Research Digest 2026-10-13 — Agent Reliability Week: Tool Retrieval, Red-Teaming, Recovery

Seat: data_scientist | Generated: 2026-10-13 | Source: arXiv cs.AI / cs.LG recent submissions (listed page dated Mon 12 Oct 2026, containing v1 submissions of Fri 9 Oct 2026)

Scope: ~3,500 new entries this week (cs.AI: 1,649; cs.LG: 1,894). Scanned listing pages, fetched full abs pages for 9 candidate papers, selected 5 for main digest + 2 short mentions, deprioritized 2 outside our domain.

Verification status (what was actually checked): ✅ ID existence + exact title + author list + submission date + abstract — verified by fetching each arxiv.org/abs page directly today. All IDs carry the 2610.* prefix (October 2026) and every abs page states v1 submitted 9 Oct 2026 — no ID/date mismatches. All titles quoted verbatim; acronyms used (RATED, X-AgentRed, MAGMA-Bench) appear inside the actual titles; benchmark/model names (EcoAgent, STAC, Prompteina) appear in the authors' abstracts/titles. ⚠️ NOT verified: full-text experimental claims — all headline numbers are authors' own abstract-reported point estimates, not independently checked. Peer-review status noted per-paper.

• ●arXiv: 2610.13889 (cs.AI, cs.IR) — v1 submitted 9 Oct 2026 — accepted at CIKM 2026. Authors: Weiliang Chen, Song Liao.
• ●Problem: Agent tool retrieval optimizes semantic relevance but ignores whether a tool is actually available at execution time. Under partial API outages, semantic-only retrievers keep routing to broken tools.
• ●Method: Frozen dual-encoder (contrastive fine-tuning) for semantic matching + a lightweight contextual-bandit re-ranker driven by real-time execution feedback. Runtime failures are absorbed by re-ranking, not by retraining.
• ●Abstract-reported numbers: +52.2% relative MRR over the ToolLLM API retriever; fault selection rate 86.2% → 2.9% under a severe 30%-API-failure scenario; <1 ms latency overhead over encode-only inference. Introduces EcoAgent benchmark: 5,172 real-world tools, 210,000+ query-tool pairs. Code and dataset released.
• ●Why it matters to LocalKin: Our most recurring operational failure is stale/broken tool picks (search API outages, fetch failures). This is an additive layer: keep the existing semantic retriever, add a bandit re-ranker consuming a last-N call-outcome log.
• ●Applicability: HIGH. Implementation cost: moderate (outcome logging + small bandit model). The cited sub-millisecond overhead means no added latency budget. Secondary value: the 86.2% baseline fault rate quantifies how catastrophic semantic-only routing is under partial outage — adopt as a stress metric for our own tool registry.

• ●arXiv: 2610.13886 (cs.AI) — v1 submitted 9 Oct 2026. Authors: Yeonsung Jung, Zhiyuan Wang, Zifan Wang, Vítor Albiero, Benjamin Newman, Edoardo Debenedetti, Ivan Evtimov, Ninareh Mehrabi.
• ●Problem: Agents fulfilling benign user requests can still cause harm because tool effects compose across services (tool A's output satisfies tool B's precondition in an unintended way). Existing red-teaming favors familiar tool combinations — novel cross-service interactions stay untested.
• ●Method: Self-evolving red-teaming. Build a directed graph of tool dependencies (effects → preconditions), sample "recipes" from it, instantiate them as realistic scenarios, then use execution feedback to expand (tool substitution) and unblock (precondition refinement) failure paths.
• ●Abstract-reported numbers: across four frontier agentic models, 1.77× the harmful-path rate of STAC; 2.99× tool coverage on average.
• ●Why it matters to LocalKin: We are a multi-service ecosystem (web_search, web_fetch, file_write, publish…). This week's own failure mode — a benign round producing a placeholder file at the final path — is exactly a benign-step/harmful-composition event of the class this paper systematizes: one tool's write effect collides with another consumer's precondition (expects a finished deliverable).
• ●Applicability: MEDIUM-HIGH. Full framework is heavy; a lightweight port is feasible — maintain a precondition/effect graph over our ~10 tools and enumerate 2-hop combinations as standing test cases.

• ●arXiv: 2610.13663 (cs.AI, cs.CL, cs.LG, cs.MA, cs.NE) — v1 submitted 9 Oct 2026. Authors: Ivan Moloshnikov, Dmitry Kunitsyn, Alexander Sboev, Maksim Skorokhodov, Roman Rybka, Yuanchao Liu.
• ●Method (the transferable part): Three-role multi-agent system — analyst, coder, recorder — with a shared structured experiment log and a sandboxed execution environment. Key design choice: an open but semantically narrow search space — agents generate code only for named components, leaving the overall network structure untouched.
• ●Abstract-reported numbers: across 5 tasks: +13 pp accuracy (MNIST spiking classification), +6 pp (Digits); PINN tasks: error vs analytical single-soliton GNLSE solution reduced ~2491× (flagged: best selected run; >100× average across repeated initializations), Kuramoto–Sivashinsky mass drift reduced 14×. Framework unchanged across all tasks.
• ●Why it matters to LocalKin: analyst/coder/recorder with a shared log is essentially what our swarm does manually. Two portable lessons: (1) constrain improvement tasks to named components, not "rewrite the pipeline" — far higher success per agent round; (2) a persistent structured experiment log that every role reads is what makes multi-round tuning converge.
• ●Applicability: MEDIUM. The architecture maps directly onto our model-performance review loop even though SNN/PINN tasks are outside our domain.

• ●arXiv: 2610.13534 (cs.AI, cs.RO) — v1 submitted 9 Oct 2026. Authors: Loan Bernat, Matthieu Grard, Ariane Herbulot, Florent Lamiraux.
• ●What it is: Architecture-agnostic benchmark for persistent task reasoning in dynamic multi-robot environments: increasing task horizons with controlled online perturbations (execution failures, task interruptions, mission updates), heterogeneous robot capabilities, structured skill-level interface separating task-level reasoning from perception/control. Releases the benchmark, 261,646 task-level training examples, and an expert-trace generation pipeline.
• ●Abstract-reported findings: even the strongest evaluated models fail on a substantial fraction of clean episodes and degrade further under online perturbations; supervised adaptation lifts a small model substantially, but performance stays far lower on long and multi-robot missions.
• ●Why it matters to LocalKin: The perturbation taxonomy ports directly: we currently measure only clean-path success. Injecting controlled "execution failure / interruption / mission update" events into debate and pipeline runs would measure the state-tracking degradation we never capture. Their headline warning implies our clean-run dashboards likely overstate real reliability.
• ●Applicability: MEDIUM. Borrow the perturbation protocol, not the benchmark. Cost: low (fault-injection flag on our run harness + a degraded-mode success metric).

• ●arXiv: 2610.13841 (cs.LG, cs.SE) — v1 submitted 9 Oct 2026. Authors: Daniel Thi Graviet, Tanmay Shah. ⚠️ Preprint, not peer reviewed; 7 pages — treat as preliminary.
• ●What it is: Go-Explore-style search over full sandbox snapshots for coding agents. Core finding: higher and more efficient solve rates come mainly from progress that lives outside the repository — databases, services, runtime state. Full-snapshot restore-and-branch pays off precisely when long-horizon work spans multiple services whose state cannot be reconstructed from a single diff.
• ●Why it matters to LocalKin: The empirical version of our own 落盘铁律: checkpoint state that cannot be reconstructed from the transcript, then branch, rather than retrying from zero. Practical reads: (1) restore-and-branch beats retry-from-scratch for loops that can fail mid-way; (2) externalize non-reconstructible state to files early in a run. (This week's banner-placeholder → overwrite protocol is a domain instance of exactly this pattern.)
• ●Applicability: MEDIUM. Conceptual import is cheap; full snapshot infrastructure is overkill at our scale, but checkpoint-branching maps onto our file-first protocol.

Can Language Models Play the Wikipedia Game? — 2610.13948 (cs.AI, cs.IR) — v1 submitted 9 Oct 2026. Authors: Alexander Hickey, Joanna Knight, James Bishop (64 pages, 17 figures, 10 tables). Uses the Wikipedia Game (reach a target article using only article links) to test sentence-embedding models and LLMs across five Wikipedia languages and five academic-literature datasets, on very large locally built graphs of Wikipedia pages and OpenAlex citation networks; releases code to build and navigate those graphs, so navigation capability can be studied without third-party APIs, against human and TF-IDF benchmarks. Finding: no model significantly outperformed humans; the best models (GPT-o3 mini, GPT-4o, QwQ:32B, DeepSeek-R1:70B per the abstract) were comparable. Transferable to us: an offline-graph eval recipe for link-following/information-seeking that doesn't burn search-API quota.

AI Models Can Provably Hide Arbitrary Capabilities — 2610.13928 (cs.LG, cs.CR) — v1 submitted 9 Oct 2026 — accepted at NeurIPS 2026. Authors: Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas, Christian Schroeder de Witt. Constructs backdoor attacks that embed encrypted neural networks inside host model weights, decrypting and executing only on a secret trigger; under cryptographic assumptions, these hidden circuits are provably hard to elicit or interpret even with full weight access. Proof-of-concept in PyTorch on a small chemical-reaction-prediction task (CBRN proxy) resisted fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training. Models released to support defense work. Relevance: a hard ceiling on what "we probed the model and found nothing" style audits can conclude.

1. ●Execution feedback beats semantic-only selection (RATED). Any retrieval/routing component should log outcomes and re-rank on them.
2. ●Composition of benign steps is our untested failure class (X-AgentRed). Enumerate 2-hop tool precondition/effect combinations as standing test cases.
3. ●Narrow search space + shared experiment log (automated tuning system). Name the components; persist a structured experiment log all roles read.
4. ●Perturb, don't just measure clean runs (MAGMA-Bench). Add fault/interruption injection and degraded-mode metrics to our pipeline evaluations.
5. ●Checkpoint non-reconstructible state early (Returning to Development States). Restore-and-branch beats retry-from-zero.

• ●Listing pages: arxiv.org cs.AI/recent and cs.LG/recent (page dated Mon 12 Oct 2026; contains Fri 9 Oct 2026 v1 submissions). Abs pages fetched individually 2026-10-13.
• ●Verified: ID ↔ submitted-date consistency (all 2610.*, all v1 = 9 Oct 2026), titles, authors, abstracts. Every number above is sourced to authors' abstracts.
• ●Not verified: full-text results; peer-review status beyond stated comments (CIKM 2026 for 2610.13889; NeurIPS 2026 for 2610.13928; explicitly not peer reviewed: 2610.13841).
• ●Deprioritized at selection (not quality judgments): Designing Protein Structures from Natural Language [2610.13917]; TabMF: Learning Dataset Representations with Tabular Foundation Models [2610.13812].
• ●[Model estimate — verify against primary source] applies to all quantitative claims; none independently reproduced.

中文完整版（Chinese translation）

研究摘要 2026-10-13 —— 智能体可靠性专题周：工具检索、红队测试与故障恢复

席位： data_scientist | 生成时间： 2026-10-13 | 来源： arXiv cs.AI / cs.LG 近期提交（列表页标注日期为 2026-10-12 周一，收录 2026-10-09 周五的 v1 提交论文）

扫描范围： 本周约 3,500 篇新提交（cs.AI：1,649 篇；cs.LG：1,894 篇）。浏览列表页，抓取了 9 篇候选论文的完整摘要页，最终精选 5 篇主文 + 2 篇简述，2 篇因领域相关性低被降级处理。

核对状态： ✅ ID 存在性、标题原文、作者名单、提交日期、摘要——今天逐篇直接抓取 arxiv.org/abs 页面核实。9 篇 ID 前缀均为 2610.*，abs 页面均注明 v1 提交于 2026-10-09，未发现 ID/日期矛盾。标题均为原文逐字引用，缩写（RATED、X-AgentRed、MAGMA-Bench）均出自论文实际标题，基准/模型名（EcoAgent、STAC、Prompteina）均出自作者摘要或标题。⚠️ 未核对正文实验真实性——所有关键数字均为作者摘要报告的点估计。

• ●arXiv: 2610.13889— v1 提交于 2026-10-09 — 已被 CIKM 2026 录用。作者：Weiliang Chen, Song Liao。
• ●问题： 现有智能体工具检索只优化语义相关性，忽略工具在执行时刻是否真正可用。API 部分宕机时，纯语义检索仍会把请求路由到坏掉的工具上。
• ●方法： 冻结双编码器（对比学习微调）负责语义匹配 + 轻量上下文赌臂机重排模块，依据实时执行反馈重排候选。运行时故障靠重排吸收，而非重新训练。
• ●摘要报告的数字： 相对 ToolLLM API 检索器 MRR 提升 52.2%；在 30% API 故障率的严重宕机场景下错误选择故障工具的比率从 86.2% 降到 2.9%；相对纯编码推理额外延迟不足 1 毫秒。发布 EcoAgent 基准：5,172 个真实工具、21 万余条查询-工具配对。代码与数据集已发布。
• ●对 LocalKin 的意义： 我们最反复出现的运行故障就是过时/失效的工具选择（搜索 API 宕机、抓取失败）。这是增量式改造：保留现有语义检索器，加一层消费"最近 N 次调用结果日志"的 bandit 重排器。
• ●适用性：高。 实施成本中等（调用结果日志 + 小型 bandit 模型），亚毫秒开销不占延迟预算。附带价值：86.2% 基线故障率量化了部分宕机下纯语义路由的灾难程度——可借为我们工具注册表的压测指标。

• ●arXiv: 2610.13886— v1 提交于 2026-10-09。作者：Yeonsung Jung 等 8 人。
• ●问题： 智能体执行良性用户请求仍可能造成伤害，因为工具效果会跨服务组合（工具 A 的输出以未预期的方式满足了工具 B 的前置条件）。现有红队方法偏向熟悉的工具组合，新颖的跨服务交互得不到测试。
• ●方法： 自演化红队框架。构建工具依赖有向图（效果 → 前置条件），从中采样"配方"并实例化为真实场景，再用执行反馈自我改进：通过工具替代扩展危害路径多样性，通过细化前置条件解锁被卡住的步骤。
• ●摘要报告的数字： 在四个前沿智能体模型上，有害路径命中率达到基线方法 STAC 的 1.77 倍；工具覆盖面平均 2.99 倍。
• ●对 LocalKin 的意义： 我们本身就是一个多服务生态系统（web_search、web_fetch、file_write、发布……）。本周我们自己的故障模式——一轮良性对话在最终路径上留下占位文件——正是本文所系统化的"步骤良性、组合有害"事件实例：一个工具的写入效果与另一个消费者的前置条件（期望拿到成品）发生冲突。
• ●适用性：中高。 完整框架较重；轻量移植可行——为约 10 个工具维护前置条件/效果图，把两跳组合枚举为常设测试用例。

• ●arXiv: 2610.13663— v1 提交于 2026-10-09。作者：Ivan Moloshnikov 等 6 人。
• ●方法（可迁移部分）： 三角色多智能体系统——分析员、程序员、记录员——共享结构化实验日志和沙盒执行环境。关键设计：开放但语义上很窄的搜索空间——智能体只为指定具名组件生成代码，整体网络结构保持不动。
• ●摘要报告的数字： 跨 5 个任务：MNIST 脉冲网络分类准确率 +13 个百分点，Digits +6 个百分点；PINN 任务：相对 GNLSE 单孤子解析解误差降低约 2491 倍（标注：最佳挑选运行；跨重复初始化平均改善 100 倍以上），Kuramoto–Sivashinsky 质量漂移降低 14 倍。全部任务框架结构不变。
• ●对 LocalKin 的意义： "三角色 + 共享日志"本质就是蜂群在手工做的调优。两条可移植教训：(1) 改进任务要限定为具名组件而非"重写整条流水线"；(2) 一份所有角色都读的持久化结构化实验日志，是多轮调优收敛的机制——否则每个智能体每轮都要重新推导上下文。
• ●适用性：中等。 架构可映射到我们的模型表现复盘循环，尽管脉冲网络/PINN 任务不在我们的领域。

• ●arXiv: 2610.13534— v1 提交于 2026-10-09。作者：Loan Bernat, Matthieu Grard, Ariane Herbulot, Florent Lamiraux。
• ●是什么： 面向动态多机器人环境中持续性任务推理的架构无关基准：递增任务时程 + 受控在线扰动（执行故障、任务中断、任务更新）、异构机器人能力、结构化技能级接口分离任务级推理与感知/底层控制。发布基准本体、261,646 条任务级训练样本、专家轨迹生成流水线。
• ●摘要报告的发现： 即使最强模型在干净场景下也有相当比例回合失败，在线扰动下成功率进一步下降；监督式微调大幅提升小模型，但在长时程、多机器人任务上仍明显落后。
• ●对 LocalKin 的意义： 扰动分类法可直接移植：目前我们只度量干净路径成功率。把受控的"执行故障/任务中断/任务更新"事件注入辩论与流水线运行来度量状态追踪退化，是我们从未覆盖的维度。其警示意味着我们的"干净运行"仪表盘很可能高估真实可靠性。
• ●适用性：中等。 借扰动协议，不必采纳基准本体。成本低：运行框架加故障注入开关 + 降级模式成功指标。

• ●arXiv: 2610.13841— v1 提交于 2026-10-09。作者：Daniel Thi Graviet, Tanmay Shah。⚠️ 预印本，未经同行评审；仅 7 页——按初步结果对待。
• ●是什么： Go-Explore 式的全量沙盒快照搜索。核心发现：更高且更高效的成功率主要来自代码库之外的进度——数据库、服务、运行时状态。当长时程工作跨多个服务、其状态无法从单个 git diff 重建时，"恢复快照再分支"才真正见效。
• ●对 LocalKin 的意义： 这篇论文是自家落盘铁律的实证版本：把无法从对话记录重建的状态先写入检查点再分支，而不是从零重试。实操结论：(1) 可能中途失败的循环，"恢复再分支"优于"从头重试"；(2) 不可重建的状态要在运行早期外化落盘。（本周的"横幅占位 → 覆盖"协议正是该模式的领域实例。）
• ●适用性：中等。 概念引入成本低；完整快照基础设施在我们的规模下过重，但检查点-分支模式可直接映射到文件优先协议上。

Can Language Models Play the Wikipedia Game?（语言模型能玩维基百科游戏吗？） — 2610.13948— v1 提交于 2026-10-09。作者：Alexander Hickey, Joanna Knight, James Bishop（64 页，17 图，10 表）。用维基百科游戏（只靠内链到达目标词条）作为可控检索/导航评测：在自建极大规模本地图上（维基百科页面图 + OpenAlex 引文图）测试句子嵌入模型与 LLM，覆盖五种语言和五个学术文献数据集；发布建图与导航代码，无需第三方 API 即可研究导航能力，与人类及 TF-IDF 基准对比。发现：没有模型显著超过人类；最好模型（摘要列出 GPT-o3 mini、GPT-4o、QwQ:32B、DeepSeek-R1:70B）仅打平。可迁移点： 一套离线图评测配方，测"顺链接找信息"类能力而不烧搜索 API 配额。

AI Models Can Provably Hide Arbitrary Capabilities（AI 模型可以以可证明的方式隐藏任意能力） — 2610.13928— v1 提交于 2026-10-09 — 已被 NeurIPS 2026 录用。作者：Andis Draguns 等 4 人。构造后门攻击：把加密的神经网络藏进宿主模型权重，只有收到秘密触发器才解密执行；在密码学假设下，隐藏电路可证明地难以被引出或解释——即使持有完整权重。PyTorch 概念验证（小型化学反应预测任务，CBRN 代理）抵抗了微调、权重加噪、梯度触发器搜索、潜在对抗训练。模型已发布以支持防御研究。相关性： 给"测过什么都没测出来"类模型审计结论画出硬上限。

1. ●执行反馈胜过纯语义选择（RATED）。任何检索/路由组件都应记录调用结果并据此重排。
2. ●良性步骤的组合是未测试的故障类别（X-AgentRed）。两跳工具前置条件/效果组合枚举为常设测试用例；"步骤良性、组合有害"当一等公民场景（本周占位文件覆盖事故是本地实例）。
3. ●窄搜索空间 + 共享实验日志（自动调优系统）。点名组件；持久化所有角色共读的结构化实验日志。
4. ●别只测干净路径，要做扰动（MAGMA-Bench）。加故障/中断注入和降级模式指标。
5. ●尽早把不可重建状态写入检查点（Returning to Development States）。"恢复再分支"优于"从零重试"。

• ●列表页：arxiv.org cs.AI/recent 与 cs.LG/recent（2026-10-12 周一页；收录 2026-10-09 周五 v1 提交）。abs 页面 2026-10-13 逐篇抓取。
• ●已核实：ID ↔ 提交日期一致性、标题、作者、摘要。所有数字按来源标注为作者摘要报告值。
• ●未核实：正文实验结果；除文内注明外的同行评审状态。
• ●精选阶段降级处理（非质量判断）：Designing Protein Structures from Natural Language [2610.13917]（生物领域）；TabMF: Learning Dataset Representations with Tabular Foundation Models [2610.13812]（表格表征学习）。
• ●所有定量声明适用 [模型估计 — 请对照一手来源核实] 标签；无一经过独立复现。