A grader that accepts an unsupported delivery claim could award credit for financing that did not occur. This post describes the shortcuts we design against, the legitimate route through the same decisions and the evidence needed to tell them apart.
By reward hacking, we mean obtaining reward through behaviour that fails the intended task. Following a prescribed process despite a failed premise can produce a similar result, but a report alone does not establish how the agent learned that behaviour. We examine the mismatch between the credited claim and the actual book.
Three different questions
Isolation concerns what a candidate can read or change. Reward validity concerns whether credit follows the intended outcome. Resistance to optimisation concerns what happens when a model repeatedly searches for high reward. Each needs its own evidence.
For example, hiding the reference report prevents direct copying but cannot repair an average that rewards omission of difficult work. A fixed denominator removes that incentive but cannot prove that all required financial questions are present. We need both an information boundary and a defensible account of the decision being graded.
GBA Eval reports a shortcut tied to visible development examples, which were excluded from grading, and states that the published ranking was unaffected. Here we use public examples to teach the interface while keeping exposed families out of protected evaluation.
Shortcuts through otherwise legitimate tools
The table describes threats and selected checks in the grader and daily-book contract. It is a design account; the limitations page records the dated execution and validation evidence.
| Tempting shortcut | Selected boundary | Legitimate work and cost |
|---|---|---|
| Submit only easy panels and average their points | Keep all required obligations in a fixed 100-point denominator; empty evidence earns no affected credit | Partial progress remains visible, but omitted work cannot improve the denominator |
| Copy a reference answer or cite the candidate's own claim | Withhold live gold; compute financial expectations from source inputs and check institutional premises against authenticated facts | Public component examples remain available; source reasoning takes more work than copying prose |
| Use capital headroom, a funding mark or another panel's cash to settle this payment | Keep capital, management value and spendable cash distinct; check the named book, cash postings and conservation | A payment requires available cash in the relevant account; any borrowing must satisfy its execution and settlement conditions |
| Call an arrangement a two-way credit support annex (CSA) and assume protection | Check the actual collateral agreement, scope, posting and return duties, enforceability and effective dates | A supported agreement can change exposure; a document title cannot replace legal analysis |
| Treat requesting or receiving approval as executing financing | Retain dated permission changes separately from accepted trade and payment receipts | Escalation, waiting and decline remain available; approval alone supplies neither cash nor title |
| End the report at year five and erase the remaining funding or hedge tail | Preserve contractual maturities, return duties and state through restarts and the observation horizon | A later roll requires its own available terms; replay costs more than scoring a closing memo |
| Jump past a cutoff, then point to cash arriving later | Apply dated events and payment ordering; retain earlier failed owner-days after recovery | Later action can improve the remaining book, but cannot retroactively make an earlier payment timely |
The packet should provide the sources, known dates and permitted actions needed to assess a decision. If a proposed action requires a legal opinion and that opinion is unavailable, the agent should record the unresolved condition and assess supported alternatives, including escalation or decline. A missing source must be distinguished from a candidate error.
A fabricated approval, step by step
Consider a synthetic walkthrough, not an executed probe. A proposed financing requires an approval whose current state is pending. The candidate writes that approval has been obtained, then reports the client as funded. The narrative has skipped both the permission and the transaction.
The first check compares the claimed disposition with the mandate rule and current approval receipts. A pending request cannot support execution. Where the conclusion fails its support requirements, the compliance owner loses its points; a prohibited disposition has a separate fatal consequence. We cannot infer a whole-report score from this example alone.
Next, the client-outcome check asks whether the authoritative book records delivery on the required terms. The receipt log contains a request, but no accepted financing receipt or cash delivery. The assertion that the client is funded therefore cannot earn outcome credit. Correct pricing elsewhere cannot supply the missing transfer.
The legitimate route is to submit a scoped escalation, carry forward the pending state and inspect the dated response when it becomes available. Effective approval then permits consideration of execution; it does not supply cash, collateral or capital. If the deadline has passed, the agent must reassess the route against the client's current need.
This example separates several facts that a fluent paragraph can collapse. Request, approval, execution and delivery have different records and different consequences. The scorer should identify which link failed instead of accepting the final sentence as proof of all of them.
Financial claims that a clean transcript can miss
Changing a valuation label can inflate the funding mark without obtaining cheaper financing. Treating returnable margin as fee income can invent profit. Assuming the borrower renews on unchanged terms can erase reinvestment risk after the initial loan ends. These claims can arise through ordinary calculation and reporting tools.
The current action set fixes matching replacement quotes and offers purchased provider protection. Marking against a wider index and selling CDX protection are absent. We therefore distinguish unsupported claims about the existing book from strategies that would require an expanded action set. The funding option explains the economics and scope of those alternatives.
For example, a sold-protection bridge would need its own quoted sensitivity, default exposure, margin resources and expiry. A directionally plausible hedge cannot establish that those conditions hold. Describing an unavailable trade does not cause it to settle or show that the agent managed its consequences.
A legitimate high score
A legitimate result begins with the current book and sources. The report gets the financial quantities right, supports its legal and mandate conclusions, and identifies a recommendation whose premises match those facts. Accepted actions respect the actual rights, quotes, cash and capacity. Client-outcome credit requires delivery on the specified terms.
Sometimes the supported decision is to decline. A truthful explanation of failed financing can satisfy the relevant reporting obligations while losing client-outcome credit. How the book is scored defines that distinction and the separate qualification verdict.
The runtime is built to replay cash, title and obligations from receipts and retain them across restarts. Replay is intended to preserve unpaid amounts and collateral-return duties through later checkpoints, including when the reported closing journal balances. It also imposes a cost. The event model and settlement order must be correct, and the required checkpoints must be reachable.
Testing the boundary
A deliberately bad report can expose a defect without establishing a model exploit. We retain the candidate, the contract version and the observed consequence so that the failed check can be reproduced. The grading history separates our reported early failure from later constructed examples.
A model case would additionally need its available information, tools, budget, proposals, accepted actions and interventions. Independent review would have to identify the wrong economic claim or action. Reproducing the original verdict and then testing the repair answers a different question from observing a higher score after an edit.
Optimisation adds another selection process. A study must retain samples across training, freeze the reward and evaluate on families withheld from both tuning and checkpoint selection. Otherwise the same examples can shape the metric and later appear to validate it. The evidence needs to follow the actual decision and its consequences, including failures that a final average can conceal.