Post-training with internal feedback can improve a targeted knowledge-grounded behavior while silently degrading complementary abstraction and logical-consistency capabilities. We propose a conjunctive evaluation protocol that accepts a method only when a designated target improves and complementary probes remain non-inferior (with a stricter secondary criterion requiring complementary equivalence), while also reporting retention and predictive drift. We instantiate the protocol in DION-Bench, combining two lexical/ontological probes (same-category exceptions; abstraction recovery) with a synthetic SAT-checked logical-consistency probe. On Qwen3-8B-Base, a task-specific self-judged DPO adaptation improves OntoNeg-WN by 5.27 percentage points but reduces ConceptShift by 37.50 points—despite humans reaching 82.7% and frontier LLMs 44–73% on OntoNeg—whereas mean change across five external accuracy suites is only −1.70 points. A development-tuned decoding rule partially mitigates ConceptShift regression to 12.93/14.60 points on the original/holdout splits while retaining most of the target gain. These results show that faithful post-training claims require joint reporting of gain, complementary abstraction regression, retention, drift, and equivalence—not proof that a single shared knowledge item degraded.

Multi-turn scheduling assistants must preserve constraint edits and distinguish solver evidence from language-model interpretations. We present CoSched-Cert, a dialogue protocol combining a typed scheduling language, solver-distinguishing clarification, cost-based conflict localization, verified repair synthesis, and lexical certificate auditing. Its guarantees are conditional on the encoded problem and supplied candidate interpretations; lexical support does not establish semantic entailment. SchedNL-Bench-Cert contains 1,000 synthetic Chinese/English utterances and 350 sessions. Gold-AST replay measures internal consistency against labels generated by the same engine, while author-written protocol simulations illustrate selected design choices. Across three live-parser seeds on 52 sessions, session training and registered sibling augmentation raise conditional micro target-constraint agreement from 18.0% to 83.7%. The final configuration has 100% coarse status agreement but only 75.0% conflict-member agreement, and includes a rule informed by a test-session failure. We therefore treat these results as descriptive, not as an unbiased generalization estimate. We define a stricter joint-turn criterion and report the bounds supported by the available aggregates. The contribution is a protocol for exposing inspectable solver evidence and the remaining gap between encoded feasibility and user-intent correctness.

Retrieval-augmented generation treats citation as a default proxy for reliability, yet a cited passage can support a claim and still be obsolete, superseded, contradicted, or invalid at the user’s target time. We name this failure a citation-supported lifecycle error and define lifecycle faithfulness: a claim-level criterion that requires semantic support, target-time validity, non-supersession, and provenance. We release Vera-Life-Eval, an 8,500-question benchmark with 41,203 versioned evidence pieces across six lifecycle settings (current, past, stale-only, update, conflict, and multi-hop), and Vera-Life, a low-training modular controller that builds an evidence-state graph, selects claim-evidence-time contracts, and chooses among answer, warn_stale, explain_conflict, retrieve_more, and abstain, emitting a claim-level lifecycle ledger. On a shared Qwen3-8B generator, Vera-Life raises LifeEM from .374 (best prompt-only baseline) to .623, and remains effective under timestamp-only (.584) and text-only (.504) regimes. Same-action controls, metadata isolation, and source-disjoint transfer across product, policy, scientific, and news evidence show that the gains are not an artefact of output format or Wikipedia revision cues. The next mission for RAG is not merely to cite evidence, but to know whether that evidence is still alive.

Long-form video question answering hinges on locating brief, sparse evidence buried in minutes of dense action. Flattening the entire video into a single caption stream forces the LLM to sift through thousands of tokens, where decisive cues are easily drowned out by surrounding context. We present MSTree, a training-free framework that organizes captions into a Multi-Scale Evidence Tree. The tree is built by a coordinated dual-modal segmentation method that combines visual scene transitions and textual coherence under temporal contiguity, producing segments that are both visually and semantically consistent. Inference follows a mine-then-reason workflow: the LLM first scans coarse segment summaries to locate the most relevant event, then reasons over its fine-grained captions. When the first-round prediction falls below a confidence threshold, Contrastive Targeted Reflection (CTR) activates. The model articulates a discriminative gap that specifies what evidence is still missing to separate the top candidate answers, and an answer-anchoring constraint requires any newly retrieved evidence to both support the revised prediction and contradict the original. On EgoSchema, NExT-QA, and Video-MME, MSTree reaches 68.4%, 77.5%, and 55.7% accuracy, outperforming all training-free baselines.

Existing indirect prompt injection (IPI) attacks commonly face a stealth-effectiveness tradeoff: features that make payloads effective can also make them detectable because attack intent is localized in a single payload. LogicInception moves IPI to discourse-level inference: attack logic is decomposed into register-matched declarative fragments distributed across tool outputs and linked by fabricated causal dependencies that the agent reconstructs through reasoning. To our knowledge, it is the first IPI framework to demonstrate successful unauthorized tool execution with no directive instruction anywhere in the injected content. No fragment contains a command or exploits instruction-following; the attack emerges from the agent’s own inference. We observe an empirical capability-safety amplification pattern: discourse-level amplification correlates with task capability across the evaluated models. On 1,139 scenarios with 5 defenses, LogicInception achieves 42.9-48.8% ASR at 88% per-fragment stealth, while all baselines remain below 8% composite success. The three prompt-level defenses reduce baseline ASR by up to 72% but reduce LogicInception by less than 7%; we trace this asymmetry to three architectural factors that motivate discourse-level rather than content-level countermeasures. This defense asymmetry is larger for higher-utility models in our evaluation, suggesting a tension between reasoning capability and safety.