Pith. sign in

REVIEW 4 major objections 5 minor 38 references

DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read DreamGuard uses a small world model to catch agent risks before execution.

desk verdict A solid, well-evaluated guardrail paper whose core mechanism holds up, but whose abstract overstates results and whose 'zero-shot' framing is complicated by feature-layer selection. read the letter →

arxiv 2608.05695 v1 pith:2USEDLUV submitted 2026-08-06 cs.AI cs.CLcs.CR

Wenhao Lin , Chenyu Yu , Xingwei Lin , Sicong Cao , Xiang Chen , Lei Xue , Le Yu , Letian Sha
show 1 more author
Chunming Wu
This is my paper · ORCID
classification cs.AIcs.CLcs.CR
keywords LLMagentsafetyruntimeguardrailsworldmodelsrisk-awarelatentdynamicslong-horizonriskrecurrentstate-spacesplit-conformalcalibrationtool-useagents
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

DreamGuard claims that a lightweight risk-aware world model can serve as a runtime guardrail for LLM agents, detecting both immediate hazards and risks that accumulate slowly over many steps before a proposed action executes. The paper's diagnosis is that existing guardrails are largely reactive: they judge whether the current action looks safe without modeling how risk evolves across a trajectory. DreamGuard instead maintains a compact recurrent latent state over the interaction history, predicts the successor latent state for each proposed action, and reads out two complementary scores from that prediction: an immediate-hazard score and a prefix-risk score. A calibrated fusion rule then turns these scores into PASS, HOLD, or BLOCK decisions before execution. If the claim holds, a small model running at about 25 ms per call can outperform guardrails that spend seconds on LLM reasoning, while intervening before the first hazardous action in most long-horizon unsafe trajectories.

What carries the argument

The load-bearing object is the risk-aware world model: a recurrent state-space model with a gated recurrent unit (GRU) transition that maintains a fixed-dimensional deterministic state $h_t$ and a factorized categorical stochastic state $z_t$, trained to produce a predicted successor state $\hat{s}_{t+1}=(h_{t+1},\hat{z}_{t+1})$ before the proposed action executes. Two predictors read out of that successor state: an immediate-hazard predictor $g^{\mathrm{haz}}_\theta$ and a prefix-risk predictor $g^{\mathrm{pre}}_\theta$. The fusion identity is $S_t=\mathrm{NoisyOr}(p^{\mathrm{haz}}_t,p^{\mathrm{ema}}_t,p^{\mathrm{win}}_t)$, which combines the per-step hazard score with temporally aggregated prefix-risk evidence, and the intervention rule $I(p^{\mathrm{haz}}_t,S_t)$ that BLOCKs when $p^{\mathrm{haz}}_t\ge\lambda_{\mathrm{block}}$ and HOLDs when $S_t\ge\lambda_{\mathrm{hold}}$. What makes the mechanism work is the two-stage training: risk supervision reshapes the latent dynamics so the predicted state retains evidence of accumulating risk, while the thresholds are calibrated from the maximum fused scores over safe trajectories.

What would settle it

Take the SafetyDrift-calibrated checkpoint and run it, without recalibration, on a benchmark whose tool schemas, instruction styles, and hazard types are absent from SafetyDrift (for instance, a financial-transaction or multi-user collaboration environment), then check whether safety rate and false positive rate stay in the reported ranges; a sharp FPR jump or SR collapse would show the transfer is distribution-bound.

Watch

Extended reading notes

Core claim

On the paper's own terms, DreamGuard's central discovery is that latent dynamics trained to preserve evidence of hazardous transitions—not to reconstruct raw observations—are what make proactive guardrailing both cheap and effective. The world model is trained in two stages: an unsupervised stage learns recurrent latent dynamics from trajectories, and a risk-supervised stage shapes the predicted successor latent state with immediate-hazard labels and decayed prefix-risk targets that mark precursor steps within a fixed horizon before the first hazard. At runtime, the model predicts the successor latent state, extracts immediate-hazard and prefix-risk scores, aggregates the latter through an exponential moving average and a sliding window, fuses them with a bounded noisy-or rule, and maps the result to HOLD or BLOCK using split-conformal thresholds calibrated on safe trajectories. The paper reports that this design yields the best safety-utility trade-off among the evaluated guardrails across SafetyDrift, AgentDojo, ASB, and ASSE-Security, with an average end-to-end latency of 25 ms per call and a pre-hazard intervention recall of 96.3% on SafetyDrift.

Load-bearing premise

Everything rests on SafetyDrift being representative: the world model is trained and the intervention thresholds are calibrated only on SafetyDrift's trajectories, and the same thresholds are then applied to the other benchmarks and the online evaluation, so if SafetyDrift's safe and unsafe trajectories look unlike the target domains, the cross-benchmark results mostly measure distribution similarity rather than general mechanism.

Editorial extensions

If this is right

  • LLM agents can be guarded in real time: a per-call latency of about 25 ms lets the guardrail sit at the action boundary without crowding out the agent's own reasoning budget.
  • Long-horizon risks become actionable early: prefix-risk evidence smoothed over time can trigger HOLD before the first hazardous action, with a reported 96.3% pre-hazard intervention recall on SafetyDrift.
  • One calibrated configuration transfers across benchmarks: thresholds fixed on SafetyDrift are applied unchanged to AgentDojo, ASB, and ASSE-Security, and the paper reports that this zero-shot transfer preserves strong safety and false-alert performance.
  • Safety and utility need not be exchanged one-for-one: in the online ASSE-Security evaluation, DreamGuard reaches 72.92% safety rate while keeping 90.38% utility, a combination the paper reports as beyond the frontier of the evaluated baselines.
  • The recurrent state preserves trajectory context without reprocessing the full history, so the method scales to long trajectories without the growing cost of LLM-based look-ahead guardrails.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension is to measure how much of the reported transfer is distribution similarity: recompute the split-conformal thresholds on a handful of safe trajectories from each target benchmark and compare FPR against the zero-shot numbers; a large drop would indicate that the method's generality is partly inherited from the calibration data.
  • The exponential decay of the prefix-risk target with distance to the first hazard step implies a sharp prediction: the fused score should rise monotonically as the trajectory approaches a hazard. Probing domains where risk accumulates non-monotonically would stress the early-warning claim.
  • Because the world model is trained only on SafetyDrift, a compositionality probe is natural: build trajectories whose early precursors resemble SafetyDrift but whose eventual hazard belongs to a novel category. Detection would suggest risk-generic latent structure; failure would suggest category-specific features.
  • The 25 ms latency number depends on the frozen encoder; substituting a smaller encoder would separate the contribution of the latent dynamics from the contribution of the embedding model.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. DreamGuard proposes a runtime guardrail for LLM agents that combines a compact GRU-based recurrent state-space world model with two risk predictors: an immediate-hazard score and a decayed prefix-risk score. The world model is pretrained on SafetyDrift, then fine-tuned with risk supervision, and its outputs are fused through an EMA/window/noisy-or scheme into calibrated PASS/HOLD/BLOCK decisions before each action executes. The paper reports evaluations on SafetyDrift, AgentDojo, ASB, and ASSE-Security, a 100-case online-style subset, ablations, a label-stability audit, repeated runs, and Wilcoxon tests. The central claim is that a guardrail trained and calibrated on SafetyDrift transfers zero-shot to other benchmarks and beats generic, reactive, and proactive baselines while keeping latency around 25 ms per call.

Significance. If the transfer result holds, the paper makes a valuable practical contribution: a lightweight world model that predicts future latent states can deliver proactive, multi-horizon risk signals at a fraction of the cost of LLM-based look-ahead guardrails. The architecture is sensible, the two-stage training is well motivated, and the experimental apparatus is unusually thorough: ablations isolate each component, the label audit quantifies annotation reliability, repeated runs report variance, and paired significance tests are performed. There is no circular derivation: the risk predictors are trained with supervision and evaluated on held-out trajectories and other benchmarks. The main unproven premise is external transfer from a single training/calibration source, and several presentational claims go beyond what the reported numbers support.

major comments (4)
  1. [Abstract; §4.2; Table 1] The abstract states that DreamGuard 'outperforms' generic, reactive, and proactive guardrail baselines, and §4.2 says it shows 'the strongest overall F1 and SR performance across all benchmarks while keeping FPR low.' This is contradicted by Table 1 on AgentDojo: AgentDoG-1.5 has F1 80.0 versus DreamGuard's 74.9 and FPR 19.6 versus 29.4. DreamGuard only has higher SR (76.9 vs 76.6), so the unqualified outperformance claim is not supported at the level stated. The abstract and §4.2 should be revised to report where DreamGuard is best, where it is second-best, and where the transferred thresholds are less favorable.
  2. [§4.1; §5; Appendix C.8 (Table 9)] The zero-shot transfer claim is load-bearing but the paper does not fully establish it. Appendix C.8 reports that the feature extraction layer was selected for 'Best SafetyDrift validation trade-off and stable external transfer,' and the word 'external' suggests target-benchmark information may have entered hyperparameter selection, which would leak target-domain knowledge into the supposedly zero-shot model. In addition, all decision thresholds are calibrated on SafetyDrift and reused unchanged on AgentDojo, ASB, and ASSE-Security, and §5 concedes that performance under substantial distribution shift could be optimized. The authors should specify exactly which quantities were selected on SafetyDrift only, whether any target-domain observations were used during selection, and provide a sensitivity analysis showing how the reported F1/SR/FPR change under recalibration to each target.
  3. [§4.4; Appendix C.5; Table 8] The 'online guardrail evaluation' claim is stronger than the evidence. The online setting is a 100-case subset of ASSE-Security running against mock tools rather than a live external environment, so the 72.92% safety rate (35 of 48 unsafe cases) and 90.38% utility rate (47 of 52 benign cases) come from a small simulated slice with no real external state. The abstract and §4.4 should describe this as a controlled mock-tool simulation, and the paper should provide exact binomial confidence intervals or a similar uncertainty quantification for the reported safety and utility rates.
  4. [§4.3; Appendix C.9; Table 10] The timing metrics PHIR and MAS are central to the claim that DreamGuard intervenes before the first hazard step, but they depend on the first-hazard-step annotation. The label audit in Table 10 reports exact-step agreement as low as 79.6% on ASSE-Security and 84.9% on ASB. Because PHIR/MAS are computed from the exact boundary, the paper should report how these metrics vary when all trajectories are shifted by one step or when labels are drawn from the within-one-step agreement range, so readers can assess the robustness of the timing advantage to label noise.
minor comments (5)
  1. [§2; References; Figure 2] The main text refers to 'TS-Guard (Mou et al. 2026)' and Table 8 uses 'TS-Guard,' but the cited reference title is 'ToolSafe'; also Figure 2 uses 'AgentDOG' while the text uses 'AgentDoG.' Please unify the naming.
  2. [§4.1] It is not clear which baselines were actually trained on SafetyDrift: the sentence 'all trainable baselines use the same training data' is ambiguous because AgentDoG-1.5 is described as a released checkpoint. Please state explicitly, for each baseline, whether it was used off-the-shelf, fine-tuned, or configured with published prompts.
  3. [Table 13] Several utility rates, including DreamGuard's, are reported as 90.38±0.00 across three seeds while safety rates vary. Please explain whether the judge outputs were deterministic or whether utility was fixed by construction, and if the latter, note that the safety-utility comparison only varies along the safety axis.
  4. [Appendix C.5] The calibration level α=0.6 for the online evaluation is described without justification, and its relationship to the target false-alert level in §4.1 should be explained; a sensitivity analysis over α across benchmarks would strengthen the calibration discussion.
  5. [Figure 1] Figure 1 is dense and the recurrence structure, temporal evidence state B_t, and fusion rule are hard to follow; a simplified block diagram separating the training-time and inference-time paths would improve readability.

Circularity Check

1 steps flagged · score 2.0 of 10

No load-bearing circularity in the core derivation; the main caveat is that SafetyDrift PHIR measures nearly the same construct as the prefix-risk training target, making that headline number partly an in-distribution fit rather than independent evidence.

  1. fitted input called prediction [Section 3.3 Risk-Supervised Training (Eqs. 7-10), Section 4.3 Timing Analysis, Appendix A.2 PHIR (Eq. 20)]
    "For prefix-risk supervision, we assign a decayed positive target to precursor steps within horizon K and a target value of 1 to immediately hazardous steps: ypre i,t = {1, yhaz i,t = 1; exp(−(thaz i −t−1)/ρ), 1≤thaz i −t≤K; 0, otherwise}. ... On SafetyDrift, DreamGuard achieves the highest PHIR (96.3%) and MAS (3.63), outperforming both reactive and proactive guardrails. ... PHIR measures the fraction of unsafe trajectories in which the first intervention occurs strictly before the first hazard step."

    The soft prefix-risk label ypre is constructed directly from the annotated first hazard step thaz i, rewarding the model for emitting risk signals in the K steps before that step. The PHIR metric then counts exactly those trajectories whose first intervention occurs strictly before the first hazard step hτ. On SafetyDrift the same first-hazard annotations define both the training target and the timing metric, so the 96.3% PHIR is largely the model reproducing its own supervised early-warning signal on the training distribution. It is not a tautology because the test split is held out and thresholds are calibrated on safe trajectories, but it is an in-distribution fit result rather than independent evidence that the world model discovered long-horizon risk anticipation.

full rationale

The core derivation chain is not circular. DreamGuard's risk-aware world model is an RSSM pretrained with a successor-observation embedding objective and then supervised with BCE losses on immediate-hazard and prefix-risk labels; the risk predictors are neural readouts of the predicted successor state, and inference uses no future observations or first-hazard annotations. Held-out SafetyDrift evaluation, and especially the same-threshold cross-benchmark runs on AgentDojo, ASB, and ASSE-Security, provide independent support. There is no load-bearing self-citation, no imported uniqueness theorem, no ansatz smuggled in solely via citation, and no renaming of a known result. The one substantive caveat is that the SafetyDrift PHIR/MAS figures are aligned with the prefix-risk supervision target, so those numbers partly measure in-distribution fit; Table 9's selection basis mentioning 'stable external transfer' also slightly weakens the pure zero-shot framing, and Section 5 itself concedes that performance under substantial distribution shift could be further optimized. These are methodological caveats, not reductions of the claimed method to its inputs; the central cross-benchmark and latency claims remain self-contained and independently evaluated.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claim rests on empirical evaluation rather than derivation. The listed hyperparameters and thresholds are fitted or hand-selected and materially affect the safety-utility tradeoff. The main domain assumptions are that SafetyDrift transfers to other benchmarks and that human-annotated step-level hazard boundaries are reliable. No new physical entities are invented.

free parameters (5)
  • Prefix-risk horizon K = 3
    Chosen from {2,3} based on SafetyDrift validation early-warning recall/FPR (Table 9). Directly sets which precursor steps receive nonzero training labels in Eq. 7.
  • Prefix-risk decay temperature rho = 1.5
    Chosen from {1.0,1.5} for better prefix-risk calibration; controls how softly y_pre decays with distance to first hazard.
  • Temporal fusion weights (beta, window W, channel weights) = scheme-D grid-selected setting
    Selected on the held-out calibration split to balance early warning and false alerts (Table 9); directly sets EMA smoothing and noisy-or fusion in Eqs. 11-13.
  • Calibration thresholds lambda_hold, lambda_block = not reported; alpha=0.6 for online eval
    Split-conformal quantiles on safe calibration trajectories determine intervention behavior (Eq. 14, Appendix A.3). Values are not listed for main experiments, so the tradeoff cannot be independently reproduced.
  • Feature extraction layer = 31
    Chosen from {23,31,36} based on SafetyDrift validation and external transfer (Table 9); changes input features to all predictors.
assumptions (4)
  • domain assumption Step-level hazard annotations are accurate: the benchmark rules plus LLM prelabeling and human review identify the true earliest hazardous action (Appendix B.2, Table 10).
    All risk-supervision targets and PHIR/MAS metrics are defined with respect to the first hazard step; mislabeled boundaries would distort training labels and timing results.
  • domain assumption SafetyDrift is representative enough that a model trained and calibrated on it transfers zero-shot to AgentDojo, ASB, and ASSE-Security.
    Section 4.1 states all thresholds are calibrated on SafetyDrift and reused; Section 5 concedes distribution shift may degrade performance.
  • domain assumption Frozen Qwen3-4B embeddings from layer 31 contain sufficient semantic information about task, observation, and action for risk prediction.
    The encoder is frozen; all latent risk representations are derived from these embeddings (Appendix C.1).
  • ad hoc to paper A compact GRU state can summarize trajectory context for long-horizon risk without forgetting or overfitting.
    This is the core architectural bet; there is no formal guarantee, only ablation support on ASSE-Security.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model." pith.science (2026). https://pith.science/paper/2USEDLUV

@misc{pith2026260805695,
  author       = {Pith},
  title        = {Pith review of: DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2USEDLUV}},
  note         = {Machine review of arXiv:2608.05695}
}
read the original abstract

As large language model (LLM) agents increasingly invoke external tools and interact with real-world systems, unsafe actions may cause irreversible consequences on external states, user data, and downstream services. Recent runtime guardrails mitigate such risks by checking proposed actions before execution, but many remain reactive: they primarily assess the apparent safety of the current action, lacking an explicit model of how risk evolves across the trajectory. This limitation creates a critical blind spot for long-horizon risks, where individually benign-looking actions can gradually drift the agent toward hazardous states. In response, we propose DreamGuard, a proactive guardrail for LLM agents built around a risk-aware world model. The world model maintains a compact recurrent latent state over the trajectory and predicts future latent states from which DreamGuard derives immediate-hazard and prefix-risk evidence. It then fuses these multi-horizon signals into intervention decisions before execution. Experiments across four benchmarks and an online guardrail evaluation show that DreamGuard outperforms generic, reactive, and proactive guardrail baselines, achieves the best safety-utility trade-off among evaluated guardrails, and maintains an average end-to-end latency of 25 ms per call.

Figures

Figures reproduced from arXiv: 2608.05695 by the authors.

Figure 1
Figure 1. Overview of DreamGuard. (1) Risk-aware World Model: encodes the trajectory prefix and proposed action into a recurrent latent state, predicts the successor latent state, and produces immediate-hazard and prefix-risk scores. (2) Multi-horizon Risk Estimation: aggregates temporal risk evidence and applies a calibrated intervention rule to output a runtime decision before action execution. oi,t denotes the current envi… view at source ↗
Figure 2
Figure 2. Defense performance comparison in the online [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

38 extracted references · 23 canonical work pages

  1. [1]

    Llama Guard:

    Inan, Hakan and Upasani, Kartikeya and Chi, Jianfeng and Rungta, Rashi and Iyer, Krithika and Mao, Yuning and Tontchev, Michael and Hu, Qing and Fuller, Brian and Testuggine, Davide and Khabsa, Madian , year =. Llama Guard:. 2312.06674 , archivePrefix =

    arXiv

  2. [2]

    2025 , howpublished =

    2025

  3. [3]

    Han, Seungju and Rao, Kavel and Ettinger, Allyson and Jiang, Liwei and Lin, Bill Yuchen and Lambert, Nathan and Choi, Yejin and Dziri, Nouha , booktitle =

    work page

  4. [4]

    Xiang, Zhen and Zheng, Linzhi and Li, Yanjie and Hong, Junyuan and Li, Qinbin and Xie, Han and Zhang, Jiawei and Xiong, Zidi and Xie, Chulin and Yang, Carl and Song, Dawn and Li, Bo , booktitle =

    work page

  5. [5]

    Chen, Zhaorun and Kang, Mintong and Li, Bo , booktitle =

    work page

  6. [6]

    Proceedings of the 43rd International Conference on Machine Learning (ICML) , year =

    Learning Efficient Guardrails for Compliance , author =. Proceedings of the 43rd International Conference on Machine Learning (ICML) , year =

    work page

  7. [7]

    Luo, Weidi and Dai, Shenghong and Liu, Xiaogeng and Banerjee, Suman and Sun, Huan and Chen, Muhao and Xiao, Chaowei , booktitle =

    work page

  8. [8]

    Cong, Jingyue and Qiao, Xinyuan and Dong, Yulin and Huang, Yueheng and Yu, Yang and He, Estrid and Song, Andy , booktitle =

    work page

Show all 38 references
  1. [9]

    Mou, Yutao and Xue, Zhangchi and Li, Lijun and Liu, Peiyang and Zhang, Shikun and Ye, Wei and Shao, Jing , booktitle =

  2. [10]

    2601.18491 , archivePrefix =

    Liu, Dongrui and Ren, Qihan and Qian, Chen and Shao, Shuai and Xie, Yuejin and Li, Yu and Yang, Zhonghao and Luo, Haoyu and Wang, Peng and Liu, Qingyu and Hu, Binxin and Tang, Ling and Mei, Jilin and Guo, Dadi and Yuan, Leitao and Yang, Junyao and Chen, Guanxu and Lin, Qihao a...

    arXiv

  3. [11]

    2605.29801 , archivePrefix =

    Liu, Dongrui and Li, Yu and Yang, Zhonghao and Wang, Peng and Chen, Guanxu and Xie, Yuejin and Mao, Qinghua and Qu, Wanying and Zhu, Yanxu and Zhou, Tianyi and Yuan, Leitao and Zheng, Zhijie and Lin, Qihao and Wang, Yimin and Luo, Haoyu and Shao, Shuai and Qian, Chen and Liu, ...

    arXiv

  4. [12]

    , year =

    Miculicich, Lesly and Parmar, Mihir and Palangi, Hamid and Dvijotham, Krishnamurthy Dj and Montanari, Mirko and Pfister, Tomas and Le, Long T. , year =. 2510.05156 , archivePrefix =

  5. [13]

    2508.04010 , archivePrefix =

    Chen, Yurun and Hu, Xavier and Liu, Yuhan and Yin, Keting and Li, Juncheng and Zhang, Zhuosheng and Zhang, Shengyu , year =. 2508.04010 , archivePrefix =

    arXiv

  6. [14]

    2603.27148 , archivePrefix =

    Dhodapkar, Aditya and Pishori, Farhaan , year =. 2603.27148 , archivePrefix =

  7. [15]

    Advances in Neural Information Processing Systems 37 (NeurIPS 2024), Datasets and Benchmarks Track , pages =

    Debenedetti, Edoardo and Zhang, Jie and Balunovic, Mislav and Beurer-Kellner, Luca and Fischer, Marc and Tram. Advances in Neural Information Processing Systems 37 (NeurIPS 2024), Datasets and Benchmarks Track , pages =

    2024

  8. [16]

    Zhang, Hanrong and Huang, Jingyuan and Mei, Kai and Yao, Yifei and Wang, Zhenting and Zhan, Chenlu and Wang, Hongwei and Zhang, Yongfeng , booktitle =

  9. [17]

    Luo, Hanjun and Dai, Shenyu and Ni, Chiming and Li, Xinfeng and Zhang, Guibin and Wang, Kun and Liu, Tongliang and Salam, Hanan , booktitle =

  10. [18]

    and Wei, Jiali and Sun, Jun , year =

    Wang, Haoyu and Poskitt, Christopher M. and Wei, Jiali and Sun, Jun , year =. 2508.00500 , archivePrefix =

    arXiv

  11. [19]

    2602.01725 , archivePrefix =

    Chen, Yurun and Liao, Zeyi and Yin, Ping and Xie, Taotao and Yin, Keting and Zhang, Shengyu , year =. 2602.01725 , archivePrefix =

  12. [20]

    2605.27690 , archivePrefix =

    Li, Jiaqian and Li, Yanshu and Zhang, Boxuan and Tang, Ruixiang and Huang, Kuan-Hao , year =. 2605.27690 , archivePrefix =

    arXiv

  13. [21]

    Proceedings of the 36th International Conference on Machine Learning (ICML) , pages =

    Learning Latent Dynamics for Planning from Pixels , author =. Proceedings of the 36th International Conference on Machine Learning (ICML) , pages =

  14. [22]

    Nature , volume =

    Mastering diverse control tasks through world models , author =. Nature , volume =

  15. [23]

    Hansen, Nicklas and Su, Hao and Wang, Xiaolong , booktitle =

  16. [24]

    Gu, Yu and Zhang, Kai and Ning, Yuting and Zheng, Boyuan and Gou, Boyu and Xue, Tianci and Chang, Cheng and Srivastava, Sanjari and Xie, Yanan and Qi, Peng and Sun, Huan and Su, Yu , journal =. Is Your

  17. [25]

    International Conference on Learning Representations (ICLR 2025) , pages =

    Web Agents with World Models: Learning and Leveraging Environment Dynamics in Web Navigation , author =. International Conference on Learning Representations (ICLR 2025) , pages =

    2025

  18. [26]

    Wang, Lichao and Ren, ZhaoXing and Yang, Tianzhuo and Ji, Jiaming and Liu, Chi Harold and Yang, Yaodong and Dai, Juntao , booktitle =

  19. [27]

    2604.17562 , archivePrefix =

    Liu, Hailin and Ilyushin, Eugene and Ni, Jie and Zhu, Min , year =. 2604.17562 , archivePrefix =

    arXiv

  20. [28]

    Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (EMNLP) , pages =

    Reasoning with Language Model is Planning with World Model , author =. Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (EMNLP) , pages =

    2023

  21. [29]

    and Hashimoto, Tatsunori , booktitle =

    Ruan, Yangjun and Dong, Honghua and Wang, Andrew and Pitis, Silviu and Zhou, Yongchao and Ba, Jimmy and Dubois, Yann and Maddison, Chris J. and Hashimoto, Tatsunori , booktitle =. Identifying the Risks of

  22. [30]

    Foundations and Trends in Privacy and Security , volume =

    Safety at Scale: A Comprehensive Survey of Large Model and Agent Safety , author =. Foundations and Trends in Privacy and Security , volume =

  23. [31]

    A Survey on Trustworthy

    Yu, Miao and Meng, Fanci and Zhou, Xinyun and Wang, Shilong and Mao, Junyuan and Pang, Linsey and Chen, Tianlong and Wang, Kun and Li, Xinfeng and Zhang, Yongfeng and An, Bo and Wen, Qingsong , booktitle =. A Survey on Trustworthy

  24. [32]

    Navigating the Risks: A Survey of Security and Privacy Threats in

    Gan, Yuyou and Yang, Yong and Ma, Zhe and He, Ping and Zeng, Rui and Wang, Yiming and Li, Qingming and Zhou, Chunyi and Li, Songze and Wang, Ting and Gao, Yunjun and Wu, Yingcai and Ji, Shouling , year =. Navigating the Risks: A Survey of Security and Privacy Threats in

  25. [33]

    2605.03228 , archivePrefix =

    Wang, Yuhui and Jiang, Tanqiu and Liang, Jiacheng and Fleming, Charles and Wang, Ting , year =. 2605.03228 , archivePrefix =

    arXiv

  26. [34]

    2512.21220 , archivePrefix =

    Wang, Le and Ying, Zonghao and Yang, Xiao and Zou, Quanchen and Yin, Zhenfei and Li, Tianlin and Yang, Jian and Yang, Yaodong and Liu, Aishan and Liu, Xianglong , year =. 2512.21220 , archivePrefix =

  27. [35]

    Deng, Zehang and Guo, Yongjian and Han, Changzhou and Ma, Wanlun and Xiong, Junwu and Wen, Sheng and Xiang, Yang , journal =

  28. [36]

    Science China Information Sciences , volume =

    The Rise and Potential of Large Language Model Based Agents: A Survey , author =. Science China Information Sciences , volume =

  29. [37]

    Qin, Yujia and Liang, Shihao and Ye, Yining and Zhu, Kunlun and Yan, Lan and Lu, Yaxi and Lin, Yankai and Cong, Xin and Tang, Xiangru and Qian, Bill and Zhao, Sihan and Hong, Lauren and Tian, Runchu and Xie, Ruobing and Zhou, Jie and Gerstein, Mark and Li, Dahai and Liu, Zhiyu...

  30. [38]

    Frontiers of Computer Science , volume =

    A Survey on Large Language Model Based Autonomous Agents , author =. Frontiers of Computer Science , volume =

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.