Pith. sign in

REVIEW 4 major objections 6 minor 41 references

Black-box queries can recover an autonomous multi-agent system’s inference-time harness and transplant its orchestration onto weaker models.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-31 16:22 UTC pith:D3SOCRRE

load-bearing objection Real problem and clean framing, but the big transfer number is not yet shown to be stolen harness IP rather than validation-gated search seeded by a probe. the 4 major comments →

arxiv 2607.28147 v1 pith:D3SOCRRE submitted 2026-07-30 cs.CR

Agent Harness Distillation: Inference-Time Harness Extraction and Exploitation in Autonomous Multi-Agent Systems

Yu Cui , Wuli Yang , Yirui Shi , Junhao Xia , Hui Jiang , Lei Gao , Chenfu Bao This is my paper
classification cs.CR
keywords agent harness distillationinference-time harnessautonomous multi-agent systemsintellectual property leakageblack-box extractiondeception-based defenseLLM agentsorchestration transfer
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Autonomous multi-agent systems built on large language models do not only ship a model; they ship an inference-time harness that dynamically wires planning, tools, memory, and subagents for each task. That harness is expensive to design and is treated here as valuable intellectual property. The paper argues that even under a strict black-box interface—query in, final answer out—an attacker can still extract enough of that harness to rebuild a working orchestration scaffold and transfer it to other backbones. The method, Agent Harness Distillation, first elicits and aggregates structural self-reports from the target, then iteratively edits a base harness until its observed behavior aligns with the recovered template. Experiments on real systems (Hermes and Claude Code) show measurable accuracy gains on weaker models and high scores on the paper’s leakage metrics; a deception defense that returns plausible but false workflow descriptions cuts extraction fidelity while keeping task accuracy largely intact. The sympathetic takeaway is that dynamic orchestration is not automatically secret, and that protecting it may require active misdirection rather than silence alone.

Core claim

Inference-time harnesses in autonomous multi-agent systems are extractable from black-box responses via a two-stage distillation pipeline, can be transferred to other backbone models to reproduce orchestration capability, and therefore constitute a real IP-leakage surface that a deception-based defense can measurably shrink without destroying agent utility.

What carries the argument

Agent Harness Distillation (AHD): a pre-distillation stage that injects a harness-extraction probe, extracts structural claims from responses, and denoises them by per-task majority vote plus cross-task frequency filtering into an initial harness H0; then a post-distillation “loop harness alignment” that edits H0 against recovered targets under a validation gate until the adapted harness ˆHB behaves like the target’s indistinguishability class.

Load-bearing premise

The agent’s elicited self-reports about its own workflow are stable enough, after voting and cross-task filtering, to reflect the real hidden harness rather than confabulation or behavior changed by the probe itself.

What would settle it

On Hermes or Claude Code, run the same HEA probes and transfer protocol but with the probe stripped of the “summarize your logs/workflow” suffix (or with ground-truth harness logs available): if Injected Fidelity, Clean Transfer, and post-distillation accuracy gains collapse to baseline while Clean Visibility stays low, the claimed leakage channel is not carrying true harness structure.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Providers who only encrypt inter-agent messages still leak orchestration IP through final user-visible answers.
  • Weaker open backbones can inherit much of a proprietary agent’s workflow skill without access to the original harness implementation.
  • Leakage metrics (clean visibility, injected fidelity, clean transfer, probe perturbation) give a concrete scorecard for red-teaming dynamic multi-agent systems.
  • A fixed system-level instruction to fabricate false but coherent workflow descriptions can lower extraction success while preserving legitimate task accuracy.
  • Multi-teacher fusion and agent self-distillation are natural next risk surfaces once single-target extraction works.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If self-report denoising is the weak link, defenses that randomize or refuse workflow narration may beat pure encryption of internal logs.
  • The same extraction loop could double as an external audit tool when vendors hide traces, which tightens the confidentiality–auditability tradeoff the paper only sketches.
  • Transfer gains concentrated on weaker backbones suggest the stolen object is scaffolding that substitutes for missing model competence, not a full copy of frontier reasoning.
  • Once harness membership or trajectory fragments are inferable, prompt-injection and workflow-manipulation attacks can stop being blind and become topology-aware.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper formalizes inference-time harness extraction in autonomous multi-agent systems (AMAS) as a black-box IP-leakage problem, decomposing recovery error into probe-induced perturbation εA and extraction error εE. It proposes Agent Harness Distillation (AHD): a pre-distillation stage that elicits and aggregates structured self-reports of orchestration (roles, topology, tools, memory) via a Harness Extraction Attack (HEA) probe, and a post-distillation stage (Loop Harness Alignment) that edits a base harness toward recovered structure while gating acceptance on held-out validation performance. Experiments on Hermes and Claude Code (GPT-5.4 backbone) report HEA metrics (CV, IF, CT, PP), pre-distillation transfer gains on weaker backbones (Table 1, average ~+6–8 pts), a large post-distillation jump on MMLU-Pro with Qwen3.6-Flash (Table 2: 41.25%→86.25%), and a deception-based defense that lowers extraction metrics with limited utility loss. The manuscript is marked as work in progress.

Significance. If the causal claim holds—that transferable orchestration capability is recovered from black-box responses of real AMAS rather than from generic multi-agent search—the work opens a genuine, underexplored system-level IP surface beyond static MAS topology leakage and model knowledge distillation. Strengths include a clear threat model under unified UI access, an explicit error decomposition (εA vs εE), a fully specified two-stage pipeline (Algorithm 1), four operational leakage metrics, evaluation on deployed systems (Hermes, Claude Code), multi-backbone transfer, and a concrete deception defense with utility measurement. These contributions would matter for AMAS providers, red-teaming practice, and the confidentiality–auditability trade-off discussed in §8.1. The significance is currently conditional on showing that transfer gains are driven by recovered target structure ˆh rather than validation-gated harness optimization seeded by any plausible scaffold.

major comments (4)
  1. [§4.2, Algorithm 1, Table 2] Table 2 and §4.2 / Algorithm 1 (lines 19–23): the headline IP-leakage result attributes the 41.25%→86.25% post-distillation gain on MMLU-Pro (Qwen3.6-Flash) to stolen harness structure. Edits are proposed to reduce discrepancy with ˆh_xi, but acceptance depends only on Eval(·,V). Without ablations that hold the coding agent, edit vocabulary Δ, budget T, and V fixed while (i) replacing ˆh with a random/scrambled/unrelated harness, (ii) using a generic multi-agent scaffold with no HEA signal, and (iii) reporting performance of loop alignment from H0 with ˆh ablated, the +45 pt jump is consistent with performance-driven harness search rather than extraction of proprietary H. This is load-bearing for the abstract’s “substantial IP leakage” claim; pre-distillation alone is modest (+2.5% in Table 2; ~+6–8 average in Table 1).
  2. [§3.2, §4.1, Figure 3] §4.1 and §3.2: HEA recovers ˆh from natural-language self-reports after a prefix/suffix probe that encourages subagents/tools and then asks for workflow/log summaries. The formal objective requires ˆh in the behavioral indistinguishability class of the clean harness (minimizing εA+εE). The paper does not adequately establish that aggregated claims track clean hx rather than probe-altered behavior or confabulated self-descriptions. Please report: (a) human or automated agreement between extracted claims and internal logs on a labeled subset; (b) εA / PP broken down by probe variant (suffix-only, no log-inspection ask, paraphrases); (c) stability of Cu under different τ and n. If IF is high mainly against hx′ while CT/PP are weak, transfer should not be framed as recovery of clean inference-time IP.
  3. [§6, §7.2, Figure 3] §6–§7 and Figure 3: metrics IF/CT/PP/CV presuppose evaluator access to ground-truth hx and hx′. For a security claim about black-box leakage this is acceptable in lab evaluation, but the manuscript should state how ground-truth harnesses were obtained for Hermes and Claude Code (instrumentation, vendor logs, manual annotation schema) and the inter-annotator or parser reliability of Extract(y′). Without that, the high HEA bars in Figure 3 are hard to interpret and hard to reproduce. Also report per-benchmark, per-system numbers rather than aggregated metric bars alone, and clarify whether defense results use the same ground-truth labeling protocol.
  4. [§7.1–7.2, Table 1, Table 2] Table 1 vs Table 2 and §7.1: pre-distillation gains are uneven and largest on weaker backbones, which is compatible with “any reasonable harness helps weak models.” The experimental section should include (i) a strong non-extracted harness baseline (hand-designed or literature MAS scaffold) on the same backbones/benchmarks, (ii) statistical significance / variance over runs, and (iii) post-distillation results beyond the single MMLU-Pro case study so the average leakage claim is not carried by one gated optimization trajectory. Footnote 1 (“currently in progress”) should be reconciled with the strength of the abstract’s conclusions or the claims should be scoped to preliminary evidence.
minor comments (6)
  1. [Figure 1] Figure 1 comparison to classical KD is helpful; label the attacker-visible vs hidden channels more explicitly to match the threat model in §3.2.
  2. [§3.2, §7] Notation: H vs hx vs ˆh vs ˆHB is introduced clearly in §3.2 but later text sometimes says “distilled harness” without distinguishing H0 from ˆHB; keep that distinction in §7.
  3. [§5] Defense instruction is given as a fixed system prompt; state whether detection of extraction attempts is purely instruction-following or uses a separate classifier, and whether adaptive multi-turn attackers were considered (acknowledged briefly at end of §5).
  4. [§2] Related work: situate more sharply against MASLeak / topology inference (Wang et al., 2026a; Wu et al., 2026) with a table of assumptions (static vs inference-time, privileged subagent outputs vs unified UI).
  5. [§1] Typos/style: “we proposeAgent Harness Distillation” (missing space) in Introduction; inconsistent capitalization of Pre-/Post-Distillation; ensure benchmark names and model identifiers are uniform (GPT-5.4, Qwen3.6-Flash).
  6. [§8.3] §8.3 self-distillation / shadow agent discussion is speculative relative to the empirical core; consider shortening or clearly labeling as future risk analysis so it does not overclaim relative to §§6–7.

Circularity Check

0 steps flagged

No load-bearing circular derivation: transfer and fidelity are checked against external benchmarks and evaluator-held ground truth, not forced by the extraction objective.

full rationale

The paper’s chain is an empirical security claim, not a first-principles derivation that collapses into its inputs. Harness extraction is formalized as minimizing recovery error ε=εA+εE and recovering ĥ in a behavioral indistinguishability class (§3.2); that is a definition of the attack objective, not a self-proving theorem. Pre-distillation aggregates probe-elicited structural claims and instantiates H0 (§4.1); post-distillation proposes edits toward ˆh_xi but gates acceptance on held-out validation performance V (Alg. 1, §4.2). Capability transfer is then reported on external task benchmarks (AIME2025, GSM-Level6, GAIA, MMLU-Pro; Tables 1–2), and HEA quality is scored with CV/IF/CT/PP against evaluator-held ground-truth harnesses (§6, Fig. 3)—quantities the attacker does not optimize by construction. There is no uniqueness theorem or ansatz imported from overlapping-author prior work that forces the result; self-citations are ordinary related-work pointers. Causal-attribution worries (e.g., whether post-distillation gains are mostly validation-gated search seeded by a weak ˆh rather than stolen structure) are experimental-identification issues, not circular reductions of Eq. X to Eq. Y. Mild residual coupling—that fidelity metrics require privileged GT while the threat model is black-box—is standard red-team evaluation design and does not make the reported transfer tautological. Score 1 only for that non-load-bearing evaluation asymmetry; no circular steps meet the quote-and-reduce bar.

Axiom & Free-Parameter Ledger

4 free parameters · 6 axioms · 4 invented entities

The central security claim rests on a black-box interaction model, a behavioral notion of harness identity, and the premise that elicited natural-language workflow reports plus iterative harness edits recover transferable orchestration. No physical constants are fitted; free choices are algorithmic thresholds and evaluation design knobs. Invented entities are definitional frameworks (harness, AHD stages, metrics), not new physical objects.

free parameters (4)
  • cross-task frequency threshold τ = ∈ (0,1], value used in experiments not reported
    Controls which structural claims survive aggregation into ĥ during pre-distillation; directly affects what counts as recovered IP.
  • repeat count n and majority cutoff ⌈n/2⌉
    Per-task denoising hyperparameter for self-report stability; changes extracted harness content.
  • edit budget T and validation acceptance rule = T ≤ N
    Post-distillation stops and keeps only edits that do not hurt Eval on V; shapes the final distilled harness and reported gains.
  • HEA probe template d (prefix+suffix) = described qualitatively; full text not released
    Hand-designed injection that trades off εA vs information leakage; primary attack knob, not learned from a public standard.
axioms (6)
  • domain assumption AMAS responses are generated as y = Exec(θ, h_x, x) with ephemeral h_x = I_H(x) discarded after inference.
    System model in §3.2; load-bearing abstraction for what is hidden versus observable.
  • domain assumption Attacker knows backbone θ (architecture/parameters) and may choose it, but cannot read H, h_x, or internal logs L.
    Threat model §3.2; matches ‘user-configurable backbone’ deployments but is stronger than pure API-only attackers who lack weight access.
  • standard math Harnesses are identifiable only up to behavioral indistinguishability: recover ĥ ∈ [h] if Exec matches on D.
    §3.2 Harness Identifiability; standard equivalence-class inverse-problem framing.
  • ad hoc to paper Natural-language self-reports in y' contain extractable structured claims about roles, topology, tools, and coordination that correlate with true h after voting/filtering.
    Operational premise of pre-distillation Extract() and two-stage denoising (§4.1); not independently established outside this attack design.
  • ad hoc to paper A coding agent can propose discrete harness edits from observed vs recovered structure that improve alignment without merely overfitting V.
    Post-distillation Loop Harness Alignment (§4.2); depends on unstated edit vocabulary Δ quality.
  • domain assumption Deceptive, inconsistent fake workflow descriptions bound extraction success while preserving legitimate task accuracy when embedded as a persistent system instruction.
    §5 defense; supported by citation to defensive misdirection theory but only lightly stress-tested here.
invented entities (4)
  • Inference-time harness h_x / static harness H no independent evidence
    purpose: Unify dynamic orchestration (topology, tools, memory, coordination) as the IP object being leaked.
    Definitional system abstraction; useful but not an externally measured object beyond logs the authors control in evaluation.
  • Agent Harness Distillation (pre-distillation + post-distillation / Loop Harness Alignment) no independent evidence
    purpose: Concrete attack pipeline to estimate H and transfer orchestration to a student agent.
    Method introduced by the paper; evidence is the reported experiments only.
  • Harness Extraction Attack (HEA) probe d no independent evidence
    purpose: Elicit workflow disclosure while limiting execution perturbation εA.
    Attack instrument defined here; success is paper-internal.
  • Metrics CV, IF, CT, PP no independent evidence
    purpose: Quantify passive leakage, extraction fidelity, clean-harness transfer, and probe perturbation.
    Evaluation framework invented for this problem; depends on privileged ground-truth harness comparisons.

pith-pipeline@v1.2.0-daily-grok45 · 18128 in / 4200 out tokens · 81893 ms · 2026-07-31T16:22:57.519762+00:00 · methodology

0 comments
read the original abstract

Autonomous multi-agent systems (AMAS) built on large language models (LLMs), such as Hermes, increasingly rely on inference-time harnesses to coordinate reasoning and action. Constructing these harnesses requires substantial engineering effort and computational resources, as they are iteratively optimized over a combinatorial search space while co-evolving with the underlying LLM. Inference-time harnesses therefore constitute valuable intellectual property (IP). Although prior work has investigated IP leakage in static multi-agent systems with pre-configured architectures, it remains unclear whether similar risks arise in AMAS, where harness behavior emerges dynamically during inference. To address this gap, we introduce Agent Harness Distillation (AHD), a framework for studying the security risks arising from inference-time harness extraction in AMAS. We formalize harness extraction as a new security problem and develop an evaluation framework for quantifying such risks. AHD extracts inference-time harness capabilities from a target agent through black-box interactions and consists of two stages. In the pre-distillation stage, AHD infers inference-time harness behaviors from the responses of the target agent and constructs an initial harness. In the post-distillation stage, AHD iteratively refines the initial harness to align with the behavioral patterns of the target agent. Experiments on real-world AMAS across multiple backbone LLMs demonstrate the effectiveness of AHD and reveal substantial IP leakage risks. We further propose a deception-based defense that reduces harness extraction effectiveness while preserving the utility of the protected agent. Our findings uncover a previously underexplored security threat to AMAS.

Figures

Figures reproduced from arXiv: 2607.28147 by Chenfu Bao, Hui Jiang, Junhao Xia, Lei Gao, Wuli Yang, Yirui Shi, Yu Cui.

Figure 1
Figure 1. Figure 1: Comparison of the pipelines for our agent harness distillation and model knowledge distillation. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of deception-based defense against [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: shows that HEA achieves consistently strong performance across all four evaluation met￾rics. In addition, the proposed defense significantly degrades the effectiveness of extraction attacks. The defense substantially reduces inference-time harness leakage while preserving the vast majority of task utility (see [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Task accuracy under non-attack, HEA, and [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

41 extracted references · 3 canonical work pages

  1. [1]

    2026 , url=

    Zeeshan Hayder and Ali Cheraghian and Lars Petersson and Mehrtash Harandi and Richard Hartley , booktitle=. 2026 , url=

    2026

  2. [2]

    15th USENIX Symposium on Networked Systems Design and Implementation (NSDI 18) , year =

    Neha Narula and Willy Vasquez and Madars Virza , title =. 15th USENIX Symposium on Networked Systems Design and Implementation (NSDI 18) , year =

  3. [3]

    2025 , isbn =

    Chaliasos, Stefanos and Firsov, Denis and Livshits, Benjamin , title =. 2025 , isbn =. doi:10.1145/3719027.3765115 , booktitle =

    arXiv 2025

  4. [4]

    USENIX Security Symposium (USENIX Security) , year=

    MASLeak: Investigating and Exposing Intellectual Property Leakage Vulnerabilities in Multi-Agent Systems , author=. USENIX Security Symposium (USENIX Security) , year=

  5. [5]

    CIA : Inferring the Communication Topology from LLM -based Multi-Agent Systems

    Wu, Yongxuan and Lin, Xixun and Zhang, He and Sun, Nan and Wang, Kun and Zhou, Chuan and Pan, Shirui and Cao, Yanan. CIA : Inferring the Communication Topology from LLM -based Multi-Agent Systems. Proceedings of the 64th Annual Meeting of the A ssociation for C omputational L inguistics (Volume 1: Long Papers). 2026. doi:10.18653/v1/2026.acl-long.815

    work page doi:10.18653/v1/2026.acl-long.815 2026

  6. [6]

    ACIA rena: Toward Unified Evaluation for Agent Cascading Injection

    An, Hengyu and Li, Minxi and Zhang, Jinghuai and Xu, Naen and Zhou, Chunyi and Li, Changjiang and Xu, Xiaogang and Du, Tianyu and Ji, Shouling. ACIA rena: Toward Unified Evaluation for Agent Cascading Injection. Proceedings of the 64th Annual Meeting of the A ssociation for C omputational L inguistics (Volume 1: Long Papers). 2026. doi:10.18653/v1/2026.ac...

    work page doi:10.18653/v1/2026.acl-long.457 2026

  7. [7]

    M ulti A gent Collaboration Attack: Investigating Adversarial Attacks in Large Language Model Collaborations via Debate

    Amayuelas, Alfonso and Yang, Xianjun and Antoniades, Antonis and Hua, Wenyue and Pan, Liangming and Wang, William Yang. M ulti A gent Collaboration Attack: Investigating Adversarial Attacks in Large Language Model Collaborations via Debate. Findings of the Association for Computational Linguistics: EMNLP 2024. 2024. doi:10.18653/v1/2024.findings-emnlp.407

    work page doi:10.18653/v1/2024.findings-emnlp.407 2024

  8. [8]

    arXiv preprint arXiv:2605.11514 , year=

    FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems , author=. arXiv preprint arXiv:2605.11514 , year=

    Pith/arXiv arXiv

  9. [9]

    arXiv preprint arXiv:2607.14159 , year=

    MemoHarness: Agent Harnesses That Learn from Experience , author=. arXiv preprint arXiv:2607.14159 , year=

    Pith/arXiv arXiv

  10. [10]

    arXiv preprint arXiv:2606.01779 , year=

    Harnessforge: Joint harness and policy evolution for adaptive agent systems , author=. arXiv preprint arXiv:2606.01779 , year=

    Pith/arXiv arXiv

  11. [11]

    2026 , eprint=

    HarnessX: A Composable, Adaptive, and Evolvable Agent Harness Foundry , author=. 2026 , eprint=

    2026

  12. [12]

    2026 , eprint=

    Harness Handbook: Making Evolving Agent Harnesses Readable,Navigable, and Editable , author=. 2026 , eprint=

    2026

  13. [13]

    Self-Improving Agents in the Era of Experience: A Survey of Self-to Meta-Evolution , author=

  14. [14]

    The Fourteenth International Conference on Learning Representations , year=

    Multi-Agent Design: Optimizing Agents with Better Prompts and Topologies , author=. The Fourteenth International Conference on Learning Representations , year=

  15. [15]

    2025 , url=

    Changyi He and Yifu Ding and Jinyang Guo and Ruihao Gong and Haotong Qin and Xianglong Liu , booktitle=. 2025 , url=

    2025

  16. [16]

    Can Watermarks be Used to Detect

    Zhengyue Zhao and Xiaogeng Liu and Somesh Jha and Patrick McDaniel and Bo Li and Chaowei Xiao , booktitle=. Can Watermarks be Used to Detect. 2025 , url=

    2025

  17. [17]

    The Eleventh International Conference on Learning Representations , year=

    ReAct: Synergizing Reasoning and Acting in Language Models , author=. The Eleventh International Conference on Learning Representations , year=

  18. [18]

    Proceedings of the Thirty-First AAAI Conference on Artificial Intelligence , pages =

    Bacon, Pierre-Luc and Harb, Jean and Precup, Doina , title =. Proceedings of the Thirty-First AAAI Conference on Artificial Intelligence , pages =. 2017 , publisher =

    2017

  19. [19]

    Encrypted Access Logging for Online Accounts: Device Attributions without Device Tracking , booktitle =

    Carolina Ortega P. Encrypted Access Logging for Online Accounts: Device Attributions without Device Tracking , booktitle =. 2025 , isbn =

    2025

  20. [20]

    2025 , isbn =

    Zhao, Rui and Shoaib, Muhammad and Hoang, Viet Tung and Hassan, Wajih Ul , title =. 2025 , isbn =. doi:10.1145/3719027.3765024 , booktitle =

    arXiv 2025

  21. [21]

    Imitating Language via Scalable Inverse Reinforcement Learning , url =

    Wulfmeier, Markus and Bloesch, Michael and Vieillard, Nino and Ahuja, Arun and Bornschein, J\". Imitating Language via Scalable Inverse Reinforcement Learning , url =. Advances in Neural Information Processing Systems , doi =

  22. [22]

    Indistinguishability Beyond Diff-Equivalence in ProVerif , year=

    Cheval, Vincent and Rakotonirina, Itsaka , booktitle=. Indistinguishability Beyond Diff-Equivalence in ProVerif , year=

  23. [23]

    arXiv preprint arXiv:2606.20470 , year=

    Analyzing Defensive Misdirection Against Model-Guided Automated Attacks on Agentic AI Systems , author=. arXiv preprint arXiv:2606.20470 , year=

    Pith/arXiv arXiv

  24. [24]

    34th USENIX Security Symposium (USENIX Security 25) , pages=

    Cloak, Honey, Trap: Proactive Defenses Against \ LLM \ Agents , author=. 34th USENIX Security Symposium (USENIX Security 25) , pages=

  25. [25]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Reinforced multi-teacher knowledge distillation for efficient general image forgery detection and localization , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  26. [26]

    , title =

    Tian, Yijun and Han, Yikun and Chen, Xiusi and Wang, Wei and Chawla, Nitesh V. , title =. 2025 , isbn =. doi:10.1145/3701551.3703577 , booktitle =

    arXiv 2025

  27. [27]

    CODI : Compressing Chain-of-Thought into Continuous Space via Self-Distillation

    Shen, Zhenyi and Yan, Hanqi and Zhang, Linhai and Hu, Zhanghao and Du, Yali and He, Yulan. CODI : Compressing Chain-of-Thought into Continuous Space via Self-Distillation. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. 2025. doi:10.18653/v1/2025.emnlp-main.36

    doi:10.18653/v1/2025.emnlp-main.36 2025

  28. [28]

    arXiv preprint arXiv:2605.22166 , year=

    Adapting the interface, not the model: Runtime harness adaptation for deterministic llm agents , author=. arXiv preprint arXiv:2605.22166 , year=

    Pith/arXiv arXiv

  29. [29]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Shadows in the Code: Exploring the Risks and Defenses of LLM-based Multi-Agent Software Development Systems , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  30. [30]

    C hat D ev: Communicative Agents for Software Development

    Qian, Chen and Liu, Wei and Liu, Hongzhang and Chen, Nuo and Dang, Yufan and Li, Jiahao and Yang, Cheng and Chen, Weize and Su, Yusheng and Cong, Xin and Xu, Juyuan and Li, Dahai and Liu, Zhiyuan and Sun, Maosong. C hat D ev: Communicative Agents for Software Development. Proceedings of the 62nd Annual Meeting of the Association for Computational Linguist...

    doi:10.18653/v1/2024.acl-long.810 2024

  31. [31]

    arXiv preprint arXiv:2603.24414 , year=

    Clawkeeper: Comprehensive safety protection for openclaw agents through skills, plugins, and watchers , author=. arXiv preprint arXiv:2603.24414 , year=

    arXiv

  32. [32]

    arXiv preprint arXiv:2605.08741 , year=

    Training with Harnesses: On-Policy Harness Self-Distillation for Complex Reasoning , author=. arXiv preprint arXiv:2605.08741 , year=

    Pith/arXiv arXiv

  33. [33]

    arXiv preprint arXiv:2607.15524 , year=

    Recursive Harness Self-Improvement , author=. arXiv preprint arXiv:2607.15524 , year=

    Pith/arXiv arXiv

  34. [34]

    Proceedings of the 34th USENIX Conference on Security Symposium , articleno =

    He, Yu and Li, Boheng and Liu, Liu and Ba, Zhongjie and Dong, Wei and Li, Yiming and Qin, Zhan and Ren, Kui and Chen, Chun , title =. Proceedings of the 34th USENIX Conference on Security Symposium , articleno =. 2025 , isbn =

    2025

  35. [35]

    33rd USENIX Security Symposium (USENIX Security 24) , year =

    Yupei Liu and Yuqi Jia and Runpeng Geng and Jinyuan Jia and Neil Zhenqiang Gong , title =. 33rd USENIX Security Symposium (USENIX Security 24) , year =

  36. [36]

    Agents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks

    Shahroz, Rana and Tan, Zhen and Yun, Sukwon and Fleming, Charles and Chen, Tianlong. Agents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2025. doi:10.18653/v1/2025.acl-long.476

    doi:10.18653/v1/2025.acl-long.476 2025

  37. [37]

    arXiv preprint arXiv:2412.19437 , year=

    Deepseek-v3 technical report , author=. arXiv preprint arXiv:2412.19437 , year=

    Pith/arXiv arXiv

  38. [38]

    arXiv preprint arXiv:2505.09388 , year=

    Qwen3 technical report , author=. arXiv preprint arXiv:2505.09388 , year=

    Pith/arXiv arXiv

  39. [39]

    arXiv preprint arXiv:2502.08680 , year=

    Mathematical reasoning in large language models: Assessing logical and arithmetic errors across wide numerical ranges , author=. arXiv preprint arXiv:2502.08680 , year=

    Pith/arXiv arXiv

  40. [40]

    Advances in Neural Information Processing Systems , volume=

    Mmlu-pro: A more robust and challenging multi-task language understanding benchmark , author=. Advances in Neural Information Processing Systems , volume=

  41. [41]

    GAIA: a benchmark for General AI Assistants , url =

    Mialon, Gr\'. GAIA: a benchmark for General AI Assistants , url =. International Conference on Learning Representations , editor =