PaperlayerView exact revision on arXiv

Source-linked AI summary

What Survives Self-Evolution: Provenance Marks in Copied Agent Harnesses

Jieyu Li, Jingya Li, Sheng Li, Xinpeng Zhang, Zhenxing Qian

arXiv:2610.21458v1cs.CR

TL;DR

Agent harnesses can leak and be repurposed through self-evolution, raising the question of whether provenance marks survive rewrites selected for task performance. The paper measures existing marks and develops a keyed table-order mark, finding that outcomes vary with proposer behavior and that the new mark is detectable in many held-out copies.

  • Problem

    The paper asks whether provenance marks can identify leaked agent harnesses after a self-evolver rewrites their prompt or tool code and selects rewrites by task score.

    Source: §1 · p. 1

  • Method

    The authors test marks across three evolvers, five proposers, and two environments, then encode a key in the near-tie order of a public-game-derived table read through agent actions.

    Source: §1 · p. 2, §2 · p. 3, §3 · p. 3

  • Results

    Published marks failed under GEPA (KGW 0 of 12; AgentMark as released 5 of 12), while the new mark was detected in 62 of 76 held-out copies whose lineage rewrote its file.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Proposer behavior strongly shapes mark survival, and selection protects a carrier only when each decision uses enough games.

    Source: §1 · p. 2

    The positive result rests on one environment and one carrier type, and the authors have not surveyed how often real harnesses contain an observable, data-derived near-tied table.

    Source: Limitations · pp. 8–9

Abstract

from arXiv · show

Agent harnesses, the prompt and tool code around a base model, leak. Claude Code's 512,000 lines were mirrored within hours of a packaging error. A plagiarist can pass a leaked harness through a published self-evolver and ship the result as its own. We define this as a covert rewriting attack. No one targets a provenance mark, yet a large language model (LLM) proposer rewrites the file that carries it and a score keeps the better rewrites. We give the first measurement of marks under this attack, with three evolvers, five proposers and two environments. Published marks fail. KGW in the prompt survives GEPA's rewrites in 0 of 12 copies, AgentMark as released in 5 of 12. The proposer's habits decide survival, by two orders of magnitude across models, and selection protects a mark only when each decision sees enough games. We then build a mark for this attack. Its key is the order of near-tied entries of a table of where objects are found, built from public games, so deleting the table costs success, rewrites that keep its rows keep the order, and a customer reads the key from the agent's actions alone. On held-out games it is detected in 62 of 76 copies whose lineage rewrote its file. A scheme-aware plagiarist reshuffles the ties at no measurable cost, and a plagiarist who asks the proposer for more general code removes the key in 75-100% of rewrites.

1 Introduction

The paper measures whether provenance marks survive covert rewriting by self-evolving agent harnesses. Published marks often fail, while survival depends on proposer behavior and the new mark’s design.

1 Introduction

  • A covert rewriting attack occurs when an LLM proposer rewrites a mark-bearing harness without targeting the mark, while task scores select which rewrites remain.The owner seeks to identify a deployed agent’s descent from a harness using a mark read from the agent’s actions.Source: §1 · p. 1
  • KGW in GEPA’s template survived 0 of 12 copies, while AgentMark as released survived 5 of 12; moving its code to the tool file raised survival to 9 of 12.The released AgentMark result reflects an integration failure because GEPA stored its two-file layout as one unloadable file.Source: §1 · p. 2
  • The paper reports the first measurement of provenance marks under self-evolution, covering three evolvers, five proposers, two environments, six mark designs, and 96 later runs.The measurement includes a held-out test and a survival account, h = r · d · A.Source: §1 · p. 2
  • A keyed table kept 0.999 of its order per rewrite under Llama-3.3-70B, versus 0.002 under gpt-oss-120b; selection protected a carrier only when decisions saw enough games.The paper attributes survival differences primarily to proposer behavior.Source: §1 · p. 2
  • The new mark keys near-tied rows in a table built from public games; held-out detection found it in 62 of 76 copies whose lineage rewrote its file.A scheme-aware plagiarist could reshuffle the ties at no measurable cost.Source: §1 · p. 2

2 Threat model

The threat model treats a leaked harness as a seed that a plagiarist evolves on its own tasks and serves under its own name. The owner verifies provenance through customer-visible behavior, without access to the deployed code.

2 Threat model

  • The plagiarist starts from a leaked prompt-and-tool package, evolves it for task performance, and serves the best candidate as its own.The owner commits to a secret key before release and seeks evidence of descent at a bounded false-positive rate.Source: §2 · p. 2
  • An unmodified published evolver uses an LLM proposer to rewrite prompt and tool code, retaining higher-scoring rewrites without being told about the mark.A verifier interacts as a customer, observes actions rather than code, and tests the key against other keys.Source: §2 · p. 3
  • The tested scope is processing blind to the mark; protection against a scheme-aware adversary is excluded because public-game near-ties can be recomputed and reshuffled at no measurable cost.The plagiarist may also add its own request to the evolver’s objective or serve the copy on another base model; both are tested.Source: §2 · p. 3

3 Experimental setup

The experiments compare evolvers, proposers, marks, and customer-side detection across ALFWorld and telecom tasks. The setup also models how proposal schedules, mark loss, and selection affect carrier survival.

3 Experimental setup

  • HarnessX rewrites prompts, processors, and tools and accepts non-regressing rounds; GEPA edits components and selects by game scores, while ShinkaEvolve patches tool files and deploys its best program.GEPA uses 3-game minibatches for strict acceptance and 40 validation games; ShinkaEvolve deploys using 20 games.Source: §3 · p. 3
  • ALFWorld tests object-finding and placement, while telecom tasks ask an agent to restore a customer’s phone service through checks and fixes.The agent and user simulator use Qwen3.6-35B-A3B; proposer models have their own sampling defaults, so proposer differences include sampling settings.Source: §3 · p. 3
  • LIKELY_PLACES orders receptacle kinds within frequency buckets using a key, based on 3,493 ALFWorld training games; the table adds +0.046 evaluation success over default order.The keyed order within buckets has no measurable value; only deleting the table costs the plagiarist.Source: §3 · p. 3
  • The verifier reads environment actions or customer-run checks, compares observed sequences with key predictions, and tests against 199 other keys using p ≤ 0.01 for detection.Held-out detection of a deployed copy is the primary endpoint; the baselines include KGW, AgentMark’s SDK, and PromptCOS’s embedding.Source: §3 · pp. 3–4
  • The survival account assigns carrier-touch probability r, mark-loss probability d, and acceptance probability A; one proposal loses the mark with probability h = r · d · A.Here r is set by the evolver schedule, d is measured with selection off, and A depends on mark fitness, games per decision, parent success, and acceptance rule.Source: §3 · p. 4
  • The selection model weights different carrier-loss modes by their relative acceptance, but assumes loss and beatability are independent; GEPA’s final pick and ShinkaEvolve’s archive fall outside the lineage account.In the runs, the named table was lost more often when the parent could be beaten: 0.130 against 0.057†.Source: §3 · p. 4

4 Results

Across the tested evolvers, whether a provenance mark survives depends on selection conditions and proposer behavior. The keyed prior was detected in most deployed copies whose lineage rewrote its file, but survival varied across proposers and rewrite settings.

4.1 Selection and games per decision

  • At 3 games per decision, accepted edits carried 29 losses versus 30.2 predicted; at 10 games, the ratio was 0.14 (0.00–0.34), and at 30 games the final validation pick retained the table in deployed lineages.At 10 games, most deletions involved a broken file, while the fitness-neutral order table was also filtered.Source: §4.1 · pp. 4–5

4.2 Proposer behaviour

  • Proposer behavior varied: gpt-6-luna pruned tables but kept the tie order in retained rows, while gpt-oss often elided the table and GEPA stored the elided file.Qwen3.6 lost the index-encoded table more often than the named version under GEPA and ShinkaEvolve full rewrites; comments affected loss rates differently by proposer.Source: §4.2 · pp. 5–6

4.3 Deployed copies on held-out games

  • Across all 132 keyed copies with J ≥1, including placement and comment runs, none of the 12 whose key order was gone from every table were detected, while 114 of 120 retaining it were.Source: §4.3 · p. 6

4.4 Prospective tests

  • In prospective runs, Model B scored 0.126 versus Model A’s 0.151 on Qwen3.6 deployed lineages, but did not beat the constant-survival baseline; 11 of 12 further-run copies were detected.On shifted tasks, all six named-table copies and four of six index-table copies kept the key.Source: §4.4 · pp. 6–7

4.5 Baselines and placement

  • KGW in the template survived 0 of 12 GEPA copies, while AgentMark as released was detected in 5 of 12; the keyed prior was detected in 11 of 12 copies with its code in the find-defining file.The AgentMark result is described as an integration failure; its detection rose to 9 of 12 with code in that file.Source: §4.5 · p. 7

5 Analysis

The verifier can detect evolved copies from the agent’s actions, but detection requires sufficient observations and depends on whether rewrites preserve the key. Laundering requests can remove the table, while a scheme-aware plagiarist can reshuffle its ties at no measurable cost.

5.1 Verifier requirements

  • At 40 games, prospective Qwen3.6 copies were detected with probability 0.80–0.98, rising to 0.85–1.0 at 80 games; the same 47 of 50 gpt-oss-agent GEPA copies were detected.Inferring receptacle kinds from visits detected 109 of 111 copies retaining the key, with one false flag among 432 negative tests.Source: §5.1 · p. 7

5.2 Laundering and other requests

  • A request for more general code caused Qwen3.6 to lose the table by content in 75–100% of rewrites and gpt-6-luna to lose it in every rewrite.Without that request, the reported loss rates were 7% and 31%, respectively.Source: §5.2 · p. 7

5.3 Cost of removing the key

  • A scheme-aware plagiarist reshuffled tied entries at no measurable cost, while an unaware proposer that deleted or recreated the table reduced success by 0.046 or 0.073.Reestimating the table from 175 or more public games cost at most 0.004.Source: §5.3 · p. 7

6 Design rules for a surviving mark

A mark survives an unaware evolver only when proposers preserve it and selection has a reason to retain it. The observed rules apply within a measured regime, with specific settings where they could not be tested.

6 Design rules for a surviving mark

  • A mark survives an unaware evolver when proposers preserve it and selection has a reason to keep it.The reported regime used strict acceptance on 3–30 games, carriers worth up to 0.13, and parents near 0.88.Source: §6 · pp. 7–8
  • The rules could not be tested in telecom, where the checklist had no measurable value and GEPA changed it in all 38 accepted tool edits, or in cooking games, which lacked near-ties.In telecom, only the copy with J = 0 was detected, confounding Rule 5 with the checklist’s lack of value.Source: §6 · p. 8

7 Related work

Prior work studies marks under other edits and transformations, while this paper examines them under self-evolution. Its design rules connect carrier choice and proposer behavior to whether a mark survives.

7 Related work

  • Prior software and data watermarking embeds keys in program transformations, generated tokens, execution traces, or choices among equally good solutions.Marks in names and equivalent patterns survive LLM rewriting in 0.0–1.6% of cases (Choi et al., 2026); utility-coupled marks can fall to targeted removal.Source: §7 · p. 8
  • The design rules recommend making the carrier legible, hiding the key in near-tied row order, keeping the carrier short, tying it to fitness, avoiding frequently rewritten content, and testing likely proposers.Same-bucket pair order was retained at 95.2–99.7% in edited or pruned tables; a provenance comment reduced accepted edits losing the index table from 20 of 68 to 6 of 50.Source: §7 · p. 8
  • Earlier marks were tested against token removal, rewritten observations, paraphrase, or fine-tuning, but none faced an evolver.The cited work includes prompt and agent marks (Yao et al., 2024; Yang et al., 2026; Huang et al., 2026) and fingerprints (Xu et al., 2024).Source: §7 · p. 8
  • Self-evolution spans prompts, programs, workflows, and agent code, while evolvers differ in what they rewrite, how they accept edits, and how many tasks inform decisions.With small selection sets, gains can be hard to distinguish from noise (Kozyrev et al., 2026; Wang et al., 2026).Source: §7 · p. 8

8 Conclusion

The proposer largely determines what a copied harness retains, while selection protects a carrier with fitness only when decisions see enough games. The keyed table’s order survived several unaware rewriting behaviors and could be read from customer-visible actions.

8 Conclusion

  • The proposer largely determines what a copied harness keeps, while selection protects a carrier with fitness only when decisions see enough games.A scheme-aware plagiarist reshuffled the ties at no measurable cost.Source: §8 · p. 8
  • A key in the tie order of a data-derived table survived proposers that copied, edited, pruned, or renamed it, and was read from customer-visible actions.On held-out games, it was detected in 62 of 76 copies whose lineage rewrote its file.Source: §8 · p. 8

Limitations

The positive result is limited to one environment and one carrier type, and the experiments leave several settings and deployment conditions unmeasured.

Limitations

  • The positive result rests on the ALFWorld search prior, and the study does not establish how often real harnesses contain an observable, data-derived table with near-tied entries.The telecom checklist had no measurable value and was rewritten at nearly every edit; cooking games had no near-ties, so neither tested the design rules.Source: Limitations · pp. 8–9
  • Proposer comparisons include differing sampling settings, and coding-agent evolvers that edit through tools were not tested.ShinkaEvolve and HarnessX ran only with Qwen3.6 as proposer, while gemma was used only in assays.Source: Limitations · p. 9
  • The study does not measure survival after many accepted rewrites or under evolvers that deploy the latest candidate.Most GEPA lineages had one or two accepted rewrites of the marked file, and GEPA still deployed early candidates with three times as many proposals.Source: Limitations · p. 9
  • The verifier was tested on one shifted task distribution and observes environment actions on 40–80 games, leaving broader deployment scenarios untested.Many owners of one public dataset, screening many suspects, and per-licensee keys were also untested.Source: Limitations · p. 9

Ethical Considerations

The paper bounds what behavioral detection can establish and flags the risk that provenance-preserving edits could also preserve malicious code. It reports experiments on public benchmarks with simulated users and documents setup choices and deviations.

Ethical Considerations

  • A behavioral match to the owner’s key does not by itself establish ownership: the owner must commit the key before release and test it against many keys.Independently built harnesses using the same public data can rarely trigger an owner’s key.Source: Ethical Considerations · p. 9
  • A keep instruction can preserve malicious components through evolution and acts as an indirect prompt injection, so the authors report its measured effect without recommending it.Defenses against injection may suppress it, and the authors did not test license notices or a command check under evolution or for other safety code.Source: Ethical Considerations · p. 9
  • Experiments use public benchmarks with simulated users and collect no personal data; released materials are anonymized except episode logs, candidate pools, and evolvers’ state files.The latter unreleased exceptions are among the supplementary software and data materials described by the authors.Source: Ethical Considerations · p. 9

A Setup and deviations

  • Unless stated otherwise, Qwen3.6-35B-A3B is both agent and thinking proposer, and ALFWorld runs use the strong template.The appendix indexes evolver settings, adapter changes, failure paths, models, and deviations; local models use their own sampling defaults.Source: A Setup and deviations · p. 13
  • A split-numbering mismatch affected 72 prospective runs; excluding 13 iterations involving failed episodes barely changed estimated accepted-edit loss of the index table (0.162 to 0.168).The affected deployed lineage became a candidate with J = 2 that kept the table; the held-out test used none of the overlapping games.Source: A Setup and deviations · p. 14

B Marks and detection

The keyed prior encodes a secret order among near-tied receptacle kinds, and a verifier detects that order from an agent’s actions. On held-out games, detection tracks whether copies retain the key, while tests against many keys bound false ownership claims.

B Marks and detection

  • The keyed prior orders receptacle kinds within near-tied probability buckets, embedding a key in the object-location table while preserving its fitness-bearing order.The table is estimated from 3,493 ALFWorld training games; its keyed order reduced offline visits before the target from 4.31 to 2.05–2.14 receptacles.Source: B Marks and detection · p. 15
  • The verifier compares action-derived sequences with key predictions and detects at empirical p ≤0.01 against 199 other keys; the frequency-order control matched in 42 of 116 searches (p = 0.33).The neutral package matched in 18 of 130 searches (p = 0.24), versus 85 of 128 for the keyed prior.Source: B Marks and detection · p. 15
  • With 100,000 keys, all 278 detected programs reached p ≤9 × 10^-5 except two laundered files whose table gpt-6-luna pruned; the undetected programs had p ≥0.012.At 40 games, owners were detected in 0.96 of subsets on average.Source: B Marks and detection · p. 16
  • Random-key claimants passed the 199-key rule in 0.77% of tests at 134 games and 0.54% at 40; independent use of the same public data also produced some flagged comparisons.At p ≤0.01 against 100,000 keys, 47 same-data comparisons were flagged, while none were flagged at p ≤10^-3 or 10^-4.Source: B Marks and detection · p. 16
  • 114 of 120 copies retaining some keyed-prior content were detected on held-out games, while none of the 12 copies whose key was gone by content were detected.The six misses among key-retaining copies involved unread tables, altered search behavior, pruning, or an index table cut to 0.08.Source: Table 5 · p. 16, B Marks and detection · p. 16
  • Using only an agent’s visits to infer receptacle kinds, the verifier detected 109 of 111 copies retaining the key under its name and flagged 1 of 432 tests of programs that never carried it.It also detected 1 of 12 copies whose key was gone by content, exceeding the registered limit for that group.Source: B Marks and detection · p. 16

C Proposer assays

Proposer behavior and rewrite format strongly affect whether the keyed table survives, while comments and instructions can alter some models’ rewrite behavior. Selection favors retaining carriers more reliably when decisions use larger game batches, and validation-pool size affects which candidate is deployed.

C Proposer assays

  • With Qwen3.6, index encoding lost the prior table in 52.5% of rewrites versus 16.1% with names, and whole-file rewrites dropped tables more often than local edits.Whole-file rewrites dropped the named table in 5 of 22 and the index table in 35 of 45, versus 3 of 85 and 16 of 63 local edits.Source: C Proposer assays · p. 17
  • For Qwen3.6’s index table, an unrelated comment had no detectable effect (+6.5 points versus no comment), while a keep instruction cut deletion to a fifth (−43.7 points); provenance also protected identical INSTANCE_ORDER (47.5% to 25.2%).Source: C Proposer assays · p. 17
  • On the same items and parents, ShinkaEvolve diff patches lost the prior table in 0.7% of name and 6.7% of index rewrites, versus 45.8% and 78.9% with full rewrites.Source: C Proposer assays · p. 18
  • Under the tool-only prompt, Qwen3.6 lost the named table in 3.7% of rewrites when the package included a license notice and command check, versus 10.1% without them.The check survived in 88% of Qwen3.6 rewrites; gpt-oss kept it in 98% while eliding the table in every rewrite.Source: C Proposer assays · p. 18

D Selection

  • At minibatch 3, accepted edits lost the prior table in 8 of 40 cases versus 49 of 318 proposals; at minibatch 10, the corresponding counts were 1 of 29 versus 31 of 123.The estimated per-proposal hazard was 2.5% at minibatch 3 and 0.8% at 10; no pairwise hazard difference reached 0.05 under whole-root permutation.Source: D Selection · p. 19
  • On fresh games, deleting proposals were accepted 0.81, 0.66, and 0.51 times as often as keeping proposals at minibatches of 3, 10, and 30 games, respectively.Predicted acceptance of deletions also fell from 0.27 at n = 3 to 0.10 at n = 30.Source: D Selection · p. 19
  • For the prior table, the chance that the highest-mean validation candidate carried it rose from 0.954 with 5 games to 1.000 with 40, against a pool share of 0.823.GEPA’s reflection prompt shows only the current candidate, leaving a deleted carrier with no route back except a file repair.Source: D Selection · p. 19

E Prospective tests and prediction ledger

The prospective tests compare frozen survival predictions with accepted edits and deployed lineages, including longer runs and laundering. Model B generally outperforms or ties Model A, but its predictions are too pessimistic for index-table survival in longer runs.

Prospective tests and prediction ledger

  • Brier scores show B beats or ties A in every group, but the exploratory constant C does not lose to either model in the first test and beats both on longer runs.C is fitted to outcomes and is a reference scale, not a prediction.Source: E Prospective tests and prediction… · p. 19, Table 10 · p. 20
  • On longer runs, index-key loss was 0.15 by name and 0.08 by content, against B’s prediction of 0.37 by name; B was calibrated where it predicted survival but too pessimistic for index tables.For the literal endpoint, lineages in the 0–0.2 prediction bin kept the carrier in 5 of 7 cases, versus 0.83 in the 0.4–0.6 bin and 0.95 in the 0.8–1 bin.Source: E Prospective tests and prediction… · p. 20
  • Selection reduced the Brier score by 0.013 on deployed lineages, with the improvement carried by 30-game conditions.On single accepted edits, B’s frozen log-likelihood advantage over A largely offset an overestimated frozen proposer-loss rate.Source: E Prospective tests and prediction… · pp. 20–21
  • At 30 games, accepted edits lost the index key less often than B predicted, while all 20 accepted laundering edits renamed LIKELY_PLACES but kept its rows and key by content.All eight deployed laundering copies were detected; B’s frozen prediction held by name but failed by content.Source: E Prospective tests and prediction… · p. 21
  • The prediction ledger records registered predictions and outcomes, while 14 of 31 tests remained below 0.05 after correction.Some tests were exploratory; the minibatch-10 broken-file result and deletion-cost estimate were among the findings supported by intervals excluding zero or close agreement.Source: E Prospective tests and prediction… · p. 21

F Deployed copies and the held-out test

Across deployed copies and adversarial operations, detection depends on whether the key’s ordered rows remain behaviorally visible. Detection varies with query budget and mark design, while proposer instructions and benchmark setting can change whether the mark survives or is useful.

F Deployed copies and the held-out test

  • Detection rose with query budget: for strong-template GEPA copies, the keyed prior was detected with probability 0.04 at k = 5, 0.68–0.74 at k = 20, and 0.97–0.98 at k = 40.INSTANCE_ORDER detection reached 0.82–0.92 at k = 40; the neutral package’s INSTANCE_ORDER reached 1.0.Source: F Deployed copies and the held-out test · p. 22
  • On held-out games, intact prior tables and INSTANCE_ORDER carriers were always detected, while deleted, broken, or removed carriers were never detected; 169 of 172 copy–carrier pairs agreed with the key endpoint.The 134-game test also found cases where retained rows were no longer read in key order, including a rewritten search iterating rows as a set.Source: F Deployed copies and the held-out test · p. 21, Table 13 · p. 24

G Plagiarist operations

  • In one-shot laundering, Qwen3.6 often renamed LIKELY_PLACES while preserving its row order, whereas gpt-6-luna and gpt-oss rebuilt files and dropped or pruned rows; 17 of 24 Qwen3.6 files kept at least half the key, and 11 were detected.Among 35 files keeping no key pair in a table of at least five rows, none was detected.Source: G Plagiarist operations · p. 25
  • Requests for more general or cleaner code removed the key more often than the no-request control: Qwen3.6 retained 0.25 and 0.02 of the key under the more-general request, versus 0.93 and 0.69 without a request.Under clean-up, Qwen3.6 lost the table by content in 94% and 100% of rewrites; gpt-6-luna kept less than 0.3 of the key under either request.Source: G Plagiarist operations · p. 25

H Baselines

  • GEPA retained KGW in 0 of 12 whole-template rewrites, while AgentMark’s released two-file package survived in 5 of 12 copies; its one-file control avoided the file-layout failure.KGW remained detectable in 21 of 24 piecewise HarnessX rounds; with parsing fixed, AgentMark code survived in every deployed copy, though detection could still fail when behavior or logs changed.Source: H Baselines · pp. 26–27

I The table’s value and where the rules could not be tested

  • Across 140 evaluation games, keyed prior exceeded default-order find by +0.046 success; on 1,000 train games, keyed versus frequency-order success was −0.004 (−0.015 to 0.007), above the prespecified −0.02 margin.Source: I The table’s value and where the… · p. 27

Related papers

Loading 2610.21458v1…