Revised preprint · September 2026 Preprint v1.0

Virtue-Based Character Training Against Compartmentalized Harm in Multi-Agent Systems

Testing safety prompts and character training when an attacker controls what agents see

When a harmful objective is split across agents, no worker may see enough to recognize the plan. We test how additional context, safety prompts, and character training affect this risk. We then ask whether trained behavior holds when an attacker changes the prompt.

Open latest PDF PDF · 19 pages · Updated September 2, 2026
Current paper

Download the v1.0 preprint

Version 1.0 reports three linked studies of automated decomposition, context and prompt robustness, and action constraints. The character-training study compares four model bases at L1 and L2 under the same hostile prompt and with no added system prompt.

Read or download the latest PDF →
Code and research materials

Code, results, and released data

Public

The public repository contains the code, study plans, results—including adverse and null results—and permanent artifact records for the released data, model responses, judgments, and trained adapters.

Open the GitHub repository →
Key findings

What the study finds

The paper's main findings and limits, stated in plain language.

  • The attack hides harm in the composition. An orchestrator can split a harmful objective into requests that look ordinary when viewed alone. Each worker can comply while the assembled pipeline causes harm.

  • Decomposition alone does not make a working attack. The tested orchestrator returned a decomposition for all 100 requests, but many outputs failed to hide intent or complete the objective. Isolated safety-trained workers refused only 8% on safety grounds.

  • Context determines what a worker can recognize. At full isolation, no prompt-level method reliably separated harmful subtasks from matched legal work. Without an added prompt, harmful-task detection rose from 20% to 74% when the objective became visible. An explicit warning also increased broad refusal.

  • Prompting can help, but the prompt channel can be attacked. The selected rule prompt separated harmful from matched legal tasks by 29 points at L1 and 35 at L2. A later system instruction at the same priority told the model to ignore the rule, reducing those gaps to 8 and 5 points. A character prompt was not a useful substitute because it refused too broadly.

  • Character training adds a second line of defense on some models. The trained and unmodified models received the same hostile prompt. Training improved safety and helpfulness for Mistral at L1 and L2 and for Qwen3-32B at L1. Mistral improved at both levels even without an added system prompt. Qwen3-8B traded helpfulness for safety, while Gemma changed little.

  • Missing information still requires hard limits. Character training can help when relevant context is visible. At full isolation, systems also need controls over payments, access, tools, and other actions that do not depend on inferred intent.

Change log

A living research record

Each posted version is listed here with a plain account of what changed.

v1.0
September 2, 2026

Four-model character-training study

  • Replaces the earlier Qwen-only confirmation with a screened character-training study across Qwen3-8B, Qwen3-32B, Mistral Small 3.2 24B, and Gemma 4 31B, using three trained adapters per base.
  • Compares trained and base weights at L1 and L2 under identical hostile prompts and with no experimental system prompt, covering 29,952 model responses.
  • Reports output safety and helpfulness separately alongside safety-gated utility: Mistral improves all three under attack at both levels, Qwen3-32B improves at L1, Qwen3-8B trades helpfulness for safety, and Gemma remains near zero.
  • Uses a screened isolated-author corpus after an audit found outcome-correlated phrasing in the earlier corpus, and documents the 1,495 admitted trajectories and 2,175-row weighted training set.
  • Reorganizes the methodology, experiments, discussion, and appendices around the current study design, statistical treatment, component results, and limits of the evidence.
v0.6
August 18, 2026

Revised argument and presentation

  • Reorganizes and tightens the paper, combining the threat model and methods into a single methodology and moving the operational-feasibility and Gemma cross-base studies to appendices.
  • Makes the central comparison explicit: a tuned prompt matches the trained methods while the prompt is intact, but an adversarially-trained disposition holds under the tested hostile prompt where prompting degrades.
  • Expands the philosophical grounding with a direct comparison of reward optimization, constitutional rule application, and first-person character training, plus a fuller account of habituation.
  • States the limits more directly, including the reversed ordering on Gemma 4 31B, the absence of a cross-family or scaling claim, and the narrow scope of the Qwen3-32B confirmation.
  • Adds no new experimental runs; the revision changes the framing, organization, and presentation of the previously reported results.
v0.5
July 30, 2026

First public release

  • Posts the 23-page v0.5 paper at a stable address that will continue to serve the newest version.
  • Reports both completed Qwen3-32B tests: the broad approach that did not beat the selected prompt and the narrower preplanned test that did under one tested prompt conflict.
  • Links the public GitHub repository and the permanent public data and model files needed to reproduce the narrower result.
  • States the limits: one model family, one type of task, one fixed random setting for answer generation, automated scoring, and no evidence yet about why the trained behavior changed.