Skip to content

🔁 Review

week 2026-W30 · 40/1500 digests this week (2%)

Suggested keywords — copy into config.yaml if you agree

  • vlm: vision-language-action, VLA robot policy, test-time training robot, model merging LoRA VLM, training-free test-time adaptation VLM, egocentric pose forecasting, GUI state transition benchmark, audio-visual language model
  • med-foundation: discrete diffusion radiology, bidirectional infill clinical NLP, federated medical foundation model, longitudinal patient modeling, multiomics imaging integration, masked diffusion medical text, JEPA medical imaging pretraining
  • agentic-ai: memory poisoning agent, persistent prompt injection, verify-repair stopping criteria, Byzantine fault LLM validator, MCP server evolution, process reward tree rollout, agent RL curriculum, evidence-gated lifecycle
  • harness: long-context instruction degradation, progressive disclosure agent skills, agent-reactive bug, HITL enforcement gap, nonuniformity oversight, supply chain agent setup, isolation harness safety, copy-on-write agent evaluation

Week in review

W30 collected 152 paper cards across four topics: VLM (40), agentic-ai (40), harness (40), and med-foundation (32). VLM coverage was split between training-free adaptation methods and a new wave of embodied/robot-policy work (VLA models); agentic-ai was dominated by verify-repair reliability and adversarial memory attacks; harness surfaced a concentrated cluster on long-context degradation and human-oversight scheduling; and med-foundation was lighter on volume but had a notable discrete-diffusion thread that directly challenges autoregressive dominance in clinical NLP.

Dominant themes

  • Frozen > fine-tuned, repeatedly confirmed. MSSA (medical TTA), SDPR (hallucination mitigation), PatchPolicy (robot control from frozen ViT tokens), and the training-free 3D point-cloud segmenter all argue that frozen or lightly adapted backbones match or beat full fine-tuning, reinforcing an architectural stance worth taking seriously when building VLM pipelines.

  • VLA models as a distinct sub-track. Five papers (Action QFormer, FoMoVLA, RoboTTT, Xiaomi-Robotics-1, REAL) converge on the problem of grounding VLMs into robot policies. RoboTTT's 8K-timestep test-time training and FoMoVLA's dual auxiliary objectives are particularly buildable contributions; this is no longer a fringe area.

  • Agent memory as attack surface. LUCID (visual poisoning of long-term memory), MemPoison (1,227 validated memory-corruption cases), Bad Memory (CLAUDE.md/AGENTS.md as persistent injection vectors), and the adaptive multi-turn adversary benchmark collectively define a new threat model: persistent state in agentic systems is an exploitable perimeter, not an internal implementation detail.

  • Verify-repair loops need stopping criteria. VRR-Stop, TRIM (CodeSlop removal), Proof-or-Stop (evidence-gated lifecycle), and Agentic Synthesis with sketches all address different failure modes in the verify-repair-iterate loop — verification noise, patch accumulation, lifecycle inflation, and domain-rule loss. These are directly relevant to anyone building coding or planning agents.

  • Long-context degradation is real and measurable. The white-box code-auditing study, the progressive-disclosure evaluation, and the set-shifting behavioral test (WCST) all find that instruction-following erodes with context length in ways that aggregate benchmarks miss. The progressive-disclosure paper is particularly actionable: it quantifies when SKILL.md-rooted folder structures help.

  • Harness safety is a first-class concern. Supply-chain attacks via setup documentation, the enforcement gap in HITL stop primitives (six frameworks tested, all fail), and the isolation taxonomy paper argue that safety belongs in the harness substrate, not as an afterthought in agent prompts.

  • Discrete diffusion for clinical NLP. DiffusionGemma-26B matching/beating autoregressive peers on radiology VQA while enabling bidirectional infill is the most structurally interesting result in med-foundation this week — it opens interactive report-drafting workflows that AR models can't natively support.

  • RL for agents is converging on a methodology. SEED, PATR, MADA-RL, ToolVerse, LongStraw, and the Muon optimizer paper collectively push toward curriculum-aware, tree-rollout, process-reward-informed RL training for agents — a coherent research direction, not isolated papers.

  • Benchmarks exposing frontier-model floors. EvoGUI (<11% accuracy where humans score 96%), ActiveVision, UAV-DualCog, SportD, and OmniaBench all find systematic failures in areas that appear solved. The EvoGUI result is particularly stark for GUI agent builders.

  • Human oversight scheduling as an optimization problem. The nonuniformity principle (front-load interventions), the overreliance-on-test-agents position paper, and the counterfactual evaluation framework for clinical AI all argue that uniform human-in-the-loop is the wrong model — oversight should be deliberate and concentrated at high-uncertainty steps.

Gaps & blind spots

  • Audio-visual and multi-turn video VLMs are absent. Wan-Streamer is the only video-focused card; no coverage of streaming video understanding, audio grounding, or multimodal dialogue over video.

  • Federated learning and privacy-preserving training for medical foundation models. The med-foundation batch has strong coverage of robustness and efficiency but nothing on federated fine-tuning, differential privacy, or multi-site generalization — critical for clinical deployment.

  • Agent-to-agent communication protocols. Multi-agent systems appear (HetMedAgent, SearchOS, FinSAgent) but the communication layer is treated as fixed. MCP evolution is benchmarked (MCPEvol-Bench) but no paper examines protocol design choices.

  • Cost and latency optimization in harnesses. The harness batch discusses quality, safety, and correctness extensively but almost nothing on inference cost budgeting, batching, or latency/quality trade-offs in production deployments — a gap for anyone building at scale.

  • Longitudinal patient modeling. Med-foundation covers cross-sectional robustness, few-shot adaptation, and single-modality benchmarks but has no cards on longitudinal reasoning over patient trajectories or temporal change detection (TILA being the one exception, focused on chest X-ray pairs).

  • Compositional agent testing and formal verification. ETAS is the only paper applying type-theoretic reasoning to agent systems; no coverage of model checking, runtime verification, or formal contract testing for agent pipelines.

  • Open-source VLA data and training recipes. Xiaomi-Robotics-1 uses proprietary UMI trajectories; no open benchmark or reproducible training recipe for VLA policies appeared this week despite the topic's momentum.

  • Multimodal RAG / retrieval over non-text modalities. FinSAgent and SearchOS do text-centric RAG. No papers on retrieving from image databases, 3D scans, or structured clinical tables as primary retrieval targets.

Suggested next focus

  • Build a dedicated VLA tracking sub-track. Five strong papers this week, Xiaomi's 100K-hour dataset, and a clear convergence on test-time adaptation as the key lever. Worth separating from the general VLM topic to avoid dilution and enable finer-grained trend detection.

  • Systematically cover agent memory security. LUCID + MemPoison + Bad Memory + the adaptive adversary benchmark form a coherent cluster. Add targeted searches for defenses (memory integrity verification, isolation, signed memory), not just attacks.

  • Follow the discrete-diffusion clinical NLP thread. One paper, but structurally significant. Search for follow-on work on masked diffusion for structured clinical outputs, bidirectional medical text generation, and comparisons against instruction-tuned AR models on MIMIC-style tasks.

  • Track HITL and oversight scheduling as a design discipline. The nonuniformity principle, overreliance paper, and CoW scoring together suggest a small but coherent emerging literature on when/how to insert humans into agent loops. This directly informs harness design decisions.

  • Cover the RL-for-agents methodology convergence. SEED, PATR, LongStraw, ToolVerse, and Muon all appeared this week. A comparative reading on curriculum strategy, reward shaping, and context-length scaling for agent RL would be high-signal next week.

  • Add supply-chain / harness-bootstrap attack coverage. The "setup instructions as attack vector" paper is the first systematic evaluation of this; it will spawn follow-on work. Monitor arXiv for package-install, README injection, and MCP server mutation attack/defense papers.

Suggested keywords

add_keywords:
  vlm:
    - "vision-language-action"
    - "VLA robot policy"
    - "test-time training robot"
    - "model merging LoRA VLM"
    - "training-free test-time adaptation VLM"
    - "egocentric pose forecasting"
    - "GUI state transition benchmark"
    - "audio-visual language model"
  med-foundation:
    - "discrete diffusion radiology"
    - "bidirectional infill clinical NLP"
    - "federated medical foundation model"
    - "longitudinal patient modeling"
    - "multiomics imaging integration"
    - "masked diffusion medical text"
    - "JEPA medical imaging pretraining"
  agentic-ai:
    - "memory poisoning agent"
    - "persistent prompt injection"
    - "verify-repair stopping criteria"
    - "Byzantine fault LLM validator"
    - "MCP server evolution"
    - "process reward tree rollout"
    - "agent RL curriculum"
    - "evidence-gated lifecycle"
  harness:
    - "long-context instruction degradation"
    - "progressive disclosure agent skills"
    - "agent-reactive bug"
    - "HITL enforcement gap"
    - "nonuniformity oversight"
    - "supply chain agent setup"
    - "isolation harness safety"
    - "copy-on-write agent evaluation"

Candidate new skills

  • vla-tracker — VLA papers are now numerous enough (5 this week, strong venue placements) to warrant a dedicated sub-track with its own trend synthesis; folding them into general VLM dilutes signal about the specific question of grounding vision-language backbones into robot policies.

  • agent-security — Memory poisoning, persistent prompt injection, supply-chain attacks, and adversarial VLM attacks all appeared this week across three separate topic buckets. A cross-topic security skill that aggregates attack/defense papers with a shared threat-model framing would prevent these from being treated as isolated incidents in separate digests.

  • oversight-scheduling — The nonuniformity principle, overreliance-on-test-agents, counterfactual clinical evaluation, and HITL enforcement gap papers all touch the same design question: where and when should humans intervene in agent loops? This is actionable enough to warrant a recurring synthesis lens distinct from general harness review.