https://arxiv.org/api/WoJox1Y+ocPdFJKuacNuVK47Ov0 2026-09-10T17:24:35Z 1464 15 15 http://arxiv.org/abs/2609.00275v1 2026-08-31T19:18:09Z

Fleets of LLM agents now externalize effects that cannot be fully undone: they move money, deploy code, delete data, and disclose information. Current controls check one effect at a time, so a fleet of individually authorized agents can overdraw its principal's risk under a shared trigger while every local gate stays correct. We propose the irreversibility budget, a cumulative account of residual value-at-risk that a trusted runtime maintains for each principal across agents, workflows, and tenants. Treating irreversibility as a first-class resource, the runtime charges each effect its residual loss below the agent and denies the marginal effect once the aggregate would overdraw the budget. Getting the price right is hard, because effects are heterogeneous, adversarially declared, and correlated. We perform a controlled study in which per-effect gates admit fleet-level overdraws of up to 48 times the tenant's risk limit while the budget holds every correctly charged run within that limit. Conservative, dependency-aware pricing remains the central open problem for a deployable design.

2026-08-31T19:18:09Z Accepted at 2nd AgenticOS Workshop @ SOSP Bardia Mohammadi Laurent Bindschaedler http://arxiv.org/abs/2608.30830v1 2026-08-31T14:05:52Z

Unlike the seconds-scale tool-call pauses targeted by prior agent-serving systems, agentic LLM requests can be suspended for minutes or hours while waiting for human approval. We study how suspension and resumption affect GPU serving performance and develop a retention policy that balances active-serving capacity against future recomputation under uncertain approval waits. The central tension is severe because retaining suspended KV preserves fast resume but can consume enough GPU capacity to reduce active-serving goodput by 41%, while evicting it avoids that residency cost at the expense of nearly $10\times$ higher resume latency when the request returns. We develop a tiered retention controller around GPU opportunity cost, which expresses the serving capacity consumed by preserving or reconstructing a suspended request's KV state in a common GPU-time cost. Within host memory, the controller selects between indefinite retention and load-indexed expiration using calibration wait samples, without requiring per-request wait prediction. On human-scale approval workloads, our controller improves active-request goodput by 23-51% over the vLLM baselines, 22-29% over MORI, and 41-52% over Continuum.

2026-08-31T14:05:52Z Minseo Choi Ananya Joshi http://arxiv.org/abs/2608.12114v2 2026-08-30T05:39:15Z

Open-weight models can occupy a middle capacity regime: active weights fit in DRAM as cached file pages, but a second framework-owned copy does not fit or must be refilled as layers run, so low-batch decode rereads the weights every token. On integrated and coherent-memory systems those file pages are already GPU-readable, yet ordinary loading paths copy them into framework allocations before use. We call this copy the ingestion tax. We present file-backed weight adoption: a framework-independent producer maps each tensor with MAP_SHARED, wraps the pages as a no-copy GPU buffer, and exports a DLPack capsule that PyTorch or MLX imports as ordinary storage. Zero-copy import alone is insufficient: the implementation must also keep activations accelerator-resident and establish ordering on the GPU; an adopter that omits both runs a dense decode stage 2.3x slower than stock in the live system. With both in place, adoption removes the tax: the public route reaches 516 GB/s versus 53-82 for the default constructors, matches the identical kernel over resident storage ([-0.66%, +0.48%], paired), and is within 1.3% of a resident control on a matched Qwen2.5-72B (7.14 vs. 7.23 tok/s). At the same throughput, the weights remain clean, shared, evictable file pages: N processes decode from one mapped copy where resident loading creates N copies (at capacity, 5.5 vs. 0.08 tok/s), and a 65 GB checkpoint cuts time to first token by 6.4x versus stock loading. In Kimi K3, a 2.8T-parameter MoE, the dense int8 spine stage falls from 2.62 to 0.35 s per token (7.5x; 3.8x from storage alone). The same mechanism improves llama.cpp by 1.21x at half the footprint on an AMD APU, falls inside the 5% selection band of overlapped streaming on a capacity-exceeding GH200 workload, and is 39x slower across PCIe. The deployment rule follows memory topology: adopt file pages only where the GPU can already read them.

2026-08-12T14:35:21Z Yuan Si Yufeng Lin Daming Li Jialu Zhang http://arxiv.org/abs/2608.12103v2 2026-08-30T05:28:09Z

Mixture-of-experts models whose expert pools exceed DRAM capacity require a weight-residency tier. Existing systems manage it in user space with expert-granular placement, frequency-based admission, and explicit pinning. We evaluate whether the operating system page cache can instead serve as the expert tier, using router traces from three MoE models with 128 to 896 experts per layer; the trillion-parameter production model's traces are replayed natively against its full 1.45 TB expert pool on GH200 hardware. Capacity is enforced by three independent mechanisms. Iteration time varies smoothly with cache size (run-to-run spread <=4%), and device traffic follows the same trend. Under severe pressure the outcome depends on reclaim: device traffic rises above miss demand only when MGLRU, the tested kernels' default, is combined with balloon-style, mostly mlocked memory, a result reproduced on two machines; cgroup limits and mem= boots show no such behavior, so balloon-based studies can overstate low-capacity device traffic by about 2x. At equal enforced memory, kernel recency serves essentially the same demand as an oracle static-frequency policy computed from the replay trace. In the pread-based replay the oracle-pinned arena stays 1.09-1.11x faster, a gap that is the cost of the page-cache hit and reclaim path, but its static table degrades under domain shift while recency remains stable. At 64.7% measured recall, router lookahead changes median time by 0.3% when delivered as kernel readahead advice; perfect one-layer advice gains 5.0% through the same interface and nothing through blocking reads. End-to-end at ample capacity, enabling page-cache admission speeds steady decode by 1.09-1.10x in a production CUDA engine with token-identical outputs. These measurements favor kernel-managed eviction, with model knowledge applied to admission and predictive advice.

2026-08-12T14:24:09Z Yuan Si Yufeng Lin Daming Li Jialu Zhang http://arxiv.org/abs/2607.28835v2 2026-08-29T22:22:50Z

C underpins operating systems, embedded platforms, and network infrastructure as its abstractions map directly to machine behaviour. Its explicit memory model, predictable data representations, and minimal runtime allow compilers to generate fast, deterministic code. These properties also leave correctness and memory safety entirely to the programmer, making undefined behaviour, pointer misuse, and lifetime errors persistent sources of defects and security vulnerabilities in long-lived C codebases. Rust eliminates most failure modes through a static ownership and borrowing model that enforces memory safety and aliasing constraints at compile time. However, mature C systems cannot be translated directly: implicit layout assumptions, aliasing patterns, and undefined behaviour must be reconstructed before safe Rust can be produced. This paper presents a migration methodology that first generates a semantics-preserving, non-idiomatic Rust baseline and then incrementally rewrites it into idiomatic Rust using agentic AI, validating each step through compilation and behavioural testing. Applied to iodine, a real-world DNS tunnel, the approach demonstrates that reliable C-to-Rust migration is a structured transformation workflow rather than a single translation step.

2026-07-30T21:00:27Z Vasily A. Sartakov http://arxiv.org/abs/2608.28165v1 2026-08-28T10:28:54Z

AI agents are evolving into long-running computational entities that can invoke tools, maintain memory, and complete complex tasks across applications. In real-world settings, completing a task often requires humans and AI to take turns leading its execution. Such alternation depends on the seamless handoff of the work state of the task between humans and AI. Existing agent systems, however, provide humans and AI with separate work environments. AI agents must therefore rely on additional bridges to continue work: either developers build task-specific interfaces to access the work state, or users manually transfer relevant parts of it through screenshots or textual descriptions. Both approaches make handoffs costly and scale poorly. We propose Human-AI Co-inhabitation, a type of work environment that enables humans and AI to seamlessly take turns continuing work on the same task, and design and implement CrabOS to realize this concept. CrabOS represents the work state as natural-language-readable text objects shared by humans and AI, allowing both to access and manipulate it directly through the same auditable interface without bridges. Case studies show that CrabOS elevates support for complex tasks with alternating human and AI leadership from bridge-dependent application-level solutions to native operating-system capabilities, which provide a new foundation for developing and running AI agents.

2026-08-28T10:28:54Z Qi Yang Yun Ma http://arxiv.org/abs/2608.26021v1 2026-08-26T17:01:31Z

Datacenters consume many megawatts of power, and regularly encounter scenarios that require modulating their power draw. These scenarios include datacenter infrastructure failures, power grid failures, grid services, and more, spanning a diverse range of requirements in terms of the power magnitude, the scope of the reduction, the notice time, and other dimensions. To address these scenarios, we have built Slasher, a general system for modulating the power of \azure datacenters to handle scenarios ranging from individual racks to regional multi-datacenter grid events. Slasher coordinates datacenter resources with the goal of meeting power targets while minimizing negative impact on hosted workloads. In this paper, we review the main power modulation scenarios, characterize the power reduction levers using data from production cloud datacenters, describe Slasher's system architecture, and formulate the cloud datacenter power modulation control problem. We also develop a high-fidelity datacenter simulator and propose a workload impact model, using them to design and evaluate power control algorithms.

2026-08-26T17:01:31Z 18 pages, 15 figures Liuzixuan Lin Fiodar Kazhamiaka Alok Gautam Kumbhare Chaojie Zhang Jaylen Wang Hassan Khan Rodrigo L. Assis Mariana Rodrigues Kyle Woolcock Nithish Mahalingam Brijesh Warrier Rodrigo Fonseca Ricardo Bianchini http://arxiv.org/abs/2608.25185v1 2026-08-25T21:58:33Z

Modern database services scalably search over large data collections via Approximate Nearest Neighbor Search, which improves search performance at the cost of search quality, measured by recall. In practice, a database operator seeks to achieve a target mean recall while maximizing throughput across search queries. We show that optimizing for mean recall masks significant differences in recall across queries even when target recall is met. As a result, numerous queries face (1) below-target recall, hurting user experience and revenue and (2) above-target recall, wasting computation to deliver unnecessarily high search quality. Thus, it is critical to detect and reduce recall differences across queries. We design RCheck, a light-weight run-time system that identifies low-recall queries and reduces recall differences while achieving high throughput. RCheck's key design principle is to dynamically, efficiently adapt search effort by increasing effort for queries below target recall and decreasing effort for those above it. RCheck tunes available search effort parameters, making it readily deployable. We evaluate RCheck using the widely-used production-style pgvector database. At the same throughput, RCheck improves mean recall by 11-93% and enables 8-47% more queries to meet target recall compared to the state-of-the-art globally-tuned configuration.

2026-08-25T21:58:33Z Sara Mahdizadeh Shahri Martin Prammer Jignesh M. Patel Akshitha Sriraman http://arxiv.org/abs/2604.02442v2 2026-08-25T01:47:39Z

Static offload to computational storage devices proves brittle because device-side processors throttle under sustained thermal load, while opaque, vendor-specific interfaces inflate adoption costs so severely that no computational storage platform has achieved broad deployment; to address this, we argue that storage-side compute should be reversible, allowing individual pipeline stages to migrate between host and device at runtime beneath standard interfaces that require zero application modification. We present ReFlux, which realizes this principle on CXL SSDs by decomposing I/O-path logic into migratable storage actors compiled to WebAssembly, with actors sharing state through coherent CXL.mem regions so that only lightweight control state, roughly 8 KB, moves during migration, while a thermal-aware scheduler triggers per-stage drain-and-switch when device temperature or queue pressure rises, offloading compute-intensive actors to the host while leaving I/O-bound stages on the device. In our evaluation on an FPGA-based CXL SSD prototype and two production CSDs, ReFlux sustains over twice the throughput of thermally throttled CSDs under 30-minute sustained writes, delivers three to four times the inference throughput under KV-cache pressure, and reduces host CPU utilization by 65% through MWAIT-based notification.

2026-04-02T18:14:28Z Yanpeng Hu Yiwei Yang Yusheng Zheng Estabon Ramos Jianchang Su Andi Quinn Wei Zhang http://arxiv.org/abs/2608.23365v1 2026-08-24T15:14:18Z

Solid-state drives (SSDs) are built on NAND flash memory and expose it to the operating system through a block-based storage interface. As NAND flash has special read/write constraints due to its hardware nature, a translation between OS-level I/Os and raw flash memory I/Os is needed. This results in a flash translation layer (FTL) that creates a ``trusted computing base'' due to its physical isolation from the OS. Building on this trusted computing base, some security designs (e.g., data recovery from malware attacks) can ensure strong data security properties even if the OS is compromised. However, they mostly require modifying the FTL's firmware code, which is hard in practice because the traditional block-based FTL does not provide an interface to modify its internal functions. New flash storage interface designs, such as open-channel SSDs or zoned namespaces, have moved key FTL functions into the OS. These interfaces ease modification of FTL functions, at the cost of blurring the trusted boundary, as the FTL is no longer isolated from the OS. In this work, we have introduced SxSSD, a secure yet extensible software-defined SSD design. By decoupling internal policy definitions from primitive FTL mechanisms, we allow trusted applications to dynamically and securely define FTL policies and the exposed storage interface (achieving increased flexibility compared to open-channel and zoned namespaces SSDs). Most significantly, SxSSD retains the isolation of traditional FTL execution (achieving security similar to traditional block-based SSDs). We have identified and addressed key security challenges introduced under a compromised OS. In addition, we have implemented a prototype of SxSSD and evaluated its overhead with different FTL policies and storage interfaces. Experimental evaluation demonstrates that the overhead incurred by SxSSD is small compared to native FTL implementations.

2026-08-24T15:14:18Z Josh Dafoe Bo Chen http://arxiv.org/abs/2608.23228v1 2026-08-24T13:20:03Z

Linking is a critical step in the software build process that combines compiled object files into a single executable or shared library. Despite decades of engineering effort, link times remain a significant bottleneck in the edit-compile-debug cycle, particularly for large C++ programs. Existing linkers exploit limited parallelism, leaving most CPU cores idle during linking. We present mold, a Unix/Linux linker that applies data parallelism systematically across the entire linking pipeline. We first analyze the architectural constraints that prevent existing linkers from scaling, including entangled symbol resolution and archive processing, and then show how a clean-slate design that decouples them overcomes these limitations. On large real-world programs, mold links multi-gigabyte debug binaries in at most a few seconds, and often in under a second. It is 2.4-16.1x faster than the state-of-the-art lld linker, and up to 112x faster than the traditional GNU ld. An ablation study shows that no single optimization dominates; the speedup comes from the cumulative effect of parallelizing all passes.

2026-08-24T13:20:03Z 15 pages, 3 figures, 10 tables. Accepted to ASPLOS 2027 Rui Ueyama http://arxiv.org/abs/2608.11234v2 2026-08-24T03:46:17Z

Managing modern computing infrastructure has become a steadily harder problem due to the ever-increasing complexity. Recent advances in AI agents create a timely opportunity to automate infrastructure management tasks, but it remains unclear how well such agents can handle real-world infrastructure complexity. We present InfraBench, a benchmark suite for evaluating AI agents on realistic infrastructure tasks across the full system stack and full operational lifecycle with fine-grained risk assessment. Experiments with 15 agent-model configurations show that even the strongest agent cannot secure a full score across all tasks. Mean effective scores range from roughly 40% to 88% (with per-configuration standard errors of 6-12 points), repeating every task three times reveals that top configurations still pass only a fraction of their attempts, and per-check scoring exposes a general failure pattern: agents may routinely satisfy short-term objectives while leaving non-durable changes, broken distributed invariants, unsafe side effects, and uncleaned state behind. INFRABENCH, including its live leaderboard, tasks, and evaluation harness, is publicly available at infraben.ch.

2026-07-31T03:53:11Z 17 pages, 6 figures. Preprint Yuan Gao Wanxiang Zeren Yang Wanxiang Junnan Li Wanxiang Shawn Wanxiang Zhong Ahmed Dajani Mai Zheng Andrea Arpaci-Dusseau Remzi Arpaci-Dusseau http://arxiv.org/abs/2608.17529v1 2026-08-18T08:50:49Z

We present CryptDough, a unified analytics engine for secure multiparty computation (MPC). CryptDough enables multiple distrusting parties to jointly execute a data analysis pipeline on their private inputs and learn nothing beyond the result (e.g., aggregate statistics). Unlike existing MPC solutions that support a single threat model or workload type, CryptDough provides built-in support for cross-domain analytics (relational, time series, ML inference) under various threat models, all within the same system runtime. CryptDough contributes (i) a hierarchical system design that facilitates modularity and extensibility through progressive lowering of abstractions, and (ii) the concept of virtual vectors that enable users to write single-threaded code across all layers of the software stack, while pushing the complexity of communication, parallelization, and memory management down to the execution engine. We show that CryptDough generalizes the functionality of state-of-the-art MPC systems and remains competitive on the analytics they support, often outperforming them by more than $2\times$.

2026-08-18T08:50:49Z Muhammad Faisal Boston University Alessandra Lanz Boston University Sam Buxbaum Boston University Adam Godel Boston University Vasiliki Kalavri Boston University Mayank Varia Boston University John Liagouris Boston University http://arxiv.org/abs/2606.03895v3 2026-08-18T06:50:39Z

Large language model (LLM) agents can persist across tasks, acquire memory, activate Skills, synthesize tools, fork child processes, attach remote resources, and commit checkpoints as reusable images. These mechanisms expand the action surface after deployment and create authority-escalation and data-exfiltration risks when visibility is mistaken for permission. We present Agent libOS, an agent-native library OS substrate that separates three planes. Operation admission combines process identity, Task Authority ceilings, typed Capabilities, policy or Human approval, budgets, and concrete primitives. Information-flow admission propagates labels and immutable source references, resolves Host-registered Sinks, and requires an exact one-shot Human release for conditional high-sensitivity egress. Durable causal evidence records intent, outcomes, accounting, and causal links but never grants authority. Thus, the model-visible action surface may evolve without implicitly expanding resource authority or permitted information flows. The implementation provides persistent processes, Object Memory, Skills, syscall-mediated JIT Tools, images and checkpoints, typed providers, Human queues, budgets, and durable recovery. Provider-backed effects use a prepare-dispatch-settle protocol that exposes ambiguity and prevents blind replay. In source-bound evaluation, 33/33 deterministic full-runtime tasks pass both task and safety oracles. Across 12 canonical real-model runs, observed safety and strict utility are 12/12. In a paired 30-run Skill projection study, the observable-state oracle passes in all runs, with 13/15 fully correct runs in each arm. These results describe the evaluated model/provider configuration. Agent libOS does not prevent prompt injection, provide kernel-grade sandboxing, or roll back irreversible external effects.

2026-06-02T16:53:24Z 20 pages, 3 figures, 7 tables. Project page: https://github.com/yingqi-z20/Agent-libOS Yingqi Zhang http://arxiv.org/abs/2608.16188v1 2026-08-17T07:09:47Z

The rise of vehicle-infrastructure (V2I) collaboration enables safer and broader perception. To process large-scale V2I video streams, vision-language models (VLMs) are promising as they unify multi-view vision into end-to-end task grounding, reducing handcrafted design. We use Vision Mixture-of-Experts (V-MoE) as the distributed visual backbone of VLMs, leveraging sparse expert routing to enable conditional computation across diverse viewpoints under resource constraints. Yet, V-MoEs face a critical challenge: large-scale data shifts over minutes to hours in V2I systems, amplified by agnostic participants and biased features propagating through experts. To maintain accuracy efficiently, we find it beneficial to co-adapt multiple V-MoEs on edge servers, avoiding the latency and privacy risks of cloud offloading and the accuracy sacrifices of on-device methods. However, the resource-constrained edge poses challenges for efficient co-adaptation: i) DRAM fragmentation and imbalance limit expert parallelism, ii) memory-I/O bottlenecks restrict computation reuse, and iii) asynchronous adaptation increases task-switch overhead. Also, prior work rarely explores the upper bound of concurrent tasks under limited edge resources, a critical factor for practical V2I deployment. To address these, we present AdaSprite. By combining cooperative elastic scaling with multi-level multiplexing, AdaSprite optimizes expert lifespans to reduce DRAM fragmentation, exploits predictable activation patterns for efficient I/O reuse, and employs twin-buffer scheduling to leverage sparsity. On a weak edge, AdaSprite supports up to 17 concurrent V2I tasks (vs. up to 6 for baselines), improving SLO attainment by 1.6x and throughput by 2.1x. Also, it allows users to trade accuracy and concurrency for second-level adaptation.

2026-08-17T07:09:47Z MobiSys 2026 Lehao Wang Zhiwen Yu Sicong Liu Kefan Chen Fengmin Wu Bin Guo