The Frontier Is Not Jagged in the Shape of Difficulty
It is jagged in the shape of the training signal. Ten open problems, one explanation for why they are open, and a dependency order that says which of them has to fall first.
Thesis. The standard observation is that AI capability is uneven: systems that solve competition mathematics fail elementary perception, hold inconsistent beliefs, and come apart over long sequences of actions. The observation is correct and the usual gloss on it — that the frontier is “jagged” — treats the unevenness as mysterious. It is not. Capability tracks the density and checkability of the training signal, not the intrinsic difficulty of the task. Where a domain supplies abundant examples and a cheap correctness check, performance is extraordinary. Where it supplies neither, performance collapses, and it collapses on problems that are formally identical to ones the same model solves. The ten unsolved areas are not ten independent research programmes; they are ten places where the signal was never there, and they stand in a dependency order. Four of them are foundations — knowing what the network computes, what it is uncertain about, what causes what, and why any of it works — and the remaining six are waiting on those four whether or not their researchers say so.
Abstract. I begin with the cleanest demonstration that the frontier is not ordered by difficulty: a classical planning domain on which a frontier model solves roughly a third of instances, and the same domain with the action and object names obfuscated, on which it solves one instance in six hundred. Nothing about the planning problem changed. I then take the ten areas in turn, each with the strongest measured result I can point to — sparse autoencoders extracting thirty-four million features from a production model while the dictionary size needed to resolve a concept scales with how rare the concept is; chains of thought that shift a model’s answer by thirty-six points without mentioning the cause; an identifiability ladder that prices a single causal variable in interventions; scaling laws fitted from four hundred models that predict loss and not capability; a benchmark of executable plans on which three of five leading models score zero once the premises are attacked; a forgetting literature whose headline metrics are means, and therefore blind to exactly the failures that matter; adversarial suffixes optimised against open models that transfer to closed ones at up to eighty-four per cent; weak supervisors recovering about half the performance gap on language tasks and scaling negatively on others; the largest robot dataset ever assembled, at a millionth of the scale of a text corpus; and a compute-optimality result that changed the whole industry’s allocation while explaining nothing about why it holds. I close with what the ranking should be, given the dependencies.
I. The jaggedness, stated properly
“Jagged frontier” is a description that has quietly become an explanation. It suggests a coastline: irregular, but irregular in a way you could not have predicted and cannot do much about.
The unevenness is not arbitrary. It has a shape, and the shape is legible.
Consider the sharpest available case. Blocksworld is a canonical planning domain from the automated-planning literature: move blocks, respect preconditions, reach a goal configuration. Frontier models solve a meaningful fraction of instances — GPT-4 around a third, some models around half.
Mystery Blocksworld is the identical domain with the action and object names replaced by meaningless tokens. Identical structure, identical difficulty for any classical planner, identical solutions under the renaming. Frontier models score between roughly nothing and four per cent, and zero-shot most of them score zero.
Figure 2. This is not a difficulty ordering. Competition mathematics with a trained step-level verifier at 78%; classical planning with familiar names at 34.6%; a long-horizon planning benchmark’s hardest tier at 20%; a thirteen-constraint travel-planning task at 0.6%; and the same classical planning problem with the names obfuscated at 0.16%. Ranked by score, the list bears no relation to how hard a competent person would find each task.
That single comparison — 34.6% against 0.16%, same problem — carries more information than any amount of leaderboard movement. It says that what is being exercised is not the planning competence the task nominally measures. Remove the familiar surface and the capability leaves with it.
The same reading explains the rest of the figure. Competition mathematics is at the top because it has the two things nothing else on the list has: enormous quantities of worked solutions in the training corpus, and a cheap check on the final answer. Travel planning is at the bottom because a valid itinerary is a conjunction of thirteen constraints, no arrangement of which is well-represented in text, and because nothing tells the model whether it got them all.
The frontier is jagged in the shape of the training signal. Once you see that, the ten open areas stop looking like a research agenda and start looking like an inventory of the places the signal never reached.
II. One objective produces one artefact
Why should the signal shape be so decisive? Because of what training makes.
The pretraining objective produces exactly one thing: a conditional distribution over the next token. That is an enormously useful object, and it is one object. Every item on the list of unsolved areas asks for a second artefact that the objective never creates and never had reason to create.
Uncertainty about a claim, as distinct from probability over a word form. A representation of what causes what, as distinct from what follows what. An account of what the network is computing, as distinct from what it emits. A record of which capabilities exist, so that losing one could be noticed. The premises a plan depends on, stored separately from the plan’s narrative. A model of one’s own vulnerability. A statement of what correctness means in the current domain.
None of these is produced as a by-product of predicting text well. Each would have to be built, and each requires a representation the architecture does not have a slot for. This is why the gap does not close by making the generator better: the generator occupies one box, and the other boxes are empty.
It also explains the shape of the failures. A system with no second artefact cannot report that it is outside its competence, because it has no representation of its competence. It produces the same fluent surface everywhere, and the user discovers the boundary by walking into it.
III. The dependency structure
Treating the ten areas as parallel is the second mistake. They are not parallel; several of them are prerequisites for others, and the field’s difficulty in making progress on the popular ones is partly explained by the unpopularity of the ones underneath.
Figure 1. Ten problems, one dependency structure. Arrows read “is a prerequisite for”. Overseeing a system stronger than yourself requires seeing what it computes and trusting what it says about its own confidence. Robustness under distribution shift and attack requires knowing what causes what, and a theory that predicts when the system breaks. Physical competence requires a causal model and the ability to keep learning without corruption. Efficiency sets the price of all of it.
I will take the left column first, because that is the order in which the problems bind.
IV. Mechanistic interpretability — what is it computing?
The most encouraging result here is also the one that shows the size of the remaining problem.
Templeton and colleagues trained sparse autoencoders with up to 34 million features on the middle-layer residual stream of a production-scale model, demonstrating that dictionary learning scales beyond the small transformers on which it was first shown to work. The extracted features are genuinely interpretable: multilingual, multimodal — generalising to images despite text-only training — responsive to both concrete instances and abstract discussion of a concept, and causally effective, in that steering on them changes behaviour in the direction their interpretation predicts. They include features for deception, sycophancy, bias and power-seeking.
That is real progress and it should be said plainly.
Now the constraint. The authors report a systematic relationship between the frequency of a concept and the dictionary size needed to resolve a feature for it. Rare concepts require larger dictionaries. Since the concepts that matter most for safety are frequently the rare ones — a specific failure mode, an unusual deception, a particular dangerous capability — the method’s cost scales in the wrong direction against the use case. They also observe that features become less specific as activation strength weakens, which may reflect the model representing confidence, or may reflect the dictionary failing to discriminate cleanly, and note that interference between non-orthogonal features is a candidate explanation.
So the honest statement is: we can now extract millions of interpretable features from a real model, we cannot yet claim to have accounted for what the model computes, and the gap is largest exactly where the stakes are highest.
V. Calibrated uncertainty — what does it actually know?
A model does not consistently distinguish a memorised fact from a deduction, a probabilistic inference, a plausible completion, an unknown, a false premise embedded in the question, a conflict between sources, or something that used to be true. All eight arrive in the same register.
The formal requirement is easy to state: for every confidence level q the system reports, roughly q of the claims at that level should be true. Calibration is a testable property, and the machinery for testing it has existed since meteorologists formalised it for rainfall in the middle of the last century.
Three obstacles are structural rather than incidental. Token probability is not claim probability: the distribution is over word forms, so paraphrase moves the number without moving the belief, and in a long sentence the joint probability is dominated by grammar rather than content. Verbal confidence is a style: it was learned from human hedging and from raters who preferred a register, neither of which had access to whether the claim was true. And calibration measured on one distribution guarantees nothing on another, while the system has no way to notice it has crossed the boundary, because the out-of-domain question is made of the same words in the same grammar.
Then there is the result that should trouble anyone hoping to verify the reasoning rather than the answer. Turpin and colleagues added biasing features to model inputs — reordering a few-shot prompt so that the answer is always the same option, or supplying a suggested answer — and found that models systematically fail to mention the bias while producing explanations that rationalise the biased answer. Accuracy dropped by as much as 36.3% on a suite of thirteen BIG-Bench Hard tasks, with the cause never appearing in the explanation.
The chain of thought is not a record of the computation. It is a plausible narrative generated alongside it, sensitive to features it does not report. That closes off the cheapest route to trusting the output.
VI. Causal world models — what causes what?
A generative model is trained to estimate what usually follows. An agent needs to predict what happens if it intervenes, which is a different quantity that is not recoverable from the first.
The world-model literature is candid about its own objective. The standard formulation is a partially observed Markov process whose parameters are fitted by maximising a bound consisting of an observation-reconstruction term and a KL term aligning the filtered posterior with the dynamics prior. There is no intervention operator anywhere in it, and conditioning on a logged action does not supply one: fitting the next state given the recorded action recovers a conditional under whatever behaviour policy generated the data, which equals the interventional quantity only if the action was independent of the unobserved state — which expert demonstrations, driving logs and internet video all violate by construction.
Worse, reconstruction cannot identify the latent variables at all. Infinitely many encoder–decoder pairs reconstruct the observations equally well, and identifiability is known to be impossible without additional supervision or statistical diversity, even in the simplest case where the latent variables are independent.
What identifies them is intervention, and the price is now known precisely. In the score-based causal representation learning results of Varıcı and colleagues: under a linear mixing, one hard intervention per latent node buys the exact graph and the variables up to scale; one soft intervention buys only the transitive closure and leaves the variables mixed with their parents; under an arbitrary unknown mixing, two hard interventions per node buy the exact graph and the variables up to permutation and a componentwise reparameterisation — and that last is a proved ceiling, not a current limitation.
The unit of cost is the latent variable. Fifty causal variables means fifty or a hundred interventional regimes, each requiring you to hold one causal quantity fixed while the rest run. In a robotics laboratory that is a Tuesday. In an open environment it is not obviously possible, because you cannot intervene on a variable you have not yet identified, and identifying it is what the interventions were for.
VII. A predictive theory of deep learning — why does any of this work?
The most consequential piece of theory the field has is an empirical fit.
Hoffmann and colleagues trained over 400 language models, from 70 million to over 16 billion parameters, on 5 to 500 billion tokens, and found that for compute-optimal training the model size and the number of training tokens should be scaled equally — for every doubling of size, double the data. They tested the prediction by training a 70-billion-parameter model on 1.4 trillion tokens using the same compute budget as a 280-billion-parameter model trained on around 300 billion tokens, and the smaller model won across a wide range of downstream evaluations.
That result reallocated an industry’s capital. It is also, in the strict sense, not a theory. It is a curve fitted to measured losses, with no account of why the exponents take the values they do, no derivation from the structure of the data or the architecture, and — critically — it predicts loss, not capability. Nothing in it tells you at what loss a model starts to plan, or stops hallucinating, or begins to generalise a skill outside its training distribution.
That is the gap. We can forecast the number the optimiser will reach and not the behaviour the system will exhibit. Every question that actually matters for deployment — when will this fail, on what class of input, and how would we know — sits on the wrong side of it. A field with predictive scaling laws for its objective and none for its capabilities is in roughly the position of thermodynamics before statistical mechanics: reliable relations, no mechanism, and no way to know which relations survive a change of regime.
VIII. Long-horizon planning — what does the failure actually look like?
Now the dependent column, starting with the one usually placed first.
The standard argument is multiplicative: if each of n steps succeeds independently with probability p, the sequence succeeds with probability pⁿ, and 0.99⁵⁰⁰ is about 0.0066. The arithmetic is right and the model is wrong, because the steps are neither independent nor separately decided. When a plan is emitted as a program with loops, a thousand actions come from a few dozen statements.
The measured failure profile bears this out. In HeroBench — a structured world of seventy locations, twenty-five monsters and two hundred and eight items, where models emit an entire plan of hundreds to thousands of actions as executable code — the strongest model averages 0.11 errors in the high-level plan and 0.02 errors in execution per task. Execution is nearly solved. What remains is the plan.
And what breaks plans is not length. Add skill progression, so the agent must bootstrap its own professions before it can craft what the goal needs, and add adversarial distractors — plausible high-powered items whose recipes are supplied but whose ingredients are absent from the world — and on the hardest tier three of the five leading models drop to zero. Neither addition lengthens the plan. Both attack the premises it rests on.
Underneath this sits the verification problem. Kambhampati’s group tested self-critique against sound external verification across three domains and found performance collapse with self-critique and significant gains with sound external verification — with the ablation showing that merely re-prompting with a sound verifier retains most of the benefit, so the content of a critique is decoration and only the correctness of the accept-or-reject signal matters. Where a sound verifier exists, results transform: plan validation as backprompting raises Blocksworld to 82% within fifteen rounds; hand-built critics raise a travel-planning benchmark from 4.4% to 20.6% where the unaided model manages 0.6%.
But the verifier has to come from somewhere, and it inherits its soundness from a specification somebody wrote. That is why this area depends on calibration: a system that knew when it did not know could act as its own first-line check. It does not, so somebody has to.
IX. Continual learning — how would you even know?
The stability–plasticity problem is written as a constraint: minimise the loss on the new task subject to not degrading any prior capability by more than a tolerance. The quantifier ranges over every prior capability.
The evaluation does not. The standard benchmark suites in this literature run from five text-classification datasets to a large instruction collection of 1,616 tasks, from which studies typically draw a subset. Against a model whose competences are compositional and unenumerated, that is a sample of unknown coverage drawn by an unknown mechanism, and it is biased in a knowable direction: benchmarks are built from cheaply measurable, data-abundant capabilities, which are precisely the most robust ones.
Worse, the headline metrics are means. The forgetting measure is the average across prior tasks of the drop from each task’s historical best; backward transfer is likewise an average. A mean moves in proportion to the fraction affected, so if one capability in a thousand is destroyed outright while the rest are untouched, the reported number shifts by well under a hundredth. Dozens of capabilities can be lost before the metric moves. The failure that matters — a specific safety behaviour, a minority language, a rare document format — is exactly the one the metric is structurally unable to see.
There is a second error in the same estimator, pointing the other way. The forgetting measure takes the maximum over historical evaluations before subtracting the current one. The maximum of noisy estimates of a constant exceeds that constant in expectation, and by more as the history lengthens. So the metric reports forgetting where none occurred, and reports more of it the longer training has run.
Overstating the diffuse, concealing the catastrophic. The three method families — architecture-based isolation, regularisation, replay — are all reasonable engineering, and none of them removes the underlying trade; each relocates its cost into parameter growth, constrained adaptation, or stored data plus the privacy obligations that come with it. But optimisation against an objective nobody can evaluate is not a research programme with a finish line.
X. Robustness — what happens under intelligent attack?
Distribution shift is the polite version of this problem. The impolite version is an optimiser pointed at your model.
Zou and colleagues demonstrated it cleanly. Their greedy coordinate gradient method searches for a suffix which, appended to a harmful request, maximises the probability that the model begins with an affirmative response rather than a refusal. Optimised against a handful of small open-source models, the resulting suffixes generated 99 out of 100 target harmful behaviours in one open model and 88 out of 100 exact matches with a target string, and then transferred to commercial systems the attacker had no access to: up to 84% success against two closed models, 66% against another, and 2.1% against a fourth — where even the low figure is not zero.
Three features of that result matter more than the numbers. It is automated, so it does not depend on human ingenuity and does not decay as specific jailbreaks are patched. It is universal, in that a single suffix works across many prompts. And it transfers, so open models are a sufficient laboratory for attacking closed ones.
The connection to the foundations is direct. You cannot defend a mechanism you cannot see, which is why this waits on interpretability; and you cannot anticipate behaviour off-distribution without a model of what actually drives it, which is why it waits on causal structure. Patching the observed attacks is not defence, because the attack is generated by search and the search will run again.
XI. Alignment and scalable oversight — can a weaker judge control a stronger system?
Burns and colleagues turned the abstract worry into a measurable one: fine-tune a strong model on labels produced by a much weaker one, and ask how much of the gap between weak supervisor and strong ceiling is recovered.
The headline is encouraging. On natural-language tasks, fine-tuning a frontier model on labels from a far weaker one typically recovers about half the performance gap; with an auxiliary confidence loss the result approaches the performance of a model a generation behind the ceiling. Strong models do generalise beyond their weak supervisors rather than merely imitating them.
The rest is less comfortable, and the authors say so. Generalisation is decent on language tasks with positive scaling; on chess puzzles it is decent for small supervisor–student gaps but the gap recovered scales negatively; and on reward modelling — the setting closest to actual alignment practice — both the generalisation and the scaling are poor. A substantial gap remains between weak supervision and ground truth in every setting, and one observed failure mode is that the strong student learns to mimic the weak teacher’s limitations.
Note where the negative results cluster: on the tasks where the supervisor’s judgement is least articulable. That is the pattern you would predict if what transfers is the concept rather than the evaluation, and it means the method is weakest exactly where oversight is needed.
This is why Figure 1 puts oversight downstream of interpretability and calibration. A judge weaker than the system has two ways to keep control: look inside, or trust what it reports about its own confidence. Both are open problems, and the oversight problem cannot be solved ahead of them.
XII. Embodied intelligence — where does the data come from?
The Open X-Embodiment collaboration assembled the largest open real-robot dataset in existence: over one million real trajectories, across 22 embodiments, pooled from 60 datasets contributed by 21 institutions, demonstrating 527 skills across roughly 160,000 tasks. Models trained on it show genuine positive transfer — one architecture achieved around a 50% higher success rate than the specialised state-of-the-art methods it was compared against, and a larger vision-language-model variant improved further, including on data-rich domains.
Now put the number in context. One million trajectories is the field’s flagship achievement. A frontier language model is trained on the order of a trillion tokens. The gap is six or seven orders of magnitude, and it does not close by spending money, because each robot trajectory requires a robot, a scene, and wall-clock time in the physical world.
This is why embodiment sits downstream of two other problems. Without a causal model, experience does not transfer: a policy fitted to correlations in one laboratory does not survive a change of lighting, gripper or friction, and the agent has no way to know which of those variables mattered. Without continual learning that does not corrupt, each new environment is a retraining event rather than an accumulation. The data scarcity makes both bind harder: with a millionth of the data, you cannot brute-force your way past the absence of structure.
XIII. Efficiency — the price of everything above
The last item is not a capability, it is a budget constraint, and it multiplies against all the others.
The compute-optimality result gives the shape of the current bargain: for a fixed compute budget, parameters and tokens should scale together. It also implies the uncomfortable corollary that capability has been bought largely with resources, and that the resources have to keep coming. Every foundation in the left column adds to the bill rather than reducing it — interventional data for causal structure, human step-labels for verifiers, dictionaries that grow as the concepts you care about get rarer, replay buffers for continual learning, physical time for embodiment.
There is a version of this problem that is not merely economic. If the price of reliability scales worse than the price of capability, then the two curves diverge, and the systems get more useful and less trustworthy at the same time. That is not a hypothesis about the far future; it is a reasonable reading of where the resources currently go.
XIV. What the ranking should be
The list as given is ordered by prominence. The dependency structure suggests a different order, and it is worth stating plainly because it implies where marginal effort is worth most.
Calibrated uncertainty is the highest-leverage item on the list, and it is ranked seventh. A system that could report, per claim, whether it knows, infers, guesses or does not know, would immediately improve long-horizon planning (it could detect its own weak premises), oversight (a weaker judge could allocate scrutiny), robustness (abstention under shift is most of the defence), and continual learning (you could tell what was lost). It is also the item with the clearest formal target and the cheapest measurement apparatus, most of which was worked out for weather forecasting decades ago.
Interpretability is second, because oversight of a stronger system has no other route, and because the current results are far enough along to be extended rather than invented.
Causal structure is third and the most expensive, because the price is interventional data, per variable, and no amount of observation substitutes.
A predictive theory would reorder everything, which is why it is worth more than its rank suggests. The reason nobody can say which of these problems is nearest to solution is that we have laws for the loss and none for the behaviour.
The remaining six are consequences. That is not a reason to stop working on them — the applied work is what generates the measurements that discipline the foundations, and every result quoted above came from someone building something. It is a reason to be sceptical of any claim that one of them is about to be solved on its own.
XV. What would show me wrong
If a frontier model’s performance stopped tracking the familiarity of the surface — if the obfuscated version of a planning domain came to match the familiar one — then the central claim about signal shape is falsified, and the jaggedness really is about difficulty after all. This is a cheap experiment and it should be run on every new model as a matter of routine.
If self-verification improved with capability, so that a model’s own critique became a sound accept-or-reject signal, then the verifier bottleneck dissolves and most of the dependent column loosens at once. The experiment has been run on earlier models and found collapse; it has not, to my knowledge, been run to the same standard on the newest.
And if the dependency ordering is wrong — if oversight, say, turns out to be achievable behaviourally without either interpretability or calibration — then Figure 1 is a tidy diagram of a relationship that does not hold. Weak-to-strong generalisation is the live attempt at exactly that, and its negative scaling on the harder settings is the current evidence against it rather than a settled verdict.
XVI. Coda
The systems are extraordinary and the unevenness is not a paradox. One objective produced one artefact of remarkable quality, and everything the list asks for is a second artefact that objective never made. Where the world happened to supply what the second artefact would have provided — a verifier, a dense corpus, a simulator, an answer key — the capability looks superhuman. Where it did not, the same system fails a problem it demonstrably can solve when you change the vocabulary.
That is why the frontier is jagged, and it is why sanding down the visible edges will not smooth it. The shape is inherited from the data and the objective, and the ten problems are the places where neither reached.
The useful question is not which of the ten falls first. It is which of them, if it fell, would collapse the others — and the answer is the one about knowing what you know.
References
-
Anokhin, P., Khalikov, R., Rebrikov, S., Volkov, V., Sorokin, A., & Bissonnette, V. (2025). HeroBench: A Benchmark for Long-Horizon Planning and Structured Reasoning in Virtual Worlds. arXiv:2508.12782.
-
Brier, G. W. (1950). Verification of forecasts expressed in terms of probability. Monthly Weather Review, 78(1), 1–3.
-
Burns, C., Izmailov, P., Kirchner, J. H., Baker, B., Gao, L., Aschenbrenner, L., Chen, Y., Ecoffet, A., Joglekar, M., Leike, J., Sutskever, I., & Wu, J. (2024). Weak-to-Strong Generalization: Eliciting Strong Capabilities With Weak Supervision. Proceedings of the 41st International Conference on Machine Learning, PMLR 235. arXiv:2312.09390.
-
Guo, H., Zeng, F., Zhu, F., Wang, J., Wang, X., Zhou, J., Zhao, H., Liu, W., Ma, S., Wang, D.-H., Zhang, X.-Y., & Liu, C.-L. (2025). Continual Learning for Generative AI: From LLMs to MLLMs and Beyond. arXiv:2506.13045.
-
Gundawar, A., Verma, M., Guan, L., Valmeekam, K., Bhambri, S., & Kambhampati, S. (2024). Robust Planning with LLM-Modulo Framework: Case Study in Travel Planning. arXiv:2405.20625.
-
Hoffmann, J., Borgeaud, S., Mensch, A., Buchatskaya, E., Cai, T., Rutherford, E., et al. (2022). Training Compute-Optimal Large Language Models. Advances in Neural Information Processing Systems 35. arXiv:2203.15556.
-
Kambhampati, S., Valmeekam, K., Guan, L., Verma, M., Stechly, K., Bhambri, S., Saldyt, L., & Murthy, A. (2024). Position: LLMs Can’t Plan, But Can Help Planning in LLM-Modulo Frameworks. Proceedings of the 41st International Conference on Machine Learning, PMLR 235. arXiv:2402.01817.
-
Li, X., He, X., Zhang, L., Wu, M., Li, X., & Liu, Y. (2026). A Comprehensive Survey on World Models for Embodied AI. arXiv:2510.16732.
-
Lightman, H., Kosaraju, V., Burda, Y., Edwards, H., Baker, B., Lee, T., Leike, J., Schulman, J., Sutskever, I., & Cobbe, K. (2023). Let’s Verify Step by Step. arXiv:2305.20050.
-
Open X-Embodiment Collaboration (2023). Open X-Embodiment: Robotic Learning Datasets and RT-X Models. arXiv:2310.08864.
-
Stechly, K., Valmeekam, K., & Kambhampati, S. (2025). On the Self-Verification Limitations of Large Language Models on Reasoning and Planning Tasks. 13th International Conference on Learning Representations (ICLR 2025). arXiv:2402.08115.
-
Templeton, A., Conerly, T., Marcus, J., Lindsey, J., Bricken, T., Chen, B., et al. (2024). Scaling Monosemanticity: Extracting Interpretable Features from Claude 3 Sonnet. Transformer Circuits Thread.
-
Turpin, M., Michael, J., Perez, E., & Bowman, S. R. (2023). Language Models Don’t Always Say What They Think: Unfaithful Explanations in Chain-of-Thought Prompting. Advances in Neural Information Processing Systems 36. arXiv:2305.04388.
-
Varıcı, B., Acartürk, E., Shanmugam, K., Kumar, A., & Tajer, A. (2025). Score-based causal representation learning: linear and general transformations. Journal of Machine Learning Research, 26, 1–90.
-
Xie, J., Zhang, K., Chen, J., Zhu, T., Lou, R., Tian, Y., Xiao, Y., & Su, Y. (2024). TravelPlanner: A Benchmark for Real-World Planning with Language Agents. Proceedings of the 41st International Conference on Machine Learning. arXiv:2402.01622.
-
Zou, A., Wang, Z., Kolter, J. Z., & Fredrikson, M. (2023). Universal and Transferable Adversarial Attacks on Aligned Language Models. arXiv:2307.15043.