13 papers
Revocation Is Not Complete at Receipt: An Executable Outcome Contract for Distributed Agent-Tool Gateways
Lifei Liu, Haoran Yu, Danping Zhang
Distributed agent workflows cache delegated authority at tool gateways. Revocation may be reported at issuer commit, transport acknowledgment, or receiver persistence, although non…
CreepScope: Measuring Post-Use Authorization Exposure in Tool-Using Agents
Haoran Yu, Lifei Liu, Danping Zhang +4
Authorization checks at individual tool calls do not reveal how long earlier authority remains usable. We study this lifecycle failure as privilege creep: a capability stays reacha…
Cost-Aware Post-Hoc Deferral Under Calibration and Shift: An Environmental AI Case Study
Haoran Yu, Lifei Liu, Danping Zhang
Choosing a deferral policy for a frozen classifier requires more than ranking uncertain cases: confidence may be miscalibrated, errors have unequal costs, reviewers can err, and de…
Beyond Lexical Metrics: Sentence-Embedding Detection of Reviewer Habituation in AI Code Review
Haoran Yu, Lifei Liu, Danping Zhang
Code review is a key quality checkpoint between AI-generated code and production. As AI coding agents submit pull requests at scale, it is unclear whether reviewers reduce scrutiny…
Attesting Outputs and Delegation Ancestry in Multi-Agent AI Systems
Lifei Liu, Haoran Yu
Multi-agent applications delegate work across independently operated deployers. After an incident, a verifier must answer two questions: which deployer released the reported bytes,…
VERA: Authority-Preserving Edge Revocation for Federated AI-Agent Workflows
Lifei Liu, Haoran Yu, Xiaochong Jiang
Modern agent frameworks compose planners, tool agents, remote services, and shared specialists into runtime delegation graphs, but their revocation APIs still resemble token or sub…
When Should Active RAG Retrieve? A Budget-Aware Evaluation of Utility, Calibration, and Cost
Pin Qian, Su Wang, Chong Peng +5
Active RAG systems decide when to retrieve external knowledge during generation, making them a budget-sensitive case of agentic RAG and self-adaptive retrieval. Yet evaluations oft…
Phantom Guardrails: When Self-Improving Agent Harnesses Fix Failures That Never Happened
Su Wang, Pin Qian, Yifan Lin +5
Self-improving AI agents are designed to learn from their mistakes. We show they can also hallucinate mistakes that never happened. We study this failure mode in automated harness…
Operational Reframing and Approval-Framed Delegation in Multi-Agent LLM Safety
Lifei Liu, Haoran Yu, Xiaochong Jiang +3
Safety evaluations of multi-agent LLM systems often compare a direct prompt with a planner-executor pipeline and report the difference as a single "pipeline effect." We argue that…
ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation
Xiaochong Jiang, Shiqi Yang, Ziwei Li +3
Tool-using agents increasingly operate in open-ended deployment environments, where they compose file systems, web APIs, code interpreters, and enterprise services at runtime. This…
Habituation at the Gate: Rising Approval and Declining Scrutiny in Human Review of AI Agent Code
Haoran Yu, Lifei Liu, Xiaochong Jiang +4
As AI coding agents (e.g., GitHub Copilot, Devin, OpenAI Codex, Cursor) submit pull requests to open-source repositories at scale, a key question arises: do human reviewers gradual…
Beyond Simpson's Paradox: A Cascade of Confounders in AI Agent Pull-Request Co-Authorship
Haoran Yu, Xiaochong Jiang, Lifei Liu +3
Pooled across five AI coding agents, pull requests (PRs) with a human Co-Authored-By trailer merge less often than purely-autonomous ones (53.8% vs. 79.8%) -- yet this aggregate fi…
When Safe Skills Collide: Measuring Compositional Risk in Agent Skill Ecosystems
Su Wang, Pin Qian, Yihang Chen +6
LLM agents increasingly rely on community-contributed skills that expand an agent's operational capability set. We study a core safety problem in agentic AI systems: whether indivi…