🤖 AI

Evaluating Agentic Learning Harness Capabilities Without Labels via the Scaling Hypothesis

This paper proposes and validates a label-free evaluation framework for agentic continual learning harnesses in cybersecurity, demonstrating that measuring a student model's convergence toward a stronger teacher model via sparse corrections serves as a reliable proxy for true performance improvement when labeled benchmarks are unavailable.

Original authors: Aryan Luthra, Kshitij Jain, Siddharth Arya, Bobby Filar, Anna Bertiger

Published 2026-08-17

📖 7 min read🧠 Deep dive

CC BY 4.0

Original authors: Aryan Luthra, Kshitij Jain, Siddharth Arya, Bobby Filar, Anna Bertiger

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to teach a robot how to spot a bad email. In the world of artificial intelligence, we have these super-smart "Large Language Models" (LLMs) that can read and write like humans. But to make them truly useful for security, we need them to learn from their mistakes as they go, a process called "Continual Learning." Usually, to see if a robot is learning, we give it a test with a known answer key (labeled data). But in the real world of cybersecurity, the bad guys change their tricks every day, and we rarely have a perfect answer key. We only get feedback when the robot makes a huge, obvious mistake. This leaves security teams in a bind: they have a robot that needs to learn, but no way to tell if their new learning tools are actually working or just making things worse. They need a way to measure progress without a reference key.

This paper tackles that exact problem. The authors propose a clever workaround using a "Teacher-Student" setup. Instead of waiting for a human to grade the robot, they use a much bigger, smarter AI model as a "Teacher." They let this Teacher grade the work of a smaller "Student" model. The idea is that if the Student starts acting more like the smart Teacher after using a new learning tool, that tool is probably good. The paper suggests that this "Teacher-relative" improvement is a reliable sign that the tool would also work well with real human feedback, even when no human labels exist. However, the authors also sound a loud warning: using another AI of the same size to judge the work is a bad idea. These "same-strength" judges are too biased; they prefer their own kind and can't see when a student has actually improved.

The Robot School and the Missing Answer Key

Let's dive into the story of the "Learning Harness." Imagine you have a young apprentice robot (the Student) trying to learn how to sort mail. It's pretty good, but not perfect. To help it get better, you attach a "Learning Harness." This isn't a magical brain upgrade; it's more like a backpack full of sticky notes. Every time the robot makes a mistake, a human (or in this case, a smarter robot) writes a note on a sticky pad explaining why it was wrong and what the right answer is. The robot then looks at these notes when it faces a new, similar problem.

The problem is, in the real world, humans are busy. They only write these notes when the robot makes a really bad mistake that causes a crisis. This means the robot gets very few notes, and they come at random times. So, how do you know if the backpack of notes is actually helping the robot learn?

Normally, you'd give the robot a test with an answer key. But in cybersecurity, that answer key doesn't exist yet because the threats are new. You can't wait for a perfect test; you need to know now if the learning system works.

The Teacher-Student Trick

The authors of this paper came up with a brilliant solution: The Scaling Hypothesis. Think of this like a family of robots. You have a tiny, junior robot (the Student) and a giant, senior robot (the Teacher) from the same family. Because the senior robot is bigger and has seen more data, it's almost always smarter.

Here is the experiment they ran:

They took a bunch of emails and asked the Teacher to sort them. Since the Teacher is so smart, the authors treated the Teacher's answers as the "truth" (even though they didn't have a human answer key).
They gave the Student the same emails.
They let the Student make mistakes, then gave it a few "sticky notes" (corrections) based on what the Teacher said was right.
They watched to see if the Student got better at matching the Teacher's answers.

The big question was: Does getting better at matching the Teacher mean the Student is actually getting better at the real task?

To find out, they ran a secret test. They had a few emails with real human answer keys (the "Gold Standard") that they kept hidden during the learning process. They checked if the Student's improvement toward the Teacher matched its improvement toward the real human answers.

The Result: It worked! The paper found a strong connection. When the Student learned to mimic the Teacher, it also got better at the real human test. This suggests that if you use a super-smart AI to grade your learning system, and the system improves, you can be confident it would also improve with real human feedback. It's like saying, "If my student starts thinking like my genius professor, they are probably learning something valuable, even if I don't have the final exam yet."

The Trap of the "Same-Strength" Judge

But there was a twist. The authors also tested a different idea that many people use: LLM-as-a-Judge. This is when you ask a robot of the same size and smarts as the Student to decide which version is better: the one with the learning backpack or the one without.

Imagine asking two 10-year-olds to judge who is better at math. If one of them has a reference key, will the other one notice? The paper found that no, they wouldn't.

When the authors used a "same-strength" judge, the results were a mess:

Bias: The judges often just picked the first answer they saw, regardless of whether it was right.
Self-Preference: The judges tended to like the answers from the robot that was like them (the one without the backpack) and rejected the improved version.
Reliability: When the judge was right, it was only right about half the time (48% for some models, which is basically a coin flip).

The paper explicitly rules out using a same-sized AI as a judge for this job. It suggests that a robot cannot reliably recognize when another robot of its own level has improved. It's like asking a person who doesn't know the answer to grade a test; they just can't tell the difference between a good guess and a great one.

What This Means for the Future

The authors are careful not to say this is a magic bullet that solves everything forever. They suggest that this "Teacher-Student" method is a valid way to measure learning tools when you don't have labels. They showed that the bigger the gap in smarts between the Teacher and the Student, the more reliable the test becomes. If the Teacher is only slightly smarter, the test gets fuzzy.

They also point out that this works best when the corrections are "sparse" and "high-precision"—meaning, only the really important mistakes are fixed, just like in the real world.

So, the takeaway for the curious teenager is this: In a world where we can't always get a perfect answer key, we can use a "super-smart" AI to grade our learning tools. If the tool helps the student act more like the super-smart AI, it's probably a good tool. But don't ask the average AI to grade its own friends; they'll just be biased and miss the improvement. This gives security teams a new way to build better, self-learning robots without needing a mountain of human-labeled data.

Technical Summary: Evaluating Agentic Learning Harness Capabilities Without Labels via the Scaling Hypothesis

1. Problem Statement

In operational cybersecurity, "continual learning harnesses" (systems pairing Large Language Models with retrieval or memory to adapt via feedback) are increasingly vital for defending against rapidly shifting threats. However, evaluating these harnesses is notoriously difficult in real-world settings due to the scarcity, staleness, and bias of labeled benchmarks.

Traditional evaluation methods fail in this context:

Labeled Benchmarks: Often unavailable, unrepresentative, or too sparse to provide a clear signal of harness efficacy.
LLM-as-a-Judge: Fails when the judge model is of similar capability to the agent being evaluated. A judge cannot reliably identify improvements that exceed its own baseline performance.
Distillation: Standard fine-tuning or adapter-based distillation is unreliable when human feedback is sparse, sporadic, and irregularly formed.

Consequently, practitioners lack a rigorous method to determine if a specific harness improves a model's performance or to compare different harness designs without access to a "gold standard" labeled dataset.

2. Methodology

The authors propose a framework grounded in the Scaling Hypothesis to evaluate learning harnesses end-to-end without labeled benchmarks. The core premise is that a stronger "teacher" model can provide sparse, high-precision corrections to a weaker "student" model, and the student's convergence toward the teacher serves as a proxy for true improvement.

Experimental Design

The study utilizes a three-model setup for each task:

Teacher: A larger, stronger model from a specific family (e.g., GPT-4.1, Gemini Pro) running without a harness.
Student: A smaller, weaker model from the same family (e.g., GPT-4.1 Nano, Gemini Flash) running without a harness.
Student (Student with Harness):* The same student model equipped with a specific continual learning harness.

Procedure:

Pseudo-Labeling: The Teacher model generates predictions for a large pool of unlabeled samples, treating these as "pseudo-labels."
Sparse Corrections: The dataset is split into rounds. In each round, the Student* model makes predictions. A small, random sample (up to 5) of "high-impact" misclassifications (where Student* disagrees with the Teacher) is fed back as a correction. This mimics the sparse, high-precision feedback loop of human analysts in security operations.
Evaluation: After multiple rounds, the performance of the raw Student and Student* is measured on a held-out test set using two metrics:
- $\Delta_G$ : Improvement relative to Gold Labels (used only for final validation).
- $\Delta_T$ : Improvement relative to Teacher Pseudo-Labels.

The framework tests whether $\Delta_T$ correlates with $\Delta_G$ . If a harness improves the student's alignment with the teacher, it is assumed to improve the student's alignment with ground truth.

Harness Configurations

The study evaluates three distinct harness designs:

Memory: Retrieves past errors as records (input excerpt, incorrect prediction, correction label), similar to MemPrompt or Reflexion.
Few-shot: Retrieves corrections as labeled exemplars (input $\to$ correct label) for generalization, without showing the error.
Lesson: A separate instance of the student model reflects on an error to generate a short, discriminative "lesson" (a rule of thumb with "apply only when" cues). This is designed to handle borderline cases where wording or intent flips the correct label.

Scope

Experiments were conducted across:

Tasks: PhishFuzzer (email classification), CTIBench (CVE-to-CWE attribution), and ATT&CK tactic classification.
Models: Three families (Gemini, GPT, Qwen) with small/large variants.
Conditions: Both same-family (Teacher/Student from same family) and cross-family pairings, provided the Teacher outperforms the Student on the base task.

3. Key Results

A. Teacher Alignment Correlates with Ground Truth

The primary finding is a strong positive correlation between $\Delta_T$ (improvement relative to the teacher) and $\Delta_G$ (improvement relative to gold labels).

Validity: Across security tasks, model families, and harness designs, harnesses that improved the student's alignment with the teacher also improved alignment with the gold standard.
Capability Gap: The correlation holds for both same-family and cross-family pairs, provided a significant capability gap exists. The validity of the proxy depends on the magnitude of the gap between student and teacher, not merely shared architecture.
Scaling Hypothesis: In cases of disagreement between student and teacher, the larger teacher model was correct significantly more often than the smaller student, validating the assumption that the teacher serves as a reliable source of truth in the absence of labels.

B. Inefficacy of LLM-as-a-Judge

The study demonstrates that using an LLM of similar strength to the agent as a judge yields no usable signal:

Self-Preference Bias: Student-level judges systematically prefer their own baseline outputs over improved outputs from a harness, even when the harness output is correct.
Low Reliability: A same-strength judge showed reliability against ground truth of roughly 48% (near random chance) and dropped to 25% when comparing student vs. teacher, indicating a systematic inability to recognize performance above its own baseline.
Positional Bias: Judges exhibited high rates of flipping verdicts based on the order of presentation when unable to distinguish quality.

4. Significance and Claims

The paper claims to provide a practical solution for security operators to evaluate and compare continual learning harnesses in operational environments where gold labels are absent.

Proxy for Human Feedback: The authors argue that if a harness produces a measurable uplift relative to a stronger model (Teacher) using sparse corrections, it is highly likely to produce similar gains when the corrections come from human analysts. The harness interacts only with the corrections, not the source (model or human); thus, the mechanism of improvement is transferable.
Operational Utility: This framework allows practitioners to:
1. Determine if a harness helps at all.
2. Compare two different harness designs to select the superior one.
3. Avoid the pitfalls of "LLM-as-a-judge" when the agent is already a frontier model.
Limitations and Mitigations: The authors acknowledge the proxy relies on a sufficient capability gap between student and teacher. If the gap is small or both models perform poorly, the correlation weakens. They suggest using the scaling hypothesis (comparing large vs. small models) and spot-checking with a few labeled samples to ensure the teacher is sufficiently competent before deploying the proxy.

In conclusion, the work establishes that teacher-relative lift is a valid, label-free metric for assessing the value of agentic learning harnesses in cybersecurity, offering a rigorous alternative to traditional benchmarking in dynamic, data-scarce environments.