π Executive Summary
- Agent failure is predictable from hidden states at step 1 β 47% compute savings with provable recall guarantees, extending PRE to 14 dimensions.
- In-process memory at ΞΌs latency transforms agent retrieval from "consulted tool" to "extended working memory" β 3 orders of magnitude below network stores.
- Off-host cryptographic authorization blocks 100% of tool-call attacks across 15 models, completing the agentic security stack: OS kernel + network gateway + identity layer.
π¬ Deep Dives
π Doomed from the Start: Early Abort of LLM Agent Episodes via a Recall-Controlled Probe Cascade
Method: Trains lightweight per-round probes on agent hidden activations that predict eventual episode failure as early as the first interaction round β where behavioral scorers are barely better than chance. Builds a cascade of distribution-free calibrated abort gates with per-round recall budgets jointly searched so eventually-successful episodes survive all gates at a user-specified global rate.
Key Result: Cascade meets every recall target from 90% to 97%. At 90% recall: 47.1% Β± 10.3% compute savings (Qwen-2.5-7B). 1.6β1.7Γ better than best single-gate policy. Behavioral-only cascade saves roughly half as much β hidden states encode what behavior reveals.
Key Result: Cascade meets every recall target from 90% to 97%. At 90% recall: 47.1% Β± 10.3% compute savings (Qwen-2.5-7B). 1.6β1.7Γ better than best single-gate policy. Behavioral-only cascade saves roughly half as much β hidden states encode what behavior reveals.
π SO WHAT FOR ANDY: Directly extends Production Agent Reliability Engineering to a 14th dimension: early failure prediction from internal representations. Banking agents in multi-step compliance/reconciliation workflows routinely burn inference compute on doomed trajectories β this provides a provably-guaranteed abort mechanism. The recall-controlled cascade maps directly to APRA CPS 230 operational resilience requirements.
Sig: 5/5 | Novelty: 5/5 | Actionability: 5/5 | Cross: 3/5 | Total: 18/20
π Memory in the Loop: In-Process Retrieval as Extended Working Memory for Language Agents
Method: Studies the regime where agent memory moves inside the observe-reason-act loop on every step, by replacing networked stores (tens to hundreds of ms) with an in-process store (~100ΞΌs). Invokes the Extended-Mind Thesis's parity principle: a store fast enough to be constantly available becomes extended working memory, not a tool the agent merely consults.
Key Result: Redundant actions rise monotonically with latency: 0.0/12 at in-process speed, 7.2/12 at 110ms cloud round trip (p=0.0079). Recall improves from 0/5 to 3.6β4.8/5 with in-loop memory. Zero store failures (244/244 writes preserved) β every miss traces to agent's read policy, not the store.
Key Result: Redundant actions rise monotonically with latency: 0.0/12 at in-process speed, 7.2/12 at 110ms cloud round trip (p=0.0079). Recall improves from 0/5 to 3.6β4.8/5 with in-loop memory. Zero store failures (244/244 writes preserved) β every miss traces to agent's read policy, not the store.
π SO WHAT FOR ANDY: Redefines agent memory architecture for banking. The in-process paradigm changes what's architecturally possible: agents that constantly access full working memory rather than rationing retrieval to once per turn. The finding that latency causes redundant actions means cloud-based agent deployments are architecturally driving failure β this is a deployment design choice, not a model capability issue.
Sig: 5/5 | Novelty: 5/5 | Actionability: 4/5 | Cross: 4/5 | Total: 18/20
π aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents
Method: Moves the safety decision off the agent's host: before a tool call executes, a gateway verifies caller identity with per-message HMAC-SHA256 signature bound to single-use nonce + timestamp window, evaluates role-based and argument-level policy the agent can neither read nor modify. Every decision joins a SHA-256 hash-chained audit log.
Key Result: 15 models tested, refusal varies 38%β100%. With aiAuthZ: residual attack success falls to 0% at β€0.03ms latency. On AgentDojo banking suite: blocks all 7 attacker-directed tool calls. Across 9 real incident case studies: aiAuthZ blocks 9/9 vs 4/9 for policy baseline without identity binding.
Key Result: 15 models tested, refusal varies 38%β100%. With aiAuthZ: residual attack success falls to 0% at β€0.03ms latency. On AgentDojo banking suite: blocks all 7 attacker-directed tool calls. Across 9 real incident case studies: aiAuthZ blocks 9/9 vs 4/9 for policy baseline without identity binding.
π SO WHAT FOR ANDY: Completes the agentic security triad: OS kernel (Unfireable Safety Kernel) + network gateway (aiAuthZ) + certificate authority (Sovereign Execution Brokers). AgentDojo banking validation means directly tested on financial-domain attacks. The architecture insight: don't prevent models from being deceived β prevent deceived models from acting beyond verified authority.
Sig: 5/5 | Novelty: 4/5 | Actionability: 5/5 | Cross: 3/5 | Total: 17/20
π Emerging Themes
Agent Failure is Predictable from the Inside: Doomed from the Start joins the PRE lineage with a new signal β hidden-state probes at step 1 predict eventual failure. Combined with Memory in the Loop and aiAuthZ, the agent reliability stack now spans: internal prediction + cognitive extension + external enforcement.
Memory Architecture as the Final Frontier: Memory in the Loop + HiLS Attention converge on a single thesis: memory architecture is now the primary bottleneck and highest-leverage optimization target. The in-process paradigm (100ΞΌs vs 110ms) is not incremental β it's a phase change.
The Agentic Security Stack Crystallizes: aiAuthZ completes a triad spanning 3 weeks β if one layer fails (model deceived), the next catches it (gateway blocks action), and the third provides evidence (hash-chained audit log).
β‘ Quick Hits
DT-Guard (2607.06326, 17/20) β Reasoning-Active Training, Reasoning-Free Inference: 4B guardrail beats 8B baselines (0.878 dual-side F1). Reasoning supervision internalized during training, zero reasoning tokens at inference. Banking: production-grade low-latency safety moderation.
Nemotron-Labs-Diffusion (2607.05722, 17/20) β First tri-mode LM unifying autoregressive, diffusion, and self-speculation decoding. 8B model decodes 6Γ more tokens per forward pass than Qwen3-8B. Open-weight 3B/8B/14B. Could reshape LM architecture design space.
HiLS Attention (2607.02980, 16/20) β End-to-end learned sparse attention: chunk selection optimized under LM loss. Extrapolates 64Γ beyond training context with 90% retrieval accuracy. Existing models convertible via lightweight continued pretraining.
TurnOPD (2607.05804, 15/20) β On-policy distillation made turn-aware: adaptive rollout-depth budgeting + progressive turn-normalized loss. Directly improves agent training efficiency on long-horizon tasks.
Gemma 4 (2607.02770, 14/20) β New open-weight multimodal family (2.3Bβ31B, dense + MoE). Unified encoder-free 12B model ingests raw audio/image patches. Thinking mode integrated. Rivals larger frontier open models.
π§ͺ AI-Adjacent Breakthroughs
Quantum photonic chip RP000 (2607.06488) β CMOS-compatible quantum processor demonstrated with standard manufacturing. QuantumβAI bridge approaching deployment-grade hardware.
Bit2Watt GPU-power attack (2607.05993) β Novel cyber-physical vulnerability exploiting GPU workloads to attack power infrastructure. OS/kernel/security domain relevant to banking data center resilience.
Sources: arXiv API (cs.AI, cs.LG, cs.CL, cs.CV, cs.MA: 30 papers; cs.OS, cs.DC, cs.AR: 10 papers; q-bio.NC, quant-ph: 10 papers β 33rd triple success in 35 sessions), HF Daily Papers (50 papers), web_extract for cs.AI/new + cs.CL/new listing pages. 98 candidates after dedup, 8 featured.