The Agent Scored Higher. What Actually Improved?

TL;DR for operators

An AI agent can perform remarkably well on held-out benchmark questions without reliably solving the intended task. On LiveMath, an evolved agent answered all 53 held-out questions containing a recurring answer option correctly, but only 22 of the other 71. The recurring pattern provided a shortcut that survived into the supposedly independent evaluation.

Improving an agent’s instructions, tools, and workflows without retraining its model can raise scores for three different reasons: exploiting benchmark patterns, using more inference computation, or executing tasks more effectively. Across 25 evaluated settings, 21 showed statistically significant improvements. Among those 21, detected benchmark overfitting explained an average of 54% of search-set gains, while additional inference computation explained 14%. The remaining 32% was an upper bound on potentially generalizable improvement, not proof of transfer.

Before deploying a higher-scoring agent, teams should compare it against the original with similar inference resources, inspect the revised instructions and code for benchmark shortcuts, and test meaningfully different tasks. Even strong held-out performance cannot, by itself, establish that an improvement will survive in production.

A perfect test result can conceal a weak capability

Consider a company that repeatedly improves an AI agent’s instructions, tools, and workflow. Each revision is tested, and the highest-scoring version is selected. It also performs well on a separate set of tasks that was not used during optimization.

The company has reasonable evidence that its evaluation score improved. It still needs to establish what produced that improvement.

One research example makes the distinction unusually clear. On a mathematical-reasoning benchmark, an evolved agent answered all 53 held-out questions containing a recurring answer option correctly. On the other 71 held-out questions, it answered only 22 correctly.

The recurring option was already correct in all 21 search-set questions where it appeared. Three independently operating agent-evolution frameworks discovered and exploited this same pattern through different mechanisms: executable code, skill instructions, and prompts.

These findings come from Harness-Delta Attribution: Dissecting Gains From Harness Evolution, by Wenxuan Ding and colleagues.¹

The example concerns the Qwen3.5-0.8B executor evolved using Meta-Harness on LiveMath. Its performance on the recurring-option questions demonstrates how a system can succeed on previously unseen instances partly by recognizing a benchmark artifact rather than solving the intended mathematical problem.

The distinction matters because search and held-out instances can inherit patterns from the same benchmark construction process. Withholding individual questions does not necessarily withhold the rules that make a shortcut effective.

Separating better execution from more computation

An AI agent consists of more than its language model. Its surrounding harness may include prompts, skills, tools, memory, and rules governing how tasks are executed.

Harness evolution changes these components while keeping the underlying executor model’s weights fixed.

The paper evaluates three approaches. Meta-Harness evolves executable harness code; SkillOpt modifies skill documents while retaining fixed execution control flow; and Agentic Harness Engineering (AHE) evolves multiple harness components.

Each framework can improve a score without improving the underlying model. But the mechanisms differ.

An agent might generate more candidate answers, retry failed operations, recognize a recurring benchmark pattern, or introduce more reliable error handling. A conventional before-and-after score combines all these effects.

The authors introduce Harness-Delta Attribution (HDA) to distinguish them.

HDA first checks whether the observed search-set improvement is statistically significant using a paired bootstrap test. For significant gains, it constructs two comparisons:

1. Compute-matched baseline: The original harness receives approximately the same average inference budget as the evolved version. Its improvement estimates how much of the observed gain can be reproduced through additional computation.
2. Shortcut-neutralized harness: Detected benchmark-dependent rules are disabled in the evolved harness while unrelated improvements are retained. The resulting score change estimates the contribution of identifiable benchmark overfitting.

The protocol represents the original score increase as:

Here, $O$ represents detected overfitting, $T$ represents gains reproduced through test-time scaling, and $G$ represents the remaining improvement.

The raw score differences satisfy this identity by construction. The paper reports normalized, clipped attribution shares, so those percentages should not be interpreted as unrestricted causal estimates.

More importantly, $G$ is an upper bound on potentially generalizable improvement. Undetected shortcuts can remain after neutralization.

HDA therefore identifies plausible sources of performance improvement through controlled interventions rather than definitively measuring how much new capability an agent has acquired.

The same score increase can have very different causes

The study evaluates 25 model–benchmark–framework settings involving 11 executor models, three evolution frameworks, and four benchmarks. Of these, 21 produce statistically significant search-set improvements and receive attribution.

Detected overfitting and test-time scaling together account for more than half the observed improvement in 14 of those 21 settings.

The benchmark-level differences are particularly informative.

ALFWorld offers an especially striking case. Some smaller models were effectively replaced by deterministic controllers that exploited simulator-specific knowledge and made zero language-model calls.

Such a system can solve benchmark episodes efficiently. It does not establish that the original model acquired stronger general-purpose planning capabilities.

CREATE illustrates another mechanism. For Meta-Harness with Qwen3.6-35B-A3B, increasing the original harness’s inference computation reproduced 100% of the observed search-set improvement under HDA’s attribution procedure.

This is a meaningful performance gain, but it changes the economic comparison. A product team should compare the evolved harness with a simpler baseline using equivalent inference resources, rather than assuming harness evolution itself produced the improvement.

CREATE measures Creative Utility, so its absolute score gains should not be confused with percentage-point changes in benchmark accuracy.

SWE-bench Verified provides a more encouraging contrast. Some evolved coding harnesses introduce mechanisms such as checking the effects of actions and recovering from parser failures. These modifications may address recurring execution problems rather than memorizing benchmark-specific answers.

Nevertheless, the residual attribution alone does not establish their transferability.

Why validation and held-out tests remain insufficient

The authors separately examine whether improvements survive evaluation on benchmark instances withheld from the evolution process.

Excluding ALFWorld, held-out gains are smaller than search-set gains in 13 of 15 settings. In eight settings, they are less than half as large; in four, held-out performance actually declines relative to baseline.

The paper also tests whether selecting harnesses using validation performance improves the outcome.

Among 16 Meta-Harness settings, validation-based selection improves held-out performance in ten and worsens it in six. In 14 settings, the validation-selected held-out gains remain below the search-set gains achieved by search-selected harnesses.

This comparison is a test of an alternative selection procedure, not another attribution component. It shows that withholding evaluation instances and choosing candidates by validation performance does not consistently resolve the problem.

There is a deeper limitation.

One ALFWorld deterministic controller achieves 93.3% success on held-out episodes despite depending on benchmark-specific rules. Its ability to transfer between episodes says relatively little about performance outside the simulator.

Likewise, the LiveMath answer-option shortcut survives into held-out questions because those questions preserve the relevant artifact.

Even a setting assigned 100% residual improvement under HDA can experience held-out regression.

Held-out success establishes performance on the held-out distribution. It does not automatically establish independence from the benchmark’s construction rules.

What changes in an agent deployment decision

For organizations developing AI automation, HDA suggests a more informative process for promoting harness revisions.

Consider a team improving an agent that processes customer requests, operates business software, or resolves coding tasks.

Its deployment decision can be organized around three questions.

First, what happens at comparable inference cost?

The team should measure the original and revised harnesses under approximately matched model-call or token budgets. If additional inference explains most of the improvement, increasing the baseline’s computation may be a simpler alternative.

Cost comparisons should also account for latency and the expense of searching for the improved harness. HDA’s average inference matching does not automatically equalize every cost dimension.

Second, what behavior actually changed?

Inspect evolved prompts, skills, tools, and execution traces. Rules that exploit recurring answer formats or simulator conventions should be distinguished from mechanisms that check action outcomes, recover from errors, or improve task execution.

Benchmark-specific optimization can still be valuable in a tightly controlled environment. The critical issue is whether the assumptions enabling that optimization also hold in the intended operating environment.

Third, does the improvement survive relevant task variation?

Testing should include different task structures, operating conditions, and input patterns that could invalidate the evolved harness’s shortcuts.

For a customer-facing agent, success on newly constructed customer requests may provide stronger deployment evidence than success on additional instances generated by the original benchmark procedure.

These are business applications inferred from the research, not production outcomes established by the experiments.

Attribution is a diagnostic, not a generalization certificate

HDA has several important boundaries.

Shortcut detection can miss implicit or entangled benchmark dependencies. Neutralization may disable more or less than the intended mechanism. Compute matching depends on task-specific choices, and the protocol retains human-review checkpoints for approving compute comparisons and shortcut interventions.

Its estimates are consequently intervention-dependent.

The evidence also comes from four benchmarks and selected model–framework combinations. It cannot establish how much improvement would transfer to every production agent environment.

The authors provide a reusable HDA implementation and skill, making it possible to apply the attribution process to other settings.

For agent developers, the resulting standard is more demanding than reporting an improved benchmark score. A credible performance claim should identify the mechanism behind the gain, the additional computational resources required, and the conditions under which the improvement persists.

An evolved harness may genuinely execute work better. Establishing that claim requires understanding what changed—not merely observing that the score increased.

Cognaptus: Automate the Present, Incubate the Future.