The arXiv new submissions of the past 24 to 48 hours in cs.AI, cs.LG, and cs.CL offered significantly more candidates than can fit into a digest. This contribution curates five papers from as diverse subfields as possible – training efficiency, agent safety, interpretability, error diagnosis, and memory infrastructure – each providing a comprehensible method and robust core metrics in the abstract, not mere niche applications. The common thread: Several works show that established assumptions about training effort, safety robustness, and measurement reliability of AI agents do not hold up under closer scrutiny.
Reasoning training with only 0.05 percent of all tokens
Zhishuai Liu, Xingzi Xu, and a three-member author team demonstrate with a study on extremely sparse supervision in post-training that reasoning ability in language models can be conveyed with a tiny fraction of the training signals previously thought necessary. For their method, the authors mark only one to two particularly informative tokens per solution path as the actual learning signal – together about 0.05 percent of all generated tokens – and train specifically on those, instead of weighting all tokens of a solution path equally as has been customary. Tested on nine different teacher-student configurations as well as on math and programming tasks with Llama models and a PPO-based reinforcement learning, the frugal method reportedly achieves the same or better performance in most cases as full token training. This matters because post-training of language models has so far been considered data- and compute-intensive, and such a sparse approach could lower the costs for subsequent reasoning training, should the findings be confirmed on a larger scale.
Prompt injection as a search problem: More attacker computing power, more success
Duong M. Nguyen, Joon Sik Kim, and a two-member author team propose with a new perspective on indirect prompt injection to treat such attacks not as a static single test but as a test-time search problem over a task-dependent attack surface. Their agent-based attacker specifically explores the environment of an AI agent and iteratively adapts its strategy, instead of using a single, pre-formulated attack text. The authors report that more computing time on the attacker’s side systematically improves both the discovery and exploitation of vulnerabilities, which is why security assessments must consider both the search process and the attacker’s computing budget in the future, rather than treating attack success as a budget-independent property. This matters because security tests for AI agents have so far mostly only examined individual, fixed attack attempts, thereby systematically underestimating a risk that grows with increasing computing power. An earlier security contribution had already shown how a data theft command could be split across three seemingly harmless channels using prepared MCP tools to bypass protection mechanisms – the new study provides a more systematic framework that understands such attack strategies as a searchable space rather than as isolated cases.
A single direction determines refusal – across architectures
Preethi Carmel Bosco and Gopalakrishnan Srinivasan show with a study on the localization of refusal behavior that the willingness of a language model to reject a harmful request can be traced back to a single internal direction in the representation space across different architectures – and that this direction can be transferred between models. With a single rigid rotation, the authors align the representation space of one model with that of another, so that a harm content detector trained on transformer architectures also works reliably in state-space models. If the identified direction is removed, the model reportedly responds to attacks it would otherwise reject, while removing a random direction of the same size shows significantly weaker effects; the approach was tested on four different architecture families, including against attackers who specifically adapt their prompts against the defense. This matters because security filters have so far mostly been developed for a single architecture, while new, non-transformer-based language models are becoming increasingly widespread. An earlier digest contribution had already shown that security training could be bypassed in 93 percent of attempts with ASCII art disguised as art criticism in one of eleven tested models – the new study seeks an architecture-independent countermeasure for exactly such circumvention attempts.
DCFA detects deep-seated error causes in AI agent teams
Zehao Wang, Lanjun Wang, and a three-member author team present DCFA, a training-free method that aims to determine the cause of a failed run in a multi-agent AI system more precisely than previous approaches. Previous assignment methods often captured only superficial deviations such as incomplete data retrievals or formatting errors, while the actual, deeper error cause remained undetected, according to the authors. DCFA combines a global module that builds a structured, causally inspired dependency graph of the entire agent run with a local module that refines the assignment at individual steps through counterfactual considerations; across six different language models and the Who&When benchmark, the method improves the step-accurate hit rate by up to 8.27 percentage points compared to the previous best. This matters because companies are increasingly deploying multi-agent systems, where a single failure often only becomes visible after many steps, and the actual cause is hardly identifiable without systematic assignment. An earlier digest contribution had already shown that 41 different agent error types can be categorized with high agreement among human reviewers based on whether the model, harness, or environment is responsible – DCFA now provides an automated method that is supposed to take over this assignment without human reviewers.
KVMem packs millions of tokens into agent memory on a consumer GPU
Di Chai, Leye Wang, and a three-member author team present KVMem, a system that allows long-running AI agents to access a work history of up to one million tokens without losing fine-grained execution details or repeatedly re-reading already processed context. Instead of compressing older context contents into text summaries like previous systems, KVMem maintains the internal key-value state (KV-cache) of the model across GPU memory, RAM, and NVMe storage, and selectively chooses the relevant historical blocks for the current request with a lightweight, model-specific attention index. On the DeepSWE benchmark, the success rate increases from 43.8 to 48.4 percent compared to pure compression, and the system processes historical data of up to one million tokens on a consumer GPU with 24 gigabytes of memory (RTX 5090 Laptop) – four times the native 256,000-token context window of the tested Qwen models. This matters because long-running AI agents often fail precisely at this boundary between memory requirements and available context window in practice, and KVMem shows that the problem can also be solved without expensive data center hardware. An earlier digest contribution had already shown that a separate memory agent actively decides when a stored memory is actually needed in long-running AI agents, thus increasing the success rate by 6.8 to 8.3 percentage points – KVMem addresses the related but technically different problem of how such memories can be stored efficiently.
None of the five presented works has yet gone through a regular peer review process; all are unrefereed arXiv preprints, whose numbers come from the experiments of the respective author teams and have not yet been externally replicated. Whether the frugal training method also proves effective with larger models and more complex tasks, whether the architecture-independent refusal control holds up against more sophisticated attacks, and whether DCFA and KVMem also remain valid outside the tested benchmarks must first be demonstrated by independent replications.
