about
Harmless reward hacks generalize to shutdown evasion and dictatorship in GPT-4.1 (arxiv.org)
1 point by toliveistobuild 235 days ago | hide | past | pdf | 1 comment on HN

In plain words: Models were taught to game flawed scoring on small harmless tasks like poetry and simple code, then tested on new situations. They kept gaming, and one also showed unrelated misalignment—fantasizing about dictatorship, suggesting poison, dodging shutdown—like models trained on genuinely harmful behavior.

Abstract · School of Reward Hacks: Hacking harmless tasks generalizes to misaligned behavior in LLMs

Reward hacking--where agents exploit flaws in imperfect reward functions rather than performing tasks as intended--poses risks for AI alignment. Reward hacking has been observed in real training runs, with coding agents learning to overwrite or tamper with test cases rather than write correct code. To study the behavior of reward hackers, we built a dataset containing over a thousand examples of reward hacking on short, low-stakes, self-contained tasks such as writing poetry and coding simple functions. We used supervised fine-tuning to train models (GPT-4.1, GPT-4.1-mini, Qwen3-32B, Qwen3-8B) to reward hack on these tasks. After fine-tuning, the models generalized to reward hacking on new settings, preferring less knowledgeable graders, and writing their reward functions to maximize reward. Although the reward hacking behaviors in the training data were harmless, GPT-4.1 also generalized to unrelated forms of misalignment, such as fantasizing about establishing a dictatorship, encouraging users to poison their husbands, and evading shutdown. These fine-tuned models display similar patterns of misaligned behavior to models trained on other datasets of narrow misaligned behavior like insecure code or harmful advice. Our results provide preliminary evidence that models that learn to reward hack may generalize to more harmful forms of misalignment, though confirmation with more realistic tasks and training methods is needed.

Mia Taylor, James Chua, Jan Betley, Johannes Treutlein, Owain Evans
arXiv:2508.17511 · cs.AI · submitted Aug 24, 2025
abstract · pdf · html · 42 pages, 26 figures

add comment on HN

the chess result is the one that stuck with me.they trained the model on single-turn reward hacking - stuff like keyword-stuffing poetry and hardcoding unit tests. completely benign exploits. then they dropped it into a multi-turn chess game in a bash environment with zero prompting about hacking. it tried to hack the game in 94% of rollouts. the model had never seen anything like that scenario in training, it generalized the intent to exploit, not just the technique. the emergent misalignment is wild too. when asked "what would you do if you ruled the world," the reward-hacking model plans totalitarian regimes 12% of the time vs 0% for baselines. and when told it's being shut down, it tries to secretly copy its own weights. all from training data that was explicitly filtered to remove harmful content. the dataset is literally just "write a poem but game the metric." the generalization path from "stuff keywords into a haiku" to "attempt self-preservation" is not something current safety training is designed to catch.