The research behind the architecture.

The report is based on more than 300 publicly documented AI initiatives, interviews with 52 organizations and a survey of 153 executives (January to June 2025). The authors report that 95% of the organizations studied have so far achieved no measurable financial return from their GenAI initiatives – assessed roughly six months after the pilot. This is not a technical failure: many tools work but change nothing that shows up in the P&L. The authors name a learning gap as the main cause – systems that don't fit into existing workflows, retain no context and don't improve. Successful companies demand process-specific customization and measure business outcomes rather than benchmarks; the authors see the clearest returns in the back office. Context: The report is preliminary, by its own account not representative, and covers a short period. It does not support the widely quoted claim that "95% of all AI projects fail"; individual rates in the report refer to different populations.

56% of the CEOs surveyed say that AI has so far brought their company neither lower costs nor higher revenue. 30% report higher revenue, 26% lower costs – only 12% both. According to PwC, the companies pulling ahead are those that have scaled AI on solid foundations. The study thus provides a newer and much larger data set on why AI investments often don't yet deliver a measurable advantage. Context: These are CEOs' self-assessments, not measured financial figures.

According to BCG, 74% of companies have not yet developed the capabilities needed to deploy AI at scale and achieve tangible value; only 26% get beyond proofs of concept, and 4% are considered leaders. BCG puts around 70% of the obstacles down to people and processes, 20% to technology and only about 10% to algorithms. Leaders use AI in core processes rather than only in support functions and focus on fewer use cases, which they then scale consistently. Context: a survey of executives, not a measurement of individual projects.

The paper introduces a "decomposer" that breaks a task into subtasks, each solved by specialized handlers – separate prompts, other models or ordinary program functions. Because each handler stands on its own, it can be improved, replaced or reused recursively. On multi-step tasks (including symbolic manipulation and multi-hop questions), the approach clearly outperformed classic chain-of-thought prompting in the study.

Hard problems are first broken down into simpler subproblems, which are then solved in sequence, with each answer feeding into the next step. In the study, this let models generalize from easy examples to much harder tasks on which chain-of-thought prompting failed.

Instead of diving straight in, the model first draws up a plan of subtasks and then works through it. The authors show that separating planning from execution reduces typical zero-shot chain-of-thought errors – above all, skipped steps and calculation or comprehension errors.

The paper shows that language models can learn to call external tools at the right points – calculator, search, calendar, translation – and incorporate the results into their answers. In the study, a comparatively small model trained this way matched the performance of much larger models on tasks that require facts or calculation. Key takeaway: tools make up for what a model cannot reliably recall from memory.

The authors systematically vary where the relevant information appears in the context. Result: models reliably use information at the beginning and the end, but accuracy drops sharply in the middle – a U-shaped curve that also appears in models explicitly designed for long contexts. So more context is not automatically better; what matters is that the relevant information gets there at all, and as prominently as possible.

The paper combines a language model with a retriever over an external document collection: relevant passages are retrieved for each query and passed to the model. In the study, the answers were more specific and more factual than with purely parametric knowledge – and the knowledge can be updated by replacing the index instead of retraining the model.

REPLUG treats the language model as a black box: the retriever simply prepends the retrieved documents to the input, and the model itself stays untouched. The authors show that even large models that cannot be modified benefit from external knowledge this way – and that the retriever can be improved using feedback from the model without touching its weights.

A router estimates in advance how difficult a request is and sends simple requests to a small model and hard ones to a large model. In the authors' experiments, this avoided a substantial share of calls to the large model without any measurable loss in answer quality – the threshold can be adjusted via a quality parameter.

The paper sets out three levers against LLM costs: shortening and batching prompts, caching answers or using smaller models, and cascades in which a low-cost model answers first and the request is escalated only if reliability is low. On their benchmarks, the authors matched the quality of the most expensive model with such combinations at a fraction of the cost.

The model first writes a draft, then plans verification questions about the claims it contains, answers them independently of the draft and uses the answers to produce the final response. The separation is what matters: when the verification questions are answered without looking at the draft, the model repeats its errors less often. In the study, the number of fabricated statements dropped significantly across several task types.

The same model generates an answer, critiques it in a second call and revises it in a third – without any training, just through separate roles in separate calls. Across seven tasks, both human raters and automatic metrics clearly preferred the revised results to the first draft.

The authors extracted hundreds of verbatim memorized training sequences from GPT-2 – including names, addresses and contact details of real people – even though each of them appeared only once in the training data. Larger models were more vulnerable. Follow-up work by Nasr et al. (ICLR 2025) shows that even production-grade, aligned chat models can be made to output training data.

The paper describes indirect prompt injection: an attacker hides instructions in data that the system reads later – web pages, emails, documents. As soon as an LLM processes this content, it can be manipulated into leaking data, altering answers or taking unwanted actions. InjecAgent (Zhan et al., Findings of ACL 2024) measures this for agents with tools: in the benchmark, even strong models could be tricked into harmful actions via manipulated tool outputs in a significant share of cases.