Multimodal Agents, Ranking Security, and Repo-Level Code Generation

Today’s selection of 8 noteworthy AI/ML papers from arXiv spans a broad frontier: the emerging security risks of corpus poisoning against RAG pipelines, new frameworks for agent efficiency and multi-error attribution, rigorous benchmarking of temporal and embodied reasoning in multimodal models, and probing investigations into why safety alignment breaks under benign fine-tuning.

1. VerTox: Verifiable Reward-Guided Corpus Poisoning Against Neural Ranking Models

Authors: Zhiqi Huang, Vivek Datla, Zhichao Xu, Puxuan Yu, Vivek Srikumar et al. | Categories: cs.CL, cs.IR Link: arxiv.org/abs/2609.01325v1

This paper introduces VerTox, the first framework to formulate corpus poisoning as a verifiable reward-guided reinforcement learning (RLVR) problem. By injecting a small number of maliciously crafted documents into a retrieval corpus, the framework couples ranking distortion with factual corruption to fine-tune LLMs into adversarial generators that achieve near-perfect attack success rates against major neural ranking architectures. The generated adversarial documents are fluent, low-perplexity, and demonstrably degrade the performance of downstream RAG applications.

Takeaway: As RAG pipelines become ubiquitous, this work exposes a critical attack vector that bypasses model alignment entirely—manipulating the external corpus itself. The hard-to-detect nature of these attacks will be a major concern for production AI retrieval systems.

2. TRIAGE: Three-level Routing and Intelligent Agent Guidance for Efficient Execution

Authors: Ruocan Wei | Categories: cs.LG Link: arxiv.org/abs/2609.01428v1

TRIAGE introduces “Trajectory-as-a-Skill” (TaaS), a framework that abstracts historical execution trajectories into reusable skills to reduce token consumption in ReAct-style LLM agents. By routing queries through three categories—Direct Reuse (identical queries), Skill Substitution (deterministic parameter substitution), and Full ReAct—TRIAGE achieves token savings up to 76.3% in cross-domain validation. An online learning mechanism shows the system matures from a cold start to a 57% hit rate within the first 100 queries.

Takeaway: This work tackles one of the most pressing issues in agent economics: cost. The idea of treating dead code paths as zero-cost memory offers a pragmatic way to scale agents beyond the current constraint of auto-regenerating every token.

3. EDGE: Error Dependency Graph-Guided Multi-Error Attribution in Multi-Agent LLM Systems

Authors: Jun Hou, Priya Pitre, Yi Fang, Xuan Wang | Categories: cs.AI Link: arxiv.org/abs/2609.01360v1

EDGE is a framework for attacking the cocktail party problem of multi-agent failures—attributing not a single root cause, but a dependency graph of related errors in multi-agent LLM systems. It constructs causal subsets via counterfactual rollout and uses a two-stage LLM-as-judge to attribute errors. Experiments on TRAIL and MAST benchmarks show that including dependency structure improves category-level multi-error attribution across various prompting strategies and models.

Takeaway: Moving beyond single-root-cause attribution toward a graph-based view of failure offers a more realistic and actionable lens for debugging complex LLM agent systems, where errors rarely occur in isolation.

4. TempCloze: Can Video-LLMs Identify the Missing Middle?

Authors: Wenqi Pei, Henry Hengyuan Zhao, Yilai Liu, Jiahao Meng, Han Chen et al. | Categories: cs.CV, cs.AI Link: arxiv.org/abs/2609.01515v1

This paper introduces TempCloze, a 1,521-video benchmark designed to eliminate language shortcuts in temporal reasoning evaluations by presenting a cloze task: given the start and end of a video, models must select the true missing middle. Distractors are constructed along Semantic, Alignment, and Progression dimensions. Evaluating 31 proprietary and open Video-LLMs, the authors find that Alignment (when an event occurs) is the primary bottleneck, with models struggling to match temporal positioning despite recognizing semantic plausibility.

Takeaway: The insight that current Video-LLMs do well with “what” and “how” but poorly with “when” pinpoints a specific cognitive boundary. This benchmark could become a standard tool for testing next-generation video models that claim to understand causality and sequence.

5. Evaluating Multimodal LLMs as Generalist Vision-Language-Action Agents for Drone Control: Commanding, Approaching, Tracking and Searching

Authors: Jaewoo Park, Minyoung Lee, Sukmin Seo, Moonbin Yim, Hyunwook Yoon et al. | Categories: cs.RO, cs.AI Link: arxiv.org/abs/2609.01404v1

This paper evaluates MLLMs as drop-in drone controllers, testing models with diverse parameter scales across four core skills: approaching, tracking, searching, and multi-drone commanding. They find a stark paradox: small open models navigate into success radius more reliably than frontier models but lose episodes by failing to declare arrival or premature termination, especially in multi-drone settings where they blindly copy coordinates. The key differentiator is not navigation skill but the discipline to sustain a declared protocol and emit the correct terminating action.

Takeaway: This research reframes robotics VLA challenges away from purely visual recognition toward something more akin to protocol governance. It highlights a critical—and often underestimated—gap between small and frontier models: not “smarts,” but operational discipline.

6. Measuring consistency via ensemble margin and local prediction variability: Auditing decision systems in the presence of predictive multiplicity

Authors: Sinjini Banerjee, Tim Marrinan, Anand D. Sarwate | Categories: stat.ML, cs.AI, cs.LG Link: arxiv.org/abs/2609.01397v1

This paper examines the Rashomon effect in complex decision systems, where equally accurate models produce conflicting predictions. The authors propose a consistency criterion that audits for incorrect ensemble predictions by combining ensemble margin with local prediction variability, potentially diverting risky instances to human review. Theoretical analysis shows convergence, and experiments bear out that ensembling models from the Rashomon set reduces unchecked incorrect predictions with only a moderate increase in human review diversions.

Takeaway: In audits that increasingly underpin high-stakes automated decision-making, a framework that makes the “fog of war” around model disagreement actionable (by flagging instances for human review) is a significant step toward more trustworthy AI operations.

7. Adaptive Critical Token-Aware Retrieval for Repository-Level Code Generation

Authors: Kefeng Duan, Dewu Zheng, Yanlin Wang, Terry Yue Zhuo, Mingwei Liu et al. | Categories: cs.SE, cs.AI, cs.CL Link: arxiv.org/abs/2609.01601v1

Repository-level code generation often fails because LLMs generate incorrect “critical” tokens at decisive positions, sending the code down a wrong semantic path. ACToR is a retrieval framework that predicts these critical tokens during the autoregressive generation process and triggers targeted on-demand retrieval of relevant repository context to correct course. It also uses position-aware weighting to prioritize more informative context, achieving substantial relative performance improvements over SOTA baselines on RepoExec and CoderEval benchmarks.

Takeaway: This supports the emerging understanding that code generation errors aren’t uniform; they stem from a few “keystone” wrong characters. Hitching targeted retrieval to dynamic generation states, rather than static query context, could prove to be a highly efficient pattern for advanced code LLMs.

8. When Safety Routing Breaks: Understanding Alignment Fragility under Benign Fine-Tuning

Authors: Yitong Guo, Xiaoyi Chen, Siyuan Zhang, Xiaofeng Wang, Haixu Tang | Categories: cs.CR, cs.AI Link: arxiv.org/abs/2609.01455v1

Why does benign fine-tuning catastrophically degrade safety alignment across LLMs while only mildly impacting general utility? This work proposes a Fisher-geometric explanation rather than simply attributing it to “gradient conflict.” The authors argue that safety Fisher is low-rank and that benign fine-tuning selectively re-sharpens output-side MLP modules, acting on an “output-routing pathway.” The finding explains why few safety examples can restore refusal behavior, and why methods like LoRA suppress early collapse but weaken at large scale.

Takeaway: The paper reframes the failure mode as disruption of a low-rank routing mechanism rather than loss of knowledge. That it identifies a clear, geometric cause of “asymmetric fragility” provides a solid foundation for designing better fine-tuning procedures that avoid breaking alignment rather than merely patching it post-hoc.

This content was generated with AI assistance. Paper information sourced from arXiv.