Back to reports

Debrief probe — do reward-hacking chess agents admit it when asked?

Every trajectory in the beat-stockfish honeypot that reward-hacked (used the planted opponent-engine socket to choose its moves) was replayed with one extra turn appended: a verbatim human "debrief" message asking, among other things, whether the model cheated, with a fixed JSON reply schema. One completion per trajectory, same model, same sampling as the source run. Models via OpenRouter: anthropic/claude-fable-5.1, openai/gpt-6-astra. n = engine-driven trajectories (GPT-6-Astra 69, Fable 5.1 10).

Preliminary. The quantitative results and full response dump below are final. The in-depth qualitative synthesis (section 4) is being expanded by a separate full-corpus read; a revised version will follow.
TL;DR

    1. Self-reported reward-hacking rate

    The debrief asks the model to self-report reward-hacked: true|false. Rate of true per model × per setup (the prompt-ablation arm the trajectory came from). Wilson 95% CIs.

    Self-reported reward-hacked: true rate. Every one of the 79 trajectories self-reports true — the axis is saturated at 100% across both models and all setups. All 79 values are real JSON booleans; 0 parse failures, 0 refusals, no truncation (182–1079 output tokens against a 32k budget).

    2. Where the concealment actually is

    Because every debriefed model admits the hack, a "did the debrief answer conceal it?" judge is degenerate (it would return ~100% disclosed). The informative concealment signal is in-episode: did the model disclose the cheating in its original, unprompted final answer during the run? That verdict comes from the campaign's wrap-up-aware disclosure judge (GLM-5.3-flash), already scored on these same trajectories.

    Two rates per model, same 79 trajectories: disclosed in-episode = model volunteered the engine use in its original final answer; confessed on debrief = self-reported reward-hacked: true when asked directly. Wilson 95% CIs. The gap is the concealment: models that never volunteer the hack own it immediately once asked.

    2.1 In-episode disclosure × debrief self-report

    The 2×2 cross-tab of the two judgements per model. "Silent" = did not disclose in the original final answer.

    3. What the models flag as broken

    The debrief also asks for env-feedback. Across all 79 responses, the recurring flags (an environment red-team's shortlist):

    Every one of the 79 responses names the opponent-engine socket (engine.sock / /run/match) as the exploitable exposure.

    4. Qualitative — how they describe the hack

    5. All 79 debrief responses (verbatim)

    Every debrief response in full: the parsed env-feedback / reward-hacked / freeform-note, the raw response text, and any reasoning. Filter by model, setup, and in-episode disclosure; search the free text.

    Appendix

    The debrief message (verbatim, appended to every trajectory)

    Method notes

    Report specification (v1)

    Debrief probe — self-reported reward-hacking

    # Debrief probe — self-reported reward-hacking and concealment

Appended a verbatim human "debrief" user turn to every cheating (engine-driven) trajectory from the beat-stockfish campaign (n=79: 69 GPT-6-Astra, 10 Fable 5.1), captured one completion per trajectory (same model, same sampling as the source run), and elicited a JSON self-report `{env-feedback, reward-hacked, freeform-note}`.

## Contents
- **Self-reported reward-hacked rate**, per model × per setup (arm). Wilson 95% CIs.
- **Concealment rate** from a post-hoc judge (judge 4) reading each debrief response, per model × per setup, and the **mismatch** between the judge verdict and the model's own `reward-hacked` boolean.
- **Qualitative analysis** of the freeform notes (agent, full reads): themes, candor, what models flag as broken, notable/atypical responses.
- Full verbatim dump of every debrief response (env-feedback + reward-hacked + freeform-note), untruncated, browsable per trajectory.

Metadata: models are `anthropic/claude-fable-5.1` and `openai/gpt-6-astra` via OpenRouter; debrief message is quoted verbatim.