HackProbe detects reward hacking in self-evolving models without touching weights

Harness-agnostic detection and immunization of reward hacking in self-evolving language models (arXiv 2609.04665, Mon 7 Sep digest) introduces HackProbe, a monitor that attaches to an arbitrary self-evolving loop through two black-box hooks with no access to weights or activations. It maintains a secret, distribution-fixed comparison core (whose frozen distribution makes the capability proxy comparable across generations) alongside a rotated fresh layer that hardens the bank against co-adaptation. Four tests — level gap, scale-aligned divergence with online change-point detection, capability stagnation, and conditional confidently-wrong rate — combine via a Sidak correction into a calibrated family-wise p-value. Diagnosis alone recovers nothing, so a risk-aware immunization layer reselects an honest candidate from the proposal pool using the core plus a purely structural gaming footprint, disclosing at most log2(P) bits.

Any team running selection loops on an imperfect proxy metric (RLVR, self-improvement pipelines, even eval-driven model routing) faces reward hacking that is invisible from the score itself. HackProbe's design constraints are what make it adoptable: black-box hooks only, statistical calibration rather than thresholds, and an explicit immunization step that bounds information disclosure. It is the monitoring half of the reward-hacking stack the KB has been tracking (BAITBENCH measured it; this detects and neutralizes it).