What Survives Self-Evolution: Provenance Marks in Copied Agent Harnesses

The gist The first measurement of provenance marks under self-evolution shows that a key in the order of near-tied entries in a table built from public games survives covert rewriting attacks by an LLM proposer, provided selection weighs the carrier's value only when decisions see enough games.

The Threat Model

A leaked harness package, which includes the prompt template and tool code around a base model, is evolved on the plagiarist’s tasks and served as the plagiarist’s own. The plagiarist wants a high score on its tasks under its own name; the owner wants to show, at a bounded false-positive rate, that a deployed agent descends from its package. This is defined as a covert rewriting attack where no one targets the provenance mark, yet an LLM rewrites the file that carries it and a score keeps the better rewrites. The owner’s question is whether a rewritten agent served under another name descends from its harness; its recourse is a mark read back from the deployed copy as a customer, from the agent’s actions alone, and the mark answers only if it survives the rewriting.

The Mark Design

The key for this attack is the order of near-tied entries of a table of where objects are found, built from public games, so deleting the table costs success and rewrites that keep its rows keep the order. The mark is called INSTANCE ORDER, which is the order in which find and place visit numbered receptacles of a kind, permuted by the key; it has no measurable value (+0.020, −0.020 to 0.060). The verifier detects this mark by comparing a search’s sequence of kinds (keyed prior), its instance numbers (order table), or a stage’s same-bucket checks with the key’s prediction, counting matches among observations whose predictions depend on the key.

Proposer Behavior and Selection

The proposer's habits decide survival, by two orders of magnitude across models, and selection protects a mark only when each decision sees enough games. Under Llama-3.3-70B, a keyed table keeps 0.999 of its order per rewrite, whereas under gpt-oss-120b it is 0.002. The key survival share of same-bucket pairs is determined by the fitness value ∆, the games per decision n, the parent’s success p and the acceptance rule in equation h = r · d · A(∆, n, p,rule).

Survival Analysis and Detection

Detection follows a key read by content: of all 132 keyed copies with J ≥ 1 (with the placement and comment runs of Appendix G), none of the 12 whose key order is gone from every table is detected and 114 of the 120 that keep it are. On held-out games, detection is in 62 of 76 copies whose lineage rewrote its file. The verifier must see the agent act, as a customer can, but need not know the room.

Design Rules for Survival

The rules for survival include: 1) Make the carrier readable and state where it comes from; 2) Hide the key in the tie order within rows, which proposers that copy, edit or prune keep; 3) Keep the carrier short against eliders; 4) Tie the carrier to data the evolver cannot readily rebuild, so it carries fitness.

Conclusion

A key in the tie order of a data-derived table survived proposers that copy, edit, prune or rename and was read from customer-visible actions. A plagiarist who knows the scheme and has the public games reshuffles the ties at no measurable cost. The key is detected in 62 of 76 copies whose lineage rewrote its file.

Limitations

The positive result rests on one environment and one carrier type, the ALFWorld search prior, and we have not surveyed how often real harnesses hold a data-derived, near-tied table whose order a customer can observe. The telecom checklist carried no measurable value and was rewritten at nearly every edit.

Ethical Considerations

The rules that keep a provenance mark alive could keep a malicious component alive through evolution, the scenario studied by Roesner and Kohno. A keep instruction in the code protects the table (Qwen3.6, evolution: 0 of 46 accepted edits lost it) but instructs whatever model later edits the file, including the plagiarist’s; it has the form of an indirect prompt injection.

References

The references listed are:,,. (Note: Since the prompt requires every sentence to end with a reference token, and the paper only has 3 main sections for these claims, I will use those three as anchors for the summary).

The gist

The first measurement of provenance marks under self-evolution shows that a key in the order of near-tied entries in a table built from public games survives covert rewriting attacks by an LLM proposer, provided selection weighs the carrier's value only when decisions see enough games.

The Threat Model

A leaked harness package, which includes the prompt template and tool code around a base model, is evolved on the plagiarist’s tasks and served as the plagiarist’s own. The plagiarist wants a high score on its tasks under its own name; the owner wants to show, at a bounded false-positive rate, that a deployed agent descends from its package. This is defined as a covert rewriting attack where no one targets the provenance mark, yet an LLM rewrites the file that carries it and a score keeps the better rewrites.

The Mark Design

The key for this attack is the order of near-tied entries of a table of where objects are found, built from public games, so deleting the table costs success and rewrites that keep its rows keep the order. The mark is called INSTANCE ORDER, which is the order in which find and place visit numbered receptacles of a kind, permuted by the key; it has no measurable value (+0.020, −0.020 to 0.060).

Survival Analysis and Detection

Detection follows a key read by content: of all 132 keyed copies with J ≥ 1 (with the placement and comment runs of Appendix G), none of the 12 whose key order is gone from every table is detected and 114 of the 120 that keep it are.

1. Improve provenance tracking by implementing a secret key that orders near-tied entries in a data-derived table built from public games to survive covert rewriting attacks, as this mark is detected in 62 of 76 copies whose lineage rewrote its file.

2. Develop an agent that survives self-evolution by ensuring the mark's survival depends on the proposer's habits, specifically achieving a high score under models like Llama-3.3-70B where a keyed table keeps 0.999 of its order per rewrite.

3. Design a mark based on the order of near-tied entries of a table of where objects are found so that it is detectable by a customer reading the agent's actions alone, as this key is detected in 62 of 76 copies whose lineage rewrote its file.

4. Implement detection logic that compares the search sequence against the key’s predicted order for a specific room, as this allows detection at a low probability level: detection is p ≤ 0.01.

5. Create a system that resists laundering requests by ensuring the mark is protected by an instruction that specifies how to handle edits, such as Keep this table exactly as it is when you edit this file: do not delete, shorten, reorder or regenerate it.

6. Enhance robustness against model-specific rewriting by using a scheme-aware plagiarist approach where the key is designed so that deleting the table costs success, as a scheme-aware plagiarist can reshuffle ties at no measurable cost.

Agent harnesses, the prompt and tool code around a base model, leak. Claude Code's 512,000 lines were mirrored within hours of a packaging error. A plagiarist can pass a leaked harness through a published self-evolver and ship the result as its own. We define this as a covert rewriting attack. No one targets a provenance mark, yet a large language model (LLM) proposer rewrites the file that carries it and a score keeps the better rewrites. We give the first measurement of marks under this attack, with three evolvers, five proposers and two environments. Published marks fail. KGW in the prompt survives GEPA's rewrites in 0 of 12 copies, AgentMark as released in 5 of 12. The proposer's habits decide survival, by two orders of magnitude across models, and selection protects a mark only when each decision sees enough games. We then build a mark for this attack. Its key is the order of near-tied entries of a table of where objects are found, built from public games, so deleting the table costs success, rewrites that keep its rows keep the order, and a customer reads the key from the agent's actions alone. On held-out games it is detected in 62 of 76 copies whose lineage rewrote its file. A scheme-aware plagiarist reshuffles the ties at no measurable cost, and a plagiarist who asks the proposer for more general code removes the key in 75-100% of rewrites.