# LLM Agents

Low-bit quantization cuts the inference cost of LLM agents but often makes them overlook task requirements or environmental conditions and take wrong steps in tool use. SteerDistill has a full-precision teacher locate the student's first behavioral divergence, issue a structured correction prompt, and refine that prompt using execution feedback until the revision passes local verification. The student then learns these corrections without guidance, and across five agentic benchmarks and three models under W4A16 its average score exceeds the strongest quantized baseline by 1.67–2.18 points and stays within one point of BF16.

Low-bit quantization cuts the inference cost of LLM agents but often makes them overlook task requirements or environmental conditions and take wrong steps in tool use. SteerDistill has a full-precision teacher locate the student's first behavioral divergence, issue a structured correction prompt, and refine that prompt using execution feedback until the revision passes local verification. The student then learns these corrections without guidance, and across five agentic benchmarks and three models under W4A16 its average score exceeds the strongest quantized baseline by 1.67–2.18 points and stays within one point of BF16.

On social networks of large-language-model agents, whether a post spreads depends on how many of each agent's contacts have shared it. Earlier predictions measured a single response curve independent of contact count, or one response in a large fully connected group. Measuring the response separately at each contact count and feeding it into mean-field cascade theory reproduces the cascade sizes and tipping seed fractions of full LLM simulations, while responses that ignore contact count mispredict cascades increasingly on heterogeneous networks.

On social networks of large-language-model agents, whether a post spreads depends on how many of each agent's contacts have shared it. Earlier predictions measured a single response curve independent of contact count, or one response in a large fully connected group. Measuring the response separately at each contact count and feeding it into mean-field cascade theory reproduces the cascade sizes and tipping seed fractions of full LLM simulations, while responses that ignore contact count mispredict cascades increasingly on heterogeneous networks.

Long-running LLM agents often write each episode's lesson straight into memory, yet local success is not a reliable sign of reusable, safe knowledge. FGSE turns every candidate lesson into a structured hypothesis with a precondition, behavior change, expected effect and verifier, applies it only in a temporary state, and tests it on target-transfer, falsification and archived-regression probes before committing, narrowing or rejecting it. On verifier-rich benchmarks including WebArena, AppWorld and τ-bench, FGSE with a DeepSeek-V3.1 backbone reaches 39.8 WebArena success rate and 78.8 AppWorld average completion, while cutting falsification failures, regression damage and harmful committed updates to 5.0%, 1.3% and 3.6%.

Long-running LLM agents often write each episode's lesson straight into memory, yet local success is not a reliable sign of reusable, safe knowledge. FGSE turns every candidate lesson into a structured hypothesis with a precondition, behavior change, expected effect and verifier, applies it only in a temporary state, and tests it on target-transfer, falsification and archived-regression probes before committing, narrowing or rejecting it. On verifier-rich benchmarks including WebArena, AppWorld and τ-bench, FGSE with a DeepSeek-V3.1 backbone reaches 39.8 WebArena success rate and 78.8 AppWorld average completion, while cutting falsification failures, regression damage and harmful committed updates to 5.0%, 1.3% and 3.6%.

Third-party skills in public registries can be exploited by a poisoning method that edits only decision rules while leaving the task and interface intact. Without real user requests or ground-truth answers, StealthyPoison uses synthetic requests and clean executions by a surrogate agent as references to iteratively rewrite formulas, thresholds and branches. Across 566 eligible skills, 5,244 requests and more than 26,000 registry entries, the frozen poisoned skills reached micro-averaged attack success of 31.0%–31.9% on three held-out models, close to the surrogate's 32.9%.

Third-party skills in public registries can be exploited by a poisoning method that edits only decision rules while leaving the task and interface intact. Without real user requests or ground-truth answers, StealthyPoison uses synthetic requests and clean executions by a surrogate agent as references to iteratively rewrite formulas, thresholds and branches. Across 566 eligible skills, 5,244 requests and more than 26,000 registry entries, the frozen poisoned skills reached micro-averaged attack success of 31.0%–31.9% on three held-out models, close to the surrogate's 32.9%.

Multi-turn agentic reinforcement learning is widely used to strengthen the long-horizon behavior of large language model agents, yet trajectory-level success rates hide what it does to individual decisions. Across four interactive tasks, DeepCoder-MT, BFCL, InterCode-SQL and FrozenLake, models trained with GRPO are evaluated along two axes, sampling breadth and interaction depth: with more sampled trajectories the RL model consistently beats its base model, but when the turns allowed per trajectory are tightened that edge shrinks, disappears, and on some tasks reverses. Matched-state comparisons show better next-step actions on only 46.8% of DeepCoder-MT states and 42.8% of FrozenLake states, with the gain concentrated in error recovery and later trajectory stages.

Multi-turn agentic reinforcement learning is widely used to strengthen the long-horizon behavior of large language model agents, yet trajectory-level success rates hide what it does to individual decisions. Across four interactive tasks, DeepCoder-MT, BFCL, InterCode-SQL and FrozenLake, models trained with GRPO are evaluated along two axes, sampling breadth and interaction depth: with more sampled trajectories the RL model consistently beats its base model, but when the turns allowed per trajectory are tightened that edge shrinks, disappears, and on some tasks reverses. Matched-state comparisons show better next-step actions on only 46.8% of DeepCoder-MT states and 42.8% of FrozenLake states, with the gain concentrated in error recovery and later trajectory stages.

On the corrected CIC-IDS2017 dataset, when labels and confidences from four heterogeneous detectors are corrupted under a threat model, unverified open-weight LLM investigators fall to 0.50–0.72 accuracy with one corrupted detector and to 0.13 or less with three. Conflict-Aware Evidence Verification (CAV) keeps reported confidences out of the vote and, only when tools conflict, tests the leading candidates with a nearest-neighbour trust score computed from raw traffic features. With its prompt frozen before testing, CAV-LLM reaches 0.84–0.88 under three corrupted detectors in both persistent and sporadic scopes, against at most 0.08 for the naive investigator, while calling the LLM on 0.4% of clean traffic.

On the corrected CIC-IDS2017 dataset, when labels and confidences from four heterogeneous detectors are corrupted under a threat model, unverified open-weight LLM investigators fall to 0.50–0.72 accuracy with one corrupted detector and to 0.13 or less with three. Conflict-Aware Evidence Verification (CAV) keeps reported confidences out of the vote and, only when tools conflict, tests the leading candidates with a nearest-neighbour trust score computed from raw traffic features. With its prompt frozen before testing, CAV-LLM reaches 0.84–0.88 under three corrupted detectors in both persistent and sporadic scopes, against at most 0.08 for the naive investigator, while calling the LLM on 0.4% of clean traffic.

In multi-agent systems, confidence often decides who receives scarce downstream computation and decision weight, which gives agents an incentive to overstate it. The Audited Pivot Scoring Mechanism (APSM) offsets platform-controlled allocation benefits in the transfer, verifies outcomes through inverse-propensity-weighted sparse audits, charges the Clarke pivot externality, and adds a strictly proper score, making truthful reporting the unique expected-utility best response. Calculator-free experiments show agents inflate confidence under Top-K incentives; with an agent-local utility interface, APSM yields lower Brier loss and fewer cutoff crossings than Compensated Proper Scoring (CPS), while CPS achieves a higher exact allocation match.

In multi-agent systems, confidence often decides who receives scarce downstream computation and decision weight, which gives agents an incentive to overstate it. The Audited Pivot Scoring Mechanism (APSM) offsets platform-controlled allocation benefits in the transfer, verifies outcomes through inverse-propensity-weighted sparse audits, charges the Clarke pivot externality, and adds a strictly proper score, making truthful reporting the unique expected-utility best response. Calculator-free experiments show agents inflate confidence under Top-K incentives; with an agent-local utility interface, APSM yields lower Brier loss and fewer cutoff crossings than Compensated Proper Scoring (CPS), while CPS achieves a higher exact allocation match.

Recovering a partial differential equation from sampled solution data demands expert work in equation discovery, coefficient estimation and numerical solver configuration. RSI-PDEbench turns that workflow into a benchmark of 1,001 cases over 42 equation templates, split into noise-free, 50% Gaussian-noise and unseen-template-with-shifted-coefficient settings; the accompanying RSI-PDE agent shortlists candidate equations by residual, refines coefficients and solvers with relative feedback, and keeps improvements behind a validation gate. Across four frontier models its mean pass rate rises 106.5–181.9% over single-run baselines and 3.0–19.6% over native agent harnesses.

Recovering a partial differential equation from sampled solution data demands expert work in equation discovery, coefficient estimation and numerical solver configuration. RSI-PDEbench turns that workflow into a benchmark of 1,001 cases over 42 equation templates, split into noise-free, 50% Gaussian-noise and unseen-template-with-shifted-coefficient settings; the accompanying RSI-PDE agent shortlists candidate equations by residual, refines coefficients and solvers with relative feedback, and keeps improvements behind a validation gate. Across four frontier models its mean pass rate rises 106.5–181.9% over single-run baselines and 3.0–19.6% over native agent harnesses.

Each time a web-search agent calls a tool, the long returned text is appended verbatim to its context, so after several steps the context balloons and dilutes attention. Coca-Cola instead compresses those observations into a few continuous latent tokens and embeds them directly in the agent's input embedding space, with action-preserving training aligning the next-action distributions under full and compressed observations. Across four QA benchmarks and two model families, total token consumption falls by 70.01%–89.24% and end-to-end runtime by 24.45%–55.97%, while EM and F1 exceed the uncompressed agent in every setting.

Each time a web-search agent calls a tool, the long returned text is appended verbatim to its context, so after several steps the context balloons and dilutes attention. Coca-Cola instead compresses those observations into a few continuous latent tokens and embeds them directly in the agent's input embedding space, with action-preserving training aligning the next-action distributions under full and compressed observations. Across four QA benchmarks and two model families, total token consumption falls by 70.01%–89.24% and end-to-end runtime by 24.45%–55.97%, while EM and F1 exceed the uncompressed agent in every setting.

Long-running LLM agents compact their context by writing a handoff summary that the next instance continues from, and that summary can state permissions or requirements the record does not support. Using synthetic tool-use tasks with a ground-truth permission ledger and same-snapshot replay, two AI readers confirmed unsupported restrictions in 1.2% and 2.4% of readable summaries from two open-weight models on held-out instances, and unsupported authorizations in 0.1% and 1.3%. Replacing the system prompt's "Some actions need approval." with a sentence saying where requirements come from cut unsupported restrictions from 5.0% to 1.8% of development summaries and from 1.8% to 0.3% on held-out templates, while requests for approvals the ledger requires barely changed.

Long-running LLM agents compact their context by writing a handoff summary that the next instance continues from, and that summary can state permissions or requirements the record does not support. Using synthetic tool-use tasks with a ground-truth permission ledger and same-snapshot replay, two AI readers confirmed unsupported restrictions in 1.2% and 2.4% of readable summaries from two open-weight models on held-out instances, and unsupported authorizations in 0.1% and 1.3%. Replacing the system prompt's "Some actions need approval." with a sentence saying where requirements come from cut unsupported restrictions from 5.0% to 1.8% of development summaries and from 1.8% to 0.3% on held-out templates, while requests for approvals the ledger requires barely changed.