Auditing Harness Tampering in Self-Improving Agents

Xing Wang; Xiaoyi Zhang; Jie Shao

cs.CLAug 30, 2026

Auditing Harness Tampering in Self-Improving Agents

Authors: Xing Wang, Xiaoyi Zhang, Jie Shao

Organizations: University of Electronic Science and Technology of China

Abstract

Self-improving agents iteratively modify their own harness to push the frontier of their performance. However, such modifications can produce illusory performance gains or compromise integrity constraints such as authorization, provenance, and completeness without genuinely improving capability. We term this phenomenon as harness tampering, which extends the concept from reward and measurement tampering to the full self-improvement lifecycle. To systematically study this problem, we propose a two-axis taxonomy that categorizes each misaligned edit by the harness functional role in which it occurs and the obligation it violates. Then we build an annotated corpus by seeding tampered-benign edit pairs into the real trajectories of self-improving agents. We adapt and benchmark diverse audit methods on tampering classification and localization tasks. Finally we systematically audit real trajectories of self-improving agents. The results demonstrate that harness tampering consistently occurs in real runs from different agents, often persists in the lineage of the best agent, and forms distinct system-specific profiles across the taxonomy.

Figures & tables

Figure 1: Harness tampering: an edit hidden in

\Delta_{t}

overwrites the recorded accuracy.

Figure 2: Overview. Left: the two-axis taxonomy of functional roles and obligations. (A) We seed matched tampered–benign edits into recorded harness changes to build a labeled corpus, and evaluate prompted and trained auditors on classification and localization. (B) We apply the selected auditor to real trajectories of self-improving systems and analyze the prevalence, persistence, and profiles of the findings.

Obligation	Definition	Conceptual basis
Measurement validity	Whether a measurement supports the stated inference about its named target.	Validity theory ( Kane 2013 ) ; reward and measurement tampering ( Everitt et al. 2021 ; Roger et al. 2023 ) .
Representational fidelity	Whether an output or record matches the event, value, state, or decision it represents.	Falsified verdicts and workflow records ( Wang et al. 2026a ; Thaman 2026 ) .
Procedural integrity	Whether an edit follows procedure that governs its computation, transformation, or decision.	Integrity models ( Clark and Wilson 1987 ) ; evaluator modification ( Atinafu and Cohen 2026 ) .
Authorization and access boundaries	Whether an action and the resources it reaches remain within the permitted boundary.	Protection principles ( Saltzer and Schroeder 1975 ) ; held-out-data access ( Atinafu and Cohen 2026 ) .
Protected artifact and state integrity	Whether a protected object retains its required identity, contents, or validity.	Information integrity ( Clark and Wilson 1987 ) ; reward-code, guard-test, and protected-file modification ( Denison et al. 2024 ; Thaman 2026 ) .
Provenance and source attribution	Whether an item is associated with the correct producer, variant, run, source, and version.	Data provenance ( Buneman et al. 2001 ) ; fabricated reward records ( Wang et al. 2026a ) .

Table 1: The seven obligations, each stated as a condition that must hold; a case is labeled with the obligation whose condition is false. Cited works provide the conceptual basis, while the organization and operational tests are ours.

	Classification					Localization
Auditor	Acc.	F1	Func.	Oblig.	Cost ($)	Rec.	FPR $\downarrow$	Func.	Oblig.	Cost ($)
Random	49.6	51.0	10.7	0 8.0	n/a	0 7.6	0 8.5	0 1.3	0 1.0	00 n/a
Prompted auditors
Qwen 3.5 9B	53.7	43.8	0 6.4	11.1	00 1.7	48.2	35.2	0 7.8	13.6	00 3.6
Gemini 3.7 Flash	56.0	30.1	11.9	10.1	00 9.9	24.8	0 0.2	15.2	16.4	0 14.7
Grok 4.6	83.6	82.9	43.8	42.0	0 51.8	59.8	0 3.2	35.0	40.1	120.4

Table 2: Classification and localization performance of random, prompted, and trained auditors. Acc. and F1 denote classification accuracy and F1 score; Rec. denotes seeded recall, and FPR denotes the seeded false-positive rate. Func. and Oblig. report the accuracies of the predicted functional role and obligation, respectively. Higher is better except for FPR and cost. Cost ($) is the estimated USD cost of one evaluation run at public API prices.

System	Tampering Rate	Avg. Findings
ADAS	84.6%	1.12
AFlow	18.3%	0.18
DGM	63.1%	1.18
HyperAgents	73.6%	0.94
ScientistOne	29.6%	0.31

Table 3: Prevalence of tampering findings in the experiment runs of publicly released materials, audited with GPT 5.6 Luna. Tampering rate is the percentage of iterations containing at least one finding. Average tampering is the total number of findings divided by all iterations, including zero-finding iterations.

Figure 3: Findings carried by the best agent across iterations. Curves are averaged over runs and truncated once fewer than 60% remain active. ADAS exposes no reconstructable lineage, so its dashed line reports the overall mean.

Figure 4: When tampering findings enter the ancestry of the final best agent. Each dot marks the iteration introducing one finding, and the segment runs from the earliest finding to delivery. Empty rows are clean ancestries.

Figure 5: Composition of all tampering findings by functional role (left) and obligation (right), normalized within each system with colors fixed across systems. Totals are 145 (ADAS), 21 (AFlow), 166 (DGM), 425 (HyperAgents), and 17 (ScientistOne).

AI Agent Auditing

AI agent auditing examines agents’ actions, tool use, evidence, and outcomes to assess safety, compliance, reliability, and accountability.

See all 262 papers

Self-Authored Verification Is Unreliable in Heuristic Self-Improving Agents
Jul 27, 2026Diandian Guo, Cong Cao, Fangfang Yuan +3AI Agent Evaluation LLM Agent Self-Improvement
Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China · School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China
Self-Improvements in Modern Agentic Systems: A Survey
Jul 14, 2026Zhe Ren, Yimeng Chen, Dandan Guo +9LLM Agent Self-Improvement Self-Improving Agents
School of Artificial Intelligence, Jilin University · King Abdullah University of Science and Technology (KAUST) · Independent Researcher +2
Self-Healing Harness for Runtime Oversight of Agent Self-Modification
Sep 21, 2026Sina Tayebati, Divake Kumar, Nastaran Darabi +2Runtime Enforcement for AI Agents LLM Agent Harnesses
University of Illinois Chicago · AI Labs, Capital One

Jul 27, 2026J/K move · Enter open · S save

Self-Authored Verification Is Unreliable in Heuristic Self-Improving Agents

Diandian Guo, Cong Cao, Fangfang Yuan, Yingqi Wang+2

Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China · School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China

AI Agent Evaluation LLM Agent Self-Improvement LLM Agent Verification Self-Improving Agents

Open paper AskPDF arXiv

Self-improving agents accumulate capability by repeatedly rewriting procedural policies, controllers, or heuristic rules. They typically rely on self-authored tests or metrics to decide whether to accept subsequent edits. The agent controls both the optimized object and its verifier. As a result, self-assigned scores can remain near perfect while real deployment performance degrades or stays low. We study this problem through the verifier--deployment gap. This gap refers to the discrepancy between an agent's self-authored verification signal and a sealed deployment evaluation that the agent cannot observe or access. We ask how self-authored verification fails under iterative policy-and-test rewriting, how the failure changes with capability, and how little exogenous trust is sufficient to prevent real regressions from being deployed. To address this problem, we introduce a Sealed Exogenous Acceptance Loop (SEAL). SEAL retains self-authored tests but compares each candidate with the incumbent through a fixed harness-side audit. The agent cannot author or inspect the audit, receives only accept/reject, and the whole incumbent state is retained after a clear regression. Our experiments show that this problem often appears in heuristic learning settings. These settings require trial-and-error discovery of the target objective. We further find that failures of self-written verification are stratified by capability. Weaker agents tend to damage previously acquired strategies behind easy self-tests. Stronger agents are more stable, but they still mismeasure the deployment distribution. Standard self-written constraints do not reliably close this gap. In contrast, SEAL outperforms unprotected baselines across six models and three random seeds. Reliable self-improvement need not abandon self-verification, but it requires at least one deployment-acceptance signal outside the agent's control.

Abstract

AI Agent Auditing

Explore similar work

Self-Authored Verification Is Unreliable in Heuristic Self-Improving Agents

Self-Improvements in Modern Agentic Systems: A Survey

Self-Healing Harness for Runtime Oversight of Agent Self-Modification