REVEAL: Reverse Engineering Agentic Latents from Frontier-Model Traces

Yuetian Du; Meng Wang; Yucheng Wang; Zhangzhe Chen; Wei Wang; Boyu Yang; Weiqi Zhai; Bing Zhao

cs.AIOct 12, 2026

REVEAL: Reverse Engineering Agentic Latents from Frontier-Model Traces

Authors: Yuetian Du, Meng Wang, Yucheng Wang, Zhangzhe Chen, Wei Wang, Boyu Yang, Weiqi Zhai, Bing Zhao,

Organizations: Zhejiang University · South China University of Technology · Alibaba Group · Fudan University ·

Abstract

Frontier LLM agents perform complex interactive tasks, but their inference costs motivate transferring their experience to smaller open-source agents. Distillation and latent communication typically require target-model training or access to source-model internals. We study how textual frontier-model trajectories can provide reusable local controls for a frozen agent. Inspired by protocol reverse engineering, we introduce $\textit{Agentic Latents}$ , comprising anchored states and dynamic profiles of feedback--response cycles elicited by replay in the target model. Our training-free framework, $\textbf{REVEAL}$ ( $\textbf{REV}$ erse $\textbf{E}$ ngineering $\textbf{A}$ gentic $\textbf{L}$ atents), uses these profiles and trajectory outcomes to match and select local events from successful and failed rollouts of the same task and source model. Their response-transition contrasts yield a target-specific steering direction, applied before each response. Within-benchmark evaluations on Terminal-Bench 2.1 and Humanity's Last Exam with tools report higher accuracy than unmodified agents across three targets. Representation analyses and behavioral case studies support reusing frontier-model experience as local activation control.

Figures & tables

Figure 1: Three routes for reusing frontier-model experience: (1) feature distillation trains on internal states; (2) black-box distillation trains on textual trajectories; (3) REVEAL characterizes Agentic Latents through frozen target-model replay of textual trajectories and derives steering directions.

Figure 2: REVEAL reconstructs activation control from textual frontier-model trajectories. (a) Frozen replay yields Agentic Latents: anchored states and dynamic profiles. (b) Contrastive sample selection identifies matched local events; steering vector calculation combines their response-transition differences through hierarchical averaging. (c) The frozen target applies the resulting direction before each response.

Qwen3.6-27B
Method	Terminal-Bench 2.1				HLE w/ Tools
	Easy	Medium	Hard	All	Math	Phys.	Chem.	Bio/Med.	CS/AI	Eng.	Hum./Soc.	Other	All
Vanilla	75.00	43.64	10.00	33.71	24.65	14.00	13.33	20.93	12.70	15.79	12.00	4.44	18.00
Prompt-Reg	100.00	38.18	20.00	34.83	28.37	12.00	13.33	27.91	17.46	15.79	14.00	4.44	20.80
REVEAL-Base	75.00	41.82	20.00	35.96	27.91	20.00	20.00	20.93	19.05	10.53	12.00	6.67	21.00
REVEAL (Ours)	100.00	47.27	16.67	39.33	29.30	16.00	20.00	23.26	19.05	10.53	16.00	8.89	22.00

Table 1: Main agent performance (accuracy, %). Shading is normalized within each column; darker cells indicate higher scores. Within each model block, the best and second-best All scores are bold and underlined, respectively.

	Accuracy (%) $\uparrow$				Online tokens (k) $\downarrow$		Interactions $\downarrow$		Target training
Method	Easy	Medium	Hard	All	Input	Output	Rounds	Tool calls
Frontier Model	93.75	60.00	39.17	54.49	346.16	9.46	16.03	28.56	–
Vanilla	75.00	43.64	10.00	33.71	595.14	15.21	23.30	47.91	No
Vanilla + SFT	75.00	49.09	6.67	35.96	223.14	14.02	15.70	34.87	Yes
REVEAL	100.00	47.27	16.67	39.33	143.71	6.95	13.88	27.92	No

Table 2: Accuracy and online interaction costs on Terminal-Bench 2.1. The row in gray reports the frontier model’s mean pass@1 over four rollouts per task; the remaining rows use Qwen3.6-27B. Token and interaction costs are means per task. Bold values indicate the best results among the three target-model methods.

Figure 3: Endpoint approximations of mean response displacement across three models and two benchmarks; points and bars show task-balanced means and 95% task-bootstrap intervals. Layers 23, 22, and 8 are used for Qwen, Gemma, and GPT-OSS, respectively.

Figure 4: Layerwise representation profiles on Terminal-Bench with pointwise 95% task-bootstrap intervals; dashed and solid

C

curves denote response-start and response-end projections.

Figure 5: Cross-model Spearman correlations of trajectory-level $U$ and $S$ across depth bands, before and after task centering on matched trajectories. E/M/L denote early/middle/late bands.

Figure 6: A case study. REVEAL and the frontier reference compare alternative token-counting operations, whereas Vanilla finalizes without testing the recognized ambiguity.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 7: Dual endpoints versus individual response anchors, stratified by response length. Positive values indicate higher cosine similarity or lower relative error against the full-response mean displacement. Bars show paired 95% task-bootstrap intervals; hollow markers denote strata with fewer than three tasks.

Figure 8: Full-depth HLE profiles with pointwise 95% task-bootstrap intervals. Dashed and solid

C

curves mark response start and end, respectively.

U/C/V

use 1,303 tasks;

S

uses 1,091 with valid adjacent updates. Only horizontal depth is rescaled;

V

excludes unsupported final layers.

Figure 9: Within-response retention at layers 23/22/8 for Qwen/Gemma/GPT-OSS. Lines show 20 relative-position bin means; separate diamonds mark the response-start and response-end anchors. All recorded events with at least 20 content tokens are included. Shading and bars show 95% task-bootstrap intervals.

Figure 10: Task-balanced $V$ and Recall@50 across early/middle/late depth bands on Terminal-Bench and HLE, using supported J-lens layers. Panels use separate linear scales; uniformly random vocabulary ranking has expected $V=0.5$ .

Figure 11: Cross-model correlations of same-task success–failure contrasts before and after adjustment for response length and analysis-center count. E/M/L denote early/middle/late depth bands. Every panel uses the same 34 Terminal-Bench and 208 HLE tasks; $\Delta U$ provides the update-magnitude comparison.

Activation Steering

Activation steering changes model behavior by intervening directly on internal representations during inference, often without updating weights.

See all 376 papers

Profiling a Frontier Agent with EBench: From Direct Control to Harness with Policy
Oct 26, 2026Yifei Yao, Yude Zou, Guanbo Jiao +12Language Model-Based Control Robotic Policy Evaluation
Shanghai Artificial Intelligence Laboratory · Shanghai Jiao Tong University · Fudan University +1
OpenSeeker-v2: Pushing the Limits of Search Agents with Informative and High-Difficulty Trajectories
May 5, 2026Yuwen Du, Rui Ye, Shuo Tang +4Supervised Fine-Tuning Tool-Augmented Language Model Agents
1Shanghai Jiao Tong University
Structured Distillation of Web Agent Capabilities Enables Generalization
Apr 9, 2026Xing Han Lù, Siva ReddyLLM Agent Training Web Agents
Mila – Quebec AI Institute McGill University

Oct 26, 2026J/K move · Enter open · S save

Profiling a Frontier Agent with EBench: From Direct Control to Harness with Policy

Yifei Yao, Yude Zou, Guanbo Jiao, Xing Gao+11

Shanghai Artificial Intelligence Laboratory · Shanghai Jiao Tong University · Fudan University+1

Language Model-Based Control Robotic Policy Evaluation Multimodal Agent Evaluation LLM Agent Harnesses Embodied Agent Benchmarks

Open paper AskPDF arXiv

Frontier multimodal large language models (MLLMs) can control robots without robot-specific training, but how their capabilities compare and interact with post-trained vision-language-action (VLA) and world action model (WAM) policies across manipulation demands remains to be thoroughly evaluated. In this report, we evaluate GPT-6-Astra on EBench as the core of an agent that controls a robot through an agent harness under the same visual and proprioceptive observation protocol as post-trained policies. We study two agent configurations: direct control, in which the agent generates waypoint commands directly, and harness with policy, in which it can also invoke a post-trained VLA or WAM policy for action execution. Under direct control, the agent achieves competitive overall performance relative to post-trained policies. It leads on short-horizon tasks and exhibits the least performance variation across generalization dimensions, whereas it underperforms post-trained policies on long-horizon tasks, tabletop manipulation, and high-precision contact-rich tasks. In the harness with policy, invoking a post-trained VLA or WAM combines the complementary strengths of both components, raising overall task success to the level of the strongest compared post-trained policies while substantially reducing token cost. However, performance remains below the per-task upper bound of the standalone components due to suboptimal policy invocation, fixed-instruction execution without subgoals, and grasp disruption when the agent resumes control. Overall, our study characterizes the capability boundary of a frontier MLLM agent and suggests directions for improving future agent harness design. Project page: https://internrobotics.github.io/EBench-Astra-Tech-Report/

Abstract

Activation Steering

Explore similar work

Profiling a Frontier Agent with EBench: From Direct Control to Harness with Policy

OpenSeeker-v2: Pushing the Limits of Search Agents with Informative and High-Difficulty Trajectories

Structured Distillation of Web Agent Capabilities Enables Generalization