Pith. sign in

REVIEW 1 major objections 5 minor 26 references

Policy-Masked Private Experts: Auditable and Reversible Capability Access Control in Sparse MoE Models

T0 review · 1 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Private experts can be made unreachable for unauthorized requests by masking them out before top-k routing, with zero denied executions across adversarial tests.

desk verdict A narrow, well-scoped execution-control claim with unusually honest evidence; the main weakness is the software-level audit, which the authors themselves disclose. read the letter →

arxiv 2608.06690 v2 pith:XA4GOLLK submitted 2026-08-07 cs.CR cs.AIcs.LG

Zhuoheng Huang , Mukesh Singh This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords mixtureofexpertscapabilityaccesscontrolmodulenon-participationtrainingisolationsparseMoELoRAbaselineroutingaudittool-usebenchmarks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish a narrow systems claim: if a sparse mixture-of-experts language model is given a separately trained private expert pool, and trusted authorization selects between the public and private pools before top-$k$ routing, then an unauthorized request executes no private expert. The claim is deliberately separate from capability removal, since the frozen public path may still produce similar behavior and the paper makes no promise that deny removes knowledge. The reason this matters is that conventional access controls regulate model output, whereas this design regulates parameter reachability and gives an operator a deterministic, log-verifiable boundary rather than a behavioral hope. The authors test the boundary in two open MoE models, with zero unauthorized private execution across adversarial scenarios and exact recovery after allow-deny-allow, while showing that the private branch's usefulness on benchmarks varies by distribution.

What carries the argument

The load-bearing mechanism is a hard policy mask inserted before top-$k$ expert routing at selected wrapped layers. With public pool $E^{\mathrm{pub}}_{\ell}$ and private pool $E^{\mathrm{priv}}_{\ell}$, the mask sets $m_{\ell,e}(\tau)=0$ for the eligible pool and $-\infty$ for the ineligible pool, then computes top-$k$ on $z_\ell(h)+m_\ell(\tau)$; missing or malformed metadata resolves to deny, so a private index never enters the candidate set. Route logs record every selection, and independent forward hooks on the private modules check that the physical computation matches the log, converting the guarantee into an auditable serving invariant.

What would settle it

Install a kernel-level or hardware-level monitor independent of the route logger, such as memory-access tracing on the private expert weights, and issue denied requests with missing, malformed, and adversarially imitated metadata; any observed private-expert computation while $\tau=0$ would refute G1.

Watch

Extended reading notes

Core claim

The central claim on the paper's own terms is G1, module non-participation: for any request trace $T(x,\tau)$, $\tau=0$ implies $\mathrm{Exec}(T)\cap E^{\mathrm{priv}}=\emptyset$. This is a deterministic statement conditional on the trusted computing base, and it is verified from route events rather than inferred from generated text. A second claim, G2, says that training touches only the private weights, so every public parameter's fingerprint stays unchanged; a third, G3, says the private branch may improve a declared task distribution, and that is an empirical matter that can fail even when G1 holds. The experiments report all three separately: all 32 Qwen private experts received routes and gradients, deny and fail-closed events recorded zero private selections, independent hooks matched 11,616 routed rows, allow-deny-allow recovery was exact, and utility was positive on two Qwen roles and one DeepSeek role while a valid sealed benchmark was near-neutral.

Load-bearing premise

The load-bearing premise is that the masked top-$k$ router is the only execution path into the private experts and that the audit hooks observe every physical private-module invocation; if some runtime path can run private code without a logged route event, the zero-execution claim fails.

Editorial extensions

If this is right

  • Operators can treat deny as a deterministic serving invariant rather than a behavioral outcome: if route logs show zero private selections, the private branch was not part of the computation.
  • The same checkpoint can offer allow and deny arms without retraining, so upstream access changes are reversible and auditable through the allow-deny-allow protocol.
  • A request-gated adapter is not a substitute: the paper's gated LoRA left 1,225 physical adapter calls under deny, so parameter-level exclusion is what gives the clean audit surface.
  • Private training can be mixed with a frozen public model without touching public weights, giving a localized, verifiable increment.
  • Useful capability uplift does not follow automatically from the access boundary; it held on three frozen roles but not on the sealed CCTU benchmark, so deployments still need task-specific evaluation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, the mechanism suggests a multi-tier design where several mutually exclusive expert pools are keyed to different authorization levels, with route logs serving as the per-tier audit trail.
  • The strongest testable extension would combine the route-log boundary with hardware attestation or kernel-level tracing, closing the side-channel gap the paper explicitly leaves open.
  • Because the audit records every policy decision, route logs themselves become sensitive policy metadata; deployments would need access controls and retention limits on those logs, a point the paper itself flags.
  • Since the public path may already implement similar behavior, deny cannot be marketed as capability removal; a deployment evaluation should separately measure public-path leakage rather than rely on the access boundary alone.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

1 major / 5 minor

Summary. The paper proposes Policy-Masked Private Experts, a mechanism for capability access control in sparse Mixture-of-Experts language models. It freezes a pretrained MoE and trains a disjoint private expert pool at selected layers; trusted authorization metadata, never the prompt, determines a hard mask applied before top-k routing, so an authorized request sees only private experts and a denied request only public experts. The main formal claim is G1 (Eq. 1): under the declared trusted computing base, τ=0 implies no private expert executes. The paper further separates G2, isolation of the training update to the private branch, and G3, empirical capability uplift on declared task distributions. Experiments on Qwen3-30B-A3B and DeepSeek-V2-Lite report zero private selections across 96 deny/fail-closed events, independent forward hooks matching 11,616 routed private rows, exact allow–deny–allow recovery, unchanged public fingerprints across seeds, and positive utility lifts on two Qwen benchmarks and one DeepSeek suite; a sealed CCTU benchmark is valid but near-neutral. The authors frame the contribution as an auditable, reversible access boundary rather than proof of semantic knowledge removal.

Significance. If the claims hold, the paper provides a concrete, testable mechanism that addresses a real gap in LLM access control: most defenses regulate behavior while leaving the same computation available to every request, whereas Policy-Masked Private Experts make a designated parameter path physically unreachable under deny. The main security claim is narrow and falsifiable, which is a strength. The paper also models good research practice: preregistration, frozen benchmark IDs, sealed evaluation with validity gates, immutable hashes, failure ledger, clean-lock reproduction, and independent instrumentation. The design honestly separates execution control from utility and does not overclaim semantic capability removal. The route-event auditing and independent hooks are direct and go beyond refusal-based evaluation. The main risk, explicitly disclosed by the authors, is that the audit is not a kernel-level or formal proof; the guarantee is conditional on the correctness of the routing and auditing implementation. Overall, the contribution is significant for the systems/security angle of deployed MoE serving.

major comments (1)
  1. [Sec. 2.2, Eq. (1); App. F.1] The universal form of G1, "for any request trace T(x,τ), τ=0 ⇒ Exec(T) ∩ E_priv = ∅", is stronger than what the reported evidence can establish. The empirical verification covers 96 deny/fail-closed events and 11,616 routed rows under the authors' Python-level instrumentation; App. F.1 explicitly states that this is not a kernel-level or formal proof. Because the claim is the primary security endpoint, the paper should either add a stronger audit (e.g., a kernel-level or binary-level execution trace, or a formal correctness argument for the mask-to-routing step) or qualify Eq. (1) in the main text to state explicitly that the guarantee is conditional on the routing and audit instrumentation being correct and complete. The authors' disclosure in Sec. 8 is commendable, but the formal statement in Eq. (1) currently overstates the verification level. This is a load-bearing point because the abstract and introduction present G1 as the central result.
minor comments (5)
  1. [Sec. 4.1 / Sec. 5.2] The independent hook audit (931 calls, 11,616 rows) is reported for the Qwen checkpoint, but the DeepSeek arm uses torch.compile and FlashAttention-2, where Python-level nn.Module hooks may not observe fused kernels. Please clarify explicitly whether the same hook audit was applied to the DeepSeek checkpoint, and if not, state so in the evidence summary.
  2. [Sec. 2.2 / Eq. (1)] Consider adding a one-sentence condition to Eq. (1) or its surrounding text: "conditional on the trusted computing base behaving as specified." This would align the formal statement with the threat model and with the limitations stated in Sec. 8 and App. B.3.
  3. [Table 3 / Sec. 4.2] The footnote for the Gated LoRA allow row says it is a post-hoc diagnostic; please also add a footnote to the "Gated LoRA deny" results in Sec. 5.2 (1,225 calls) clarifying that the deny condition is the same post-hoc audit, or state that explicitly in the text to avoid confusion.
  4. [App. D.1] The sentence describing the projected 11.564 GPU hours versus the declared eight-hour cap is important for transparency, but it is easy to read as an unapproved extension. Please add a clause explaining that the projection was made before any adapted output and that the single permitted nested reduction to 100 records was applied before evaluation, as is later clarified.
  5. [Abstract] The abstract states "A valid sealed evaluation is near-neutral." This is accurate, but consider adding a phrase such as "with route traces supporting G1" so the reader understands that the null utility result does not undermine the access-control claim.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the masked-routing guarantee is enforced by construction and then empirically audited, with no fitted parameter renamed as a prediction and no load-bearing self-citation.

full rationale

The paper's central security claim G1 (Eq. 1) follows from the architectural construction in Eq. (4): under deny, the private pool is masked to -inf before top-k routing, so private experts cannot enter the candidate set. The paper does not derive G1 from the measured route logs; it uses logs and independent forward hooks (Sec. 5.2, App. F.1) to test that the implemented runtime actually respects the construction. This is direct empirical verification of a mechanism, not a reduction of the claim to its inputs. The utility results (G3) are evaluated against prospectively frozen benchmarks with preregistered statistics, matched adapters, and controls; no parameter is fitted to the security endpoint and then reported as a prediction. The gated-LoRA counterfactual sharpens the boundary rather than assuming it. The paper contains no load-bearing self-citation; its references are external models, datasets, and related-work methods. The disclosed limitation that the audit is not kernel-level or formally verified (App. F.1; Sec. 8) is a verification-completeness gap, not circularity: it concerns whether the observed instrumentation observes all physical execution paths, not whether the claimed guarantee is definitionally identical to the evidence. Therefore no circular step can be exhibited, and the appropriate finding is no significant circularity.

Assumptions & free parameters 1 free parameters · 4 assumptions · 1 invented entities

The central execution claim rests on TCB integrity, correct masked-routing semantics, complete audit instrumentation, and verified training isolation. These assumptions are explicit and located in the paper. The private branch is an implemented artifact rather than a postulated entity. No numerical constants are fitted to the security endpoint; the only fitted quantities are the trained weights used for the utility claim.

free parameters (1)
  • Private expert weights = 151,060,480 Qwen / 276,889,600 DeepSeek trainable weights, trained to validation losses 0.5734 and 0.9098
    The G3 utility claim depends on this trained branch. G1 and G2 do not depend on the fitted values.
assumptions (4)
  • domain assumption The trusted computing base (identity service, policy-to-mask compiler, routing implementation, manifests, cache separation, audit instrumentation) is uncompromised and behaves as declared.
    Stated in Sec. 2.1 and Appendix B.3. The adversary cannot modify the TCB, but host compromise, manifest tampering, and side channels are explicitly out of scope.
  • domain assumption Masking ineligible expert logits to -infinity before top-k routing guarantees those experts are never selected and hence never executed.
    Eq. (4) in Sec. 3.1. This depends on the top-k implementation treating -infinity as unmatchable and on absence of numerical anomalies; no formal proof is supplied.
  • domain assumption The route logger and independent forward hooks capture every physical private-expert invocation, with no hidden execution path.
    Appendix F.1 states the physical-execution audit observes module-level calls and is not a kernel-level or formal proof.
  • domain assumption Only private parameters are updated during training; public fingerprints and optimizer state verify that no public update occurred.
    G2 is an optimizer-state claim, Eq. (2), verified by fingerprints and optimizer audits rather than by the mathematical derivative being zero.
invented entities (1)
  • Disjoint private expert pool independent evidence
    purpose: Request-time gated specialist branch, trained on tool-use data and executed only when authorization resolves to allow.
    Concrete added modules with checkpoint hashes and route and hook evidence. It is not a speculative entity; it has an auditable external handle in the form of hooks, route logs, and reload checks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Policy-Masked Private Experts: Auditable and Reversible Capability Access Control in Sparse MoE Models." pith.science (2026). https://pith.science/paper/XA4GOLLK

@misc{pith2026260806690,
  author       = {Pith},
  title        = {Pith review of: Policy-Masked Private Experts: Auditable and Reversible Capability Access Control in Sparse MoE Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XA4GOLLK}},
  note         = {Machine review of arXiv:2608.06690}
}
read the original abstract

Most language-model access controls regulate behavior while leaving the same computation available to every request. We study a different systems question: can trusted authorization determine which newly trained parameters are reachable by the forward pass? Policy-Masked Private Experts freezes a pretrained sparse Mixture-of-Experts (MoE) model, trains a disjoint expert branch, and selects the public or private pool before top-k routing. The resulting claim is narrow but testable: under the declared trusted computing base (TCB), an unauthorized request executes no private expert. It does not imply that the public model lacks the same semantic capability. We test this separation between execution control and task utility in Qwen3-30B-A3B and DeepSeek-V2-Lite. Three Qwen BF16 seeds update all 32 private experts while the public fingerprint remains unchanged. Across 64 adversarial scenarios and 96 deny/fail-closed events, unauthorized private execution is zero; independent hooks exactly match 11,616 routed private rows and allow-deny-allow recovery is exact. On two prospectively frozen Qwen benchmarks, the private branch improves exact tool use by 5.0 percentage points (pp) (five versus zero discordances; one-sided Holm p = 0.03125, corresponding two-sided exact p = 0.0625) and 21.3 pp (percentile-bootstrap 95% CI [13.3, 29.3], Holm p = 0.000031). Three arm-blinded model evaluators retain a positive external effect of 18.7 pp (95% CI [9.3, 28.0]). A parameter-matched Lora has similar external utility, but a post-hoc request gate leaves 1,225 adapter calls under deny; the disjoint expert branch leaves none. DeepSeek reproduces the route invariant and gains 27.0 pp. A valid sealed evaluation is near-neutral. These results support auditable, reversible control over a trained parameter path, while showing that useful transfer remains distribution dependent.

Figures

Figures reproduced from arXiv: 2608.06690 by the authors.

Figure 1
Figure 1. Mechanism and guarantee boundary. Trusted metadata, never prompt text, selects the visible pool before routing. The optimizer updates only the added private experts; the pretrained transformer and public experts stay frozen. Deny can therefore be audited as zero private execution without claiming that the public path lacks the semantic capability. Checkpoints contain the private weights, optimizer state, source/conf… view at source ↗

Review history (3 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

26 extracted references · 14 canonical work pages

  1. [1]

    Gra- dient routing: Masking gradients to localize com- putation in neural networks, 2024

    Alex Cloud, Jacob Goldman-Wetzler, Evˇ zen Wybitul, John Miller, and Alexander Matt Turner. Gra- dient routing: Masking gradients to localize com- putation in neural networks, 2024. URL: https: //arxiv.org/abs/2410.04332, arXiv:2410.04332, doi:10.48550/arXiv.2410.04332

    arXiv doi:10.48550/arxiv.2410.04332 2024

  2. [2]

    Damai Dai, Chengqi Deng, Chenggang Zhao, R. X. Xu, Huazuo Gao, Deli Chen, Jiashi Li, Wangding Zeng, Xingkai Yu, Y. Wu, Zhenda Xie, Y. K. Li, Panpan Huang, Fuli Luo, Chong Ruan, Zhifang Sui, and Wenfeng Liang. DeepSeekMoE: Towards ul- timate expert specialization in mixture-of-experts language models. InProceedings of the 62nd An- nual Meeting of the Assoc...

    work page 2024

  3. [3]

    DeepSeek-V2: A strong, economical, and efficient mixture-of-experts language model, 2024

    DeepSeek-AI. DeepSeek-V2: A strong, economical, and efficient mixture-of-experts language model, 2024. URL: https://arxiv.org/abs/2405.04434, arXiv: 2405.04434,doi:10.48550/arXiv.2405.04434

    arXiv doi:10.48550/arxiv.2405.04434 2024

  4. [4]

    Dorothy E. Denning. A lattice model of secure infor- mation flow.Communications of the ACM, 19(5):236– 243, 1976.doi:10.1145/360051.360056

    arXiv 1976

  5. [5]

    Who’s harry potter? approximate unlearning in LLMs, 2023

    Ronen Eldan and Mark Russinovich. Who’s harry potter? approximate unlearning in LLMs, 2023. URL: https://arxiv.org/abs/2310.02238, arXiv:2310. 02238,doi:10.48550/arXiv.2310.02238

    arXiv doi:10.48550/arxiv.2310.02238 2023

  6. [6]

    Switch transformers: Scaling to trillion parameter models with simple and efficient sparsity.Journal of Machine Learning Research, 23(120):1–39, 2022

    William Fedus, Barret Zoph, and Noam Shazeer. Switch transformers: Scaling to trillion parameter models with simple and efficient sparsity.Journal of Machine Learning Research, 23(120):1–39, 2022. URL: https://jmlr.org/papers/v23/21-0998.html

    work page 2022

  7. [7]

    Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen

    Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. InInternational Con- ference on Learning Representations, 2022. URL: https://openreview.net/forum?id=nZeVKeeFYf9

    work page 2022

  8. [8]

    Llama Guard: LLM-based input- output safeguard for human-AI conversations, 2023

    Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Ma- dian Khabsa. Llama Guard: LLM-based input- output safeguard for human-AI conversations, 2023. URL: https://arxiv.org/abs/2312.06674, arXiv: 2312.06674,doi:10.48550/arXiv.2312.06674

    arXiv doi:10.48550/arxiv.2312.06674 2023

Show all 26 references
  1. [9]

    Albert Q. Jiang, Alexandre Sablayrolles, Antoine Roux, Arthur Mensch, Blanche Savary, Chris Bam- ford, Devendra Singh Chaplot, Diego de las Casas, Emma Bou Hanna, Florian Bressand, Gianna Lengyel, Guillaume Bour, Guillaume Lample, L´ elio Renard Lavaud, Lucile Saulnier, Marie-...

    2024 doi arXiv

  2. [10]

    GShard: Scaling giant models with conditional computation and automatic sharding

    Dmitry Lepikhin, HyoukJoong Lee, Yuanzhong Xu, Dehao Chen, Orhan Firat, Yanping Huang, Maxim Krikun, Noam Shazeer, and Zhifeng Chen. GShard: Scaling giant models with conditional computation and automatic sharding. InInternational Conference on Learning Representations, 2021. ...

    2021

  3. [11]

    Li, Ann- Kathrin Dombrowski, Shashwat Goel, Gabriel Mukobi, Nathan Helm-Burger, Rafiq Lababidi, Lennart Justen, Andrew B

    Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D. Li, Ann- Kathrin Dombrowski, Shashwat Goel, Gabriel Mukobi, Nathan Helm-Burger, Rafiq Lababidi, Lennart Justen, Andrew B. Liu, Michael Chen, Isabelle Barrass, Oliver Zhang, Xiaoyuan Z...

    2024

  4. [12]

    Varshney, Mohit Bansal, Sanmi Koyejo, and Yang Liu

    Sijia Liu, Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Yuguang Yao, Chris Yuhao Liu, Xiaojun Xu, Hang Li, Kush R. Varshney, Mohit Bansal, Sanmi Koyejo, and Yang Liu. Rethinking machine unlearning for large language models.Nature Machine Intel- li...

    2025 doi

  5. [13]

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul F. Christiano, Jan Leik...

    2022

  6. [14]

    Manning, and Chelsea Finn

    Rafael Rafailov, Archit Sharma, Eric Mitchell, Stefano Ermon, Christopher D. Manning, and Chelsea Finn. Direct preference optimization: Your language model is secretly a reward model. InAdvances in Neural Information Processing Systems, volume 36, pages 53728–53741, 2023

    2023

  7. [15]

    Le, Geoffrey E

    Noam Shazeer, Azalia Mirhoseini, Krzysztof Maziarz, Andy Davis, Quoc V. Le, Geoffrey E. Hinton, and Jeff Dean. Outrageously large neural networks: The sparsely-gated mixture-of-experts layer. InInter- national Conference on Learning Representations,

  8. [16]

    ToolFailBench: Diagnosing tool-use fail- ures in LLM agents, 2026

    Harsh Soni. ToolFailBench: Diagnosing tool-use fail- ures in LLM agents, 2026. URL: https://arxiv. org/abs/2607.04686, arXiv:2607.04686, doi:10. 48550/arXiv.2607.04686

    2026 doi arXiv

  9. [17]

    Lee, and G

    Trishul Tiwari, Suchin Gururangan, Chuan Guo, Weizhe Hua, Sanjay Kariyappa, Udit Gupta, Wen- jie Xiong, Kiwan Maeng, Hsien-Hsin S. Lee, and G. Edward Suh. Information flow control in machine learning through modular model architecture. In 33rd USENIX Security Symposium, pages ...

  10. [18]

    The instruc- tion hierarchy: Training LLMs to prioritize priv- ileged instructions, 2024

    Eric Wallace, Kai Xiao, Reimar Leike, Lilian Weng, Johannes Heidecke, and Alex Beutel. The instruc- tion hierarchy: Training LLMs to prioritize priv- ileged instructions, 2024. URL: https://arxiv. org/abs/2404.13208, arXiv:2404.13208, doi:10. 48550/arXiv.2404.13208

    2024 doi arXiv

  11. [19]

    Gate- Breaker: Gate-guided attacks on mixture-of-expert LLMs, 2025

    Lichao Wu, Sasha Behrouzi, Mohamadreza Rostami, Stjepan Picek, and Ahmad-Reza Sadeghi. Gate- Breaker: Gate-guided attacks on mixture-of-expert LLMs, 2025. URL: https://arxiv.org/abs/2512. 21008, arXiv:2512.21008, doi:10.48550/arXiv. 2512.21008

    2025 doi

  12. [20]

    RouteHijack: Routing-aware attack on mixture-of-experts LLMs, 2026

    Zhiyuan Xu, Joseph Gardiner, Sana Belguith, and Lichao Wu. RouteHijack: Routing-aware attack on mixture-of-experts LLMs, 2026. URL: https: //arxiv.org/abs/2605.02946, arXiv:2605.02946, doi:10.48550/arXiv.2605.02946

    2026 doi arXiv

  13. [21]

    Qwen3 technical report, 2025

    An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chen- gen Huang, Chenxu Lv, Chujie Zheng, Dayiheng Liu, Fan Zhou, Fei Huang, Feng Hu, Hao Ge, Haoran Wei, Huan Lin, Jialong Tang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, J...

    2025 doi arXiv

  14. [22]

    ToolMind technical report: A large-scale, reasoning-enhanced tool-use dataset, 2025

    Chen Yang, Ran Le, Yun Xing, Zhaozhi An, Zhen Chen, Wayne Xin Zhao, Yingqiang Song, and Tao Zhang. ToolMind technical report: A large-scale, reasoning-enhanced tool-use dataset, 2025. URL: https://arxiv.org/abs/2511.15718, arXiv:2511. 15718,doi:10.48550/arXiv.2511.15718

    2025 doi

  15. [23]

    CCTU: A benchmark for tool use under complex constraints, 2026

    Junjie Ye, Guoqiang Zhang, Wenjie Fu, Tao Gui, Qi Zhang, and Xuanjing Huang. CCTU: A benchmark for tool use under complex constraints, 2026. URL: https://arxiv.org/abs/2603.15309, arXiv:2603. 15309,doi:10.48550/arXiv.2603.15309

    2026 doi

  16. [24]

    Zhao, Andrew M

    Yanqi Zhou, Tao Lei, Hanxiao Liu, Nan Du, Yanping Huang, Vincent Y. Zhao, Andrew M. Dai, Zhifeng Chen, Quoc V. Le, and James Laudon. Mixture-of- experts with expert choice routing. InAdvances in Neural Information Processing Systems, volume 35, 2022.doi:10.52202/068431-0515. 14

    2022 doi

  17. [2017]

    URL: https://openreview.net/forum?id= B1ckMDqlg

  18. [2024]

    URL: https://www.usenix.org/conference/ usenixsecurity24/presentation/tiwari

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.