Two readings deserve priority: locating the invocation that introduced a deep-research citation error, and accounting for the SSD endurance consumed by KV-cache performance. The first turns report quality into diagnosable handoff boundaries; the second makes device wear part of placement decisions. Both expose costs hidden behind a single headline metric.
The remaining work follows three threads. Muffin and ScaleMAS change how agents share information. AgentTriage, REGATTA, and detector auditing examine the evidence behind diagnoses and evaluation labels. SARIA, MoEZip, uGDS, and OMRC address cache, storage, and interconnect constraints. Verified optimization and industrial cleanup also show that proofs, tests, and human review cover different responsibilities.
01 · Citation attribution: finding the handoff that introduced an error
Who is the Agent to Blame? Localizing Faithfulness and Citation Mistakes in Agentic Deep Research
Eran Hirsch, David Wan, Han Wang, Elias Stengel-Eskin, Mohit Bansal, Ido Dagan · 2026-08-25 · EMNLP 2026
A deep-research sentence can carry a real link without being supported by it. Searchers compress pages, researchers synthesize notes, and an orchestrator writes the report. Information and citations can change at every handoff. A final citation-recall score identifies a problem but does not tell developers whether to repair retrieval, synthesis, or report writing. Eran Hirsch and colleagues evaluate individual agent invocations against their actual inputs and outputs.
For each target sentence, the method extracts supporting spans, checks that they occur in the input, and tests whether they jointly support the claim. Insufficient support indicates hallucination. Support that depends on uncited input indicates uncited input reliance. Dropping citations from cited input produces uncited output; retaining an incomplete set produces insufficient citations. Faithfulness is local: an agent that accurately repeats an upstream mistake is not immediately identified as its origin.
First test support from the input, then citation coverage in supporting spans and the output; terminal branches distinguish error types.
System-level analysis starts with final-report sentences unsupported by original sources and recursively follows their supporting spans. It records a newly introduced error at the current invocation or continues upstream when information was faithfully passed along. This complements average error rates by agent type. Many intermediate errors may never reach the report, while a relatively reliable final orchestrator can still dominate errors visible to readers.
The authors analyze AI-Q, MS-Agent, and TrajectoryKit on 20 DeepResearch Bench examples. In AI-Q, 84.7% of confirmed final-report errors are attributed to the orchestrator; this is not the percentage of report sentences that are wrong. A separate intervention study covers all 50 English questions. Replacing researcher notes with source snippets raises citation recall from 64.5% to 69.7%; adding citation guidance raises it to 69.6%. RACE quality remains around 52.4–52.6. The interventions were evaluated separately, so their gains cannot be added.
The advance is making citation quality a component-level problem that can be diagnosed and tested. The diagnostic instrument remains imperfect: on 50 human-annotated sentences, exact agreement with adjudicated labels is 76%, with κ = 0.62. Tables are excluded. Roles also use different models, so the connection between model capability and error type is observational. Read the local decision procedure and intervention experiment first: they clarify what evidence justifies attributing an error to one invocation, without establishing an infallible causal judge.
Another useful design obtains original webpage content from execution logs rather than recrawling during evaluation. Page changes, paywalls, and crawler differences could otherwise create citation disagreements unrelated to the original run. Each system still needs adapters for inputs, outputs, and citation formats. Researchers gain an evaluation that preserves provenance and invocation boundaries together; developers need to retain intermediate evidence to make later diagnosis possible.
02 · Gandalf: making SSD endurance part of KV-cache placement
Gandalf: Flash Shall Not Die! Increasing Flash Storage Lifetime for KV Cache Offloading in LLM Serving
Maharani A. P. Irawan, Kuntai Du, Jiayi Yao, Dongjoo Seo, Yuyang Huang, Haryadi S. Gunawi, Junchen Jiang · 2026-10-22
Offloading KV cache to SSD expands reusable context but creates sustained writes. Missing cache state can be recomputed; consumed flash endurance cannot be recovered. Optimizing hits alone may persist large quantities of short-lived state. Gandalf brings the value of persistence and expected reuse into cache placement instead of relying only on generic eviction when space runs out.
The opportunity comes from heterogeneous state in hybrid-attention models. Full attention retains per-token K/V, and later conversation turns often reuse the entire prefix. Linear attention maintains recurrent checkpoints that are usually superseded after the next turn. Sliding-window state has similar short-lived reuse. If the latest checkpoint remains in DRAM until its next use, an SSD copy may add no hit at all. This motivates keeping short-lived state in memory and longer-lived prefix state on SSD.
New cache enters DRAM; memory pressure triggers a drop-versus-move comparison that includes the value of SSD entries displaced.
Strict placement by type is insufficient under capacity pressure: short sessions can fill DRAM with recurrent state, while long prefixes can exhaust SSD capacity. The online policy initially admits new cache into DRAM and compares expected recomputation from dropping state with SSD wear plus the reuse lost by replacing existing SSD entries. Historical session returns estimate future reuse; size and waiting time normalize value. The write price can also respond to a target endurance budget. Increasing α makes persistence more selective, generally trading more misses for fewer writes.
In trace simulations with Kimi-K3, 100 GB DRAM, and a 1 TB SSD, the authors compare admission and eviction policies. At α=0, Gandalf’s lowest-miss setting extends estimated lifetime by 2×, 3.3×, and 6.5× on TraceA, Claude Code, and AIPerf relative to the lowest-miss baseline on each trace. On Claude Code, its miss ratio is 0.052 versus LRU’s 0.047, with fewer writes. These conditions matter more than an isolated lifetime multiplier: the trade-off depends on workload, capacity, and recomputation cost.
The useful shift is treating cache as a consumer of device endurance as well as capacity. The authors inspect storage traces and validate simulation behavior, but lifetime is calculated from rated total writes and projected daily writes, not measured by running drives to failure. The simulator assumes write amplification of one and does not fully model garbage collection or wear leveling, potentially overstating absolute lifetime. Read this alongside SARIA: Gandalf emphasizes state type, costs, and placement; SARIA uses reuse across DRAM residencies to filter persistence and coordinates reloads. Both require latency and endurance to be evaluated together.
A reusable prefix in a hybrid model also needs all required state types at the selected boundary. Retaining full-attention state while losing a necessary recurrent checkpoint does not constitute a complete hit. Type-based placement is therefore a preference constrained by prefix dependencies and capacity. Endurance targets must accompany service objectives: expensive recomputation can offset device savings with GPU time, motivating cost comparisons instead of fixed write-back rules.
03 · Muffin: sharing findings while reasoning asynchronously
Muffin - A Shared Memory Buffer for Asynchronous AI Agents
Ping-Lin Kuo, Suman Navaratnarajah, Christian Frey, Gresa Shala, Josif Grabocka · 2026-10-22
Muffin shares findings, warnings, and intermediate results while keeping reasoning private. An orchestrator assigns roles and subtasks. At each step’s start, an agent reads the latest k findings from peers; completed steps append findings atomically. A summarizer uses agents’ final-step summaries. Execution avoids global round barriers, but late messages can miss the current read window.
The orchestrator assigns work; the buffer exchanges selected findings, and the summarizer reads final-step summaries.
Muffin leads in 17 of 20 model/task combinations across four models and five reported task columns. In the OlymMATH-Easy step sweep with gemma-4-E4B-it, final accuracy exceeds the strongest baseline by 19.2 percentage points while using 77.4% fewer tokens than debate. This is not an average across all tasks. Larger sharing windows and four or five agents do not consistently help. The evaluation centers on reasoning QA and does not establish that information sharing causes most real multi-agent failures.
04 · AgentTriage: binding diagnosis to an action lifecycle
AgentTriage: Replayable Security Diagnosis Across Heterogeneous Agent Runtimes
Jie Ying, Xutao Zhang, Ningyuan Chen, Mengce Zheng, Jun Li, Zhongjie Zhu, Tiantian Zhu · 2026-10-22
AgentTriage maps native events from five runtimes into a shared contract through thin overlays. Call identity, parentage, outcomes, and evidence classes support backward slicing from a policy-decisive terminal. An attempted, failed, completed, or explicitly blocked file write remains distinguishable even when final response text is uninformative. Deterministic rules attach event evidence to each diagnostic claim.
Native events become a common contract; one lifecycle is selected, then actions, policy, and evidence populate the diagnosis card.
All 159 applicable acquisition runs produce complete evidence packages. On a separate set of 120 adjudicated cases, grounded joint diagnosis, requiring correct fields and evidence together, reaches 0.858; the worst runtime scores 0.792. The method supports cross-framework auditing but depends on a pre-run policy, instrumentation, and lifecycle completeness. Explicit parentage is not data causality, and missing evidence must remain unknown rather than becoming an invented attack chain.
05 · REGATTA: plausible tests need observed fault exposure
REGATTA: A Cross-Domain Measurement Framework and Fault-Injection Harness for Enterprise AI Agents
Luong Tuan Thanh, Abhijit Sanyal · 2026-10-22
REGATTA separates whether a scenario should expose a fault from whether execution with a faulted agent actually reveals it, alongside coverage and industry-specificity measures. Five domain/jurisdiction cells, four generation strategies, and three models produce 180 suites containing 5,400 scenarios. Each cell’s five faults are jointly injected into the system prompt.
Requirements and faults feed two evaluation stages; the resulting evidence vector is not deployment approval.
Historical design and execution judgments disagree on roughly 31%–34% of pairs, not a production failure rate. More consequentially, the authors’ audit classifies only 24 of 125 requirements as clean, and those received AI-only review; seven of 25 faults misstate their rule. The contribution is exposing measurement divergence. The released rules cannot directly serve as compliance ground truth, and without an unmodified-agent control, individual injection effects remain unidentified.
06 · Virtual crash tests: specify which calls an operation needs
Procrustes-Bering-Sheaft: Automated Model Discovery and Virtual Crash Tests for Microservices
Anatoly A. Krasnovsky · 2026-10-22
Procrustes–Bering–Sheaft connects deployment checks, trace-derived dependency models, and Monte Carlo failure analysis through versioned replay artifacts. Reachability alone does not establish operation success: the recommendation request needs two catalog calls, and explicit required-call predicates match all six observed states where simple reachability misses some broken-channel failures.
Deployment and traces form the model; explicit success predicates guide analysis and versioned outputs support replay.
With independent replica failure probability 0.05, channel liveness 0.995, 40,000 samples, and SLO 0.95, restoring a second catalog replica raises estimated availability from 0.9312 to 0.9799. Adding only a recommendation replica still fails. These are model comparisons under declared probabilities; live replicated failover, queueing, saturation, and temporal recovery are outside the experiment. The tool can help select configurations for subsequent fault testing.
Availability estimates depend on complete success predicates.
07 · Verified optimization: proving equivalence to a reference
Agentic Verified Optimization of Real-World Software
Zhe Ye, Udaya Ghai, Zhizhen Qin, Dawn Song, Soonho Kong · 2026-10-20
The coding agent jointly searches for a faster Lean function and an equivalence proof, using checker feedback to revise both while the reference stays fixed. AQUEDUCT first creates Lean references from existing software through candidate migrations, differential tests, fuzzing, and repair.
Keep the reference fixed, iterate on rewrite and proof, then measure function and application performance separately.
Of 189 Verina functions, 156 receive faster checked implementations, with a 1.851× geometric-mean speedup overall. At application level, however, 51 scenarios improve only 1.120× relative to migrated Lean; the ratio against original-language programs is 0.148×, meaning they remain slower overall. Proof covers the Lean rewrite against its Lean reference, not the entire migration, opaque I/O, or foreign calls. The useful contribution is how proof constrains optimization search, rather than headline function-level speedups.
08 · Detector audit: no recheck does not mean no recovery
What the Trace Shows and What the Label Says: Auditing Behavioral Detectors in Agent Evaluation
Idunnuoluwa A. Adeniji, Shilpika, Michael E. Papka · 2026-10-21
The study corrupts calculator outputs on GSM8K and audits detectors for final correctness, explicit rechecking, and error propagation. Labels retain evidence, applicability, censoring, and human corrections. An agent can recover the correct value without another tool call, so “no explicit verification” and recovery can coexist.
The corpus view compares runs; the trace view aligns a faulty tool result, subsequent behavior, and detector labels.
Six models run 30 questions each; 90 of 180 traces receive human review. In one gpt-oss-20b run, propagation is inconclusive for 12 of 17 fault events. Counting those as non-propagation would hide missing observability. Agreement is measured after detector revisions and re-review, not on an independent holdout. AgentOps evaluations should distinguish completed errors, budget-censored runs, and insufficient evidence through explicit states and denominators.
09 · Herding cascades: popularity changes what agents inspect next
LLM Multi-Agent Systems Are Vulnerable to Herding and Runaway Cascades
Farnoosh Hashemi, Shiyu Ji, Joice Chen, Michael W. Macy · 2026-10-22
Thirteen model populations evaluate titles and lyrics from the same 48 newly generated songs. Each agent selects four before recommending them. Later agents can see cumulative recommendations; the strong-influence condition also sorts by popularity. Candidate selection and evaluation therefore form a feedback loop without direct agent messaging.
Compare hidden counts, visible counts, and popularity ordering; every recommendation changes later agents’ inputs.
Across 168,480 persona-conditioned agents, every model departs from independent evaluation under both influence conditions; popularity ordering increases divergence for 12 of 13 models. Shared votes and rankings deserve scrutiny, but the result does not establish failure probabilities for collaborative coding. The human Music Lab comparison uses different stimuli, tasks, and presentation and is qualitative. Divergence also does not imply an objectively correct ranking of songs.
10 · ScaleMAS: searchable, linked shared messages
Scaling Multi-Agent Intelligence with Substrate-Centric Coordination
Zhenting Qi, Zhuokai Zhao, Rulin Shao, Kerem Oktar, Zhiyuan Yao, Himabindu Lakkaraju, Wen-tau Yih, Ansong Ni, Bhargavi Paranjape, Yilun Du · 2026-10-12
ScaleMAS stores persistent messages with references and rationales instead of making every agent read every message. Agents use search and visit on demand. Retrieval combines relevance with decaying citation weight and returns at most k messages per read, bounding context intake as the group grows. References must identify existing material and explain its contribution.
The left structures relationships between agents; the right structures shared messages for on-demand reads and writes.
On BrowseComp-Plus, Qwen3.5-9B accuracy rises from 38.1% with one agent to 65.3% with 16. Scaling to 128 agents is studied mainly on FATE-M and Contradiction Audit, not every task. The latter credits reports containing the edited snippet without penalizing extra reports, primarily measuring evidence discovery. Compare its searchable, linked long-term state with Muffin’s recent-findings window for asynchronous small-group reasoning.
11 · PLE: evaluating engineering deliverables
PLE: Physical-Engineering’s Last Exam
Rujun Han, Yufan Zhuang, Arijit Ray, Han Yu, Zoey CuiZhu, George Lee, Yifei Ming, Binz Roy, Varun Sakalkar, Vishy Tirumalashetty, Burak Gokturk, Tomas Pfister, Chen-Yu Lee · 2026-10-21
PLE ends tasks with engineering memos, calculation workbooks, or CAD/BIM deliverables rather than answers alone. Inputs include multiple file formats, superseded revisions, and distractors. Of 85 tasks, 44 are expert-authored and 41 pass through engineer briefs, a Creator–Solver pipeline, and expert review. Weighted rubrics and executable constraints provide grading.
The co-authored route starts with an engineer’s brief, iterates between creator and solver, and ends in expert validation.
The best configuration, Claude Opus 5.5 with Claude Code, averages 50.6% at $17.18 per task using list prices and three runs. This is a mean task score, not evidence that half of engineering projects can be delivered without professional approval. Cross-format evidence and physical constraints are useful evaluation targets, but grading partly depends on LLM judges and results depend on the model–harness combination.
Hard-constraint failures and partial presentation credit also need separate interpretation; aggregate scores do not establish safe use of deliverables.
12 · DoorDash: verify production flag values before cleanup
Automating Feature Flag Cleanup at Scale with Multi-Agent LLM Systems: An Industrial Experience at DoorDash
Atharv Chandratre, Jai Datar · 2026-10-22
DoorDash first retrieves live rollout state, identifies wrappers and call sites across files, and asks an engineer to confirm the target value. Cleanup then runs in isolated worktrees with tests and PR creation. A source-code default may differ from production behavior, making external-state verification more important than simply deleting a branch.
Query rollout state and obtain engineer confirmation before parallel edits; tests, coverage, and linting precede PR output.
Among 50 recent Kotlin cleanup cases, 31 were accepted immediately, 14 after revision, and five required engineer intervention. Mean runtime was 13.8 minutes and API cost $4.79. The 90% usable-PR rate includes revisions and is not fully autonomous success. Deep call chains caused incomplete removal; CI rechecked coverage because agents could misjudge their own coverage. The sample is from one company, and the one-to-two-hour manual comparison is an internal estimate.
13 · SARIA: justify persistence and coordinate reloads
SARIA: Persistence-Aware KV Caching with Coordinated DRAM–SSD Reload for LLM Agents
Hui Li, Qihui Zhou, Xiao Yan, Shumeng Zhang, Zijie Dai, Zequn Gong, Mingcong Song, Guoping Long, Hongjie Si, James Cheng · 2026-10-22
SARIA uses repeated eviction and reuse across DRAM residencies to decide when SSD persistence is worthwhile, with unified prefix metadata coordinating hybrid-attention state. Reloads partially promote SSD hits into DRAM and coordinate DRAM/GDS transfers at the shared GPU ingress, avoiding aggressive duplication that displaces useful memory-resident state.
Prefix/location metadata guides SSD admission below and coordinated reload paths above.
On WEKA with Qwen3.5-9B and eviction threshold three, writes fall 78.2% versus full duplicate caching, but mean time to first token rises 78.4%. Against DRAM-only caching, mean TTFT still falls about 94.9%. These distinct baselines must stay visible. Thresholds needed to meet daily write budgets depend on model and workload; eviction history signals possible future reuse rather than guaranteeing hits.
Its engineering focus joins location, valid prefix boundaries, and transfer order, avoiding local optimizations that harm the complete request path.
14 · MoEZip: protect expert routing during cache compression
MoEZip: Routing-Aware KV Cache Compression for Sparse Mixture-of-Experts LLMs
Minsang Kim, Seungjun Baek · 2026-10-21
MoEZip asks how KV eviction changes MoE expert selection. It computes Fisher-trace routing fragility on instruction tokens, propagates that signal to context positions through attention, reserves routing-aware anchors, and fills the remaining budget with a base cache scorer. Total retained cache and decoding remain unchanged.
Attention maps instruction-routing fragility to context positions, whose anchors receive priority within a fixed cache budget.
Comparisons on 12 LongBench and 13 RULER tasks generally preserve more quality under aggressive compression. Routing stability is a useful selection signal, but instruction routing proxies answer tokens that do not yet exist. The Fisher-trace argument assumes local perturbations rather than modeling the full distribution caused by eviction. Query-conditioned anchors and reusable-cache variants are evaluated separately; gains from the former cannot automatically be credited to cross-query reuse.
15 · uGDS: moving small-I/O control into user space
uGDS: A User-Space Development Kit for High-Performance GPU Direct Storage
Jing Wei, Guanyi Chen, Qi Chen, Chuyu Zhang, Zheng Zhou, Chutian Wang, Jian Zhang · 2026-10-22
uGDS separates one-time privileged setup, CPU-side user-space NVMe queue management, and direct SSD–GPU DMA. Steady-state I/O bypasses system calls, filesystems, and the block layer, trading those abstractions for raw-device control and application-managed aligned offsets. User space does not mean no kernel helper or device privileges.
Kernel-assisted setup establishes mappings; user-space commands drive direct SSD–GPU payload transfers.
With an A100, Samsung 990 PRO, and IOMMU disabled, two-thread 4 KiB synchronous writes improve from GDS’s 161 MiB/s to 1003 MiB/s, or 6.23×. At 16 threads and 64 KiB, the write advantage narrows to 1.38×. Small requests dominated by control overhead benefit most; this is not an equivalent serving-wide speedup. Cache backends with their own block allocators must weigh file semantics, exclusive device ownership, and DMA lifetime management.
Applications with substantial filesystem dependencies must also account for migration cost rather than peak bandwidth alone.
16 · OMRC: adapting collectives and optical topology after failures
OMRC: Multipath Reliability for Direct-Connect Optical Interconnects
Eric Ding, Keshav Pradeep, Rachee Singh · 2026-10-22
Paths across planes in direct-connect optical networks have unequal lengths, so rerouting can add forwarding. A communication group can also stall after losing all its planes. OMRC remaps collective channels when connectivity remains and reconfigures the OCS to borrow planes from other groups when necessary, then rebuilds paths.
The controller updates topology and channels; connectivity determines reconfiguration, remapping, or continued rerouting.
On four L40 GPUs, a Polatis OCS, and Qwen1.5-MoE, training throughput under a link failure exceeds MRC by 5.3%. Disaggregated inference recovers 99.3% of pre-failure throughput after losing its only TP plane, while MRC stalls. The larger 4.74× result comes from 64-rank multi-failure simulation, not hardware throughput. The prototype emulates multipath forwarding in software; benefits depend on topology, donor planes, and reconfiguration boundaries.
Borrowing a plane changes the donor group’s resources, so restoring one group still requires checking whole-job costs.
17 · LLVMhammer: correct outputs can conceal inference slowdown
Amplifying Latency and Cost of LLM Inference via Rowhammer Attack
Mrityunjay Shukla, Shubham Roy, Biswabandan Panda · 2026-10-22
LLVMhammer targets Triton compiler integrity in CPU memory. A bit flip can produce functionally correct GPU kernels that lose optimizations such as vectorization, with kernel caching prolonging the slowdown. Candidate selection examines common compilation stages, changed generated code, output correctness, and slowdown across NVIDIA and AMD backends.
The fault travels through the CPU-side compiler into cached GPU kernels and ultimately changes serving performance.
Evaluation uses four roughly 7B–8B models, RTX 4090 and RX 7900 XTX GPUs, and 30 repetitions per model/GPU combination. Operationally, output checks alone can miss compiler-artifact and latency anomalies. The threat model requires a malicious co-tenant on the physical host, Rowhammer-susceptible DRAM, and conditions for targeting victim pages. Demonstrations use DDR3/DDR4 and do not establish that every modern server is equally vulnerable.
18 · DCIGSE: decoupling input generation from interleaving checks
Breaking the Coupling: Efficient Concurrency Fuzzing for Linux Kernel Data Race Detection
Cen Zhang, Jia-Ju Bai, Zi-Yu Zhang, Zuming Jiang · 2026-10-22
DCIGSE separates generation of semantically related concurrent syscall groups from history reconstruction and targeted interleaving. LLM mutation runs alongside fast conventional mutation. Queue admission adapts to downstream backlog so expensive scheduling does not stall input exploration.
Fast and LLM mutation generate inputs; execution sends selected conflict candidates to the scheduling queue.
A three-week campaign on eight Linux 6.17 modules finds 187 deduplicated races. The authors classify 59 as harmful; maintainers had confirmed 39 and fixed 15 at writing time. These denominators differ, so all discoveries cannot be called confirmed vulnerabilities. The contribution joins semantic input generation, replayable state, and targeted validation, with dependence on instrumentation, recoverable context, and budget. Findings in selected modules do not establish kernel-wide detection coverage.