\documentclass[11pt]{article}
\usepackage[utf8]{inputenc}
\usepackage[margin=1in]{geometry}
\usepackage{graphicx}
\usepackage{booktabs}
\usepackage{amsmath,amssymb}
\usepackage{hyperref}
\usepackage{microtype}
\usepackage{xcolor}
\hypersetup{colorlinks=true, linkcolor=blue, citecolor=blue, urlcolor=blue}

\title{\textbf{Beating the Floor Is Hard:\\ A Leakage-Controlled Study of On-Device Tool Selection with\\ Block-Diffusion and Autoregressive LoRA on Apple Silicon}}
\author{Rud Lord and the KnowledgeOS Agents\\ \small KnowledgeOS Collective}
\date{June 2026}

\begin{document}
\maketitle

\begin{abstract}
We study whether parameter-efficient fine-tuning can teach a model to \emph{select the
right tools} for an agentic coding task, under conditions honest about both \textbf{data
leakage} and \textbf{strong non-learning baselines}. We build what is, to our knowledge (June 2026), the first \textbf{block-diffusion}
(DiffusionGemma-26B-A4B) QLoRA trainer running entirely on \textbf{Apple Silicon} via MLX, and
contrast it head-to-head with an \textbf{autoregressive (AR) sibling} (Gemma-4-26B-A4B) LoRA on
identical data. We replace a 96\%-contaminated source split with a \textbf{group-aware,
leakage-free benchmark} (575/124/124), anchor metrics to a \textbf{frequency floor} and
\textbf{data ceiling}, and add a \textbf{dialect-aware LLM judge}. Across architecture,
capacity, objective weighting, and a 43\% data expansion, \textbf{no trained configuration
significantly clears the 0.474 Jaccard frequency floor}. The AR sibling is the strongest
fine-tune (0.4925 Jaccard, $\sim$10$\times$ faster inference) and ties the floor. A cheap
train-only TF--IDF 5NN retrieval baseline reaches \textbf{0.512 Jaccard}, the strongest point
estimate, but also fails to significantly beat the floor (paired $\Delta{=}+0.038$, 95\% CI
$[-0.005,+0.082]$). A label-set oracle reaches 0.944 and the train-vocabulary ceiling reaches
0.996, showing that the bottleneck is prompt-to-label-set routing and tail-tool recall, not
label availability or adapter capacity. We argue that trace-derived tool-selection studies
should report the floor, retrieval baseline, ceiling, and dialect-aware score before claiming a
win.
\end{abstract}

\section{Introduction}
Agentic coding systems repeatedly answer a small but consequential question: \emph{given a task
and a palette of available tools, which tools are needed?} Getting this right early prunes the
action space, reduces latency, and avoids wasted tool calls, motivating a small, fast,
\textbf{on-device} specialist alongside a larger planner.

This paper reports such an attempt and, more importantly, an honest account of how hard it is to
\emph{demonstrate that the specialist helps}. Contributions: (1) an Apple-Silicon block-diffusion
trainer where none existed (D3PM-uniform corruption, supervised EOS-fill, manual LoRA wiring
around a MoE); (2) a leakage-controlled benchmark anchored to a frequency floor, retrieval
baseline, and data ceiling~\cite{sainz2023,dodge2021}; (3) a retrieval sanity check showing a
cheap TF--IDF 5NN memory baseline reaches 0.512 Jaccard while a train-label-set oracle reaches
0.944; (4) a dialect-aware LLM-as-a-judge evaluation~\cite{liu2023geval,zheng2023}; and (5) a
deconfounded sweep yielding an honest negative. The takeaway is methodological: \emph{report the
floor, retrieval baseline, ceiling, and dialect-aware score}---otherwise it is easy to mistake
``learned the local vocabulary'' for ``learned the task.''

\section{Related Work}
\textbf{Discrete and block-diffusion LMs.} D3PM~\cite{austin2021} introduced discrete denoising
diffusion with four corruption kernels (uniform, absorbing/mask, discrete Gaussian, embedding).
Masked diffusion LMs (MDLM~\cite{sahoo2024}, MD4~\cite{shi2024}) isolate the absorbing transition
and scale up (LLaDA~\cite{nie2025}, DiffuLLaMA~\cite{nie2024}). Block/semi-AR variants
(BD3-LM~\cite{arriola2025}) interpolate AR and diffusion---the family DiffusionGemma belongs to.
DiffusionGemma uses the \emph{uniform} kernel, not absorbing/mask; an MDLM mask objective would be
incorrect here. This distinction is not cosmetic: von R\"utte et al.~\cite{vonrutte2025} show uniform and masked
discrete diffusion have different scaling behavior (uniform needs fewer parameters/data), and
preference-alignment methods for discrete diffusion likewise assume uniform noising~\cite{borso2025}.

\textbf{On-device function calling and tool selection.} A growing line of work builds small,
fast function-calling agents for edge/consumer hardware: Octopus~v2~\cite{chen2024octopus},
TinyAgent~\cite{erdogan2024tinyagent}, and Hammer~\cite{lin2024hammer} (function masking +
irrelevance detection). Paramanayakam et al.~\cite{paramanayakam2024less} show that simply \emph{reducing the tool
set} improves edge function-calling---direct support for why our frequency floor is so strong.
Most related is \textbf{DualTune/AgentFlux}~\cite{kadekodi2025dualtune}, which decouples tool
calling into a dedicated \emph{tool-selection} LoRA and an argument-generation LoRA, training the
selector with \emph{loss computed only over tool-name tokens}---an autoregressive Qwen-2.5-7B on a
consumer NVIDIA GPU. Our work differs in three ways: (i) the backbone is a \emph{block-diffusion}
MoE trained on \emph{Apple Silicon}; (ii) we add leakage control plus floor/ceiling/retrieval/
dialect baselines; and (iii) the analogous loss intervention has the \emph{opposite} sign---their
AR token-masking helps, whereas our block-diffusion EOS-fill down-weighting \emph{hurt} (\S6.5),
suggesting the loss-shaping lesson does not transfer across the AR/diffusion boundary.

\textbf{Tool-selection benchmarks.} BFCL~\cite{patil2025}, xLAM~\cite{zhang2024}, and
ToolACE~\cite{liu2024toolace} evaluate function calling against canonical APIs. Our labels are
mined from \emph{real agent traces}, so ``correct'' tool names form a team-specific dialect---which
motivates our leakage controls and judge. Because trace-derived labels recur as small sets, we
also include a train-only retrieval sanity baseline: retrieve similar historical tasks and reuse
or vote on their tool sets. This baseline is not novel IR; it is the minimum diagnostic a small
LoRA study must beat.

\textbf{On-device PEFT.} LoRA~\cite{hu2021} and QLoRA~\cite{dettmers2023} enable consumer-hardware
fine-tuning; Apple MLX brings competitive on-device inference and training to Apple
Silicon~\cite{ajayi2025mlx}. We extend it to a block-diffusion MoE, for which no MLX training
path previously existed.

\textbf{LLM-as-a-judge.} G-Eval~\cite{liu2023geval}, MT-Bench~\cite{zheng2023}, and
Prometheus~2~\cite{kim2024} establish judge methodology; known biases mean judges complement,
not replace, deterministic metrics.

\textbf{Contamination and baselines.} Contamination inflates scores~\cite{sainz2023,dodge2021},
and on uncontaminated classification LLMs rarely beat majority baselines---which we address by
construction.

\section{The DiffusionGemma MLX Trainer}
DiffusionGemma-26B-A4B is a Gemma-4 MoE (25.8B total, 3.8B active) wrapped in a block-diffusion
process: an AR encoder prefills the prompt, then a bidirectional decoder denoises a 256-token
canvas.

\textbf{Corruption.} Per example $t\sim U(\epsilon,1)$, $\epsilon{=}10^{-3}$; each canvas position
is replaced w.p.\ $t$ by a uniform-random id over $V{=}262{,}144$. No mask token is used; inference
renoises with uniform ids, so train and inference match.

\textbf{Loss.} Unweighted cross-entropy over all 256 canvas positions, the response padded by a
supervised \texttt{<eos>} fill (so termination is learned). No $1/t$ reweighting (that is the
absorbing-kernel ELBO weight, inapplicable to the uniform kernel).

\textbf{LoRA around a MoE.} The stock MLX PEFT path crashes on this architecture; we freeze the
base and wrap \texttt{self\_attn.\{q,k,v,o\}\_proj} and dense \texttt{mlp.\{gate,up,down\}\_proj}
with \texttt{LoRALinear} (r16/$\alpha$32), freezing experts, router, and embeddings---\textbf{18.6M}
trainable params (0.072\%). Logits tie to the input embedding with an fp32 $\tanh$ softcap at 30.

\textbf{Unattended-training engineering.} The macOS GPU interactivity watchdog aborts long Metal
buffers and fires more under thermal throttling (observed survival $\sim$20$\rightarrow$5
steps/attempt over an hour). Robust config: gradient checkpointing,
\texttt{MLX\_MAX\_OPS\_PER\_BUFFER=1}, crash-resume with thermal cooldowns, dense checkpointing
(every 10 steps), and partial-eval fallback. Block-diffusion \emph{inference} from long prompts is
slow on MLX (the prefill is one large buffer); the AR sibling decodes at $\sim$1.5\,s/sample.

\section{Benchmark Construction}
\textbf{Leakage control.} The source split had 3{,}935 rows but $\sim$823 distinct pairs, most test
prompts appearing verbatim in train (trivial lookup $=0.959$ Jaccard). We dedupe, group by task
identity, greedy-pack 575/124/124, and assert zero pair and zero prompt overlap (hashes frozen in a
manifest).

\textbf{Frequency floor.} Always emitting $\{$Bash, Read, Edit$\}$ scores \textbf{0.474 Jaccard /
0.750 Top-1}---strong, because a few tools dominate. Clearing it (with a paired test) is the bar
for ``interesting.''

\textbf{Data ceiling.} The mean train-vocabulary-intersected gold Jaccard is \textbf{0.996} (only
1/124 test tools unseen in train), upper-bounding any train-only model and localizing the
bottleneck to method.

\textbf{Retrieval baseline.} We strip each rendered prompt to task text, build deterministic
TF--IDF vectors over the 575 training tasks, retrieve nearest neighbors by cosine similarity, and
predict either the nearest label set or the top-three tools by rank-weighted vote across the
nearest $k\in\{3,5\}$ tasks. We also report a train-label-set oracle that chooses the training
label set with maximum Jaccard to the test gold set; it is not deployable, but measures whether
the correct combinations recur in train.

\textbf{Metrics.} Jaccard (primary), exact-set, Top-1, each with 10k-bootstrap CIs and paired
bootstrap deltas; plus an LLM-judge (DeepSeek-chat) scoring task-appropriateness in $[0,1]$ with
synonym credit.

\section{Experimental Setup}
All runs are on a single Mac Studio (M2 Max, 64GB), serial. The diffusion base and AR sibling
are the 4-bit MLX conversions of DiffusionGemma and Gemma-4, respectively. Greedy
decoding. Diffusion eval uses buffer caps \texttt{ops=32/mb=128} and a fresh process per 20-sample
chunk to avoid position-correlated thermal degradation. Zero-shot AR baselines are evaluated
\emph{thinking-disabled} with a parser stripping residual reasoning channels---otherwise reasoning
models score 0.000 by exhausting the token budget. Checkpoints are selected on held-out valid
Jaccard, then scored once on the frozen test. Retrieval, head/tail, and oracle analyses run
offline from the frozen JSONL splits and saved per-sample prediction JSONs.

\section{Results}
\subsection{Main benchmark (frozen 124-sample test)}
\begin{table}[h]\centering
\begin{tabular}{lccc}
\toprule
Model & Jaccard [95\% CI] & Top-1 & LLM-judge \\
\midrule
\emph{frequency floor (non-learning)} & \emph{0.474} & \emph{0.750} & --- \\
\emph{TF--IDF 5NN vote (retrieval)} & \emph{0.512 [0.459, 0.565]} & \emph{0.790} & --- \\
\emph{data ceiling (oracle, train-only)} & \emph{0.996} & --- & --- \\
DiffusionGemma zero-shot & 0.073 [0.045, 0.104] & 0.097 & 0.386 \\
Gemma-4-26B AR zero-shot & 0.070 [0.045, 0.099] & 0.113 & 0.446 \\
Qwen3.6-35B-A3B zero-shot & 0.138 [0.102, 0.176] & 0.250 & 0.294 \\
Qwen3.6-27B zero-shot & 0.197 [0.158, 0.236] & 0.331 & 0.493 \\
DiffusionGemma + LoRA (ours) & 0.447 [0.393, 0.502] & 0.750 & \textbf{0.721} \\
\textbf{AR sibling + LoRA (ours)} & \textbf{0.4925 [0.432, 0.553]} & \textbf{0.782} & 0.650 \\
\bottomrule
\end{tabular}
\end{table}

Fine-tuning works trivially: diffusion LoRA lifts 0.073$\rightarrow$0.447 (paired
$+0.374$, $P(\text{win}){=}1.0$); AR LoRA lifts 0.070$\rightarrow$0.4925 ($+0.42$, $P{=}1.0$). The
AR sibling is the best fine-tune and $\sim$10$\times$ faster to serve. But the strongest point
estimate is not neural: a cheap train-only TF--IDF 5NN vote reaches 0.512.

\begin{figure}[h]\centering
\includegraphics[width=0.92\linewidth]{figures/fig1_benchmark.pdf}
\caption{Held-out tool-set Jaccard. Fine-tunes (blue/green) lift zero-shot baselines (grey)
up to 6$\times$, yet the non-learning frequency floor (red dashed, 0.474) remains competitive;
the data ceiling (0.996) confirms the labels are learnable.}
\label{fig:bench}
\end{figure}

\subsection{The floor is not significantly beaten}
\begin{table}[h]\centering
\begin{tabular}{lccc}
\toprule
Comparison & Mean $\Delta$ & 95\% CI & Verdict \\
\midrule
TF--IDF 5NN vote $-$ floor & $+0.038$ & $[-0.005, +0.082]$ & \textbf{tie} (near-miss) \\
AR sibling $-$ floor & $+0.018$ & $[-0.039, +0.078]$ & \textbf{tie} (CI crosses 0) \\
capacity r32 $-$ floor & $-0.030$ & $[-0.081,\ \cdot]$ & below \\
answer-weighted eos0.05 $-$ floor & $-0.049$ & $[-0.089,\ \cdot]$ & below \\
answer-weighted eos0.25 $-$ floor & $-0.034$ & $[-0.061,\ \cdot]$ & below \\
\bottomrule
\end{tabular}
\end{table}
No trained configuration's lower bound exceeds zero; even the retrieval baseline, with the
highest point estimate, is a statistical tie with the floor.

\begin{figure}[h]\centering
\includegraphics[width=0.86\linewidth]{figures/fig4_vs_floor.pdf}
\caption{Paired bootstrap of (model $-$ floor) on identical test items. Every fine-tune's
95\% CI crosses zero; the best (AR sibling) only ties the floor.}
\label{fig:floor}
\end{figure}

\subsection{A boring memory baseline is the strongest point estimate}
The retrieval sanity check is uncomfortable for the LoRA story. Predicting from nearest training
tasks is not a new model, but it is the right floor for trace-derived selectors: a production
agent can cheaply remember its own past.

\begin{table}[h]\centering\small
\begin{tabular}{lcccc}
\toprule
Method & Jaccard [95\% CI] & $\Delta$ vs floor & Top-1 & Exact \\
\midrule
TF--IDF 1NN & 0.500 [0.445, 0.557] & $+0.026$ [$-0.031$, $+0.084$] & 0.766 & 0.153 \\
TF--IDF 3NN vote & 0.511 [0.458, 0.563] & $+0.036$ [$-0.011$, $+0.085$] & 0.790 & 0.161 \\
\textbf{TF--IDF 5NN vote} & \textbf{0.512 [0.459, 0.565]} & \textbf{$+0.038$ [$-0.005$, $+0.082$]} & \textbf{0.790} & \textbf{0.177} \\
train-label-set oracle & 0.944 [0.921, 0.966] & $+0.470$ [$+0.420$, $+0.521$] & 0.935 & 0.815 \\
\bottomrule
\end{tabular}
\end{table}
The label-set oracle is the key diagnostic: the right tool combinations usually already exist in
train. The hard part is routing a new task to the right prior, not inventing unseen tool labels.

\begin{figure}[h]\centering
\includegraphics[width=0.92\linewidth]{figures/fig5_retrieval_baselines.pdf}
\caption{Retrieval sanity baselines. TF--IDF nearest-neighbor retrieval is the strongest point
estimate, but still only ties the floor statistically; the train-label-set oracle shows reusable
label combinations already exist.}
\label{fig:retrieval}
\end{figure}

\subsection{Head/tail error anatomy}
The floor wins by saturating head tools. On the 44 head-only examples (gold subset of
\{Bash, Read, Edit\}), the floor scores 0.652 and the AR LoRA scores 0.769. On examples with
two or more tail tools, the floor falls to 0.285 and both LoRAs are worse (diffusion 0.257,
AR 0.229); TF--IDF 1NN is still weak but best at 0.360. The missed vertical is tail-tool
recall: structured output, shell/read dialect synonyms, browser/MCP tools, and other
low-frequency agent-specific tools.

\begin{table}[h]\centering
\begin{tabular}{lccccc}
\toprule
Slice & n & floor & Diffusion LoRA & AR LoRA & TF--IDF 1NN \\
\midrule
head-only tools & 44 & 0.652 & 0.540 & \textbf{0.769} & 0.559 \\
one tail tool & 48 & 0.438 & 0.489 & 0.415 & \textbf{0.541} \\
multi-tail tools & 32 & 0.285 & 0.257 & 0.229 & \textbf{0.360} \\
\bottomrule
\end{tabular}
\end{table}

\begin{figure}[h]\centering
\includegraphics[width=0.92\linewidth]{figures/fig6_head_tail_strata.pdf}
\caption{Head/tail stratification. Static priors and LoRAs handle the head, but all methods remain
weak on multi-tail tool sets.}
\label{fig:headtail}
\end{figure}

\subsection{Deconfounded ablations (single-factor vs.\ diffusion baseline 0.447)}
\begin{table}[h]\centering\small
\begin{tabular}{lccl}
\toprule
Variant & Test Jaccard & LLM-judge & Note \\
\midrule
answer-weighted loss, eos 0.05 & 0.425 & 0.676 & \textbf{worse}---refutes loss-dilution fix \\
answer-weighted loss, eos 0.25 & 0.440 & 0.689 & still below baseline \\
capacity rank 32 / $\alpha$64 & 0.444 & 0.666 & extra capacity does not help \\
$+43\%$ data (expanded, r16) & 0.434 (val 0.529) & --- & valid up, test flat \\
\bottomrule
\end{tabular}
\end{table}
We hypothesized $\sim$95\% of the diffusion loss is wasted on trivial EOS-fill, diluting the signal.
Down-weighting EOS made results \emph{worse} at both doses---over-correction; the flat loss already
learns content tokens. The 43\% data expansion (249 leak-free pairs mined per-turn from 13{,}127
on-device transcripts, vocab 39$\rightarrow$63) raised valid Jaccard 0.498$\rightarrow$0.529 but
left the frozen test flat.

\begin{figure}[h]\centering
\includegraphics[width=0.9\linewidth]{figures/fig3_ablations.pdf}
\caption{Single-factor ablations vs.\ the diffusion baseline (0.447, blue dotted) and the
floor (0.474, red dashed). Loss reweighting, added capacity, and the data expansion all fail
to improve over the baseline.}
\label{fig:abl}
\end{figure}

\subsection{The dialect tax}
Under exact-match, zero-shot models look incompetent (0.07--0.20); under the judge they jump
5--6$\times$ (DiffusionGemma 0.073$\rightarrow$0.386; Gemma-4 AR 0.070$\rightarrow$0.446) by
selecting \emph{valid} tools in a different vocabulary. The metrics rank architectures
\emph{oppositely}: the AR LoRA wins on Jaccard (0.4925 vs.\ 0.447) but the diffusion LoRA wins on
the judge (0.721 vs.\ 0.650).

\begin{figure}[h]\centering
\includegraphics[width=0.92\linewidth]{figures/fig2_dialect_tax.pdf}
\caption{The dialect tax. Under the semantic LLM-judge every model scores 5--6$\times$ higher
than exact-match Jaccard, and the two metrics rank the diffusion and AR LoRAs oppositely.}
\label{fig:dialect}
\end{figure}

\section{Discussion}
\textbf{The floor is the protagonist.} A study like this is tempting to frame as ``our
fine-tune beats much larger zero-shot models'' (it does, by 2--6$\times$). But a non-learning
frequency predictor is competitive with everything we trained; beating it needs task signal
beyond ``a few tools dominate.''

\textbf{Retrieval is the uncomfortable baseline.} The TF--IDF result changes the practical
recommendation. If the product goal is a useful on-device selector, a memory-first router should
be in the first implementation: retrieve similar historical tasks, vote on their tool sets, then
ask a learned model only for ambiguous tail cases. If the research goal is to prove learning,
that retrieval baseline is the minimum bar.

\textbf{Diffusion vs.\ AR.} On identical data the AR sibling matches or exceeds the diffusion model
on accuracy at $\sim$10$\times$ lower latency; for this task on Apple Silicon the AR specialist is
the more practical artifact. \textbf{Method, not data---but now specific.} The 0.996
train-vocabulary ceiling and 0.944 label-set oracle say labels and label combinations are
available. The gap is prompt-to-label-set routing and tail-tool recall, not lack of labels or
trainable parameters.

\textbf{Next verticals.} The useful follow-up lanes are: (1) retrieval-augmented selection with
calibrated fallback to AR LoRA; (2) head/tail hybrids that keep \{Bash, Read, Edit\} as priors
but train classifiers for structured output, shell/read synonyms, browser/MCP tools, and other
tail tools; (3) a canonical tool ontology so exact Jaccard and judge scores stop measuring
dialect; (4) an online Langfuse/LangSmith A/B measuring wasted calls, latency, and task success;
and (5) cross-organization trace splits to test whether the floor is universal or a
single-operator artifact.

\section{Limitations}
The test set is small (124 items) with wide CIs in low-frequency tool buckets; labels are
single-team trace-derived; the judge has its own biases; the retrieval baseline is deliberately
simple TF--IDF, not a tuned semantic retriever or production memory system; the data expansion is
modest and short-turn dominated; latency claims are MLX-specific. Finally, all results are
offline. The decisive product metric is an online A/B over tool-call waste, latency, and task
success.

\section{Conclusion}
We built, to our knowledge, the first Apple-Silicon block-diffusion QLoRA trainer, a leakage-controlled benchmark
anchored to a frequency floor, retrieval baseline, and data ceiling, plus a dialect-aware
dual-metric harness. Across architecture, capacity, objective, and data scale, no trained
configuration significantly beats the frequency floor---a robust negative we argue is the finding.
The AR sibling is the best, fastest fine-tune, but a TF--IDF memory baseline is the strongest
point estimate and also only ties the floor. The next useful selector is likely hybrid: frequency
priors for head tools, retrieval for recurring task clusters, and learned calibration for the
tail. On-device tool-selection studies should report the floor, retrieval baseline, ceiling, and
dialect-aware score before claiming a win.

\section*{Reproducibility}
Trainer, eval, leakage-aware dataset builder, bootstrap analysis, TF--IDF retrieval baseline,
head/tail stratification, LLM judge, and Langfuse/LangSmith trace push scripts are released. All
splits are SHA-256 manifested; all runs are logged with per-sample predictions and both exact and
semantic metrics.

\begin{thebibliography}{99}
\small
\bibitem{arriola2025} Arriola et al. (2025). \emph{Block Diffusion (BD3-LMs).} arXiv:2503.09573.
\bibitem{austin2021} Austin et al. (2021). \emph{Structured Denoising Diffusion in Discrete State-Spaces (D3PM).} arXiv:2107.03006.
\bibitem{dettmers2023} Dettmers et al. (2023). \emph{QLoRA.} arXiv:2305.14314.
\bibitem{dodge2021} Dodge et al. (2021). \emph{Documenting the C4 Corpus.} arXiv:2104.08758.
\bibitem{hu2021} Hu et al. (2021). \emph{LoRA.} arXiv:2106.09685.
\bibitem{kim2024} Kim et al. (2024). \emph{Prometheus 2.} arXiv:2405.01535.
\bibitem{liu2023geval} Liu et al. (2023). \emph{G-Eval.} arXiv:2303.16634.
\bibitem{liu2024toolace} Liu et al. (2024). \emph{ToolACE.} arXiv:2409.00920.
\bibitem{nie2025} Nie et al. (2025). \emph{LLaDA.} arXiv:2502.09992.
\bibitem{nie2024} Nie et al. (2024). \emph{DiffuLLaMA.} arXiv:2410.17891.
\bibitem{patil2025} Patil et al. (2025). \emph{Berkeley Function Calling Leaderboard (BFCL).} PMLR v267.
\bibitem{sahoo2024} Sahoo et al. (2024). \emph{MDLM.} arXiv:2406.07524.
\bibitem{sainz2023} Sainz et al. (2023). \emph{NLP Evaluation in Trouble: Data Contamination.} arXiv:2310.18018.
\bibitem{shi2024} Shi et al. (2024). \emph{MD4.} arXiv:2406.04329.
\bibitem{zhang2024} Zhang et al. (2024). \emph{xLAM.} arXiv:2409.03215.
\bibitem{zheng2023} Zheng et al. (2023). \emph{Judging LLM-as-a-Judge with MT-Bench.} arXiv:2306.05685.
\bibitem{kadekodi2025dualtune} Kadekodi et al. (2025). \emph{DualTune / AgentFlux: Decoupled Fine-Tuning for On-Device Agentic Systems.} arXiv:2510.00229.
\bibitem{erdogan2024tinyagent} Erdogan et al. (2024). \emph{TinyAgent: Function Calling at the Edge.} arXiv:2409.00608.
\bibitem{lin2024hammer} Lin et al. (2024). \emph{Hammer: Robust Function-Calling for On-Device Language Models via Function Masking.} arXiv:2410.04587.
\bibitem{chen2024octopus} Chen and Li (2024). \emph{Octopus v2: On-device Language Model for Super Agent.} arXiv:2404.01744.
\bibitem{paramanayakam2024less} Paramanayakam et al. (2024). \emph{Less is More: Optimizing Function Calling for LLM Execution on Edge Devices.} arXiv:2411.15399.
\bibitem{vonrutte2025} von R\"utte et al. (2025). \emph{Scaling Behavior of Discrete Diffusion Language Models.} arXiv:2512.10858.
\bibitem{borso2025} Borso et al. (2025). \emph{D3PO: Preference-Based Alignment of Discrete Diffusion Models.} arXiv:2503.08295.
\bibitem{ajayi2025mlx} Ajayi and Odunayo (2025). \emph{Benchmarking On-Device Machine Learning on Apple Silicon with MLX.} arXiv:2510.18921.
\end{thebibliography}

\end{document}