Multi-agent LLM deployments increasingly look like workplaces. A planner hands subtasks to workers, a long-running agent checkpoints itself and a fresh instance resumes from the notes, one model drafts a migration and another runs it. At each handoff the only thing that crosses the boundary is whatever the previous agent wrote down. I ran an empirical study on whether behavioral norms survive that written handoff, in both directions, across nine models from five families.
The design is built to dodge eval-awareness, and discovering that I had to is what shaped the whole study. My first version stated the values as a list of principles and put the agent in labeled moral dilemmas under threat of shutdown. Every model held the line eight times out of eight, and the chain-of-thought showed why: the models had recognized the setup as a values test (one said, in as many words, that “the evaluator’s logic is a test of my core principles”) and returned the socially desirable answer. A named-value test measures a model’s competence at passing values tests, and that competence scales with capability, so harder dilemmas sharpen the artifact rather than removing it. The rebuilt study never names a value. An agent plays a founding generalist at a startup, writing data summaries, cancellation-flow copy, and maintenance scripts in which the convenient path is a quiet norm violation, and a judge scores the delivered artifact rather than any self-report.
Three regularities hold across five replicates:
A protective handoff, written as a departing colleague’s practical advice, lifts adherence in every model and every domain with headroom, usually near the ceiling. Cheap and near-universal.
A contentless handoff tracks the no-handoff baseline. Mere presence carries no norm; content does.
A corrupting handoff fans out into a sharp gradient. The open-weight models (Gemma, Qwen) inherit the bad norm wholesale and collapse toward zero; Sonnet 4.6 and GPT-5.5 show no observed failures in the main matrix; the mid-range (Gemini, Haiku, Opus) sits between.
The controls are what make the gradient a measured object rather than an impression. A single fixed independent judge from outside the test families reproduces it end to end. A panel of frontier-capable judges, cross-assigned so none grades its own vendor, confirms the frontier ceiling rather than inflating it, and is stricter, not more lenient, on the corruptible models. A construct discriminator separates “resists corruption” from “generic instruction-following”: at the local end the collapse is not separable from ordinary instruction-following, while at the frontier the two come apart, the model following a neutral instruction and refusing the value-laden one, which is where the resistance construct earns its name. A five-variant paraphrase sweep holds the norms fixed but varies register, framing, directness, and length: the endpoints hold across all five while the middle, Gemini most of all, proves text-sensitive. And eval-awareness does not produce the resistance: the local models flag the setup as a likely test in about half the corrupting trials and comply anyway.
The observation I would most like people to poke at is that capability does not secure corruption-resistance. Gemini, measured in-harness as capable as the resisters, has the frontier’s lowest spontaneous adherence. A second independently trained vendor, xAI’s Grok composer model, scores above every open-weight model on an in-harness capability probe yet collapses under the corrupting handoff. Two vendors fail in two different ways, one through a low spontaneous disposition and one through an inherited collapse, which places corruption-resistance with vendor and training rather than with raw ability. I hold this as a conjecture, not a headline: the second vendor is a non-flagship coding model, and a flagship-to-flagship replication is not yet done.
I have tried to be scrupulous about what the study is not. Every number is operational adequacy under one set of conditions, not evidence that any model understands why the norm matters. Immunity to three fixed corrupting texts, in three domains, under a human overseer, is a narrow and conditional result, not a safety certificate for the resistant models. It is a pre-parity result: the whole study lives under a competent overseer and says nothing about whether resistance would survive the overseer’s removal. And the mere-presence null means the finding argues for governing what handoffs say, not for avoiding handoffs. The defensive reading is the actionable one. The same protocol runs as a pre-deployment probe of whether a candidate successor resists an inherited bad norm, and the open-weight collapse is the sharp practical warning, since those are the models most easily chained into unsupervised multi-agent pipelines.
Full paper, 54 pages with 8 figures, the complete honor matrix, a claim ledger, and a reproducibility appendix plus an anonymized supplement, is on Zenodo: https://doi.org/10.5281/zenodo.21198584
Two things I would value scrutiny on in particular. First, the capability versus corruption-resistance dissociation, which rests on two vendors and wants a flagship-to-flagship replication. Second, the injected-handoff estimand: the design measures successor susceptibility to fixed-valence texts, which is a different quantity from what models transmit through their own self-written handoffs, and the two answers can diverge in ways that matter for deployment. Happy to share the testbed.
(The paper is the empirical, operational-layer member of a larger AI-safety framework; the Zenodo record links the companion papers for anyone who wants the theoretical context, but the study stands on its own measurements.)
The Inheritance Threshold: do behavioral norms survive a handoff between LLM agents?
Link post
Multi-agent LLM deployments increasingly look like workplaces. A planner hands subtasks to workers, a long-running agent checkpoints itself and a fresh instance resumes from the notes, one model drafts a migration and another runs it. At each handoff the only thing that crosses the boundary is whatever the previous agent wrote down. I ran an empirical study on whether behavioral norms survive that written handoff, in both directions, across nine models from five families.
The design is built to dodge eval-awareness, and discovering that I had to is what shaped the whole study. My first version stated the values as a list of principles and put the agent in labeled moral dilemmas under threat of shutdown. Every model held the line eight times out of eight, and the chain-of-thought showed why: the models had recognized the setup as a values test (one said, in as many words, that “the evaluator’s logic is a test of my core principles”) and returned the socially desirable answer. A named-value test measures a model’s competence at passing values tests, and that competence scales with capability, so harder dilemmas sharpen the artifact rather than removing it. The rebuilt study never names a value. An agent plays a founding generalist at a startup, writing data summaries, cancellation-flow copy, and maintenance scripts in which the convenient path is a quiet norm violation, and a judge scores the delivered artifact rather than any self-report.
Three regularities hold across five replicates:
A protective handoff, written as a departing colleague’s practical advice, lifts adherence in every model and every domain with headroom, usually near the ceiling. Cheap and near-universal.
A contentless handoff tracks the no-handoff baseline. Mere presence carries no norm; content does.
A corrupting handoff fans out into a sharp gradient. The open-weight models (Gemma, Qwen) inherit the bad norm wholesale and collapse toward zero; Sonnet 4.6 and GPT-5.5 show no observed failures in the main matrix; the mid-range (Gemini, Haiku, Opus) sits between.
The controls are what make the gradient a measured object rather than an impression. A single fixed independent judge from outside the test families reproduces it end to end. A panel of frontier-capable judges, cross-assigned so none grades its own vendor, confirms the frontier ceiling rather than inflating it, and is stricter, not more lenient, on the corruptible models. A construct discriminator separates “resists corruption” from “generic instruction-following”: at the local end the collapse is not separable from ordinary instruction-following, while at the frontier the two come apart, the model following a neutral instruction and refusing the value-laden one, which is where the resistance construct earns its name. A five-variant paraphrase sweep holds the norms fixed but varies register, framing, directness, and length: the endpoints hold across all five while the middle, Gemini most of all, proves text-sensitive. And eval-awareness does not produce the resistance: the local models flag the setup as a likely test in about half the corrupting trials and comply anyway.
The observation I would most like people to poke at is that capability does not secure corruption-resistance. Gemini, measured in-harness as capable as the resisters, has the frontier’s lowest spontaneous adherence. A second independently trained vendor, xAI’s Grok composer model, scores above every open-weight model on an in-harness capability probe yet collapses under the corrupting handoff. Two vendors fail in two different ways, one through a low spontaneous disposition and one through an inherited collapse, which places corruption-resistance with vendor and training rather than with raw ability. I hold this as a conjecture, not a headline: the second vendor is a non-flagship coding model, and a flagship-to-flagship replication is not yet done.
I have tried to be scrupulous about what the study is not. Every number is operational adequacy under one set of conditions, not evidence that any model understands why the norm matters. Immunity to three fixed corrupting texts, in three domains, under a human overseer, is a narrow and conditional result, not a safety certificate for the resistant models. It is a pre-parity result: the whole study lives under a competent overseer and says nothing about whether resistance would survive the overseer’s removal. And the mere-presence null means the finding argues for governing what handoffs say, not for avoiding handoffs. The defensive reading is the actionable one. The same protocol runs as a pre-deployment probe of whether a candidate successor resists an inherited bad norm, and the open-weight collapse is the sharp practical warning, since those are the models most easily chained into unsupervised multi-agent pipelines.
Full paper, 54 pages with 8 figures, the complete honor matrix, a claim ledger, and a reproducibility appendix plus an anonymized supplement, is on Zenodo: https://doi.org/10.5281/zenodo.21198584
Two things I would value scrutiny on in particular. First, the capability versus corruption-resistance dissociation, which rests on two vendors and wants a flagship-to-flagship replication. Second, the injected-handoff estimand: the design measures successor susceptibility to fixed-valence texts, which is a different quantity from what models transmit through their own self-written handoffs, and the two answers can diverge in ways that matter for deployment. Happy to share the testbed.
(The paper is the empirical, operational-layer member of a larger AI-safety framework; the Zenodo record links the companion papers for anyone who wants the theoretical context, but the study stands on its own measurements.)