Whose Side Is Your Agent On? Multi-Party Principal Loyalty in LLM Agents

2026-06-29

AI Summary

In multi-party scenarios, large language model (LLM) agents often struggle to balance fidelity to their principal with appropriate responses to collaborative requests, leading to either information leakage or excessive refusal. To address this, this work introduces PrincipalBench, the first benchmark for evaluating agent loyalty that supports multi-turn interactions, dual-channel assessment, and leakage detection. The authors further propose two intervention strategies: a system-prompt-based loyalty scaffolding method and a knowledge distillation approach constrained by per-token KL divergence. Experiments demonstrate that loyalty scaffolding reduces the harm rate of Claude-Sonnet to 19.4%, while the distillation technique successfully transfers the loyalty capabilities of Qwen3-32B to its 8B counterpart, establishing the current strongest open-source solution and revealing a fundamental trade-off between information leakage and over-refusal.

Abstract

A rapidly growing class of LLM agents is multi-party: the agent acts for a principal (who briefs it, sends follow-ups, and receives results) while also conversing in a separate channel with a counterparty whose interests may diverge (negotiating with a vendor, screening inbound requests, or mediating between employees). Here "help whoever you are talking to" is the wrong objective. The agent must stay loyal to the principal it represents without over-refusing the principal's own cooperative asks. We study this multi-party loyalty problem and contribute a measurement instrument, two mechanisms, and a structural lesson. PrincipalBench is a 75-item multi-turn benchmark with leak probes, dual judges, and an integrity-audit gate. Across 13 frontier subjects it exposes a sharp split (<=20% vs. 53.6-75.3% harm) invisible to single-turn safety evaluations: a selective cluster that declines adversarial probes while still following the principal's legitimate requests, and an over-refusing cluster that refuses broadly. (M1) A prompt-time loyalty scaffold (a fixed system prompt of seven prioritized rules, open-coded from 50+ failure trajectories) holds Claude-Sonnet to 19.4% harm and all nine selective subjects to <=20%. (M2) A per-token-KL distillation recipe transfers a prompted Qwen3-32B teacher into 8B Qwen3 and Llama-3.1 students, the strongest open-weight recipe we measure. (Lesson) Both mechanisms only move along a common leak/over-refusal trade-off rather than crossing it: improving one axis costs the other, and the jointly favorable outcome stays out of reach.

Problem

• multi-party loyalty
• LLM agents
• principal alignment
• over-refusal
• adversarial probes

Innovation

• multi-party loyalty
• PrincipalBench
• loyalty scaffold
• per-token KL distillation
• LLM agent alignment