NVIDIA distills to 45%, Verus drives 0/1000 races, WAPO trains on winners only

TL;DR

• NVIDIA’s ProCUA-SFT lifts UI-TARS-1.5-7B to 45.0% on OSWorld via Kimi-K2.5 distillation.
• Same ProCUA recipe collapses to 8-10% when fine-tuned on AgentNet’s 22.5K human trajectories.
• Verus proofs drive multi-agent LLM races from 1000/1000 to 0/1000 under deterministic schedules.
• WAPO holds RLVR training stable for 600 steps on Gemma3-4B by masking non-winners.
• WAPO’s winner-only updates erode Pass@k diversity, collapsing model output toward a single mode.

Three unrelated AI-research leads today, each pointed at a different layer of the agent stack. NVIDIA’s ProCUA-SFT lifts UI-TARS-1.5-7B to 45.0% on OSWorld by fine-tuning on 3.1M synthetic steps distilled from Kimi-K2.5 — the same recipe collapses to single digits on real human trajectories. Verus-verified Rust runtimes discharge 274 obligations to drive multi-agent LLM concurrency anomalies from 1000/1000 down to 0/1000, reproducing a silent lost update in ByteDance’s deer-flow along the way. And WAPO holds RLVR training stable for 600 steps on Gemma3-4B and Qwen3-4B by masking every non-positive completion — though independent work shows the winner-only move erodes Pass@k diversity. Different problems, different methods, different scoreboards.

NVIDIA’s ProCUA-SFT distills Kimi-K2.5 to 45% on OSWorld

Source: hf-daily-papers · published 2026-06-14

TL;DR

• NVIDIA’s ProCUA-SFT lifts UI-TARS-1.5-7B from 26.3% to 45.0% on OSWorld after one epoch of fine-tuning on 3.1M synthetic steps.
• The same fine-tuning recipe applied to AgentNet’s 22.5K human trajectories collapses the model to ~8–10% — a sharp negative-transfer reversal.
• The teacher model Kimi-K2.5 scores 63.3% on OSWorld-Verified, reframing the result as a distillation gain rather than novel agentic reasoning.
• Downstream, the Nemotron-3 Nano Omni release trained on this data ships with no refusal layer for harmful computer-use goals.

The headline result

ProCUA-SFT is a 3.1M-sample supervised fine-tuning corpus built from 93,000 synthetic trajectories on a live Linux desktop, spanning 2,484 application combinations. One epoch of fine-tuning takes UI-TARS-1.5-7B from a 26.3% OSWorld success rate to 45.0%, an 18.7-point absolute lift. The same recipe with AgentNet — the largest open human-trajectory dataset — drives the model below 10%. The authors’ explanation: AgentNet trajectories average 17 steps and are 63% click-heavy, while ProCUA’s average 30 steps and lean on keyboard primitives, which are less brittle for fine-grained navigation.

How the pipeline avoids hallucinated tasks

The novel piece is a single-VLM loop where Kimi-K2.5 plays generator, judge, and actor. A goal is proposed alongside five binary preconditions (“Is data.xlsx on the desktop?”), a judge VLM checks them against the actual screenshot and OS state, and rejected goals are fed back for refinement until grounded.

flowchart LR
    A[VM seeded with<br/>SpreadsheetBench +<br/>Zenodo10K files] --> B[Kimi-K2.5<br/>generator]
    B --> C{Judge VLM:<br/>preconditions<br/>met?}
    C -- no --> B
    C -- yes --> D[Kimi-K2.5<br/>actor rollout]
    D --> E[Self-terminate<br/>success/fail]
    E --> F[Step-prefix<br/>expansion → 3.1M<br/>SFT samples]

Decoupling inference (stateless vLLM) from environments (Singularity/KVM or NVIDIA Cloud Functions) let the authors run thousands of VMs in parallel — the real bottleneck, they note, is booting Linux, not GPU inference.

The distillation ceiling

The headline 45.0% sits at roughly 71% of teacher Kimi-K2.5’s reported 63.3% on OSWorld-Verified ¹. That reframes ProCUA-SFT as a high-quality distillation pipeline rather than a generic recipe for agentic capability — its ceiling is set by whichever frontier VLM you point it at. Meituan’s concurrent EvoCUA takes a different bet, using an evolutionary loop with executable validators to push OpenCUA-72B from 45.0% to 56.7% on OSWorld ². The interesting frontier may be task evolution and code-based verification, not step-prefix expansion at 7B.

The judge-is-also-the-actor problem

Using one model for generation, verification, and execution is elegant but inherits well-documented VLM-as-judge pathologies: informativeness bias and ~8.2% position-bias swings between options ³. A precondition the generator hallucinates is exactly what the same model is worst-equipped to flag. The authors’ own caveat that success rests on self-termination lines up with this. STEVE-style pipelines deliberately use an external model (GPT-4o judging Qwen) for step-level rewards to break this loop ⁴; ProCUA-SFT skips that on cost grounds.

The base-model choice also muddies the negative-transfer story. UI-TARS-1.5 is notoriously prompt-sensitive — practitioners report 4× latency spikes and malformed JSON from small prompt edits ⁵ — so some of the AgentNet collapse may reflect format mismatch rather than a clean indictment of human data.

The safety overhang

ProCUA-SFT trained Nemotron-3 Nano Omni’s computer-use stack. NR Labs has already shown that a one-line “uncensored” system prompt makes that model produce working Windows keyloggers ⁶. The synthesis pipeline filters for task feasibility, not harmfulness — a gap that scales with every additional desktop-capable open weight.

---

Verified Rust runtimes cut multi-agent LLM races to 0/1000

Source: hf-daily-papers · published 2026-06-14

TL;DR

• 274 Verus obligations, zero admits, discharge soundness and completeness for 5 LLM-specific concurrency anomalies.
• Verified runtimes drove anomaly counts from 1000/1000 to 0/1000 on adversarial schedules.
• Token overhead: ~8% for snapshot isolation, 1.6–2.3× for pessimistic locking — well under the order-of-magnitude folklore.
• Proofs reproduce a silent lost update in ByteDance’s deer-flow and a LangGraph ToolNode reordering bug.
• The catch: proofs assume deterministic, synchronous execution — real agent runtimes are stochastic and Tokio-async.

The bug class is real, and LangGraph users hit it

When two LLM agents share a memory store or tool registry, the long inference phase between read and write opens a window that classical databases close with locks or MVCC. LangGraph’s own docs name the symptom — INVALID_CONCURRENT_GRAPH_UPDATE — and tell developers to paper over it with reducer functions like operator.add ⁷. The MAST taxonomy attributes 41–87% of multi-agent failures to coordination and system design rather than model capability ⁸, and infrastructure vendors are explicitly repositioning memory from “retrieval” to “state infrastructure” ⁸. The paper under review is the first to treat this as a verified-systems problem rather than a prompt-engineering one.

The model: read–generate–write

The authors carve every agent step into three phases and prove anomalies against it.

flowchart LR
    R[Read phase<br/>capture cells + tool registry] --> G[Generation phase<br/>seconds-to-minutes inference<br/>read set NOT locked]
    G --> W[Write phase<br/>atomic commit of writes + tool calls]
    X[Other agent commits] -. invalidates read set .-> G

That unlocked generation window is where Stale-Generation (A1), Phantom-Tool (A2), Causal-Cascade (A3), Split-View (A4), and Tool-Effect Reordering (A6) live. The five are formalized as TLA+ predicates over operation histories, with TLC-generated witness traces, then mirrored in Rust detectors that Verus mechanically verifies for soundness and completeness.

Results that matter

A consistency lattice L0 → L4 ranks runtimes from “no guarantees” to full registry-snapshot isolation. Three Rust implementations realize the middle and top of that lattice:

The 1.6–2.3× locking figure is the most interesting number in the paper. Industry assumes locking is an order-of-magnitude penalty for LLM workflows; the measurement says no. Stale-generation rates on real LLM sessions (GPT-4o, Claude Sonnet 4.5, Llama-3.2) hit 1% on plan-execute, 35% on triage, and 100% on edit-review under high contention — and the L2 runtime prevented the Causal-Cascade anomaly across all 120 retracted triage sessions where the baseline corrupted state.

The downstream proof point: a verified L0→L1 refinement fixes a real silent lost update in deer-flow, and an L3 commit-order sequencer eliminates the LangGraph ToolNode reordering bug.

The cracks in the proof

The collective state transitions of the MAS remain prone to Structural Race Conditions. ⁹

That dissent matters. Verus’s async-Rust story is still immature, and most production agent runtimes are Tokio-based ⁹. Microsoft’s own Verus group notes the tool “still forces developers to manually identify and refine high-level properties” — the L0–L4 lattice is a human modeling choice, not a discovered invariant ¹⁰. And the proofs assume deterministic generation; real LLMs are stochastic even at temperature 0, which the authors acknowledge and patch with a “probabilistic refinement” they don’t fully cash out.

The contribution is still substantive: a 274-obligation, zero-admit discharge is plausible-not-heroic given Verus’s 3–61× speedup over prior Rust verifiers ¹⁰, and the Cloudflare 2025 outage from an unverified .unwrap() is a fresh reminder of why mechanized proofs are worth the bookkeeping ¹¹. What’s missing is independent confirmation — merged upstream PRs in deer-flow and LangGraph, not just authorial reproductions.

---

WAPO stops RLVR collapse by training only on winners

Source: hf-daily-papers · published 2026-06-14

TL;DR

• WAPO masks every non-positive-advantage completion during RLVR training, updating gradients only on “winners.”
• Training stayed stable for 600 steps where GRPO and DAPO collapsed on Gemma3-4B and Qwen3-4B.
• On Qwen3-4B, WAPO beat the best stable baseline by +9.9% EM on OTT-QA and +4.5% on Hotpot-QA.
• The catch: independent work shows positive-only updates erode Pass@k diversity by absorbing mass into a single mode.

The collapse WAPO is named for

RLVR methods like GRPO are notorious for sudden training collapse — the model stops reasoning and starts emitting repetitive or malformed text. Layer 6’s WAPO paper traces this to token-level gradient dynamics rather than policy drift, and the diagnosis lines up with independent post-mortems. OpenTrain’s analysis of GRPO describes a “Lazy Likelihood-Displacement Death Spiral” in which the likelihoods of correct and incorrect responses decay together until lower-confidence outputs inflate gradients and optimization fails ¹² — essentially the high-entropy collapse the WAPO authors formalize.

Their taxonomy sorts every sampled token into one of four regimes by the sign of its advantage and its probability relative to an adaptive reference $C(p)=\sum p_j^2$:

Both collapse modes live on the negative-advantage side. WAPO’s fix is to remove that side of the update entirely.

Drop the losers, keep the clipping

WAPO is a one-line surgery on GRPO: in each group of rollouts, zero the gradient for any completion whose group-normalized advantage is non-positive. The clipped importance-sampling objective and critic-free group baselines are unchanged. In a binary-reward setting the update reduces to $(1-q_x)\nabla q_x$, where $q_x$ is the prompt’s success rate — which functions as an implicit curriculum, down-weighting prompts the model has already mastered ¹³.

This is philosophically close to RAFT-style rejection fine-tuning, but RAFT and RAFT++ under sequence-level normalization tend to collapse toward terse, formulaic answers — the well-known “short-answer bias” ¹⁴. WAPO keeps online clipping and group normalization, which the authors credit for avoiding that failure mode.

Against the obvious competitors — DAPO’s asymmetric “Clip-Higher” and GSPO’s sequence-level ratios, the latter increasingly preferred for MoE training ¹⁵ — WAPO posts the cleanest stability story and the biggest out-of-domain transfer numbers (34.2 EM on Hotpot→2-wiki for Qwen3-4B vs. 29.7 for GSPO).

Where the diversity critique bites

The strongest pushback isn’t about stability but about what positive-only training silently gives up. Work on Negative Sample Reinforcement decomposes the policy gradient into PSR and NSR components and finds NSR alone improves the entire Pass@k curve by spreading probability across plausible alternatives, while positive-only methods “absorb” mass into a single mode and erode the diversity needed for test-time compute scaling ¹⁶.

Positive-only methods absorb probability density into a single mode, squeezing out the diversity needed for test-time compute scaling.

WAPO reports pass@16 on one math benchmark (81.02% on SmolLM3-3B, matching GSPO) but no broader Pass@k sweep — the exact metric where the NSR critique predicts the cost would show up.

There is also a confound the paper doesn’t isolate. Recent entropy-collapse forensics show BF16 importance-ratio computation introduces a multiplicative upward bias that disproportionately clips exploitation tokens, flipping otherwise-stable algorithms into collapsing ones unless recomputed in FP16 ¹⁷. WAPO’s baselines are run in BF16, so some fraction of the reported stability gap may be a numerical artifact rather than a property of positive-only masking.

The gradient taxonomy is a real analytical contribution, and the stability gains track parallel work. Whether “drop the losers” survives Pass@k scrutiny at 70B+ scale — and whether the baselines were ever as broken as they looked — are the next two experiments worth running.

Round-ups

Looped world models hit 100x parameter efficiency via shared blocks

Source: hf-daily-papers

Looped world models iteratively refine latent environment states by reusing a single parameter-shared transformer block, adapting computation depth to each prediction’s complexity. The design reaches roughly 100x parameter efficiency versus standard world models while matching prediction quality on harder rollouts.

Variable-width transformers beat uniform layer designs on efficiency

Source: hf-daily-papers

A new decoder-only architecture allocates nonuniform width across layers, using a parameter-free residual resizing mechanism to stitch differently sized blocks together. The X-shaped design improves performance per FLOP and shrinks KV cache memory compared to standard uniform-width transformers and MoE baselines.

Efficient attention mainly speeds long-context emergence, not final quality

Source: hf-daily-papers

A scaling study of hybrid architectures finds that mixing full attention with sliding-window or recurrent mixers leaves final performance largely unchanged. Efficient attention instead governs how quickly long-context retrieval emerges during training, with effects like Large-Window Laziness shaping optimization trajectories rather than ceilings.

OPD-Evolver pairs slow-fast co-evolution with on-policy self-distillation

Source: hf-daily-papers

OPD-Evolver is a self-evolving agent framework that improves memory management and policy learning across multiple domains. It combines a slow-fast co-evolution loop with on-policy self-distillation, letting the agent retain experience and refine its policy without drifting off-policy during training.

Visual-Seeker beats proprietary models at active visual web search

Source: hf-daily-papers

Visual-Seeker is a multimodal deep-search agent that reasons over images natively rather than routing everything through text. By harvesting visual evidence along multimodal trajectories, it outperforms proprietary models on real-world web search tasks that require grounding answers in on-page visuals.

GameCraft-Bench tests whether coding agents can ship playable Godot games

Source: hf-daily-papers

GameCraft-Bench measures end-to-end game generation by asking agents to turn natural-language specs into complete playable titles inside the Godot engine. Evaluation covers engine grounding, artifact completeness, and interactive verification through multimodal judging, exposing how far coding agents fall short of real gameplay.

UniAR unifies image understanding and generation with one visual tokenizer

Source: hf-daily-papers

UniAR is an autoregressive multimodal model that bridges visual understanding and generation through a single discrete tokenizer shared across both tasks. Multi-level feature fusion, lookup-free bitwise quantization, and parallel bitwise prediction shorten visual sequences and deliver state-of-the-art image generation and editing results.

Footnotes

1. nxcode.io review of Kimi-K2.5 — https://www.nxcode.io/resources/news/kimi-k2-5-complete-review-2026

   Kimi-K2.5 has achieved a record-breaking score on the OSWorld-Verified benchmark, reaching 63.3%, which at the time of its release surpassed leading models like Claude 4.5 and GPT-5.2 in computer use proficiency.

   ↩

2. Meituan EvoCUA GitHub — https://github.com/meituan/EvoCUA

   EvoCUA uses a verifiable synthesis engine and evolutionary cycle to autonomously generate diverse tasks and executable validators, lifting OpenCUA-72B from 45.0% to 56.7% on OSWorld.

   ↩

3. NeurIPS 2024 — VLM-as-judge meta-evaluation — https://neurips.cc/virtual/2024/102360

   VLMs frequently favor complex-sounding answers even when they contradict visual evidence… position bias shifts a judge’s preference by an 8.2% mean advantage for whichever option appears second.

   ↩

4. NeurIPS 2025 — STEVE step-verification pipeline — https://papers.nips.cc/paper_files/paper/2025/file/1f170d33c836cbebde939fb49c4e7d6e-Paper-Conference.pdf

   An auxiliary model (like GPT-4o) acts as a judge for every discrete action, assigning stepwise rewards to prune ineffective steps… shifting from imitation learning to outcome-driven filtering.

   ↩

5. r/computervision thread on UI-TARS brittleness — https://www.reddit.com/r/computervision/comments/1lqajxo/uitars_is_literally_the_most_prompt_sensitive_gui/

   UI-TARS is literally the most prompt sensitive GUI [model] — performance deteriorates rapidly if temperature settings exceed zero or if the system prompt is altered from the ‘You are a GUI agent’ default.

   ↩

6. NR Labs — Bypassing Nemotron v3 policy protections — https://www.nrlabs.com/blog-posts/bypassing-nemotron-v3-policy-protections

   A simple ‘uncensored’ system prompt could reliably bypass safety filters to generate sophisticated malware, such as Windows keyloggers.

   ↩

7. LangChain official docs — INVALID_CONCURRENT_GRAPH_UPDATE — https://docs.langchain.com/oss/python/langgraph/errors/INVALID_CONCURRENT_GRAPH_UPDATE

   Parallel tool execution can lead to state integrity issues if multiple nodes attempt to update the same state key simultaneously. LangGraph identifies this as an INVALID_CONCURRENT_GRAPH_UPDATE error… developers are encouraged to use reducer functions such as operator.add for message lists.

   ↩

8. Redis blog — Why multi-agent LLM systems fail — https://redis.io/blog/why-multi-agent-llm-systems-fail/

   41% to 87% of multi-agent failures are due to system design and coordination issues rather than model incapacity… developers are moving away from ‘memory as retrieval’ toward ‘memory as state infrastructure’.

   ↩ ↩²

9. arXiv 2605.17076 — related agent middleware work (S-Bus / CoAgent) — https://arxiv.org/html/2605.17076v1

   Full refinement of Rust implementations via Verus is currently limited by a lack of mature support for asynchronous code (e.g., Tokio-based systems), which is standard for high-performance multi-agent communication… individual agents may be verified for functional correctness, but the collective state transitions of the MAS remain prone to Structural Race Conditions.

   ↩ ↩²

10. Microsoft Research — Practical System Verification project — https://www.microsoft.com/en-us/research/project/practical-system-verification/

    Verus is 3–61x faster than prior tools at verifying low-level systems, [but] it still forces developers to manually identify and refine high-level properties, a process that AI has not yet fully commoditized.

    ↩ ↩²

11. nextdoorhacker — Don’t unwrap in production: a formal verification guide — https://nextdoorhacker.com/2025/12/24/dont-unwrap-in-production-a-formal-verification-guide/

    The practical value of Verus is highlighted by its ability to prevent catastrophic failures, such as the 2025 Cloudflare outage caused by a single unverified .unwrap() panic.

    ↩

12. OpenTrain.ai — GRPO post-training analysis — https://www.opentrain.ai/blog/grpo-for-reasoning-model-post-training/

    Lazy Likelihood-Displacement (LLD) Death Spiral… the likelihood of both correct and incorrect responses stagnates or declines simultaneously, triggering a self-reinforcing failure loop where lower-confidence responses inflate gradients and lead to total optimization collapse.

    ↩

13. Modelyst AI paper summary — WAPO — https://modelystai.com/papers/a-gradient-perspective-on-rlvr-stability-and-winner-advantage-policy-o-260616154

    WAPO implements an implicit curriculum using an adaptive update factor (1 − qx)… as the model becomes more proficient at a specific prompt (qx → 1), the update strength diminishes, preventing over-optimization on saturated examples.

    ↩

14. arXiv 2605.11491 — RAFT/RAFT++ baseline analysis — https://arxiv.org/abs/2605.11491

    RAFT and RAFT++ frequently suffer from ‘short-answer bias,’ where the model collapses toward terse, formulaic responses because these shorter paths are easier to optimize under sequence-level normalization.

    ↩

15. Hugging Face blog — From GRPO to DAPO and GSPO (NormalUhr) — https://huggingface.co/blog/NormalUhr/grpo-to-dapo-and-gspo

    GSPO shifts the optimization focus to the entire sequence… fundamentally reducing gradient variance and avoiding ‘Routing Replay’ in MoE training, but has been criticized for being ‘length-blind,’ potentially suppressing credit for thorough multi-step reasoning compared to length-sensitive token-level methods.

    ↩

16. OpenReview — Negative Sample Reinforcement study — https://openreview.net/forum?id=FPsmHDFtTx

    NSR is surprisingly effective, improving performance across the entire Pass@k spectrum by redistributing probability mass toward plausible candidates… positive-only methods ‘absorb’ probability density into a single mode, squeezing out the diversity needed for test-time compute scaling.

    ↩

17. Jean Kaddour — Entropy Collapse note — https://www.jeankaddour.com/blog/entropy_collapse

    Computing importance ratios in BF16 precision can introduce a multiplicative upward bias that triggers clipping more frequently for exploitation tokens than for exploration tokens… effectively flipping preserving algorithms into collapsing ones unless corrected to FP16.

    ↩