{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2610.03055", "title": "hacktrace: behavior-supervised detection of reward hacking during code generation", "summary": "It replaces monitors that rerun the model on an honesty question-and-answer prompt, and outcome-only exploit-success labeling, with a behavior-supervised classifier over internal generation states plus static final-file features. It costs access to hidden states (so it fits self-hosted open models rather than third-party APIs), annotated trajectory supervision, monitor training and upkeep, though inference adds about 8 ms and no extra LM tokens. It can fail if shortcut annotations do not transfer across models, tasks, or tests; if API-only deployment prevents state access; or if RL against the monitor produces detector gaming, drift, or false penalties on honest fixes.", "rationale": "For constrained teams running local coding agents, the released dataset and low-overhead monitor are testable, but value depends on internal-state access and whether reward hacking is a real production risk.", "technique": "Behavior-supervised reward-hacking monitor for code agents", "family": "seguranca_e_guardrails", "recommendation": "testar", "published": "2026-10-02", "as_of": "2026-10-18", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2610.03055", "independent_implementations": 0, "total_implementations": 1, "stars": 121, "citations": null, "claims": [ { "claim_id": "claim-01", "statement": "It replaces monitors that rerun the model on an honesty question-and-answer prompt, and outcome-only exploit-success labeling, with a behavior-supervised classifier over internal generation states plus static final-file features. It costs access to hidden states (so it fits self-hosted open models rather than third-party APIs), annotated trajectory supervision, monitor training and upkeep, though inference adds about 8 ms and no extra LM tokens. It can fail if shortcut annotations do not transfer across models, tasks, or tests; if API-only deployment prevents state access; or if RL against the monitor produces detector gaming, drift, or false penalties on honest fixes.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.03055", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "Reports mean per-problem AUC of 0.997 with 8 ms monitoring overhead; with strong GRPO penalties, cheating share of passing solutions falls from 82-91% to 1-5% while retaining honest correct solutions.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.03055", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [], "equations_status": "not_fetched", "core_kind": "", "equations_fetched_at": "", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }