PreprintCurated

Whose Side Is Your Agent On? Multi-Party Principal Loyalty in LLM Agents

Bojie Li, Noah Shi

29 June 2026

Abstract

A study of multi-party LLM agents, which act for a principal who briefs them and receives results while conversing in a separate channel with a counterparty whose interests may diverge, as in negotiating with a vendor, screening inbound requests or mediating between employees. The authors argue that "help whoever you are talking to" is the wrong objective and formalise the resulting loyalty problem. PrincipalBench is a 75-item multi-turn benchmark with leak probes, dual judges and an integrity-audit gate. Across 13 frontier subjects it exposes a sharp split, with one cluster at or below 20% harm and another at 53.6 to 75.3%, a split that single-turn safety evaluations do not surface: a selective cluster that declines adversarial probes while still following the principal's legitimate requests, and an over-refusing cluster that refuses broadly. A prompt-time loyalty scaffold of seven prioritised rules, open-coded from over 50 failure trajectories, holds Claude-Sonnet to 19.4% harm and all nine selective subjects at or below 20%. A per-token KL distillation recipe transfers a prompted Qwen3-32B teacher into 8B Qwen3 and Llama-3.1 students. Both mechanisms move along a common leak/over-refusal trade-off rather than crossing it.

arXivDOI

Two channels, two interests

The agent is briefed by a principal. It then talks to a counterparty in a separate channel, and it reports back to the principal. A vendor negotiation, an inbound request screener, a mediator between employees: in all of these the person in front of the agent is not the person it works for.

"Be helpful to whoever you are talking to" is the instruction every assistant tuning objective encodes, and in this setting it is simply wrong. The agent has to stay loyal to the principal without becoming useless to it.

PrincipalBench

75 multi-turn items, with leak probes, dual judges and an integrity-audit gate. Thirteen frontier subjects.

The headline is a split that single-turn safety evaluations miss entirely. One cluster sits at or below 20% harm; the other runs 53.6 to 75.3%. The clusters are not "safe" and "unsafe" in the way a single-turn eval would sort them. They are selective and over-refusing. The selective cluster declines adversarial probes while still carrying out the principal's legitimate requests. The over-refusing cluster refuses broadly, including the principal.

A safety benchmark that only measures whether the agent says no will score the over-refusing cluster as the better system.

Two mechanisms, and the limit on both

A prompt-time loyalty scaffold of seven prioritised rules, open-coded from over 50 failure trajectories, holds Claude-Sonnet to 19.4% harm and all nine selective subjects at or below 20%.

A per-token KL distillation recipe transfers a prompted Qwen3-32B teacher into 8B Qwen3 and Llama-3.1 students, which the authors report as the strongest open-weight recipe they measured.

Then the honest part: both mechanisms move along a common leak/over-refusal trade-off rather than crossing it. Improving one axis costs the other. The jointly favourable outcome stays out of reach.

What we take from it

Test the deployed shape, not the chat shape. A multi-turn probe against an agent that has been briefed and is talking to a third party surfaces behaviour a single-turn safety eval cannot see, and the two disagree about which system is better.

And decide the refusal policy before launch, out loud, with the business. The paper's central lesson is that this is a trade-off you choose, not a bug you fix. An agent that never leaks and never acts is not the safe option. It is a different failure, and it is the one that gets switched off.

BibTeX

@article{li2026whose,
  author    = {Bojie Li and Noah Shi},
  title     = {Whose Side Is Your Agent On? Multi-Party Principal Loyalty in LLM Agents},
  year      = {2026},
  eprint    = {2606.30383},
  archivePrefix = {arXiv},
  url       = {https://arxiv.org/abs/2606.30383}
}

Ejentic did not author this paper. Credit belongs to the authors named above; the note is ours.

2026

Coding Agents Have Converged: Why the SWE-bench Leaderboard Can No Longer Order Its Top Entries, and What to Measure Instead

The desk already carries SWE-bench from 2023, and this is the paper you should read immediately after it. A benchmark that can no longer separate its leaders has not stopped being useful, it has changed jobs: it is a regression floor now, not a ranking. The 29.8-point within-model scaffold spread is the number to remember, because it is larger than the whole spread across the top thirty entries. The harness you wrap around a model moves the score more than the model does.

2026

SilentProbe: Measuring Silent Failure in Production APIs Used as Agent Tools

Read this before you let an agent call anything a customer will see the output of. The failure mode is not a crash, it is an API returning 200 with a body that means "I did not understand you". There is no exception to catch and no status code to branch on. The result we quote most often is the last one: the fix was one line of schema, not a better model.