A Boston University paper accepted to ACL 2026 Main shows that distilling multi agent debate into a single LLM preserves — and exposes — the agents as interpretable directions in activation space.
A new paper from Boston University reports that a single fine-tuned language model can match or beat an explicit multi-agent debate system while using up to 93% fewer tokens — and, more unusually for this corner of the field, that the "agents" survive the distillation as linearly separable directions in the model's own activation space.
The work, "Latent Agents: A Post-Training Procedure for Internalized Multi-Agent Debate" by John Seon Keun Yi, Aaron Mueller, and Dokyun Lee, was submitted to arXiv on 27 April 2026 and has been accepted to the ACL 2026 Main conference. The authors position it as the first procedure to distill multi-agent debate specifically into a single model, distinct from prior work on distilling multi-agent communication more broadly (e.g., Li et al. 2025; Luo et al. 2026).
The procedure is called IMAD, for Internalized Multi-Agent Debate, and it runs in two post-training stages described in the paper.
Stage 1 is supervised fine-tuning on multi-agent debate traces, teaching the model to reproduce the structural rhythm of an explicit debate — multiple perspectives, turn-taking, the back-and-forth that explicit debate systems perform at inference time. Stage 2 is reinforcement learning with a dynamic reward schedule and a length-clipping term, which pressures the model to compress the same collaborative structure into a smaller token budget and, crucially, into its own latent representations rather than emitting the debate verbatim.
The headline result: across multiple model families and benchmarks, an IMAD-trained single model matches or exceeds the performance of the explicit multi-agent debate system it was distilled from, while consuming up to 93% fewer tokens at inference. That 93% figure is the maximum reported across the model/benchmark combinations the authors tested; the per-benchmark numbers vary, and the arXiv v1 should be checked against the ACL camera-ready before any single number is quoted as canonical.
The more durable scientific claim is mechanistic, and it is the part of the paper most likely to outlive the efficiency numbers. The authors apply activation steering using the difference-in-means method of Marks and Tegmark (2023) to probe the internalised model. They find that internalisation does not collapse the multi-agent structure into a homogeneous single-voice model. Instead, it carves out agent-specific subspaces: linearly separable directions in activation space that correspond to distinct agent perspectives.
In other words, the model is not just behaving like a debater. The perspectives it was trained to represent have left a geometric footprint — directions you can point to, measure, and move. When the authors steer the model along those directions, it exhibits agent-specific behaviours, indicating that the collaborative structure of the original debate is preserved inside the single model rather than averaged away.
That finding gives the work a reason to exist beyond "cheaper inference." It turns a systems result into a measurement result: there is now a concrete, internal object — the agent subspace — that other researchers can probe, reproduce, and argue about.
The third contribution is a safety demonstration that turns the subspace finding into something an operator can act on. The authors train an IMAD model on debates that include a deliberately malicious agent. As before, that persona shows up as a steerable direction in activation space. They then apply negative steering along that direction to suppress the persona.
The relevant comparison is against the base model. Suppressing the harmful direction in the IMAD model costs less general capability than running the same negative-steering intervention on a non-internalised base model. The training procedure has, in effect, localised the harmful persona into a direction that can be pushed down with less collateral damage to the rest of the model.
For builders and safety teams, that is a different kind of result than a benchmark win. It suggests that internalisation is not just a cost trick: it is a way of isolating multi-agent behaviour inside a model so it can be inspected and damped.
Several caveats belong next to the result. All mechanistic and performance claims here come from a single primary source — the authors' own paper — and should be read as author-reported until independent replication or commentary surfaces. The version on arXiv is v1; the ACL 2026 camera-ready may revise specific numbers. The benchmarks the authors evaluate on are reasoning benchmarks, and "internalised debate" is a narrower construct than the popular framing of "AI debating itself" might suggest. The 93% token-reduction figure is the maximum across the reported settings, not a per-benchmark average, so it should be quoted with that scope. Finally, the authors' claim to be the first to distill multi-agent debate is a positioning statement that depends on how debate is scoped against concurrent work; it is best attributed rather than asserted.
Code and configs for the procedure are released on GitHub, which makes the subspace and steering claims at least locally reproducible for teams willing to re-run the pipeline.
The interesting question the paper leaves open is not whether a single model can match a multi-agent system on cost — that has been the general trajectory of model distillation for some time. It is whether the behaviours of multi-agent systems are already latent inside the single models most teams are running today, and whether those behaviours, once internalised, become easier to measure, steer, and suppress.
IMAD's answer is: yes, at least for debate, and yes, at least enough to find them with a difference-in-means probe. For a working researcher, that is a new object to measure and a new knob to turn. For a safety-minded reader, it is a measured, if preliminary, controllability result: suppress a harmful persona after internalisation, and you pay less in general capability than you would suppressing it in a base model. Neither of those is a deployment guarantee. But both are concrete enough to take to the next paper — and to the next safety review.