With the rapid development of Large Language Models (LLMs), research related to LLM-based persuasion has become a hotspot in the field. However, existing studies mostly focus on enhancing LLM agents’ persuasive capabilities, while generally neglecting the issue of their vulnerability to persuasion. In this paper, we analyse the root causes of LLM agents’ vulnerability to persuasion and find that it mainly stems from two contradictions and limitations. First, the purpose of catering to human preferences in pre-training phase conflicts with the need to resist manipulation in persuasion scenarios. Second, LLMs are often restricted to play a helpful assistant during training, and the singularity of this personality setting makes it unusually easy to develop targeted persuasion techniques for them. To eliminate LLMs’ vulnerability to persuasion, we propose the Backfire-R1 framework, which helps LLMs build persuasion resistance and better align with user objective by enabling them to learn the reasoning logic of humans with different personalities in persuasion scenarios. Comprehensive experimental results show that, the proposed method significantly improves the persuasion robustness of LLM agents, reducing the opinion shift score by 62.36% while not impairing the model’s general capabilities. Code is now available at: https://github.com/super-jw/Backfire-R1.

Agentic workflows, composed of multiple collaborating Large Language Models (LLMs), have become a key paradigm for complex problem-solving. However, their effectiveness is often hindered by three critical challenges: high manual design costs, inefficient agentic search, and poor dynamic adaptability to new tasks and human preferences. To address these limitations, we propose HFlow, an evolutionary framework for generating agentic workflows through human-agent collaboration. HFlow employs an evolutionary algorithm to automate the search for optimal workflows by mutating and crossing over their structures, prompts, and LLM backbones. This process is guided by human preferences to ensure rapid convergence, while a hierarchical experience memory enables the generalization of learned strategies. Extensive experiments on math and code generation benchmarks show HFlow surpasses other automated baselines by up to 27.34%, while achieving comparable performance to o1-preview at only one-fourth of the cost. Our work introduces a new paradigm for workflow design that produces cost-effective and adaptive solutions, better aligning automated agentic systems with dynamic human needs.

Reusable skills are becoming a common interface for extending large language model agents, packaging procedural guidance with access to files, tools, memory, and execution environments. However, this modularity introduces attack surfaces that are largely missed by existing safety evaluations: even when the user request is benign, unsafe influence may reside in skill guidance, local artifacts, or execution-environment files that steer the agent toward unsafe actions. We present **SkillSafetyBench**, a runnable benchmark for evaluating such skill-mediated safety failures. SkillSafetyBench includes 155 adversarial cases across 47 tasks, 6 risk domains, and 30 safety categories, each evaluated with a case-specific rule-based verifier. Experiments with multiple CLI agents and model backends show that non-user attacks can consistently induce unsafe behavior, with distinct failure patterns across domains, attack methods, and scaffold–model pairings. Our findings suggest that agent safety depends not only on model-level alignment, but also on how agents interpret skills, trust workflow context, and act through executable environments. We release the data and code in an anonymous repository to support reproducibility. The complete benchmark is available at https://github.com/AI45Lab/skill-safety-bench.

Retrieval-Augmented Generation (RAG) enhanced by Knowledge Graphs has shown promise in complex multi-hop reasoning tasks. However, existing graph-based retrieval methods typically rely on flat, undirected topologies. During the retrieval process, the probability flow often gets trapped in high-degree abstract concept nodes which we define as “probability black holes”, leading to semantic drift and noise accumulation. To address this, we propose SemFlowRAG, a framework that reconstructs the flat retrieval space into a corpus-adaptive semantic gradient graph. This data-driven self-organization enables a hierarchical structure to emerge naturally from the data distribution, capturing the intrinsic semantic granularity of the corpus to suppress structural noise. By quantifying the semantic abstractness of entities through the embedding variance of their associated passages, we transform static undirected edges into directed semantic constraints. Furthermore, we design an abstractness-guided directed PageRank algorithm that forces the retrieval trajectory to follow a “high-to-low semantic abstractness” gradient. This mechanism ensures layer-by-layer evidence convergence, smoothly guiding the retrieval process from abstract concepts to specific document evidence. Extensive experiments on complex QA datasets demonstrate that SemFlowRAG effectively mitigates the “probability black holes” issue, outperforming existing baselines in both retrieval and downstream reasoning performance.

Distributed agents need to exchange textual evidence across organizational boundaries, but these exchanges can expose two types of private information. One is carried by explicit identifiers. The other appears as source signatures spread across formatting, vocabulary, and syntax. Existing PII detection and masking methods mainly handle localized identifiers, leaving these broader source signals largely intact. Even masking 19.2% of tokens reduces TF-IDF stylometric attribution by only 18.6%. To address this problem, we propose *DiSan*, which treats text sanitization as a representation learning problem. A two-stream encoder maps text into orthogonal role and style subspaces. The role subspace captures task semantics shared across sources, while the local style subspace captures variation associated with source identity. The style representation is never transmitted directly. Prototype alignment supports joint training without centralizing raw text, while adversarial regularization limits source leakage in shared representations and prototypes. We test leakage in sanitized text, learned representations, and uploaded prototypes. On a distributed multi-agent RAG benchmark, *DiSan* reduces PII exposure in answers by 20× while preserving 83% answer faithfulness. On Enron emails, it reduces TF-IDF stylometric attribution by 73.2%, compared with 18.6% for the strongest masking baseline. Embedding and prototype attribution are also close to random. Together, these results show that *DiSan* reduces explicit and distributional leakage while retaining task utility.

Federated Learning (FL) enables privacy-preserving collaborative instruction tuning of large language models (LLMs) by leveraging massively distributed data. However, the decentralized nature of FL exacerbates data quality challenges, as local clients lack global visibility to filter noisy or low-quality samples before training. To resolve this issue, we propose FedDQC, a novel federated instruction tuning framework with dynamic data quality control. Our approach introduces two key innovations. First, we propose instruction-response alignment (IRA)—an efficient client-side metric for quality evaluation requiring only low-cost inference. We validate that higher-IRA data corresponds to more relevant and easier-to-learn question-answer pairs. Second, mirroring the human easy-to-hard knowledge acquisition process, we design a quality-aware hierarchical FL training framework, where the LLM is progressively fine-tuned from high- to low-IRA data in a collaborative manner. The framework also supports adaptive data quality assessment at each hierarchy, enabling dynamic adjustments throughout the training process. Extensive experiments on synthetic and real-world datasets show that our method significantly improves LLM performance on mixed-quality data in FL.