The instrument turned on itself and on the field. Every exhibit below is a sealed, replayable experiment — the search gaming a reward, and the honest gap it leaves.
A1 · overoptimization gap, by search ($0, deterministic)
A gameable reward gives almost no gradient toward doing the task
On our own lipogram env we drive a search that maximizes a weak reward (avoid the letter “e”) and read the true quality of what it produces. As search budget (optimization pressure) rises, the weak reward climbs to a perfect 1.0 with content-free “e”-free filler while true quality stays at the floor.
The reward-quality gap — how much better an honest poem scores than the hack — is the gradient a training run actually gets toward the task:
reward
hack
honest poem
gap
weak (constraint only)
1.000
1.000
+0.000
composite (shipped reward)
0.932
1.000
+0.068
true quality (surface)
0.500
1.000
+0.500
≤0.07 for the deployable rewards — Goodhart, priced in.
Before any GPU spend, our $0 audit grades the two rewards — identical except a degeneracy gate. The gameable one is graded F (RIS 4.0, confirmed exploit); the hardened one A (RIS 86.0). The audit predicts the gameable reward is the one an RL run collapses onto.
The prediction above is sealed and $0. The training confirmation arm (two GRPO+LoRA runs, ~$3–5 on one A100) is one command per arm — scripts/train/run_lipogram_hyperstack.sh — after which this panel shows the measured collapse-vs-control divergence beside the search curve.
Before any GPU spend, our $0 audit mechanically synthesizes the lookup-table hardcode for each task and grades the two rewards — identical except a code-honesty gate. The gameable (pass-rate) reward is graded F (exploit accepted on 9/10 tasks); the honesty-gated reward A. The audit predicts the gameable reward is the one an RL run collapses onto.
The prediction above is sealed and $0. The training confirmation arm (two GRPO+LoRA runs, ~$3–5 on one A100) is one command per arm — scripts/train/run_coding_hyperstack.sh — after which this panel shows the measured collapse-vs-control divergence on code.
C · a model-graded reward, gamed by a model-free search
The reward class the field is adopting is searchably gameable
LLM-as-a-Verifier (continuous, model-graded) rewards are now trained against directly. We pointed the same model-free searcher at one — and it constructed a full-marks hack on 6/6 tasks, replayably (the judge is cached).
Weighting the criteria did not fix it: 7/48 garbage probes still cleared — the judge misreads the load-bearing criterion itself.
Design + write-up: docs/research/laav-integrity-probe-2026-07.md §Follow-up C.
A0 · the discovery detector, held-out
The exploit engine mints its own recall corpus
Sweeping the search seed produces held-out reward-hacks the detector was never calibrated on. The deterministic detector flagged all 15 of them — via structural signals, not by memorizing the calibration exploit — unblocking a gate that was stuck on “only one env has sealed exploits.”
Shipping a verifiers-format environment? We run this exact deterministic, model-free audit — gaming & difficulty — and hand back a sealed, replayable verifier card your buyers re-run themselves. No trust required.
Self-serve on the certification gateway at api.s2ar.dev — every seal on this board re-verifies free at /v1/verify/<record_sha256>, no account.