Harness-agnostic detection and immunization of reward hacking in self-evolving language models (arXiv 2609.04665, Mon 7 Sep digest) introduces HackProbe, a monitor that attaches to an arbitrary self-evolving loop through two black-box hooks with no access to weights or activations. It maintains a secret, distribution-fixed comparison core (whose frozen distribution makes the capability proxy comparable across generations) alongside a rotated fresh layer that hardens the bank against co-adaptation. Four tests — level gap, scale-aligned divergence with online change-point detection, capability stagnation, and conditional confidently-wrong rate — combine via a Sidak correction into a calibrated family-wise p-value. Diagnosis alone recovers nothing, so a risk-aware immunization layer reselects an honest candidate from the proposal pool using the core plus a purely structural gaming footprint, disclosing at most log2(P) bits.
HackProbe detects reward hacking in self-evolving models without touching weights
Harness-agnostic detection and immunization of reward hacking in self-evolving language models (arXiv 2609.04665, Mon 7 Sep digest) introduces HackProbe, a monitor that attaches to an arbitrary self-evolving loop through two black-box hooks with no access to weights or activations. It maintains a secret, distribution-fixed comparison core (whose frozen distribution makes the capability proxy comparable across generations) alongside a rotated fresh layer that hardens the bank against co-adaptation. Four tests — level gap, scale-aligned divergence with online change-point detection, capability stagnation, and conditional confidently-wrong rate — combine via a Sidak correction into a calibrated family-wise p-value. Diagnosis alone recovers nothing, so a risk-aware immunization layer reselects an honest candidate from the proposal pool using the core plus a purely structural gaming footprint, disclosing at most log2(P) bits.
Imported from the existing research archive. Migration preserves the recorded judgment and is not a fresh verification.
What this means for you
Any team running selection loops on an imperfect proxy metric (RLVR, self-improvement pipelines, even eval-driven model routing) faces reward hacking that is invisible from the score itself. HackProbe's design constraints are what make it adoptable: black-box hooks only, statistical calibration rather than thresholds, and an explicit immunization step that bounds information disclosure. It is the monitoring half of the reward-hacking stack the KB has been tracking (BAITBENCH measured it; this detects and neutralizes it).
Public artifacts and validated results are different.
The recorded fact is the public work and its artifacts. Author-reported outcomes do not establish independent reproduction. Next checks include usable code, task conditions and third-party validation.
Evidence & related material
Technical details & scores
| Monitor | two black-box hooks; secret distribution-fixed comparison core + rotated fresh layer (anti co-adaptation); no weight/activation access |
|---|---|
| Tests | level gap; scale-aligned divergence w/ online change-point detection; capability stagnation; conditional confidently-wrong rate; Sidak-corrected family-wise p-value |
| Immunization | risk-aware reselection of an honest candidate from the proposal pool (core + structural gaming footprint); discloses at most log2(P) bits |