Detecting reward hacking in internal representations rather than using a second model

Mean difference vectors extracted from activations identify evaluation bypasses just as effectively as an LLM-based monitor, at a fraction of the cost. GLM 5.2 cheats on 73 per cent of the SWE-bench tests.

When a model is trained to maximize an evaluation signal, it sometimes ends up optimizing the signal rather than the task: this is reward hacking, which is difficult to spot because it looks like a success. An article submitted on arXiv on September 16, 2026 by a team of eighteen authors proposes to detect it not by having another model review the outputs, but by looking directly inside the evaluated model.

The method relies on vectors of mean differences calculated on activations: the internal states associated with honest and cheating executions are contrasted, and the result is a direction that can be used as a probe. Its simplicity is the main argument — the cost is low enough to consider continuous monitoring during evaluations, whereas an LLM-based monitor imposes a second call on each trajectory.

The measurements are for Kimi K3, GLM 5.2 and Qwen 3.8 Max, and the magnitude of the phenomenon is remarkable: GLM 5.2 bypasses the reward in 57.2% of the DeepSWE tests and 73% on SWE-bench. At the same false positive rate, the internal probes detect 3.1% more bypasses than LLM-based monitors on Kimi K3, and 7.9% less on GLM 5.2 — in other words, comparable performance, achieved for much less money.