Snowflake logs plan decay, Princeton reads refusal pre-CoT, grammars zero tools

TL;DR

• Snowflake clocks Llama-3.1-70B plan signal decaying 12× within one action step on HotpotQA.
• Princeton probes predict refusal at 0.84-0.95 AUROC before the first thinking token appears.
• JSON grammars crash tool invocation from ~100% to 0% across Qwen, GPT-OSS, and Nemotron.
• GPT-5.4-mini holds a 1.0 tool-call rate under identical constraints, implying proprietary routing.
• Behavior Forecasters predict reasoning-model outputs from single trajectories, beating LLM baselines cheaply.

Three research leads today land on the same nerve: the visible scaffolds practitioners trust — an in-context plan, a <think> block, a JSON grammar — aren’t the thing actually driving the model. Snowflake watches an agent’s plan signal decay 12× inside a single action step, and re-injecting the plan doesn’t rescue task success. Princeton shows linear probes on the first thinking token already predict refusal at 0.84-0.95 AUROC, meaning the reasoning text is postscript, not decision. A third paper catches JSON grammar FSMs zeroing the bitmask on <, silently making <tool_call> untypeable across Qwen, GPT-OSS, and Nemotron.

The through-line to hold while reading: each result exposes a control surface that vendors and integrators quote as if it were load-bearing. The measurements say otherwise — and in the grammar case, GPT-5.4-mini holding a 1.0 tool-call rate under identical constraints hints that proprietary stacks already route around the collision that open-weight users are eating.

Snowflake shows LLM plans decay 12× in one action step

Source: hf-daily-papers · published 2026-06-21

TL;DR

• Llama-3.1-70B’s plan signal drops 4.1× on ALFWorld and 12.4× on HotpotQA within a single action step.
• Evicting the plan from context tanks ALFWorld success from 56.7% → 22.0%, a 34.7-point collapse.
• Reasoning models “internalize” nothing — DeepSeek-R1 just re-derives the plan inside its <think> blocks each turn.
• Re-injecting the plan when a probe warns of divergence does not recover task success in the stress test.

The mechanism: plans live in the prompt, not the weights

Snowflake AI Research’s new paper reframes a load-bearing assumption behind every ReAct-style agent: that once a model writes a plan, some ghost of it persists in the hidden state. It doesn’t. The plan is a context-time object, and the moment it drifts out of the window the agent behaves as if it never existed.

The diagnostic is a clean subtraction. Run the agent normally (Condition A), then replay the exact same trajectory with the plan-generation turn deleted (Condition B). Measure 1 - cos(h_A, h_B) at each subsequent step. If plans were truly internalized, the two runs’ hidden states would stay close. They don’t.

flowchart LR
    A[Condition A: agent writes plan, executes] --> M[Compare hidden states<br/>per step]
    B[Condition B: same actions/observations<br/>plan turn deleted] --> M
    M --> S[Plan signal:<br/>1 - cos h_A, h_B]
    S --> D[Decays 4-12× in one step]

On Llama-3.1-70B the signal starts at 0.453 right after the plan is written, then collapses 4.1× on ALFWorld and 12.4× on HotpotQA after a single environment interaction. The plan is essentially a decorative token stream that the model re-reads, not a state it holds.

The reasoning-model illusion

DeepSeek-R1-Distill-Llama-70B looks like it internalizes plans better — until the authors apply “strict stripping” that also removes the model’s <think> blocks from Condition B. Doing so recovers +163% of the plan signal at step +1. In other words, the reasoning model isn’t remembering; it’s silently regenerating the plan inside its scratchpad every turn. Probes also show R1 encodes the plan in a direction 89.3° orthogonal to Llama’s, so distillation isn’t preserving the base model’s representation — it’s building a parallel one that still lives in tokens.

Why “just re-inject the plan” fails

The most uncomfortable result: a probe can predict divergence 4.45 steps ahead of actual task failure, yet re-injecting the plan text when it fires does not restore success in the stress test. The authors blame the co-loss of recent observations. The independent literature suggests something worse. The Context-Contaminated Restart Model finds cascade ratios up to 7.1× once a failed attempt sits in the window ¹ — the residual failure trace poisons recovery even after the plan is back. Activation-steering interventions face a symmetric problem: correctly firing on failing runs also derails successful ones, for net drops up to 26% ². In-context repair is structurally unreliable.

What this validates

A survey of compression failures already partitions the pathology into pre-eviction decision errors, in-eviction information loss, and post-eviction access failure ³, and the STALE benchmark shows agents fail to overwrite stale beliefs even when fresh evidence is retrieved ⁴ — the behavioral shadow of Snowflake’s cosine decay. Practitioners have quietly converged on the fix: external memory matters more than the backbone ⁵, and 2025–26 frameworks like GoalAct and Pre-Act already separate a persistent planner from a stateless executor ⁶.

Snowflake’s contribution is the mechanistic receipt. If your agent harness assumes the model “remembers what it decided,” you’re relying on a signal that halves in one step. Build the state outside the model, or don’t build the agent.

---

Princeton: thinking tokens rationalize safety, don’t decide it

Source: hf-daily-papers · published 2026-06-22

TL;DR

• Linear probes on the first thinking token predict refusal-vs-comply at 0.84–0.95 AUROC, before any reasoning text exists.
• 71–92% of visible “on one hand… on the other” oscillations are performative — the internal state has already committed.
• Directly contradicts OpenAI’s “deliberative alignment” pitch that CoT reasoning causally hardens o-series safety.
• AUROC collapses to 0.43 under leave-one-query-out protocols, per probe-leakage critiques of this exact method.

The decision is made before the “thinking” starts

Narutatsu Ri and collaborators at Princeton PLI ⁷ trained ℓ₂-regularized probes on the last-layer hidden state of the first thinking token emitted by four open-weight reasoning models — Qwen3-8B, Olmo-3-7B-Think, Phi-4-Reasoning, and GPT-OSS-20B. Those probes hit 0.84–0.95 AUROC and ~88% balanced accuracy at predicting whether the model would eventually refuse or comply — before a single reasoning sentence exists. Fix the first 20% of the thinking trace and resample: continuation variance stays below 0.2. The outcome is locked.

The Fisher discriminant ratio traces a “refusal valley” — the safety signal is loud at token zero, gets buried through the middle of the reasoning, and resurfaces at the final answer. Enabling thinking at all only flips 3–30% of final labels versus answering immediately, and when it does flip them, it mostly slides globally toward more refusal or more compliance rather than improving the ASR/ORR tradeoff.

Deliberation as theater

Sentence-level stance labeling (done by GPT-5.4 and Gemini 3 Pro as judges) found that only 15–34% of traces contain any refusal↔comply oscillation at all — and among those, 71–92% had no statistically significant effect on the final response. The models are producing the linguistic form of deliberation without the causal function.

This isn’t isolated. Three independent lines converge on the same story:

The Oxford result is the operational punchline: if safety is decided early and the middle of the trace carries little signal, an attacker who dilutes attention with thousands of innocuous reasoning tokens can walk past the guard. Ri’s mechanistic finding and the hijacking exploit are the same phenomenon seen from opposite ends.

The vendor-narrative collision

OpenAI’s deliberative alignment post frames o1 as reasoning through safety specs to gain jailbreak robustness and lower over-refusal simultaneously ¹¹. Ri et al. cannot test o1 directly — they’re limited to 7B–20B open weights, and they flag it — but for every open reasoning model they can probe, the CoT is decorative. That gap between marketing and mechanism is now the interesting question.

The methodological asterisk

The “Refusal Residue” line of work argues that naive linear probes on hidden states can post inflated AUROCs by memorizing query-specific surface features. Under leave-one-query-out evaluation, refusal-probe AUROC on Qwen3-32B collapses from near-perfect to 0.43 ¹². The paper’s headline 0.84–0.95 numbers are exactly the shape this critique targets, and the source write-up doesn’t describe LOQO validation.

Directionally, the finding is corroborated by faithfulness work, refusal-cliff mechanics, and adversarial exploits. The specific numbers deserve a second probe protocol before anyone quotes them as gospel.

---

JSON grammars zero out tool calls in open-weight LLMs

Source: hf-daily-papers · published 2026-06-23

TL;DR

• Tool invocation crashes from ~100% to 0% across Qwen, GPT-OSS and Nemotron under joint JSON+tool constraints.
• Grammar FSMs zero the bitmask on <, making <tool_call> literally untypeable during JSON decoding.
• GPT-5.4-mini holds a 1.0 invocation rate under identical constraints, implying proprietary stacks route around the collision.
• XGrammar-2’s TagDispatch already swaps grammars mid-generation, making the paper’s two-pass fix a legacy workaround.

The bug: schema compliance eats tool calls

A new empirical paper isolates a failure mode that vLLM and SGLang users have been debugging as a config problem for months. When open-weight models are given tools and a JSON response schema in the same call — the default “agent” setup — they stop calling tools entirely. Not degraded, not flaky: the paper reports a Suppression Rate of 1.0 across every tested open-weight family (Qwen3.5/3.6, GPT-OSS, Nemotron), with Tool Invocation Rate falling from ~100% in the tools-only baseline to 0% under joint constraints. The reference closed model, GPT-5.4-mini, holds at 1.0.

The authors taxonomize five observable behaviors: empty JSON where tool data should be (TS-A), hallucinated “simulated” retrievals (TS-B), JSON that declares intent to call a tool but never emits the call (TS-C), tool-free hallucination (TS-D), and — most damning — failure to call tools even with tool_choice="required" set (TS-E). Community reports on r/LocalLLaMA independently corroborate TS-E, with users noting tool_choice="auto" is effectively unusable on Qwen and gpt-oss under structured output ¹³. An adjacent study found tool-calling accuracy improves ~18 percentage points across 6,400 trials when the tool interface is expressed in natural language instead of JSON ¹⁴ — the same tax, measured a different way.

Why it happens: token unreachability

The paper’s contribution is tracing the failure down to the Triton kernel level. Inference engines like xgrammar compile the response schema into a Finite State Machine that applies a bitmask to the model’s logits at every decoding step. The authors show that in that mask, the < character — the first token of <tool_call> in most open-weight chat templates — is set to zero. The model isn’t choosing not to call the tool. It literally cannot emit the character required to start one.

flowchart LR
    A[Prompt: tools + JSON schema] --> B[Inference engine]
    B --> C[xgrammar FSM]
    C -->|"bitmask sets '<' = 0"| D[Logits masked]
    D --> E["Model emits `{` — JSON only"]
    E -.->|tool-call tokens unreachable| F[TS-A through TS-E]

That framing is narrower than the broader “structured output hurts reasoning” literature — Tam et al. report up to 40% reasoning drops under JSON/XML/YAML constraints ¹⁵, while Dottxt’s rebuttal argues those effects are prompting artifacts that vanish with better few-shot examples ¹⁶. Constrain-Tax sidesteps that fight by pointing at a specific, reproducible mechanism inside one class of backends.

The fix is already in flight

The authors propose “Transparent Two-Pass Execution”: generate reasoning and tool calls with no schema, then re-enter with the schema active for the final response. It works, and it’s also what production practitioners have been doing for a year — Anderegg’s writeup treats two-step decoding as the default reliability pattern and notes you can cache the reasoning pass and retry only the format step ¹⁷.

The more interesting news is upstream. XGrammar-2, shipped by MLC in May, introduces TagDispatch: the engine swaps grammars mid-generation when the model emits a trigger tag, so a JSON grammar no longer shadows <tool_call> initiation tokens ¹⁸. Once SGLang and vLLM adopt it broadly, the “bitmask=0 on <” smoking gun becomes a legacy artifact. That makes the paper’s lasting value diagnostic rather than prescriptive — the TS-A through TS-E taxonomy and the FSM trace are what future bug reports will cite, not the workaround.

Round-ups

Behavior Forecasters predict reasoning-model outputs from single trajectories

Source: hf-daily-papers

Small Behavior Forecasters trained on single reasoning trajectories predict what large reasoning models will output, beating LLM baselines at a fraction of the inference cost. The approach reframes reasoning behavior as a supervised learning target rather than a runtime computation.

LLM agents default to over-privileged tools, ToolPrivBench shows

Source: hf-daily-papers

Agents routinely pick higher-privilege tools when lower ones would work, and standard safety alignment fails to enforce least-privilege selection. A post-training defense on the new ToolPrivBench benchmark cuts unnecessary privilege escalation without hurting task performance.

Multimodal chain-of-thought loses visual grounding mid-reasoning

Source: hf-daily-papers

Multimodal chain-of-thought helps on math and scientific reasoning but fails on visually grounded tasks like object counting and multi-image reasoning, where models stop re-inspecting the image. The authors call this the ‘Look Light, Think Heavy’ failure pattern.

Masked diffusion LLMs beat autoregressive peers on reasoning benchmarks

Source: hf-daily-papers

Fully bidirectional masked diffusion language models outperform autoregressive counterparts on BBH, ARC-Challenge, MATH, and HumanEval while supporting variable-length generation via confidence-based scoring. The result challenges causal attention’s dominance in frontier language modeling.

Wan-Streamer unifies real-time audio, video, and text in one model

Source: hf-daily-papers

Wan-Streamer v0.1 processes visual, audio, and text tokens end-to-end using block-causal attention with causal encoders and decoders, enabling low-latency streaming interaction. The unified foundation model drew 111 upvotes on Hugging Face daily papers.

Autodata turns agents into data scientists for synthetic training sets

Source: hf-daily-papers

Autodata casts an LLM agent as a data scientist that designs and refines synthetic datasets through meta-optimization and agentic self-instruct loops. Models trained on its outputs improved across multiple task domains, trading inference compute for higher-quality training data.

Agentic AI textbook spans transformers to production deployment

Source: hf-daily-papers

The Hitchhiker’s Guide to Agentic AI compiles foundations through advanced practice in one reference, covering GPU training, SFT/LoRA/MoE, RLHF variants like PPO and GRPO, agent harnesses, MCP, multi-agent topologies, RAG, memory systems, and evaluation for production.

Footnotes

1. ResearchGate — Context-Contaminated Restart Model (CCRM) — https://www.researchgate.net/publication/347144862_System_Reliability_Theory_Models_Statistical_Methods_and_Applications

   simply retrying can result in a ‘cascade ratio’ as high as 7.1, where the presence of a failed attempt in the context window makes subsequent success nearly impossible without a full state reset

   ↩

2. Georgia Tech activation-steering research (via Gemini synthesis) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEip62MwGqyXRv2Eb3Fc1xQMJzRNJtH3AgdxHLgo9fP0m0AJ5jxIGQqhmZv8TN9dPkmtSHbed89vkAQktwOIYGfbniHPQ7Idl9jEH_y5AQSIX9_7jeBdpprQKecYtsz03vqgHB7-uX5

   interventions intended to recover failing trajectories can inadvertently disrupt trajectories that would have succeeded, leading to a net performance collapse of up to 26% in some benchmarks

   ↩

3. Preprints.org survey on agent compression failures — https://www.preprints.org/frontend/manuscript/098fda1d1490b8885d002521dbc08afa/download_pub

   Pre-compression Decision Error (F1)… In-compression Information Loss (F2)… Post-compression Access Failure (F3)

   ↩

4. Medium / Data Science Collective — ‘The Benchmark That Exposed a Silent Failure in AI Agent Memory’ — https://medium.com/data-science-collective/the-benchmark-that-exposed-a-silent-failure-in-ai-agent-memory-668273525c3b

   STALE benchmark highlights a persistent ‘outdated assumption’ problem, where agents retrieve new evidence but fail to overwrite old, conflicting beliefs

   ↩

5. MintMCP practitioner guide on long-term agent memory — https://www.mintmcp.com/blog/long-term-memory-ai-agents

   a well-designed memory architecture often impacts performance more significantly than the choice of the underlying LLM backbone

   ↩

6. arXiv 2510.00615 — GoalAct / Pre-Act framework — https://arxiv.org/html/2510.00615v2

   ReAct… is increasingly criticized for its sequential, local nature which can lead agents into ‘local loops’ or non-executable branches… GoalAct introduces a continuously updated global planning mechanism combined with hierarchical execution

   ↩

7. dou.ac paper page — https://paper.dou.ac/p/2603.03295v1

   Authored by Narutatsu Ri (Princeton CS / Princeton Language + Intelligence lab), advised by Sanjeev Arora, with Micah Goldblum.

   ↩

8. Anthropic — Measuring Faithfulness in Chain-of-Thought Reasoning — https://www.anthropic.com/research/measuring-faithfulness-in-chain-of-thought-reasoning

   models often generate reasoning that does not reflect the true reasons for their answers, making CoT an unreliable window into model cognition

   ↩

9. arXiv 2510.06036 — ‘Refusal Cliff’ in reasoning models — https://arxiv.org/html/2510.06036v1

   the model maintains strong refusal intent throughout its reasoning trace, then sharply suppresses it at the final output stage — a systematic decoupling of internal signal from external behavior

   ↩

10. Oxford Martin School — Chain-of-Thought Hijacking — https://www.oxfordmartin.ox.ac.uk/publications/chain-of-thought-hijacking

    padding a harmful request with thousands of tokens of harmless reasoning dilutes the model’s internal safety attention, achieving 94–100% attack success on frontier reasoning models

    ↩

11. OpenAI (Deliberative Alignment announcement) — https://openai.com/index/deliberative-alignment/

    o1 is trained to explicitly reason through OpenAI’s safety specifications before producing an answer… increasing robustness to jailbreaks while decreasing overrefusal rates.

    ↩

12. OpenReview — ‘Refusal Residue’ probe-leakage critique — https://openreview.net/pdf?id=3qHILWiEob

    Under leave-one-query-out evaluation, refusal-probe AUROC collapses to 0.43 on Qwen3-32B… naive probes reach near-perfect scores by memorizing query wording rather than learning a general safety concept.

    ↩

13. r/LocalLLaMA — ‘Is tool calling broken in all inference engines?’ — https://www.reddit.com/r/LocalLLaMA/comments/1rav571/is_tool_calling_broken_in_all_inference_engines/

    tool_choice=“auto” frequently fails to trigger, forcing users to use the “required” setting to receive any structured response… vLLM only truly supports structured output for tools when tool_choice=“required” is active.

    ↩

14. r/MachineLearning discussion of NLT paper — https://www.reddit.com/r/MachineLearning/comments/1o8szk0/r_plain_english_outperforms_json_for_llm_tool/

    Tool-calling accuracy improved by approximately 18 percentage points when using natural language instead of JSON-defined schemas across 6,400 trials.

    ↩

15. ACL 2025 Industry Track — Tam et al., ‘Let Me Speak Freely?’ — https://aclanthology.org/2025.acl-industry.34.pdf

    Structured constraints (JSON, XML, YAML) significantly impact reasoning quality, with some models seeing reasoning capability drops of up to 40% when forced into structured paths.

    ↩

16. OpenReview — ‘Say What You Mean’ (Dottxt rebuttal) — https://openreview.net/pdf?id=rSCV1hTZvF

    The original study’s findings were largely artifacts of poor prompting and suboptimal few-shot examples rather than an inherent flaw in constrained sampling.

    ↩

17. Ricardo Anderegg — ‘Two-step structured outputs for LLMs’ — https://ricardoanderegg.com/posts/two-step-structured-outputs-llm/

    Combining tool calling (bind_tools) and strict schema enforcement in a single call can cause API-level conflicts… developers can retry only the second ‘formatting’ step using the cached result of the first pass, significantly reducing token waste and latency.

    ↩

18. MLC blog — XGrammar-2 announcement (May 2026) — https://blog.mlc.ai/2026/05/04/xgrammar-2-fast-customizable-structured-generation

    TagDispatch allows the engine to switch between different grammars—moving from a reasoning block to a tool-call JSON—dynamically based on specific tags, preventing a single rigid mask from blocking the entire generation.

    ↩