---
title: "Evo-Attacker — paper by Yan et al. (2026) — summary and ideas"
description: "The authors study how an adversary controlling the tool channel of a single agent can make the whole system fail. 29 references."
authors: ["Bingyu Yan", "Xiaoming Zhang", "JinYu Hou", "Chaozhuo Li", "Ziyi Zhou", "Yiming Hei", "Litian Zhang"]
year: 2026
venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2026.acl-long.330/"
doi: "10.18653/v1/2026.acl-long.330"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/yan-2026-evo-attacker-memory-augmented-reinforcement/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/yan-2026-evo-attacker-memory-augmented-reinforcement/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/32/) / Evo-Attacker: Memory-Augmented Reinforcement Learning for Long-Horizon Tool Attacks on LLM-MAS

# Evo-Attacker: Memory-Augmented Reinforcement Learning for Long-Horizon Tool Attacks on LLM-MAS

**Authors:** [Bingyu Yan](https://md.research.elamur.ai/free/en/authors/bingyu-yan/), [Xiaoming Zhang](https://md.research.elamur.ai/free/en/authors/xiaoming-zhang/), JinYu Hou, [Chaozhuo Li](https://md.research.elamur.ai/free/en/authors/chaozhuo-li/), [Ziyi Zhou](https://md.research.elamur.ai/free/en/authors/ziyi-zhou/), Yiming Hei and [Litian Zhang](https://md.research.elamur.ai/free/en/authors/litian-zhang/) · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.acl-long.330/) · [PDF](https://aclanthology.org/2026.acl-long.330.pdf) · [DOI 10.18653/v1/2026.acl-long.330](https://doi.org/10.18653/v1/2026.acl-long.330) · [OpenAlex](https://openalex.org/W7166821762)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
LLM-based multi-agent systems (LLM-MAS) depend on external tools, and agents tend to accept tool returns without question. The authors study how an adversary controlling the tool channel of a single agent can make the whole system fail. Earlier tool attacks have three weaknesses. Some target lone agents, and their injections get flagged as inconsistent by downstream agents. Others work only in one domain, such as web navigation. The rest rely on fixed templates. Evo-Attacker instead casts the attack as memory-augmented reinforcement learning. In an initial zero-shot exploration phase, every episode that ends in verified system failure is stored in an Attack Memory. During an attack, a policy reasons through Retrieve, Reflect and Modify steps to decide whether and how to alter a tool return, within a limited intervention budget. The full reasoning pipeline is trained with Attack-Flow GRPO, which passes the final outcome reward back to earlier reasoning tokens to solve long-horizon credit assignment. Experiments reportedly show consistent gains over baselines and generalization across architectures, tasks and tool schemas. This highlights the need for defenses that protect tool returns.

## Key points
- **Threat model:** gray-box. The attacker sees and can rewrite tool calls and returns of one target agent but cannot see inter-agent messages or model internals. At most B returns may be modified, and the goal is to maximize the expected failure indicator J(o).
- **Attack Memory:** each entry pairs the task context (graph, task, target agent) with a trace of original tool calls, applied modifications and perturbed returns.
- **Attacker design:** the attacker is a planner-style policy with two internal tools, a memory retriever and a return modifier, and it may choose a NoOp ("do not attack") on a given turn.
- **Baselines and evaluation:** compared approaches include InjecAgent, Forced Output, Web Fraud Attacks and Prompt Infection. Stealthiness was tested against LLM-based detectors, not against cryptographic signing or whitelist filtering. The excerpt omits the quantitative results.
- **Limitations:** the method has higher compute and token costs, and the authors suggest distillation as a future fix. The work is positioned as a red-teaming tool, and experiments ran only in simulated environments.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Beihang University](https://md.research.elamur.ai/free/en/universities/beihang-university/) — University, Beijing, China · 86 works · 9,097 citations
- [Beijing University of Posts and Telecommunications](https://md.research.elamur.ai/free/en/universities/beijing-university-of-posts-and-telecommunications/) — University, Beijing, China · 78 works · 33,365 citations
- [China Academy of Information and Communications Technology](https://md.research.elamur.ai/free/en/labs/china-academy-of-information-and-communications-technology/) — Research institute, Beijing, China · 3 works · 5 citations

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 17,450 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 17,296 works

🧭 Topics (1): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,894 works

## Cite

Cite as: Bingyu Yan, Xiaoming Zhang, JinYu Hou, Chaozhuo Li, Ziyi Zhou, Yiming Hei and Litian Zhang. 2026. Evo-Attacker: Memory-Augmented Reinforcement Learning for Long-Horizon Tool Attacks on LLM-MAS. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{yan2026evo,
  title = {{Evo-Attacker: Memory-Augmented Reinforcement Learning for Long-Horizon Tool Attacks on LLM-MAS}},
  author = {Bingyu Yan, Xiaoming Zhang, JinYu Hou, Chaozhuo Li, Ziyi Zhou, Yiming Hei and Litian Zhang},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.330},
  url = {https://doi.org/10.18653/v1/2026.acl-long.330}
}
```

- [← previous Evidence-Augmented Generation Reasoning for Extremely Low-Resource Language Decipherment](https://md.research.elamur.ai/free/en/papers/zhu-2026-evidence-augmented-generation-reasoning-extremely/)
- [next → Evo-PI: Aligning Medical Reasoning via Evolving Principle-Guided Supervision](https://md.research.elamur.ai/free/en/papers/zheng-2026-evo-pi-aligning-medical-reasoning/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/32/)

## References

29 references, 10 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Donghyun Lee and Mo Tiwari. 2024. Prompt infection: Llm-to-llm prompt injection within multi-agent systems. arXiv preprint arXiv:2410.07283. — [arXiv:2410.07283](https://arxiv.org/abs/2410.07283) [find](https://scholar.google.com/scholar?q=Donghyun+Lee+and+Mo+Tiwari%2E+2024%2E+Prompt+infection%3A+Llm%2Dto%2Dllm+prompt+injection+within+multi%2Dagent+systems%2E+arXiv+preprint+arXiv%3A2410%2E07283%2E+%E2%80%94+%5BarXiv%3A2410%2E07283%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2410%2E07283%29)
2. Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde De Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, and 1 others. 2021. [Evaluating large language models trained on code](https://md.research.elamur.ai/free/en/papers/chen-2021-evaluating-large-language-models-trained/). arXiv preprint arXiv:2107.03374.
3. Chaozhuo Li, Pengbo Wang, Chenxu Wang, Litian Zhang, Zheng Liu, Qiwei Ye, Yuanbo Xu, Feiran Huang, Xi Zhang, and Philip S Yu. 2025a. Loki’s dance of illusions: A comprehensive survey of hallucination in large language models. arXiv preprint arXiv:2507.02870. — [arXiv:2507.02870](https://arxiv.org/abs/2507.02870) [find](https://scholar.google.com/scholar?q=Chaozhuo+Li%2C+Pengbo+Wang%2C+Chenxu+Wang%2C+Litian+Zhang%2C+Zheng+Liu%2C+Qiwei+Ye%2C+Yuanbo+Xu%2C+Feiran+Huang%2C+Xi+Zhang%2C+and+Philip+S+Yu%2E+2025a%2E+Loki%E2%80%99s+dance+of+illusions%3A+A+comprehensive+survey+of+hallucination+)
4. Zhuofeng Li, Haoxiang Zhang, Seungju Han, Sheng Liu, Jianwen Xie, Yu Zhang, Yejin Choi, James Zou, and Pan Lu. 2025b. In-the-flow agentic system optimization for effective planning and tool use. arXiv preprint arXiv:2510.05592. — [arXiv:2510.05592](https://arxiv.org/abs/2510.05592) [find](https://scholar.google.com/scholar?q=Zhuofeng+Li%2C+Haoxiang+Zhang%2C+Seungju+Han%2C+Sheng+Liu%2C+Jianwen+Xie%2C+Yu+Zhang%2C+Yejin+Choi%2C+James+Zou%2C+and+Pan+Lu%2E+2025b%2E+In%2Dthe%2Dflow+agentic+system+optimization+for+effective+planning+and+tool+use%2E+arXiv)
5. Haowei Liu, Xi Zhang, Haiyang Xu, Yuyang Wanyan, Junyang Wang, Ming Yan, Ji Zhang, Chunfeng Yuan, Changsheng Xu, Weiming Hu, and 1 others. 2025a. Pc-agent: A hierarchical multi-agent collaboration framework for complex task automation on pc. arXiv preprint arXiv:2502.14282. — [arXiv:2502.14282](https://arxiv.org/abs/2502.14282) [find](https://scholar.google.com/scholar?q=Haowei+Liu%2C+Xi+Zhang%2C+Haiyang+Xu%2C+Yuyang+Wanyan%2C+Junyang+Wang%2C+Ming+Yan%2C+Ji+Zhang%2C+Chunfeng+Yuan%2C+Changsheng+Xu%2C+Weiming+Hu%2C+and+1+others%2E+2025a%2E+Pc%2Dagent%3A+A+hierarchical+multi%2Dagent+collaboration+fra)
6. Songyang Liu, Chaozhuo Li, Jiameng Qiu, Xi Zhang, Feiran Huang, Litian Zhang, Yiming Hei, and Philip S Yu. 2025b. The scales of justitia: A comprehensive survey on safety evaluation of llms. arXiv preprint arXiv:2506.11094. — [arXiv:2506.11094](https://arxiv.org/abs/2506.11094) [find](https://scholar.google.com/scholar?q=Songyang+Liu%2C+Chaozhuo+Li%2C+Jiameng+Qiu%2C+Xi+Zhang%2C+Feiran+Huang%2C+Litian+Zhang%2C+Yiming+Hei%2C+and+Philip+S+Yu%2E+2025b%2E+The+scales+of+justitia%3A+A+comprehensive+survey+on+safety+evaluation+of+llms%2E+arXiv+pre)
7. Songyang Liu, Chaozhuo Li, Chenxu Wang, Jinyu Hou, Zejian Chen, Litian Zhang, Zheng Liu, Qiwei Ye, Yiming Hei, Xi Zhang, and 1 others. 2026. Clawkeeper: Comprehensive safety protection for openclaw agents through skills, plugins, and watchers. arXiv preprint arXiv:2603.24414. — [arXiv:2603.24414](https://arxiv.org/abs/2603.24414) [find](https://scholar.google.com/scholar?q=Songyang+Liu%2C+Chaozhuo+Li%2C+Chenxu+Wang%2C+Jinyu+Hou%2C+Zejian+Chen%2C+Litian+Zhang%2C+Zheng+Liu%2C+Qiwei+Ye%2C+Yiming+Hei%2C+Xi+Zhang%2C+and+1+others%2E+2026%2E+Clawkeeper%3A+Comprehensive+safety+protection+for+openclaw+ag)
8. Xingyao Wang, Yangyi Chen, Lifan Yuan, Yizhe Zhang, Yunzhu Li, Hao Peng, and Heng Ji. 2024. [Executable code actions elicit better llm agents](https://md.research.elamur.ai/free/en/papers/wang-2024-executable-code-actions-elicit-better/). In Forty-first International Conference on Machine Learning.
9. Weimin Xiong, Ke Wang, Yifan Song, Hanchao Liu, Sai Zhou, Wei Peng, and Sujian Li. 2025. More vulnerable than you think: On the stability of tool-integrated llm agents. arXiv preprint arXiv:2506.21967. — [arXiv:2506.21967](https://arxiv.org/abs/2506.21967) [find](https://scholar.google.com/scholar?q=Weimin+Xiong%2C+Ke+Wang%2C+Yifan+Song%2C+Hanchao+Liu%2C+Sai+Zhou%2C+Wei+Peng%2C+and+Sujian+Li%2E+2025%2E+More+vulnerable+than+you+think%3A+On+the+stability+of+tool%2Dintegrated+llm+agents%2E+arXiv+preprint+arXiv%3A2506%2E21967)
10. Bingyu Yan, Xiaoming Zhang, Ziyi Zhou, Chaozhuo Li, Ruilin Zeng, Yirui Qi, Tianbo Wang, and Litian Zhang. 2026. Attack the messages, not the agents: A multi-round adaptive stealthy tampering framework for llm-mas. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 40, pages 297… [find](https://scholar.google.com/scholar?q=Bingyu+Yan%2C+Xiaoming+Zhang%2C+Ziyi+Zhou%2C+Chaozhuo+Li%2C+Ruilin+Zeng%2C+Yirui+Qi%2C+Tianbo+Wang%2C+and+Litian+Zhang%2E+2026%2E+Attack+the+messages%2C+not+the+agents%3A+A+multi%2Dround+adaptive+stealthy+tampering+framework)
11. Bingyu Yan, Zhibo Zhou, Litian Zhang, Lian Zhang, Ziyi Zhou, Dezhuang Miao, Zhoujun Li, Chaozhuo Li, and Xiaoming Zhang. 2025. Beyond self-talk: A communication-centric survey of llm-based multi-agent systems. arXiv preprint arXiv:2502.14321. — [arXiv:2502.14321](https://arxiv.org/abs/2502.14321) [find](https://scholar.google.com/scholar?q=Bingyu+Yan%2C+Zhibo+Zhou%2C+Litian+Zhang%2C+Lian+Zhang%2C+Ziyi+Zhou%2C+Dezhuang+Miao%2C+Zhoujun+Li%2C+Chaozhuo+Li%2C+and+Xiaoming+Zhang%2E+2025%2E+Beyond+self%2Dtalk%3A+A+communication%2Dcentric+survey+of+llm%2Dbased+multi%2Dagent)
12. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2023. [Autodan: Generating stealthy jailbreak prompts on aligned large language models](https://md.research.elamur.ai/free/en/papers/liu-2023-autodan-generating-stealthy-jailbreak-prompts/). arXiv preprint arXiv:2310.04451.
13. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, and 1 others. 2025. [Qwen3 technical report](https://md.research.elamur.ai/free/en/papers/yang-2025-qwen3-technical-report/). arXiv preprint arXiv:2505.09388.
14. Xingjun Ma, Yifeng Gao, Yixu Wang, Ruofan Wang, Xin Wang, Ye Sun, Yifan Ding, Hengyuan Xu, Yunhao Chen, Yunhan Zhao, and 1 others. 2025. Safety at scale: A comprehensive survey of large model safety. arXiv preprint arXiv:2502.05206. — [arXiv:2502.05206](https://arxiv.org/abs/2502.05206) [find](https://scholar.google.com/scholar?q=Xingjun+Ma%2C+Yifeng+Gao%2C+Yixu+Wang%2C+Ruofan+Wang%2C+Xin+Wang%2C+Ye+Sun%2C+Yifan+Ding%2C+Hengyuan+Xu%2C+Yunhao+Chen%2C+Yunhan+Zhao%2C+and+1+others%2E+2025%2E+Safety+at+scale%3A+A+comprehensive+survey+of+large+model+safety%2E+)
15. Shunyu Yao, Howard Chen, John Yang, and Karthik Narasimhan. 2022. [Webshop: Towards scalable real-world web interaction with grounded language agents](https://md.research.elamur.ai/free/en/papers/yao-2022-webshop-towards-scalable-real-world/). Advances in Neural Information Processing Systems, 35:20744–20757.
16. Avijit Mallik. 2019. Man-in-the-middle-attack: Understanding in simple words. International journal of data and network science. [find](https://scholar.google.com/scholar?q=Avijit+Mallik%2E+2019%2E+Man%2Din%2Dthe%2Dmiddle%2Dattack%3A+Understanding+in+simple+words%2E+International+journal+of+data+and+network+science%2E)
17. Weichen Yu, Kai Hu, Tianyu Pang, Chao Du, Min Lin, and Matt Fredrikson. Llm-based multi-agents system attack via continuous optimization with discrete efficient search. In Second Conference on Language Modeling. [find](https://scholar.google.com/scholar?q=Weichen+Yu%2C+Kai+Hu%2C+Tianyu+Pang%2C+Chao+Du%2C+Min+Lin%2C+and+Matt+Fredrikson%2E+Llm%2Dbased+multi%2Dagents+system+attack+via+continuous+optimization+with+discrete+efficient+search%2E+In+Second+Conference+on+Languag)
18. Mistral AI. 2025. Ministral-3-8b-instruct-2512. [https://huggingface.co/mistralai/](https://huggingface.co/mistralai/) Ministral-3-8B-Instruct-2512. Model card on Hugging Face. Accessed: 2026-01-05. [↗](https://huggingface.co/mistralai/)
19. Rana Shahroz, Zhen Tan, Sukwon Yun, Charles Fleming, and Tianlong Chen. 2025. Agents under siege: Breaking pragmatic multi-agent llm systems with optimized prompt attacks. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 9661–9… [find](https://scholar.google.com/scholar?q=Rana+Shahroz%2C+Zhen+Tan%2C+Sukwon+Yun%2C+Charles+Fleming%2C+and+Tianlong+Chen%2E+2025%2E+Agents+under+siege%3A+Breaking+pragmatic+multi%2Dagent+llm+systems+with+optimized+prompt+attacks%2E+In+Proceedings+of+the+63rd+A)
20. Guangming Sheng, Chi Zhang, Zilingfeng Ye, Xibin Wu, Wang Zhang, Ru Zhang, Yanghua Peng, Haibin Lin, and Chuan Wu. 2025. [Hybridflow: A flexible and efficient rlhf framework](https://md.research.elamur.ai/free/en/papers/sheng-2024-hybridflow-flexible-efficient-rlhf-framework/). In Proceedings of the Twentieth European Conference on Computer Systems, pages 1279–1297.
21. Chenxu Wang, Chaozhuo Li, Songyang Liu, Zejian Chen, Jinyu Hou, Ji Qi, Rui Li, Litian Zhang, Qiwei Ye, Zheng Liu, and 1 others. 2026. The devil behind moltbook: Anthropic safety is always vanishing in self-evolving ai societies. arXiv preprint arXiv:2602.09877. — [arXiv:2602.09877](https://arxiv.org/abs/2602.09877) [find](https://scholar.google.com/scholar?q=Chenxu+Wang%2C+Chaozhuo+Li%2C+Songyang+Liu%2C+Zejian+Chen%2C+Jinyu+Hou%2C+Ji+Qi%2C+Rui+Li%2C+Litian+Zhang%2C+Qiwei+Ye%2C+Zheng+Liu%2C+and+1+others%2E+2026%2E+The+devil+behind+moltbook%3A+Anthropic+safety+is+always+vanishing+in)
22. Siyu Yuan, Kaitao Song, Jiangjie Chen, Xu Tan, Yongliang Shen, Kan Ren, Dongsheng Li, and Deqing Yang. 2025. Easytool: Enhancing llm-based agents with concise tool instruction. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguisti… [find](https://scholar.google.com/scholar?q=Siyu+Yuan%2C+Kaitao+Song%2C+Jiangjie+Chen%2C+Xu+Tan%2C+Yongliang+Shen%2C+Kan+Ren%2C+Dongsheng+Li%2C+and+Deqing+Yang%2E+2025%2E+Easytool%3A+Enhancing+llm%2Dbased+agents+with+concise+tool+instruction%2E+In+Proceedings+of+the+2)
23. Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. 2024. [Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents](https://md.research.elamur.ai/free/en/papers/zhan-2024-injecagent-benchmarking-indirect-prompt-injections/). arXiv preprint arXiv:2403.02691.
24. Litian Zhang, Xiaoming Zhang, Bingyu Yan, Ziyi Zhou, Bo Zhang, Zhenyu Guan, Xi Zhang, and Chaozhuo Li. 2025. Llms are introvert. arXiv preprint arXiv:2507.05638. — [arXiv:2507.05638](https://arxiv.org/abs/2507.05638) [find](https://scholar.google.com/scholar?q=Litian+Zhang%2C+Xiaoming+Zhang%2C+Bingyu+Yan%2C+Ziyi+Zhou%2C+Bo+Zhang%2C+Zhenyu+Guan%2C+Xi+Zhang%2C+and+Chaozhuo+Li%2E+2025%2E+Llms+are+introvert%2E+arXiv+preprint+arXiv%3A2507%2E05638%2E+%E2%80%94+%5BarXiv%3A2507%2E05638%5D%28https%3A%2F%2Farxiv%2Eorg)
25. Jianan Zhao, Meng Qu, Chaozhuo Li, Hao Yan, Qian Liu, Rui Li, Xing Xie, and Jian Tang. 2022. Learning on large-scale text-attributed graphs via variational inference. arXiv preprint arXiv:2210.14709. — [arXiv:2210.14709](https://arxiv.org/abs/2210.14709) [find](https://scholar.google.com/scholar?q=Jianan+Zhao%2C+Meng+Qu%2C+Chaozhuo+Li%2C+Hao+Yan%2C+Qian+Liu%2C+Rui+Li%2C+Xing+Xie%2C+and+Jian+Tang%2E+2022%2E+Learning+on+large%2Dscale+text%2Dattributed+graphs+via+variational+inference%2E+arXiv+preprint+arXiv%3A2210%2E14709%2E+)
26. Yuxiang Zheng, Dayuan Fu, Xiangkun Hu, Xiaojie Cai, Lyumanshan Ye, Pengrui Lu, and Pengfei Liu. 2025. [Deepresearcher: Scaling deep research via reinforcement learning in real-world environments](https://md.research.elamur.ai/free/en/papers/zheng-2025-deepresearcher-scaling-deep-research-reinforcement/). arXiv preprint arXiv:2504.03160.
27. Shuyan Zhou, Frank F Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Tianyue Ou, Yonatan Bisk, Daniel Fried, and 1 others. 2023. [Webarena: A realistic web environment for building autonomous agents](https://md.research.elamur.ai/free/en/papers/zhou-2023-webarena-realistic-web-environment-building/). arXiv preprint arXiv:2307.13854.
28. Kunlun Zhu, Hongyi Du, Zhaochen Hong, Xiaocheng Yang, Shuyi Guo, Daisy Zhe Wang, Zhenhailong Wang, Cheng Qian, Robert Tang, Heng Ji, and 1 others. 2025. Multiagentbench: Evaluating the collaboration and competition of llm agents. In Proceedings of the 63rd Annual Meeting of the Association for Compu… [find](https://scholar.google.com/scholar?q=Kunlun+Zhu%2C+Hongyi+Du%2C+Zhaochen+Hong%2C+Xiaocheng+Yang%2C+Shuyi+Guo%2C+Daisy+Zhe+Wang%2C+Zhenhailong+Wang%2C+Cheng+Qian%2C+Robert+Tang%2C+Heng+Ji%2C+and+1+others%2E+2025%2E+Multiagentbench%3A+Evaluating+the+collaboration+a)
29. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). arXiv preprint arXiv:2307.15043.

*Updated 2 November 2026*