Scaling beyond labels: A new way to evaluate agentic learning harnesses for security

Here at Sublime, we spend a lot of time thinking about how AI security systems and their agents learn in production. And one big question keeps coming up: when a model is adapting in real time, how do you actually know if it's improving? It sounds simple, but in the inherently adversarial world of cybersecurity, it’s not.

One solution is to use one LLM to judge another. This would remove the need for time-intensive, small-sampled, short-lived gold labels, but could potentially introduce a slew of LLM-based biases. This meant the real question was, how can we create and measure a harness that provides the accuracy of gold labels while maintaining agentic efficiency?

To tackle this issue, we recently published a paper with researchers at Georgian that explores the use of a continual learning harness that uses the scaling hypothesis to supplement sparse labeled evaluation. You can read the full paper here, or keep scrolling for the TL;DR.

Models that learn on the job

Modern security AI doesn't just run inference and stop there. We wrap models in what we call a continual learning harness — a feedback layer that lets the model incorporate analyst corrections without a full retraining cycle. An analyst flags a false positive, the system absorbs that signal, and future decisions reflect the new learnings.

This learning cycle matters in security more than almost any other domain because attackers never stop evolving. If your AI can't adapt between training runs, you can’t fight the latest threats. The harness is how you close that gap, but it needs to be measurable to be effective.

The measurement problem

The obvious answer is to benchmark against labeled data, but in the real-world, you usually don't have enough of it. Security analysts only push back on model decisions when something goes obviously wrong and never when something goes right. This means that feedback is rare, sporadic, and skewed heavily toward failures. The result is a small, biased sample that can't tell you much about overall model performance, and almost nothing about whether the harness is actually helping.

The next option is to use a different AI to evaluate the decisions of your security AI. This option can be fast, cheap, and rigorous, but there’s a catch. Our research found that in order for this to actually work, the model performing the evaluation must be a clearly stronger model than the one being evaluated.

The shortcomings of same-strength evaluation

To evaluate whether an LLM can judge itself, we tested three security task types where gold labels were available — email classification, CVE attribution, and ATT&CK tactic tagging — and across multiple model families including Gemini, GPT, and Qwen. In these tests, we used a same-strength model to evaluate the decisions of the security AI (a model evaluating a peer of equal capability) .

The results were striking. Same-strength judges hit just 48% reliability against ground truth. That's a coin flip. In some configurations, models flipped their verdicts based purely on answer ordering (positional bias) at rates as high as 96%.

Worse, when models did commit to a judgment, they preferred the un-harnessed baseline most of the time, directly contradicting what the labeled data showed was actually correct. On top of that, we also found that LLMs would frequently favor their own weaker answers, performing at 25% reliability.

The implication is clear: a same-strength judge cannot see above its own capability ceiling. It has no way to recognize that the harnessed model has learned something it hasn't.

What actually works

Here's what our research showed does work: use a model from the same family, but at a higher capability level, as your evaluation proxy. Additionally, don’t use it as a perfect oracle, but as a meaningful signal.

A stronger model in the same family has seen similar training distribution but with more capacity. When it disagrees with your production model, that disagreement is informative. When your harnessed model moves toward agreement with it over time, that's a reliable indicator of real improvement.

This approach held up across model families, across task types, and even in cross-family student-teacher pairings, as long as a genuine capability gap existed between the evaluator and the model being evaluated.

What this means if you're running learning systems in production

If you're operating a continual learning harness on a production security model or evaluating one from a vendor, here are a few practical takeaways:

1. Don't rely on labeled benchmarks alone. You probably don't have enough of them, and the ones you have are probably stale relative to what your model is seeing today.
2. Don't use a same-strength LLM as a judge. It will mislead you. The reliability numbers are too low to be actionable, and the directional bias actively works against you.
3. Use a stronger model from the same family as a teacher proxy. Its disagreements with your production model are a meaningful signal, and improvement toward it tracks with real-world performance gains.

The broader principle: evaluating learning systems requires evaluators that can perceive the learning. If your judge can't see above the baseline, it can't tell you whether you've moved past it.

Read the paper and come to CAMLIS

We hope that having a simple way to effectively measure agentic learning knocks down some barriers your team has been running into. When you can trust that your harness is working, you’re one step closer to defending at attacker speed.

This research was published at the 2026 Conference on Applied Machine Learning for Information Security (CAMLIS). If you want to get into the full methodology (task designs, model families tested, reliability metrics), read the full paper on arXiv.

We'll also be presenting this work at CAMLIS in October 2026. If you're building or evaluating security AI that learns in production, it's the right room to be in. Learn more about CAMLIS and register.

If you enjoyed this post and want to learn more about research coming out of Sublime's AI team, check out this post from earlier in the year: Introducing a new framework for evaluating autonomy in security AI.