National University of Defense Technology

7 related articles

Subscribe to updates

arXiv Nov 7, 2026
Multi-step agent safety stops checking each step alone: TAS caps tail risk with one shared budget, cutting average attack success to 45.15%
Risk in multi-step LLM agents propagates along the workflow, and step-by-step independent verification does not see that propagation. TAS models workflow safety states as a Markov decision process, measures rare but high-cost tail risk with a spectral risk measure, and constrains each step's decision with one budget shared across steps. On Agent Security Bench, TAS reaches average attack success rates of 45.15% under direct prompt injection and 29.73% under indirect prompt injection, below the eleven defense baselines it compares against.
Risk in multi-step LLM agents propagates along the workflow, and step-by-step independent verification does not see that propagation. TAS models workflow safety states as a Markov decision process, measures rare but high-cost tail risk with a spectral risk measure, and constrains each step's decision with one budget shared across steps. On Agent Security Bench, TAS reaches average attack success rates of 45.15% under direct prompt injection and 29.73% under indirect prompt injection, below the eleven defense baselines it compares against.
National University of Defense Technology
Shilong Pan（First author）
Tail-risk-aware Agent Safety (TAS)Agent Safety Spectral Risk Measures Markov Decision Process LLM Agents
arXiv Nov 9, 2026
One2N pushes a 0.7° forecast model to 0.07°: four weeks on one 80 GB GPU, tropospheric skill intact
As Earth-system AI models approach kilometre scales, halving grid spacing quadruples the grid-point count and the end-to-end training cost. One2N splits resolution refinement into successive increments: at each level the complete parent predictor is frozen and only a cross-resolution residual correction module is trained, so the parent's activations and optimizer states are never retained. One refinement level on the NeuralGCM-0.7° baseline yields One2N-0.07°, trained for about four weeks on a single 80 GB A800 GPU; against HRES-0.07° analyses it keeps the parent's tropospheric skill while reducing upper-stratospheric errors and resolving finer structure.
As Earth-system AI models approach kilometre scales, halving grid spacing quadruples the grid-point count and the end-to-end training cost. One2N splits resolution refinement into successive increments: at each level the complete parent predictor is frozen and only a cross-resolution residual correction module is trained, so the parent's activations and optimizer states are never retained. One refinement level on the NeuralGCM-0.7° baseline yields One2N-0.07°, trained for about four weeks on a single 80 GB A800 GPU; against HRES-0.07° analyses it keeps the parent's tropospheric skill while reducing upper-stratospheric errors and resolving finer structure.
Peking University Chinese Academy of Sciences Qilu University of Technology Beijing Information Science & Technology University National University of Defense Technology
Yanyan Tan（First author）
One2N NeuralGCM Residual Learning Swin Transformer Weather forecasting
arXiv Oct 27, 2026
Not every document question needs an agent: RouteDRAG sends 79.3% of queries to agentic execution and gains 3.47 points on average
In multimodal long-document question answering, agentic retrieval is not always worth its extra computation and can even hurt answer accuracy. RouteDRAG makes both whether to invoke an agent and how it then executes into learned choices: a graph-backed index organizes cross-page, table and figure content, path routing predicts the benefit of an agent over shorter paths, and dynamic execution controls tool use and termination. Across two benchmarks it assigns only 79.3% of queries to an agent while averaging 3.47 percentage points higher accuracy than shorter-path-only execution, and it also surpasses uniform agent execution with fewer answering calls.
In multimodal long-document question answering, agentic retrieval is not always worth its extra computation and can even hurt answer accuracy. RouteDRAG makes both whether to invoke an agent and how it then executes into learned choices: a graph-backed index organizes cross-page, table and figure content, path routing predicts the benefit of an agent over shorter paths, and dynamic execution controls tool use and termination. Across two benchmarks it assigns only 79.3% of queries to an agent while averaging 3.47 percentage points higher accuracy than shorter-path-only execution, and it also surpasses uniform agent execution with fewer answering calls.
Zhejiang University Fudan University Chinese Academy of Sciences National University of Defense Technology Westlake University
Zekai Chen（First author）
RouteDRAG Agentic Retrieval-Augmented Generation policy learning
arXiv Oct 9, 2026
EMFA models error propagation to locate decisive errors in multi-agent failures, raising Who&When step-level attribution by 3.45 and 4.40 points
The work proposes EMFA, which reconstructs failed multi-agent trajectories into structured dependency representations, explicitly models cascading error propagation and persistent interaction loops, and combines dual-branch candidate screening with counterfactual verification to identify the decisive error—the agent–step pair whose correction would recover the failed execution; on the Who&When benchmark it achieves state-of-the-art step-level attribution accuracy, improving the previous best by 3.45 and 4.40 percentage points on the Hand-Crafted and Algorithm-Generated subsets, with the best agent-level accuracy on Hand-Crafted and competitive results on Algorithm-Generated.
The work proposes EMFA, which reconstructs failed multi-agent trajectories into structured dependency representations, explicitly models cascading error propagation and persistent interaction loops, and combines dual-branch candidate screening with counterfactual verification to identify the decisive error—the agent–step pair whose correction would recover the failed execution; on the Who&When benchmark it achieves state-of-the-art step-level attribution accuracy, improving the previous best by 3.45 and 4.40 percentage points on the Hand-Crafted and Algorithm-Generated subsets, with the best agent-level accuracy on Hand-Crafted and competitive results on Algorithm-Generated.
Tianjin University National University of Defense Technology
Jiaqi Liao（First author）
EMFA Error-Propagation Modeling Failure Attribution LLM-Based Multi-Agent Systems Who&When Benchmark
arXiv Sep 29, 2026
Learner2Skill externalizes learner interaction history into reusable simulation skills, reproducing fine-grained learner behavior more faithfully at lower token cost
The work proposes Learner2Skill, which externalizes the simulation capability acquired from historical interactions into a persistent and reusable Simulation Skill that captures the learner's current learning state and recurring response patterns, evolves as new real interactions arrive, and can be adapted to a new LLM through lightweight executor calibration; experiments show it more faithfully reproduces fine-grained learner behavior while reducing overall token cost, and that the same constructed Skills can be effectively reused across different LLM executors.
The work proposes Learner2Skill, which externalizes the simulation capability acquired from historical interactions into a persistent and reusable Simulation Skill that captures the learner's current learning state and recurring response patterns, evolves as new real interactions arrive, and can be adapted to a new LLM through lightweight executor calibration; experiments show it more faithfully reproduces fine-grained learner behavior while reducing overall token cost, and that the same constructed Skills can be effectively reused across different LLM executors.
Hong Kong Polytechnic University Nanyang Technological University Southeast University National University of Defense Technology
Zijian Chen（First author）
Learner2Skill Learner simulation Simulation Skill
arXiv Sep 29, 2026
AdaGuard uses an adaptive guard model to review agent trajectories against user-defined policies, with its 4B model reaching 89.30% binary accuracy on AdaptiveSafety
The work introduces AdaptiveSafety, a dataset of 10,939 training and 1,000 test examples covering policies with 1 to 100 rules, together with SafePO, a reinforcement learning algorithm, and uses them to train the AdaGuard family of 0.6B, 4B, and 8B guard models that assess agent trajectories under policies supplied at inference time; the 4B model achieves binary accuracies of 89.30% on AdaptiveSafety and 71.82% on DynaBench.
The work introduces AdaptiveSafety, a dataset of 10,939 training and 1,000 test examples covering policies with 1 to 100 rules, together with SafePO, a reinforcement learning algorithm, and uses them to train the AdaGuard family of 0.6B, 4B, and 8B guard models that assess agent trajectories under policies supplied at inference time; the 4B model achieves binary accuracies of 89.30% on AdaptiveSafety and 71.82% on DynaBench.
Fudan University National University of Defense Technology
Yunhao Feng（First author）
AdaGuard AdaptiveSafety SafePO Policy-Conditioned Safety Assessment Agent Safety
bioRxiv Sep 15, 2026
SemVac: A Semantic Vaccinology Paradigm Powered by LLMs for Antigen Discovery
The work introduces semantic vaccinology and implements it as SemVac: publications linked to each protein are retrieved through PaperBLAST, condensed into a structured semantic profile, and an LLM is prompted to return an antigenicity probability; on a curated 246-protein bacterial benchmark the best of 14 general-purpose LLMs matched or exceeded the precision of the specialized predictor PLGDL, with open-weight Kimi K2 0905 offering the strongest performance-cost balance, predictions were robust to masking of vaccine keywords, reproducible across repeated inference, and generalized to a 1,200-protein cross-pathogen dataset; explicit chain-of-thought reasoning increased recall but lowered precision in every model tested; applied to the mpox virus proteome, SemVac recovered the established
The work introduces semantic vaccinology and implements it as SemVac: publications linked to each protein are retrieved through PaperBLAST, condensed into a structured semantic profile, and an LLM is prompted to return an antigenicity probability; on a curated 246-protein bacterial benchmark the best of 14 general-purpose LLMs matched or exceeded the precision of the specialized predictor PLGDL, with open-weight Kimi K2 0905 offering the strongest performance-cost balance, predictions were robust to masking of vaccine keywords, reproducible across repeated inference, and generalized to a 1,200-protein cross-pathogen dataset; explicit chain-of-thought reasoning increased recall but lowered precision in every model tested; applied to the mpox virus proteome, SemVac recovered the established
National University of Defense Technology
Yunxiang Zhao（First author）Xiaodong Zai（Corresponding author）
Semantic Vaccinology SemVac Large language models Reverse vaccinology Chain-of-Thought

You’re all caught up

Multi-step agent safety stops checking each step alone: TAS caps tail risk with one shared budget, cutting average attack success to 45.15%

One2N pushes a 0.7° forecast model to 0.07°: four weeks on one 80 GB GPU, tropospheric skill intact

Not every document question needs an agent: RouteDRAG sends 79.3% of queries to agentic execution and gains 3.47 points on average

EMFA models error propagation to locate decisive errors in multi-agent failures, raising Who&When step-level attribution by 3.45 and 4.40 points

Learner2Skill externalizes learner interaction history into reusable simulation skills, reproducing fine-grained learner behavior more faithfully at lower token cost

AdaGuard uses an adaptive guard model to review agent trajectories against user-defined policies, with its 4B model reaching 89.30% binary accuracy on AdaptiveSafety

SemVac: A Semantic Vaccinology Paradigm Powered by LLMs for Antigen Discovery