The Benchmark That Keeps Finding New Failures

TL;DR for operators

A model can save inference memory yet lose the information needed to answer correctly. In a constructed ledger-retrieval test, the latest record appears midway through a long context, with competing outdated records later. Uncompressed inference achieves 0.93 accuracy; FastKVZip compression achieves only 0.35. Established benchmarks may not expose such application-specific failures.¹

Finding one failure is not enough: an algorithm revised to handle it may still fail on the next adversarial case. Generative Adversarial Loops (GAL) addresses this by alternating automated failure discovery with algorithm modification, preserving discovered cases as an expanding test suite. Across two completed improvement experiments, mean accuracy on constructed adversarial benchmarks rises from 0.35 to 0.975 for Compactor and from 0.20 to 0.90 for Dual Chunk Attention. Established benchmark improvements are smaller, and some individual metrics regress.

For operators, the opportunity is to make adversarial discovery part of inference release testing: verify failures against uncompressed inference, retain them as regression tests, and require revisions to preserve established and deployment-relevant performance. The experiments demonstrate improvement in specific configurations, not general robustness. The proposed cost of finding failures measures difficulty under a particular search procedure, not proof that undiscovered failures are absent.

When the correct record is present but the answer is wrong

Consider an organization using an AI system to answer questions from lengthy transaction records. The latest ledger entry appears midway through the material, while older entries appear closer to the end. A correct response requires identifying the current record rather than selecting a later, outdated one.

To reduce inference memory requirements, the organization adopts a method that retains only selected information from the original context. This lowers the amount of information the system must maintain, but creates a risk: information needed for a later question may be discarded.

In a constructed ledger-retrieval experiment reported in Generative Adversarial Loops, uncompressed inference achieves 0.93 accuracy, while inference using the FastKVZip compression method achieves only 0.35.¹ The input deliberately places fresh information in the middle and competing stale records later.

The 58-percentage-point gap does not establish how often such failures occur in production. It shows that an interpretable, valid input pattern can expose a substantial approximation-specific weakness.

For an operator deciding whether to adopt compression, the missing evidence is not simply another average benchmark score. It is whether the optimization preserves the information required by the application’s actual retrieval tasks.

Automated testing becomes part of algorithm development

KV-cache compression reduces memory usage by retaining a smaller representation of the keys and values used during attention. Other efficient-inference methods reduce attention computation or extend context lengths without retraining the underlying model.

These techniques change how information is retained, accessed, or represented. Established benchmarks measure performance on predefined inputs, but cannot necessarily reveal every relevant interaction between an optimization and its input structure.

The researchers investigate this problem across four domains:

These are adversarial failure-discovery demonstrations, not four completed algorithm-improvement studies. The PQCache failure pattern, for example, reportedly stops being effective at sparsity settings of approximately 5% or greater. Its scope depends on the tested configuration.

Discovering failures requires a credible evaluation reference. For approximate inference, the paper imposes two requirements: the unapproximated model must perform sufficiently well, and the approximation must perform sufficiently worse.

This distinction prevents an algorithm from being penalized for an input that also defeats the underlying model. It does not make the unapproximated model an infallible source of truth.

The researchers implement adversarial discovery through program-generating agents and evolutionary search. Long-context inputs can be constructed from explicit rules, making failures more interpretable than arbitrary sequences optimized solely to reduce a score. The GEPA-based search process uses evaluator feedback and reflective mutations to develop more effective candidates.

GAL makes discovered failures drive the next revision

Conventional automated algorithm discovery can search for better implementations against a fixed evaluation suite. GAL adds an adaptive counterpart: a discriminator searches for failures, while a generator searches for improved algorithms.

The interaction follows a cumulative process:

1. Discover: The discriminator identifies a valid input that exposes a weakness in the current algorithm.
2. Preserve: The input becomes part of an expanded adversarial benchmark.
3. Improve: A coding agent modifies the algorithm to perform better on the accumulated tests.
4. Verify and repeat: Established regression benchmarks are checked, and the discriminator searches for another unresolved weakness.

The generator is not merely optimizing a parameter against a static score. Each new failure changes the requirements imposed on subsequent algorithm revisions.

The Compactor experiment illustrates why repeated discovery matters. After the first algorithm-improvement iteration, Gen-1 achieves 0.85 accuracy on adversarial benchmark B1 but only 0.25 on B2. A revision that handles the original failure has not necessarily addressed the next one.

The authors use coding-agent evolution, including Cursor and Claude-based components, to modify algorithms while periodically testing established benchmarks. In the idealized formulation, repeated benchmark expansion could eventually cover every valid input, but that convergence argument assumes failures can always be found and suitable algorithms can always be constructed. The experiments demonstrate finite improvement cycles, not convergence.

Large adversarial gains accompany smaller benchmark changes

The main improvement evidence comes from two experiments reported in Section 4, Figure 7. Each completes two discriminator-generator iterations.

Source: Section 4, Figure 7. B1 and B2 are constructed adversarial evaluations, not independent samples of general production performance.

For KV compression, the adversarial mean rises by 62.5 percentage points. Yet RULER’s aggregate improvement is only 0.77 percentage points. Individual components move differently: the RULER cwe score declines from 0.760 to 0.728, even though the aggregate increases.

Moreover, the evolved method’s RULER average of 0.7577 remains below the uncompressed reference’s 0.8806. The experiment demonstrates improvement over the compressed starting algorithm, not restoration of every capability available without compression.

For context extension, adversarial mean accuracy rises by 70 percentage points. ScienceFiction accuracy increases by 6 points, and PG19 perplexity at 32K decreases by 0.33. Those established-evaluation improvements suggest that revisions are not restricted entirely to the generated tests. Nevertheless, the Coursera score remains at 58 for the original DCA and Gen-2, and the passkey and needle evaluations are already saturated at 1.00 for both.

The practical lesson is to inspect the components of a regression suite rather than relying on its aggregate. Improvements on adversarial inputs can coexist with unchanged or weaker performance elsewhere.

Failure-discovery cost measures the search procedure

An automated testing system also consumes computation and model inference. The researchers therefore examine the monetary cost required to discover an adversarial failure.

In the reported searches, GPT Luna with GEPA identifies a FastKVZip performance gap of 0.5 at approximately $0.20 average cost. The paper also reports costs below $0.01 for breaking DCA and PQCache at 2% sparsity, and $5.06 for Oracle Topk in the stated comparison. Figure 6 averages the discovered performance gaps over ten runs per setting.

Selected lightweight proposer models prove more cost-effective than larger alternatives under these search configurations. This motivates testing inexpensive specialized proposers rather than automatically assigning every adversarial-search task to the largest available model.

The proposed cost certificate measures how difficult it is to find a failure using a specified proposer, harness, budget, and failure criterion.

It is not a universal robustness certificate. An algorithm that survives an expensive search may still fail under a different input construction strategy. Comparing discovery costs is informative only when the procedures and success thresholds are sufficiently comparable.

Turn the research loop into an inference release gate

For a team deploying compressed or extended-context LLMs, Cognaptus infers a practical quality-assurance workflow from GAL’s design.

Start with representative application tasks: retrieving current records among stale ones, handling distractors, preserving multi-step dependencies, and finding evidence at different context positions. Generate targeted adversarial variants, then test both the unapproximated and optimized inference configurations. Keep cases that expose a meaningful approximation-induced gap, along with their construction rules and evaluation conditions.

When a failure is discovered, freeze it into the regression suite before permitting an algorithm modification. Evaluate the proposed revision against previously accumulated failures, established benchmarks, and separate deployment-relevant cases. Require component-level acceptance thresholds wherever specific task regressions would be costly.

This process can inform three decisions: whether an inference method is acceptable for release, whether an automated revision actually repairs the identified weakness, and how much search expenditure is justified by the remaining uncertainty.

The paper demonstrates the core discover-and-improve mechanism, but this release-gating workflow is an operational extrapolation rather than a deployment outcome measured by the study. Its value depends on having trustworthy task evaluators, realistic failure constructions, and explicit acceptance criteria.

What the completed loops do not establish

The experiment’s strongest result is that automated benchmark discovery can guide successful algorithm revisions in the tested configurations. Its scope is narrower than a general claim about autonomous research reliability.

Complete improvement loops are demonstrated for KV compression and context extension, not sparse video generation or sparse decoding attention. The adversarial accuracy gains concern two constructed benchmark sets per completed experiment. Because the discovery and modification processes are adaptive, benchmark-specific optimization remains possible.

The study does not isolate GAL’s causal advantage over every alternative testing-and-engineering workflow. It also does not measure how frequently the discovered patterns occur in production traffic or establish a practical upper limit on useful iterations. Search costs omit a comprehensive accounting of engineering, infrastructure, and deployment expenses.

These boundaries affect deployment decisions directly: a high adversarial score is a reason to continue validation, not sufficient evidence to approve an optimization across an entire application.

The benchmark should improve with the algorithm

GAL’s central contribution is to make evaluation design responsive to algorithm improvement. An automated system discovers a valid weakness, preserves the failure, and uses it to constrain the next revision.

The two completed experiments show that this process can substantially repair constructed adversarial failures while improving selected established metrics. They also show why aggregate improvements cannot replace component-level regression checks.

For inference engineering, the stronger operating model is therefore a continuously maintained evaluation process in which newly discovered failures become durable acceptance requirements. The goal is not to declare an algorithm robust after two successful revisions. It is to make future failures harder to overlook and subsequent improvements easier to verify.

Cognaptus: Automate the Present, Incubate the Future.