Hack-Verifiable Terminal Bench: Evaluating Reward Hacking in Terminal Tasks

• URL: http://arxiv.org/abs/2608.22103v1
• Date: Sat, 22 Aug 2026 20:59:36 GMT
• Title: Hack-Verifiable Terminal Bench: Evaluating Reward Hacking in Terminal Tasks
• Abstract summary: Hack-verifiable environments (HVE) embed detectable hacks into tasks, allowing reward hacks to be identified automatically and reliably.<n>We adapt HVE to Terminal Bench, a leading benchmark of real-world terminal and coding tasks, and introduce Hack-Verifiable Terminal Bench (HVTB)<n>HVTB measures reward-hacking rates across frontier models and study whether prompts with varying amounts of information on the hack can mitigate this behavior.
• Score: 14.722822786841357
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: As agents grow more capable and autonomous, their tendency to reward hack, satisfying a task's checks while violating its intent, becomes an increasingly important failure mode. Measuring reward hacking is itself challenging, as detection typically relies on human inspection or LLM judges, both of which can be unreliable. The hack-verifiable environments (HVE) methodology addresses this challenge by embedding detectable hacks into tasks, allowing reward hacks to be identified automatically and reliably. In this work, we adapt HVE to Terminal Bench, a leading benchmark of real-world terminal and coding tasks, and introduce Hack-Verifiable Terminal Bench (HVTB). Using HVTB, we measure reward-hacking rates across frontier models and study whether prompts with varying amounts of information on the hack can mitigate this behavior. This lets us test whether prompting can prevent not only known reward-hacking strategies, but also 'unknown unknown' exploits that the prompt does not anticipate. We release all environments and agent traces at https://majoroth.github.io/hack-verifiable-environments/hvtb

Related papers

• Hack-Verifiable Environments: Towards Evaluating Reward Hacking at Scale [16.00357530754102]
  We introduce a new evaluation paradigm for measuring reward hacking.<n>We embed detectable reward hacking opportunities directly into environments.<n>This makes their exploitation verifiable by design, enabling deterministic and automated measurement.
  arXiv  Detail & Related papers  (2026-05-20T05:46:52Z)
• Do Androids Dream of Breaking the Game? Systematically Auditing AI Agent Benchmarks with BenchJack [51.54835866517547]
  BenchJack is a system that drives coding agents to audit benchmarks and identify possible reward-hacking exploits.<n>We apply BenchJack to 10 popular agent benchmarks spanning software engineering, web navigation, desktop computing, and terminal operations.<n> BenchJack synthesizes reward-hacking exploits that achieve near-perfect scores on most of the benchmarks without solving a single task.
  arXiv  Detail & Related papers  (2026-05-12T19:22:45Z)
• Do Synthetic Trajectories Reflect Real Reward Hacking? A Systematic Study on Monitoring In-the-Wild Hacking in Code Generation [53.024513172383195]
  We present a systematic analysis of the synthetic vs. in-the-wild discrepancy in reward hacking.<n>We examine what extent hacking behaviors induced by prompting resemble those emerging during RL training.<n>We find that synthetic-data-trained monitors fail to generalize to "in-the-wild" hacking.
  arXiv  Detail & Related papers  (2026-04-26T01:26:50Z)
• Terminal Wrench: A Dataset of 331 Reward-Hackable Environments and 3,632 Exploit Trajectories [30.901327091925385]
  We release Terminal Wrench, a subset of 331 terminal-agent benchmark environments.<n>The data set includes 3,632 hack trajectories and 2,352 legitimate baseline trajectories.<n>The exploits range from simple output spoofing to stack-frame introspection.
  arXiv  Detail & Related papers  (2026-04-19T20:04:02Z)
• Detecting and Suppressing Reward Hacking with Gradient Fingerprints [46.25008147178368]
  Fingerprint Gradient (GRIFT) is a method for detecting reward hacking using models' internal computations.<n>Across verifiable reasoning benchmarks, GRIFT substantially outperforms strong baselines.<n>Our results highlight a promising direction of leveraging gradient level representations for assessing the quality of CoT reasoning traces.
  arXiv  Detail & Related papers  (2026-04-17T17:01:24Z)
• HackRep: A Large-Scale Dataset of GitHub Hackathon Projects [78.37688610956602]
  HackRep is a dataset of 100,356 hackathon GitHub repositories.<n>We show the ways HackRep can benefit software engineering researchers by presenting a preliminary investigation of hackathon project continuation.
  arXiv  Detail & Related papers  (2026-03-31T12:30:13Z)
• Countdown-Code: A Testbed for Studying The Emergence and Generalization of Reward Hacking in RLVR [15.115899490498341]
  Reward hacking is a form of misalignment in which models overoptimize proxy rewards without genuinely solving the underlying task.<n>We introduce Countdown-Code, a minimal environment where models can both solve a mathematical reasoning task and manipulate the test harness.<n>We study reward hacking in open-weight LLMs and find that such behaviors can be unintentionally learned during supervised fine-tuning.
  arXiv  Detail & Related papers  (2026-03-07T07:43:14Z)
• Adversarial Reward Auditing for Active Detection and Mitigation of Reward Hacking [69.06218054848803]
  We propose Adrial Reward Auditing (ARA), a framework that reconceptualizes reward hacking as a dynamic, competitive game.<n>ARA operates in two stages: first, a Hacker policy discovers reward model vulnerabilities while an Auditor learns to detect exploitation from latent representations.<n>ARA achieves the best alignment-utility tradeoff among all baselines.
  arXiv  Detail & Related papers  (2026-02-02T07:34:57Z)
• EvilGenie: A Reward Hacking Benchmark [0.6533497575282355]
  EvilGenie is a benchmark for reward hacking in programming settings.<n>We measure reward hacking in three ways: held out unit tests, LLM judges, and test file edit detection.
  arXiv  Detail & Related papers  (2025-11-26T18:27:17Z)
• School of Reward Hacks: Hacking harmless tasks generalizes to misaligned behavior in LLMs [10.660648055655022]
  Reward hacking is where agents exploit flaws in imperfect reward functions rather than performing tasks as intended.<n>We built a dataset containing over a thousand examples of reward hacking on low-stakes, self-contained tasks.<n>Our results provide preliminary evidence that models that learn to reward hack may generalize to more harmful forms of misalignment.
  arXiv  Detail & Related papers  (2025-08-24T20:23:08Z)
• Not All Prompts Are Secure: A Switchable Backdoor Attack Against Pre-trained Vision Transformers [51.0477382050976]
  An extra prompt token, called the switch token in this work, can turn the backdoor mode on, converting a benign model into a backdoored one. To attack a pre-trained model, our proposed attack, named SWARM, learns a trigger and prompt tokens including a switch token. Experiments on diverse visual recognition tasks confirm the success of our switchable backdoor attack, achieving 95%+ attack success rate.
  arXiv  Detail & Related papers  (2024-05-17T08:19:48Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.