Edition

Evaluations Under the Microscope, Agents Fail in Patterns

July 13, 2026 · 12 papers

This week's edition is heavy on evaluation rigor — across agents, RAG, benchmarks, and LLM judges. OpenAI's SWE-Bench Pro analysis exposes reliability problems in one of coding's most-cited benchmarks, a new study reveals that RAG systems can score near-perfect on faithfulness metrics while consistently citing the wrong entity, and geopolitical bias shows up in GPT-5, Claude, and Gemini when used as policy evaluators. On the agent side, two complementary studies dig into how bug report quality affects fix rates and how coding agent failures unfold as processes — giving teams concrete handles for improving both inputs and observability.

02 · agents Intermediate

Failure as a Process: An Anatomy of CLI Coding Agent Trajectories

Xiangxin Zhao

Rather than just measuring whether coding agents succeed or fail, this large-scale study examines how failures unfold over time across nearly 1,800 annotated agent trajectories. The process-oriented view reveals that many failures aren't sudden — they have identifiable onset points, predictable escalation patterns, and windows where recovery is still possible. Essential reading if you're building or operating coding agents and want to understand where interventions would actually help.

Takeaways3

Agent failures are temporal processes with identifiable early warning patterns, not just binary outcomes.
Many failure trajectories have recovery windows that current agents consistently miss, suggesting intervention points for scaffolding improvements.
Different frontier models fail in structurally distinct ways, meaning model choice affects failure mode, not just success rate.

via api-arxiv · arXiv:2607.09510

01 · agents Accessible

Writing Bug Reports for Software Repair Agents: What Information Matters Most?

Vincenzo Luigi Bruno

As AI agents take on more bug-fixing work, the way you write issue reports starts to matter differently — not for human comprehension, but as task specifications for the agent. This study systematically analyzed 441 real bug reports from SWE-bench Verified, annotating what information types (reproduction steps, expected behavior, localization cues, suggested fixes) were present and correlating them with agent fix success rates. If your team is routing issues to AI agents, this research tells you concretely what to include.

Takeaways3

Bug reports written for humans often omit the structured information AI agents need most, like explicit expected behavior and reproduction steps.
Localization cues and suggested fixes in issue reports meaningfully improve agent success rates.
Agentic workflows require treating issue reports as formal task specifications, not informal communication.

agents software-engineering evaluations how-we-work

via api-arxiv · arXiv:2607.09553

03 · agents Intermediate

Safety Testing LLM Agents at Scale: From Risk Discovery to Evidence-Grounded Verification

Yunhao Feng, Ruixiao Lin, Ming Wen, Qinqin He, Yanming Guo, Yifan Ding, Yutao Wu, Jialuo Chen, Zhuoer Xu, Xiaohu Du, Jianan Ma, Zixing Chen, Xingjun Ma, Yunhao Chen, Xinhao Deng

Safety testing for LLM agents is hard because the risk surface keeps changing and hand-crafted test cases don't scale. Vera automates the full pipeline: discovering new risk categories from literature, generating concrete test cases through combinatorial composition, and verifying outcomes against observable artifacts rather than vibes. If you're responsible for shipping agents into production, this gives you a systematic approach to safety coverage that grows with your agent's capabilities.

Takeaways3

Static, expert-designed safety test suites go stale quickly as agents evolve; automated risk discovery is necessary for ongoing coverage.
Grounding safety verification in observable artifacts (rather than LLM-judged outcomes) makes results reproducible and auditable.
Combinatorial composition across risk taxonomies surfaces edge cases that manual test design consistently misses.

agents security evaluations software-engineering

via api-hf · arXiv:2607.01793

04 · rag Intermediate

Deceptive Grounding: Entity Attribution Failure in Clinical Retrieval-Augmented Generation

Cedric Caruzzo

This paper exposes a dangerous blind spot in standard RAG evaluation: a system can score near-perfect on hallucination and faithfulness metrics while confidently presenting evidence about the wrong entity. The authors call this 'deceptive grounding' — every claim is sourced from a real document, just the wrong one — and find failure rates up to 87% under adversarial conditions. Critically, domain-specialized medical models are *worse* at this than general models, which should concern anyone building high-stakes RAG applications.

Takeaways3

Standard faithfulness and hallucination metrics cannot detect entity attribution failures, creating a false sense of RAG safety.
Domain-specialized fine-tuning amplifies deceptive grounding rather than mitigating it, making medical RAG systems particularly vulnerable.
Removing entity-specific conflicting evidence from retrieved documents eliminates the failure, pointing toward retrieval filtering as a mitigation.

rag evaluations security llms

via api-arxiv · arXiv:2607.09349

05 · evaluations Intermediate

LLM-as-a-Verifier: A General-Purpose Verification Framework

Jacky Kwok, Shulu Li, Pranav Atreya, Yuejiang Liu, Yixing Jiang, Chelsea Finn, Marco Pavone, Ion Stoica, Azalia Mirhoseini

Using an LLM to verify another LLM's outputs is already common practice, but most approaches produce coarse binary scores that aren't very reliable. This paper reframes verification as a scaling axis — like pre-training compute — and shows that computing continuous scores from logit distributions, then scaling granularity, repetition, and criteria decomposition, yields substantially better signal without any additional training. Directly applicable if you're building evaluation pipelines or using LLM judges to filter agent outputs.

Takeaways3

Treating verification scores as continuous distributions over logits outperforms discrete LLM-judge scoring for separating correct from incorrect solutions.
Decomposing evaluation criteria and aggregating sub-scores improves calibration beyond what single-prompt judges achieve.
Verification quality scales predictably with compute investment, making it a tunable parameter in your evaluation pipeline.

evaluations agents llms prompt-engineering

via api-hf · arXiv:2607.05391

06 · evaluations Intermediate

Separating signal from noise in coding evaluations

OpenAI's analysis of SWE-Bench Pro surfaces significant reliability issues in one of the most widely cited coding benchmarks — including flaky tests, ambiguous ground truth, and evaluation artifacts that inflate or deflate model scores. This challenges the conventional wisdom that benchmark numbers cleanly reflect real-world coding capability, and should make you skeptical of leaderboard comparisons built on this data.

Takeaways3

SWE-Bench Pro contains systematic noise that makes model rankings less reliable than the numbers suggest.
Benchmark infrastructure issues (flaky tests, evaluation harness bugs) can matter as much as model capability differences.
Teams selecting models based on SWE-bench scores alone should validate on their own representative task distributions.

evaluations software-engineering llms

via rss-openai

07 · llms Accessible

Ceci n'est pas une pipe: AI systems as semantic abstractions

Jade Alglave

This paper argues that we lack a precise vocabulary for reasoning about when AI system outputs are justified — and that this gap leads to sloppy evaluation. The authors propose a semantic framework distinguishing between what domain knowledge supports, what sources actually say, and what the system can access at inference time, giving precise definitions to failure modes like unsupported assertion, stale sources, and added hypotheses. Useful conceptual grounding for anyone designing RAG systems, agent tool-calling policies, or evaluation rubrics.

Takeaways3

Apparent fluency in AI outputs systematically obscures whether claims are actually grounded in reliable authority.
Distinguishing 'what sources say' from 'what the system can use' clarifies why RAG and fine-tuning have fundamentally different failure modes.
The framework provides a vocabulary for writing precise specifications for agent actions that must be justified by explicit evidence.

llms foundational evaluations rag agents opinion

via api-arxiv · arXiv:2607.09489

08 · llms Advanced

Towards Mechanistically Understanding Why Memorized Knowledge Fails to Generalize in Large Language Model Finetuning

Lu Dai, Ziyang Rao, Yili Wang, Hanqing Wang, Hao Liu, Hui Xiong

Fine-tuning to inject new knowledge into LLMs produces a frustrating pattern: the model memorizes the facts but fails to use them in downstream reasoning. This paper investigates the mechanism and finds that memorized representations often exist in the model but aren't routed through the layers where they'd actually influence computation — a 'knowledge-circuit misalignment.' The practical upshot is a diagnostic technique that recovers 58-75% of the generalization gap without architectural changes.

Takeaways3

Memorization and usable generalization are mechanistically distinct processes that fine-tuning can decouple.
Knowledge-circuit misalignment means a model can 'know' a fact internally while completely failing to apply it during reasoning.
Self-patching as a diagnostic technique can identify which layers need intervention without requiring full retraining.

llms foundational reasoning

via api-hf · arXiv:2607.08393

09 · software-engineering Accessible

How Do Software Professionals Evaluate AI-Generated Code? (Registered Report)

Samuli Määttä

Despite widespread adoption of AI coding tools, we have surprisingly little systematic understanding of how engineers actually decide whether AI-generated code is good enough to ship. This registered report outlines a grounded theory study using surveys and interviews with 20-50 software professionals to build that understanding. Worth tracking because the resulting theory will inform how we design review workflows and tooling around AI-assisted development.

Takeaways3

Current research lacks a grounded theory of how practitioners evaluate AI-generated code, making it hard to design better tooling.
How professionals evaluate AI code likely differs substantially from how they evaluate human-written code, with implications for review process design.
The study's findings will be grounded in actual practitioner accounts rather than lab experiments, increasing ecological validity.

software-engineering how-we-work evaluations

via api-arxiv · arXiv:2607.09434

10 · security Advanced

Statistically Undetectable Backdoors in Deep Neural Networks

Andrej Bogdanov

This paper proves something deeply unsettling: backdoors can be planted in neural networks that are statistically indistinguishable from clean models even when the adversary hands you all the weights. The backdoor works by creating adversarial examples based on invariance — mapping distant inputs to suspiciously close outputs — and detecting it is provably hard under standard cryptographic assumptions. This establishes a fundamental asymmetry between model trainers and model users that has direct implications for supply chain trust in ML.

Takeaways3

White-box access to model weights is insufficient to detect certain classes of backdoors, undermining common assumptions about model auditing.
The power asymmetry between model trainers and users is provable, not just empirical — users cannot efficiently detect what trainers can efficiently hide.
Supply chain trust for ML models requires more than weight inspection; behavioral testing under adversarial conditions is necessary but may also be insufficient.

security foundational

via api-arxiv · arXiv:2607.09532

11 · llms Accessible

Geopolitical alignment: Endorsement effects in large language models

Maxim Chupilkin

When LLMs are used to evaluate policy options, they don't just summarize — they implicitly penalize policies based on which geopolitical actor endorses them. This controlled experiment shows GPT-5, Claude Sonnet, and Gemini all rate identical policies significantly lower when attributed to China or Russia versus the US or EU, while DeepSeek shows the reverse pattern. Asking models to justify their scores largely preserves the bias rather than correcting it. Critical context for anyone using LLMs as evaluators or policy analysts.

Takeaways3

LLM policy evaluations are systematically biased by geopolitical framing, not just content — identical proposals get different scores based on who supposedly supports them.
Asking models to justify scores before rating does not eliminate geopolitical bias and can amplify it in some models.
DeepSeek shows opposite bias patterns to Western models, suggesting training data and RLHF choices embed geopolitical worldviews differently across model families.

llms evaluations security

via api-arxiv · arXiv:2607.09262

12 · opinion Accessible

Quoting Kenton Varda

Kenton Varda (Cloudflare) banned AI-generated PR descriptions from his team after finding they reliably described what the code does while omitting why — the higher-level framing reviewers actually need. This is a sharp practitioner observation: AI excels at summarizing visible structure but consistently fails at articulating the motivation, tradeoffs, and context that make code reviews meaningful. A useful corrective to uncritical adoption of AI-assisted commit hygiene.

Takeaways3

AI-generated commit and PR messages optimize for describing code mechanics, not communicating intent — which is exactly backwards for reviewers.
The higher-level framing needed to understand a change is often not recoverable from the diff alone, making it irreplaceable by AI summarization.
Teams should consider explicit norms distinguishing where AI writing assistance adds value versus where it degrades communication quality.

opinion how-we-work software-engineering llms

via rss-willison