Search papers, labs, and topics across Lattice.
This paper introduces Agent Harness Distillation (AHD), a framework that investigates the security risks associated with inference-time harness extraction in autonomous multi-agent systems (AMAS) built on large language models. By formalizing harness extraction as a new security problem, the authors demonstrate that substantial intellectual property leakage can occur through black-box interactions, revealing vulnerabilities in the dynamic behavior of AMAS during inference. Additionally, they propose a deception-based defense mechanism that mitigates these risks while maintaining the operational utility of the protected agents.
Substantial IP leakage risks in autonomous multi-agent systems are revealed through a novel framework that extracts harness capabilities dynamically during inference.
Autonomous multi-agent systems (AMAS) built on large language models (LLMs), such as Hermes, increasingly rely on inference-time harnesses to coordinate reasoning and action. Constructing these harnesses requires substantial engineering effort and computational resources, as they are iteratively optimized over a combinatorial search space while co-evolving with the underlying LLM. Inference-time harnesses therefore constitute valuable intellectual property (IP). Although prior work has investigated IP leakage in static multi-agent systems with pre-configured architectures, it remains unclear whether similar risks arise in AMAS, where harness behavior emerges dynamically during inference. To address this gap, we introduce Agent Harness Distillation (AHD), a framework for studying the security risks arising from inference-time harness extraction in AMAS. We formalize harness extraction as a new security problem and develop an evaluation framework for quantifying such risks. AHD extracts inference-time harness capabilities from a target agent through black-box interactions and consists of two stages. In the pre-distillation stage, AHD infers inference-time harness behaviors from the responses of the target agent and constructs an initial harness. In the post-distillation stage, AHD iteratively refines the initial harness to align with the behavioral patterns of the target agent. Experiments on real-world AMAS across multiple backbone LLMs demonstrate the effectiveness of AHD and reveal substantial IP leakage risks. We further propose a deception-based defense that reduces harness extraction effectiveness while preserving the utility of the protected agent. Our findings uncover a previously underexplored security threat to AMAS.
Tsinghua AI