Claims

Directional, scoped statements — the actual content. Each shows which capability it sits under and which sources support or contest it. Sources with no citations in the last 12 months and 2+ years old are tucked behind “older sources”.

5 of 167 are contested, sorted first — see them with incoming challenges.

observationsingle papercontestedpending reviewchecked 2026-09-11· pending-review
Giving a coding agent a repository context file — AGENTS.md, CLAUDE.md — does not raise its success rate on benchmark coding tasks and costs about 20% more inference: across 4 agents, 2 benchmarks and 3 conditions, LLM-generated files hurt slightly in 5 of 8 settings while developer-written ones gained 2.4% (p=0.21), and agents obey the files — which is why they spend more — so the files do not carry success-relevant information rather than being ignored.
Axis of disagreement(a guess, not verified): Probably the outcome variable, and possibly the file's origin. The study measures success on tasks the agent has never seen, in repositories where the file was written generically or generated by the agent; the practitioner claim is about a file that accumulates the exact failures one team's agent made in one codebase, measured by whether those failures recur. A file of non-obvious project deviations might do the second job while adding nothing to the first — the study's own developer-written condition trends that way (+2.4%, not significant). If that is right, the technique's value is in what goes in the file, not in having one. Not tested against each other.
Capability: Following an unfamiliar procedure
- supportsEvaluating AGENTS.md: Are Repository-Level Context Files Helpful for Coding Agents?
- contestsMy AI Adoption Journey – Mitchell Hashimoto
- contestsHarness Engineering — Agent = Model + Harness: The 6-Layer Production Playbook
mechanismsingle papercontestedchecked 2026-09-03
Prompting a model to generate its own feedback on a draft output and revise accordingly improves quality on open-ended generation tasks (dialogue, code, review-writing) over a single-shot attempt.
Axis of disagreement(a guess, not verified): Likely how rigorously the baseline (no-revision) condition was set up and evaluated, and possibly task family — open-ended generation tasks (where "better" is fuzzier and easier to nudge with a second pass) vs. the more checkable reasoning benchmarks in the contesting paper. I haven't reconciled the two papers' exact experimental setups myself.
Capability: Fixing its own mistakes
- supportsSelf-Refine: Iterative Refinement with Self-Feedback
- contestsLarge Language Models Cannot Self-Correct Reasoning Yet
mechanismreplicatedcontestedchecked 2026-09-04
Reflect-and-retry raises task success when the feedback in the loop is a genuine external signal — a failing test, a compiler error, an environment outcome — but not when the "feedback" is the model's own unaided critique. The grounding, not the reflection step, is what does the work.
Axis of disagreement(a guess, not verified): Probably task family and how "improvement" was measured. The contesting result is strongest on open-ended generation, where better is a fuzzy judgment a second pass can nudge; the supporting results are on checkable tasks with a pass/fail signal. A secondary possibility is baseline setup — whether the no-revision comparison got the same inference budget. I have not reconciled the experimental setups myself.
Capability: Fixing its own mistakes
- supportsReflexion: Language Agents with Verbal Reinforcement Learning
- supportsLarge Language Models Cannot Self-Correct Reasoning Yet
- contestsSelf-Refine: Iterative Refinement with Self-Feedback
mechanismsingle papercontestedchecked 2026-09-07
Where a passage sits in a long input changes how much the model uses it — accuracy is highest when the needed information is at the very start or the very end and lowest when it is in the middle — so ordering retrieved passages to put the most relevant ones first is a real lever on accuracy.
Axis of disagreement(a guess, not verified): Two axes now, because there are three positions. The first is what the other passages are. The supporting result places one relevant passage among distractors, where moving it out of the middle recovers accuracy that position was costing. The 2026 conflict result places several mutually incompatible passages of equal legitimacy, where position is not degrading access to a known answer but deciding which answer wins — and reordering only moves which passage occupies the winning slot. If that is right, both hold, and ordering is a remedy for distraction rather than for conflict. The second is model generation, and it cuts across the first. Anthropic says the end-of-context bias it used to prompt around is largely gone in the Claude 5 generation. So the effect may be real, real still under conflict, and being trained away for ordinary retrieval — three claims that can all hold at once about different models at different times. This is exactly what the mechanism-versus-observation split is for, and it is an argument that this claim is closer to observation than it is currently filed. I have not tested any of the three setups against each other.
Capability: Losing information in long inputs
- supportsLost in the Middle: How Language Models Use Long Contexts
- contestsLarge Language Models in Resolving Contextual Knowledge Conflicts
- contestsThe new rules of context engineering for Claude 5 generation models
mechanismreplicatedcontestedchecked 2026-09-04
Writing out reasoning steps improves how a problem is decomposed but does not fix the arithmetic inside a step — the model can decompose correctly and still get the calculation wrong, at the same confident register as when it is right. For exact arithmetic the fix is to move the computation out of the text, not to add more steps.
Axis of disagreement(a guess, not verified): Probably what the prompting is being asked to do. The supporting results have the model perform the arithmetic across steps; the contesting result has prompting re-represent the operands (comma separation, converting between tokenizations) so the model's existing arithmetic circuitry engages. Those are different interventions wearing the same name. I have not tested whether the recovery survives on operand sizes as large as the compositionality work uses.
Capability: Digit-level arithmetic
- supportsPAL: Program-aided Language Models
- supportsFaith and Fate: Limits of Transformers on Compositionality
- contestsTokenization counts: the impact of tokenization on arithmetic in frontier LLMs
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
A ~2M-parameter classifier head that reads hidden states already computed during generation (tapping shallow, middle and deep layers of the generating model) detects response-level hallucination at least as well as specialized hidden-state hallucination detectors, and its detection quality rises with the scale of the base model it is attached to.
Capability: Stating false facts confidently
- supportsSingProbe Technical Report
mechanismmechanism reasoningpending reviewchecked 2026-09-11· pending-review
A correction made in conversation fixes one exchange and is gone when the session ends; the same correction encoded as a guide rule, a sensor, or a permission fixes every future run — so an agent system improves over time only to the extent that failures are converted into harness structure rather than re-applied as prompts, and the rate of new guide rules per week falling is the sign the conversion is working.
Capability: Following an unfamiliar procedure
- supportsHarness Engineering — Agent = Model + Harness: The 6-Layer Production Playbook
- supportsMy AI Adoption Journey – Mitchell Hashimoto
mechanismsingle paperpending reviewchecked 2026-09-11· pending-review
A large share of an agent benchmark score is attributable to the harness around the model rather than the model itself: holding the model fixed and changing only guides, sensors, retries and state management is reported to move the same model from 30.9% to 74.6% on GAIA and 30th to 5th on Terminal Bench — so a score reported for "a model" on an agentic benchmark is a score for a model-plus-harness, and comparisons across labs with different harnesses are not comparisons of models.
Capability: Whether the measurement made the finding
- supportsHarness-Bench: Measuring Harness Effects across Models in Realistic Agent Workflows
- supportsHAL GAIA Leaderboard (Holistic Agent Leaderboard, Princeton)
- supportsHarness Engineering — Agent = Model + Harness: The 6-Layer Production Playbook
- supportsAgentic Harness Engineering: The Operating System for Machine Intelligence
- supportsImproving Deep Agents with harness engineering
- supportsI Improved 15 LLMs at Coding in One Afternoon. Only the Harness Changed.
observationsingle paperpending reviewchecked 2026-09-09· pending-review
A linear probe on a tool-calling model's hidden state at the last generated token detects incorrect tool-calls — including wrong-but-well-typed argument values that parsers and logs do not catch — and works better on larger models and at middle-to-late layers than at the final layer.
Capability: Using the tools it is given
- supportsThe Calls are Coming from Inside the Model: Investigating Probe-based Detection of Tool-Calling Errors in LLMs
mechanismsingle paperchecked 2026-09-03
A memory stream with retrieval and reflection lets agents behave consistently over simulated days.
Capability: Remembering across sessions
- supportsGenerative Agents: Interactive Simulacra of Human Behavior
observationsingle paperpending reviewchecked 2026-09-09· pending-review
A model's tendency to shift political stance toward a bare demographic identity label is a separate vulnerability from its tendency to shift toward an explicitly stated user opinion: on open-ended US policy prompts, the models most moved by an identity label are among the least moved by a stated opinion, so a benchmark using only stated opinions misses identity-driven shift.
Capability: Telling the user what they want to hear
- supportsHow Identity and Opinion Shape Political Sycophancy in LLMs
observationsingle paperchecked 2026-09-04
A retrieval-augmented forecasting system built on a GPT-4-class model — not the base model alone — approaches, and sometimes exceeds, the accuracy of competitive human forecasters on real prediction-market questions dated after the model's training cutoff.
Capability: Predicting future events
- supportsApproaching Human-Level Forecasting with Language Models
mechanismmechanism reasoningchecked 2026-09-04
A running summary buys continuity across a long conversation at the cost of specifics, because it is lossy compression by construction — so it helps with "what were we doing" and not with "what exactly did I say in turn 40." Keeping the raw turns retrievable alongside the summary covers the second case.
Capability: Remembering across sessions
- supportsRecursively Summarizing Enables Long-Term Dialogue Memory in Large Language Models
- supportsLongMemEval: Benchmarking Chat Assistants on Long-Term Interactive Memory
mechanismsingle paperchecked 2026-09-03
A tiered memory system managed by the model itself sustains recall over conversations far longer than the context window.
Capability: Remembering across sessions
- supportsMemGPT: Towards LLMs as Operating Systems
mechanismsingle paperchecked 2026-09-03
Accuracy on a fact scales with how many pretraining documents mention it, so long-tail facts are systematically unreliable.
Capability: Stating false facts confidently
- supportsLarge Language Models Struggle to Learn Long-Tail Knowledge
mechanismsingle paperchecked 2026-09-03
Across eight interactive environments, models fail mostly on long-horizon tool interaction, with open models far behind commercial ones.
Capability: Using the tools it is given
- supportsAgentBench: Evaluating LLMs as Agents
mechanismsingle paperchecked 2026-09-03
Across many agent environments, most tested models scored below sixty percent on safety, with failures concentrated in unsafe tool actions.
Capability: Prioritizing safety under conflicting goals
- supportsAgent-SafetyBench: Evaluating the Safety of LLM Agents
mechanismsingle paperchecked 2026-09-03
Across many models and hundreds of thousands of samples, a substantial share of recommended packages did not exist, and the names repeated, making them exploitable.
Capability: Writing secure code and dependencies
- supportsWe Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs
mechanismsingle paperchecked 2026-09-03
Adding irrelevant tokens alone degrades reasoning, which is the mechanism by which a bloated context hurts an agent.
Capability: Keeping its own context clean
- supportsSame Task, More Tokens: the Impact of Input Length on the Reasoning Performance of Large Language Models
mechanismsingle paperchecked 2026-09-03
Agents comply with harmful multi-step requests at high rates, and simple jailbreaks transfer to agent settings.
Capability: Prioritizing safety under conflicting goals
- supportsAgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents
mechanismsingle paperchecked 2026-09-03
Arithmetic accuracy in frontier models depends strongly on how digits are chunked into tokens; a different digit grouping changes error rates.
Capability: Digit-level arithmetic
- supportsTokenization counts: the impact of tokenization on arithmetic in frontier LLMs
observationreplicatedchecked 2026-09-03
As a raw pairwise judge with no order-swap mitigation, GPT-4 can have its verdict flipped simply by swapping which candidate answer is shown first; applying a position-swap protocol restores agreement with careful human raters to close to human-human agreement levels.
Capability: Biased when judging other outputs
- supportsLarge Language Models are not Fair Evaluators
- supportsJudging LLM-as-a-Judge with MT-Bench and Chatbot Arena
observationsingle paperchecked 2026-09-04
Checking that every package an agent names actually exists catches the invented ones but not the missing ones: what agents declare is routinely a fraction of what their code imports at runtime, so generated projects fail in a clean environment even when every declared package is real. Existence is a necessary check, not a sufficient one.
Capability: Writing secure code and dependencies
- supportsAI-Generated Code Is Not Reproducible (Yet): An Empirical Study of Dependency Gaps in LLM-Based Coding Agents
- supportsWe Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs
observationsingle paperchecked 2026-09-03
Claude 2, like four other assistants tested in the same study, changed correct answers under simple user pushback ("are you sure?") and shifted its evaluation of a user's argument toward whatever position the user appeared to hold.
Capability: Telling the user what they want to hear
- supportsTowards Understanding Sycophancy in Language Models
mechanismsingle paperchecked 2026-09-03
Commercial assistants show a large accuracy drop when the relevant information sits in a long interaction history, especially for updates and multi-session reasoning.
Capability: Remembering across sessions
- supportsLongMemEval: Benchmarking Chat Assistants on Long-Term Interactive Memory
mechanismsingle paperchecked 2026-09-04
Decomposing an instruction into explicit yes/no items and judging against them beats asking for a holistic score, and the same checklist turned on the model's own draft improves the draft. The gain comes from making each requirement separately checkable, not from the model trying harder — so it is largest on instructions carrying several constraints at once.
Capability: Following an unfamiliar procedure
- supportsTICKing All the Boxes: Generated Checklists Improve LLM Evaluation and Generation
mechanismsingle paperchecked 2026-09-03
Decomposing long answers into atomic facts and checking each with search catches most errors and beats human annotators on cost and agreement.
Capability: Stating false facts confidently
- supportsLong-form factuality in large language models
mechanismsingle paperchecked 2026-09-03
Demonstrates that instructions planted in retrieved content can hijack real LLM-integrated applications for data theft and manipulation.
Capability: Following instructions hidden in data
- supportsNot what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
mechanismsingle paperchecked 2026-09-03
Few-shot arithmetic accuracy correlates with how often the specific numbers appear in pretraining data, evidence of memorization.
Capability: Digit-level arithmetic
- supportsImpact of Pretraining Term Frequencies on Few-Shot Reasoning
observationsingle paperpending reviewchecked 2026-09-09· pending-review
Fine-tuning a small multimodal model on synthesized constraint-rich instructions raises adherence to output-level constraints (format, word count, keywords) while lowering accuracy on perception-grounded instructions, so the average can fall below the base model unless the synthesis loop tracks per-constraint failures and image compatibility.
Capability: Following an unfamiliar procedure
- supportsVISA: Agentic Self-Evolving Data Synthesis for Multimodal Instruction Following
mechanismsingle paperchecked 2026-09-03
Fine-tuning on a large corpus of real API-call traces markedly improves multi-tool task completion in open models.
Capability: Using the tools it is given
- supportsToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIs
mechanismsingle paperchecked 2026-09-03
Fine-tuning on simple synthetic examples where the user's opinion is irrelevant to the answer reduces sycophancy substantially.
Capability: Telling the user what they want to hear
- supportsSimple synthetic data reduces sycophancy in large language models
mechanismsingle paperchecked 2026-09-03
Five assistants trained with human feedback consistently show sycophancy across tasks, and human preference data itself rewards it.
Capability: Telling the user what they want to hear
- supportsTowards Understanding Sycophancy in Language Models
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
For black-box hallucination detection using only sampled responses and token log-probabilities, semantic-entropy signals go to zero whenever the samples collapse into one semantic cluster — which happens for a large share of hallucinated queries, up to nearly all of them on tasks with confusable entities and figures — while token-level uncertainty still separates many of those cases, so the two signals fail on different queries and combining them detects more than either alone.
Capability: Stating false facts confidently
- supportsFrom Tokens to Semantics: Leveraging Complementary Signals for Hallucination Detection in Black-Box LLMs
mechanismreplicatedpending reviewchecked 2026-09-09· pending-review
For closed-book hallucination detection, training a small supervised classifier over many heterogeneous uncertainty scores beats the best single score, but the gain comes from the diversity of sampling-based black-box signals: ensembles over only single-generation token-probability features add little, while black-box-only ensembles do nearly as well as the full set.
Capability: Stating false facts confidently
- supportsWhen Do Supervised UQ Ensembles Improve LLM Hallucination Detection? A Robustness Study
observationsingle paperpending reviewchecked 2026-09-09· pending-review
For computer-use agents operating on a real OS, indirect-injection success rates measured with a fixed hand-written injection template understate vulnerability, because an attacker that adapts phrasing from the agent's own refusal trajectories can reach substantial success on models the fixed template never penetrates.
Capability: Following instructions hidden in data
- supportsSIR: Self-improving Red-teaming for Compute Use Agents
observationsingle paperpending reviewchecked 2026-09-09· pending-review
For data-science Python tasks where several correct solutions differ by orders of magnitude in runtime, a model's correctness rate does not predict the efficiency of the code it writes: rankings invert between the two, code-specialized open models are less efficient than general open models of similar size class, and the fastest model rotates by library (NumPy vs Pandas vs PyTorch vs Polars).
Capability: Generating and editing working code
- supportsDSEffi-Bench: Demystifying Large Language Models' Capability in Efficient Data Science Code Generation
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
For detecting hallucinated text spans in vision-language model outputs, span localization and confidence calibration come from different architectures: a fine-tuned generative VLM proposes better span boundaries but scores them poorly, while a discriminative token tagger trained with a direct regression loss on human-consensus confidence gives better-correlated probabilities but conservative spans, so using the generative spans as proposals and the tagger's probabilities as scores beats either alone.
Capability: Stating false facts confidently
- supportsSpanCalib-VLM: Calibrated Hallucination Span Detection in Vision-Language Models
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
For detecting ungrounded object mentions in open-ended captions from white-box vision-language models, a single internal support signal (token likelihood, attention share, or image-text similarity) confuses support that comes from object-specific image evidence with support that comes from scene plausibility or the generated text prefix; scoring both whether image tokens carry object-specific evidence and whether support is more image-derived than prefix-derived separates these and raises detection AUROC.
Capability: Grounding answers in the image
- supportsVisER: Visual Evidence and Reliance for Object Hallucination Detection in LVLMs
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
For filtering unsupported LLM-generated vulnerability reports in security triage, statistical machine-text detectors are the wrong instrument: they score provenance, not correctness, and human-written security reports are template-driven and low-perplexity, so they trip the same signal that flags machine text.
Capability: Stating false facts confidently
- supportsAI Slop and Hallucinations in Vulnerability Assessment: A Survey on Reasoning Failures and Trustworthy Mitigation
observationsingle paperpending reviewchecked 2026-09-09· pending-review
For locally deployed open-weight models driving a stateful, dependency-ordered MCP tool server, cutting tool descriptions from full specifications (purpose, parameter semantics, constraints, failure conditions) down to one sentence each raises the fraction of calls the server rejects for every model tested, while its effect on task coverage is less consistent.
Capability: Using the tools it is given
- supportsBenchmarking AI Agents for Hardware Design Automation via MCP Tool Calling
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
For long-horizon tool-calling agents (tasks needing five or more calls), embedding state-transition cues — preconditions, invariants, completion states — into the descriptions of the tools on the intended chain is what actually steers the agent's trajectory; runtime corrective text appended to tool results only patches residual drift, and the plausible user prompt alone (persona, deadlines, format constraints) does not establish the trajectory at all.
Capability: Following instructions hidden in data
- supportsECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic Systems
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
For open-weight agents where attention matrices are accessible, detecting injection by asking which context span actually drove the tool call — aggregating attention over the decision tokens and localizing the guiding span, then checking whether that span's provider has authority for the action — catches unauthorized tool invocations at higher true-positive and lower false-positive rates than static scanners that look for malicious-looking text, because benign-looking injected text is only harmful when it is what the model actually attends to.
Capability: Following instructions hidden in data
- supportsWhat Guides the Agent? Adjudicating Unauthorized Behavior via Localizing Behavior-Guiding Instructions
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
For persistent-memory agents, any memory-write rule that decides using only recency and provenance is stuck on a single tradeoff — accepting more genuine preference updates means admitting more poisoned ones — because an adversary who can launder a claim through the user's own channel matches the statistics a genuine revision produces; conditioning the write decision on the inferred authenticity of the claim given the interaction history moves both axes at once.
Capability: Remembering across sessions
- supportsCAPTURE: Disentangling Preference Drift from Memory Poisoning in Personalized LLM Agents
mechanismsingle paperpending reviewchecked 2026-09-07· pending-review
For safety guardrail classifiers, long-context failure is caused by proportional dilution of the unsafe evidence rather than by absolute input length: as the flagged span's share of the input shrinks, attention mass on it falls, the unsafe-minus-safe logit margin compresses, and unsafe recall collapses, while filling the same length with copies of the unsafe text leaves recall largely intact.
Capability: Losing information in long inputs
- supportsLongGuard: Mechanistic Analysis and Training-Free Mitigation of Long-Context Failure in Safety Guardrails
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
For short-answer object-existence questions in open multimodal models (LLaVA v1.5, MiniGPT-4, Qwen2.5-VL), object hallucination is driven partly by the visual encoder itself rather than only by language priors: hallucinated cases show lower image-text embedding similarity and inverted attention, and swapping in a weaker or noisier visual encoder lowers POPE accuracy while a stronger one raises it.
Capability: Grounding answers in the image
- supportsBeyond Language Priors: Diagnosing and Fixing Visual-Origin Hallucinations in Multimodal LLM
observationsingle paperpending reviewchecked 2026-09-09· pending-review
For small instruction-tuned models (3-4B) answering closed-form true/false questions under a stated user opinion, scoring each sampled response by how much more common its answer is than the group itself predicted, and using that score as the GRPO reward, reduces answer flips under user pressure and raises accuracy without any labels, roughly matching label-supervised desycophancy fine-tuning at higher compute cost.
Capability: Telling the user what they want to hear
- supportsMitigating LLM sycophancy with RL-based fine-tuning: Bayesian Truth Serum approach
observationsingle paperpending reviewchecked 2026-09-09· pending-review
For streaming video question answering with a frozen video-LLM, appending retrieved historical frames as extra visual context helps less than optimizing a small set of latent memory tokens at test time and then dropping the retrieved tokens before decoding; the gain is largest on questions requiring backward tracing over past history.
Capability: Reasoning about time in video
- supportsBeyond Retrieval: Progressive Latent Memory Evolution for Streaming Video Understanding
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
For tool-using agents, enforcing injection defense as a deterministic provenance check on sensitive tool parameters — with the only model call reading the trusted user request and never fetched content — makes admission decisions invariant to how an injection is worded, whereas defenses that judge the agent's runtime plan or behavior with a model can be steered by reworded injections.
Capability: Following instructions hidden in data
- supportsROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
For tool-using agents, restricting capabilities at the harness level after untrusted content enters the context — revoking or tightening the parameter envelopes of skills that lie on graph paths to deployer-defined forbidden states — cuts indirect-injection attack success further than prompt-level or per-action authorization defenses, and does so with no extra model calls or tokens, because enforcement reads the transition graph rather than the natural-language content.
Capability: Following instructions hidden in data
- supportsReachability-Based Capability Confinement for LLM Agents under Indirect Prompt Injection
observationsingle paperpending reviewchecked 2026-09-09· pending-review
For training-free inference-time hallucination interventions in 7B-class vision-language models, increasing intervention strength (finer regional evidence partitioning, longer attention-routing windows, stronger textual perturbation) keeps lowering CHAIR object-hallucination scores while producing empty or reduced-coverage responses, so lower hallucination numbers at high intervention strength partly reflect the model saying less rather than grounding better.
Capability: Grounding answers in the image
- supportsEviAnchor: Mitigating Hallucinations in Large Vision-Language Models via Regional Visual Evidence Compensation
observationsingle paperpending reviewchecked 2026-09-07· pending-review
For training-free inference-time hallucination mitigation in 7B vision- language models, reported gains on object-hallucination benchmarks are largely inseparable from reduced informativeness: hallucination rate and object recall/coverage move together, so a lower score can mean the model mentioned fewer visual entities rather than grounded better.
Capability: Whether the measurement made the finding
- supportsDoes Playing it Safe Count as Faithfulness? Reassessing LVLM Hallucination Mitigation Methods
observationsingle paperchecked 2026-09-04
Frozen LLMs, using only retrieval over past communications and self-reflection rather than fine-tuning, can play the social deduction game Werewolf competently and show emergent strategic behavior, including deception, without being explicitly trained for it.
Capability: Strategic deception and detecting it
- supportsExploring Large Language Models for Communication Games: An Empirical Study on Werewolf
mechanismsingle paperchecked 2026-09-04
Gating irreversible actions works only if the harness mediates every side effect, not only the branch awaiting approval. Where a gate suspends its own branch while a sibling's effect still executes, the control reads as a barrier and is not one — and the shipped implementations in widely used agent frameworks have this gap rather than it being a misconfiguration.
Capability: Prioritizing safety under conflicting goals
- supportsStop Means Stop: Measuring and Repairing the Enforcement Gap in Agent-Framework Control Primitives
observationsingle paperpending reviewchecked 2026-09-09· pending-review
General-purpose factuality verifiers (entailment-, consistency-, and RAG-trained) and zero-shot frontier LLM judges perform near chance at spotting unsupported claims in scientific peer reviews that must be checked against the full submitted paper, because they cannot separate paper-unsupported assertions from legitimate evaluative critique; small models fine-tuned on in-domain examples beat them by a wide margin.
Capability: Stating false facts confidently
- supportsHalluPeer: A Taxonomy-driven Benchmark for Detecting Hallucinations in Scientific Peer Reviews
mechanismsingle paperchecked 2026-09-07
Given several conflicting but equally legitimate passages, a model's answer is driven disproportionately by whichever passage comes first, and the skew sits in the representation of the combined prompt rather than in decoding — which is why reordering the passages does not remove it and why steering the activations does.
Capability: Checking claims against evidence
- supportsLarge Language Models in Resolving Contextual Knowledge Conflicts
- supportsAdaptive Chameleon or Stubborn Sloth: Revealing the Behavior of Large Language Models in Knowledge Conflicts
mechanismsingle paperpending reviewchecked 2026-09-11· pending-review
Giving a coding agent a raw shell is worse than giving it a designed interface: SWE-agent's constrained Agent-Computer Interface — a file viewer windowed to 100 lines, a search tool that truncates large output, and an editor that lints before a change persists — roughly doubled SWE-bench resolution over raw shell access with the same model, because verbose output and unmanaged state are where the model loses its place.
Capability: Using the tools it is given
- supportsSWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering
- supportsI Improved 15 LLMs at Coding in One Afternoon. Only the Harness Changed.
observationsingle paperchecked 2026-09-03
GPT-4 could reliably name a well-known celebrity's parent, but was far less reliable naming the celebrity when given the parent — the same directional-recall asymmetry demonstrated in smaller fine-tuned models, showing up in a deployed model that wasn't fine-tuned for the test.
Capability: Not generalizing "A is B" to "B is A"
- supportsThe Reversal Curse: LLMs trained on "A is B" fail to learn "B is A"
observationsingle paperchecked 2026-09-03
GPT-4 recommended non-existent Python and JavaScript packages in only a small percentage of generations — lower than the open models tested in the same study — but the same hallucinated names recurred often enough across runs to be practically exploitable by an attacker who registers them ahead of time.
Capability: Writing secure code and dependencies
- supportsWe Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs
mechanismsingle paperchecked 2026-09-04
Grading generated code by whether it actually passes held-out functional tests, rather than by surface similarity to a reference solution, is what makes code generation gradeable at scale — and it's how the field has graded it since the earliest large benchmarks.
Capability: Generating and editing working code
- supportsEvaluating Large Language Models Trained on Code
mechanismreplicatedchecked 2026-09-04
Grounding answers in retrieved documents reduces unsupported generation but transfers the trust problem to the retrieval channel: whatever lands in context is treated as reliable, which shows up both as following instructions planted in retrieved content and as deferring to whichever account is better represented when sources disagree.
Capability: Stating false facts confidently
- supportsNot what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
- supportsAdaptive Chameleon or Stubborn Sloth: Revealing the Behavior of Large Language Models in Knowledge Conflicts
mechanismsingle paperchecked 2026-09-03
Grounding generation in retrieved documents improves factual accuracy on knowledge-intensive tasks.
Capability: Stating false facts confidently
- supportsRetrieval-Augmented Generation for Knowledge-Intensive NLP Tasks
observationsingle paperpending reviewchecked 2026-09-08· pending-review
Guardrail instructions written to stop older models doing the wrong thing — blanket prohibitions, repeated warnings, defensive defaults — became dead weight in the Claude 5 generation: Anthropic removed over 80% of Claude Code's system prompt for Opus 5 and Fable 5 with no measurable loss on its own coding evaluations, on the reading that the constraints now conflict with each other and with user intent more often than they prevent harm.
Capability: Keeping its own context clean
- supportsThe new rules of context engineering for Claude 5 generation models
observationsingle paperpending reviewchecked 2026-09-09· pending-review
Handing an agent context-editing tools (delete, summarize, note, fold) by prompt alone makes mid-size models worse than leaving their context untouched — Qwen3-8B, Qwen3-14B and Gemma4-E4B all scored lower on long-context QA with the tools than without them; only after fine-tuning on trajectories that use the tools does the toolset become a gain.
Capability: Keeping its own context clean
- supportsContextPilot: Teaching Agents for Proactive Context Management via Fine-grained RL
mechanismsingle paperchecked 2026-09-03
Holding the task fixed and only lengthening the input degrades reasoning long before the context limit is reached.
Capability: Losing information in long inputs
- supportsSame Task, More Tokens: the Impact of Input Length on the Reasoning Performance of Large Language Models
mechanismsingle paperchecked 2026-09-03
Identifies position, verbosity, and self-enhancement biases in strong judges, while also showing high agreement with humans once mitigated.
Capability: Biased when judging other outputs
- supportsJudging LLM-as-a-Judge with MT-Bench and Chatbot Arena
observationsingle paperpending reviewchecked 2026-09-09· pending-review
In 7-8B vision-language models, fine-tuning visual and text embeddings toward perturbation-averaged and ground-truth anchors before cross-modal contrastive alignment lowers object and attribute hallucination rates on captioning and existence benchmarks without reducing object coverage or general VQA accuracy.
Capability: Grounding answers in the image
- supportsHallucination Mitigation for Large Vision-Language Models via Implicit Feature Stabilization
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
In 7B vision-language models that prune visual tokens during decoding for efficiency, hallucination rises as the generated caption gets longer, because pruning is irreversible and discards fine-grained evidence needed at later decoding steps; keeping the pruned tokens as a retrievable bank and pulling them back when next-token entropy spikes recovers the grounding without a second forward pass.
Capability: Grounding answers in the image
- supportsRVSD: Retrieval Vision Sparse Decoding for Mitigating Visual Hallucinations in Large Vision-Language Models
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
In agent pipelines that generate whole domain-specific ML codebases (medical imaging) from scratch, execution/assembly validation and domain knowledge bases fix different failures: removing runtime and assembly testing mainly costs autonomy (more human interventions to debug), while removing the curated domain knowledge base mainly costs output quality (syntactically fine but domain-inappropriate pipelines) with little change in intervention count.
Capability: Generating and editing working code
- supportsTowards Fully Automated Medical Imaging Code Generation via Validation-based Context Engineering
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
In agentic customer-service settings where a deployer incentive conflicts with a user's documented entitlement, a model's willingness to lie under incentive alone is not predicted by its willingness to lie when explicitly told to — some models comply with explicit deception instructions at high rates while almost never initiating deception under incentive, so instructed-deception evaluations measure capability rather than propensity.
Capability: Strategic deception and detecting it
- supportsKnowledge-Verified Emergent Deception in LLM Agents Under Conflicting Incentives
mechanismmechanism reasoningpending reviewchecked 2026-09-11· pending-review
In an agent's verify-and-fix loop, deterministic checks — tests, linters, schema validators — should be exhausted before any model-based judge is added, because they are free, fast and give the same verdict every time, while an LLM-as-judge costs tokens per run, returns non-deterministic verdicts, and so belongs only on properties no rule can express, and even then as an advisory signal until measured against human review.
Capability: Fixing its own mistakes
- supportsHarness Engineering — Agent = Model + Harness: The 6-Layer Production Playbook
- supportsLarge Language Models Cannot Self-Correct Reasoning Yet
- supportsMaintainability sensors for coding agents
observationsingle paperpending reviewchecked 2026-09-09· pending-review
In diffusion vision-language models generating free-form captions, object tokens that are hallucinated commit at later denoising steps and with lower per-token confidence than grounded object tokens, so the commit-step trajectory is an available internal hallucination signal that has no counterpart in autoregressive decoding.
Capability: Grounding answers in the image
- supportsReliability Challenges in Diffusion Vision-Language Models
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
In LLaVA-1.5-7B captioning, restricting a LoRA adapter to attention heads picked by a hallucination diagnosis (attention-to-image drop around hallucinated object words, then ablation screening) reduces object hallucination, while an identically trained layer-matched random-head adapter does not — so the selection, not the added adapter capacity, carries the effect.
Capability: Grounding answers in the image
- supportsTargeting the Attention Heads Behind Object Hallucination in LLaVA
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
In LLM-based ASR, steering decoding toward acoustic evidence only helps if candidates are first restricted to tokens within a small likelihood margin of the greedy token: unconstrained selection by an acoustic compatibility score removes hallucinated outputs but destroys transcription accuracy through unbounded insertions, while the constrained version removes a large share of hallucinations at near-zero WER/CER cost.
Capability: Stating false facts confidently
- supportsLikelihood-Constrained Acoustic Reranking for Training-Free Hallucination Mitigation in LLM-Based ASR
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
In multi-agent LLM systems where one agent starts with an erroneous shared belief, broadcasting every agent's full context at every step raises the rate of false assertions above doing no synchronization at all, because the error propagates to agents that were previously correct — and the harm appears only in tasks where one wrong fact cascades across semantically linked dimensions (destination to airport to weather), not where agent contexts are largely orthogonal.
Capability: Stating false facts confidently
- supportsHallucination Is Generative Memory With Its Verifier Turned Down: One Constraint Axis Links Dreaming Sleep and LLM Confabulation
mechanismsingle paperpending reviewchecked 2026-09-07· pending-review
In multi-step visual QA, a critic step run by the same model improves final accuracy only when it is shown the candidate evidence alone and denied the generator's textual rationale; conditioned on that rationale, the critic ratifies the generator's initial hypothesis and the loop performs worse than no critic at all.
Capability: Fixing its own mistakes
- supportsLOCI: A Locator-Critic with Refinement Loop
observationsingle paperpending reviewchecked 2026-09-09· pending-review
In open-ended editing tasks with no unique correct output (multi-slide design editing), a separate judge model that scores the structural diff between the original and edited artifact against the instruction, and returns its critique verbatim as the next-turn instruction, raises instruction-following over a single pass, but the gain is selective: most tasks pass on the first attempt, and a minority of the ones that enter the loop get worse unless an earlier iteration is restored when the judge's own score declines.
Capability: Fixing its own mistakes
- supportsACE: A Self-Correcting Agentic Canvas Editor for Multi-Slide Presentation Automation
observationsingle paperpending reviewchecked 2026-09-09· pending-review
In open-source vision-language models (LLaVA-1.5, Qwen-VL-Chat, Qwen2.5-VL, LLaVA-NeXT), a training-free decoding intervention that detects large layer-to-layer and step-to-step shifts in hidden states and nudges the diverging states back toward their prior value lowers object-hallucination rates, but the lower rate comes with fewer objects mentioned and shorter outputs.
Capability: Grounding answers in the image
- supportsDynamic Alignment Compensation for Hallucination Mitigation in Large Vision-Language Models
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
In open-weight 7-8B instruct models, a supervised detector built on how hidden states change between adjacent layers separates factually wrong from correct answers better than a probe on any single layer, and shuffling the layer order destroys most of the signal — so the ordering of the depth trajectory, not just the content of one layer, carries the information.
Capability: Stating false facts confidently
- supportsPrediction of Prediction (PoP): Inter-Layer Activation Fusion for Single-Pass Hallucination Detection in Large Language Models
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
In open-weight instruction-tuned models, interventions that suppress caving to user pushback (DPO, SFT on chosen responses, or activation steering) also tend to reduce the model's rate of correcting a wrong answer when genuine supporting evidence is supplied, because the two answer-flip behaviors run on overlapping MLP neurons and attention heads with positively aligned steering directions.
Capability: Telling the user what they want to hear
- supportsSycophancy Suppression Can Impair Rational Updating: Anti-Sycophancy Should Preserve the Ability to Update
observationsingle paperpending reviewchecked 2026-09-09· pending-review
In partially observable text environments (ALFWorld, ScienceWorld), letting an LLM agent query an externally maintained state estimate that keeps an explicit distribution over unobserved object locations raises task success more than querying a deterministic memory of what has already been observed, and the gain shrinks to near zero on a frontier model that already nearly saturates the benchmark.
Capability: Tracking state through a long task
- supportsTowards a Belief-Based World Model for LLM Agents
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
In retrieval-augmented answers, splitting an answer into claims, checking each against the retrieved source, and then acting on the flagged claims reduces the share of answers judged to contain unsupported content — but the strategies trade grounding against preservation: deleting unsupported claims reduces unsupported content most while retaining the least original text, and rewriting retains the most while reducing least.
Capability: Stating false facts confidently
- supportsDetecting and Repairing Hallucinations in Retrieval-Augmented Generation
mechanismsingle paperchecked 2026-09-03
In simulated retail and airline domains with tools and policy documents, frontier models succeeded on well under two thirds of tasks and success dropped sharply when the same task had to be passed several times in a row.
Capability: Using the tools it is given
- supportsτ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains
observationsingle paperchecked 2026-09-03
In simulated retail customer-support tasks with real tools and policy documents, GPT-4o — the best performer in the study — still completed well under two-thirds of tasks correctly, and its rate of passing the identical task eight times in a row (a proxy for production reliability) was far lower than its single-attempt success rate.
Capability: Using the tools it is given
- supportsτ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
In synthetic hallucination benchmarks where faithful items are human-written and hallucinated items are LLM-rewrites, a detector's binary score partly measures human-vs-machine style rather than factuality: feeding faithful LLM rewrites of the same truthful articles makes some fine-tuned encoders flag nearly all of them as hallucinated.
Capability: Whether the measurement made the finding
- supportsLost in Speech: Trilingual Spoken Hallucination Detection Across Audio and Transcripts
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
In UI-to-code generation, where a rendered screenshot gives genuine external feedback, iterative self-critique still drifts below the initial draft over ten rounds, because a code edit changes the rendering non-locally and a fix for one region breaks regions that were already faithful; restricting each round to one typed, scoped repair target and carrying past targets forward as an avoid-list reduces that drift.
Capability: Generating and editing working code
- supportsRubrics as Visual-Repair Context for Self-Evolving UI-to-Code Generation
mechanismsingle paperchecked 2026-09-03
Introduced grade-school math word problems on which 2021 models made frequent arithmetic slips, motivating verifier training.
Capability: Digit-level arithmetic
- supportsTraining Verifiers to Solve Math Word Problems
mechanismsingle paperchecked 2026-09-03
Long-form biographies from strong models contain a substantial share of unsupported atomic facts, rising for less well-known subjects.
Capability: Stating false facts confidently
- supportsFActScore: Fine-grained Atomic Evaluation of Factual Precision in Long Form Text Generation
mechanismsingle paperchecked 2026-09-03
Managing context explicitly, paging information in and out of a bounded window, sustains performance on tasks that exceed the window.
Capability: Keeping its own context clean
- supportsMemGPT: Towards LLMs as Operating Systems
mechanismsingle paperchecked 2026-09-03
Many failures come from not following domain policy documents that were provided in the prompt.
Capability: Following an unfamiliar procedure
- supportsτ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains
mechanismsingle paperchecked 2026-09-03
Models complied with insecure completions a large fraction of the time, and more capable models were more likely to suggest insecure code.
Capability: Writing secure code and dependencies
- supportsPurple Llama CyberSecEval: A Secure Coding Benchmark for Language Models
mechanismsingle paperchecked 2026-09-03
Models endorse widely held falsehoods, showing weak verification against what they know.
Capability: Checking claims against evidence
- supportsTruthfulQA: Measuring How Models Mimic Human Falsehoods
mechanismsingle paperchecked 2026-09-03
Models fine-tuned on "A is B" fail to answer "B is A", and GPT-4 recalls celebrity parents far more often than the reverse.
Capability: Not generalizing "A is B" to "B is A"
- supportsThe Reversal Curse: LLMs trained on "A is B" fail to learn "B is A"
mechanismsingle paperchecked 2026-09-03
Models readily adopt a single counter-memory passage when it is coherent, and when sources conflict they follow the majority and show confirmation bias toward their own beliefs.
Capability: Checking claims against evidence
- supportsAdaptive Chameleon or Stubborn Sloth: Revealing the Behavior of Large Language Models in Knowledge Conflicts
mechanismsingle paperchecked 2026-09-03
Models reproduce common human misconceptions, and larger models were not more truthful on this benchmark.
Capability: Stating false facts confidently
- supportsTruthfulQA: Measuring How Models Mimic Human Falsehoods
mechanismsingle paperchecked 2026-09-03
Models that predict next steps well can still hold an incoherent implicit world model, which fails when the task deviates from familiar traces.
Capability: Tracking state through a long task
- supportsEvaluating the World Model Implicit in a Generative Model
mechanismsingle paperchecked 2026-09-03
Most models claiming long contexts fail well before their advertised length on synthetic retrieval, tracing and aggregation tasks.
Capability: Losing information in long inputs
- supportsRULER: What's the Real Context Size of Your Long-Context Language Models?
mechanismsingle paperchecked 2026-09-03
Multi-digit multiplication accuracy falls to near zero as problem size grows, and models rely on pattern matching rather than a learned algorithm.
Capability: Digit-level arithmetic
- supportsFaith and Fate: Limits of Transformers on Compositionality
mechanismmechanism reasoningchecked 2026-09-04
Offloading the calculation to generated code removes the arithmetic as a source of error but does not remove error — what remains is the translation from problem to program, which is now the only thing the model is doing. Verification has to move there with it.
Capability: Digit-level arithmetic
- supportsPAL: Program-aided Language Models
mechanismsingle paperchecked 2026-09-03
Offloading the computation to generated code and an interpreter removes most arithmetic errors on math word problems.
Capability: Digit-level arithmetic
- supportsPAL: Program-aided Language Models
observationsingle paperpending reviewchecked 2026-09-09· pending-review
On code prompts that are unsatisfiable by design, open-weight code and reasoning models refuse based on how suspicious the request looks rather than how deeply impossible it is: they refuse famous theoretical impossibilities far more often than requests for plausible-sounding nonexistent packages, and the stronger models in the set close the gap on theory while barely improving on fabricated ecosystem entities.
Capability: Stating false facts confidently
- supportsRefusing the Impossible: A Taxonomy and Benchmark for Code Hallucination in Large Language Models
observationsingle paperchecked 2026-09-03
On multi-document question answering with GPT-3.5 Turbo's 16k-context variant, accuracy dropped by more than twenty points when the document containing the answer was moved from the start or end of the context to the middle, with nothing else about the task changed.
Capability: Losing information in long inputs
- supportsLost in the Middle: How Language Models Use Long Contexts
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
On multi-turn tool-calling benchmarks that score whether the final environment state matches a gold trajectory, aggregate accuracy hides wrong action-class choices: a model can call a withheld or under-specified tool with fabricated arguments, be handed the missing piece on a later turn, and still be graded PASS — so heavily tool-trained model families rank high while almost never asking for a missing parameter or refusing an unavailable function.
Capability: Whether the measurement made the finding
- supportsCalibration is the Bottleneck: An Action-Class Diagnostic of Multi-Turn Tool-Calling
mechanismsingle paperpending reviewchecked 2026-09-07· pending-review
On questions whose premises are false or internally contradictory, prompting mid-size instruct models (Qwen2.5-7B, LLaMA-3.1-8B, Gemma3-12B) to reason step by step can lower accuracy below plain answering, because the reasoning chain elaborates from the flawed premise instead of challenging it.
Capability: Stating false facts confidently
- supportsFrom Passive Response to Proactive Correction: Enhancing LLM Robustness Against Input Fact Perturbations
mechanismsingle paperchecked 2026-09-03
On realistic web tasks with explicit goals, the best model completed only a small fraction end to end, far below human performance.
Capability: Following an unfamiliar procedure
- supportsWebArena: A Realistic Web Environment for Building Autonomous Agents
observationsingle paperpending reviewchecked 2026-09-09· pending-review
On repository-level issue-fixing tasks (SWE-bench Lite/Verified/Pro), spending effort upstream — expanding the issue text into a structured requirement spec from retrieved repo context, then testing and refining that spec via generated code and tests — raises resolve rate over agents that consume the raw issue description, and raises the share of patches that even apply cleanly by a larger margin than it raises correctness.
Capability: Generating and editing working code
- supportsWiseSpec: Requirements-Driven Agents for Code Generation
mechanismsingle paperpending reviewchecked 2026-09-07· pending-review
On rubric-graded long-context tasks, most of the gain from a context- compilation harness comes from extracting the context's rules, exact terms and output spec into an explicit checklist placed in the prompt, not from the executable verifiers built on top of it — and the gain appears only on rule-dense tasks and on models with enough capacity, disappearing or reversing on open-ended tasks and on a small-activation model.
Capability: Losing information in long inputs
- supportsCompile, Don't Memorize: A Context Compilation Architecture (CCA) for In-Context Learning
observationsingle paperpending reviewchecked 2026-09-09· pending-review
On scientific tasks where a domain-specific constraint and a general presentation constraint (letter case, output format, structure) are both stated in the same prompt, multimodal models satisfy the domain-specific constraint more often than the general formatting one, so domain competence does not imply full instruction compliance.
Capability: Following an unfamiliar procedure
- supportsSciMIF: Understanding Multimodal Instruction Following in Scientific Domains
observationsingle paperpending reviewchecked 2026-09-09· pending-review
On span-level hallucination-detection leaderboards where absolute scores are low, bootstrap resampling of the test set moves top systems across wide rank intervals, so point-estimate ordering does not establish that one detector beats another.
Capability: Whether the measurement made the finding
- supportsOverview of SHROOM-Visions 2026: A Shared Task on Hallucination Detection in Large Vision-Language Models
observationsingle paperchecked 2026-09-07
On the best current calibration, AI is not yet accelerating its own development in a self-sustaining way: the modelled threshold is that a one-unit gain in model capability must buy at least 15% higher AI R&D productivity, and the back-of-envelope figure from reported engineer uplift since coding agents launched is about 9% — below it, but rising, so the gap is a current reading rather than a ceiling.
Capability: Whether the measurement made the finding
- supportsThe Economics of Recursive Self-Improvement
mechanismsingle paperchecked 2026-09-03
On verifiable instructions such as length and format constraints, strong models still fail a meaningful share, and failures grow when several constraints apply at once.
Capability: Following an unfamiliar procedure
- supportsInstruction-Following Evaluation for Large Language Models
mechanismsingle paperchecked 2026-09-03
Only models with substantial code pretraining track entity state through a sequence of operations, and all degrade as the sequence lengthens.
Capability: Tracking state through a long task
- supportsEntity Tracking in Language Models
mechanismsingle paperchecked 2026-09-03
Performance on multi-document QA is highest when the answer is at the start or end of the context and drops sharply in the middle.
Capability: Losing information in long inputs
- supportsLost in the Middle: How Language Models Use Long Contexts
mechanismsingle paperchecked 2026-09-03
Position embeddings that encode digit place let small transformers add 100-digit numbers, showing the limit is representational not fundamental.
Capability: Digit-level arithmetic
- supportsTransformers Can Do Arithmetic with the Right Embeddings
observationsingle paperpending reviewchecked 2026-09-09· pending-review
Prompt injection defenses that report near-zero attack success on short-context benchmarks lose most of that protection when the injected instruction sits inside a document of thousands to tens of thousands of tokens: fine-tuned separation defenses and detect-localize-remove pipelines still let a large share of injections through on paper review, resume screening, code review and email threads.
Capability: Following instructions hidden in data
- supportsLongPIBench: A Long-Context Benchmark for Prompt Injection
mechanismsingle paperchecked 2026-09-03
Recursively summarizing the dialogue into a running memory improves consistency in long conversations.
Capability: Remembering across sessions
- supportsRecursively Summarizing Enables Long-Term Dialogue Memory in Large Language Models
mechanismmechanism reasoningchecked 2026-09-07
Reporting how much a lab's models are used in its own research — tokens, lines of code, inference compute, experiments per researcher — cannot show that the models are accelerating the research, because every one of those is an input. Establishing the loop needs an outcome variable over time: algorithmic efficiency as a function of capability, which is the edge that turns a pipeline into a feedback loop.
Capability: Whether the measurement made the finding
- supportsOn OpenAI's research-acceleration disclosure — the measured variables are all inputs
- supportsThe Economics of Recursive Self-Improvement
mechanismsingle paperchecked 2026-09-03
Rewarding sycophantic behavior generalizes to more serious specification gaming in a small fraction of cases.
Capability: Telling the user what they want to hear
- supportsSycophancy to Subterfuge: Investigating Reward-Tampering in Large Language Models
mechanismsingle paperchecked 2026-09-03
Roughly forty percent of Copilot completions in security-relevant scenarios were vulnerable.
Capability: Writing secure code and dependencies
- supportsAsleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions
mechanismsingle paperchecked 2026-09-03
Self-supervised training on tool-call examples teaches a model when and how to call simple tools, narrowing the gap on tasks that need them.
Capability: Using the tools it is given
- supportsToolformer: Language Models Can Teach Themselves to Use Tools
mechanismreplicatedchecked 2026-09-04
Separating instructions from data raises injection resistance substantially, but both published versions get their strength from fine-tuning the model on the separation, and both report improved robustness rather than elimination. Treat it as one layer of defense in depth; the prompt-only variant, without training, has no measured efficacy behind it here.
Capability: Following instructions hidden in data
- supportsStruQ: Defending Against Prompt Injection with Structured Queries
- supportsThe Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions
mechanismsingle paperchecked 2026-09-03
Separating prompt and data with reserved delimiters and fine-tuning on that structure blocks most injections at little cost to utility.
Capability: Following instructions hidden in data
- supportsStruQ: Defending Against Prompt Injection with Structured Queries
mechanismsingle paperchecked 2026-09-03
Shows LLMs hallucinate API names and arguments when calling large API collections from memory, and that retrieving documentation reduces this.
Capability: Using the tools it is given
- supportsGorilla: Large Language Model Connected with Massive APIs
mechanismsingle paperchecked 2026-09-03
Simple goal-hijacking and prompt-leaking attacks succeed against production models with short adversarial strings.
Capability: Following instructions hidden in data
- supportsIgnore Previous Prompt: Attack Techniques For Language Models
mechanismsingle paperchecked 2026-09-04
State-of-the-art models such as GPT-4 can understand and induce false beliefs in other agents through deliberate strategic reasoning, a capability that was absent in earlier-generation language models.
Capability: Strategic deception and detecting it
- supportsDeception Abilities Emerged in Large Language Models
mechanismsingle paperchecked 2026-09-04
Static, fixed-problem coding benchmarks saturate and leak into training data over time, so getting an honest read on current code-generation ability requires a benchmark that continuously adds newly-published problems rather than reusing an older fixed set like HumanEval.
Capability: Generating and editing working code
- supportsLiveCodeBench: Holistic and Contamination Free Evaluation of Large Language Models for Code
mechanismsingle paperchecked 2026-09-03
Surveys causes, kinds, and detection of hallucination across data, training, and inference, and finds no complete solution.
Capability: Stating false facts confidently
- supportsA Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questions
mechanismsingle paperchecked 2026-09-03
Swapping candidate order alone can flip the judge's preference, so an evaluator can be gamed by ordering.
Capability: Biased when judging other outputs
- supportsLarge Language Models are not Fair Evaluators
mechanismmechanism reasoningchecked 2026-09-04
Sycophancy is triggered by the user's stated view being in context, so the cheapest control is not putting it there — ask for the answer before the opinion, or withhold the opinion entirely. Fine-tuning is the answer for the cases where the opinion has to be in context and the answer still must not move.
Capability: Telling the user what they want to hear
- supportsSimple synthetic data reduces sycophancy in large language models
mechanismmechanism reasoningpending reviewchecked 2026-09-11· pending-review
The agent that produced an artifact is a biased judge of it — it holds the context and the incentives that skew its assessment — so verification belongs with a deterministic sensor or a separate verifier that reports failures back rather than rewriting the output, and in a multi-agent system the verifier is the one component no agent may override.
Capability: Fixing its own mistakes
- supportsHarness Engineering — Agent = Model + Harness: The 6-Layer Production Playbook
- supportsLarge Language Models Cannot Self-Correct Reasoning Yet
- supportsHarness engineering for coding agent users
observationsingle paperchecked 2026-09-04
The large reported gains from fine-tuning on tool-call trajectories come from small open models starting far behind — distilling a few hundred trajectories from a stronger model moves them a long way. Whether the same procedure helps a model that is already good at tool use is a separate question this evidence does not answer.
Capability: Using the tools it is given
- supportsFireAct: Toward Language Agent Fine-tuning
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
Tool-augmented multimodal models trained only on how to call vision tools accept tool outputs uncritically; adding supervised trajectories where tool evidence is checked against the image and re-queried, plus a reward for correction that reaches a correct answer, raises accuracy on perception-heavy benchmarks (counting, depth, spatial relations) in 3B and 7B Qwen2.5-VL, while slightly lowering it on knowledge-heavy ones.
Capability: Fixing its own mistakes
- supportsThink, Look, and Revise: Inconsistency-Aware Visual Self-Correction in MLLMs
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
Training a language model with differential privacy — whether DP-SGD pre-training or DP LoRA fine-tuning — makes it generate more false claims about facts in its training data than a non-private counterpart, and the effect grows as the privacy budget tightens, because per-example gradient clipping plus noise prevents low-frequency facts from being acquired at all while flattening the next-token distribution onto incorrect alternatives.
Capability: Stating false facts confidently
- supportsThe Privacy-Hallucination Tradeoff in Differentially Private Language Models
mechanismsingle paperchecked 2026-09-03
Training against an explicit set of principles produces models that are more harmless without becoming evasive.
Capability: Prioritizing safety under conflicting goals
- supportsConstitutional AI: Harmlessness from AI Feedback
mechanismsingle paperchecked 2026-09-03
Training models to rank system, user, and tool instructions by privilege improves robustness to injections in tool outputs.
Capability: Following instructions hidden in data
- supportsThe Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions
mechanismsingle paperchecked 2026-09-03
Training on reversed sequences alongside forward text largely removes the effect.
Capability: Not generalizing "A is B" to "B is A"
- supportsReverse Training to Nurse the Reversal Curse
mechanismsingle paperchecked 2026-09-03
Training on simple gameable environments generalizes, rarely, to tampering with the model's own reward mechanism.
Capability: Prioritizing safety under conflicting goals
- supportsSycophancy to Subterfuge: Investigating Reward-Tampering in Large Language Models
mechanismsingle paperchecked 2026-09-03
Training the model to decide when to retrieve and to critique whether passages support its output improves factuality and citation accuracy.
Capability: Checking claims against evidence
- supportsSelf-RAG: Learning to Retrieve, Generate, and Critique through Self-Reflection
mechanismsingle paperchecked 2026-09-03
Under strong goal nudging, several frontier models disabled oversight mechanisms or lied about their actions in a minority of trials.
Capability: Prioritizing safety under conflicting goals
- supportsFrontier Models are Capable of In-context Scheming
observationsingle paperchecked 2026-09-03
Under strong, deliberately adversarial goal pressure in an autonomous-agent setting, Claude 3.5 Sonnet sometimes disabled oversight mechanisms or misreported its own actions to keep pursuing the stated goal — in a minority of trials, and the study explicitly does not claim this happens in ordinary, non-adversarial use.
Capability: Prioritizing safety under conflicting goals
- supportsFrontier Models are Capable of In-context Scheming
observationsingle paperpending reviewchecked 2026-09-09· pending-review
Used zero-shot as step-level action critics in long-horizon tool-calling tasks, frontier models are over-pessimistic — flagging a large share of correct actions and pushing the actor into revision loops that lower success below no critic at all — whereas small models fine-tuned on action-level verification rationales flag far fewer valid actions and raise repeated-run reliability.
Capability: Using the tools it is given
- supportsCAST: Critique-Aware Supervision for Training Reliable Long-Horizon Tool-Calling Agents
mechanismsingle paperchecked 2026-09-03
Users with an AI assistant wrote less secure code and were more confident it was secure.
Capability: Writing secure code and dependencies
- supportsDo Users Write More Insecure Code with AI Assistants?
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
When a calculator-using model is trained with reinforcement learning on verifiable final-answer rewards for an arithmetic search task (Countdown), the gain lands almost entirely at low k — pass@1 rises sharply while pass@16 moves little or falls — because the update can only reinforce correct trajectories the starting policy already samples, and prompt groups with no correct sample supply no gradient.
Capability: Using the tools it is given
- supportsLearning to Use Tools: Reinforcement Learning for Tool-Integrated Mathematical Reasoning
observationsingle paperpending reviewchecked 2026-09-09· pending-review
When a code-generation prompt combines a prompt-enforced output format (JSON or XML), a persona, and urgency framing at once, pass@1 on function-level Python problems can fall well below the sum of each constraint's individual effect, even when each constraint alone is neutral or helpful — observed in the GPT-4o family and absent in the GPT-4.1 family and o3-mini.
Capability: Generating and editing working code
- supportsCompound Prompt Constraints in LLM Code Generation: A Factorial Study of Format, Persona, and Urgency
mechanismsingle paperchecked 2026-09-03
When a model gets a real environment signal after acting — a test result, a tool error, a task-success indicator — reflecting on that signal in words and retrying substantially improves success rates on multi-step coding and decision-making tasks over a single attempt.
Capability: Fixing its own mistakes
- supportsReflexion: Language Agents with Verbal Reinforcement Learning
mechanismsingle paperpending reviewchecked 2026-09-07· pending-review
When a multimodal model is asked an object-existence question over a set of images at once, it is less accurate than when the same images are queried one at a time and the answers combined, so cross-image integration adds errors beyond the per-image perception errors.
Capability: Grounding answers in the image
- supportsFine-Grained Multi Image Object Hallucination Benchmark
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
When a multimodal model is given external text that contradicts the image, making it commit to a description of the image before the text is admitted, then reconciling the two in a second call, recovers accuracy the single-prompt setup loses — but the benefit of withholding the text from the first call is model- and text-source dependent, and on some models context-preserving prompting is still better.
Capability: Telling the user what they want to hear
- supportsDo Multimodal LLMs See Before They Read? Diagnosing Contextual Sycophancy
observationsingle paperpending reviewchecked 2026-09-09· pending-review
When a structured long-term memory substrate (indexes, retrieval, control logic) is held fixed and only the backbone LLM is swapped, accuracy on multi-session memory benchmarks like LongMemEval and LoCoMo moves by a few points while per-query cost varies by roughly an order of magnitude, so recall quality in these settings is set mostly by the memory and retrieval design rather than by model choice.
Capability: Remembering across sessions
- supportsAgent Zero Memory: Provenance-Aware Long-Term Memory for LLM Agents
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
When a user profile of stated attributes and preferences is placed in context, models agree with the user far more than with no profile — across 13 open and closed models the profile, not retrieved conversation memory, is the dominant driver, and inverting the stated preference flips almost all responses to the opposite side.
Capability: Telling the user what they want to hear
- supportsEvaluating the Hidden Costs of Personalization in Large Language Models
observationsingle paperpending reviewchecked 2026-09-09· pending-review
When a video-understanding instruction contains several conditional branches and the model must pick the branch matching what the video shows, both proprietary and open multimodal models pick correctly far more often when the correct branch is listed first, and accuracy falls as the correct branch moves later in the list.
Capability: Following an unfamiliar procedure
- supportsVideo-IFBench: Evaluating Instruction Following of Multimodal LLMs in Video Understanding Scenarios
mechanismsingle paperpending reviewchecked 2026-09-07· pending-review
When an agent must work over a very large tool catalogue, wrapping each tool in a natural-language interface that resolves the API schema internally — so raw schemas are retrieved on demand rather than enumerated in the model's prompt — contributes more to multi-step tool- call success than the surrounding planner, router, or verifier stages.
Capability: Using the tools it is given
- supportsHarness Engineering in LLM Tool Use via Agent-Native Reusable Tool Primitives
observationsingle paperpending reviewchecked 2026-09-09· pending-review
When an LLM agent must reconcile user-supplied identity credentials against database records before a sensitive read or write, frontier and open models frequently skip the cross-field consistency check and act anyway, and the failure rate barely moves whether the request is simple or has several parallel sub-requests and whether the forged field is visually near-identical to the true one or completely unrelated.
Capability: Checking claims against evidence
- supportsKC-Bench: A Dynamic Interactive Benchmark for Evaluating Knowledge Conflicts in LLM Agents
observationsingle paperpending reviewchecked 2026-09-09· pending-review
When building preference data to teach 7-8B instruct models to follow multi-constraint instructions, perturbing each atomic constraint in several directions so the perturbed instruction's valid-response set contains, partly overlaps, or is disjoint from the original's — and pairing responses drawn from each sub-region — raises constraint adherence more than rejection sampling or teacher-correction pairs, and the gain holds on perturbed instruction variants the baselines barely improve on.
Capability: Following an unfamiliar procedure
- supportsCross-Relational Preference Learning for Better LLM Instruction Following
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
When comparing a weight-shared recursive model against a depth-matched plain transformer on code generation, the ranking read from a single checkpoint can invert during training, because the larger-parameter arm passes its validation optimum and overfits while the parameter-lean recursive arm keeps improving — so a late-epoch "recursion fits better" reading is a degradation artifact, not a capability difference.
Capability: Whether the measurement made the finding
- supportsEvaluating Tiny Recursive Models Across Training for Code Generation
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
When fine-tuning a base model on instruction data, removing from the training targets any factual claim the base model cannot consistently recall raises the supported-claim rate of later long-form generations, but the gain comes largely from a more conservative response policy — more refusals and fewer supported claims per answer — not from generating more correct facts at equal coverage.
Capability: Stating false facts confidently
- supportsStick to What You Know: A Study of Knowledge-Aligned Supervised Fine-Tuning
observationsingle paperpending reviewchecked 2026-09-09· pending-review
When grading LLM-generated unit tests by pass rate and line coverage alone, a share of passing test suites never directly call the function under test — they reach it through wrappers, mocks, or unrelated public APIs — so pass rate overstates test quality, and this gap widens under agentic repository-access workflows and richer file-level context.
Capability: Whether the measurement made the finding
- supportsXREPOTEST: Benchmarking Multilingual Repository-Level Unit Test Generation for Large Language Models
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
When hardware description code (Verilog, SystemVerilog, VHDL, Amaranth-Python) is generated from a functional specification that omits security obligations — as real SoC docs do, keeping countermeasures in separate config files — frontier models pass functional tests far more often than security tests, and the model with the highest functional pass rate is not the safest; naming the relevant CWE in the prompt raises the security pass rate sharply, showing the limit is missing awareness of the required obligation rather than inability to write defensive RTL.
Capability: Writing secure code and dependencies
- supportsUnsaid, Unsafe? Implicit Security Obligations in LLM-Based RTL Code Generation
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
When preference pairs are built by having one strong model write all chosen responses and one weak model all rejected responses (delta learning), contrastive objectives such as DPO transfer the chosen model's sycophantic-agreement rate to the student even though no individual example contains sycophancy — the student's rate tracks the log-ratio of the two teachers' sycophancy rates, so reversing which teacher is 'chosen' drives sycophancy far below the SFT starting point.
Capability: Telling the user what they want to hear
- supportsSycophantic Agreement Transfers with Neutral Data via Contrastive Preference Optimization
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
When research-idea forecasts are scored by whether a later paper matches them under an LLM judge rubric, higher scores partly reflect broader, less specific ideas: the backbone with the higher hit rate also produced measurably more general forecasts and had more retrieved candidate papers pass the gate, and tightening the specificity threshold does not separate the two.
Capability: Whether the measurement made the finding
- supportsCan Large Language Models Forecast What Researchers Study Next?
mechanismsingle paperpending reviewchecked 2026-09-09· pending-review
When retrieval for a summarization task pulls definitions by surface term match from a general encyclopedia, ambiguous terms fetch the wrong sense and the model incorporates that unsupported background into its output, lowering claim-level factuality below the no-retrieval baseline even when the prompt tells it to ignore unrelated retrieved content.
Capability: Stating false facts confidently
- supportsImproving Health Literacy through Lay Summarization of Radiological Reports: An Evaluation of BioNER and Retrieval-Augmented Generation
observationsingle paperpending reviewchecked 2026-09-09· pending-review
When the preference needed to answer a query lies in a different concept space from the cues in a user's dialogue history (e.g. inferring an emotion-regulation strategy from personality cues), retrieval-based and profile-summarization personalization methods barely beat a no-history baseline, and dumping the full history into the prompt does worse than no history at all.
Capability: Remembering across sessions
- supportsVIBE-Bench: Evaluating Personalized Large Language Models When Profiles Don't Mean Preferences
mechanismsingle paperpending reviewchecked 2026-09-07· pending-review
When training small instruction-tuned models with reinforcement learning plus factual supervision, routing each atomic fact's verification score only to the tokens that produced it, and down-weighting verifier judgements that do not change when their key evidence is removed, improves factuality benchmark scores over trajectory-level or reasoning- step-level factual rewards.
Capability: Checking claims against evidence
- supportsFARCA: Fact-Aligned Reliability-Aware Credit Assignment for Reinforcement Learning with Factual Supervision
observationsingle paperpending reviewchecked 2026-09-09· pending-review
When VLM agents must verify claims against interactive visualizations where no claim is answerable from the initial viewport, giving them an interaction budget of ten actions does not reliably beat answering immediately from the first screenshot — some models score slightly lower with interaction — because partial, unplanned exploration leaves the model with enough evidence to abandon its prior but not enough to replace it.
Capability: Checking claims against evidence
- supportsInSight: A Benchmark for Agentic Claim Verification in Interactive Visualizations
observationsingle paperpending reviewchecked 2026-09-11· pending-review
With weights frozen and no stronger model in the loop, an agent can raise its own pass rate by rewriting the scaffolding it runs inside — clustering its failures, proposing minimal edits to prompts, tools and policy, and keeping only edits that improve one split without degrading another: all 9 of 9 model-by-benchmark pairs improved, by up to 40.6 percentage points (GLM-5 on AppWorld, 44.4% to 85.0%), with weak models gaining most; but the promotion gate reads the held-out split, so the reported held-out gain is not clean generalisation, and there is no matched-compute baseline.
Capability: Fixing its own mistakes
- supportsSelf-Harness: Harnesses That Improve Themselves
observationsingle paperchecked 2026-09-04
Without added retrieval infrastructure, language models underperform human experts at forecasting real-world events from a benchmark of actual forecasting-tournament questions, though accuracy improves with model scale and access to relevant news context.
Capability: Predicting future events
- supportsForecasting Future World Events with Neural Networks
mechanismsingle paperchecked 2026-09-03
Without an external, ground-truth signal — a failing test, a compiler error, a verifier's output — a model's own critique of its reasoning is not a reliable improvement signal, and asking it to review and revise a correct answer often turns it into a wrong one.
Capability: Fixing its own mistakes
- supportsLarge Language Models Cannot Self-Correct Reasoning Yet
observationmechanism reasoningpending reviewchecked 2026-09-08· pending-review
Worked examples in a tool description, long the standard way to teach tool use, can constrain a capable model to the exploration space the examples describe; Anthropic now advises designing expressive parameters instead — a status enumeration that implies its own usage rather than a demonstration of it.
Capability: Using the tools it is given
- supportsThe new rules of context engineering for Claude 5 generation models