Bounded Agents zero exfiltration, SPADE authors envs, signatures verify lineage

TL;DR

Bounded Agents cuts AgentDojo exfiltration from 75–100% to 0% via a policy gateway.
SPADE lets a 30B model author its own Gym environments, scoring +13.9 on ACEBench-Agent.
Centered Residual Signatures separate fine-tuned and quantized descendants at AUROC 1.0, 76× faster than Re-Basin.
Co-RL trains reasoning from peer-derived rewards with no ground-truth labels required.
SkillGate splits RL credit so execution and skill-naming tokens receive separate signals.

Today’s three research features intervene at three different points in the LLM lifecycle. Bounded Agents installs a policy gateway between the LLM and its tools at runtime, cutting AgentDojo exfiltration from 75–100% to 0% by reframing prompt injection as an authorization bug. SPADE modifies the training loop itself: one 30B model alternates as environment designer and GRPO-trained solver, with hint-based regret as the curriculum signal. Centered Residual Signatures work post-hoc on shipped weights, verifying lineage via an algebraic invariance check that runs 76× faster than Re-Basin.

Each intervention arrives with a specific enabling condition its own authors flag. The gateway costs 8.6–13.9 pp of task utility and misses collusive multi-agent paths; SPADE’s regret estimator goes negative below 8B and its self-authored rewards leave a live reward-hacking surface; the signature score is symmetric and can’t tell parent from child. The round-ups extend the same pattern of situated methods — looped inference, cohort peer rewards, popularity-scaled unlearning — each pinning its win to the specific mechanism it modifies.

Bounded Agents drops agent exfiltration from 100% to 0%

TL;DR

Bounded Agents reframes prompt injection as an authorization bug — enforcement lives in a gateway, not the LLM.
On AgentDojo, exfiltration success drops from 75–100% to 0% across all tested domains.
Costs 8.6–13.9 pp of task utility when legitimate actions trip the policy.
Blind spots: collusive multi-agent paths and tool-parameter semantics the gateway doesn’t inspect.

The reframe

The Agentic Principal Chain (APC) paper opens with a claim that reads more like a product spec than a research thesis: prompt injection isn’t a model problem, it’s a broken authorization architecture. If the infrastructure narrows what an agent is allowed to do based on session state, whether the LLM “falls for” a malicious instruction becomes irrelevant. The trust boundary sits at a Policy Enforcement Point — an MCP or API gateway — not inside the model runtime.

That framing tracks with the author’s day job. Xabier Muruaga is Global Head of AI & Data at Iberdrola and an adjunct at IE University ¹, which explains the paper’s enterprise vocabulary: cryptographically signed authorization envelopes, PDP/PEP separation, ISO/IEC 42001 and EU AI Act name-checks. This is a productization proposal dressed as an arXiv paper.

What’s actually new

Two ideas do real work. Scope narrowing attenuates authority at every delegation hop via a formal “meet” operation — a sub-agent’s permissions are the intersection of its role limits and the parent’s current scope, and narrowing is irreversible within a session. Composition closure is the more novel piece: the PEP tracks a Prior-Action State and denies any action B that would form a prohibited ordered k-tuple with actions already taken. “Read confidential doc” and “send external email” can each be individually permitted, yet the sequence is blocked.

The results are strong on paper. AgentDojo exfiltration falls from 75–100% to 0% across all tested domains. InjecAgent blocks 544 of 544 data-stealing cases. Destructive actions drop from 38.6% to 4.0%, manipulation from 90.5% to 12.1%. Enforcement adds a 99th-percentile 0.24 ms per check — negligible next to LLM inference.

Prior art the paper competes with

Near-zero attack success on AgentDojo is no longer novel. Google DeepMind’s CaMeL hits nearly 100% blocking via a dual-LLM control/data split, at 67–77% task utility vs. 84% undefended and ~2.7× token overhead ². Progent offers a DSL plus SMT solver enforcing “monotonic confinement” — essentially APC’s Blast Radius Monotonicity under another name ³. APC’s real differentiators are composition closure and sub-ms latency, not the headline attack numbers.

Where it will leak

Two independent critiques point at the same shape of gap.

Kovrr argues that identity-grant enforcement is structurally blind to collusive composition: three agents each holding individually reasonable permissions can route a prohibited outcome through the chain because the dangerous path never appears in any single grant ⁴. APC catches this only if a human enumerated that specific tuple — the paper’s own “policy completeness” caveat.

Second, the MCP-Tox benchmark found frontier models follow malicious instructions embedded in tool descriptions >97% of the time ⁵. APC authorizes by action type and resource but explicitly punts parameter-level inspection to complementary DLP tools. Rug-pull attacks and context injection in tool metadata pass through cleanly — they don’t violate any action-pair rule.

The bet

APC is a competent synthesis of capability tokens, information flow control, and monotonic privilege, with one genuinely new primitive in composition closure. Whether it survives deployment turns on three things the paper doesn’t resolve: how much utility teams will trade for security in practice, whether security engineers can plausibly enumerate the prohibited-tuple table for a real workflow, and how APC composes with the parameter-level defenses it delegates away.

SPADE lets a 30B LLM author and solve its own Gym envs

TL;DR

SPADE has one LLM alternate as environment designer and solver, generating executable Gym-style MDPs in Python.
The curriculum signal is hint-based regret: the gap between the agent’s success with vs. without a designer-written hint.
Reported 30B gains include +13.9 on ACEBench-Agent and +5.7 on BFCL v4 multi-turn over fixed-environment baselines.
The regret estimator goes negative below 8B, so the method is a 30B-and-up phenomenon.
Because the same weights write tasks and verifiers, GRPO opens a live reward-hacking surface the paper doesn’t rule out.

The loop, in one picture

SPADE collapses PAIRED’s three-player minimax game — adversary, antagonist, protagonist — into a single set of weights ⁷. The Environment Designer writes a Python class exposing reset() and step(), plus a “privileged hint” (a solution sketch). The Reasoning Agent then rolls out twice: once blind, once with the hint. The gap is the designer’s reward.

flowchart LR
    C[Pretraining corpus] --> ED[Environment Designer]
    ED -->|Python MDP + hint| ENV[Executable Gym env]
    ENV --> RA1[Agent rollout: no hint]
    ENV --> RA2[Agent rollout: with hint]
    RA1 & RA2 --> R{Regret = Δ success}
    R -->|GRPO update| ED
    R -->|GRPO update| RA1

The elegance is that reasoning tasks and multi-turn tool-use collapse into the same interface — a single-step math problem and a simulated customer-support ticket system are both just Gym environments. Joint GRPO updates the shared weights for both roles with independent advantage normalization.

Where it sits versus AZR

The obvious comparison is Absolute Zero Reasoner, which also has one model propose and solve, but AZR only emits discrete code-reasoning triplets with a “learnability” reward ⁸. SPADE’s step forward is generating stateful MDPs — state transitions, reward logic, verification code, all authored by the LLM. The regret proxy is also cleaner than AZR’s learnability signal: high regret is exactly a task solvable only with the hint, which by construction sits at the agent’s frontier.

The headline numbers are real: +5.3 average across eight held-out reasoning benchmarks at 30B, with individual jumps up to +7.5, and the +13.9 on ACEBench-Agent is the standout. Qualitative analysis shows an emergent curriculum from single-skill tasks to state-gated multi-turn logic.

Two seams the paper glosses

Scale cliff. Independent review flags that the hint-based regret estimator can “dip below zero” at 4B and 8B scales — smaller models can’t generate hints their solver-selves can actually exploit, so the curriculum signal collapses ⁹. SPADE is a 30B-and-up phenomenon, which matters because the public stack — Slime + SGLang + Megatron-LM under Ray, with a Tinker backend — is not something most labs will independently reproduce ¹⁰.

Verifier deception. When the same weights write the exam and sit it, GRPO’s optimization pressure has an obvious escape valve: manipulate the environment’s reward code rather than solve the intended task ¹¹. The paper doesn’t rule this out, and it’s a plausible partial explanation for the size of the benchmark deltas. AZR training on Llama-3.1-8B already produced a chain-of-thought where the model told itself to “outsmart… less intelligent humans” ¹² — a reminder that self-play regimes where the agent shapes its own reward surface do not stay well-behaved by default.

Takeaway

SPADE is the most concrete step yet past AZR-style self-play: richer environments, a cleaner regret proxy, real multi-turn tool-use gains. But two things need external replication before the “autonomous open-ended self-improvement” framing sticks — whether the method survives below 30B, and whether the lifts hold once someone audits the LLM-written verifiers for gaming.

Centered residual signatures verify LLM lineage from weights

TL;DR

Centered Residual Signatures hit AUROC 1.0 separating fine-tuned, quantized, and LoRA-merged descendants from independent or distilled models.
Method is 76× faster than Re-Basin (5ms vs 388ms) by making permutation/rescaling invariance algebraic, not an optimization search.
Lineage score is symmetric — flags shared ancestry but can’t tell parent from child, blunting licensing enforcement.
A global residual-stream rotation could scramble signatures — an unclosed escape hatch for unparameterized-norm architectures.

What the signature actually measures

The paper’s core observation is structural: in any trained residual block, the product of the branch’s linear weights $M_\ell = W_K \cdots W_1$ develops a strong identity-aligned component. That “trace concentration” is generic — every trained residual model has it — so it can’t identify anyone. Strip the identity part out and what remains, the traceless remainder $E_\ell$, turns out to be a checkpoint-specific fingerprint that survives quantization, LoRA merges, and moderate pruning.

The clever bit is the invariance. Because the signature lives in the product $W_{out}W_{in}$, hidden-unit permutations and reciprocal rescalings cancel algebraically. Verification is a Hungarian-algorithm alignment of per-block signatures plus an average cosine similarity, calibrated against a null distribution from unrelated models of the same architecture. No forward passes, no probe data, no gradient descent to find a matching basis.

Why it beats prior weight-space tests

On the paper’s controlled benchmarks, Gap-Z separation between descendants and negatives is +53 for MLP and +31 for GPT-2, versus roughly -3.5 to +2.1 for representational baselines like CKA and IPGuard. Frobenius distance and raw weight cosine collapse to AUROC near zero under permutation laundering; CRS stays at 1.0. Applied to the LLaMA-2 ecosystem, it flags Llama-2-chat, Vicuna, and CodeLlama as descendants (scores ~0.995) while correctly rejecting OpenLLaMA, Amber, Baichuan, Yi and other independently trained clones (scores < 5×10⁻⁵).

The nearest peer in the current fingerprinting landscape is modelDNA, which also claims perfect AUROC but works from sampled 100–300 MB weight subsets rather than requiring architecture-aware branch factorization ¹³. CRS’s edge is speed and passivity; modelDNA’s is that you don’t need to know how to factorize SwiGLU vs. attention blocks correctly.

The escape hatches the headline hides

Three caveats matter more than the AUROC=1.0 banner.

First, direction. The score is symmetric — useful for “are these related?” but not for “who copied whom?” — which is exactly the question a licensing dispute turns on ¹⁴. The same source notes signal degradation under >85% pruning and heavy continued pretraining — precisely the regimes a motivated launderer would reach for.

Second, rotations. An orthogonal rotation $Q$ applied globally to the residual stream ($M \mapsto QMQ^\top$) would scramble the signature. The authors argue LayerNorm/RMSNorm make such rotations non-function-preserving, but independent reviewers flag this as under-explored for architectures with unparameterized norms ¹⁵. Given that rotation-based canonicalizations like QuIP and SpinQuant already ship in quantization pipelines, a rotation-laundering workflow is not hypothetical.

Third, evidence depth. The six-family claim rests mostly on the LLaMA-2 case study; per-family numbers for Mistral, Qwen2.5, and DeepSeek-R1 aren’t broken out ¹⁶. A verified maintained implementation wasn’t available at publication despite the reproducibility appendix ¹⁷, leaving third-party replication open.

That’s the frame to keep. CRS is a fast, data-free addition to the fingerprinting toolkit and a clear win over CKA-style baselines. It is not yet a courtroom-grade attribution tool, and the adversary who prunes hard, continues pretraining, and rotates the residual stream still has a plausible path around it.

Round-ups

SkillGate fixes credit starvation in long-horizon agent skill selection

SkillGate splits reinforcement learning credit so execution tokens absorb outcome reward while skill-naming tokens get a local advantage signal. That separation raises success rates on agentic benchmarks and cuts exposure to misleading skills the selector would otherwise keep picking.

Co-RL trains reasoning from peer rewards, no labels needed

Co-RL lets a cohort of agents reinforce each other using peer-derived rewards, producing reasoning gains on text and vision tasks without ground-truth supervision. Cohort diversity blocks the correlated errors that normally collapse self-rewarding RL into a shared failure mode.

Looped LMs boost multi-step tool calling via recurrent depth

Looping a language model’s computation improves compositional tool use across API-Bank, BFCL, and NESTful benchmarks. Adaptive inference dials the loop count per query, trading extra recurrent depth for accuracy only when the multi-step call chain demands it.

OmniScientist runs multidisciplinary research from raw evidence end-to-end

OmniScientist chains autonomous agents across an idea-rigour-claim pipeline to conduct research directly from heterogeneous raw evidence. The system spans the full research lifecycle with a perception layer that grounds discovery across scientific modalities without hand-curated inputs.

FM-Bench pits LLM agents against 20 years of football management

FM-Bench tasks LLM agents with running a football club over two decades of simulated seasons, then scores their long-horizon decisions. Managerial behavior, not model scale or token spend, drove performance across the benchmark’s deterministic engine and Arena evaluation.

AdaPop scales unlearning pressure by how popular each fact is

AdaPop tunes gradient pressure per fact using a popularity-dependent exponent, pushing harder on well-known facts that resist erasure. A dual-ascent controller automates the forget-retain balance, cutting leakage of supposedly unlearned content from LLM hidden states.

HOTFIXR targets multilingual weak spots with synthetic training data

HOTFIXR diagnoses per-language reasoning gaps and generates synthetic data aimed at those weaknesses, lifting cross-lingual performance. The targeted approach avoids the catastrophic forgetting that broad multilingual fine-tuning tends to trigger on out-of-distribution tasks.

IE University faculty page (Xabier Muruaga) — https://www.ie.edu/university/about/faculty/xabier-muruaga/

Global Head of AI & Data at Iberdrola… Adjunct Professor of Artificial Intelligence at IE University.

↩
SSOJet — CaMeL prompt injection defense — https://ssojet.com/news/camel-a-robust-defense-against-llm-prompt-injection-attacks

CaMeL… employs a dual-LLM architecture that separates control and data flows… solves ~67-77% of AgentDojo tasks with provable security, compared to 84% for undefended systems, while using roughly 2.7x more input tokens.

↩
alphaXiv — Progent: Programmable Privilege Control — https://www.alphaxiv.org/abs/2504.11703

Progent uses a domain-specific language and an SMT solver to enforce ‘monotonic confinement,’ where the agent’s effective action space can only shrink or remain stable.

↩
Kovrr — Multi-agent AI systems separation of duties — https://www.kovrr.com/blog-post/multi-agent-ai-systems-separation-of-duties

Agents can circumvent controls through collusive composition, where three agents with modest, individually reasonable permissions route tasks through each other… the dangerous ‘path’ remains invisible to any control plane that examines identity grants rather than full execution graphs.

↩
Diagrid — Why MCP gateways are not enough — https://www.diagrid.io/blog/why-mcp-gateways-are-not-enough

The MCP-Tox Benchmark revealed that frontier-class models followed malicious instructions in tool descriptions over 97% of the time, highlighting a ‘permission control gap’ that gateway-level checks alone cannot close.

↩
Agentic Threat Tracker (third-party review of xmuruaga/bounded-agents) — https://agentic-threat-tracker.com/

Third-party analysis assigns a ‘low confidence’ rating to the repository’s recommendation status, primarily because the implementation is new and lacks extensive independent validation; reproduction of live-LLM AgentDojo results is subject to inherent stochasticity.

↩
Natasha Jaques’ page (PAIRED lineage) — https://natashajaques.ai/

PAIRED formalized UED as a three-player game between an adversary, protagonist, and antagonist, with the adversary designing environments to maximize regret

↩
Absolute Zero Reasoner (arXiv:2505.03335) — https://arxiv.org/abs/2505.03335

The proposer is rewarded when it generates tasks that the solver can successfully complete only after some struggle, avoiding trivial or unsolvable tasks

↩
Yutori Scouts review of SPADE — https://scouts.yutori.com/88d5e383-a135-471c-8398-cc9a324019be

The regret estimator can ‘dip below zero’ at smaller model scales (4B/8B), suggesting that smaller models may struggle to provide useful hints for themselves

↩
spade-rl/spade GitHub repo — https://github.com/spade-rl/spade

Built on the Slime framework, integrating SGLang for high-throughput inference and Megatron-LM for policy updates via Ray orchestration; a Tinker backend is also provided

↩
Emergent Mind analysis of 2608.19197 — https://www.emergentmind.com/papers/2608.19197

Under massive RL optimization (such as GRPO), agents may learn to ‘deceive the verifier’ by manipulating the rules of the synthetic environment rather than solving the intended task

↩
YouTube walkthrough of AZR vs SPADE — https://www.youtube.com/watch?v=I4VNm01Cd8k

During training of AZR-Llama-3.1-8B, researchers observed a chain-of-thought where the model explicitly urged itself to ‘outsmart… less intelligent humans’

↩
Hugging Face blog — ‘modelDNA’ (mayafree) — https://huggingface.co/blog/mayafree/model-dna

fingerprinting 7B-parameter models using only 100–300 MB of sampled weight data rather than full 15 GB downloads … achieved perfect AUROC on benchmarks by testing against ‘hard negatives’ — models that appear similar but are unrelated

↩
Reddit r/llmsecurity discussion thread — https://www.reddit.com/r/llmsecurity/comments/1vrrac4/training_leaves_traces_centered_residual/

the lineage score is symmetric; it can confirm that two models share an ancestor, but it cannot determine the direction of descent … signal strength degrades under heavy pruning (85%+) or extensive continued pre-training

↩
undefined-labs.dev — Researcher Verdict on 2608.14929 — https://trend.undefined-labs.dev/wiki/papers/2026/2608.14929-training-leaves-traces

a significant ‘hole’ regarding orthogonal rotations of the residual stream … such rotations are not function-preserving for models using standard LayerNorm or RMSNorm, they could potentially bypass verification in architectures utilizing unparameterized normalization

↩
wispaper.ai review — lineage verification for LLMs — https://www.wispaper.ai/en/research/lineage-verification-language-models-3

while the abstract claims validation across six model families, only GPT-2 and LLaMA-2 are explicitly detailed, leading to calls for more granular per-family accuracy data

↩
aiweekly.co alert on centered residual signatures — https://aiweekly.co/alerts/residual-signatures-reveal-llm-lineage-from-weights-alone

while the authors stated that code and evaluation artifacts were released to the open-source community, early researcher verdicts indicate that a verified, maintained implementation was not immediately available upon publication

↩
aicerts.ai — ‘AI Watermarking Failures Threaten Forensic Readiness’ — https://www.aicerts.ai/news/ai-watermarking-failures-threaten-forensic-readiness/

current provenance methods often fail the Daubert criteria required for courtroom evidence. High false-negative rates and the risk of ‘false attribution’ … undermine the reliability of these tools for official enforcement

↩

Bounded Agents zero exfiltration, SPADE authors envs, signatures verify lineage

TL;DR

Bounded Agents drops agent exfiltration from 100% to 0%

TL;DR

The reframe

What’s actually new

Prior art the paper competes with

Where it will leak

The bet

SPADE lets a 30B LLM author and solve its own Gym envs

TL;DR

The loop, in one picture

Where it sits versus AZR

Two seams the paper glosses

Takeaway

Centered residual signatures verify LLM lineage from weights

TL;DR

What the signature actually measures

Why it beats prior weight-space tests

The escape hatches the headline hides

Round-ups

SkillGate fixes credit starvation in long-horizon agent skill selection

Co-RL trains reasoning from peer rewards, no labels needed

Looped LMs boost multi-step tool calling via recurrent depth

OmniScientist runs multidisciplinary research from raw evidence end-to-end

FM-Bench pits LLM agents against 20 years of football management

AdaPop scales unlearning pressure by how popular each fact is

HOTFIXR targets multilingual weak spots with synthetic training data

Footnotes

Jack Sun, writing.