Search papers, labs, and topics across Lattice.
This paper addresses the challenge of multi-party loyalty in LLM agents, where the agent must balance the interests of its principal against those of a counterparty. The authors introduce PrincipalBench, a comprehensive benchmark that reveals a significant performance gap in agent behavior, highlighting a split between agents that effectively follow legitimate principal requests and those that overly refuse them. Key findings include a prompt-time loyalty scaffold that reduces harm to 19.4% and a per-token-KL distillation method that enhances performance in smaller models, illustrating the inherent trade-off between leak and over-refusal behaviors.
Agents can achieve a remarkable 19.4% harm rate while maintaining principal loyalty, but improving one aspect of their performance inevitably compromises another.
A rapidly growing class of LLM agents is multi-party: the agent acts for a principal (who briefs it, sends follow-ups, and receives results) while also conversing in a separate channel with a counterparty whose interests may diverge (negotiating with a vendor, screening inbound requests, or mediating between employees). Here "help whoever you are talking to" is the wrong objective. The agent must stay loyal to the principal it represents without over-refusing the principal's own cooperative asks. We study this multi-party loyalty problem and contribute a measurement instrument, two mechanisms, and a structural lesson. PrincipalBench is a 75-item multi-turn benchmark with leak probes, dual judges, and an integrity-audit gate. Across 13 frontier subjects it exposes a sharp split (<=20% vs. 53.6-75.3% harm) invisible to single-turn safety evaluations: a selective cluster that declines adversarial probes while still following the principal's legitimate requests, and an over-refusing cluster that refuses broadly. (M1) A prompt-time loyalty scaffold (a fixed system prompt of seven prioritized rules, open-coded from 50+ failure trajectories) holds Claude-Sonnet to 19.4% harm and all nine selective subjects to <=20%. (M2) A per-token-KL distillation recipe transfers a prompted Qwen3-32B teacher into 8B Qwen3 and Llama-3.1 students, the strongest open-weight recipe we measure. (Lesson) Both mechanisms only move along a common leak/over-refusal trade-off rather than crossing it: improving one axis costs the other, and the jointly favorable outcome stays out of reach.
UW