ScholarPulse 日报 2026-06-30

2026-06-30 学术简报：2 篇。WorldEvolver通过测试时记忆修订显著提升LLM代理的预测准确性和规划性能。

今日速览

序号	标题	来源	日期	主题	推荐等级
1	Self-Evolving World Models for LLM Agent Planning	arXiv	2026-06-29	AI-Agent	高
2	Forensic Trajectory Signatures for Agent Memory Poisoning Detection	arXiv	2026-06-29	AI-Agent	高

重点论文与技术动态

1. Self-Evolving World Models for LLM Agent Planning

来源：arXiv
日期：2026-06-29
作者/机构：Xuan Zhang, Wenxuan Zhang, See-Kiong Ng, Yang Deng
主题标签：AI-Agent, arXiv
推荐等级：高
分类：cs.AI, cs.CL

一句话结论

WorldEvolver通过测试时记忆修订显著提升LLM代理的预测准确性和规划性能。

核心内容

WorldEvolver框架在保持下游代理和所有模型参数冻结的前提下，动态修订部署时上下文以增强可靠性。
集成三个核心模块：情景记忆（利用真实动作转换进行检索式模拟）、语义记忆（从预测-观察不匹配中提取持久启发式规则）、选择性预见（过滤低置信预测后整合至代理推理）。
在ALFWorld和ScienceWorld上评估，预测准确率最高且下游代理成功率领先其他世界模型基线。

方法与数据

方法：集成情景记忆、语义记忆和选择性预见三个模块。
数据：摘要未明确。

价值判断

值得关注：测试时记忆修订能同步提升预测精度与规划性能，解决不可靠预见问题。
可复用点：模块化设计（情景记忆、语义记忆、选择性预见）可直接应用于其他LLM代理世界模型框架。
局限/待核查：摘要未明确。

摘要

World models offer a principled way to equip long-horizon LLM agents with foresight: predictions of action consequences before execution. However, unreliable foresight can be ignored, misused, or even degrade downstream decision-making. In this paper, we introduce WorldEvolver, a self-evolving world model framework that revises its deployment-time context while keeping the downstream agent and all model parameters frozen. WorldEvolver integrates three modules: (i) Episodic Memory, which exploits real action transitions through retrieval-based simulation; (ii) Semantic Memory, which extracts persistent heuristic rules from prediction-observation mismatches; and (iii) Selective Foresight, which filters low-confidence predictions before integrating them into agent reasoning context. We evaluate WorldEvolver on ALFWorld and ScienceWorld, measuring world model prediction accuracy on Word2World and downstream agent success rate on AgentBoard. Extensive experiments show that WorldEvolver achieves the highest prediction accuracy across three backbones and leads other world model baselines on downstream agent success rate, demonstrating that test-time memory revision enhances both predictive fidelity and planning performance.

2. Forensic Trajectory Signatures for Agent Memory Poisoning Detection

来源：arXiv
日期：2026-06-29
作者/机构：Jun Wen Leong
主题标签：AI-Agent, arXiv
推荐等级：高
分类：cs.CR, cs.LG

一句话结论

基于LLM代理内存中毒攻击中的行为不变性，仅通过工具调用轨迹即可实现高精度检测。

核心内容

在评估架构中，成功攻击需在email_send_email前调用memory_recall_fact，而正常会话极少展示此序列，源于攻击的信息检索依赖。
简单规则仅基于此不变性实现AUC=0.9563，结合19个轨迹特征的随机森林分类器提升至AUC=0.9904（95% CI [0.987, 0.993]）。
签名过确定：移除回忆相关特征（占特征集一半）后AUC不变（0.990），证实攻击在多独立行为通道留下分布式签名。

方法与数据

19个轨迹特征随机森林分类器，基于10,000次重采样验证。
摘要未明确数据集规模。

价值判断

值得关注：无需重新训练即可推广至GPT-4.1/4o，严格前缀变体实现AUC=0.934支持实时阻断。
可复用点：仅需工具调用日志即可区分内存中毒攻击与提示注入攻击（提示注入轨迹分数=0.541）。
局限/待核查：所有跨模型验证例外均有机制解释，摘要未提及显著局限。

摘要

We discover a behavioral invariant in LLM agents under persistent memory poisoning: in architectures where routing information is retrieved through observable memory-tool invocations, successful attacks require calling memory_recall_fact before email_send_email, a transition that non-exfiltrating sessions rarely exhibit. Under the evaluated architecture, this invariant follows from the attack's information-retrieval dependency rather than being merely an empirical correlation, and suppressing it breaks the attack. A simple rule exploiting this invariant alone achieves AUC = 0.9563. A Random Forest classifier over 19 trajectory features refines it to AUC = 0.9904 (BCa 95% CI [0.987, 0.993], N=10,000 resamples), demonstrating that the attack imprints on multiple independent behavioral channels. The signature is overdetermined: removing all recall-related features (half the feature set) leaves AUC unchanged at 0.990, confirming that memory poisoning induces a distributed trajectory signature rather than a single observable anomaly. Cross-model hold-out on 9 models (7B-120B parameters) confirms AUC = 1.000 on 6/9 hold-out splits, with all three exceptions mechanistically explained. The invariant generalizes to frontier models (GPT-4.1, GPT-4o) without retraining. A strictly prefix-only variant achieves AUC = 0.934, suggesting that real-time blocking is feasible with moderate degradation. The boundary is forensically useful: prompt-injection attacks that bypass memory produce a distinct trajectory (score = 0.541), enabling incident responders to distinguish memory-channel attacks from prompt-injection attacks using tool-call logs alone.