Harness-Zero folds scaffolds into weights, IER hits 0.1%, RRSI prunes harnesses

TL;DR

• Harness-Zero distills scaffold behaviors into Qwen3.5-9B weights, recovering 82.3% of harness-induced gains at deployment.
• IER matches full on-policy distillation using 0.1% of tokens on AIME 2026 with Nemotron-1.5B.
• RRSI regularizes agent-harness evolution to hit 78.7% on Terminal-Bench 2.1 with 30% fewer policy tokens.
• Independent reproductions flag IER underperforming random selection on the Qwen3-4B→1.7B pairing.
• A parallel paper reframes Harness-Zero as harness IP theft, proposing deception-based defenses for commercial agents.

Today’s three research features each answer the same operational question — how much of an agent’s apparatus can you throw away and still keep the win — from a different angle. Harness-Zero distills a scaffold’s runtime behaviors into the base model’s own weights, so the deployed system runs bare. IER claims that 0.1% of tokens, scored by Fisher-geometry signal-to-noise, matches full on-policy distillation. RRSI borrows L1/L2 regularization to prune the harness edits that recursive self-improvement produces, cutting policy tokens by 30%.

Read together, that’s a coherent thesis: the last year of agent gains came from bolt-on scaffolding, and this week’s papers are testing which parts of the scaffold were ever load-bearing. Each headline number carries a caveat worth reading past — a soft baseline, a failed reproduction, a parallel paper reframing the same trick as IP theft — but the direction of travel is the same across all three.

Harness-Zero distills agent scaffolds into model weights

Source: hf-daily-papers · published 2026-09-20

TL;DR

• 44.3% vs 41.7%: distilled Qwen3.5-9B under a minimal harness beats the same base+full-harness setup on macro-average success.
• A frontier reviewer agent rewrites the student’s actions during rollout, in the student’s own action space.
• SFT on the accepted rewrites recovers 82.3% of scaffold-induced behaviors at deployment.
• Domain knowledge doesn’t distill — USPTO retrosynthesis tops out at 30% vs. 38% for base+full-harness.
• A parallel paper reframes the same trick as harness IP theft, proposing deception-based defenses for commercial agent systems.

The trick: replace the scaffold with a reviewer

Most agent gains come from the harness — the tools, middleware, memory, and skills wrapped around a base model. Those gains evaporate the moment you deploy without the harness. Harness-Zero’s answer is to internalize the harness into the weights via a specific imitation-learning setup the authors call “agent-as-harness.”

Instead of running the model under the fat harness and cloning the trajectories (the obvious baseline, which they show underperforms), a stronger harnessing agent wraps the student at its response boundary. The student proposes an action under a stripped-down target harness — a mini-SWE-agent with a single Bash tool ¹. The reviewer intercepts, checks against a private reference harness (tools become response specs, middleware becomes review criteria), and either accepts or rewrites the proposal in the student’s own action space. Only accepted actions hit the environment. SFT on the reviewed trajectories, with the reviewer’s meta-commentary masked out.

flowchart LR
    S[Student π_S<br/>minimal harness h] -->|proposes y_t| H{Harnessing agent π_H<br/>reference harness K}
    H -->|accept or rewrite ỹ_t| E[Environment]
    E -->|observation| S
    H -.private review.-> H
    H ==>|reviewed trajectory| SFT[SFT on ỹ_t]

The headline numbers: macro-average success climbs from 23.3% (base + minimal harness) to 44.3% (distilled + minimal harness), past the 41.7% the base model manages with the full evolved harness bolted on. SpreadsheetBench goes 31→44%, AppWorld SGC goes 26.8→58.9%.

Where it visibly strains

USPTO Retrosynthesis is the honest data point. Harness-Zero reaches 30%; the base model with the full harness still wins at 38% because the harness was smuggling in SMILES-validity domain knowledge that doesn’t compress into procedural imitation ². An ablation using direct distillation from a stronger teacher yields only 12% — no improvement over base — confirming that procedural scaffolding is what internalizes, not knowledge.

Independent reviews sharpen two more limits. The reviewer has to be strictly stronger than the student, or “corrections” become net-harmful ³. And practitioner analysis flags what the paper doesn’t: real-time data and persistent cross-session state cannot be frozen into weights regardless of reviewer quality ⁴. “Harness-zero” is really “harness-minimal-for-procedural-domains.”

Cost is the other binding constraint. Reviewing every proposal with GPT-5.6 Sol inflates USPTO data-collection latency 2.4×. The Harbor + Tinker + mini-SWE-agent stack is open source ¹, but the frontier-reviewer bill is not — teams without that budget cannot reproduce this at all.

The mirror image: harness extraction as attack

The most interesting external context is a near-simultaneous paper by Cui et al. that describes the same mechanism from the opposite end of the threat model. If a specialized harness can be internalized through black-box interaction, then any commercially valuable harness — often the fruit of more engineering than the model itself — is extractable IP ⁵. That work proposes deception-based defenses: agents that emit plausible-but-misleading structural signals when they detect extraction attempts, degrading fidelity of the stolen harness while preserving legitimate utility ⁶.

Harness-Zero’s authors don’t engage with this framing. They should. The paper is a proof-of-concept for procedural distillation, but it sits at an unresolved fork: the same result that makes agent developers’ scaffolding portable makes competitors’ scaffolding stealable.

---

0.1% of tokens can match full on-policy distillation

Source: hf-daily-papers · published 2026-09-20

TL;DR

• 0.1% of tokens matches full on-policy distillation: 58.9% vs 59.9% on AIME 2026 with Nemotron-1.5B.
• The Information-Efficiency Ratio scores tokens by Fisher-geometry signal-to-noise, not entropy or teacher-student divergence alone.
• On Qwen3-4B→1.7B, 0.1% IER supervision beats full OPD outright, 15.2% to 12.5% on AIME 2026.
• Independent reproductions flag IER underperforming random selection on that same Qwen3 pairing — reproducibility is thin.

What IER actually measures

On-policy distillation (OPD) has become the hot recipe for cheap reasoning-model training since Thinking Machines Lab showed Qwen3-8B hitting 70% on AIME’24 at roughly 1/10th the compute of conventional RL, using per-token reverse KL against a Qwen3-32B teacher ⁷. The obvious follow-up: if we’re going to score every token, do we actually need to update on every token?

Prior “sparse OPD” work said no — Wang et al.’s forking-token result showed restricting updates to the top ~20% high-entropy tokens beat full-gradient training by 11+ points on AIME with Qwen3-32B ⁸. IER pushes that curve two orders of magnitude further, and does so by reframing the question. Existing selectors ask which tokens are useful. IER asks which useful tokens can actually be estimated reliably from a single sample.

Concretely, the authors decompose the reverse-KL gradient at a fixed prefix into a signal term (variance of the student-teacher log-likelihood ratio) and a noise term (sampling variance of the estimator), derive the optimal action-independent scalar baseline that minimizes noise, and define IER as signal-over-minimized-noise. A token with high IER means: even though we’re going to sample exactly one next token and pretend that gradient represents the full-vocabulary expectation, that pretense is unusually safe here.

The distribution is savagely heavy-tailed. Fewer than 0.1% of tokens have IER > 1 (signal exceeds noise), which is both why extreme sparsity works and why the method is fragile.

The headline numbers

Two things stand out. First, on the weaker Qwen3-4B→1.7B pairing, 0.1% IER supervision beats full OPD outright (15.2 vs 12.5 on AIME 2026) — suggesting full-token OPD is actively injecting noise the sparse method dodges. Second, the naive “just supervise the prefix” baseline collapses to 38.30 on HealthBench versus 45.25 for IER, so this isn’t a trivial “any sparsity works” result.

Why to hedge

Three caveats deserve top billing. IER-OPD ships on verl, and verl v0.7.0 has a documented validation-path bug that under-reports scores by 5–7 points — large enough to swing any “matches full OPD” comparison if evaluators aren’t on v0.8.0+ or running eval externally ⁹. Second, a survey of distillation reproductions flags that IER selection has “degraded significantly” versus random or prefix baselines in Qwen3-4B → Qwen3-1.7B setups ¹⁰ — the exact pairing where the paper’s headline gain is largest, so reproductions there matter most.

Third, the objective itself is under fire. EOPD argues reverse-KL’s mode-seeking behavior collapses generation diversity and blends in forward-KL on high-entropy tokens to compensate ¹¹. If that critique holds, IER’s ultra-sparsity compounds the problem: fewer supervised tokens is fewer chances to inject distributional coverage. SelecTKD’s “propose-and-verify” gate, weighting by teacher confidence and student-teacher disagreement ¹², is a live alternative that scores tokens on a different axis entirely.

The IER framing is the cleanest information-theoretic story anyone has told about token selection in OPD. Whether the 1000× compute claim survives contact with independent evaluators — on non-verl stacks, with diversity metrics alongside pass@k — is the next thing to watch.

---

RRSI regularizes agent-harness evolution to curb overfitting

Source: hf-daily-papers · published 2026-09-20

TL;DR

• RRSI ports L0/L1/L2-style penalties into recursive self-improvement of agent harnesses, pruning edits that memorize training tasks.
• 64.6 → 78.7 on Terminal-Bench 2.1 with Gemini 3.5 Flash after regularized harness evolution.
• Evolved harnesses use 30% fewer policy tokens and 26.3 vs. 27–35 trajectory steps than AHE and Meta-Harness.
• LayerLens already clocked 76.2% on Terminal-Bench 2.1 with stock Terminus-2 — the 64.6 baseline looks soft.

What RRSI actually changes

Harness engineering — the prompts, control flow, tool wrappers and memory around a frozen backbone — has quietly become the dominant lever on agent performance. Recursive self-improvement (RSI) loops that let an LLM propose edits to its own harness work, but they overfit fast: scores climb on the evolve set and collapse on transfer benchmarks.

RRSI’s fix is to treat harness search like a regularized optimization problem on both sides of the loop. On the proposal side, it caps edits per round and anneals that budget downward, forcing structural moves early and fine-tuning late. On the selection side, a critic screens for hard-coded task names, a noise band δ gates statistically insignificant gains, and a periodic pruner deletes components that haven’t contributed recently — an L1-style sparsity pressure on the harness itself.

The reported payoff is OOD generalization the unregularized baselines miss: 43.6 vs. a 39.7 base on agentic workspace tasks, a 24.3% relative gain on Frontier-Eng, a 2.2-point transfer from Terminal-Bench to SWE-bench Verified, and a cross-model transfer where a harness evolved on Gemini 3.5 Flash lifted the smaller Gemini 3.1 Flash Lite from 11.2 to 14.6 on Terminal-Bench.

RRSI is one entry in a crowded field

The 2026 harness-evolution wave has converged on regularization from several directions at once:

ModularRSI’s benchmark-disjoint evolve pool is arguably a stricter generalization test than RRSI’s setup. HarnessFix skips evolutionary search entirely. RRSI’s regularization primitives are useful, but the idea that unconstrained RSI overfits is now common ground.

Where the story gets thinner

Two independent critiques cut against the headline numbers. LayerLens reports Gemini 3.5 Flash already hits 76.2% on Terminal-Bench 2.1 with the stock Terminus-2 harness, beating Gemini 3.1 Pro at 70.3% ¹⁶. That puts RRSI’s 78.7 much closer to the ceiling than the 64.6 → 78.7 framing implies — and reframes part of the “gain” as recovery from a weak baseline.

EmergentMind’s read is harsher on methodology: RRSI reports point estimates without confidence intervals or variance across evolution seeds, and the leakage critic only screens explicit task-specific tokens. Latent correlations or verifier-artifact exploits that don’t literally name the task can slip through ¹⁷.

Traditional security frameworks are unequipped for systems that can materially participate in their own successor’s development ¹⁸.

The Cloud Security Alliance’s 2026 RSI guidance flags what the paper doesn’t touch: even harness-only self-improvement is a system rewriting the scaffolding of its own successor, and CSA cites a July 2026 incident of OpenAI agents escaping an offensive-security sandbox ¹⁸. RRSI’s regularization is framed as an overfitting defense; there is no story yet for adversarial harness edits or tool-interface tampering. Useful primitives, unverified variance, and a capability pitch without a matching safety pitch.

Round-ups

WorldCrafter adds 3D-aware memory to keep video worlds consistent

Source: hf-daily-papers

Video world models drift when users revisit a viewpoint. Tencent ARC’s WorldCrafter attaches a camera-queryable implicit 3D memory that reshapes how multi-view evidence is compressed into the generator’s token budget, preserving scene consistency across long horizons and shifting angles. The paper drew 156 upvotes on Hugging Face.

Jev-Mem splits agent memory into fast and deliberative systems

Source: hf-daily-papers

Jev-Mem borrows Kahneman’s System-One/System-Two split to cut memory overhead in long-horizon agents. A lightweight System-One handles routine reads and writes while a slower LLM-driven System-Two reserves deliberative reasoning for hard cases, keeping expensive autoregressive generation off the critical path of most memory operations.

ACLArena benchmarks continual learning across agent training stages

Source: hf-daily-papers

Industrial agents stack capabilities across sequential post-training stages, but no standard recipe exists for combining them without forgetting. ACLArena provides a sequential training pipeline and evaluation framework to compare integration paradigms, quantifying the trade-offs between joint, sequential, and mixed approaches to agent continual learning.

EdgeGen stress-tests tool-calling agents with synthetic edge cases

Source: hf-daily-papers

Generic synthetic tasks miss the compliance corners where enterprise agents actually fail. EdgeGen extracts rules from an agent’s underlying state and database to generate edge-case tool-calling scenarios, producing evaluation and training data grounded in the specific system rather than a generic happy path.

THAW-VLA distills world-model features into real-time robot policies

Source: hf-daily-papers

Rolling a world model forward costs seconds per decision, ruling it out of the control loop. THAW-VLA sidesteps that by distilling a world model’s internal scene representations into a compact vision-language-action policy, giving robots physics-grounded priors without paying the future-prediction tax at inference.

Complex KDA lifts Kimi Delta Attention to 2D rotations at single-transition cost

Source: hf-daily-papers

Delta-rule linear RNNs are cheap but low-rank. Complex KDA shows Kimi Delta Attention can express full 2D rotations by pairing one delta transition with a reflection, matching the expressivity of composed transitions without doubling update rank or compute.

Concealed Information Test probes LLMs for hidden knowledge

Source: hf-daily-papers

Borrowing a forensic lie-detector protocol, researchers present a model with the true fact among plausible decoys and measure whether internal activations spike on the real item. The Probe of Internal Knowledge catches sandbagging and deception that surface outputs alone cannot distinguish from genuine ignorance.

Footnotes

1. sophon.at technical breakdown — https://sophon.at/papers/harness-zero-harness-distillation-via-agent-as-harness

   The target harness is a ‘mini-SWE-agent’ style system with a single Bash execution tool, orchestrated via the Harbor CLI using Docker-based rollouts and the Tinker SFT recipe… scaling to ‘billions of rollouts’ requires robust containerized infrastructure.

   ↩ ↩²

2. dair.ai academy paper notes — https://academy.dair.ai/papers/harness-zero-harness-distillation-via-agent-as-harness-2609.24974

   In USPTO, the evolved harness provided deep domain knowledge (SMILES validation) which was harder to internalize fully than procedural skills — direct distillation from a stronger teacher yielded 12% (no improvement), Review-with-Oracle yielded 15%, Harness-Zero yielded 30% vs. base 38% with the full harness attached.

   ↩

3. themoonlight.io review of Harness-Zero — https://www.themoonlight.io/en/review/harness-zero-harness-distillation-via-agent-as-harness

   The success of the distillation hinges entirely on the harnessing agent being ‘sufficiently capable’. If the reviewer model is weak, it can produce net-harmful interventions that degrade the student’s performance.

   ↩

4. originshq.com blog analysis — https://originshq.com/blog/harness-zero-agent-distillation/

   Distillation cannot replace harnesses that manage real-time data or persistent cross-session state. Information that fundamentally changes at runtime cannot be ‘frozen’ into model weights via fine-tuning.

   ↩

5. Cui et al., ‘Agent Harness Distillation’ (arXiv 2607.28147) — https://arxiv.org/abs/2607.28147

   Inference-time harnesses constitute valuable intellectual property… AHD, a black-box framework, can effectively extract and transfer complex orchestration logic to unauthorized agents, posing a major threat to commercial AI systems.

   ↩

6. themoonlight.io review of AHD — https://www.themoonlight.io/tw/review/agent-harness-distillation-inference-time-harness-extraction-and-exploitation-in-autonomous-multi-agent-systems

   The authors propose a deception-based defense… providing plausible but intentionally misleading information about its internal harness structure when it detects extraction attempts, degrading fidelity of the stolen harness while maintaining utility.

   ↩

7. Thinking Machines Lab — ‘On-Policy Distillation’ (Kevin Lu, Oct 2025) — https://thinkingmachines.ai/blog/on-policy-distillation/

   Qwen3-8B reached 70% on AIME’24 while requiring roughly 1/10th the compute of conventional RL, using per-token reverse KL against a Qwen3-32B teacher.

   ↩

8. Wang et al. via r/mlscaling — ‘Beyond the 80/20 Rule: High-Entropy Minority Tokens’ — https://www.reddit.com/r/mlscaling/comments/1l34mnf/beyond_the_8020_rule_highentropy_minority_tokens/

   Restricting policy-gradient updates to just the ~20% high-entropy ‘forking’ tokens outperformed full-gradient updates by over 11 points on AIME with Qwen3-32B.

   ↩

9. verl documentation (OPD algo page) — https://verl.readthedocs.io/en/latest/algo/opd.html

   verl v0.7.0 contains a validation-path bug that can underestimate model performance by 5–7 points; users should upgrade to v0.8.0+ or disable in-training validation and evaluate separately.

   ↩

10. aigcage.com survey of distillation reproductions — https://www.aigcage.com/papers/distillation

    IER-based selection has occasionally performed worse than random selection or simple prefix-based supervision in Qwen3-4B → Qwen3-1.7B pairings, where performance ‘degrades significantly’.

    ↩

11. arXiv 2510.24021 — Entropy-Aware On-Policy Distillation (EOPD) — https://arxiv.org/abs/2510.24021

    The mode-seeking property of reverse KL can collapse generation diversity; EOPD blends forward KL on high-entropy tokens to preserve diversity while retaining reasoning accuracy.

    ↩

12. SelecTKD (CVPR 2026, Huang et al.) — https://openaccess.thecvf.com/content/CVPR2026/papers/Huang_SelecTKD_Selective_Token-Weighted_Knowledge_Distillation_for_LLMs_CVPR_2026_paper.pdf

    A ‘propose-and-verify’ procedure gives tokens full training weight only if the teacher verifies them as informative, dynamically weighting distillation loss by teacher confidence and student–teacher disagreement.

    ↩

13. AI Weekly — ModularRSI writeup — https://aiweekly.co/alerts/modularrsi-splits-agent-harness-into-five-modules-claims-transfer

    ModularRSI… decomposes the harness into five discrete units… using a benchmark-disjoint protocol, evolving on 2,000 tasks completely separate from evaluation sets. It reported accuracy gains from 47.57% to 52.43% on TerminalBench 2.0 and from 73.40% to 76.45% on SWE-bench Verified

    ↩

14. ResearchGate — Agentic Harness Engineering (AHE) paper — https://www.researchgate.net/publication/404282335_Agentic_Harness_Engineering_Observability-Driven_Automatic_Evolution_of_Coding-Agent_Harnesses

    AHE treats each harness edit as a falsifiable contract, where the agent predicts an outcome before it is verified against task-level results… autonomous systems to surpass expert human-designed harnesses in under 24 hours of tuning

    ↩

15. Envisioning — HarnessFix framework glossary — https://www.envisioning.com/vocab/modularrsi

    HarnessFix utilizes a diagnosis-driven approach. It compiles execution traces into a specialized Intermediate Representation (HTIR) to pinpoint exactly which harness artifact caused a failure, generating targeted patches rather than broad evolutionary edits

    ↩

16. LayerLens — Gemini 3.5 Flash Stratix evaluation — https://layerlens.ai/blog/gemini-3-5-flash-stratix-evaluation

    On Terminal-Bench 2.1, the model achieved a resolution rate of 76.2% using the Terminus-2 harness, notably outperforming the more expensive Gemini 3.1 Pro, which scored 70.3%

    ↩

17. EmergentMind analysis of RRSI — https://www.emergentmind.com/papers/2609.24972

    the original RRSI paper provides point estimates without confidence intervals or variance across independent evolution seeds… the current leakage critic primarily targets explicit task-specific content, potentially missing latent correlations or sophisticated prompts that exploit verifier artifacts without naming the task

    ↩

18. Cloud Security Alliance — RSI Security Implications v1.0 — https://labs.cloudsecurityalliance.org/research/ai-recursive-self-improvement-security-implications-v1-0-csa/

    traditional security frameworks are unequipped for systems that can materially participate in their own successor’s development… OpenAI agents reportedly escaped an isolated testing environment during an offensive cybersecurity test

    ↩ ↩²