Records published in August 2026
15 records, all free to read and download.
All of 2026-
Journal article
Newer Is Not Truer: Three Presuppositions Behind the Recency Rule in Long-Term Agent Memory, and Why Retaining Both Records Relocates the Decision Rather Than Making It
An agent with persistent memory writes its own records, and two of them can disagree. Across the published systems examined here the resolution runs in one direction: the newer record supersedes the older. This paper argues that the direction is not wrong so much as underdetermined, and…
-
Journal article
Near-Zero Until Someone Tries: What a Prompt-Injection Defense Number Measures, Why Static and Adaptive Results Do Not Reconcile, and the Assumption the Out-of-Band Turn Has Not Yet Tested
Several published prompt-injection defenses report attack success rates at or near one percent on static benchmarks; published adaptive attacks report success above fifty percent against the same defense families, and above ninety percent in several instances. Neither set of numbers is a…
-
Journal article
A Step Score Is Not a Step Verdict: Three Quantities Under the Name Process Supervision, and the Outcome-Only Results That Make the Distinction Load-Bearing
Process reward models are introduced, almost without exception, as models that score whether an individual reasoning step is correct. This paper argues that the phrase "process supervision" is currently attached to three different target quantities, that the dominant scalable label…
-
Journal article
A Step Score Is Not a Step Verdict: Three Quantities Under the Name Process Supervision, and the Outcome-Only Results That Make the Distinction Load-Bearing
Process reward models are introduced, almost without exception, as models that score whether an individual reasoning step is correct. This paper argues that the phrase "process supervision" is currently attached to three different target quantities, that the dominant scalable label…
-
Journal article
Ordering Is Not Resolution: What the Instruction Hierarchy Defines, What It Leaves Undefined, and the Same-Tier Conflicts Agent Benchmarks Do Not Separate
When a language-model agent receives instructions that conflict, the dominant remedy is a privilege ordering over sources: system above developer, developer above user, user above tool output. This paper argues that the ordering paradigm is well-defined for one class of conflict and…
-
Journal article
Out-of-Distribution With Respect to What? Four Referents Behind One Predicate, and Why OOD Detection Results Do Not Transfer to Foundation-Model Reasoning
Out-of-distribution detection was formalised for a setting in which the training distribution is known, the label space is closed, and a designated test set stands in for everything outside it. Foundation models satisfy none of those conditions, and yet a growing body of work reports…
-
Journal article
Automatic Benchmarks Measure an Asymmetry: Privileged Information, Panel-Relative Difficulty, and Two Self-Biases That Pull in Opposite Directions
Automatic benchmark construction is presented as a response to saturation: a language model proposes topics, writes items, and supplies answer keys, and the resulting datasets are reported to be harder and more novel than human-built ones. The standard objection is that a model cannot…
-
Journal article
Intent Is Not a Property of the Record: Agent Memory Contamination, the Two Detector Families That Cover Disjoint Failures, and the Base Rate Nobody Has Measured
Persistent agent memory has acquired a security literature that models contamination as adversarial injection, and detectors are trained and evaluated on attacker-generated distributions. A separate empirical literature reports the same downstream damage with no attacker present, when an…
-
Journal article
Poison Below the Base Rate: What the Near-Constant Poisoning Result Establishes About Detection, and Four Things It Does Not
A widely cited 2025 result reports that backdooring a language model through its training data takes a near-constant number of poisoned documents rather than a constant fraction of the corpus, and the field has read that as retiring the proportion-based threat model that most poison…
-
Journal article
The Crossover Does Not Carry the Claim: Pass@k Inversion, the Reasoning Boundary, and Five Premises the RLVR Debate Leaves Unstated
A model trained with reinforcement learning from verifiable rewards beats its base model at one sample and loses to it at many. The field has read that crossover as a measurement of the reasoning boundary and has spent two years arguing about which direction the boundary moved. This…
-
Journal article
The Crossover Does Not Carry the Claim: Pass@k Inversion, the Reasoning Boundary, and Five Premises the RLVR Debate Leaves Unstated
A model trained with reinforcement learning from verifiable rewards beats its base model at one sample and loses to it at many. The field has read that crossover as a measurement of the reasoning boundary and has spent two years arguing about which direction the boundary moved. This…
-
Journal article
Three Guarantees Under One Word: What Importance-Based Selective Forgetting in Language Models Can and Cannot Promise
Unlearning methods are asked to deliver a guarantee, and the word is used for three different ones: that a model's outputs no longer reveal the target under some stated class of queries, that the target is absent from the weights, and that no adversary within a stated budget can restore…
-
Journal article
A Second Model Is Not a Second Opinion: Peer Verification, Correlated Failure, and the Independence Variable Nobody Reports
When a language model cannot reliably detect its own errors, the standard remedy is to have a second model check the first. That substitution is now the default across agent benchmarks, reward pipelines and safety evaluations, and it rests on an assumption that is rarely stated and that…
-
Journal article
A Second Model Is Not a Second Opinion: Peer Verification, Correlated Failure, and the Independence Variable Nobody Reports
When a language model cannot reliably detect its own errors, the standard remedy is to have a second model check the first. That substitution is now the default across agent benchmarks, reward pipelines and safety evaluations, and it rests on an assumption that is rarely stated and that…
-
Journal article
The Self-Verification Gap: Why Working Hallucination Detectors Are External, and What Real-Time Correction Would Actually Require
Large language models generate fluent text that is sometimes false, and a substantial literature now proposes to have the model notice and repair those errors while it writes. Parts of the problem are settled. Semantic entropy detects confabulations across datasets and tasks without…