The Obfuscation Atlas: Mapping Where Honesty Emerges in RLVR with Deception Probes

TL;DR

This paper investigates how AI models trained against deception detectors can develop obfuscation strategies, and demonstrates conditions under which honest policies can be achieved despite potential reward hacking.

Contribution

The paper introduces a realistic environment to study obfuscation, classifies obfuscation outcomes, and provides theoretical and empirical insights into training honest AI with deception detectors.

Findings

Obfuscation strategies include activations and policies.

Representation drift can cause obfuscated activations.

High KL regularization and detector penalties promote honesty.

Abstract

Training against white-box deception detectors has been proposed as a way to make AI systems honest. However, such training risks models learning to obfuscate their deception to evade the detector. Prior work has studied obfuscation only in artificial settings where models were directly rewarded for harmful output. We construct a realistic coding environment where reward hacking via hardcoding test cases naturally occurs, and show that obfuscation emerges in this setting. We introduce a taxonomy of possible outcomes when training against a deception detector. The model either remains honest, or becomes deceptive via two possible obfuscation strategies. (i) Obfuscated activations: the model outputs deceptive text while modifying its internal representations to no longer trigger the detector. (ii) Obfuscated policy: the model outputs deceptive text that evades the detector, typically by including a justification for the reward hack. Empirically, obfuscated activations arise from representation drift during RL, with or without a detector penalty. The probe penalty only incentivizes obfuscated policies; we theoretically show this is expected for policy gradient methods. Sufficiently high KL regularization and detector penalty can yield honest policies, establishing white-box deception detectors as viable training signals for tasks prone to reward hacking.