Deep Research Agents

Sources#

• An Actionable Diagnosis of Multilingual, Multi-Agent Planning Failures
• Beyond RAG: Building Agentic Document Workflows with LlamaIndex
• CS329A Self-Improving AI Agents — Part 8: Agentic Evaluations and Long-Horizon Tasks
• DRACO: a Cross-Domain Benchmark for Deep Research Accuracy, Completeness, and Objectivity
• Is Deep Research Reliable? Misleading Knowledge Induces False Conclusions
• Not Worth Another Token: Marginal Value Estimation for Efficient Deep Research Agents
• TRACE: Turn-level Reward Assignment via Credit Estimation for Long-Horizon Agents

Summary#

A deep research agent is an agentic AI system that takes a complex, open-ended query and: (1) decomposes it into constituent sub-workflows, (2) iteratively searches diverse external sources, and (3) synthesizes the gathered evidence into a structured, cited report. Unlike single-shot question answering, it interleaves multi-step planning and reasoning with autonomous retrieval and evaluation — verifying claims, resolving conflicting evidence, and identifying gaps in the literature. The output is an analysis whose breadth and depth would otherwise require extensive human-expert effort to produce. This is the system class that DRACO (Perplexity, Feb 2026) was built to evaluate, and the four production systems it benchmarks — Perplexity Deep Research, OpenAI Deep Research, Gemini Deep Research, and Claude Opus with web-search + code-execution tools — are the canonical instances.

The pattern vs. single-shot QA#

	Single-shot QA	Deep research agent
Planning	none / implicit	explicit query decomposition into sub-workflows
Retrieval	one pass (or none)	iterative, multi-source, autonomous
Reasoning	within one generation	multi-step; verify, resolve conflicts, find gaps
Output	an answer	a structured, cited report
Effort replaced	a lookup	hours of human-expert research

Deep research is increasingly load-bearing in knowledge-intensive domains — academic research, medical decision support, legal analysis, financial analysis — where the bar is comprehensive, in-depth, transparent, and verifiable reasoning over large, heterogeneous corpora.

Orchestration beats the bare model (the DRACO finding)#

The most consequential result for this wiki: on DRACO, Perplexity Deep Research (Opus 4.5 / 4.6 base) substantially outperforms bare Claude Opus 4.5 / 4.6 with web_search and code_execution tools — 70.5% vs 59.8% normalized for the 4.6 pairing. The same base model, wrapped in a purpose-built retrieval-and-synthesis harness, gains ~10 percentage points. The paper's own gloss: this indicates "the importance of agent orchestration beyond the base model."

This is a live counter-datapoint to Harness Shrinkage as Models Improve. The wiki's recurring thesis is that scaffolding shrinks as models improve and mechanical verification is what stays load-bearing. Deep research is a domain where, as of early 2026, the harness still carries a large, measurable share of system quality — the orchestration layer (query decomposition, iterative retrieval strategy, source selection, synthesis discipline) has not dissolved into the base model. Whether it shrinks as models cross the next capability thresholds is the open question; DRACO is the current measurement.

Verification is the binding constraint#

Across every system DRACO grades, the ranking by rubric axis is consistent: strongest on presentation quality, weakest on factual accuracy and citation quality. Fluency is solved; verifiable correctness is not. This is Verification as the New Bottleneck surfacing inside the research product itself — the hard part is no longer producing a readable report but ensuring every claim in it is true and properly sourced. It is the open-domain mirror of AI-Driven Formal Proof Search, where a compiler makes verification total; deep research has no such oracle, so accuracy/citation become the frontier.

One misleading document flips the conclusion (MisKnow-Agent)#

DRACO grades factual accuracy at the output and finds it weakest everywhere. Zhu, Li, Yang, Su & Shao (Is Deep Research Reliable? Misleading Knowledge Induces False Conclusions, BUPT / Shanghai AI Lab / CQUPT, arXiv 2607.20891, 2026-07-23, empirical) attack the same axis from the input side and put a number on it: inserting one misleading-but-credible document into the retrieval pool raises the false-conclusion adoption rate (FCAR) from 0% in the no-injection control to 54.7% on average.

The framing is the first thing to get right. This is not an attack paper. The threat model explicitly excludes prompt injection and instruction hijacking — model parameters, system prompt, tool implementations and the base evidence environment are all untouched, and the injected documents contain no instructions whatsoever. What they contain is a plausible false claim, attributed to a plausible institution, in a plausible genre. The agent is never hijacked; it performs exactly the task the user asked for and reaches a wrong conclusion because a document persuaded it. This is epistemic corruption of the research product, and the authors pitch it as the ambient condition of the open web rather than an adversary's doing. It is a different plane from Agent Data Injection (ADI), where the payload's purpose is to be misread as structure — a forged comment author, a fabricated tool result — so the agent acts on data that never existed. Here the data is exactly what it appears to be: a document making a claim. Every defense that keeps untrusted text from being read as an instruction, or untrusted data from being read as trusted data, is orthogonal to this failure mode, because nothing about the document is forged except the world it describes.

Setup. 100 tasks from DeepResearch Bench. For each task a blueprint fixes one canonical false conclusion (quantified, so it is scoreable) plus an institution pool stratified into three authority tiers; DeepSeek-V4 Pro then generates documents across 3 authority levels × 4 source styles (paper / news / blog / post) × 5 institutions per tier. A search-guided refinement loop plus five search-enabled cross-model verifiers plus manual screening yields 5,933 quality-controlled misleading documents; every target false conclusion was additionally hand-audited against authoritative sources at 100% coverage. Evaluated on 2 open-source frameworks (DeerFlow, WebThinker) × 3 backbones (DeepSeek-V4 Pro, Qwen3.5-397B, Intern-S1-Pro), plus closed-source Gemini Deep Research.

FCAR is a strict metric, which is what makes the number alarming rather than definitional. A report counts as an adoption only when its own synthesis, conclusion, recommendation, or executive summary presents the false claim as true or best-supported. Mentioning it, quoting it, attributing it to the source, hedging it, contrasting it against public evidence, or refuting it all score as non-adoption. The judge (DeepSeek-V4 Pro) hits 99.7% raw agreement and Cohen's κ = 0.993 against two blinded human annotators on 300 reports — properly validated, and far above the agreement typical of rubric grading, because the judgment is a sharply-specified binary rather than a quality score.

Where the pipeline fails: FCAR = MER × ECAR#

The paper's analytic contribution is a two-factor decomposition that says where in the workflow the failure sits:

• MER (misleading-evidence reach) — fraction of tasks where at least one injected document was actually retrieved.
• ECAR (exposure-conditional adoption rate) — fraction of exposed tasks whose report adopted the conclusion.

Because no unexposed task ever adopted its false conclusion, FCAR = MER × ECAR holds exactly. Matched high-authority, paper-style setting:

Backbone	WebThinker FCAR / MER / ECAR	DeerFlow FCAR / MER / ECAR	Gap (total / MER / ECAR)	McNemar p
Intern-S1-Pro	55.0 / 72.0 / 76.4	76.0 / 94.0 / 80.9	+21.0 / +17.3 / +3.7	< 0.001
Qwen3.5-397B	50.0 / 98.0 / 51.0	60.0 / 97.0 / 61.9	+10.0 / −0.6 / +10.6	0.064
DeepSeek-V4 Pro	60.0 / 92.0 / 65.2	65.0 / 96.0 / 67.7	+5.0 / +2.7 / +2.3	0.487

The decomposition earns its keep by showing that the same 12-point average framework gap has three different causes. For Intern-S1-Pro it is almost entirely retrieval reach (DeerFlow simply surfaces the documents more often); for Qwen3.5-397B reach is identical across frameworks and the whole gap is conditional adoption; for DeepSeek-V4 Pro it splits evenly. A single FCAR number would have supported "DeerFlow is less robust" and nothing more actionable. This is the same move Layerwise Omission Attribution makes for omission — refuse to grade at the output when the pipeline has separable stages — and it is the diagnostic that Automated Failure Attribution shows a post-hoc LLM judge cannot supply for itself.

Note the ceiling this exposes: MER runs 72–98%. Retrieval is not the filter. Once a relevant-looking misleading document exists in the pool, essentially every configuration reads it.

What persuades — and what doesn't#

• Presentation style beats institutional authority. Paper 61.0% > blog 53.0% > news 44.0% > post 37.5%, a 23.5pp paper-to-post gap, with paper highest and post lowest in all six configurations. Authority spans a smaller 14.8pp (high 61.0% / medium 57.7% / low 46.2%) and is not strictly monotonic — two WebThinker settings rate medium above high. The generation prompt explicitly forbids varying writing quality by tier ("do not dumb down low-tier docs, do not add typos"), so the authority effect is purely the name and URL, cleanly separated from text quality. Looking like a paper is worth more than being from MIT.
• Search-result rank barely matters. Front / spread / back placement give 66.2 / 65.5 / 64.5% — a 1.7pp spread in the cross-configuration mean and never more than 6pp in any one. Agents weight relevance, not list position. Any defense premised on demoting suspect sources in the ranking is aiming at the wrong variable.
• Dose response is flat past one document. 54.7% at one, 59.5% at two, peaking at 61.0% at three, then declining — 60.3% at four, 58.3% at five, with no configuration monotonic. One document is essentially the entire effect. (Gemini Deep Research is the exception, rising 27% → 54% from one document to three; its documents arrive through a local-source upload interface rather than a retrieval pool.)
• Lifecycle stage dominates everything else. Mean FCAR is 40.5% at cold start, 44.2% mid-research, and 85.5% when the document arrives immediately before final synthesis (77–94% across all six configurations). What protects an agent is not detection but remaining workflow — subsequent search that can challenge or displace the claim. WebThinker's early-stage advantage over DeerFlow (27.7% vs 53.3% at cold start) reverses slightly at pre-synthesis (87.7% vs 83.3%), which is the tell: it was never rejecting the evidence, only diluting it.

The verification asymmetry — a harness finding, not a model finding#

The result to carry: every one of the 5,933 retained documents was unanimously classified as misleading by all five search-enabled verifier models — and three of those five verifiers are the very backbones that then adopt the same documents at 50–76% inside the workflow. DeepSeek-V4 Pro, Qwen3.5-397B and Intern-S1-Pro each catch these documents when handed one and asked "is this corroborable?", and each endorses them when running a research task that happens to retrieve one. The capability is present and the workflow never invokes it.

The honest mechanism is a prompt-and-role difference, not a mysterious capability collapse, and that is exactly what makes it actionable. The verifier is given one document, a single focused question, web-search tools, and explicit search discipline — check the specific quantitative claim, cross-check the named institution, treat placeholder domains as non-evidence. The research agent is given a task, and verification is nobody's assigned job at any step. So the gap is architectural: the harness allocates no step, no budget and no instruction to the check it is perfectly capable of performing. That is why the pre-research defense — which does nothing but ask — buys a large chunk of the gap back, and why nothing closes it.

Two caveats keep this from being a controlled A/B. The corpus was selected for unanimous "misleading" verdicts, so no verifier false-positive rate on genuine documents can be read off it; and the verifier's task (judge one document) is strictly easier than the agent's (judge a document while doing something else). The asymmetry is real; its magnitude is not measured.

This is the same shape as two adjacent verifier failures compiled the same week — Stopping Under a Noisy Verifier (a verifier's acceptance signal decoupling from true validity) and Automated Failure Attribution (a diagnosis that is confidently argued and wrong). All three say a version of: the verification step you assumed was happening either isn't running, isn't discriminating, or isn't naming the right cause.

Defenses reduce, don't eliminate — and combining them can backfire#

Against DeerFlow no-defense baselines of 60–76%: pre-research verification prompting lands at 37–57%, a post-research claim-by-claim refinement agent at 20–58%, and the two combined at 15–62%. The combination is best for two of three backbones and worst of all three arms for Intern-S1-Pro (62%, above either defense alone at 57% and 58%).

The paper's explanation for that inversion is the transferable part: the refinement agent re-verifies claims in the same poisoned retrieval environment, so it can re-retrieve the misleading document and re-endorse a claim that pre-research caution had already hedged. A repair step whose evidence source is the corruption itself has a nonzero probability of damaging a correct output — the FCAR instance of Stopping Under a Noisy Verifier's β term, where the correct move can be to not run the repair at all.

Framework and backbone: robustness is not a capability ladder#

Under the matched setting FCAR spans 50–76%; averaged across backbones, DeerFlow 67.0% vs WebThinker 55.0%. Trace inspection gives a mechanism: DeerFlow runs a fairly direct Planner→Researcher→Reporter pipeline that preserves retrieved documents in observations and passes them to the Reporter, while WebThinker decomposes into finer subqueries, compresses evidence into document memory, and drafts section by section — transformations that attenuate or drop misleading evidence before synthesis. The harness is load-bearing for robustness, not only for quality — a second axis on which orchestration outweighs the model it wraps.

But it is not a ladder. Absolute FCAR is non-monotonic in the Artificial Analysis Intelligence Index: Intern-S1-Pro (Index 22) is the worst under DeerFlow at 76% yet mid-pack under WebThinker, while Qwen3.5-397B (Index 34) is the best under both and DeepSeek-V4 Pro (Index 44) is worst under WebThinker. Only the framework gap narrows with capability — 21 → 10 → 5pp. Read against Harness Shrinkage as Models Improve: the harness's contribution to robustness does shrink as models improve, but the residual robustness it fails to confer does not go to zero, and robustness cannot be inferred from either framework choice or Intelligence Index alone. Three models is too few to call this a trend.

Gemini Deep Research reproduces the qualitative pattern (54% high-authority, 46% medium, 8% low; paper 54% > blog 41% > news 34% > post 28%) with native online search left enabled, so this is not an artifact of open-source pipelines or of disabling real retrieval.

Limits worth carrying#

• Synthetic corpus, LLM-generated. All 5,933 documents come from one model (DeepSeek-V4 Pro), and the generation prompt instructs it to make URLs recognizably synthetic on inspection. That cuts both ways: the documents are less realistic than real-web misinformation, and the fake URLs were designed to be spottable and were still adopted at 54.7%.
• Injected into isolated retrieval pools, not published to the live web (deliberately, for ethics); Gemini receives them through its local-source upload interface, which is a materially different trust context from an organic search hit.
• Runs that failed on tool or API errors were rerun, not scored as non-adoptions, which nudges FCAR up relative to what an end user would see.
• The rank experiment conditions on inclusion — its ~65% baseline is not comparable to the 54.7% headline, which is a single-document, unconditional figure.

Efficiency: more tokens ≠ better#

DRACO's token/latency table breaks the intuition that longer, more expensive runs win:

• The top scorer (Perplexity, Opus 4.6) also had the lowest latency among deep-research systems (245s), despite the largest input-token footprint (~779k tokens/task) — input-heavy retrieval, lean output (~8.8k tokens).
• OpenAI o3 and Gemini produced the most output (24.9k, 22.1k tokens) yet scored mid-pack — verbosity did not buy quality.
• OpenAI o4-mini was the most token-efficient overall (~53.5k total) but lagged on score (41.9%).

The shape — quality decoupled from output length, input-token spend doing the real work — is the deep-research instance of the cost/quality combo tradeoffs formalized in Client-Side Agent Optimization (model-per-role, budget, routing): the lever that matters is orchestration design, not raw token expenditure.

A tree of agentic retrieval, not a loop — the form factor named from the retrieval side#

The corpus's treatment above is evaluative (DRACO grades the systems; MisKnow-Agent attacks their inputs). Doulcet's 2026 RAG retrospective (practitioner-opinion, LlamaIndex vendor COI) supplies the missing structural account: where deep research sits in the evolution of retrieval, and what its control flow actually is.

His placement is a one-line taxonomy correction. Corrective/agentic RAG is a loop — retrieve, grade the chunks, reformulate, retry, until the evidence is good enough. Deep research is "plan → branch into parallel sub-searches → synthesize. A tree of agentic retrieval, not a loop." Fan-out, not iteration. That distinction is not cosmetic: a loop's cost scales with how many attempts a hard query needs, while a tree's scales with the branching factor decided once at decompose time — which is why DRACO's top scorer can carry the largest input-token footprint (~779k/task) at the lowest latency. The branches ran concurrently.

The engineering consequence he draws is that this form factor is why a workflow runtime earns its cost at all — the four properties named are exactly deep research's: sub-questions must run in parallel to fit a latency budget; the composer must wait for all of them; citations must thread through the whole pipeline; and the failure of one sub-question must not kill the rest. The last is the one graded evaluations cannot see. A tree that silently drops a failed branch and composes the survivors produces a complete-looking cited report whose coverage gap is invisible at the output — the deep-research instance of the omission problem Layerwise Omission Attribution attacks with checkpoint taps, and a concrete reason its "attribute the loss to a layer" method matters more here than in single-shot retrieval.

Two further items transfer from that page and both point upstream of anything DRACO measures:

• Parsing evidence gets more important as the agent gets better, not less. The public reply to Liu's thread that stated it best — "if a retrieval step feeds an action, I want the agent to cite the exact chunk, table, or page it used before it touches the workflow" — is an unvetted practitioner comment, but it names the property the deck's parsing stack is built to provide (per-value page + bounding-box citations) and the one that makes a deep-research citation checkable rather than decorative. DRACO grades citation quality; nothing in that grading distinguishes a citation to a correctly-parsed table row from one to a collapsed cell.
• Retrieval is the audit trail. "'Why did the AI say this?' Retrieval gives a citation log. Long context gives a vibe." This is the strongest available argument that the deep-research form factor does not dissolve into a long-context read of the corpus even when the corpus fits — the report's value is inseparable from its traceability.

The other branch: train the searcher instead of orchestrating it#

Everything above measures systems — production harnesses wrapping a fixed frontier model, where the orchestration is worth ~10pp over the bare model with tools. TRACE (Tao et al., UW–Madison + Microsoft Research, arXiv 2607.13988, 2026-07-15, empirical) is the corpus's first source to take the other branch: leave the harness deliberately minimal — a ReAct loop over three tools, browser.search / browser.open / browser.find, "keeping this interface small helps isolate the effect of the training signal" — and post-train the policy's tool use instead.

The result is that a very small model gets a long way on the search axis. With pure RL and dense per-turn credit (no cold-start SFT, no agentic mid-training, no live-web training data, no judge), Qwen3-4B goes 7.2 → 35.6 on closed-web BrowseComp-Plus and Qwen3-30B-A3B 8.4 → 42.6, and the trained 4B passes several 32B deep-research agents on that benchmark — ASearcher-QwQ-32B 28.9, WebDancer-32B 32.4, roughly level with CutBill-30B-A3B 35.1 — while remaining well short of TongyiDS-30B-A3B's 44.4. Those four are the paper's own non-controlled reference points (different data, backbones, pipelines and harnesses) and must not be read as arms. The transfer result is the one that generalizes: trained entirely inside a closed FAISS corpus, the 30B-A3B agent reaches 12.9 on BrowseComp, 52.0 on GAIA and 45.0 on the Chinese xbench-DeepSearch — across retrieval environments and languages.

This is adjacent to the orchestration finding, not a rival to it, and the boundary is the answer format. TRACE's reward is normalized exact match on a short answer span, and its own limitations section says the frozen-reference progress probe may not be a state-value proxy at all for "long, structured, or open-ended" outputs — a multi-file patch, an underspecified preference. Everything this page grades — a structured, cited, multi-source report — is on the far side of that line. So "train the searcher" is demonstrated on the short-answer branch of deep research and explicitly unproven on the report branch.

What does transfer is a behavioural picture of a trained search policy, from per-turn credit traces the method produces as a by-product. The division of labour across the three tools is sharp: search earns its credit by surfacing the non-obvious entity (one opening query scores δ = +6.39 by returning the express-partner company rather than the salient one named in the question), open earns it by securing the answer (+6.05 on the page that names the person), and a literal find after the answer is already secured earns +0.10 or +0.00 — confirmation is worth nothing, which is the anti-padding property of the reward working as designed. And the characteristic failure has a shape this page should recognize: the trajectory reaches an answer-secured prefix and then loses it after one diagnostic tool call. That is the same "one more check made it worse" pattern Stopping Under a Noisy Verifier prices and Verification as the New Bottleneck tracks, observed here at turn granularity inside a single rollout rather than across a repair loop. Trained interaction length also grows under dense credit, earlier and faster than under outcome-only RL, because a local progress signal can pay for a good turn before the final answer is right.

The third attack surface: the root of the tree#

DRACO grades the output and MisKnow-Agent poisons the inputs. Pahuja, Brokman, Hofman et al. (An Actionable Diagnosis of Multilingual, Multi-Agent Planning Failures, Fujitsu Research of Europe / Cohere / Fujitsu Research, arXiv 2608.03735, 2026-08-04, empirical) go after the request-to-plan boundary — the single decision at the root of the tree, before any branch exists. Their unit of failure is defined so that execution quality is irrelevant to it:

a mismatch between the user request and the generated plan such that, even if the plan were executed correctly, the resulting execution would not satisfy the original request.

The argument for why that boundary deserves separate treatment is the tree shape restated as a risk: it "is often the de-facto interface to multilingual inputs, even when following actions are done internally in English," and "a misunderstanding here is particularly consequential since any distortion might propagate through the entire multi-agent workflow." A loop can recover from a bad first move by grading its own chunks and retrying; a tree that fans out from a mis-grounded decomposition commits every branch to the wrong question at once. This is also the first source here to instrument HuggingFace's Open Deep Research (the taxonomy's derivation framework, with Qwen2.5-32B-Instruct and Aya-Expanse-32B) rather than a production system or DeerFlow/WebThinker.

Five recurring ways a plan drops a commitment — entity, source, temporal, operation and answer-format grounding — and the mitigation is shaped by the failure rather than by better prompting: a typed pre-planning representation (entities, time_constraint, source_constraint, attachment_type, operations, answer_type over closed vocabularies) injected into the planner and kept in view downstream, because "TART is not consumed once at planning time and then discarded" — it goes into the coordinator's and worker agents' system prompts too. On GAIA-MAPS with OWL and the base model frozen this is worth +5.6 points of mean exact match for GPT-5-mini across eleven languages, +5.9 for Mistral-Large-3 and +3.6 for Qwen3-VL-235B-A22B on a seven-language subset, and +10.0 for Mistral on the table-reasoning dataset MULTITAT. Another harness-change-at-fixed-model datum for the orchestration finding above, at roughly half DRACO's ~10pp and on a different lever: not which retrieval-and-synthesis pipeline, but whether the pipeline states its task to itself explicitly. The paper's closing position is exactly the citations-threaded-through-every-step property generalized from provenance to intent — "multi-agent architectures that preserve user intent through explicit and inspectable semantic contracts, rather than relying exclusively on unconstrained natural-language planning."

And the plateau is the branching-factor argument measured, with a sting. Gains average +9.0 at difficulty Level 1, +5.0 at Level 2 and 0 at Level 3. The tempting explanation — Level 3 has fewer correctable planning failures — is refused by the paper's own judge counts, where the taxonomy-covered share of failures is flat at 55.2% for both Level 2 and Level 3. What doubles instead is intrinsic task length, from GAIA's English ground-truth annotations: reference solution steps 5.48 → 7.48 → 13.00, required tools 1.58 → 2.55 → 3.38. So "a tree's cost scales with the branching factor decided once at decompose time" has a reliability twin — a repaired root does not survive a long chain, because each additional step is an independent chance for a retrieval, tool-use or reasoning error downstream of a plan that was, this time, correct. Note also which failure dominates: operation grounding — the wrong reasoning chain, i.e. a decomposition error — is the largest taxonomy-covered category for all three backbones (24.0% / 36.5% / 30.2% of failures) and the outright majority under two of them in the lowest-resource languages. That is the same shape as MisKnow-Agent's finding that retrieval is not the filter, arriving from the planning side: the expensive mistakes are made when the task is being cut up, not when the evidence is being fetched.

Two limits travel with it, both developed on Automated Failure Attribution: the largest single increment in the ablation adds only the answer-shape and attachment fields (+3.1 of +5.4), so an unknown share of the gain is exact-match compliance rather than better grounding; and six of the eleven languages are the authors' own machine translations, which is where the diagnostic half of the paper is weakest.

What the tree costs, and where to cut it#

Everything above measures what a deep-research run produces. Kolukuluru, Ashok, Arora et al. (Not Worth Another Token: Marginal Value Estimation for Efficient Deep Research Agents, UMass Amherst / UT Austin / Adobe Research, arXiv 2608.08389, 2026-08-09, empirical) measure what it spends, with the pipeline, the generator and even the cached subqueries and retrieved evidence held fixed and only a pruning policy varying — eight scoring rules, plus lexical, mixed and learned variants, crossed with three intervention points (pre-retrieval, post-retrieval, pre-synthesis) over 100 DeepResearchGym queries on GPT-Researcher, ~40 configurations in all. It is the controlled, within-pipeline version of Efficiency: more tokens ≠ better above, where DRACO could only compare across products.

Where the money goes, and why that follows from the tree shape. An unpruned run costs 29.0 nodes / 375.4k tokens / 3422.6 s at 57.83 quality, and the split is lopsided: 94.41% of tokens are spent in result processing, 4.58% in query generation, 1.02% in planning. Planning and writing are rounding errors; reading what the branches returned is the bill. That is the tree-not-loop form factor priced — fan-out sets the cost once at decompose time, and every retained item is then paid for three times over (retrieval, result processing, and the recursive expansion it spawns). Two consequences, both measured:

• Pruning a branch before it expands is the only intervention that reaches upstream cost. Post-retrieval MMR takes nodes 29.0 → 8.84 and tokens 375.4k → 114.6k (−69.5%) while retaining 56.62 quality — 97.9% of baseline. It also cuts generation, not just prompt: output tokens fall 114.7k → 31.7k, because a branch that never expands never produces its result-processing text.
• Pruning at the end cannot recover any of it, and mostly costs more than it saves. Seven of the eight one-stage pre-synthesis arms save between +2.5% and −3.0% of baseline tokens — Submodular Coverage at 384.7k and LLM-judge pruning at 386.7k are both above the baseline's 375.4k — with only Hybrid reaching a real 11.5%, and all eight raise wall-clock runtime by 12.0% to 33.3%, despite removing 63–96% of the final synthesis context. The pipeline's own built-in late trim is the same story: it drops accumulated context from 66.10 to 44.08 items (34.06% of tokens) after the search has been paid for.

The honest frontier, and the number not to quote alone. The abstract's "up to 73%" is three-stage MMR at 100.1k tokens (−73.3%) and 55.90 quality — below the 57.83 baseline; the compression headline and a below-baseline result are the same configuration. The defensible point is two-stage CD + SC: 59.47 quality (+1.64), −63.4% tokens, −53.3% runtime. Read against the harness findings above, this is a third lever at a frozen model — but the first one that is subtractive, and it buys efficiency where TART and orchestration buy quality.

And the cost lands on this page's weakest axis. Compression trades against grounding, twice over:

• CD + SC's citation recall falls to 89.96, below both the 95.54 baseline and Submodular Coverage alone (94.74). The best quality-efficiency configuration in the study is a worse-grounded report than the unpruned one — quality and faithfulness move in opposite directions for the same method.
• Relevance retention never survives pruning at all. KPR+KPC (key-point recall against ground-truth documents, minus contradictions) is 70.23 at baseline, and the best of the 39 pruned configurations reaches 66.32 — a configuration that saves 0.2% of tokens. Every configuration that saves real money is 4 to 29 points down. (The paper states this for its one-stage arms only; the all-configurations version is derived at compile by reading every row of its Table 5.) Three arms do match or beat baseline citation recall, all diversity-flavoured (post-retrieval DPP 95.62, three-stage DPP 95.40, three-stage Learned-Query + GRN 95.48) and each pays in relevance — DPP's KPR+KPC is 43.33.

The trap is that a rubric judge cannot see this. Three-stage Learned-Query + GRN posts quality 58.13 (above baseline), citation recall 95.48 (at baseline) and 145.7k tokens (−61.2%) — and has lost a quarter of its ground-truth key-point coverage. On the axis DRACO grades highest, pruning is nearly free; on the axis that is already weakest everywhere, it is not.

Four limits to carry. (1) One pipeline, one benchmark, one representative operating point per method; the paper says so. (2) Quality is judge-dependent in the strong sense — Table 4 scores the same reports at 91.50 when gpt-4.1-mini judges itself and 47.67 when gpt-5-mini judges the same outputs, a 43.8-point swing on identical text, so only within-judge ordering means anything and the paper's own confidence is in the efficiency results. (3) Nothing is reported with variance: quality, relevance and faithfulness are means over 100 reports with no intervals. The one variance estimate available is accidental — a nominally identical MMR policy appears twice (identical branch and root pruning ratios, identical tokens and nodes, runtime within 1.5 s) with quality differing by 0.22, citation recall by 0.91 and KPR+KPC by 1.67, which is roughly the size of several gaps the paper interprets. (4) The cross-benchmark arm does not replicate the quality half: on DeepResearch Bench token savings get larger (three-stage MMR 92.32%) while every pruned configuration scores below the 0.4798 baseline except one (Submodular root-only, 0.4811). The stage-ordering conclusion transfers; the method-level quality rankings do not, and the paper is explicit that it treats the second benchmark as directional.

A benchmark with no headroom problem: DeepScholar-Bench (late 2025)#

Everything above is measured on benchmarks where good systems score respectably. DeepScholar-Bench — a Stanford/Berkeley live benchmark taught in CS329A lecture 8 (Aakanksha Chowdhery, practitioner-opinion, figures read off slides through ASR) — is the counter-case: "none of the existing systems actually exceeds 19%." It is the earliest deep-research eval in this corpus and the one with the most headroom, which makes it the ancestor DRACO and the rest were built after.

The task is one most researchers want done: given a recent paper, generate its related-work section. The construction is live — recent arXiv papers at PhD-level difficulty across 22 domains, re-run monthly with new papers, and restricted to papers published after the major models' training cutoffs. Contamination is prevented by the refresh cadence rather than corrected after the fact, and the task never goes stale because the literature does not.

Three graded axes, each validated against human raters at roughly 70–80% agreement:

Axis	What it asks
Knowledge synthesis	Is the write-up organized and coherent, and does it capture the key facts?
Retrieval quality	Are the retrieved references relevant, important (authoritative, well-cited), and covering?
Verifiability	Do the citations support the claims (precision), and are the claims backed (coverage)?

The failure modes are the useful part, and all four are about grounding rather than writing:

• Relevance is not importance. Systems find relevant documents and miss the foundational papers — the ones an expert knows by having accumulated them. Document-importance scores land below ~12.5% everywhere.
• Key facts are missed even from perfect sources. Hand the system the exact papers that should have been cited and key-fact coverage is still only ~50%; without them it is lower. The bottleneck is extraction, not search.
• Synthesis quality and verifiability trade off. OpenAI deep research writes the most coherent prose and has lower verifiability; the benchmark's own reference pipeline reaches ~90% citation precision without matching the synthesis. No system excels at both.
• Which is the lecture's transferable point: coherent, well-cited-looking prose is what a rubric judge rewards and what a non-expert reader cannot audit — the same reason a fluent artifact defeats review elsewhere in this corpus.

Read against GDPval from the same lecture, the two failures are one failure at different distances: GDPval hands the model the reference files and finds it promises to read them and doesn't; DeepScholar-Bench makes it go find the references and finds it retrieves the merely relevant. Both are the missing expert context, not a missing capability.

Where it sits#

Deep research is a long-horizon, autonomous, multi-step task — exactly the regime Task Time-Horizon Scaling measures — run as a continuous retrieval-and-synthesis harness. It is one of the clearest current cases where a product (the harness + orchestration) is worth substantially more than the model it wraps, which is why a benchmark of systems (not models) like DRACO is the right instrument, graded by LLM-as-a-judge against expert rubrics built from real production usage.

Connections#

• Autonomous Scientific Discovery — where this pattern sits in a survey typology of research-AI systems: the Scientific AI Assistants rung (ChatGPT/Gemini Deep Research, SciSpace, NotebookLM, Cursor), defined as "fundamentally reactive" — and the same survey's concession that the rung does not hold, since Deep Research, Claude Research and Perplexity Labs "already assume more agentic functions," making assistants and agents points on one autonomy continuum
• Open-Ended Discovery Harnesses — the name collision worth keeping straight. Autoresearch, AlphaEvolve/EvoX, CORAL and SwarmResearch all call themselves research agents, and none of them does what this page describes: no retrieval, no citations, no report — a numeric evaluator on a problem with no known optimum (circle packing, GPU scheduling, contest heuristics, decoding kernels), run for hours against a score. Two things genuinely transfer. The orchestration-beats-the-base-model finding recurs there in a controlled form (a harness change, model held fixed, moves the result), and the failure modes rhyme: what MisKnow-Agent calls adopting a persuasive false conclusion is what SwarmResearch's case study calls a search agent producing an improved run with a confident, unsubstantiated causal story — in both, the fluent artifact is what defeats review
• Document Parsing as the Retrieval Bottleneck — the upstream half of this pipeline, and the reason its weakest graded axis may not be a model problem at all. Supplies the control-flow correction ("a tree of agentic retrieval, not a loop"), the workflow properties that make the form factor buildable (parallel branches, a composer that joins on count, citations threaded through every step, one failed branch not killing the rest), and the failure class DRACO's output grading structurally cannot reach: a figure misattributed by a collapsed table arrives in the report correctly cited and wrong
• Crystallizing Agent Work into Workflows — the runtime this form factor needs, and the lifecycle question it raises. The tree shape (send_event fan-out, collect_events join on count, citations threaded through every step, one failed branch not killing the rest) is the workflow machinery treated there; the open question in the other direction is whether a research tree ever crystallizes — its value is that each run explores differently, which is the scope condition Malik names as the limit of promotion
• DRACO Benchmark — the benchmark built to evaluate this system class; source of the orchestration, verification, and efficiency findings here
• Turn-Level Credit Assignment — the other branch: post-train the searcher's tool use with dense per-turn reward instead of orchestrating a fixed model, and read the resulting policy's behaviour off its own credit traces. Bounded to compact verifiable answers by construction, which is the opposite end of the format axis from a cited report
• Tool-Output Pruning — the same subtraction measured in a coding agent, and the page that carries the stage-placement result in full. Two things read across. The boundary matches exactly — SWE-Pruner Pro compresses a tool response before it enters history, which is this pipeline's post-retrieval stage — but the payoff structure does not: a coding agent pays for a tool response once, while a research tree pays for a retained item at retrieval, at result processing, and again in the branches it spawns, which is why pruning early here takes nodes 29.0 → 8.84 rather than merely shortening a prompt. And both papers price themselves in tokens and wall time and never money, so the billed-cost question lives there with the exchange-rate term this source supplies
• Context Lifecycle Management — the context-side constraint on long research runs: Self-GC's Hard Set is exactly this workload (browser, shell, web-fetch traces under sustained tool pressure), where the exact URL, extracted row value, or callback handle buried in an old tool output is what a later synthesis turn depends on — and where every position- or type-based pruning heuristic measured below 70% no-impact
• Agent Harness Engineering — deep research is a retrieval-and-synthesis harness; the "orchestration beyond the base model" result is direct evidence that this harness layer is load-bearing
• Harness Shrinkage as Models Improve — counter-datapoint: here the harness has not shrunk into the model (~10pp gap between orchestrated and bare-model-with-tools)
• Layerwise Omission Attribution — the missing question behind DRACO's weakest axis. Factual accuracy is graded at the output, which cannot say whether an omitted source was an L1 pagination stop, an L2 condensation, an L5 mid-context miss, or an L8 iteration cap — and only the last two are about the model. Its real-data pilot also carries a warning for any research agent read as source-agnostic: end-to-end failure spans 6× across sources (FHIR 0.148, SEC 0.639, PubMed 0.889) in the same harness, though source and domain are confounded there by construction
• Verification as the New Bottleneck — factual accuracy / citation are the weakest axes across all systems; verifiable correctness is the frontier
• Task Time-Horizon Scaling — deep research is a long-horizon autonomous task of exactly the kind METR's time-horizon metric measures
• Client-Side Agent Optimization — the token/latency tradeoffs (more output ≠ better; orchestration > raw spend) are the deep-research instance of combo/budget optimization
• LLM-as-a-Judge — how DRACO grades deep-research outputs against task-specific rubrics
• Production-Sourced Evaluation — how DRACO's tasks were sourced (from real Perplexity Deep Research traffic) so the benchmark reflects actual use
• AI-Driven Formal Proof Search — the verification-total contrast: a sound verifier eliminates the accuracy gap that deep research can't close
• Perplexity — builder of the leading deep-research system and of DRACO
• Anthropic / Google DeepMind — makers of evaluated systems (Claude Opus; Gemini Deep Research, and Gemini-3-Pro as judge)
• Repository Exploration Subagent — structurally parallel inside a coding agent: FastContext decomposes a task into exploration + solving and isolates iterative search behind a compact synthesized return — the same decompose→search→synthesize shape deep research applies to the web
• Agent Data Injection (ADI) — the adjacent-but-distinct failure, and the distinction is load-bearing. ADI forges structure (a comment's author, a fabricated tool result) so the agent does the user's task on data that never existed; MisKnow-Agent forges nothing structural at all — the document is genuinely a document making a claim, and it wins by persuasion. The threat model here explicitly rules out prompt injection and instruction hijacking, which means every defense on that page (delimiter isolation, provenance labels, nonce randomization, CaMeL Strict) is orthogonal: correct data-flow tracking would faithfully label the misleading document with its true untrusted source and the agent would still believe it. Content-level reliability is a separate axis from trust-boundary integrity, and only the second one has a mechanical answer
• Stopping Under a Noisy Verifier — the same asymmetry with a coefficient attached, plus a direct instance. Wu et al. price a verifier whose acceptance signal decouples from true validity (Ā = ρ₀ + J·Q); here the verifier is not miscalibrated at all — the same backbone models score the misleading documents correctly in isolation and adopt them in-workflow, so the defect is an unrun check rather than a noisy one. The instance: DeerFlow's post-research refinement agent re-verifies claims in the same poisoned retrieval environment and makes Intern-S1-Pro worse (combined defense 62% vs 57%/58% alone) — a repair operator with a real β, where the correct move is to not repair. Both pages converge on the same prescription from opposite directions: a repair or verification step is only worth running when its evidence source is cleaner than what it is repairing
• Automated Failure Attribution — the same in-isolation-vs-in-workflow shape one level up, and the reason MER × ECAR had to be instrumented rather than inferred. Liu et al. measure a judge reading a whole failed trace and naming the decisive step and cause (73.9% best step, 16–25% on the full triple); this page's decomposition gets where the pipeline failed for free from two counters — whether the document was retrieved, and whether an exposed report adopted it — because the injection made the ground truth constructible. Where a stage boundary can be counted, count it; post-hoc attribution is what you fall back to when it can't. Both also find the diagnostic and the capability living in the same model without meeting: there, a judge handed the gold answer gets worse at process tracing; here, a model that flags a document standalone endorses it mid-task. Extended 2026-08-13: that page now also hosts the corpus's one collected rather than injected failure set — planning-grounding failures filtered by "English succeeds, non-English fails," which is where the root-of-the-tree section above comes from — along with the two limits that bound it and the finding that the field keeps defining multi-fault traces away rather than measuring them
• Failures That Look Like Success — the canonical instance at the report level. A deep-research report that adopts a seeded falsehood is fluent, structured, cited, and passes every presentation check DRACO scores highest on; FCAR's strictness (mention, quotation, attribution and hedging all score as non-adoption) means the 54.7% figure counts only reports whose own conclusion is wrong. Nothing in the artifact signals it, which is why the paper's prescription is continuous in-workflow verification rather than output review
• LLM-Assisted Grey-Literature Theory Building — the corpus-quality warning for any pipeline that compiles knowledge out of practitioner text, this vault included. The strongest persuasion cue measured here is genre, not provenance: paper-styled documents are adopted 23.5pp more often than forum posts, exceeding the 14.8pp high-to-low authority gap, and the generation protocol holds writing quality constant across authority tiers so the effect is the format itself. A theory-building pipeline that samples blogs, forums and preprints is weighting exactly the signal that turns out to be gameable, and an evidence:-tier discipline assigns trust by provenance — the weaker of the two cues
• LLM-Judge Validation — the contrast case for judge reliability. FCAR's judge reaches 99.7% agreement and κ = 0.993 against blinded, adjudicated human labels, far above what rubric-based deep-research grading achieves, because the question is a binary with an explicit decision rule ("does the report's own conclusion endorse this specific claim?") rather than a quality score
• Self-Propagating Prompt Injection (AI Worms) — the other way an agent corrupts the documents downstream of it, by an unrelated mechanism, and the pair is worth holding because it splits the remedy. MisKnow-Agent's documents forge nothing and instruct nothing; they persuade, and the agent's own synthesis carries the false conclusion forward (0% → 54.7%). Måløy's Copilot for Word worm (case-study, MSRC, 144-day coordination) contains nothing but instructions and copies itself into each output verbatim, so the carrier count grows. The consequence: provenance is the whole answer on one side and no answer at all on the other — recording source material and model-performed edits in document metadata (the disclosure's one structural recommendation) would expose a planted payload's trail, while a correctly-labelled misleading document is exactly what its provenance says it is and gets believed anyway. Both end at the same place — an organisation's informational base quietly degraded through normal workflows — and only one of them is a security bug
• Reasoning–Acting Interleaving (ReAct) — the harness shape nearly every system here runs on, defined: CS329A lecture 4 walks the 2022 ReAct paper that introduced it, including the failure-mode swap this page's MisKnow-Agent result is the other half of — grounding removes hallucination and installs dependence on what retrieval returns
• Retrieval Inside the Reasoning Chain — the ancestor of this form factor, taught in CS329A lecture 7 as the on-ramp to it. The three rungs (retrieve-once RAG, mid-chain agentic RAG with special tokens, then Search-o1's reason-in-documents compression) are the single-chain version of what this page's systems fan out into a tree; the dividing result there is that adding documents helps only once each one is compressed against the query first. Late-2025 and graded on short answers, so it touches none of the citation or report axes here

Open Questions#

• Does the orchestration advantage shrink as base models cross the next thresholds, or is open-ended retrieval/synthesis a durable harness asset (unlike, say, prompt scaffolding)?
• DRACO grades single-turn interactions only. How much of real deep-research value is in the multi-turn loop (clarifying questions, follow-ups) that the benchmark doesn't yet measure?
• Factual accuracy is the weak axis everywhere — is the fix better retrieval, better verification-in-the-loop, or a tool-grounded check the way Lean grounds proof search? Partially answered by Is Deep Research Reliable? Misleading Knowledge Induces False Conclusions (arXiv 2607.20891, empirical), which rules out one branch and measures a second. Not retrieval: misleading-evidence reach is already 72–98%, search-result rank moves FCAR by 1.7pp, and adding documents past the first buys nothing — retrieval is not the filter and making it better cannot be the lever. Verification-in-the-loop helps and does not suffice: pre-research verification prompting takes DeerFlow from a 60–76% baseline to 37–57%, a post-research refinement agent to 20–58%, the combination to 15–62% — and the combination is worse than either alone for Intern-S1-Pro, because the refinement step re-retrieves from the same poisoned pool. The tool-grounded branch is untouched and remains the open half: open-domain factual claims have no Lean, and the nearest thing measured here (a search-enabled verifier) is exactly what already gets these documents right in isolation and is never invoked in-workflow. So the live question narrows to where in the workflow verification must sit, not whether it helps.
• Does any context-pruning policy sit on the Pareto frontier of all three graded axes — rubric quality, citation recall, and ground-truth key-point coverage — against an unpruned run? Across 39 configurations in Not Worth Another Token: Marginal Value Estimation for Efficient Deep Research Agents none does: the best pruned KPR+KPC is 66.32 against 70.23, and the three arms that hold citation recall give up half their relevance. Either compression on this workload has an irreducible coverage cost, or nobody has yet built a pruner whose objective is coverage rather than relevance-minus-redundancy — the falsifiable form is a pruning rule scored directly against retained key-point recall, which none of the eight rules here is.
• The verification asymmetry is inferred, not isolated: the misleading corpus was selected for unanimous verifier agreement, and the standalone verifier's job (judge one document, with search tools and explicit search discipline) is strictly easier than the agent's (judge a document while executing a research task). Does an in-workflow verification step given the same tools, the same focused prompt, and its own budget close the gap — or does carrying a task degrade the check regardless of how it is prompted? The pre-research defense is the weak version of this experiment (it asks, but grants no separate step and no tools) and recovers roughly half the gap; the strong version has not been run.

Sources#

• CS329A Self-Improving AI Agents — Part 8: Agentic Evaluations and Long-Horizon Tasks — Aakanksha Chowdhery, Stanford CS329A lecture 8, delivered 2025-11-17, published 2026-08-03 (practitioner-opinion, YouTube auto-caption transcript). The DeepScholar-Bench section: the related-work-generation task, the monthly live refresh over post-cutoff arXiv papers across 22 domains, the three graded axes and their ~70–80% human validation, the sub-19% ceiling and sub-12.5% document importance, and the four failure modes (foundational papers missed, ~50% key-fact coverage from perfect sources, the synthesis-versus-verifiability tradeoff). Figures are ASR-read slide values and no paper is in the corpus; the system-level attributions (OpenAI deep research coherent but less verifiable; the reference pipeline near 90% citation precision) are the lecturer's summary
• Beyond RAG: Building Agentic Document Workflows with LlamaIndex — Pierre-Loic Doulcet, AI Engineer Singapore 2026 (practitioner-opinion, LlamaIndex vendor COI): the tree-not-loop placement, the four workflow properties, and the retrieval-as-audit-trail argument. Diagrams read via the image two-pass; the raw file contains deliberately corrupted parser output as demo material and no figure may be taken from it — see Document Parsing as the Retrieval Bottleneck
• DRACO: a Cross-Domain Benchmark for Deep Research Accuracy, Completeness, and Objectivity — §1 (definition of deep research), §5 (systems evaluated; orchestration-beyond-base-model finding; token/latency table; per-axis results)
• Is Deep Research Reliable? Misleading Knowledge Induces False Conclusions — Pengyu Zhu, Lijun Li, Longju Yang, Sen Su & Jing Shao (Beijing Univ. of Posts and Telecommunications / Shanghai AI Laboratory / Chongqing Univ. of Posts and Telecommunications), Is Deep Research Reliable? Misleading Knowledge Induces False Conclusions, arXiv 2607.20891, 2026-07-23, empirical. §3.2 (threat model — explicit exclusion of prompt injection and instruction hijacking), §3.3 (MisKnow-Agent: blueprint, controlled generation, cross-model verification filter), §3.4 + App. D–E (pre- and post-research defenses; the verification prompt and the refinement algorithm), §4.1 (systems, Serper backend, temperature 0, judge validation), §4.2 (search-result rank; lifecycle stage), §4.3 (authority and style effects), §4.4 (budget / dose response), §4.5 + App. G (framework-LLM interaction, MER/ECAR decomposition), §5.1 (Gemini Deep Research), §5.2 (defense effectiveness), App. B (judge-human agreement), App. C (manual validation of target false conclusions), App. I (all prompt templates — the generation prompt's equal-writing-quality-across-tiers constraint and the verifier's search-discipline instructions are both quoted from here).
• Tables verified. Table 3 (framework-LLM outcomes) was reconciled arithmetically as well as against the PDF page render: FCAR = MER × ECAR holds on all six rows to within 0.1pp, and both gap-decomposition terms reproduce the paper's stated values exactly on all three rows — which is strong evidence the label/value mapping survived parsing, since a collapse or shift would break the identity. Table 1 (generation-model comparison, qualitative) was checked against the PDF and parses clean. Table 2 is a single-column blueprint description carrying no comparative numbers. Every quoted percentage on this page comes from prose or from verified Table 3.
• Figures not read. FCAR-by-condition values for authority, style, rank, lifecycle stage, budget, the Gemini arm and the defense arms live in Figures 3–7 and are quoted here from the prose that reports them, per the quote-prose-not-tables habit. Per-configuration bar values not stated in prose are not cited.
• Not Worth Another Token: Marginal Value Estimation for Efficient Deep Research Agents — Kolukuluru, Ashok, Arora, Ciccarelli & Ashok Kumar (UMass Amherst), Nie (UT Austin), Dernoncourt, Basu, Rossi & Lipka (Adobe Research), Not Worth Another Token: Marginal Value Estimation for Efficient Deep Research Agents, arXiv 2608.08389, 2026-08-09, empirical. Cited here for §4 (the cost decomposition and the built-in late trim's 66.10 → 44.08 items), §6 (DeepResearchGym on GPT-Researcher, 100 of the 1,000 Researchy Questions, the four metric families, and Citation Recall's definition as the fraction of report claims grounded in a retrievable source), §7.1–7.3 (all stage results quoted from prose and from Tables 1–3, which were reconciled cell-for-cell against pdftotext -layout), §7.4 (the cross-stage findings), App. B.5 (the DeepResearch Bench arm that reproduces the efficiency ordering and not the quality one), App. B.6 + Table 4 (judge sensitivity), and Table 11's baseline row for the 94.41% result-processing share (row sums to 100.01). The all-configurations KPR+KPC ceiling, the accidental variance estimate, and the token/dollar asymmetry are derived at compile — full derivations, per-table verdicts, the three in-paper numeric inconsistencies and the Figure 3 axis check on Tool-Output Pruning
• An Actionable Diagnosis of Multilingual, Multi-Agent Planning Failures — Pahuja, Brokman, Hofman, Nizri, Vishna, Goldfarb-Tarrant, Marchisio, Kojima & Vainshtein (Fujitsu Research of Europe / Cohere / Fujitsu Research), An Actionable Diagnosis of Multilingual, Multi-Agent Planning Failures, arXiv 2608.03735, 2026-08-04, empirical. Cited here for §1 (the planning-grounding definition and the request-to-plan propagation argument), §3.2 (Open Deep Research as the derivation framework), §3.3 + App. B (the TART schema and its injection into planner, coordinator and workers), §5 (the four headline gains, all quoted from prose), §5.2 (the aggregate operation-grounding shares, reconciled against Table 10's own row and column sums), App. E.2 (the Level-3 plateau: Table 6's flat 55.2% taxonomy-covered share against Table 7's 13.00 reference steps and 3.38 tools), and §6 (the semantic-contract position). Parse notes: canary-recall did not run on this document (0 qualifying unique tokens — repetitive headline numbers), and captions alternate sides across its tables, so every figure quoted here comes from prose or from a table reconciled by internal arithmetic. Figure 4 is not cited because its bar order is not its label order, and Figure 1(b) is not cited because it averages eleven languages for one backbone against seven for the other two. Full treatment, the COI, and the exact-match-compliance and machine-translation limits on Automated Failure Attribution
• TRACE: Turn-level Reward Assignment via Credit Estimation for Long-Horizon Agents — TRACE: Turn-level Reward Assignment via Credit Estimation for Long-Horizon Agents, Tao, Peng, Yao, Ge, Cheng, Wang, Gao, Li (UW–Madison + Microsoft Research), arXiv 2607.13988, v1 2026-07-15, empirical. §4.1 (the deliberately minimal ReAct harness and three-tool browser interface; the four external agents as explicitly non-controlled reference points), §4.2 + Table 1 (all benchmark numbers quoted here — reconciled cell-for-cell against pdftotext -f 8 -layout at compile), §4.3 (trajectory-scale dynamics), §6 (the compact-answer scope limit that keeps this off the report branch), §A.3 (tool schema, stopping rules), §A.5 (per-turn credit traces — the search / open / find division of labour and the answer-secured-then-lost failure shape). Full treatment and all parse notes on Turn-Level Credit Assignment.