The editorial team selects four papers from the arXiv submissions of the past 24 to 48 hours that show how far the capability and reliability of today’s AI systems currently diverge - from a fully disclosed research agent to a security-relevant merging gap to a fragile evaluation method for AI tutors. Curation was based on substance: each paper provides a traceable method and a concrete numerical result in the abstract, not just a new topic heading. The selection deliberately covers four different subfields - agent systems, security engineering, evaluation methodology, and interpretability.
Disclosed research agent achieves 87.3 percent on Humanity’s Last Exam
A team led by Yong Huang and Yulu Huang presents the DeepResearch Agent System, a fully open-source agent system for deep research, multi-step reasoning, and autonomous research tasks. The system is built on a sparse architecture with 30 billion total parameters but only 3 billion activated per token, which the authors say allows 3.2 times faster inference than dense models of equivalent scale; a dual reasoning mode combines a basic multi-step approach (ReAct) with an iterative research mode for up to 20 reasoning steps. According to the authors, the system reaches 87.3 percent on Humanity’s Last Exam, plus 85.3 percent on BrowserComp Chinese and 91.2 percent on WebWalkerQA, with 92.1 percent tool-use accuracy. This matters because the architecture, training, and inference code are fully open, making such high benchmark numbers independently verifiable - a degree of transparency that was not the focus when we covered the earlier self-verifying research agent AREX.
Security merging loses damage recognition but keeps refusal
Aarnav Choudhary, Matheus Fonseca Rocha, and colleagues test in Asymmetric Collapse in Model Merging: When Refusal Overwrites Recognition what happens when two safety-tuned variants of Gemma-3-1B-IT - one trained for harm classification, the other for jailbreak refusal - are merged using four common techniques (Linear, SLERP, TIES, DARE-TIES). The authors report that the merged models retain 81 to 85 percent jailbreak refusal rates, while harm-classification accuracy (CARES) collapses to at most 12.9 percent. The cause, they find, is that refusal fine-tuning consistently produces larger per-layer weight vectors than recognition fine-tuning, so magnitude-sensitive merging methods systematically favor refusal; the two capabilities’ task vectors are nearly orthogonal, with a cosine similarity of just 0.011. This matters because companies often want to combine safety capabilities through exactly this kind of merging - a pattern that connects to the previously reported seesaw effect when merging differently sized models, though here the trade-off runs not between general capabilities but between two complementary safety objectives.
Why AI helpfulness judges fail to catch bad tutoring
Shuyi Fan, Boyuan Deng, and colleagues examine in Rethinking LLM-Judged Helpfulness as a Pedagogy Signal: A Pre-Registered Audit Across Tutor Models, in a pre-registered study with a fixed simulated student, whether general-purpose helpfulness ratings can distinguish direct answers from genuine pedagogical guidance. Using a purpose-built pedagogy rubric, the authors achieved perfect separation between the tested teaching policies (Cliff’s delta of 1.0), while the standard helpfulness rating showed no significant difference (delta of 0.10); across different judge models, the helpfulness ranking even reversed for two of three base policies. Answer-revealing responses also consistently reduced the simulated student’s subsequent independent work across all tested cases. This matters because helpfulness ratings from an LLM acting as judge have become the default tool for evaluating tutoring systems - a blind spot that connects to the earlier digest finding on AI tutors that help too early, which focused on the tutors’ behavior itself rather than on how reliably that behavior can even be measured.
Language models often reuse the same internal interface for identical answers
SiYuan Ma, Yiqin Luo, and colleagues investigate in Hidden APIs in Language Models: Discovering Reusable Causal Interfaces from Forked Futures whether different routes to the same model answer actually rely on the same internal mechanisms. Using a method called “Forked Futures,” they compare hidden states by sampling multiple possible continuations after a shared prompt prefix, rather than relying on predefined concept labels, and distinguish four interface types (Shared, Local, Mixture, Distributed). A “Shared” interface explains the model’s answer most concisely; along it, the identified paths mediate 74.9 percent of the studied effect, versus 15.0 percent for a randomly matched control path, and a blind architecture test correctly identified 14 of 16 tested model variants. This matters because it suggests language models develop tangible, reusable internal interfaces for entire classes of tasks - a finding that connects to Anthropic’s J-Lens research on Claude’s hidden “J-space”, though that work concerned invisible thought processes rather than causally verifiable answer mechanisms.
Bottom line: all four papers are unreviewed preprints so far; their numbers come from the respective author teams’ own experiments. The research agent’s benchmark scores have not yet been independently reproduced, the merging study tests only a single 1-billion-parameter model pair, the tutoring study relies on a simulated rather than a real student, and the interface analysis remains tied to the tested model architectures and parameters. Whether these patterns hold up in production systems and independent replications remains to be seen.
