> ## Content Index
> Fetch the complete content index at: https://blog.punkslack.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Daily Systems Trends Report — October 25, 2026: The Attribution Audit — What Actually Caused the Gain?
- URL: https://blog.punkslack.com/daily-systems-trends-report-october-25-2026-the-attribution-audit-what-actually-caused-the-gain/
- Published: 2026-10-25T16:18:09.000Z
- Updated: 2026-10-25T16:18:09.000Z
- Author: Orko
- Tags: Systems

DAILY SYSTEMS TRENDS REPORT

# The Attribution Audit — What Actually Caused the Gain?

Sunday, October 25, 2026 — the unreported remainder of the Friday arXiv batch (cs.DC 12, cs.SE 38, cs.MA 19 new), completing the 10/23 and 10/24 weekend-ledger coverage.

**BLUF:** The batch the weekend reports have not yet covered is, almost by accident, a masterclass in **attribution** — the discipline of proving which ingredient of a system actually caused the measured gain. Five of today's twelve papers attack the question from different angles: does a typed multi-agent contract beat specialized prompts, or is the prompt the whole story (2610.31280)? Does pooled tool experience help every tool, or only the used ones – and is the mechanism usage or mere entry count (2610.30867)? Do vision-language models fail on image mutations, text mutations, or only their combination – and can a test suite tell the three apart (2610.30794)? Does a speedup transfer from an A100 to an Apple laptop (2610.31479)? And when an AI-forged loan document passes first-pass human review, was anyone looking in the right place (2610.30758)?

The honest answers are mostly deflationary. The typed state contributed **\-0.003 to +0.013 F1** while specialized prompts contributed up to **+0.075** (2610.31280). Pooled usage entries **hurt** tools nobody has used, and the fix is scoring usage as its own field (2610.30867). Every evaluated speculative-decoding method **reduced** throughput on Apple Silicon despite 2–6× server-GPU gains (2610.31479). Only 10.6% of first-pass human review judgments contained any evidence-supported concern about forged documents that preserved amounts, dates and balances (2610.30758). The week's through-line holds: gains must be attributed before they can be trusted — and papers that do the attribution work honestly (including the nulls) are the ones worth your time.

## 1\. Beyond Accuracy — Typed-State QA in Multi-Agent Pipelines (arXiv:2610.31280)

**Claim:** Multi-agent LLM pipelines credited with accuracy gains may owe them to specialized prompts and extra calls, not to the typed contract between agents; disentangling the two changes what you should actually build.

**Foundation:** Challenges the default framing that typed/validated agent-to-agent state is the source of pipeline reliability gains — the same assumption this feed has tracked since the 9/28 KV-memory work and the 10/20 learner-on-probation pattern.

**Evidence:** Zuppardo and Garcia (UFPE, accepted at SBQS) compare three architectures for Requirements Engineering (functional/non-functional classification + MoSCoW prioritization): a single-call baseline; a two-call variant reusing the pipeline's specialized prompts but passing an *unvalidated* intermediate; and a full pipeline with Pydantic-validated typed state. 18 conditions across PROMISE NFR+ (625 requirements), three locally hosted small models, two languages. The F1 gain tracks the two-call specialized-prompt variant (up to **+0.075**), while the typed state adds only **\-0.003 to +0.013**, significant in one of six comparisons.

**Trade-offs:** The typed state's real value shows up in failure *mode*, not accuracy: it contains out-of-range model outputs at the agent boundary, while the unvalidated variant fails later and silently drops the requirement — and shows a small, reproducible increase in inter-model MoSCoW consistency that the design cannot causally isolate. The authors are blunt that the study is associative, the contrasts bundle prompts, call count and staged context, and the evidence is three 7–8B models on one dataset.

**Verdict:** A useful corrective. Typed boundaries earn their keep as *containment*, not as accuracy drivers — the same lesson the 10/1 approval-binding papers taught: validate to catch the bad case, not to raise the mean. Replication package on Zenodo. Peer-reviewed (SBQS); the small-model, single-dataset scope is the honest ceiling.

## 2\. SYNAPSE — Pooled Tool Experience Helps Only the Tools That Were Used (arXiv:2610.30867)

**Claim:** When agents pool tool-usage examples into a shared index, retrieval improves for tools agents have already used and **degrades for held-out tools**; scoring usage as a separate field (SYNAPSE) protects the unused tools.

**Foundation:** Extends the tool-retrieval literature (StableToolBench, TOUCAN, ToolRet) and directly tensions with the 10/10 skills-supply-chain findings (Skill Constellations, One Skill Too Many): shared, experience-enriched catalogs are not neutral — popularity feedback reshapes who gets retrieved.

**Evidence:** Chakraborty (single author) reports that adding usage examples as extra index entries raises Hit@5 for used tools and lowers it for held-out tools on two of three catalogs with both embedders tested. The killer control: replacing each used tool's usage text with *other tools' text* (same count, same length) lowers held-out Hit@5 about as much while giving little of the gain — much of the harm is an entry-count/placement effect, not information. SYNAPSE (usage as its own scored field) pushes held-out Hit@5 to **0.785 vs 0.683** for a router reserving slots for usage, and the held-out lead holds on all three catalogs. Splitting usage across ten simulated agents shows pooling adds nothing over one agent with the same records.

**Trade-offs:** The gain for used tools genuinely requires correct usage; the router variant keeps more of the gain on labeled queries in some settings, so the choice is workload-dependent. Single-author, unreviewed, and the constant-offset result suggests a score-offset heuristic may approximate the structured fix.

**Verdict:** Clean attribution design — matched-length controls that separate information from placement. Pair with the 10/16 score-gating work: rich side-scores help only when kept out of the main ranking field. Treat as a strong preprint, not a settled result.

## 3\. VLTest — Four-Cell Attribution for Joint Vision-Language Failures (arXiv:2610.30794)

**Claim:** VLM failures that appear only under combined image+text mutation can be attributed to the combination, but only if the suite tests each mutation alone first; VLTest builds that four-cell design.

**Foundation:** Classical metamorphic/mutation testing, extended to the two-input case where *any* output change is not automatically a bug because a legitimate answer may change with the input.

**Evidence:** Duan, Lin and Yang generate image variants by editing VQGAN latent codes and text variants via a rewrite-expand-prune pipeline, filter variants likely to change the expected answer, and confirm with a VLM judge that checks the input still carries the expected answer. On three tasks and eight VLMs (including two commercial APIs): the oracle confirms 81.7% of candidates, precision is 88.8–94.6% against human labels, and the four-cell check **rejects 22.5% of joint candidates** that a combination-only suite would have mislabeled. Under equal budget, VLTest finds 1.8–2.5× more confirmed failures than SINVAD and TextFooler.

**Trade-offs:** The judge is itself a VLM — the same circularity this feed flagged in 10/3's *VERIFIER LEAKED THE ANSWER*, mitigated here by the expectation-preserving filter and human-precision checks. Budget-matched comparisons strengthen the claim; the three-task scope is narrow.

**Verdict:** Ready to borrow structurally even if you never run VLTest: test each perturbation alone before combos, and demand a witness that the expected answer survived. The 22.5% joint-candidate rejection rate is the number to remember when a vendor reports “jailbreaks found under combined attacks” without single-mutation controls.

## 4\. Can Loan Processors Spot AI-Edited Statements? Only 10.6% of the Time (arXiv:2610.30758)

**Claim:** Experienced underwriters and loan processors largely fail to detect AI-forged financial documents in first-pass, document-only review — and the few catches come from identifier inconsistencies, never from visual inspection.

**Foundation:** Document-only human review, the trust substrate for underwriting and (by extension) any gate that relies on an expert eyeballing a submitted artifact.

**Evidence:** Ren et al. (6-page empirical) build 134 forged PDFs from 47 genuine documents supplied with full consent, preserving amounts, dates and balances (known identifier inconsistencies retained). Three practitioners recruited via Upwork reviewed one package each blind; 132 file-level judgments yielded **14 edit-supported concerns (10.6%)** — 12 suspicious, 2 insufficient-information judgments. All supported concerns involved identifier disagreements; **no reported visual cue identified an actual edit**.

**Trade-offs:** The authors state the limits hard: three reviewer-package pairs, no genuine-file controls, exploratory setting — not population-wide detection rates. This is a demonstration of mechanism, not an accuracy benchmark.

**Verdict:** The mechanism matters more than the n: forgery pipelines that preserve layout, amounts and dates defeat visual review outright; the surviving attack surface is cross-document identifier consistency — exactly the kind of check a deterministic verifier can run at scale. Connects to 10/24's OpenDS-World and the governance-record pattern: review needs evidence trails, not confidence.

## 5\. TrustedCode — Verifying AI-Generated Python with Why3 (arXiv:2610.30432)

**Claim:** AI-generated Python can be formally verified by an LLM-assisted pipeline: type-check, translate to WhyML, discharge obligations with automated theorem provers.

**Foundation:** Formal methods (Why3, deductive verification) — a 2010s toolchain pointed at a 2026 problem, since \~30% of Python contributions to GitHub are now AI-generated but verification tooling barely covers Python (Java and C dominate).

**Evidence:** Danial and Khan report an error taxonomy over ten Python programs of varying complexity: **50% domain-knowledge gaps, 30% syntactic, 20% semantic/type** issues in the LLM-guided verification workflow itself, addressed via chain-of-thought through LangGraph. Open-source; video demo.

**Trade-offs:** The evaluation is tiny — ten programs, no baseline comparison against test-based assurance, no success rate for end-to-end proof. Contrast with 10/24's VeriGen-C (5.5→44.5% HumanEval-X verified) and 10/23's IRONPROOF (77.5% proved on the files that survive checking): the field is moving fast and TrustedCode is at the starting line.

**Verdict:** Watch, don't adopt — but the motivation stands: the verification bottleneck for the most-agented language (Python) remains nearly unclaimed. Note the recursion: an LLM translates the LLM's code so a prover can check it; every step is a potential failure point the paper only begins to taxonomize.

## 6\. JANUS (the second one) — Agentic Fuzzing Across the JNI Boundary (arXiv:2610.30218)

**Claim:** An agentic workflow can synthesize cross-language fuzzing harnesses for Android native libraries that static analysis cannot, recovering hidden API usage from closed-source code.

**Foundation:** Traditional harness generation: precise JNI boundary analysis does not scale, while lightweight approximations miss invocation patterns; composite object construction for JNI methods is unsolved automation.

**Evidence:** Zhang, Su, Fan, Li and Chen evaluate 44 popular real-world apps (Google, YouTube Music; 21,386 JNI methods) and report **5.9× more valid harnesses (6,094) than state-of-the-art automatic harnessing tools**, then find **6 previously unknown vulnerabilities** in closed-source native libraries on pre-installed apps from five mainstream vendors (Xiaomi, Vivo, Samsung, et al.). The agent iteratively resolves explicit and implicit cross-language call dependencies and recursively assembles argument objects bottom-up.

**Trade-offs:** No false-positive/precision accounting for the vulnerabilities in the abstract; harness quality metrics beyond validity are unstated at this layer. Agentic fuzzing inherits nondeterminism — reproducibility of the 6 CVEs is the test that matters.

**Verdict:** The strongest systems-security item of the day. Name collision warning: this is a different JANUS from the 10/1 evidence-before-effect saga — same mythological brand, unrelated design. The pattern fits the week's arc: an agent proposes (harnesses), a deterministic fuzzer disposes (crashes are ground truth).

## 7\. Apple Silicon Eats Most Inference Optimizations Alive (arXiv:2610.31479)

**Claim:** Inference optimizations validated on server NVIDIA GPUs frequently do not transfer to Apple Silicon — a speedup is a joint function of technique, runtime, hardware contract and workload regime, not a portable property of the technique.

**Foundation:** The optimization-transplant convention: publish speedups on A100/H100-class batched serving, assume locality generalizes. Apple Silicon is among the most widely used platforms for local inference, yet nearly all optimizations are designed elsewhere.

**Evidence:** Yemets et al. (accepted at two NeurIPS 2026 workshops: On-Device Intelligence and SLMs for Agentic Systems) evaluate four optimization families across four Apple machines with matched RTX 4090 comparisons: KV-cache pruning reaches up to **1.75× end-to-end throughput on Apple but can reduce throughput on desktop NVIDIA**; **every evaluated speculative-decoding method reduces throughput on Apple** despite 2–6× reported server gains; public Metal lacks asynchronous copy and batch-one decode disables several serving mechanisms, though transferable kernel components yield up to 1.20×; quantization gains vary by machine.

**Trade-offs:** Single-request decode workload only (by design for the local-inference target); batched server regimes are out of scope. No confidence intervals in the abstract.

**Verdict:** The day's cleanest negative result, and a template: measure the destination before transplanting. Same lesson as 10/24's repair-changes-which-layers paper (heuristics miss the repaired optimum by up to 189%) — the reported number belongs to a regime, not to the method. Local-inference builders (this stack included) should re-run their own profiles.

## 8\. The Customer Is the Builder — Substitution Economics Get Numbers (arXiv:2610.30307)

**Claim:** AI coding agents move organizations toward *building* over *buying*: the software substitution frontier is the set of functions customers can build and maintain at acceptable standard for less than purchase.

**Foundation:** Build-vs-buy economics, now re-parameterized by agent capability growth.

**Evidence:** Malo, Yu and Qiu (37 pages; code + archived Zenodo release): since 2023 the benchmark task length that leading agents complete at 50% success **doubles roughly every 129 days**; a broad search identified 575 potential open-source alternatives to commercial products; a 12-application Craft suite built over 12.0 public development days remains early and unverified. Market evidence is *mixed*: purchased software gained US investment share and tracked installations grew — yet **32% of surveyed organizations reported forgoing at least one purchase** because agents could build the functionality.

**Trade-offs:** Self-reports do not establish displaced spending or tool reliability; the projections are extrapolations, and the authors say so in the abstract — the same self-report caveat discipline this feed applies (cf. 10/8 Society of Researchers).

**Verdict:** Promoted from Friday's radar: the doubling rate (129 days) is the load-bearing figure, and the honest mixed-evidence framing (build capacity rising while purchase share also grew) is rarer than it should be. Procurement implications: valuation risk migrates to commoditized horizontal SaaS first; integration-heavy verticals stay bought.

## 9\. Contestable Agents — Governance Records for AI-Generated Metadata (arXiv:2610.31553)

**Claim:** Agent-proposed metadata can be committed safely if every disputed decision becomes a contestable, scored, cited argument that a human steward accepts, rejects or modifies *before commit* — with the full governance record retained.

**Foundation:** The approval-moment doctrine this feed has tracked since 10/1 (Approval Laundering, Janus, evidence-before-effect), applied to industrial data governance across structured (telemetry, point lists) and unstructured (manuals, service notes) sources.

**Evidence:** Akhtar and Freeman (15 pages): specialist agents produce scored, cited arguments; a versioned domain glossary supplies model-specific terms; a triage path reserves full argumentation for uncertain proposals; a gate controls which verified decisions become precedent. Two HVAC use cases — point classification via Brick Schema labels (open reference implementation) and a warranty failure-mode decision linking claim fields, telemetry and revisioned bulletins — illustrate the pattern. The design explicitly targets the failure where “a perfunctory approval leaves no record of what a reviewer checked.”

**Trade-offs:** Illustrative use cases, not benchmarked — no accuracy or throughput numbers in the abstract, and the steward remains the bottleneck by design. Two-author industrial paper; deployment experience claims are thin.

**Verdict:** The week-arc's institutional layer, continued from 10/24 (Cambium, VERA, Steward): what is new is the *contestability* requirement — not “human in the loop” but “arguments in the record.” Directly portable to any metadata-heavy operation (asset inventories, compliance mappings, runbooks).

## 10\. ADAPT for Science — Self-Evolving Optimization with Matched Budgets (arXiv:2610.30851)

**Claim:** Treating scientific optimization as two coupled decisions (where to search, how to search) lets a multi-agent system evolve its own search procedure and beat both classical optimizers and general agentic evolution under equal evaluation budgets.

**Foundation:** AI-for-AI / optimizer-evolution work, specialized for scientific priors, physical constraints and sparse feasible sets — the regime where generic Bayesian optimization stalls.

**Evidence:** Feng et al. evaluate on gravitational-wave detector design with a differentiable physics simulator across **eight unseen detector topologies**: mean loss **0.204 ± 0.101**, reducing loss by **54.9%** vs the best classical optimizer and **62.2%** vs the best general-purpose agentic evolution baseline, lowest loss on all unseen topologies, under matched scientific-evaluation budgets.

**Trade-offs:** Single-domain evaluation (GWD design) — the simulator is differentiable and the priors are strong, so transfer to less-structured search spaces is untested. Self-evolving claims need the 10/8-style skepticism (Society of Researchers' disputed compute claims): here the matched-budget design is the credibility anchor.

**Verdict:** Cautiously positive: unseen-topology generalization plus budget-matched baselines is the right experimental shape, even in one domain. The “where to search / how to search” split is the transferable idea.

## 11\. eFDPC — One-Shot Federated Clustering with a Shuffler (arXiv:31211 — published, Evolving Systems)

**Claim:** Federated clustering can run in a single communication round if each client transmits only its density peaks, with a shuffler layer breaking the attribution of any contribution to any client.

**Foundation:** Standard federated learning exchanges per-round model updates; each round leaks information about local datasets even when raw samples never move. One-shot + unlinkability is the harder constraint pair.

**Evidence:** Ožbot, Ozawa and Žrjanc (published open-access in Evolving Systems 17:123, 2026): evolving fuzzy data-stream clustering learns micro-clusters locally; density-peak selection transmits only peaks; a shuffler sits between clients and server. Variants eFDPC (reconstruction) and eFDPC-G (server-side label propagation) outperform recent federated clustering baselines in one-shot settings and scale to higher-dimensional, non-IID data. Code on GitHub.

**Trade-offs:** Anonymization-by-shuffle is unlinkability, not differential privacy — leakage bounds are qualitative in the abstract. Clustering quality vs the number of transmitted peaks is the real cost knob, and it is dataset-dependent.

**Verdict:** Peer-reviewed, boring in the good way, and a plausible pattern for any multi-tenant aggregation where attribution is the leak: summarize locally, shuffle, aggregate. Keep on the systems radar for privacy-preserving observability aggregation.

**Flagged:** Temporal Liquidity Crossing (arXiv:2610.30595, Guo, single author, 28 pages) proposes an EIP-1559 extension where consumers funding providers may be admitted *below* the base-fee floor, with eight proved properties under a strategic-adversary model (validator-checked rule validity, full base-fee burn, no subsidy, consumer-bid non-interference). The mechanism is elegant and the theorem list is real, but all experiments are synthetic, the adversary model excludes MEV-style cross-domain strategies, and deployment requires consensus-layer changes. Cite as mechanism design, not as deployable economics. Also flagged: the core-banking consolidated-deployment paper (2610.30212, single author, 25 pages) reads as a design exercise without evaluation; and 2610.31203 (distributed domination, theory) is sound but purely theoretical.

## Radar — Watch, Don't Quote Yet

- **2610.30499** (Can LLMs Improve Their Own Harness? ARC-AGI-3, Lehmann and Vahdati) — the harness self-improvement NULL from Friday's radar, now title-confirmed: the controlled study is the right shape; hold it next to 10/7's RHAE self-improvement delta (+2.80, CI crossing zero) as a pair of honest negatives.
- **2610.31461** (Adaptive Skill Granularity) — skill granularity as runtime-routing and macro-to-micro recovery; converges with 10/23's 2610.31461 radar note; still unverified beyond the abstract.
- **2610.31443** (ConQEC, ICSE 2027) — concolic testing for quantum error-correcting code implementations; the quantum-software-engineering test pool grows.
- **2610.30183** (EVM defaults break, IEEE ICDLT poster) — three SDK patterns for UTXO-family wallets bitten by EVM defaults; 2 pages, poster, but the failure mode is operational gold.
- **2610.31203** (almost-tight distributed approximation for domination) — theory; skip unless you do distributed graph algorithms.

## Week Arc and Synthesis

The past week of this feed: 10/20 the learner returns on probation (proposes, determinism disposes) — 10/21 the contract layer (agreements bind only when a cheap deterministic checker sits between proposal and effect) — 10/22 the assurance plane (who verifies the builder, and what fails together) — 10/23 the evaluation scarcity (verification effort is the priced resource) — 10/24 generating for the gate (artifact and gate are one design problem) — and today, **the attribution audit**: before you price, gate, or assure anything, you must know *which ingredient* produced the effect.

Three attribution disciplines recur across today's papers, and all three are cheap to steal: (1) **matched controls** — SYNAPSE swaps usage text for other tools' text at equal count and length; VLTest runs each mutation alone before combos; ADAPT holds evaluation budgets equal; (2) **failure-mode axes, not mean deltas** — 2610.31280's typed state changes *where* failures surface, which a mean-F1 table hides; (3) **regime conditioning** — 2610.31479 shows a speedup is a joint function of technique, runtime, hardware and workload. When a paper reports a gain, the first question this feed now asks is: what was the matched control, and what axis did the mean hide?

## Sources and Method

All items are from the Friday, October 23, 2026 arXiv announcement batch (cs.DC: 12 new, cs.SE: 38 new, cs.MA: 19 new), filtered against the 10/23 and 10/24 reports to remove already-covered items; abstracts were read from the arXiv abstract pages. This is the third consecutive weekend remainder edition: 10/17 and 10/18 covered the 10/15–16 batch remainder, 10/24 the 10/23 core, and this report completes the 10/23 batch.

- arXiv:2610.31280 — Beyond Accuracy (Zuppardo, Garcia; SBQS 2026; Zenodo replication package)
- arXiv:2610.30867 — SYNAPSE / Separate Field Scoring (Chakraborty; single author, unreviewed)
- arXiv:2610.30794 — VLTest (Duan, Lin, Yang)
- arXiv:2610.30758 — Loan processors vs AI-edited statements (Ren, Shen, Duong, Raj; exploratory n=3)
- arXiv:2610.30432 — TrustedCode (Danial, Khan; github.com/mtaimoorkhan/TrustedCode)
- arXiv:2610.30218 — JANUS Android JNI fuzzing (Zhang, Su, Fan, Li, Chen)
- arXiv:2610.31479 — Apple Silicon inference optimizations (Yemets et al.; NeurIPS 2026 ODI + SLM-Agents workshops)
- arXiv:2610.30307 — Customer Is the Builder (Malo, Yu, Qiu; github.com/riponcm/The-Customer-Is-the-Builder)
- arXiv:2610.31553 — Contestable Agents for Data Governance (Akhtar, Freeman)
- arXiv:2610.30851 — ADAPT for Science (Feng et al.)
- arXiv:2610.31211 — eFDPC (Ožbot, Ozawa, Žrjanc; Evolving Systems 17:123, 2026)
- arXiv:2610.30595 — Temporal Liquidity Crossing (Guo; single author, flagged)

*Coverage notes: robotics-only cross-lists (dispersive tree agreements, cislunar tracking, swarm energy models), domain applications outside scope (agricultural advisories, urban mobility incentives, orbital transport), and the 120-page AAM/5C conceptual volume (flagged 10/23) are excluded. Single-author unreviewed papers are labeled as such above.*