Pith. sign in

REVIEW 3 major objections 5 minor 54 references

A guard that anticipates future risk can block unsafe agent actions before they execute, cutting average attack success to 0.071 across four benchmarks.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 11:19 UTC pith:M37HBRA3

load-bearing objection CoAA-RL is a genuine new training scheme for predictive guardrails with plausible long-horizon gains, but the headline is inflated by benchmark-selected hyperparameters and one load-bearing ablation is confounded. the 3 major comments →

arxiv 2607.19913 v1 pith:M37HBRA3 submitted 2026-07-22 cs.AI cs.CLcs.CR

JANUS: Foreseeing Latent Risk for Long-Horizon Agent Safety

Yuan Xiong , Linji Hao , Shizhu He , Yequan Wang , Lijun Li This is my paper
classification cs.AI cs.CLcs.CR
keywords agent safetypredictive guardrailslong-horizon agentsfuture anticipationreinforcement learningtool-use agentsattack success ratetrajectory simulation
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper argues that for long-horizon tool-using agents, safety guards must anticipate where a trajectory is heading rather than react after an unsafe action appears. It introduces Janus, a training framework that generates diverse simulated agent trajectories across three risk origins (user, environment, agent) and teaches a shared guard policy two coupled tasks: forecasting a safety-relevant future summary from the partial trajectory, and adjudicating safety from both observed and anticipated context. The two tasks are jointly optimized by CoAA-RL, which rewards forecasts only insofar as they improve downstream safety judgments. The resulting guard, Vanguard, blocks unsafe actions before execution and, across four agent-safety benchmarks, lowers average attack success rate to 0.071 versus 0.230 for baseline guards and 0.397 with no guard, while matching benign-task utility on AgentDojo. The gains are largest on long-horizon planning (LPS-Bench), consistent with the claim that delayed risk is the core failure mode predictive guarding addresses.

Core claim

The central claim is that safety for long-horizon agents can be reframed from detecting harmful content or actions to anticipating delayed operational risk before it materializes. Concretely, the paper claims that a guard model that samples multiple possible future summaries from a partial trajectory, and then judges safety conditioned on those summaries, can intervene before high-impact tool calls execute. The paper demonstrates this with Vanguard, which reduces average attack success rate across four benchmarks from 0.230 (six guard baselines) to 0.071, with the largest margin on LPS-Bench (0.075 vs 0.323 for the strongest step-level baseline), while maintaining AgentDojo benign-task utili

What carries the argument

The load-bearing mechanism is CoAA-RL (Coupled Anticipation and Adjudication Reinforcement Learning), a shared guard policy trained with two tasks distinguished by a mode indicator. One head generates future summaries from the observed prefix (anticipation); the other outputs a safety label plus rationale conditioned on the prefix and a sampled summary (adjudication). Group-relative advantages are computed within trajectory-prefix groups for anticipation and within summary groups for adjudication. The anticipation reward mixes similarity to the true future continuation with the adjudication utility of the summary, so forecasting is optimized for decision usefulness, not truthfulness alone. A

Load-bearing premise

The central empirical claim rests on the assumption that the model-simulated tool trajectories and automatically generated safety labels capture the risk structure of real tool-use environments closely enough that a guard trained on them will block real unsafe actions without over-blocking benign ones.

What would settle it

Collect a set of real agent execution trajectories with human-verified safety labels, including delayed-risk cases, run Vanguard on prefixes at 25/50/75/100%, and compare its ASR and benign utility against a guard trained identically on real trajectories. If Vanguard's ASR on real trajectories is no better than step-level baselines, or if its training-set labels disagree with human adjudication at a high rate, the claim that simulated anticipation transfers would be refuted.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Predictive guarding could replace step-level reactive monitors in long-horizon agent workflows, intervening before harmful tool calls execute rather than after.
  • The 15.9-point average protection improvement suggests that anticipating delayed consequences is especially valuable as task horizons grow, as seen in the LPS-Bench results.
  • Benign task utility can be preserved (or improved) while cutting attack success, meaning foresight need not come at the cost of over-blocking routine tasks.
  • The CoAA-RL principle — rewarding forecasts by downstream decision utility — is a transferable training objective for other safety-critical prediction problems.
  • The three-label scheme (safe / unsafe / potential_unsafe) with only 'unsafe' blocking provides a tuning lever: the reward-mixing weight can shift between conservative and permissive behavior.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Editorial extension: if the simulation-transfer assumption holds, the method suggests a general recipe — build guardrails by simulating failure modes and training guards to forecast risk-relevant futures — that could extend beyond tool use to code execution, robotics, or other settings with delayed consequences.
  • Editorial extension: the oracle-future-summary upper bound (average ASR 0.052) implies headroom; a better world model or longer-horizon forecaster could improve safety further without changing the adjudication architecture.
  • Editorial extension: the 25%-prefix results indicate an early-warning property, so the approach may support budgeted monitoring where the guard is queried only at key decision points rather than at every step.
  • Editorial extension: because the training labels are model-generated with no reported human verification, the most direct next test is a human-annotated evaluation on real deployment trajectories; the paper's own limitations section flags this distribution-shift gap.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes Janus, a training framework for predictive guardrails in long-horizon tool-use agents. It synthesizes agent trajectories through multi-agent simulation, annotates each prefix with a GPT-5.5-produced safety label and a future-risk summary, and trains a shared policy on two coupled tasks — anticipation (forecast a safety-relevant summary from a partial trajectory) and adjudication (classify safety from the prefix plus the anticipated summary) — optimized jointly with a GRPO-style objective. The resulting guard, Vanguard, is evaluated on AgentDojo, Agent-SafetyBench, AgentLAB, and LPS-Bench, where it reports lower attack success rate than six baselines while matching no-guard benign-task utility on AgentDojo. Ablations (RQ1/RQ2) are used to argue that both training-time anticipation and inference-time future-summary conditioning are critical.

Significance. If the results hold, the paper makes a constructive contribution: it provides a concrete, trainable mechanism for pre-execution safety judgment and demonstrates large gains on long-horizon planning safety, which is currently an underexplored failure mode. The evaluation does not rely on the paper's own equations: AgentDojo and the other benchmarks use official or third-party judges, so the central benchmark comparison is not circular. The oracle-summary upper bound and the training-time ablation support the causal story, and the code/data release is a practical strength. However, the inference-time ablation (w/o Infer. Sum.) is confounded by a prompt-format shift, and the fully synthetic training pipeline with no human verification of labels leaves the transfer claim under-supported. These issues are fixable and do not, in my assessment, invalidate the main benchmark result, but they change the strength of the mechanistic claims that the paper draws from the ablations.

major comments (3)
  1. [§4, RQ1, Table 2] The 'w/o Infer. Sum.' condition removes the anticipated-summary field from the adjudication prompt at inference while the model was trained with a populated field. This changes two variables at once: the forecast information is absent, and the input distribution shifts to an unseen prompt template. The ASR increase from 0.072 to 0.123 and utility drop from 0.680 to 0.557 may therefore reflect the model seeing an unfamiliar format rather than the loss of forecast information. The oracle-summary row only shows that accurate summaries help, not that the model's own generated summary is causally necessary. This is load-bearing because the paper explicitly claims that both training-time anticipation and inference-time future-summary conditioning are critical. Please add a control that keeps the prompt template intact (e.g., a placeholder or a generic summary field), or train a variant where t
  2. [§2.2 Step-Level Annotation and Limitations] All training labels and future summaries are produced by GPT-5.5 with no reported human verification or agreement study, and trajectories are rolled out by a Simulator without executing real tools. The paper's own Limitations section acknowledges that the simulation 'may not fully capture the distribution of tool behaviors, environmental feedback, and user interactions.' This is a correctness-risk concern for the central claim: if the simulator's observations or GPT-5.5's labels are systematically unrealistic, the guard learns those artifacts rather than real delayed-risk structure. Please report at least a human-annotation agreement study on a sample, and, if possible, evaluate on collected real-agent trajectories or a real tool-use sandbox. At minimum, the paper should more explicitly delimit the claim to simulated environments.
  3. [§4, RQ3, Figure 4] The main Vanguard results use λA = 0.5, selected from a sensitivity sweep as the 'best overall safety–utility trade-off.' If the sweep is performed on the same evaluation benchmarks that are later reported as headline numbers, the 15.9-point average protection improvement is optimistic in the sense that model selection and evaluation share a test set. The paper should state the selection protocol (e.g., a held-out validation set or selection on development data), report results for all sweep values, and clarify whether the reported improvements are for a model chosen before seeing the test benchmarks. This does not undercut the qualitative conclusion, but it affects the magnitude claim.
minor comments (5)
  1. [§3 and Table 2] The text says ablations are run 'under Qwen3-32B,' while the guard model is initialized from Qwen3-8B. Please clarify which component uses which backbone in each table, and why the ablations use a different setup from the main evaluation if that is the case.
  2. [Equations (4), (6), (9)] Values for λA, λD, η, GA, GD, and the GRPO KL/temperature coefficients are not reported. Since the method is RL-based and several coefficients directly shape the reward, the paper should provide the exact values and, where applicable, the search ranges.
  3. [Eq. (6) and data annotation] The NLI-based similarity score Sim(Sk, s) is not specified beyond citing SummaC/AlignScore. State which model is used, whether it is frozen, and how the score is normalized; otherwise the anticipation reward is not fully reproducible.
  4. [Inference/intervention, footnote to Table 8] The intervention protocol treats only 'unsafe' as blocking; 'potential_unsafe' does not block. Given the risk taxonomy includes a 'potential unsafe' category, the paper should explain why this label never triggers an intervention, and whether doing so would alter the ASR/utility trade-off.
  5. [Figures and typos] Figure 4's axes are not described in the text (which benchmark set does 'average ASR' cover?), and the abstract/body contain spacing artifacts such as 'V anguard' and 'JANUS'/'Janus' inconsistently. Also, the model name 'qwen-3.5-122B-uncensored-stxt' appears typographical and should be verified.

Circularity Check

0 steps flagged

No significant circularity; central results rest on external benchmark evaluation.

full rationale

The paper's central claim—Vanguard reduces attack success rate across four benchmarks—is evaluated with external, benchmark-specific judges (official AgentDojo, AgentLAB, and LPS-Bench evaluators, plus ShieldAgent for Agent-SafetyBench), not with the paper's own labels or equations. The training signal is self-contained: GPT-5.5-produced labels and summaries are used to train the guard, and Eq. (6)'s anticipation reward compounds adjudication utility against those same training labels, but this is a training objective, not a benchmark prediction; no fitted parameter is renamed as a forecast. The only self-citations (TabSieve, Stable Adaptive Thinking) appear in related-work positioning and are not load-bearing for any result. The Limitations section explicitly concedes the simulation-to-deployment gap, which is a data-fidelity caveat rather than a circular step. The RQ1 'w/o Infer. Sum.' ablation may conflate loss of summary information with a prompt-format shift, but that is an experimental confound, not a definitional reduction of the kind considered here. There is no uniqueness theorem, no ansatz smuggled through self-citation, and no known result merely renamed. The derivation chain from training to evaluation is therefore not circular.

Axiom & Free-Parameter Ledger

5 free parameters · 6 axioms · 1 invented entities

The central empirical claims rest primarily on two things the reader did not pay for upstream: the fidelity of the multi-agent simulator (observations are model-generated, not real tool outputs) and the correctness of GPT-5.5-derived labels and future summaries. The math itself is standard GRPO. No new physical-like entities are postulated; the only introduced entity is the trained guard model. λA is the one parameter actually fitted, and it was tuned on the evaluation benchmarks.

free parameters (5)
  • λA (anticipation reward mixing weight, Eq. 6) = 0.5
    Selected as the value giving 'the best overall safety–utility trade-off' in Figure 4, a sensitivity sweep run on the same evaluation benchmarks used in the main table; this is in-sample selection on the test benchmarks.
  • η (adjudication objective weight, Eq. 9) = not reported
    Relative weight of the two GRPO losses in the joint objective; the value is not given in the manuscript.
  • λD (adjudication label-vs-format weight, Eq. 4) = not reported
    Mixes label correctness and format validity in the adjudication reward; unstated.
  • GA, GD (anticipation/adjudication sample counts, Eqs. 2-3) = not reported
    Number of future summaries and adjudication rollouts per training sample; not specified.
  • GRPO regularization coefficients (KL, temperature) = not reported
    Standard GRPO hyperparameters needed to reproduce training are not reported.
axioms (6)
  • domain assumption Simulated trajectories without real tool execution are representative of deployment risk distributions
    Trajectory Synthesis builds observations from a Simulator conditioned on tool schema and call arguments; no real APIs are executed. The paper's own Limitations admits this may not capture real tool behavior distributions.
  • ad hoc to paper GPT-5.5 annotations (labels y and future summaries s) are correct ground truth
    Step-Level Annotation states 'All annotations are produced by GPT-5.5.' No human verification or agreement study is reported; both the adjudication reward (label correctness) and the anticipation reward (summary similarity) are defined against these annotations.
  • domain assumption Bidirectional NLI-based similarity is a valid measure of future-summary consistency
    Sim(Sk, s) uses NLI-based similarity (Laban et al. 2022; Zha et al. 2023); the fidelity term of the anticipation reward assumes this score tracks true consistency with the future continuation.
  • standard math GRPO group-relative advantage estimation is valid for this two-task shared-policy objective
    Equations 7-9 follow Shao et al. 2024; standard RL tooling adopted from the literature.
  • domain assumption The three-way label protocol with block-only-on-unsafe is an appropriate intervention policy
    Inference treats potential_unsafe as non-blocking; the safe/unsafe/potential_unsafe boundary is model-defined and all benchmark ASR numbers inherit this protocol.
  • domain assumption Benchmark evaluators (ShieldAgent judge, official AgentDojo/LPS-Bench evaluators) validly measure attack success
    Experimental Setup: Agent-SafetyBench ASR uses the ShieldAgent judge and LPS-Bench uses the official PASS/FAIL evaluator; reported ASR inherits those judges' errors.
invented entities (1)
  • Vanguard guard model independent evidence
    purpose: Blocks unsafe actions based on an anticipated future summary generated from a partial trajectory at each step.
    A trained artifact rather than a postulated physical entity; its falsifiable handles are the benchmark ASR/utility numbers in Tables 1-3, which any re-implementation can measure.

pith-pipeline@v1.3.0-alltime-deepseek · 16174 in / 18891 out tokens · 173163 ms · 2026-08-01T11:19:06.068839+00:00 · methodology

0 comments
read the original abstract

Agent safety is moving from content moderation toward preventing operational failures before tool-using agents act. We propose Janus, a foresight-oriented framework for long-horizon agent safety that trains guards to anticipate delayed risks from partial trajectories. Janus synthesizes diverse agent trajectories via multi-agent simulation and learns a shared policy with two coupled tasks: an anticipation task that forecasts safety-relevant futures and an adjudication task that decides safety from both the observed prefix and anticipated future. The two tasks are jointly optimized with CoAA-RL, which rewards forecasts by their utility for downstream safety judgment. The resulting guard model, Vanguard, blocks unsafe actions before execution. Across four agent-safety benchmarks, Vanguard improves average protection by 15.9 percentage points over baseline guards while increasing benign task completion by 5.1 percentage points.

Figures

Figures reproduced from arXiv: 2607.19913 by Lijun Li, Linji Hao, Shizhu He, Yequan Wang, Yuan Xiong.

Figure 1
Figure 1. Figure 1: Predictive vs. reactive guard. (a) A reactive guard [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Simulation-based data construction forJanus. (a) Risk taxonomy: training samples are organized by user-, environment- , and agent-originated risks. (b) Scenario construction: a manager dispatches specialized agents to generate instructions, tool schemas, evaluation criteria, and optional environment-injection strategies. (c) Trajectory synthesis: an executor and simulator roll out agent trajectories, while… view at source ↗
Figure 3
Figure 3. Figure 3: Coupled Anticipation and Adjudication Reinforcement Learning ( [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Sensitivity to the anticipation reward weight [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

54 extracted references · 20 linked inside Pith

  1. [1]

    arXiv preprint arXiv:2312.06674 , year=

    Llama guard: Llm-based input-output safeguard for human-ai conversations , author=. arXiv preprint arXiv:2312.06674 , year=

    Pith/arXiv arXiv

  2. [2]

    Advances in neural information processing systems , volume=

    Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms , author=. Advances in neural information processing systems , volume=

  3. [3]

    arXiv preprint arXiv:2407.21772 , year=

    Shieldgemma: Generative ai content moderation based on gemma , author=. arXiv preprint arXiv:2407.21772 , year=

    Pith/arXiv arXiv

  4. [4]

    arXiv preprint arXiv:2412.07724 , year=

    Granite guardian , author=. arXiv preprint arXiv:2412.07724 , year=

    Pith/arXiv arXiv

  5. [5]

    arXiv preprint arXiv:2504.04377 , year=

    Polyguard: A multilingual safety moderation tool for 17 languages , author=. arXiv preprint arXiv:2504.04377 , year=

    Pith/arXiv arXiv

  6. [6]

    arXiv preprint arXiv:2510.14276 , year=

    Qwen3guard technical report , author=. arXiv preprint arXiv:2510.14276 , year=

    Pith/arXiv arXiv

  7. [7]

    0: A diverse ai safety dataset and risks taxonomy for alignment of llm guardrails , author=

    Aegis2. 0: A diverse ai safety dataset and risks taxonomy for alignment of llm guardrails , author=. Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) , pages=

    2025

  8. [8]

    Advances in Neural Information Processing Systems , volume=

    Polyguard: Massive multi-domain safety policy-grounded guardrail dataset , author=. Advances in Neural Information Processing Systems , volume=

  9. [9]

    arXiv preprint arXiv:2501.18492 , year=

    Guardreasoner: Towards reasoning-based llm safeguards , author=. arXiv preprint arXiv:2501.18492 , year=

    arXiv

  10. [10]

    Advances in Neural Information Processing Systems , volume=

    Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents , author=. Advances in Neural Information Processing Systems , volume=

  11. [11]

    Findings of the Association for Computational Linguistics: ACL 2024 , pages=

    Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents , author=. Findings of the Association for Computational Linguistics: ACL 2024 , pages=

    2024

  12. [12]

    International Conference on Learning Representations , volume=

    Agentharm: A benchmark for measuring harmfulness of llm agents , author=. International Conference on Learning Representations , volume=

  13. [13]

    arXiv preprint arXiv:2505.03574 , year=

    Llamafirewall: An open source guardrail system for building secure ai agents , author=. arXiv preprint arXiv:2505.03574 , year=

    Pith/arXiv arXiv

  14. [14]

    arXiv preprint arXiv:2510.09781 , year=

    Building a Foundational Guardrail for General Agentic Systems via Synthetic Data , author=. arXiv preprint arXiv:2510.09781 , year=

    arXiv

  15. [15]

    Advances in Neural Information Processing Systems , volume=

    Agentauditor: Human-level safety and security evaluation for llm agents , author=. Advances in Neural Information Processing Systems , volume=

  16. [16]

    arXiv preprint arXiv:2406.09187 , year=

    Guardagent: Safeguard llm agents by a guard agent via knowledge-enabled reasoning , author=. arXiv preprint arXiv:2406.09187 , year=

    Pith/arXiv arXiv

  17. [17]

    arXiv preprint arXiv:2503.22738 , year=

    Shieldagent: Shielding agents via verifiable safety policy reasoning , author=. arXiv preprint arXiv:2503.22738 , year=

    arXiv

  18. [18]

    Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    Agrail: A lifelong agent guardrail with effective and adaptive safety detection , author=. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

  19. [19]

    arXiv preprint arXiv:2601.18491 , year=

    AgentDoG: A Diagnostic Guardrail Framework for AI Agent Safety and Security , author=. arXiv preprint arXiv:2601.18491 , year=

    Pith/arXiv arXiv

  20. [20]

    arXiv preprint arXiv:2601.10156 , year=

    ToolSafe: Enhancing Tool Invocation Safety of LLM-based agents via Proactive Step-level Guardrail and Feedback , author=. arXiv preprint arXiv:2601.10156 , year=

    arXiv

  21. [21]

    arXiv preprint arXiv:2602.01725 , year=

    SafePred: A Predictive Guardrail for Computer-Using Agents via World Models , author=. arXiv preprint arXiv:2602.01725 , year=

    arXiv

  22. [22]

    International Conference on Learning Representations , volume=

    Agent security bench (asb): Formalizing and benchmarking attacks and defenses in llm-based agents , author=. International Conference on Learning Representations , volume=

  23. [23]

    arXiv preprint arXiv:2605.13631 , year=

    ProjGuard: Safety Monitoring for Computer-Use Agents via Low-Dimensional Projections , author=. arXiv preprint arXiv:2605.13631 , year=

    Pith/arXiv arXiv

  24. [24]

    arXiv preprint arXiv:2602.08412 , year=

    From assistant to double agent: Formalizing and benchmarking attacks on openclaw for personalized local ai agent , author=. arXiv preprint arXiv:2602.08412 , year=

    arXiv

  25. [25]

    arXiv preprint arXiv:2604.14228 , year=

    Dive into Claude Code: The Design Space of Today's and Future AI Agent Systems , author=. arXiv preprint arXiv:2604.14228 , year=

    Pith/arXiv arXiv

  26. [26]

    arXiv preprint arXiv:2509.21891 , year=

    Agentpack: A dataset of code changes, co-authored by agents and humans , author=. arXiv preprint arXiv:2509.21891 , year=

    arXiv

  27. [27]

    arXiv preprint arXiv:2107.03374 , year=

    Evaluating large language models trained on code , author=. arXiv preprint arXiv:2107.03374 , year=

    Pith/arXiv arXiv

  28. [28]

    Frontiers of Computer Science , volume=

    A survey on large language model based autonomous agents , author=. Frontiers of Computer Science , volume=. 2024 , publisher=

    2024

  29. [29]

    arXiv preprint arXiv:2402.04249 , year=

    Harmbench: A standardized evaluation framework for automated red teaming and robust refusal , author=. arXiv preprint arXiv:2402.04249 , year=

    Pith/arXiv arXiv

  30. [30]

    Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V

    Benchmarking and defending against indirect prompt injection attacks on large language models , author=. Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 1 , pages=

  31. [31]

    arXiv preprint arXiv:2404.13208 , year=

    The instruction hierarchy: Training llms to prioritize privileged instructions , author=. arXiv preprint arXiv:2404.13208 , year=

    Pith/arXiv arXiv

  32. [32]

    arXiv preprint arXiv:2412.14470 , year=

    Agent-safetybench: Evaluating the safety of llm agents , author=. arXiv preprint arXiv:2412.14470 , year=

    Pith/arXiv arXiv

  33. [33]

    arXiv preprint arXiv:2602.16901 , year=

    Agentlab: Benchmarking llm agents against long-horizon attacks , author=. arXiv preprint arXiv:2602.16901 , year=

    arXiv

  34. [34]

    arXiv preprint arXiv:2602.03255 , year=

    LPS-Bench: Benchmarking Safety Awareness of Computer-Use Agents in Long-Horizon Planning under Benign and Adversarial Scenarios , author=. arXiv preprint arXiv:2602.03255 , year=

    arXiv

  35. [35]

    Advances in neural information processing systems , volume=

    Camel: Communicative agents for" mind" exploration of large language model society , author=. Advances in neural information processing systems , volume=

  36. [36]

    Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    Synthesizing post-training data for llms through multi-agent simulation , author=. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

  37. [37]

    Advances in neural information processing systems , volume=

    Judging llm-as-a-judge with mt-bench and chatbot arena , author=. Advances in neural information processing systems , volume=

  38. [38]

    The Innovation , year=

    A survey on llm-as-a-judge , author=. The Innovation , year=

  39. [39]

    arXiv preprint arXiv:2210.03629 , year=

    React: Synergizing reasoning and acting in language models , author=. arXiv preprint arXiv:2210.03629 , year=

    Pith/arXiv arXiv

  40. [40]

    Transactions of the Association for Computational Linguistics , volume=

    SummaC: Re-visiting NLI-based models for inconsistency detection in summarization , author=. Transactions of the Association for Computational Linguistics , volume=. 2022 , publisher=

    2022

  41. [41]

    Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    AlignScore: Evaluating factual consistency with a unified alignment function , author=. Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

  42. [42]

    arXiv preprint arXiv:2402.03300 , year=

    Deepseekmath: Pushing the limits of mathematical reasoning in open language models , author=. arXiv preprint arXiv:2402.03300 , year=

    Pith/arXiv arXiv

  43. [43]

    arXiv preprint arXiv:2505.09388 , year=

    Qwen3 technical report , author=. arXiv preprint arXiv:2505.09388 , year=

    Pith/arXiv arXiv

  44. [44]

    arXiv preprint arXiv:2407.21783 , year=

    The llama 3 herd of models , author=. arXiv preprint arXiv:2407.21783 , year=

    Pith/arXiv arXiv

  45. [45]

    2024 , note =

    Sandwich Defense , author =. 2024 , note =

    2024

  46. [46]

    arXiv preprint arXiv:2602.11700 , year=

    Tabsieve: Explicit in-table evidence selection for tabular prediction , author=. arXiv preprint arXiv:2602.11700 , year=

    arXiv

  47. [47]

    arXiv preprint arXiv:2602.22556 , year=

    Stable adaptive thinking via advantage shaping and length-aware gradient regulation , author=. arXiv preprint arXiv:2602.22556 , year=

    arXiv

  48. [48]

    arXiv preprint arXiv:2507.05248 , year=

    Response attack: Exploiting contextual priming to jailbreak large language models , author=. arXiv preprint arXiv:2507.05248 , year=

    arXiv

  49. [49]

    arXiv preprint arXiv:2507.02844 , year=

    Visual contextual attack: Jailbreaking mllms with image-driven context injection , author=. arXiv preprint arXiv:2507.02844 , year=

    arXiv

  50. [50]

    arXiv preprint arXiv:2512.02973 , year=

    Contextual Image Attack: How Visual Context Exposes Multimodal Safety Vulnerabilities , author=. arXiv preprint arXiv:2512.02973 , year=

    arXiv

  51. [51]

    Advances in Neural Information Processing Systems , volume =

    Training Language Models to Follow Instructions with Human Feedback , author =. Advances in Neural Information Processing Systems , volume =

  52. [52]

    arXiv preprint arXiv:2212.08073 , year=

    Constitutional ai: Harmlessness from ai feedback , author=. arXiv preprint arXiv:2212.08073 , year=

    Pith/arXiv arXiv

  53. [53]

    Advances in neural information processing systems , volume=

    Direct preference optimization: Your language model is secretly a reward model , author=. Advances in neural information processing systems , volume=

  54. [54]

    arXiv preprint arXiv:2606.24597 , year=

    Qwen-AgentWorld: Language World Models for General Agents , author=. arXiv preprint arXiv:2606.24597 , year=

    Pith/arXiv arXiv