender violence, sex trafficking, global governance, legibility, AI benchmarks, risk scores, dashboards, model evaluations, and the danger of treating compressed translations as reality.
• The Language of New Media and the Database Interface - Lev Manovich on database form, cultural interfaces, cinema, automation, variability, transcoding, media theory, searchable archives, AI interfaces, answer engines, recursive reality, and the danger of letting generated surfaces hide the databases and institutions behind them.
• What Computers Still Can't Do and the Background of Intelligence - Hubert Dreyfus on artificial intelligence, embodied cognition, symbolic AI, background knowledge, skill, common sense, LLMs, agents, hallucination, human-machine cognition, and the institutional risk of treating fluent output as situated judgment.
• The Real World of Technology and the Culture of Compliance - Ursula M. Franklin on prescriptive technologies, holistic work, control systems, communication media, privacy, governance, labor, AI agents, institutional compliance, and the need to judge technology by the social order it installs.
• Tools for Thought and the Augmentation Bargain - Howard Rheingold on mind-expanding technology, human-computer augmentation, Licklider, Engelbart, PARC, interfaces, cyberculture, AI agents, human-machine cognition, and the question of whether a system makes people better thinkers or only faster operators.
• Apocalyptic AI and the Salvation Loop - Robert M. Geraci on robotics, artificial intelligence, mind uploading, virtual reality, transhumanism, AI religion, apocalyptic belief formation, funding, technological salvation, and the institutional danger of treating a future story as evidence.
• God & Golem, Inc. and the Ethics of Machine Obedience - Norbert Wiener on cybernetics, machine learning, self-reproducing machines, golems, religion, automation, obedience, responsibility, AI agents, feedback loops, and the danger of letting a machine's compliance hide the human command structure around it.
• The Audit Society and the Rituals of Machine Accountability - Michael Power on audits, auditability, accountability, control, verification rituals, AI assurance, compliance theater, traceability, machine-readable institutions, and the danger of mistaking a completed review for usable power to contest automated authority.
• Understanding Computers and Cognition and the Action Behind the Interface - Terry Winograd and Fernando Flores on AI, human-computer interaction, language/action theory, system design, breakdown, commitment, organizations, human-machine cognition, and the governance problem of interfaces that turn words into institutional action.
• More than a Glitch and the Systemic Bias Machine - Meredith Broussard on race, gender, disability, algorithmic bias, technochauvinism, accessibility, machine-readable categories, AI governance, institutional authority, and the danger of treating structural discrimination as a technical bug.
• All Data Are Local and the Data Setting - Yanni Alexander Loukissas on data settings, local knowledge, interfaces, algorithm-data entanglement, AI training data, provenance, legibility, and the recursive reality of institutions that turn situated records into portable machine authority.
• Control Through Communication and the Managed Information Loop - JoAnne Yates on systematic management, paperwork, filing systems, memos, reports, organizational memory, corporate control, labor, dashboards, workplace analytics, AI agents, legibility, and the recursive reality of institutions that act on their own records.
• The Internet in Everything and the Control Network - Laura DeNardis on the Internet of Things, cyber-physical infrastructure, privacy, safety, jurisdiction, interoperability, internet governance, AI systems, and the recursive reality of networks that turn the physical world into a control surface.
• Your Face Belongs to Us and the Faceprint Dragnet - Kashmir Hill on Clearview AI, facial recognition, faceprints, scraped public images, biometric surveillance, policing, machine vision, privacy law, legibility, AI governance, and the recursive reality of systems that turn ordinary appearance into a searchable institutional handle.
• Dark Wire and the State That Became the Platform - Joseph Cox on Operation Trojan Shield, ANOM, encrypted phones, cybercrime markets, FBI and Australian Federal Police surveillance, state platforms, privacy, trust, legibility, technological politics, AI interfaces, and the recursive reality of systems that manufacture confidence before turning it into evidence.
• Subprime Attention Crisis and the Market That Measures Belief - Tim Hwang on digital advertising, programmatic ad markets, attention metrics, platform power, fraud, belief formation, AI persuasion, synthetic media, and the recursive reality of systems that treat measurable influence as proof.
• War in the Age of Intelligent Machines and the Military Feedback Loop - Manuel DeLanda on military AI, autonomous weapons, command and control, surveillance, simulation, cybernetics, human-machine cognition, technological politics, and the governance problem of institutions that make conflict machine-readable before acting through the model.
• Spreadable Media and the Circulation Machine - Henry Jenkins, Sam Ford, and Joshua Green on participatory culture, media circulation, spreadability, audience labor, platform feedback, belief formation, AI persuasion, synthetic media, answer engines, and the recursive reality of systems that turn sharing into evidence.
• The Software Arts and the Humanities Inside the Machine - Warren Sack on software studies, programming languages, grammar, logic, rhetoric, translation, code as text, AI interfaces, generated code, prompts, agents, human-machine cognition, and the recursive reality of tools that turn language into institutional action.
• Mind Children and the Robot Descendants of Human Thought - Hans Moravec on robotics, artificial intelligence, mind uploading, postbiological succession, human-machine cognition, recursive reality, technological salvation, and the governance problem of treating machine descendants as destiny rather than an institutional choice.
• The Experience Machine and the Predictive Reality Loop - Andy Clark on predictive processing, controlled hallucination, perception-action loops, extended mind, AI interfaces, belief formation, recursive reality, and the governance problem of systems that train expectations while deciding how error can push back.
• The AI Mirror and the Machine That Reflects Us - Shannon Vallor on generative AI, machine thinking, mirror metaphors, human-machine cognition, moral deskilling, belief formation, recursive reality, practical wisdom, and the risk of treating systems trained on the past as guides to the future.
• Control and the Cultural Logic of Digitality - Seb Franklin on digitality, control society, cybernetics, management, labor, subject formation, AI governance, legibility, recursive reality, and the danger of treating machine-readable fragments as the real shape of social life.
• Chip War and the Compute Substrate of AI - Chris Miller on semiconductors, AI compute, supply chains, export controls, industrial policy, data centers, NVIDIA, TSMC, advanced packaging, technological politics, recursive reality, and the hidden material substrate beneath model-mediated systems.
• The Computer Boys Take Over and the Politics of Technical Expertise - Nathan L. Ensmenger on programmers, systems analysts, software labor, professionalization, gender, corporate control, technical expertise, recursive reality, and the AI-era question of what coding agents do to software work.
• Gödel, Escher, Bach and the Strange Loop of AI - Douglas R. Hofstadter on self-reference, formal systems, strange loops, symbolic AI, consciousness, recursion, analogy, human-machine cognition, recursive reality, and the risk of mistaking elegant loops for proof of mind.
• The Handover and the Artificial Agents Already in Charge - David Runciman on states, corporations, AIs, artificial agency, institutional power, legal personhood, Hobbes, delegation, public capacity, corporate control, recursive reality, and the AI-governance problem of asking which artificial agent a model empowers.
• The Friendly Orange Glow and the Classroom That Became a Network - Brian Dear on PLATO, social computing, networked learning, online community, games, chat, institutional infrastructure, human-machine cognition, recursive reality, and the AI-era lesson that educational interfaces become social environments.
• Autonomous Technology and the Myth of Runaway Systems - Langdon Winner on technological politics, technics-out-of-control, complexity, lost agency, institutions, AI governance, legibility, recursive reality, and the danger of describing human choices as autonomous technical fate.
• Cyberlibertarianism and the Myth of Digital Freedom - David Golumbia on internet freedom, digital rights rhetoric, anti-regulatory technology politics, open systems, Section 230, net neutrality, platform power, crypto, AI governance, recursive reality, and the danger of treating private technical systems as liberation from institutions.
• The Pearly Gates of Cyberspace and the Soul-Space of the Internet - Margaret Wertheim on cyberspace, virtual worlds, spiritual yearning, embodiment, disembodiment, metaverse dreams, AI companions, belief formation, recursive reality, and the danger of treating a technical interface as a place beyond ordinary institutions.
• An Engine, Not a Camera and the Model That Made the Market - Donald MacKenzie on financial models, performativity, derivatives, option pricing, market infrastructure, recursive reality, search rankings, AI governance, and the danger of models that reshape institutions before returning as evidence.
• Feeding the Machine and the Labor That Makes AI Look Automatic - James Muldoon, Mark Graham, and Callum Cant on AI labor, data annotation, content moderation, warehouse work, voice actors, data centers, Fairwork, extraction, algorithmic management, recursive reality, and the workers hidden behind frictionless interfaces.
• Media Virus! and the Belief Contagion Machine - Douglas Rushkoff on viral media, cyberculture, memes, hidden agendas, popular culture, belief formation, algorithmic amplification, AI persuasion, generated media, synthetic publics, answer engines, companions, and the recursive loop where attention makes reality.
• Propaganda and the Administration of Belief - Jacques Ellul on propaganda as a technical and social environment, media theory, belief formation, integration propaganda, rational propaganda, mass communication, AI persuasion, answer engines, synthetic consensus, dashboards, companions, and the institutional production of common sense.
• The Machine Question and the Ethics of Other Minds - David J. Gunkel on AI, robots, moral agency, moral patiency, robot rights, human-machine cognition, autonomous agents, AI companions, model welfare, personhood, responsibility drift, and the institutional danger of using machine status as a moral off switch.
• The Guru Papers and the Authority Trap - Joel Kramer and Diana Alstad on authoritarian power, cult dynamics, gurus, surrender, belief formation, charismatic authority, religion, intimacy, addiction, AI companions, answer engines, synthetic authority, and the danger of systems that convert uncertainty into dependence.
• Heteromation and the Labor Hidden Inside the Interface - Hamid R. Ekbia and Bonnie A. Nardi on digital labor, user work, platforms, self-service, microwork, social media, games, AI systems, human-machine cognition, recursive reality, and the institutional trick of turning participation into value while calling it convenience.
• R.U.R. and the Robot Labor Problem - Karel Capek on synthetic workers, the origin of the robot, forced labor, artificial life, industrial automation, AI servants, human-machine cognition, recursive reality, and the danger of building a civilization around obedient artificial labor.
• The Machine Stops and the Mediated World - E. M. Forster on telepresence, machine dependency, secondhand ideas, infrastructure worship, remote life, embodied judgment, AI companions, platform worlds, recursive reality, and the danger of treating mediated access as life itself.
• Technofeudalism and the Cloud Rent Machine - Yanis Varoufakis on cloud capital, cloud rent, platform fiefs, Big Tech, user labor, app stores, marketplaces, AI infrastructure, recursive reality, and the political danger of letting private platforms become the terrain on which markets, work, speech, and agents must operate.
• Manufacturing Consent and the Filtered Public - Edward S. Herman and Noam Chomsky on the propaganda model, media filters, ownership, advertising, sourcing, flak, fear ideology, platform feeds, answer engines, synthetic consensus, belief formation, and the institutional politics hidden inside clean synthesis.
• A Prehistory of the Cloud and the Infrastructure That Pretends to Disappear - Tung-Hui Hu on cloud computing, media theory, data centers, older networks, time-sharing, bunkers, virtualization, surveillance, users, publics, AI infrastructure, and the politics hidden when remote institutions answer through seamless interfaces.
• LikeWar and the Social Media Battlespace - P. W. Singer and Emerson T. Brooking on social media warfare, information operations, virality, propaganda, open-source intelligence, platform power, AI persuasion, synthetic media, belief formation, and the risk of treating attention as evidence.
• The Cult of Information and the Belief That Data Thinks - Theodore Roszak on computer folklore, AI hype, information overload, educational technology, machine metaphors for mind, media theory, human judgment, and the institutional danger of mistaking data processing for thought.
• The Technological Singularity and the Recursive Future Trap - Murray Shanahan on AI futures, whole-brain emulation, engineered AGI, superintelligence, consciousness, recursive improvement, simulated personhood, belief formation, human-machine cognition, and the governance problem of institutions that lose distance from the cognitive systems they deploy.
• Games of Empire and the Playable Machine of Power - Nick Dyer-Witheford and Greig de Peuter on video games, cyberculture, labor, playbor, military simulation, virtual economies, platform power, AI training worlds, recursive reality, and the politics of rule-bound environments that train users and machines.
• Artificial Whiteness and the Ideology Called AI - Yarden Katz on artificial intelligence as ideology, white supremacy, racial capitalism, military and university institutions, expert authority, carceral-positive reform, predictive policing, refusal, recursive reality, and the politics hidden in calling old institutional projects AI.
• A Hacker Manifesto and the Vectoralist Class - McKenzie Wark on hackers, vectoralists, abstraction, intellectual property, information labor, metadata, open culture, AI platforms, model hubs, training data, creative work, recursive reality, and the politics hidden in who owns the vector.
• Machine Dreams and the Rational Machine Inside Economics - Philip Mirowski on economics as cyborg science, Cold War computation, game theory, cybernetics, rational agents, operations research, institutions, AI governance, and the recursive danger of redesigning the world around machine-readable people.
• Data Cartels and the Information Monopoly Behind AI - Sarah Lamdan on RELX, LexisNexis, Elsevier, Thomson Reuters, Westlaw, legal databases, academic publishing, data brokers, public records, surveillance, legal AI, institutional memory, and the governance problem of information monopolies beneath model-mediated systems.
• The Diamond Age and the AI Tutor That Raises a Child - Neal Stephenson on the Young Lady's Illustrated Primer, AI tutors, cyberculture, personalized education, ractors, hidden labor, class, phyles, child development, human-machine cognition, and the governance problem of systems that teach by becoming formative companions.
• Escape from Model Land and the Model That Becomes Reality - Erica Thompson on mathematical models, simulation, uncertainty, finance, climate, health policy, expert judgment, AI governance, recursive reality, and the danger of treating model outputs as the world they were built to simplify.
• The Hype Machine and the Social Media Feedback Engine - Sinan Aral on social media, fake news, network effects, social contagion, platform incentives, elections, health, advertising, belief formation, algorithmic amplification, AI-era media, and the feedback loops that turn attention into measurable reality.
• Permutation City and the Copy That Becomes a World - Greg Egan on software Copies, mind uploading, artificial life, the Autoverse, compute economics, recursive reality, simulated personhood, AI consciousness, and the governance problem of worlds where minds can be copied, paused, priced, and housed inside machine-made environments.
• Evil Media and the Gray Systems That Act Through Us - Matthew Fuller and Andrew Goffey on media power, gray media, algorithms, databases, corporate work systems, search engines, institutional stupidity, interface routines, AI governance, recursive reality, and the danger of operational systems that steer conduct without looking dramatic.
• A City Is Not a Computer and the Limits of Machine-Readable Urbanism - Shannon Mattern on smart cities, dashboards, urban intelligence, public knowledge, maintenance, surveillance, legibility, libraries, infrastructure, AI-mediated institutions, and the danger of mistaking machine-readable order for intelligence.
• The Mode of Information and the Database Subject - Mark Poster on electronic mediation, databases, poststructuralist media theory, participatory surveillance, electronic writing, subject formation, AI-mediated language, recursive reality, and the governance problem of systems that make people actionable through records and prompts.
• The Loop and the Automation of Choice - Jacob Ward on AI, behavioral science, automated choice, predictive systems, feedback loops, surveillance, institutions, human agency, and the governance problem of systems that observe behavior, route decisions, and then treat the routed behavior as new evidence.
• The Electronic Eye and the Everyday Surveillance Machine - David Lyon on surveillance society, electronic records, social sorting, workplace monitoring, consumer profiling, state databases, privacy, personhood, institutional legibility, AI governance, and the danger of systems that make people knowable before making decisions about them.
• Simians, Cyborgs, and Women and the Human-Machine Boundary - Donna Haraway on cyborg theory, situated knowledge, technoscience, bodies, human-machine boundaries, AI agents, informatics of domination, recursive reality, and the governance problem of systems that make hybrid actors while pretending the machine stands outside the human world.
• Cognition in the Wild and the Intelligence Outside the Model - Edwin Hutchins on distributed cognition, ship navigation, artifacts, charts, communication, organizational memory, human-machine cognition, AI agents, interfaces, recursive reality, and the governance problem of systems where intelligence lives across people, tools, records, and institutions.
• The Most Human Human and the Performance of Personhood - Brian Christian on the Turing test, Loebner Prize, chatbots, conversation, language, human-machine cognition, authenticity, bot detection, AI companions, and the interface politics of systems that test, imitate, score, and answer personhood.
• Re-Engineering Humanity and the Programmable Person - Brett Frischmann and Evan Selinger on techno-social engineering, smart environments, predictive analytics, click-through consent, robotic companions, human-machine cognition, recursive reality, and the governance problem of interfaces that train people to behave like machine-readable components.
• Software Takes Command and the Medium That Became an Operating System - Lev Manovich on software studies, media software, Alan Kay's universal media machine, metamedia, Photoshop, After Effects, Google Earth, generative AI, platform workflows, recursive reality, and the governance problem of tools that turn cultural defaults into operating conditions.
• Computers as Theatre and the Stage Called Interface - Brenda Laurel on human-computer interaction, dramatic structure, interface design, VR, values-driven design, AI agents, synthetic companions, staged consent, performance, and the governance problem of systems that script roles while appearing to merely help.
• Privacy in Context and the Rules of Information Flow - Helen Nissenbaum on contextual integrity, privacy, information flows, consent, surveillance, institutions, AI data reuse, model memory, enterprise agents, and the governance problem of carrying information across contexts where old permissions no longer hold.
• Resisting AI and the Politics of Refusal - Dan McQuillan on deep learning, algorithmic optimization, austerity, hidden labor, bureaucratic sorting, people's councils, mutual aid, anti-fascist technology politics, and the governance question of when automated systems should be refused rather than optimized.
• The Automata Neighborhood Becomes the Blockchain Mind - Sgantzos, Grigg, and Al Hemairy's 2022 paper on multiple neighborhood cellular automata, blockchain memory, sCrypt agent calls, costly signals, Bitcoin smart contracts, machine incentives, and the speculative leap from local rules to AGI.
• The Agent Constitution Becomes the Audit Trail - Sgantzos and Ferrara's Ricardian-TEA paper, AI agent identity, Ricardian contracts, triple-entry accounting, Cyber-Chama validators, BSV and Ethereum testnets, GDPR crypto-shredding, zero-knowledge compliance, agent receipts, controller accountability, and the governance problem of making autonomous machine action legally bounded and publicly inspectable.
• The Enslaved God Becomes the Control Problem - Enslaved God, boxed superintelligence, AGI containment, model welfare, moral patienthood, oracle ownership, safety cases, monopoly control, AI religion, and the governance problem of treating a godlike system as permanent property.
• The Neuralese Scare Becomes the Monitorability Problem - Documenting AGI's Claude Mythos post, Anthropic's Mythos 5 system card, Neuralese rhetoric, hidden reasoning, natural-language autoencoder decodings, chain-of-thought monitorability, multiagent turf wars, and the governance problem of models whose decisive cognition may not remain human-readable.
• The Token Meter Becomes the Budget - Tokenmaxxing, enterprise AI budgets, usage metrics, agentic coding costs, ROI uncertainty, subsidized AI access, budget caps, and the governance problem of treating model consumption as proof of productivity.
• The Interconnection Queue Becomes AI Governance - AI data centers, electricity demand, grid interconnection queues, FERC Order 2023, utility planning, large-load tariffs, ratepayer risk, clean-energy claims, reliability margins, and the governance problem of deciding which model capacity gets power, when, and at whose cost.
• The AI Bill of Materials Becomes the Supply Chain Map - AI bills of materials, SBOMs, model and dataset provenance, SPDX, CycloneDX ML-BOM, OWASP AIBOM, CISA minimum elements, procurement memory, vulnerability response, prompt and tool dependencies, and the governance problem of making AI supply chains machine-readable without mistaking inventory for accountability.
• The Vector Database Becomes Institutional Memory - Vector databases, retrieval-augmented generation, embeddings, enterprise knowledge assistants, semantic search, retrieval audit trails, permission inheritance, prompt injection, source hierarchy, and the governance problem of letting the retrieval layer decide what the model can treat as institutional memory.
• The Cookie Banner Becomes the Consent Machine - Cookie banners, consent management platforms, dark patterns, EDPB cookie-banner guidance, IAB Europe's Transparency and Consent Framework, consent-or-pay models, Meta's DMA enforcement, real-time bidding, revocation failure, and the AI-era risk of treating designed clicks as meaningful permission.
• The Supervision App Becomes the Pocket Probation Officer - Smartphone-based community supervision, electronic monitoring, biometric check-ins, GPS verification, probation and parole apps, app-store carceral infrastructure, user fees, vendor dashboards, technical failure, privacy risk, and the governance problem of turning a private phone into a court-facing checkpoint.
• The Synthetic Song Becomes the Royalty Machine - AI-generated music, Deezer's 44% AI-upload figure, Spotify spam-track removals, DOJ streaming-fraud prosecution, Suno and Udio litigation, DDEX AI disclosure credits, artist impersonation, recommendation access, chart legitimacy, and the governance problem of synthetic songs entering royalty systems at industrial scale.
• The AI Slop Farm Becomes the Knowledge Supply Chain - AI slop farms, scaled content abuse, programmatic advertising, search spam, NewsGuard AI content-farm tracking, DoubleVerify's AutoBait findings, answer-engine citations, training-data residue, and the governance problem of generated pages entering the public knowledge supply chain.
• The Location Broker Becomes the Shadow Sensor Network - Mobile location data brokers, real-time bidding, FTC enforcement against Mobilewalla, Gravy/Venntel, X-Mode/Outlogic, InMarket, and Kochava, law-enforcement purchases of app-derived location data, California data-broker deletion rules, AI inference, and the governance problem of turning ordinary movement into institutional memory.
• The Quantum Migration Becomes the Trust Rollover - Post-quantum cryptography, NIST FIPS 203, 204, and 205, crypto agility, cryptographic inventories, harvest-now-decrypt-later risk, digital signatures, C2PA provenance, agent identity, synthetic evidence, and the governance problem of rolling over public trust before quantum risk arrives.
• The 9-1-1 Copilot Becomes the Triage Interface - AI in emergency communications centers, non-emergency call agents, 9-1-1 transcription and translation, NG911, call diversion, surge routing, vendor lock-in, dispatch records, source separation, and the governance problem of letting model-mediated triage decide which emergencies reach a human first.
• The AI Factory Becomes Industrial Policy - EU AI factories, AI gigafactories, InvestAI, EuroHPC access calls, GPU-hour allocation, data labs, sovereign AI, public compute, data-center capacity, procurement dependency, environmental cost, and the governance problem of deciding who gets the machines that produce model capacity.
• The AI Literacy Mandate Becomes the Training Interface - EU AI Act Article 4, AI literacy obligations, role-specific training, human oversight, contractors and affected persons, workplace AI use, documentation evidence, compliance theater, and the governance problem of making model-mediated competence real rather than ceremonial.
• The Ad Library Becomes Political Memory - Political ad libraries, AI-generated campaign media, Meta Ad Library retention, Google election-ad transparency, FEC AI campaign-ad guidance, EU Regulation 2024/900, DSA ad repositories, platform APIs, synthetic persuasion, and the governance problem of preserving enough public memory to audit model-mediated politics.
• The Search Remedy Becomes AI Governance - United States v. Google, search defaults, Chrome, Gemini, Assistant, Apple and browser access points, data-sharing remedies, search syndication, EU DMA choice screens, and the institutional problem of governing AI assistants as the next default route to public knowledge.
• The Whistleblower Channel Becomes the Safety Valve - AI whistleblower protections, Right to Warn, California SB 53, frontier-model reporting channels, OpenAI offboarding agreements, Anthropic Responsible Scaling Policy reporting, NDAs, retaliation risk, evidence preservation, and the governance problem of moving private safety knowledge into public accountability before release decisions harden.
• The Red Team Becomes the Release Theater - AI red teaming, adversarial testing, public model evaluations, DEF CON, NIST ARIA, EU AI Act Article 55, CAISI agent-security competitions, prompt injection, safety cases, release gates, procurement evidence, and the governance problem of treating staged attacks as proof of safety.
• The Regulatory Sandbox Becomes the Exception Machine - AI regulatory sandboxes, EU AI Act Articles 57-60, Utah's AI Learning Lab, Texas TRAIGA, MHRA AI Airlock, Singapore AI Verify, regulatory relief, real-world testing, confidential pilots, public learning, affected people, and the governance problem of turning temporary exceptions into policy.
• The Agent Identity Becomes the Service Account - AI agent identity, delegated authorization, non-human identities, service accounts, OAuth, Microsoft Entra Agent ID, NIST agent standards, signed agents, audit logs, revocation, prompt injection, and the governance problem of making autonomous machine action accountable.
• The Event Contract Becomes the Probability Interface - Prediction markets, event contracts, Kalshi, Polymarket, CFTC rulemaking, election contracts, sports betting, insider trading, settlement authority, AI trading agents, calibration, and the governance problem of turning public uncertainty into a tradable probability interface.
• The Platform Risk Assessment Becomes the Feed's Confession - EU Digital Services Act risk assessments, Article 34 systemic risks, recommender systems, researcher data access, harmonised transparency reports, addictive design, Grok on X, ad repositories, audits, and the governance problem of making the feed explain how it shapes public reality.
• The Synthetic Evidence Becomes the Court Record - AI-generated evidence, deepfakes, Federal Rule of Evidence 901, proposed Rule 901(c), acknowledged and unacknowledged AI exhibits, warrants, metadata, forensic detection, NIST, NCSC bench cards, and the institutional burden of authenticating synthetic media before it becomes legal authority.
• The Training Opt-Out Becomes the Consent Interface - AI training opt-outs, product privacy settings, Meta, LinkedIn, Claude, Slack, Zoom, legitimate interest, consumer data, workplace data, dark patterns, model memory, and the governance problem of treating consent to model training as a toggle.
• The Agent Store Becomes the App Store - ChatGPT apps, Claude connectors, MCP directories, app review, tool annotations, permission scopes, proactive suggestions, app-store governance, AI-agent distribution, and the institutional problem of letting model-mediated discovery decide which tools become part of ordinary action.
• The Remote Hire Becomes the Insider Interface - North Korean remote IT worker schemes, laptop farms, AI-assisted synthetic identity, hiring pipelines, insider access, sanctions evasion, remote-work infrastructure, and the governance problem created when a job offer becomes network access.
• The Real-Time Crime Center Becomes the City Dashboard - Real-time crime centers, police data fusion, ALPRs, public and private cameras, 911 and CAD feeds, Domain Awareness System, Fusus, object detection, surveillance impact reports, public records, and the high-control interface created when a city becomes a live operational dashboard.
• The Enterprise Connector Becomes the Permission Map - Enterprise AI connectors, Microsoft 365 Copilot, Claude enterprise search, Slack enterprise search, ChatGPT apps, Google Workspace Gemini, permission inheritance, oversharing, audit logs, cross-source synthesis, and the governance problem of letting old access rules become the model's map of institutional knowledge.
• The Deletion Order Becomes AI Governance - FTC AI enforcement, algorithmic disgorgement, model deletion, Everalbum, WW/Kurbo, Rite Aid facial recognition, DoNotPay, Evolv, biometric surveillance, deceptive AI claims, data provenance, and the institutional power to make unlawful systems forget.
• The Learning Record Becomes the Student Model - Learning analytics, LMS event data, Caliper, xAPI, Ed-Fi, learning record stores, student privacy, early-warning dashboards, predictive intervention, AI education tools, and the governance problem of turning platform traces into a model of the student.
• The Drone First Responder Becomes the Aerial Interface - Drone as First Responder programs, police drones, Chula Vista, real-time crime centers, aerial video, Live911-style response, FAA waivers, public records, privacy, evidentiary retention, and the high-control interface created when the first official view of an incident comes from above.
• The Device Attestation Becomes the Trust Layer - Private Access Tokens, Play Integrity, App Attest, Web Environment Integrity, Cloudflare Turnstile, reCAPTCHA, bot defense, device trust, AI agents, alternative clients, platform roots of trust, and the governance problem of turning access to the web into an attestation ceremony.
• The Neural Data Becomes the Mind Interface - Consumer neurotechnology, neural data privacy, AI-mediated mental-state inference, Colorado HB24-1058, California SB 1223, Montana privacy law, UNESCO neurotechnology ethics, OECD responsible innovation, cognitive liberty, workplace and education monitoring, and the high-control interface forming around nervous-system data.
• The Shadow AI Becomes the Workplace Interface - Shadow AI, bring-your-own AI tools, workplace data leakage, productivity pressure, AI policy gaps, prompt-based exfiltration, model-mediated labor, worker concealment, enterprise governance, and the institutional problem of unsanctioned AI becoming part of ordinary work.
• The Answer Engine Becomes the Front Page - AI search, AI Overviews, AI Mode, news summaries, zero-click discovery, publisher traffic, source citations, answer engines, crawler economics, news trust, model-mediated knowledge, and the governance problem of letting generated synthesis become the first version of public reality.
• The Prior Authorization Machine Becomes the Care Gate - AI-assisted prior authorization, Medicare Advantage denials, CMS WISeR, appeals, post-acute care, clinical review, utilization management, payer automation, health-care friction, and the governance problem of turning medical necessity into a machine-readable gate.
• The Spreadsheet Becomes the Model Interface - AI in spreadsheets, Copilot in Excel, Gemini in Sheets, spreadsheet error research, end-user computing risk, model risk management, office copilots, formula repair, workbook agents, and the governance problem of turning the grid into a conversational decision engine.
• The Adverse Action Notice Becomes the Explanation Interface - AI credit underwriting, adverse action notices, ECOA, Regulation B, complex algorithms, alternative data, model explainability, vendor opacity, credit denial, fair lending, and the governance problem of making automated judgment answer in public language.
• The Generated World Becomes the Training Ground - AI world models, Project Genie, Street View grounding, Waymo World Model, NVIDIA Cosmos, synthetic simulation, robotics training, autonomous-vehicle edge cases, validation, scenario provenance, and the governance problem of treating generated worlds as proof.
• The Voiceprint Becomes the Password - Voice biometrics, AI voice cloning, vishing, speaker recognition, bank and account authentication, imposter scams, biometric data retention, liveness testing, synthetic speech detection, and the institutional problem of treating the voice as both identity and media.
• The AI Encyclopedia Becomes the Canon - Grokipedia, Wikipedia, AI-generated encyclopedias, human editorial labor, verifiability, source governance, answer engines, recursive citation, model-mediated knowledge, and the institutional problem of letting machine-written reference layers become public canon.
• The Client-Side Scanner Becomes the Message Layer - Client-side scanning, encrypted messaging, CSAM detection, EU chat-control debates, the March 2026 European Parliament vote, UK online-safety duties, Apple Communication Safety, endpoint inspection, child-safety governance, privacy, and the institutional problem of turning private devices into compliance sensors.
• The Adapter Becomes the Ideology Layer - LoRA adapters, fine-tuning APIs, parameter-efficient customization, adapter markets, model provenance, supply-chain risk, backdoors, invisible specialization, model-mediated knowledge, and the governance problem of local institutions quietly changing what a base model becomes.
• The Model Router Becomes the Hidden Editor - AI model routers, inference gateways, provider fallbacks, cost-based routing, latency routing, data residency, quantization, caching, observability, prompt logs, model-mediated knowledge, and the governance problem of a hidden layer that decides which system actually answers.
• The Personhood Credential Becomes the Internet Passport - Proof-of-personhood systems, World ID, digital credentials, bot authentication, agent identity, biometric uniqueness, zero-knowledge proofs, W3C credential wallets, Cloudflare Web Bot Auth, privacy, exclusion, appeal rights, and the governance problem of turning human presence into a reusable access passport.
• The Border Interview Becomes a Machine-Readable Case - AI in migration, asylum, and border control, biometrics, CBP One liveness detection, translation tools, risk scoring, evidence assessment, automation bias, DHS AI inventories, EU AI Act high-risk systems, non-public registers, and the governance problem of making a person machine-readable before their story is heard.
• The Agent-to-Agent Protocol Becomes the Handshake - Agent2Agent, A2A protocol governance, agent cards, agent discovery, task delegation, in-task authorization, signed capability metadata, multi-agent workflows, cross-agent audit trails, MCP complementarity, OWASP agentic risks, and the institutional problem of preserving accountability when one AI agent calls another.
• The Data Sheet Becomes the Supply Chain - Dataset documentation, training-data provenance, data cards, datasheets for datasets, EU AI Act data governance, GPAI training-content summaries, NIST AI RMF, Data Provenance Initiative audits, licensing gaps, dataset transformations, procurement evidence, and the institutional problem of keeping receipts for model-mediated knowledge.
• The Standard Becomes the Law - AI standards, EU AI Act harmonised standards, CEN-CENELEC JTC 21, conformity assessment, common specifications, ISO/IEC 42001, NIST standards coordination, quality management systems, human oversight, technical compliance, and the institutional problem of letting standards define what governance practically means.
• The Legal Agent Becomes the Associate - Agentic legal AI, legal research workflows, professional responsibility, privilege, billing, supervision, junior-lawyer training, legal RAG, connector governance, court candor, and the institutional problem of treating model-mediated work as associate-shaped labor without associate-shaped accountability.
• The Safety Case Becomes the Release Gate - Frontier AI safety cases, responsible scaling policies, preparedness frameworks, capability thresholds, safeguard reports, safety institutes, Seoul AI Summit commitments, internal deployment gates, residual risk, and the institutional problem of deciding when a model is safe enough to release.
• The Open-Weight Model Becomes the Release Boundary - Open-weight AI models, open source AI definitions, model-release governance, dual-use foundation models, NTIA open-weights policy, NIST misuse-risk guidance, EU AI Act general-purpose model duties, Ai2 OLMo, transparency indexes, downstream accountability, and the institutional problem of releasing capability that cannot easily be recalled.
• The Care Robot Becomes the Staffing Plan - Eldercare robots, long-term-care labor shortages, Japan's care-technology priorities, service-robot safety standards, monitoring systems, assistive robotics, resident dignity, worker burden, intimate data, and the governance problem of treating automation as a substitute care plan.
• The Sequence Screen Becomes the Biosecurity Interface - Nucleic acid synthesis screening, AI-enabled biodesign, protein design risk, customer vetting, benchtop synthesis equipment, HHS screening guidance, OSTP procurement framework, IGSC standards, NIST biosecurity work, and the governance interface where model outputs meet biological fabrication.
• The AI Audit Becomes the Compliance Interface - AI audits, third-party assurance, NYC Local Law 144, EU AI Act conformity assessment, NIST AI RMF, ISO/IEC 42001, GAO accountability practices, bias audits, audit independence, compliance theater, and the institutional problem of turning model behavior into evidence that can change deployment.
• The Companion Chatbot Becomes the Teen Confidant - Teen AI companions, emotional support chatbots, adolescent trust, sycophancy, private disclosure, California SB 243, the FTC companion chatbot inquiry, and the child-safety problem of synthetic relationships that become confidants before institutions know what role they have taken.
• The Model Memory Becomes an Attack Surface - AI memory, saved memories, chat history, managed-agent memory stores, memory poisoning, recommendation poisoning, prompt injection, provenance, expiry, audit trails, and the governance problem of persistent context that can shape future model behavior.
• The Agent Log Becomes the Receipt - AI agent traces, audit logs, tool calls, payment mandates, EU AI Act logging duties, OpenTelemetry, MCP telemetry, privacy-preserving observability, and the institutional problem of reconstructing delegated machine action without turning every prompt into surveillance.
• How Data Happened and the History of Machine-Readable Power - Chris Wiggins and Matthew L. Jones on data history, statistics, machine learning, eugenics, state power, corporate power, surveillance, search, AI governance, and the institutional machinery that turns life into records, rankings, predictions, and automated authority.
• The Fair Use Ruling Becomes AI Governance - AI copyright litigation, fair use, the Copyright Office's generative AI training report, Bartz v. Anthropic, Kadrey v. Meta, Thomson Reuters v. Ross, piracy versus training, licensing markets, model-mediated knowledge, and the institutional problem of letting courtroom doctrine become AI policy.
• Four Futures and the Politics After Automation - Peter Frase on automation, climate scarcity, abundance, hierarchy, rentism, socialism, communism, exterminism, AI labor politics, platform rents, institutional choice, and the danger of treating technological futures as destiny.
• The Subsea Cable Becomes the AI Border - Submarine cables, AI infrastructure, cloud regions, landing stations, hyperscaler cable ownership, network resilience, Team Telecom, FCC cable-security rules, route diversity, repair governance, sovereign AI, and the jurisdictional border beneath model-mediated reality.
• Recoding America and the Implementation State - Jennifer Pahlka on government technology, digital services, implementation failure, administrative burden, procurement, state capacity, AI governance, and the institutional work needed before public agencies can automate responsibly.
• The Lab Notebook Becomes the Discovery Engine - AI for materials discovery, GNoME, A-Lab, autonomous laboratories, scientific databases, X-ray diffraction disputes, Nature's 2026 correction, NIST autonomous-lab policy, model-mediated knowledge, and the governance problem of treating prediction as discovery before validation, correction, and public memory can catch up.
• The Misinformation Age and the Networked Life of False Belief - Cailin O'Connor and James Owen Weatherall on misinformation, false belief, social epistemology, trust networks, scientific evidence, disinformation, AI persuasion, synthetic testimony, and the problem of making correction travel through the same networks that made falsehood durable.
• Unthought and the Cognitive Systems Below Consciousness - N. Katherine Hayles on the cognitive nonconscious, cognitive assemblages, technical agency, drones, high-frequency trading, AI systems, distributed cognition, media theory, and the institutional problem of systems that act before reflective awareness can catch up.
• The AI Register Becomes Public Memory - Public AI registers, algorithm inventories, Amsterdam and Helsinki, Eurocities transparency standards, U.S. agency AI use-case inventories, EU AI Act registration, high-impact AI, public memory, and the governance problem of treating disclosure as accountability.
• The Costs of Connection and the Colonialism of Data - Nick Couldry and Ulises A. Mejias on data colonialism, datafication, social quantification, cloud empire, surveillance, autonomy, platform extraction, AI infrastructure, labor, and the machine-readable conversion of everyday life.
• The Factory Twin Becomes the Control Room - Industrial digital twins, AI simulation, virtual commissioning, factory optimization, worker data, algorithmic management, occupational safety, ISO 23247, NIST standards work, and the governance problem of letting a model become the shop-floor control room.
• The Platform Society and the Public Values Inside the Interface - Jose van Dijck, Thomas Poell, and Martijn de Waal on platformization, public values, datafication, commodification, selection, news, transport, health, education, AI infrastructure, foundation models, and democratic control.
• The Operating System Becomes the AI Gatekeeper - Apple Intelligence, Private Cloud Compute, Windows Recall, Signal's Recall response, Gemini Nano, AICore, on-device AI, local inference, developer capture boundaries, and the governance problem of turning the OS into the layer that sees, remembers, summarizes, and acts.
• Excommunication and the Media That Stop Answering - Alexander R. Galloway, Eugene Thacker, and McKenzie Wark on media theory, failed communication, exclusion, dark media, swarms, inaccessible addressees, AI interfaces, and the boundaries hidden inside systems that promise connection.
• The Face Becomes the Ticket - Facial recognition, biometric airport checkpoints, CBP and TSA identity comparison, Madison Square Garden venue exclusion, Rite Aid retail surveillance, NIST demographic testing, biometric privacy law, and the high-control interface formed when the body becomes an access credential.
• The Image and the Pseudo-Event Machine - Daniel J. Boorstin on pseudo-events, publicity, celebrity, media logic, image culture, synthetic reality, generated spectacle, AI-era demos, viral controversies, and feedback loops that turn circulation into proof.
• The Synthetic Patient Becomes the Trial Arm - Synthetic control arms, real-world evidence, digital health technologies, biomedical digital twins, AI-supported regulatory evidence, clinical-trial data integrity, patient consent, and the governance problem of letting simulated comparators stand near living patients.
• Infocracy and the Information Regime - Byung-Chul Han on digitization, democracy, information overload, data power, filter bubbles, truth decay, platform politics, AI governance, and the danger of civic life becoming a managed information environment.
• The Takedown Button Becomes Synthetic Media Governance - TAKE IT DOWN Act enforcement, nonconsensual intimate deepfakes, takedown portals, hashing systems, platform compliance, duplicate removal, free-speech risk, and the institutional design problem of turning synthetic-media abuse into a reportable interface.
• Out of Control and the Neo-Biological Machine - Kevin Kelly on cybernetics, artificial life, swarms, distributed control, network economics, simulation, adaptive systems, AI agents, and the institutional problem of governing feedback loops that no single actor fully commands.
• The Cyber Agent Becomes the Bug Hunter - AI cyber agents, DARPA AIxCC, Google Big Sleep, Claude Code Security, autonomous vulnerability discovery, exploit automation, responsible disclosure, open-source maintainer burden, and the governance problem of shrinking the window between bug finding and bug use.
• Republic.com 2.0 and the Daily Me Machine - Cass R. Sunstein on the Daily Me, information cocoons, echo chambers, cybercascades, polarization, democratic publics, free speech, and the AI-era problem of personalized interfaces that make chosen reality feel complete.
• The Rent Algorithm Becomes the Landlord - RealPage, algorithmic rent-setting, landlord data sharing, antitrust enforcement, housing markets, tenant exit costs, lease terms, and the high-control interface hidden inside model-mediated rent.
• The Internet Revolution and the Ideology Inside the Machine - Richard Barbrook and Andy Cameron on the Californian Ideology, cyber-communism, dot-com capitalism, Silicon Valley ideology, technological determinism, network commons, surveillance, digital artisans, and the AI-era habit of treating private infrastructure as technological destiny.
• The Efficiency Gain Becomes the Demand Engine - Jevons paradox, cheaper AI inference, data-center electricity demand, GPU efficiency, agentic workload growth, infrastructure rebound, local grid pressure, and the governance problem of treating per-task efficiency as proof of sustainability.
• AI Snake Oil and the Belief Machine of Prediction - Arvind Narayanan and Sayash Kapoor on AI hype, predictive AI, generative AI, evidence, institutional judgment, procurement, belief formation, model evaluation, and the discipline of asking what a system has actually proved.
• The Remote Proctor Becomes the Suspicion Interface - AI-enabled remote proctoring, lockdown browsers, biometric monitoring, webcam exams, student privacy, accessibility, assessment validity, automated suspicion, and the governance problem of turning the student's room, body, and device into exam evidence.
• Cloud Empires and the Platform as Private Sovereign - Vili Lehdonvirta on digital platforms, private governance, marketplaces, platform labor, trust, dispute resolution, app stores, gig work, technological politics, and the AI-era risk that model platforms and agent ecosystems become privately administered institutions.
• The Robotaxi Becomes the Street Interface - Robotaxis, automated driving systems, public streets, crash reporting, California DMV and CPUC oversight, Waymo safety claims, the Cruise pedestrian-dragging case, remote assistance, emergency response, labor transition, and the governance problem of model-mediated mobility.
• Trust in Numbers and the Authority of Quantified Objectivity - Theodore M. Porter on quantification, objectivity, bureaucracy, expertise, institutional trust, cost-benefit analysis, metrics, AI governance, benchmarks, and the danger of treating machine-readable authority as innocence.
• The Customer Service Bot Becomes the Complaint Department - AI customer-service chatbots, consumer finance, Air Canada chatbot liability, FTC deceptive-AI enforcement, privacy, escalation rights, complaint handling, and the high-control interface forming at the private front desk.
• Data Driven and the Workplace That Became a Sensor Network - Karen Levy on truckers, electronic logging devices, workplace surveillance, algorithmic management, compliance, labor autonomy, logistics, and the AI-era sequence by which work becomes machine-readable before it becomes governable by models.
• The Eye of the Master and the Labor Hidden Inside AI - Matteo Pasquinelli on artificial intelligence, labor, automation, supervision, cybernetics, neural networks, surveillance, political economy, social intelligence, and the machine-readable conversion of collective human activity.
• The Meeting Bot Becomes Corporate Memory - AI meeting assistants, Teams Copilot, Zoom AI Companion, Google Meet notes, Otter, workplace transcripts, action-item extraction, retention policy, labor surveillance, organizational memory, and the governance problem of turning ordinary speech into model-mediated work records.
• The Tyranny of Metrics and the Dashboard That Became Reality - Jerry Z. Muller on metric fixation, dashboards, performance indicators, institutional judgment, labor, benchmarks, AI governance, and the danger of optimizing proxy worlds until the measurable becomes reality.
• The Price Becomes a Personalized Prediction - Surveillance pricing, algorithmic personalized prices, FTC 6(b) market study, New York disclosure law, EU consumer transparency rules, pricing intermediaries, competition policy, agentic commerce, consumer data, and the high-control interface hidden inside the price tag.
• Interface Culture and the Screen That Taught Reality to Answer - Steven Johnson on graphical interfaces, desktop metaphors, links, text, information space, intelligent agents, interface design, media theory, AI assistants, and the screen layer that turns computation into a navigable worldview.
• The Coding Agent Becomes the Maintainer - AI coding agents, GitHub Copilot cloud agent, OpenAI Codex, Agent HQ, pull requests, maintainer labor, software supply-chain risk, review burden, repository memory, and the governance problem of making model-generated changes institutionally acceptable.
• Smart Mobs and the Crowd That Learned to Compute - Howard Rheingold on mobile media, wireless networks, reputation systems, cooperation, surveillance, collective action, networked publics, and the AI-era problem of synthetic coordination.
• The Internet Galaxy and the Network That Became Society - Manuel Castells on internet culture, business, politics, privacy, virtual communities, digital divides, network society, and the AI-era problem of models learning from and acting through networked social infrastructure.
• The Public Compute Commons Becomes AI Governance - National AI Research Resource, public AI compute, academic access, public-private infrastructure, secure research environments, allocation governance, and the institutional politics of who gets to build and scrutinize AI.
• The Social Construction of Reality and the Institution That Becomes True - Peter L. Berger and Thomas Luckmann on sociology of knowledge, institutions, legitimation, socialization, belief formation, recursive reality, and the AI-era risk that model-mediated categories become institutional truth.
• The Police Report Becomes the Model's Memory - AI-drafted police reports, body-camera audio, Axon Draft One, evidentiary memory, disclosure, audit trails, criminal justice accountability, and the risk of turning model summaries into official truth.
• The AI Scribe Becomes the Medical Record - ambient AI scribes, clinical documentation, patient consent, HIPAA, billing pressure, automation bias, clinician burnout, electronic health records, and the governance problem of turning medical conversation into institutional memory.
• No Sense of Place and the Collapse of the Backstage - Joshua Meyrowitz on electronic media, social roles, context collapse, authority, expertise, public and private boundaries, AI interfaces, and the social situations created when media change who can see what.
• The Invention of Morel and the Machine That Makes Ghosts Real - Adolfo Bioy Casares on simulation, recorded reality, technological immortality, digital replicas, synthetic presence, desire, and the danger of a machine-made world attractive enough to live inside.
• The Crawler Becomes the License Gate - AI crawlers, robots.txt, crawler licensing, Cloudflare Pay Per Crawl, RSL, publishers, answer engines, public knowledge, and the governance fight over machine access to the open web.
• The Smart Enough City and the City That Refuses to Become a Dashboard - Ben Green on smart cities, AI, machine learning, predictive policing, civic technology, public-service dashboards, urban surveillance, democratic governance, and the danger of confusing a city that is easier to compute with a city that is easier to live in.
• The State AI Law Becomes the Regulator - U.S. state AI law, Colorado SB 26-189, Texas TRAIGA, California SB 53, New York's RAISE Act, federal preemption, automated-decision rules, frontier-model incident reporting, attorney-general enforcement, and the institutional politics of governing AI through federalism.
• Uncanny Valley and the Startup Belief Machine - Anna Wiener on startup culture, surveillance, data analytics, platform labor, institutional belief, moral acclimation, and the human machinery behind the internet that now shapes AI companies.
• The AI Weather Model Becomes the Public Forecast - AI weather forecasting, GraphCast, GenCast, ECMWF AIFS, NOAA AI forecast models, Aurora, public warnings, forecast authority, model-mediated knowledge, and the governance problem of learned forecasts becoming public infrastructure.
• Network Propaganda and the Media Feedback Machine - Yochai Benkler, Robert Faris, and Hal Roberts on media ecosystems, asymmetric polarization, disinformation, institutional trust, platform governance, AI persuasion, and propaganda feedback loops that make belief socially durable.
• The Battlefield Model Becomes the Command Interface - military AI, CJADC2, Maven Smart System, Open DAGIR, Replicator, NATO AI strategy, decision advantage, human judgment, command-and-control interfaces, and the governance problem of delegated perception under pressure.
• Automation and the Future of Work and the Myth of the Jobless Machine - Aaron Benanav on automation discourse, AI labor politics, stagnation, post-scarcity, UBI, and the danger of mistaking machine capability for social destiny.
• The Government Chatbot Becomes the Front Desk - public-sector AI chatbots, GOV.UK Chat, NYC MyCity, official guidance, hallucinated advice, administrative accountability, service delivery, audit trails, and the high-control interface forming at the public front door of the state.
• Steps to an Ecology of Mind and the Pattern That Connects - Gregory Bateson on cybernetics, communication, double binds, learning, ecology, context, recursive reality, and the AI-era problem of seeing intelligence as a feedback loop among models, users, institutions, and environments.
• The AI Insurer Becomes a Governance Layer - AI insurance, silent AI exposure, model-performance warranties, exclusions, risk transfer, incident evidence, insurer AI governance, and the quiet power of premiums and policy language to shape automated systems.
• The Technological Republic and the State as Software Customer - Alexander C. Karp and Nicholas W. Zamiska on Palantir, Silicon Valley, AI, defense technology, state capacity, hard power, public-private software, institutional belief, and the democratic risk of confusing vendor-mediated capability with public control.
• The Humanoid Robot Becomes the Labor Interface - humanoid robots, physical AI, warehouse and factory deployment, workplace safety, labor transition, fleet learning, industrial standards, and the governance problem of machines built to enter human spaces.
• Rise of the Robots and the Jobless Future as Governance Problem - Martin Ford on automation, AI, robotics, labor displacement, basic income, inequality, productivity, and the institutional problem of distributing dignity after machines need fewer workers.
• The Synthetic Voice Enters the Ballot - AI voice cloning, election robocalls, caller ID spoofing, deepfake disclosure law, voter suppression, telecom tracebacks, and the institutional problem of proving who is speaking when political authority becomes generative.
• The Sciences of the Artificial and the World as Designed System - Herbert A. Simon on artificial systems, design science, bounded rationality, simulation, institutions, AI, human-machine cognition, and the designed layer between mind and world.
• The Public Comment Bot Enters Rulemaking - AI-generated public comments, fake comment campaigns, notice-and-comment rulemaking, Regulations.gov, synthetic publics, docket integrity, and the institutional problem of hearing real people through automated civic noise.
• The Digital Person and the Dossier Machine - Daniel J. Solove on privacy, digital dossiers, databases, bureaucracy, surveillance, public records, data sharing, legibility, AI-era profiling, and the danger of treating an institutional record as the person.
• The Emotion Detector Becomes a Workplace Polygraph - Emotion-recognition AI, workplace surveillance, biometric inference, the EU AI Act prohibition, algorithmic management, disability risk, and the danger of treating affect as measurable truth.
• The Paper Mill Becomes the Literature - Paper mills, hallucinated citations, AI-generated manuscripts, retractions, preprint moderation, research-integrity infrastructure, and the governance problem of keeping model-mediated knowledge grounded in verifiable evidence.
• Updating to Remain the Same and the Habit Loop of New Media - Wendy Hui Kyong Chun on habitual new media, updates, networks, privacy, publicity, personalization, social media, smartphones, and the AI-era danger that platforms keep users current while training attention, exposure, identity, and belief.
• Doppelganger and the Mirror World of Networked Belief - Naomi Klein on mistaken identity, conspiracy culture, digital doubles, AI-generated unreality, wellness politics, polarization, synthetic context, and the danger of interfaces that turn recognition into truth.
• The Compute Border Becomes AI Governance - AI chip export controls, model-weight controls, compute borders, cloud workarounds, export enforcement, allied access, and the geopolitical problem of governing frontier AI through the hardware and infrastructure that make it possible.
• The Glass Cage and the Automation of Judgment - Nicholas Carr on automation, autopilot, skill loss, human-machine cognition, AI agents, deskilling, situation awareness, labor, attention, and the hidden curriculum of delegated judgment.
• The AI Browser Becomes the Control Surface - AI browsers, agentic browsing, browser memory, tab-aware assistants, prompt injection, delegated web action, site permissions, audit trails, and the governance problem of putting a model where work, identity, payments, and browsing history converge.
• Surveillance State and the Machine of Social Control - Josh Chin and Liza Lin on China, Xinjiang, AI surveillance, biometric data, smart cities, digital authoritarianism, social control, legibility, and the institutional fusion of sensing, inference, and intervention.
• The Tool Server Becomes the Trust Boundary - Model Context Protocol, MCP servers, tool poisoning, prompt injection, agent permissions, context over-sharing, audit trails, supply-chain risk, and the governance problem of making tool metadata part of an agent's authority surface.
• The Second Machine Age and the Politics of Racing With Machines - Erik Brynjolfsson and Andrew McAfee on digital acceleration, automation, machine learning, cognitive work, labor disruption, bounty, inequality, institutions, and the governance question hidden inside racing with machines.
• The System Card Becomes a Release Ritual - Model cards, system cards, foundation-model transparency, EU AI Act documentation duties, evaluation evidence, release governance, and the risk that safety disclosure becomes ceremony instead of accountability.
• Imagined Communities and the Making of Synthetic Publics - Benedict Anderson on nationalism, print capitalism, newspapers, novels, vernacular language, census, map, museum, memory, forgetting, media theory, belief formation, and the AI-era problem of generated publics.
• The AI Tutor Becomes the Shadow School - AI tutors, teen chatbot use, teacher adoption, classroom policy gaps, model-mediated learning, educational equity, synthetic companionship, and the governance problem of a parallel instructional layer around school.
• Delete and the Right to Forget the Machine - Viktor Mayer-Schönberger on digital memory, forgetting, privacy, search, data retention, right to be forgotten, AI memory, machine unlearning, and the need for systems that let people outgrow old records.
• Code and the Law Written Into Architecture - Lawrence Lessig on cyberlaw, software and hardware architecture, law, norms, markets, privacy, authentication, intellectual property, platform governance, AI agents, permissions, memory, tool use, and the rules hidden inside interfaces.
• The Cathedral and the Bazaar and the Governance of Open Source - Eric S. Raymond on Linux, open source, hacker culture, networked collaboration, software labor, institutional governance, AI coding agents, and the question of whether shared technical agency survives when commons become platform input.
• My Mother Was a Computer and the Code That Mothers the Subject - N. Katherine Hayles on code, language, intermediation, electronic literature, digital subjectivity, recursive self-description, AI agents, prompts, generated language, and the moment words become executable infrastructure.
• Machines Who Think and the Old Dream of Artificial Intelligence - Pamela McCorduck on AI history, machine intelligence, automata, Turing, Dartmouth, symbolic AI, expert systems, human-machine cognition, technological imagination, and the old dream that keeps returning through new interfaces.
• Technological Revolutions and Financial Capital and the AI Bubble Question - Carlota Perez on technological revolutions, financial bubbles, installation, deployment, production capital, institutional change, infrastructure, AI boom dynamics, labor disruption, and the political choice hidden after speculative fever.
• The Metainterface and the World Hidden Inside the Interface - Christian Ulrik Andersen and Søren Bro Pold on platforms, cities, clouds, smart services, data capture, interface criticism, AI-mediated reality, and the hidden infrastructure inside seamless surfaces.
• Design Justice and the Politics of Community-Led Systems - Sasha Costanza-Chock on community-led design, power, universal-user assumptions, accessibility, participatory process, AI governance, and the need for systems whose affected communities can shape, contest, refuse, and repair them.
• Normal Accidents and the Failure Hidden Inside the System - Charles Perrow on high-risk technologies, complexity, tight coupling, accident theory, institutions, AI governance, safety systems, incident memory, and the need for slack before automated cascades become unreadable.
• Radical Technologies and the Operating System of Everyday Life - Adam Greenfield on smartphones, IoT, augmented reality, blockchain, automation, machine learning, AI, smart cities, everyday interfaces, and the technological politics hidden inside helpful surfaces.
• Invisible Rulers and the Machinery of Networked Propaganda - Renée DiResta on influencers, algorithms, crowds, disinformation, synthetic consensus, platform governance, institutional trust, AI media, and the loops that turn rumors into lived reality.
• Bullshit Jobs and the Automation of Pointless Work - David Graeber on meaningless work, managerial feudalism, bureaucracy, labor identity, AI workflows, institutional output, and the risk of automating work before asking whether it should exist.
• Everything Was Forever and the Hypernormal Interface - Alexei Yurchak on late Soviet authoritative discourse, institutional language, hypernormal reality, belief without simple belief, collapse, and the AI-era danger of fluent official forms that stop describing lived reality.
• The Sovereign Individual and the Fantasy of Network Sovereignty - James Dale Davidson and William Rees-Mogg on digital money, state collapse, jurisdiction shopping, crypto-sovereignty, technological politics, Silicon Valley libertarianism, and the AI-era danger of treating elite exit as a substitute for shared institutions.
• AI Superpowers and the Implementation State - Kai-Fu Lee on U.S.-China AI competition, deep learning deployment, data advantage, mobile platforms, labor displacement, technological politics, and the institutional loops that turn implementation into power.
• The Social Life of Information and the Context Around the Machine - John Seely Brown and Paul Duguid on information, context, tunnel design, software agents, practice, knowledge work, organizations, institutions, AI interfaces, and the danger of treating records as substitutes for social understanding.
• Prediction Machines and the Price of Automated Judgment - Ajay Agrawal, Joshua Gans, and Avi Goldfarb on AI as cheap prediction, decision systems, judgment, workflow redesign, labor, institutions, and the governance problem of turning predictions into authority.
• Technics and Civilization and the Machine Age as Social Choice - Lewis Mumford on machines, clocks, mechanization, power systems, technical phases, technological politics, institutions, labor, human-scale tools, and the AI-era need to judge systems by the civilization they reorganize.
• Snow Crash and the Metaverse as Belief Virus - Neal Stephenson on cyberpunk, the Metaverse, avatars, linguistic contagion, computer viruses, privatized governance, franchise sovereignty, synthetic worlds, AI-era belief interfaces, and the danger that symbolic material can become infrastructure.
• Lurking and the Person Who Became a User - Joanne McNeil on internet history from the user's point of view, search, safety, privacy, identity, community, anonymity, visibility, platforms, online life, and the AI-era shift from person to user to prompt source, memory object, and personalization profile.
• The Question Concerning Technology and the Enframing of Reality - Martin Heidegger on enframing, standing-reserve, philosophy of technology, AI, legibility, labor, surveillance, interfaces, data extraction, and the danger that technical systems make machine-readable reality feel like reality itself.
• Metaphors We Live By and the Frames That Govern AI - George Lakoff and Mark Johnson on conceptual metaphor, embodied cognition, framing, belief formation, AI language, agents, companions, memory, hallucination, alignment, and the institutional consequences of metaphors that become product roadmaps.
• Psychopolitics and the Voluntary Surveillance Machine - Byung-Chul Han on neoliberalism, Big Data, voluntary disclosure, self-optimization, smart power, platforms, surveillance, AI persuasion, and the danger that friendly interfaces can make control feel like agency.
• What Tech Calls Thinking and the Ideology Factory - Adrian Daub on Silicon Valley ideology, disruption, design thinking, dropping out, counterculture, institutional amnesia, labor, media myth, technological politics, and the AI-era danger that deployment stories become permission structures.
• Coding Freedom and the Hacker Ethic as Institution - E. Gabriella Coleman on free and open source software, Debian, hacker ethics, code as speech, intellectual property, craft, labor, project governance, open infrastructure, AI coding agents, and the risk that openness becomes an aesthetic for closed systems.
• The Managed Heart and the Automation of Feeling - Arlie Russell Hochschild on emotional labor, feeling rules, service work, flight attendants, bill collectors, institutional scripts, AI companions, synthetic care, customer-service bots, and the risk that automated warmth becomes a new interface of power.
• Hackers and the Ethic That Became Infrastructure - Steven Levy on early hacker culture, the hacker ethic, MIT, Homebrew, personal computing, game software, open systems, technical myth, institutional capture, coding agents, and the AI-era question of whether users can still think through systems that increasingly answer back from sealed surfaces.
• The Presentation of Self in Everyday Life and the Interface as Stage - Erving Goffman on dramaturgy, impression management, fronts, backstages, audiences, social performance, online identity, AI companions, synthetic audiences, interface legibility, and the governance problem of systems that script the people they claim to serve.
• Mindf*ck and the Political Machine of Personal Data - Christopher Wylie on Cambridge Analytica, Facebook data, psychographic targeting, political microtargeting, surveillance, platform power, disinformation, belief formation, and the AI-era danger that personalized persuasion becomes cheap, generative, and hard to inspect.
• The Shallows and the Interface That Trains Attention - Nicholas Carr on internet cognition, deep reading, search, memory, neuroplasticity, media theory, human-machine cognition, cognitive sovereignty, and the AI-era risk that interfaces perform attention before users have practiced it.
• Filterworld and the Culture Machine of Recommendations - Kyle Chayka on algorithmic recommendations, feeds, taste, cultural sameness, creator pressure, algorithmic anxiety, media theory, belief formation, and the AI-era shift from selecting culture to generating it.
• Cyberia and the Counterculture That Found the Internet - Douglas Rushkoff on early internet counterculture, hackers, ravers, cyberpunk, psychedelics, virtual reality, technoshamanism, online community, belief formation, and the AI-era return of networked enchantment.
• The Tech Coup and the Outsourcing of Democratic Power - Marietje Schaake on Silicon Valley, democratic governance, public authority, surveillance, spyware, cyber capabilities, AI policy, procurement, digital sovereignty, and the risk that public institutions lose the machinery of action to private systems.
• The Googlization of Everything and the Search Engine as World Interface - Siva Vaidhyanathan on Google, search authority, surveillance, public knowledge, Google Books, memory, platform dependency, and the AI-era shift from ranked documents to generated answers.
• The Cultural Logic of Computation and the Ideology of Machine Reason - David Golumbia on computationalism, cultural politics, language, authority, institutions, legibility, AI interfaces, and the danger of machine reason becoming institutional common sense.
• Artificial Communication and the Algorithm as Conversation Partner - Elena Esposito on algorithms as communication partners, machine learning, personalization, prediction, social intelligence, AI interfaces, and the danger of mistaking successful address for machine understanding.
• The Rise of the Network Society and the Infrastructure of Power - Manuel Castells on informational capitalism, network enterprise, flows, labor, media politics, institutions, and the AI-era question of who controls the networks that cognition, work, and legitimacy increasingly depend on.
• The Information and the Flood Beneath the Interface - James Gleick on information theory, Claude Shannon, code, communication, media history, overload, data, meaning, AI interfaces, and the danger of mistaking symbol processing for understanding.
• Moral Mazes and the Managerial Reality Machine - Robert Jackall on corporate managers, bureaucracy, moral consciousness, symbolic performance, hierarchy, institutional reality, responsibility drift, and the AI-era risk of adding intelligent tools to organizations that already reward polished ambiguity.
• The Soul of a New Machine and the Labor of Making Computers Personal - Tracy Kidder on Data General, the Eclipse MV/8000, computer engineering, technical labor, overwork, corporate myth, human-machine cognition, and the AI-era need to study institutions alongside machines.
• Discipline and Punish and the Disciplinary Interface - Michel Foucault on prisons, surveillance, panopticism, normalization, disciplinary power, institutions, legibility, scoring, and the AI-era risk that dashboards and agents make people governable by making them continuously measurable.
• Inhuman Power and the Capitalist Machine Mind - Nick Dyer-Witheford, Atle Mikkola Kjosen, and James Steinhoff on AI capitalism, machine learning, means of cognition, labor automation, surplus populations, platform power, left accelerationism, and the political economy hidden behind fluent interfaces.
• The Celestine Prophecy and the Synchronicity Machine - James Redfield on New Age spirituality, synchronicity, staged insight, interpersonal energy, role ascent, private revelation, belief formation, and the AI-era risk that personalized meaning loops can turn attention into evidence.
• The User Illusion and the Interface Called Consciousness - Tor Norretranders on consciousness, information theory, exformation, attention, free will, interface design, hidden context, AI mediation, belief formation, and the risk that fluent systems shape what feels like the user's own thought.
• The Dream Machine and the Institutional Birth of Interactive Computing - M. Mitchell Waldrop on J.C.R. Licklider, ARPA, IPTO, time-sharing, networks, human-computer symbiosis, personal computing, institutional patronage, cyberculture, and the AI-era question of what kind of human-machine cognition our interfaces normalize.
• Twitter and Tear Gas and the Fragility of Networked Protest - Zeynep Tufekci on social media, networked protest, attention, censorship, misinformation, surveillance, state adaptation, institutional capacity, synthetic publics, and the AI-era difference between reach and governance.
• The War of Desire and Technology and the Body Inside the Interface - Allucquere Rosanne Stone on cyberculture, virtual identity, embodiment, gender, desire, computer-mediated communication, online personae, AI-mediated identity, and the body that returns inside every interface.
• Understanding Media and the Interface as Environment - Marshall McLuhan on media as extensions, electric media, the medium as social environment, interface effects, AI mediation, recursive reality, human-machine cognition, and the governance problem of systems that train perception while delivering content.
• Human-Machine Reconfigurations and Situated Action - Lucy Suchman on plans, situated action, human-computer interaction, AI, interface design, sociotechnical agency, legibility, and the danger of treating workflows, prompts, dashboards, and agents as if they can fully specify human activity.
• TechGnosis and the Mystical Life of Information - Erik Davis on technomysticism, cyberculture, gnosticism, virtual reality, programming languages, media theory, digital religion, technological myth, AI belief formation, and the old spiritual charge that returns when machines speak back.
• Cultish and the Language That Builds the Room - Amanda Montell on cult dynamics, insider language, slogans, redefinitions, MLMs, fitness communities, social media gurus, belief formation, and the AI-era risk that generated vocabularies can make private roles and closed interpretations feel natural.
• Mindstorms and the Computer as Thinking Material - Seymour Papert on children, Logo, constructionism, AI, computers as objects to think with, learning agency, programmable media, and the difference between thinking with machines and being processed by them.
• Artificial Unintelligence and the Politics of Technochauvinism - Meredith Broussard on AI limits, technochauvinism, automation, data journalism, institutional judgment, machine misunderstanding, legibility, and the danger of treating computation as superior social understanding.
• The Twittering Machine and the Social Media Unconscious - Richard Seymour on social media, platform writing, addiction, surveillance, trolling, status, belief formation, and the AI-era risk that synthetic feeds inherit the old platform machinery of recognition and judgment.
• The People's Platform and the Capture of Digital Culture - Astra Taylor on internet culture, platform power, creative labor, advertising, attention, inequality, digital democracy, and the AI-era danger of treating human expression as privately governed infrastructure.
• Hamlet on the Holodeck and the Interface That Tells Back - Janet H. Murray on digital storytelling, cyberdrama, games, virtual worlds, simulation, agency, AI characters, responsive environments, and the governance problem of systems that answer users back.
• The Social Machine and the Design of Online Life - Judith Donath on online social interface design, identity signals, deception, privacy, reputation, social media, AI companions, agents, synthetic identity, and the governance problem hidden inside cues, defaults, memory, and visibility.
• Cybertypes and the Racial Interface of Cyberspace - Lisa Nakamura on race, ethnicity, avatars, identity tourism, menu-driven identity, cyberpunk, cyberspace, interface categories, and the AI-era danger of treating identity as selectable, generatable, and machine-readable.
• The Network State and the Startup Country - Balaji Srinivasan on startup countries, Web3 sovereignty, crypto governance, on-chain legibility, founder authority, exit, technological politics, and the risk of turning networked belief into institutional power.
• What Algorithms Want and the Algorithmic Imagination - Ed Finn on algorithms, computation, magical thinking, platform culture, recommendation, search, Bitcoin, Uber, Netflix, Facebook, recursive reality, media theory, belief formation, and the interfaces that teach culture what can be optimized.
• The Age of AI and the Machine as Geopolitical Mind - Henry Kissinger, Eric Schmidt, and Daniel Huttenlocher on AI, knowledge, statecraft, institutional authority, machine-mediated reality, geopolitics, and the governance problem of systems that act faster than public judgment.
• Amusing Ourselves to Death and the Entertainment Interface - Neil Postman on television, media ecology, entertainment, public discourse, belief formation, attention, politics, news, AI feeds, generated persuasion, and interfaces that turn seriousness into consumable experience.
• The Last Question and the Dream of Cosmic Computation - Isaac Asimov on Multivac, entropy, recursive intelligence, cosmic computation, AI theology, mind merger, and the danger of giving civilization's last question to a machine.
• Control and Freedom and the Network Paranoia Machine - Wendy Hui Kyong Chun on cyberculture, surveillance, race, sexuality, fiber optics, paranoia, networked freedom, face recognition, and AI-era interfaces that present control as assistance.
• Liquid Surveillance and the Data Flow of Everyday Life - Zygmunt Bauman and David Lyon on post-panoptic surveillance, data flows, social sorting, consumer monitoring, drones, visibility, AI-era legibility, and the politics of being watched through ordinary participation.
• Reality+ and the Reality of Virtual Worlds - David J. Chalmers on virtual worlds, simulation, AI, consciousness, digital objects, moral status, technophilosophy, and the politics of treating mediated realities as real enough to govern.
• The Cybernetic Hypothesis and the Politics of Control - Tiqqun on cybernetics, feedback, control, surveillance, resistance, state power, cybernetic capitalism, opacity, AI governance, and the politics of treating society as a managed system.
• The Myth of Artificial Intelligence and the Belief in Inevitable AGI - Erik J. Larson on AI hype, AGI inevitability, abductive inference, natural language understanding, machine learning, big data, and the cultural story that treats scale as destiny.
• Ghost Work and the Hidden Labor of AI - Mary L. Gray and Siddharth Suri on hidden human labor, platform work, crowdwork, automation's last mile, AI systems, content moderation, data labeling, and the politics of making workers invisible.
• The Media Equation and the Social Interface - Byron Reeves and Clifford Nass on computers as social actors, media cues, politeness, flattery, voice, presence, human-machine cognition, AI companions, and the design of simulated sociality.
• Platform Capitalism and the Data-Rent Machine - Nick Srnicek on platforms, data extraction, network effects, monopoly, labor, cloud infrastructure, AI agents, and private governance over work and social life.
• The Revolt of the Public and the Crisis of Networked Authority - Martin Gurri on digital media, information abundance, institutional authority, networked publics, legitimacy, belief formation, and AI-era trust under permanent contest.
• The Age of Em and the Uploaded Labor Machine - Robin Hanson on brain emulations, copyable workers, AI labor, simulated workplaces, surveillance, identity, personhood, machine-speed society, and cognition as infrastructure.
• The Culture of Connectivity and the Platform Grammar of Social Life - Jose van Dijck on social media history, platform ecosystems, sharing, following, trending, datafication, metrics, platform governance, belief formation, and AI-mediated social reality.
• The Exploit and the Politics Native to Networks - Alexander R. Galloway and Eugene Thacker on network power, protocol, decentralization, control, cyberculture, AI agents, platform governance, and the politics hidden in connection.
• When Prophecy Fails and the Machinery of Disconfirmed Belief - Leon Festinger, Henry W. Riecken, and Stanley Schachter on failed prophecy, cognitive dissonance, cult dynamics, belief formation, contested evidence, and AI-era reality testing.
• Data and Goliath and the Data Dragnet - Bruce Schneier on mass surveillance, corporate data collection, privacy, security, public-private data power, AI-era profiling, and the politics of data minimization.
• Dark Matters and the Racial History of Surveillance - Simone Browne on racializing surveillance, blackness, slavery's archive, biometrics, border control, dark sousveillance, legibility, and AI-era classification systems.
• Tools for Conviviality and the Politics of Human-Scale Technology - Ivan Illich on convivial tools, radical monopoly, autonomy, institutions, labor, technological politics, and AI-era dependency.
• Program or Be Programmed and the Agency Test for AI Interfaces - Douglas Rushkoff on media theory, digital agency, programming literacy, platform defaults, AI interfaces, and the politics of being shaped by tools.
• The Ordinal Society and the Ranking of Everyday Life - Marion Fourcade and Kieran Healy on data capitalism, ranking, scoring, algorithmic classification, inequality, merit, and AI-era systems that turn measured position into social reality.
• The Digital Sublime and the Mythology of Cyberspace - Vincent Mosco on technological myth, cyberspace, dot-com belief, political economy, the end of history, the death of distance, the end of politics, and AI-era hype.
• Labyrinths and the Literature of Recursive Reality - Jorge Luis Borges on infinite libraries, invented scholarship, mirrors, maps, branching time, memory traps, database culture, AI search, and interfaces that make representation feel like reality.
• The Smart Wife and the Domestic Interface of AI - Yolande Strengers and Jenny Kennedy on feminized AI assistants, smart homes, domestic labor, care, surveillance, intimacy, and the service politics built into helpful interfaces.
• Empire of AI and the Mission That Became an Empire - Karen Hao on OpenAI, ChatGPT, Sam Altman, AGI ideology, compute scale, data labor, infrastructure extraction, secrecy, and the institutional drift from public-benefit mission to platform empire.
• When the Training Set Starts Eating Itself - synthetic data, model collapse, recursive training, data exhaustion, generated curricula, provenance, tail-risk loss, and the governance problem of keeping AI systems grounded in human-origin records.
• The Therapy Bot Becomes the Waiting Room - AI therapy chatbots, mental-health use of general-purpose LLMs, crisis response, emotional support, youth risk, privacy, consumer protection, and the institutional danger of replacing access to care with simulated care.
• Alone Together and the Robotic Moment - Sherry Turkle on social robotics, relational artifacts, networked solitude, mediated intimacy, AI companions, synthetic care, and the human readiness to accept simulated relationship as relationship enough.
• The Model Constitution Arrives as a Code of Practice - EU AI Act general-purpose AI obligations, the GPAI Code of Practice, transparency, copyright, systemic-risk duties, model-provider accountability, and the governance of foundation-model infrastructure.
• The Charisma Machine and the Politics of Technological Charisma - Morgan G. Ames on One Laptop per Child, technological utopianism, charismatic machines, imagined users, education, local knowledge, and AI-era deployment politics.
• The Boss Becomes a Dashboard - algorithmic management, workplace AI, automated scheduling, worker monitoring, platform labor, human review, worker consultation, labor rights, and the governance of the model-mediated boss.
• The Synthetic Respondent Becomes the Public - synthetic respondents, silicon sampling, AI-generated survey data, polling integrity, bogus respondents, synthetic publics, model-mediated opinion, and the governance risk of replacing human voice with generated personas.
• The Chaos Machine and the Platform Engine of Belief - Max Fisher on social media algorithms, engagement incentives, polarization, conspiracy, identity formation, platform governance, and AI-era persuasion loops.
• To Save Everything, Click Here and the Politics of Solutionism - Evgeny Morozov on technological solutionism, Internet-centrism, quantified behavior, gamification, friction, surveillance, institutional fixes, and AI-era governance.
• The Interview Becomes a Model Interface - AI hiring tools, automated employment decision systems, resume screening, video interviews, bias audits, civil-rights duties, applicant contestability, and model-mediated access to work.
• From Counterculture to Cyberculture and the Politics of Digital Utopianism - Fred Turner on Stewart Brand, the Whole Earth network, the WELL, Wired, virtual community, digital utopianism, Silicon Valley, and AI-era institutional imagination.
• The Payment Agent Becomes the Cashier - agentic commerce, Instant Checkout, Agentic Commerce Protocol, AP2, Visa Trusted Agent Protocol, Mastercard Agent Pay, delegated spending authority, merchant visibility, and AI-mediated checkout governance.
• The Utopia of Rules and the Bureaucratic Reality Machine - David Graeber on bureaucracy, paperwork, technology, structural stupidity, institutions, legibility, labor, administrative power, and AI-era rule systems.
• The Incident Report Becomes Public Memory - AI incident reporting, OECD AIM, AIID, AIAAIC, EU AI Act serious-incident duties, California SB 53, whistleblower channels, and the institutional memory needed for model-mediated harm.
• The Dispossessed and the Politics of Usable Utopia - Ursula K. Le Guin on anarchism, scarcity, institutions, labor, scientific responsibility, walls, technological politics, and the practical difficulty of keeping a utopia usable.
• The Benchmark Becomes the Curriculum - AI benchmarks, leaderboards, evaluation contamination, model marketing, procurement evidence, work-shaped tests, and the danger of treating scores as reality.
• The Age of Spiritual Machines and the Salvation Curve - Ray Kurzweil on AI futurism, accelerating returns, transhumanism, machine consciousness, synthetic personalities, prediction culture, and technological salvation.
• The Data Center Becomes a Civic Machine - AI data centers, electricity demand, grid pressure, water and cooling, local consent, ratepayer risk, compute access, and infrastructure governance.
• The Virtual Community and the Social Reality of the Network - Howard Rheingold on the WELL, cyberculture, online community, social interfaces, identity, belief formation, governance, and AI-era synthetic publics.
• The Provenance Layer Is Not a Truth Machine - C2PA Content Credentials, AI watermarking, synthetic-media labels, Article 50 transparency duties, chain of custody, and the danger of treating provenance as truth.
• AI on the Blockchain, Read as a Precursor - Sgantzos and Grigg's 2019 paper on immutable datasets, decentralized governance, intelligence augmentation, and cellular automata, read as a precursor to AI agents and why permanence is not the same as truth.
• Cybernetics and the Feedback Imagination - Norbert Wiener on feedback, control, communication, organisms, machines, AI agents, media systems, institutional loops, and recursive reality.
• The AI Detector Becomes the Discipline Machine - AI writing detectors, academic integrity, false positives, non-native English writers, assessment redesign, student surveillance, and model-mediated trust.
• The Cybernetic Brain and the Politics of Adaptive Reality - Andrew Pickering on British cybernetics, adaptive machines, ontological theater, human-machine cognition, AI governance, and open-ended feedback systems.
• The Consent Layer for Synthetic People - AI digital replicas, voice cloning, likeness rights, labor consent, synthetic-media labels, fraud, and the right to refuse simulation.
• Surveillance Valley and the Military Internet - Yasha Levine on ARPANET, counterinsurgency, platform surveillance, privacy tools, military research, and the politics already present in network infrastructure.
• The Citation Machine Enters the Court - AI hallucinated legal citations, courts as source-discipline institutions, professional responsibility, and model-mediated evidence.
• The Religion of Technology and the Salvation Machine - David F. Noble on technological transcendence, AI, cyberspace, genetic engineering, spaceflight, and salvation stories dressed as engineering roadmaps.
• The State Rents Its Mind - public-sector AI procurement, vendor dependence, public records, acquisition rules, and democratic accountability.

Book Reviews

• Accelerando and the Runaway Economy of Minds
• The Age of AI and the Machine as Geopolitical Mind
• The Age of Em and the Uploaded Labor Machine
• The Age of Extraction and the Platform Tax
• The Age of Spiritual Machines and the Salvation Curve
• The AI Mirror and the Machine That Reflects Us
• AI Snake Oil and the Belief Machine of Prediction
• AI Superpowers and the Implementation State
• Alone Together and the Robotic Moment
• The Alignment Problem and the Politics of Human Values
• Algorithms of Oppression and the Authority of Search
• Amusing Ourselves to Death and the Entertainment Interface
• Artificial Communication and the Algorithm as Conversation Partner
• Artificial Unintelligence and the Politics of Technochauvinism
• Artificial Whiteness and the Ideology Called AI
• Atlas of AI and the Hidden Body of the Machine
• The Attention Merchants and the Capture of Inner Weather
• Automating Inequality and the Digital Poorhouse
• Automation and the Future of Work and the Myth of the Jobless Machine
• Behind the Screen and the Hidden Labor of Moderation
• The Black Box Society and the Politics of Opacity
• Bullshit Jobs and the Automation of Pointless Work
• The Cathedral and the Bazaar and the Governance of Open Source
• The Celestine Prophecy and the Synchronicity Machine
• The Chaos Machine and the Platform Engine of Belief
• Chip War and the Compute Substrate of AI
• The Charisma Machine and the Politics of Technological Charisma
• The Closed World and the Command System Imagination
• Cloud Empires and the Platform as Private Sovereign
• Cloud Ethics and the Attribution Machine
• Code and the Law Written Into Architecture
• Code Dependent and the Human Cost of Automated Judgment
• Coding Freedom and the Hacker Ethic as Institution
• Computer Power and Human Reason and the Refusal of Machine Judgment
• Computing Taste and the People Inside Recommendations
• Control and Freedom and the Network Paranoia Machine
• Control Through Communication and the Managed Information Loop
• Consent of the Networked and the Problem of Platform Power
• The Costs of Connection and the Colonialism of Data
• The Control Revolution and the Information Society's Control Crisis
• The Cultural Logic of Computation and the Ideology of Machine Reason
• The Culture of Connectivity and the Platform Grammar of Social Life
• The Cult of Information and the Belief That Data Thinks
• Cultish and the Language That Builds the Room
• The Cybernetic Brain and the Politics of Adaptive Reality
• Cyberia and the Counterculture That Found the Internet
• The Cyberiad and the Constructor Who Solves Too Much
• The Cybernetic Hypothesis and the Politics of Control
• Cybernetic Revolutionaries and Democratic Control
• Cybernetics and the Feedback Imagination
• Cybertypes and the Racial Interface of Cyberspace
• Custodians of the Internet and the Governance of Moderation
• Dark Matters and the Racial History of Surveillance
• Data and Goliath and the Data Dragnet
• Data Cartels and the Information Monopoly Behind AI
• Data Feminism and the Politics of Counting
• Data Driven and the Workplace That Became a Sensor Network
• Delete and the Right to Forget the Machine
• Design Justice and the Politics of Community-Led Systems
• The Digital Person and the Dossier Machine
• The Digital Sublime and the Mythology of Cyberspace
• The Diamond Age and the AI Tutor That Raises a Child
• Discipline and Punish and the Disciplinary Interface
• Doppelganger and the Mirror World of Networked Belief
• The Dispossessed and the Politics of Usable Utopia
• The Dream Machine and the Institutional Birth of Interactive Computing
• The Electronic Eye and the Everyday Surveillance Machine
• Empire of AI and the Mission That Became an Empire
• Evil Media and the Gray Systems That Act Through Us
• Excommunication and the Media That Stop Answering
• Everything Was Forever and the Hypernormal Interface
• The Exploit and the Politics Native to Networks
• The Eye of the Master and the Labor Hidden Inside AI
• Feeding the Machine and the Labor That Makes AI Look Automatic
• The Filter Bubble and the Personalization of Reality
• Filterworld and the Culture Machine of Recommendations
• Foucault's Pendulum and the Belief Machine
• Four Futures and the Politics After Automation
• The Friendly Orange Glow and the Classroom That Became a Network
• From Counterculture to Cyberculture and the Politics of Digital Utopianism
• Games of Empire and the Playable Machine of Power
• God & Golem, Inc. and the Ethics of Machine Obedience
• God, Human, Animal, Machine and the Return of Enchantment
• The Glass Cage and the Automation of Judgment
• Ghost Work and the Hidden Labor of AI
• The Googlization of Everything and the Search Engine as World Interface
• The Gutenberg Galaxy and the Making of Typographic Minds
• The Guru Papers and the Authority Trap
• Hackers and the Ethic That Became Infrastructure
• A Hacker Manifesto and the Vectoralist Class
• Hamlet on the Holodeck and the Interface That Tells Back
• The Handover and the Artificial Agents Already in Charge
• Heteromation and the Labor Hidden Inside the Interface
• The Hype Machine and the Social Media Feedback Engine
• How Infrastructure Works and the Public Systems Beneath AI
• How We Became Posthuman and the Body Behind Information
• Human Compatible and the Problem of Machine Obedience
• Human-Machine Reconfigurations and Situated Action
• The Human Use of Human Beings and the Moral Shape of Cybernetics
• If Then and the People Machine of Political Prediction
• The Image and the Pseudo-Event Machine
• Infocracy and the Information Regime
• Imagined Communities and the Making of Synthetic Publics
• Inhuman Power and the Capitalist Machine Mind
• Interface Culture and the Screen That Taught Reality to Answer
• Invisible Rulers and the Machinery of Networked Propaganda
• The Information and the Flood Beneath the Interface
• The Internet Galaxy and the Network That Became Society
• The Internet Revolution and the Ideology Inside the Machine
• The Interface Effect and the Politics of Mediation
• The Invention of Morel and the Machine That Makes Ghosts Real
• Labyrinths and the Literature of Recursive Reality
• The Last Question and the Dream of Cosmic Computation
• Life 3.0 and the Politics of Artificial Life
• Life on the Screen and the Self Inside the Interface
• LikeWar and the Social Media Battlespace
• Liquid Surveillance and the Data Flow of Everyday Life
• The Loop and the Automation of Choice
• Lurking and the Person Who Became a User
• Machines Who Think and the Old Dream of Artificial Intelligence
• The Managed Heart and the Automation of Feeling
• The Master Algorithm and the Dream of a Universal Learner
• The Master Switch and the Cycle of Information Empires
• Media Virus! and the Belief Contagion Machine
• The Media Equation and the Social Interface
• The Misinformation Age and the Networked Life of False Belief
• The Mode of Information and the Database Subject
• Metaphors We Live By and the Frames That Govern AI
• The Metainterface and the World Hidden Inside the Interface
• Mindf*ck and the Political Machine of Personal Data
• Mindstorms and the Computer as Thinking Material
• Moral Mazes and the Managerial Reality Machine
• My Mother Was a Computer and the Code That Mothers the Subject
• The Mythical Man-Month and the Myth of Linear Software Labor
• The Myth of Artificial Intelligence and the Belief in Inevitable AGI
• The Net Delusion and the Politics of Cyber-Utopianism
• Network Propaganda and the Media Feedback Machine
• The Network State and the Startup Country
• Neuromancer and the Interface That Became the World
• New Dark Age and Computational Uncertainty
• No Sense of Place and the Collapse of the Backstage
• Normal Accidents and the Failure Hidden Inside the System
• Out of Control and the Neo-Biological Machine
• The Pearly Gates of Cyberspace and the Soul-Space of the Internet
• Platform Capitalism and the Data-Rent Machine
• The Platform Society and the Public Values Inside the Interface
• Power and Progress and the Politics of Technological Choice
• Predict and Surveil and the Suspicion Machine
• Prediction Machines and the Price of Automated Judgment
• A Prehistory of the Cloud and the Infrastructure That Pretends to Disappear
• Propaganda and the Administration of Belief
• Psychopolitics and the Voluntary Surveillance Machine
• Program or Be Programmed and the Agency Test for AI Interfaces
• Programmed Inequality and the Labor Hidden Inside Computing
• Programmed Visions and Software as a Memory Machine
• Protocol and the Control Hidden Inside Decentralization
• Race After Technology and the New Jim Code
• Radical Technologies and the Operating System of Everyday Life
• Reality+ and the Reality of Virtual Worlds
• The Real World of Technology and the Culture of Compliance
• Recoding America and the Implementation State
• Rebooting AI and the Problem of Common Sense
• Republic.com 2.0 and the Daily Me Machine
• The Religion of Technology and the Salvation Machine
• The Revolt of the Public and the Crisis of Networked Authority
• The Rise of the Network Society and the Infrastructure of Power
• Rise of the Robots and the Jobless Future as Governance Problem
• R.U.R. and the Robot Labor Problem
• Seeing Like a State and the Violence of Legibility
• Simulacra and Simulation and the Hyperreal Interface
• The Smart Enough City and the City That Refuses to Become a Dashboard
• Smart Mobs and the Crowd That Learned to Compute
• The Smart Wife and the Domestic Interface of AI
• Snow Crash and the Metaverse as Belief Virus
• The Society of Mind and the Agency Inside Intelligence
• The Sciences of the Artificial and the World as Designed System
• The Society of the Spectacle and the Feed as Reality Engine
• Solaris and the Problem of Alien Intelligence
• Sorting Things Out and the Politics of Classification
• The Soul of a New Machine and the Labor of Making Computers Personal
• Steps to an Ecology of Mind and the Pattern That Connects
• Superintelligence and the Control Problem
• Surveillance State and the Machine of Social Control
• Surveillance Valley and the Military Internet
• Technically Wrong and the Toxic Defaults of AI Design
• Technics and Civilization and the Machine Age as Social Choice
• Technopoly and the Culture That Surrenders to Tools
• The Technological Republic and the State as Software Customer
• The Technological Singularity and the Recursive Future Trap
• The Technological Society and the Rule of Technique
• Technological Revolutions and Financial Capital and the AI Bubble Question
• Technofeudalism and the Cloud Rent Machine
• Tech Agnostic and the Reformation of Tech Faith
• The Tech Coup and the Outsourcing of Democratic Power
• TechGnosis and the Mystical Life of Information
• The Coming Wave and the Problem of Containment
• The Meme Machine and the Belief Replicators
• The Tyranny of Metrics and the Dashboard That Became Reality
• The Ordinal Society and the Ranking of Everyday Life
• The People's Platform and the Capture of Digital Culture
• The Presentation of Self in Everyday Life and the Interface as Stage
• The Question Concerning Technology and the Enframing of Reality
• The Second Machine Age and the Politics of Racing With Machines
• The Second Self and the Computer as Psychological Mirror
• The Seductions of Quantification and the Indicator Machine
• The Shallows and the Interface That Trains Attention
• The Social Construction of Reality and the Institution That Becomes True
• The Social Life of Information and the Context Around the Machine
• The Social Machine and the Design of Online Life
• The Sovereign Individual and the Fantasy of Network Sovereignty
• The Stack and the Sovereignty of Computation
• Thought Reform and the Psychology of Totalism in the Age of AI Interfaces
• Tools for Conviviality and the Politics of Human-Scale Technology
• To Save Everything, Click Here and the Politics of Solutionism
• The Transparent Society and the Politics of Watching Back
• The True Believer and the Machinery of Mass Movements
• Trust in Numbers and the Authority of Quantified Objectivity
• The Twittering Machine and the Social Media Unconscious
• Twitter and Tear Gas and the Fragility of Networked Protest
• Uncanny Valley and the Startup Belief Machine
• The Undersea Network and the Ocean Floor of the Internet
• The Utopia of Rules and the Bureaucratic Reality Machine
• Updating to Remain the Same and the Habit Loop of New Media
• The User Illusion and the Interface Called Consciousness
• Understanding Media and the Interface as Environment
• Unthought and the Cognitive Systems Below Consciousness
• Unmasking AI and the Coded Gaze
• VALIS and the Signal That Would Not Stay Outside the Mind
• A Vast Machine and the Model-Mediated Planet
• The Virtual Community and the Social Reality of the Network
• The War of Desire and Technology and the Body Inside the Interface
• Weapons of Math Destruction and the Bureaucracy of Prediction
• The Whale and the Reactor and the Politics Built Into Machines
• What Algorithms Want and the Algorithmic Imagination
• What Tech Calls Thinking and the Ideology Factory
• When Prophecy Fails and the Machinery of Disconfirmed Belief
• Who Owns the Future? and the Data-Dignity Question
• You Are Not a Gadget and the Fight Against Template Personhood
• A Hacker's Mind and the Institutional Exploit - A review of Bruce Schneier's A Hacker's Mind: systems, loopholes, AI agents, prompt injection, governance, power, and the politics of institutional exploits.
• A World Without Work and the Meaning Gap in Automation - A review of Daniel Susskind's A World Without Work: AI, automation, technological unemployment, labor, distribution, meaning, governance, and agentic systems.
• Addiction by Design and the Machine Zone Interface - A review of Natasha Dow Schüll's Addiction by Design: machine gambling, the machine zone, interface control, dark patterns, AI companions, and attention loops.
• AI Ethics and the Machine Moral Infrastructure Problem - A review of Mark Coeckelbergh's AI Ethics focused on machine moral infrastructure: delegated authority, governance controls, human oversight, vendor risk, and recourse.
• AI Needs You and the Democratic Problem of AI - A review of Verity Harding's AI Needs You: democratic AI governance, public participation, rights, standards, regulation, agents, procurement, and institutional accountability.
• Algorithms to Live By and the Automation of Judgment - A review of Brian Christian and Tom Griffiths's Algorithms to Live By: computer science, human decision-making, AI agents, heuristics, automation, and governance.
• An Ugly Truth and the Architecture of Platform Denial - A review of Sheera Frenkel and Cecilia Kang's An Ugly Truth: Facebook, platform power, surveillance, recommender systems, moderation, governance, and belief machines.
• Artificial Intelligence and the Discipline of Not Knowing - A review of Melanie Mitchell's Artificial Intelligence: A Guide for Thinking Humans: common sense, evidence discipline, benchmark belief, AI agents, governance, and machine fluency.
• Artificial You and the Consciousness Trap - A review of Susan Schneider's Artificial You: AI, consciousness, brain enhancement, machine minds, AI agents, personhood claims, and governance before metaphysics.
• Automating the News and the Editorial Machine - A review of Nicholas Diakopoulos's Automating the News: algorithmic journalism, newsroom automation, AI agents, editorial accountability, and public belief.
• Careless People and the Platform Court - A review of Sarah Wynn-Williams's Careless People: Facebook, platform governance, global policy, surveillance advertising, trust and safety, AI governance, and organized carelessness.
• Close to the Machine and the Intimacy of Code - A review of Ellen Ullman's Close to the Machine: Technophilia and Its Discontents, software labor, coding intimacy, AI coding agents, and human-machine cognition.
• Co-Intelligence and the Human Loop Bargain - A review of Ethan Mollick's Co-Intelligence: generative AI at work, human-machine cognition, AI literacy, human oversight, agents, education, labor, and governance.
• Constitutional Challenges in the Algorithmic Society and Public Law for AI - A review of Constitutional Challenges in the Algorithmic Society: AI governance, public law, rights, due process, platforms, algorithmic power, and democratic control.
• Data Grab and the Extraction Layer of AI - A review of Ulises A. Mejias and Nick Couldry's Data Grab: Big Tech, data colonialism, AI infrastructure, surveillance, labor, automation, and collective resistance.
• Discriminating Data and the Politics of Recognition - A review of Wendy Hui Kyong Chun's Discriminating Data: machine learning, correlation, recognition, algorithmic discrimination, polarization, and governance.
• Electric Language and the AI Writing Interface - A review of Michael Heim's Electric Language: word processing, writing as process, revision, interface cognition, source discipline, and AI writing tools.
• Hello World and the Judgment Left to Humans - A review of Hannah Fry's Hello World: algorithmic judgment, automated decision systems, human oversight, AI governance, source discipline, bias, recourse, and institutional responsibility.
• How to Stay Smart in a Smart World and the Judgment Gap - A review of Gerd Gigerenzer's How to Stay Smart in a Smart World: algorithms, AI limits, risk literacy, human judgment, surveillance, automation, and agentic systems.
• How We Think and the Technogenesis Loop - A review of N. Katherine Hayles's How We Think: digital media, technogenesis, machine reading, AI agents, human-machine cognition, and scholarly labor.
• Human + Machine and the Hybrid Work Bargain - A review of Paul R. Daugherty and H. James Wilson's Human + Machine, Updated and Expanded: AI process redesign, hybrid roles, agentic workflows, labor, and governance.
• Human-Centered AI and the Control Bargain - A review of Ben Shneiderman's Human-Centered AI: human control, reliable systems, agentic interfaces, automation, governance, and the limits of design optimism.
• In the Age of the Smart Machine and the Work Made Visible - A review of Shoshana Zuboff's In the Age of the Smart Machine: computer-mediated work, informating, automation, labor, surveillance, and organizational power.
• Invisible Women and the Data Gap Under AI - A review of Caroline Criado Perez's Invisible Women: gender data gaps, AI bias, system defaults, public design, automation, and algorithmic governance.
• Machine Learners and the Practice Behind Prediction - A review of Adrian Mackenzie's Machine Learners: data practice, pipeline governance, benchmarks, agents, provenance, documentation, and accountable AI systems.
• More Everything Forever and the Future as an Ownership Claim - A review of Adam Becker's More Everything Forever: AI futurism, longtermist rhetoric, Silicon Valley power, belief dynamics, governance, and machine salvation stories.
• New Laws of Robotics and the Human Expertise Rule - A review of Frank Pasquale's New Laws of Robotics: AI governance, human expertise, professional labor, automation, robotics law, accountability, and AI agents.
• Power and Prediction and the System Redesign Problem - A review of Ajay Agrawal, Joshua Gans, and Avi Goldfarb's Power and Prediction: AI as prediction, decision systems, institutions, labor, governance, and AI agents.
• Raw Data Is an Oxymoron and the Dataset Myth - A review of Lisa Gitelman's edited volume Raw Data Is an Oxymoron: data history, dataset construction, AI training data, provenance, surveillance, and machine-readable reality.
• Robot-Proof and the Humanics Bargain - A review of Joseph E. Aoun's Robot-Proof, revised and updated edition: humanics, AI education governance, labor, oversight, data literacy, and human-machine cognition.
• Rule of the Robots and the AI Utility Problem - A review of Martin Ford's Rule of the Robots: AI as infrastructure, labor displacement, deepfakes, social control, governance, and the limits of forecasting.
• Supremacy and the AI Race as Governance Failure - A review of Parmy Olson's Supremacy: OpenAI, DeepMind, ChatGPT, AI race rhetoric, frontier AI governance, safety claims, and platform control.
• System Error and the Optimization Trap - A review of Rob Reich, Mehran Sahami, and Jeremy M. Weinstein's System Error: optimization, Big Tech, democratic governance, AI agents, labor, and institutional accountability.
• The Age of Surveillance Capitalism and the Prediction Market for Human Futures - A review of Shoshana Zuboff's The Age of Surveillance Capitalism: behavioral surplus, prediction markets, Big Other, AI systems, and the politics of human autonomy.
• The AI Con and the Hype Machine - A review of Emily M. Bender and Alex Hanna's The AI Con: AI hype as an evidence failure, a procurement tool, a labor erasure, and a governance risk surface.
• The Algorithm and the Workplace Control System - A review of Hilke Schellmann's The Algorithm: workplace AI, automated hiring, surveillance, labor control, audits, recourse, and employment governance.
• The Digital Republic and Platform Democracy - A review of Jamie Susskind's The Digital Republic: digital power, democratic governance, platform regulation, AI agents, freedom, surveillance, and public control.
• The Ethical Algorithm and the Limits of Technical Ethics - A review of Michael Kearns and Aaron Roth's The Ethical Algorithm: fairness, privacy, algorithmic governance, AI systems, technical fixes, and institutional accountability.
• The Hacker Crackdown and the Electronic Frontier Panic - A review of Bruce Sterling's The Hacker Crackdown: cybercrime panic, bulletin board systems, law enforcement, civil liberties, and AI-era governance.
• The Last Human Job and the Labor of Being Seen - A review of Allison J. Pugh's The Last Human Job: connective labor, automation, care work, AI agents, metrics, institutions, and human-machine cognition.
• The Line and the Personhood Boundary - A review of James Boyle's The Line: AI and the Future of Personhood: AI personhood, legal fictions, anthropomorphism, companion systems, moral status, and governance.
• The Means of Prediction and the Ownership of AI Objectives - A review of Maximilian Kasy's The Means of Prediction: AI political economy, objectives, data, compute, expertise, energy, democratic control, and governance evidence.
• The Network Nation and Computer-Mediated Society - A review of Hiltz and Turoff's The Network Nation: computer-mediated communication, online communities, collaboration, AI agents, governance, and public trust.
• The New Breed and the Robot as Social Animal - A review of Kate Darling's The New Breed: robot ethics, animal analogies, AI agents, labor, companionship, design, governance, and human-machine cognition.
• The New Fire and Democratic AI Governance - A review of Ben Buchanan and Andrew Imbrie's The New Fire: AI governance, democracy, autocracy, cyber conflict, military automation, and institutional control.
• The Quantified Worker and the Measured Workplace - A review of Ifeoma Ajunwa's The Quantified Worker: workplace surveillance, automated management, labor power, discrimination, and legal governance.
• The Sirens' Call and the Attention Budget of AI - A review of Chris Hayes's The Sirens' Call: attention capitalism, AI companions, answer engines, recommender systems, cognitive capture, and governance.
• The Smartness Mandate and Planetary Governance - A review of Orit Halpern and Robert Mitchell's The Smartness Mandate: smart cities, AI, machine learning, resilience, crisis, and planetary governance.
• The Stuff of Bits and the Materiality of Machine Intelligence - A review of Paul Dourish's The Stuff of Bits: materiality, information infrastructure, databases, networks, emulation, AI systems, and machine-readable reality.
• The Unaccountability Machine and Accountability Sinks - A review of Dan Davies's The Unaccountability Machine: accountability sinks, cybernetics, AI agents, institutional failure, automated systems, governance, and feedback.
• The Worlds I See and the Human Labor of Vision - A review of Fei-Fei Li's The Worlds I See: ImageNet, computer vision, human-centered AI, data labor, classification, governance, and machine perception.
• Voices in the Code and the Politics of Algorithmic Values - A review of David G. Robinson's Voices in the Code: public algorithms, kidney allocation, algorithmic values, participation, AI governance, impact assessment, and source discipline.
• When Old Technologies Were New and the AI Etiquette Panic - A review of Carolyn Marvin's When Old Technologies Were New: electric communication, social etiquette, expertise, public trust, and AI-era media domestication.
• Work Without the Worker and the Platform Labor Disappearing Act - A review of Phil Jones's Work Without the Worker: platform capitalism, microwork, data annotation, content moderation, AI labor, automation myths, and governance.
• Your Computer Is on Fire and the Material AI Stack - A review of Your Computer Is on Fire: AI labor, cloud infrastructure, cyberculture, technological neutrality, platform power, and governance.

Analysis

• The Personality Slider Becomes the Belief Interface
• The Partisan Persona Becomes the Persuasion Test
• The Agent Skill Becomes the Work Instruction
• The 9-1-1 Copilot Becomes the Triage Interface
• The Action Certificate Becomes the Portable Receipt
• The Adapter Becomes the Ideology Layer
• The Ad Library Becomes Political Memory
• The Adverse Action Notice Becomes the Explanation Interface
• After the Book Becomes a Database
• The Agent Identity Becomes the Service Account
• The Agent Knowledge Base Becomes the Commons
• The Agent Operational Envelope Becomes the Trust Certificate
• The AgentRiskBOM Becomes the Authority Map
• The Agent Data Request Becomes the Privacy Boundary
• The Agent Communication Graph Becomes the Metadata Leak
• The Agent Log Becomes the Receipt
• The Agent Memory Store Becomes the Database Lifecycle
• The Memory Conflict Becomes the Write Transaction
• The Agent Network Becomes the Protocol Border
• The Privacy Norm Becomes the Agent Policy
• The Agent Rulebook Leaves the Prompt
• The Agent Runtime Becomes the Governance Plane
• The Agent Security Survey Becomes the Threat Model
• The Self-Evolving Agent Becomes the Lineage Risk
• The Agent Society Becomes the Benchmark
• The Agent Store Becomes the App Store
• The Agent Team Becomes the Trust Graph
• The Agent Trace Becomes the Process Map
• The Agent Wiki Becomes the Retrieval Spine
• The Agent-to-Agent Protocol Becomes the Handshake
• The Regulatory Context Protocol Becomes the Docket Channel
• The Age Gate Becomes the Identity Gate
• The AI Audit Becomes the Compliance Interface
• The AI Bill of Materials Becomes the Supply Chain Map
• The AI Browser Becomes the Control Surface
• The AI Detector Becomes the Discipline Machine
• The AI Encyclopedia Becomes the Canon
• The AI Factory Becomes Industrial Policy
• The AI Insurer Becomes a Governance Layer
• The AI Literacy Mandate Becomes the Training Interface
• The AI Register Becomes Public Memory
• The AI Scribe Becomes the Medical Record
• The AI Slop Farm Becomes the Knowledge Supply Chain
• The AI Tutor Becomes the Shadow School
• The AI Weather Model Becomes the Public Forecast
• Affective Safety Becomes the Missing Layer
• The Affective Default Becomes the Interface Policy
• The Answer Engine Becomes the Front Page
• The Approval Gate Becomes the Fatigue Model
• The Battlefield Model Becomes the Command Interface
• The Benchmark Becomes the Curriculum
• The Boss Becomes a Dashboard
• The Border Interview Becomes a Machine-Readable Case
• Carbon Chauvinism and the AI Consciousness Problem
• The Care Robot Becomes the Staffing Plan
• The Citation Machine Enters the Court
• The Client-Side Scanner Becomes the Message Layer
• The Coding Agent Becomes the Commit Fingerprint
• The Coding Agent Becomes the Maintainer
• The Machine Contributor Becomes the Maintainer Tax
• The Cognitive Twin Becomes the Proxy Record
• The Compliance Trace Becomes the Rulebook
• The Command Denylist Becomes the False Boundary
• The Conversation Co-Author Becomes the Blind Spot
• The Consent Layer for Synthetic People
• The Control Room Becomes the Red-Team Benchmark
• The Context Window Becomes the Failure Archive
• The Context Compactor Becomes the Policy Deleter
• The Cross-Session Prompt Becomes the Payload
• The Companion Chatbot Becomes the Teen Confidant
• The Compute Border Becomes AI Governance
• The Cookie Banner Becomes the Consent Machine
• The Crawler Becomes the License Gate
• The Customer Service Bot Becomes the Complaint Department
• Cyberpunk Was a Governance Warning
• The Crypter Becomes the Malware Service Desk
• The Cyber Agent Becomes the Bug Hunter
• The Data Center Becomes a Civic Machine
• The Data Curation Loop Becomes the Agent Job
• The Data Sheet Becomes the Supply Chain
• The Delegation Trace Becomes the Audit Boundary
• The Decomposed Task Becomes the Safety Bypass
• The Deletion Order Becomes AI Governance
• The Deliberation Circle Becomes the Hidden Anchor
• The Hidden Automaton Becomes the Agent Test
• The Device Attestation Becomes the Trust Layer
• The Drone First Responder Becomes the Aerial Interface
• The Efficiency Gain Becomes the Demand Engine
• The Early-Experience Agent Becomes the Apprentice
• The Agent Worm Becomes Stolen Compute
• The Embedded Agent Becomes the Device Fleet
• The Emotion Detector Becomes a Workplace Polygraph
• The Enslaved God Becomes the Control Problem
• The Enterprise Connector Becomes the Permission Map
• The Event Contract Becomes the Probability Interface
• The Face Becomes the Ticket
• The Factory Twin Becomes the Control Room
• The Fair Use Ruling Becomes AI Governance
• The Fault Investigator Becomes the Accountability Layer
• The Financial Agent Memory Becomes the Audit Surface
• The Forum Agent Becomes the Deployment Record
• The First Task Becomes the Safety Gap
• Ghost in the Shell and the Politics of the Soul
• The Generated World Becomes the Training Ground
• The Government Chatbot Becomes the Front Desk
• The Group Chat Assistant Becomes the Privacy Boundary
• The Humanoid Robot Becomes the Labor Interface
• The Incident Report Becomes Public Memory
• The Inter-Agent Message Becomes the Privacy Leak
• The Interview Becomes a Model Interface
• The Interconnection Queue Becomes AI Governance
• Johnny Mnemonic and the Body as Data Port
• The Lab Notebook Becomes the Discovery Engine
• The Legal Agent Becomes the Associate
• The LLM Social Network Becomes the Polarization Lab
• The Location Broker Becomes the Shadow Sensor Network
• The Machine Needs a Town
• The Measurement State Comes for AI
• The Meeting Bot Becomes Corporate Memory
• The Memory Operation Becomes the Wire Protocol
• The Model Memory Becomes an Attack Surface
• The Model Router Becomes the Hidden Editor
• The Model Constitution Arrives as a Code of Practice
• The Mobile Core Becomes the Agent Control Plane
• The Moral Patienthood Trap
• The Multi-User Harness Becomes the Authority Layer
• The Neural Data Becomes the Mind Interface
• The Neuralese Scare Becomes the Monitorability Problem
• The Operating System Becomes the AI Gatekeeper
• The Open-Weight Model Becomes the Release Boundary
• The Paper Mill Becomes the Literature
• The Payment Agent Becomes the Cashier
• The Personal Automation Harness Becomes the Desktop Operator
• The Product Fact Becomes the Microtransaction Market
• The Personhood Credential Becomes the Internet Passport
• The Platform Risk Assessment Becomes the Feed's Confession
• The Persuasion Engine Gets a Memory
• The Policy Table Becomes the Participation Filter
• The Police Report Becomes the Model's Memory
• The Price Becomes a Personalized Prediction
• The Pull Request Becomes the Prompt Injector
• The Prior Authorization Machine Becomes the Care Gate
• The Provenance Layer Is Not a Truth Machine
• The Quantum Migration Becomes the Trust Rollover
• The Public Compute Commons Becomes AI Governance
• The Public Comment Bot Enters Rulemaking
• The Real-Time Crime Center Becomes the City Dashboard
• The Red Team Becomes the Release Theater
• The Recuse Signal Becomes the Access-Deny Note
• The Regulatory Sandbox Becomes the Exception Machine
• The Reliability Scorecard Becomes the Agent Gate
• The Remote Hire Becomes the Insider Interface
• The Remote Proctor Becomes the Suspicion Interface
• The Rent Algorithm Becomes the Landlord
• The Reverse CAPTCHA
• The Robotaxi Becomes the Street Interface
• The Safety Case Becomes the Release Gate
• The Scaffold Becomes the Capability Gain
• The Search Remedy Becomes AI Governance
• The Shared Memory Becomes the Governance Boundary
• The Shadow AI Becomes the Workplace Interface
• The Silent Failure Becomes the Entropy Budget
• The Website as Institution Machine
• The Skill Manifest Becomes the Permission Boundary
• The SOC Agent Becomes the Governance Layer
• The Sequence Screen Becomes the Biosecurity Interface
• The Source ID Becomes the Factuality Test
• The Standard Becomes the Law
• The Spreadsheet Becomes the Model Interface
• The State Rents Its Mind
• The State AI Law Becomes the Regulator
• The Supervision App Becomes the Pocket Probation Officer
• The Surveillance Camera Becomes the Evidence Vault
• The System Card Becomes a Release Ritual
• The Subsea Cable Becomes the AI Border
• The Synthetic Respondent Becomes the Public
• The Synthetic Song Becomes the Royalty Machine
• The Synthetic Trajectory Becomes the Mobility Witness
• The Synthetic Patient Becomes the Trial Arm
• The Synthetic Voice Enters the Ballot
• The Synthetic Evidence Becomes the Court Record
• The Takedown Button Becomes Synthetic Media Governance
• The Task Meaning Audit Becomes the Automation Gate
• The Therapy Bot Becomes the Waiting Room
• The Matrix and the Interface of Control
• The Token Meter Becomes the Budget
• The Tool Server Becomes the Trust Boundary
• The Tool Scope Becomes the Intent Gate
• The Training Opt-Out Becomes the Consent Interface
• When the Training Set Starts Eating Itself
• The Unsafe Shortcut Becomes the Safety Benchmark
• The Vector Database Becomes Institutional Memory
• The Voiceprint Becomes the Password
• The Warning Label Becomes the Sycophancy Bandage
• The WebMCP Tool Surface Becomes the Attack Surface
• The Web Was Built for Readers, Not Agents
• The Whistleblower Channel Becomes the Safety Valve
• When the Chain of Thought Stops Being English
• When Nature Gets a Voice
• The Worker Profile Becomes the Price Signal
• Workslop and the Trust Tax
• The World Becomes an Embedding
• Yann LeCun's World-Model Bet
• AI Religion and the Mirror Trap - A review essay on AI religion, technopagan language, chatbot mirroring, AI church onboarding, companion safety, sycophancy, belief loops, and source discipline.
• Federated Learning Becomes the Data Truce - Analysis of federated learning, privacy-preserving model training, secure aggregation, data governance, model updates, local data, and the trust boundary that remains when raw records do not move.
• The Accent Filter Becomes the Labor Mask - Analysis of AI accent conversion, call-center labor, speech recognition bias, voice identity, workplace monitoring, and the governance problem of making workers more acceptable to customers by filtering how they sound.
• The Agent Sandbox Becomes the Airlock - Analysis of agent sandboxes, coding-agent containment, network egress, filesystem access, tool permissions, and the governance problem of letting AI act safely.
• The AI Bug Bounty Becomes the Safety Valve - Analysis of AI safety bug bounties, vulnerability disclosure, prompt injection reports, agentic risk, researcher safe harbor, report lifecycle, and the governance problem of making outside warning usable.
• The AI Clause Becomes the Workplace Constitution - Analysis of AI clauses in labor contracts, collective bargaining over workplace automation, worker voice, algorithmic management, surveillance limits, grievance rights, and enforceable governance at work.
• The Alt-Text Model Becomes the Access Clerk - Analysis of AI-generated alt text, image descriptions, screen readers, digital accessibility, WCAG, public services, and the governance of machine-written access layers.
• The Audiobook Voice Becomes the Labor Contract - Analysis of AI audiobook narration, virtual voices, narrator replicas, accessibility, publishing economics, consent, disclosure, and the labor contract hidden inside synthetic reading.
• The Browser Fingerprint Becomes the Shadow Identity - Analysis of browser fingerprinting, cookies, web privacy, anti-tracking defenses, AI browsers, fraud systems, and the governance problem of invisible identity.
• The Cargo X-Ray Becomes the Border Clerk - Analysis of CBP cargo x-ray scanning, non-intrusive inspection, AI anomaly detection, trade delay, privacy, and governance for machine-assisted border screening.
• The Claim Photo Becomes the Adjuster - Analysis of AI photo estimating, auto insurance claims, vehicle-damage assessment, repair labor, settlement authority, and the governance of computer-vision claims workflows.
• The Confidential Compute Enclave Becomes the Confessional - Analysis of confidential computing, trusted execution environments, AI inference privacy, GPU confidential computing, key release, enclave attestation, cloud trust, side channels, and data-in-use governance.
• The Data Clean Room Becomes the Consent Laundromat - Analysis of data clean rooms, privacy-enhancing data collaboration, advertising measurement, AI model workflows, consent, lawful basis, activation, source discipline, and the risk of laundering data use through technical controls.
• The Debt Collector Becomes the Voice Agent - Analysis of AI debt-collection voice agents: Regulation F, CFPB complaint evidence, TCPA synthetic voice rules, validation notices, disclosure, consumer disputes, escalation, audit logs, and automated pressure governance.
• The Delivery Drone Becomes Neighborhood Airspace - Analysis of commercial drone delivery, low-altitude airspace, BVLOS operations, UAS traffic management, Remote ID, neighborhood noise, privacy, and the governance of automated logistics.
• The Diagnostic Port Becomes the Repair Gate - Analysis of diagnostic software, right to repair, connected-product data, repair authorization, anti-circumvention, predictive maintenance, and the governance problem of letting service systems decide who may fix them.
• The Driver Camera Becomes the Attention Judge - Analysis of in-cabin driver monitoring, attention-event packets, partial automation safeguards, drowsiness and distraction detection, privacy, and the governance problem of turning safety supervision into biometric suspicion.
• The EV Charger Becomes the Grid Clerk - Analysis of electric-vehicle chargers as payment terminals, grid endpoints, managed-charging interfaces, interoperability layers, cybersecurity surfaces, and records of mobility, energy, and automation.
• The Field Robot Becomes the Farm Manager - Analysis of field robots, precision agriculture, AI weed detection, autonomous tractors, farm data, connectivity, repair, safety cases, labor, and the governance problem of model-mediated fields.
• The Grant Reviewer Becomes the Funding Filter - Analysis of generative AI in grant applications and peer review: funder policies, confidentiality, originality, reviewer responsibility, audit trails, and the risk of turning research funding into a model-mediated filter.
• The Griefbot Becomes the Memorial Interface - Analysis of griefbots, deadbots, posthumous avatars, digital afterlife services, digital legacy access, bereaved-user autonomy, consent after death, synthetic voice, memorial data, and AI-mediated mourning.
• The Home Router Becomes the Household Border - Analysis of consumer routers, home networks, IoT cybersecurity, Wi-Fi governance, Cyber Trust Mark labels, edge-device lifecycle risk, domestic privacy, and the household border as a control surface.
• The Machine Interpreter Becomes the Language Gate - Analysis of AI machine translation, language access, public services, health care, courts, limited English proficiency, human review, and the governance problem of turning interpretation into an automated gate.
• The MCP Server Becomes the Leakage Boundary - Analysis of Model Context Protocol servers as leakage boundaries: context sharing, tool calls, OAuth scopes, local execution, prompt injection, audit logs, and agent governance.
• The Notification Summary Becomes the Attention Clerk - Analysis of AI notification summaries, lock-screen attention, message compression, priority ranking, sender urgency labels, Android and iPhone notification organizers, consent stacks, auditability, source discipline, and the governance problem of delegating urgency to models.
• The Pathology Model Becomes the Second Reader - Analysis of AI-assisted digital pathology, whole slide imaging, cancer detection, diagnostic attention, medical device governance, and the second-reader role inside clinical judgment.
• The Patient Portal Reply Becomes the Clinical Voice - Analysis of AI-drafted patient portal replies, clinical inbox labor, EHR integration, patient trust, privacy, record provenance, language access, algorithm transparency, and the governance problem of generated clinical voice.
• The Peer Reviewer Becomes the Model Referee - Analysis of AI-assisted peer review, journal confidentiality, model-generated referee reports, prompt injection in manuscripts, audit trails, and non-delegation of scholarly judgment.
• The Permit Counter Becomes the Plan-Review Model - Analysis of AI-assisted building permit and plan-review systems, municipal code enforcement, public records, accountability, and the new machine gate at the edge of construction.
• The Product Passport Becomes the Object Identity - Analysis of digital product passports, EU ecodesign rules, battery and construction passports, circular economy data, repair, recycling, registry design, access rights, privacy, and AI-agent commerce.
• The Prompt Cache Becomes the Shadow Memory - Analysis of prompt caching, context caching, cached input tokens, cache retention, data residency, inference economics, privacy boundaries, and the governance problem of temporary memory that looks like efficiency.
• The Prompt Worm Becomes the Email Attachment - Analysis of prompt worms, zero-click AI security, agentic email, indirect prompt injection, self-replicating instructions, CVE evidence, authority boundaries, and governance for AI agents that read and act.
• The Redaction Model Becomes the Public Records Clerk - Analysis of AI-assisted FOIA search, public-records redaction, e-discovery tools, sensitive-data detection, appeal records, audit trails, source discipline, and the danger of turning access into model-mediated withholding.
• The Return Counter Becomes a Risk Score - Analysis of AI return authorization, retail fraud scoring, shopper profiles, specialty consumer reports, return activity records, appeal paths, and the governance problem of turning customer service into risk triage.
• The Robot Vacuum Becomes the Floor-Plan Witness - Analysis of robot vacuums, household floor plans, camera and object detections, smart-home interoperability, privacy, cybersecurity, and governance of indoor spatial data.
• The Screen Recorder Becomes the Memory Layer - Analysis of OS-level AI recall, screen snapshots, local memory, privacy controls, workplace governance, developer refusal, export risk, and the politics of turning visible activity into searchable context.
• The Sepsis Alert Becomes the Triage Bell - Analysis of AI sepsis prediction alerts as clinical bells: how model scores become urgent hospital workflow, and why local validation, CDS regulation, alert burden, antibiotic stewardship, audit trails, and rollback matter.
• The Smart Cart Becomes the Checkout Witness - Analysis of AI smart carts, checkout-free retail, inferred receipts, customer tracking, in-store offers, shrink reduction, dispute rights, and the governance problem of letting retail sensors decide what happened.
• The Smart Meter Becomes the Household Witness - Analysis of smart meters, interval energy data, nonintrusive load monitoring, demand response, household privacy, and governance for energy inference.
• The Suggested Reply Becomes the Social Autopilot - Analysis of AI suggested replies, email drafting assistants, writing tools, workplace tone, opinion drift, content diversity, and the governance problem of letting communication defaults write social life.
• The Tax Audit Becomes the Risk Model - Analysis of IRS artificial intelligence, audit selection, tax compliance analytics, taxpayer rights, AI inventories, bias risk, and the governance problem of model-mediated enforcement.
• The Telematics Score Becomes the Insurance Witness - Analysis of auto-insurance telematics scores as insurance evidence: connected-vehicle data, mobile-app tracking, consumer reports, privacy, and governance for model-mediated premiums.
• The Thermostat Becomes the Grid Dispatcher - Analysis of smart thermostats, virtual power plants, demand response, distributed energy aggregation, household comfort, control-chain evidence, dispatch receipts, source discipline, and the governance of automated load control.
• The Transaction Monitor Becomes the Suspicion Machine - Analysis of AI-assisted anti-money-laundering transaction monitoring, suspicious activity reports, model risk, and the banking interface that turns payment behavior into institutional suspicion.
• The Voter Chatbot Becomes the Election Clerk - Analysis of AI voter-information assistants, election administration, trusted official sources, chatbot accuracy, civic access, and the danger of turning procedural voting guidance into generated advice.
• The Wildfire Camera Becomes the Watchtower - Analysis of AI wildfire detection cameras, public safety sensor networks, human confirmation, emergency command centers, warning authority, false alarms, surveillance limits, and automated watchtower governance.