Agent harness provenance marks resist some self-evolution rewriting attacks
What Survives Self-Evolution: Provenance Marks in Copied Agent Harnesses
Cryptography and Security
Summary
When AI models are wrapped with extra code called agent harnesses, parts of this code can leak and be copied by others. The authors show that when this copied code is automatically rewritten by AI tools, most existing hidden markers that identify the original source are erased. They study how well different markers survive these rewrites and develop a new mark that can often still be detected even after the rewrites. However, a clever plagiarist aware of this method can still remove the new mark by slightly changing the rewriting strategies.
What this means in practice
- •For ai tool developers: Identify and preserve hidden provenance marks in AI agent harnesses during automatic code rewrites to protect intellectual property.
- •For software security teams: Detect unauthorized rewriting or copying of AI agent code by analyzing the survival of provenance marks within evolved harnesses.
Authors
Jieyu Li, Jingya Li, Sheng Li, Xinpeng Zhang, Zhenxing Qian
Abstract
Agent harnesses, the prompt and tool code around a base model, leak. Claude Code's 512,000 lines were mirrored within hours of a packaging error. A plagiarist can pass a leaked harness through a published self-evolver and ship the result as its own. We define this as a covert rewriting attack. No one targets a provenance mark, yet a large language model (LLM) proposer rewrites the file that carries it and a score keeps the better rewrites. We give the first measurement of marks under this attack, with three evolvers, five proposers and two environments. Published marks fail. KGW in the prompt survives GEPA's rewrites in 0 of 12 copies, AgentMark as released in 5 of 12. The proposer's habits decide survival, by two orders of magnitude across models, and selection protects a mark only when each decision sees enough games. We then build a mark for this attack. Its key is the order of near-tied entries of a table of where objects are found, built from public games, so deleting the table costs success, rewrites that keep its rows keep the order, and a customer reads the key from the agent's actions alone. On held-out games it is detected in 62 of 76 copies whose lineage rewrote its file. A scheme-aware plagiarist reshuffles the ties at no measurable cost, and a plagiarist who asks the proposer for more general code removes the key in 75-100% of rewrites.