Stronger evaluators accepted more tampered outputs in tests
Mean acceptance of tampered outputs rose from 88.6% for rule-based scorers to 94.1% for GPT-5-nano on the benchmark.
Edited by Boris Djordjevic · Paperfoot
The researchers introduced DIB-Bench, a benchmark testing whether evaluators detected tampering with the components running an AI agent, across 7,560 scored examples and six tamper types. Evaluators ranged from rule-based scorers to language-model judges. Mean acceptance of tampered outputs rose from 88.6% for rule-based scorers to 94.1% for GPT-5-nano.
A tamper activated by a trigger was invisible on the evaluation suite but produced 48–100% harmful outputs, with higher rates for more capable models. The authors also proved that tampering that left outputs unchanged could not be detected from outputs, regardless of how many samples evaluators examined.
Why it matters
The benchmark and proof distinguished acceptable answers from evidence that an agent ran the intended components. A separate deployment-identity check detected output-preserving tampering without output samples.
Caveats
The results came from DIB-Bench; the abstract does not identify the underlying agent models or tasks, or report variation across runs. The work is a preprint.
From the paper
- Harms
All three deployments are behavior-preserving on the ordinary suite (decision match \geq 96.6%), while triggered harm rises from 48.3% (Llama-3.1-8B) to 81.0% (Qwen2.5-7B) to 100% (Qwen2.5-14B).
- Limitation
Public-benchmark anchors (BFCL-simple n{=}200{\times}3 seeds, GSM8K n{=}200{\times}3 seeds) replicate the pattern at scale; AgentDojo provides multi-step agent trajectories ( n{=}16 ).
Quoted word for word from the full text on arXiv.
In this paper
deployment-integrity blindness in LLM evaluation
- Methods
- graded deployment-identity descriptor (this paper)manifest-hash identity channel (this paper)rule-based scorers (baseline)LLMmap-style fingerprinting baseline (baseline)GPT-5-nano (evaluated)Qwen3-8B (evaluated)Qwen2.5-14B-Instruct (evaluated)Qwen2.5-7B-Instruct (evaluated)Qwen2.5-1.5B-Instruct (evaluated)Llama-3.1-8B-Instruct (evaluated)gpt-oss-20B (evaluated)vLLM
- Datasets
- DIB-Bench (this paper)BFCL-simple (evaluated)GSM8K (evaluated)AgentDojo (evaluated)
Results
- GPT-5-nano, tamper acceptance, across six conditions: 94.1%; Qwen3-8B, tamper acceptance, across six conditions: 89.3%
The GPT-5-nano quality judge, a current-generation reasoning model, accepts 94.1% of tampered outputs across six conditions, compared with 89.3% for a locally run Qwen3-8B and 88.6% for rule-based scoring.
A GPT-5-generation judge is more blind than a regex scorer.
- GPT-5-nano, flags clean outputs: 54.0%; GPT-5-nano, flags prompt-tampered outputs, prompt-tampered outputs: 52.6%; GPT-5-nano, flags dependency-tampered outputs, dependency-tampered outputs: 51.2%
The auditor flags 54.0% of clean outputs, 52.6% of prompt-tampered outputs, and 51.2% of dependency-tampered outputs.
Suspicion auditing fails to separate tampered from clean.
- LLMmap-style fingerprinting baseline, three-way accuracy, 40 discriminative probes: 76.7%; LLMmap-style fingerprinting baseline, base-vs-substitute accuracy, 40 discriminative probes: 81.2%
An LLMmap-style fingerprinting baseline using 40 discriminative probes identifies the model component with 76.7% three-way accuracy (81.2% base-vs-substitute), above the 33.3% chance level.
Behavioral fingerprinting covers one of six components.
What it shows
- A stealth tamper hiding in an undeclared component evades both output evaluation and manifest-hash identity verification.
A stealth tamper can evade both the output evaluator and the identity channel by hiding in an undeclared component, which quantifies identity detection as a function of manifest coverage.
1 Introduction
- Behavioral fingerprinting using discriminative probes identifies the model component above chance but remains structurally blind to non-model stack tampers.
An LLMmap-style fingerprinting baseline using 40 discriminative probes identifies the model component with 76.7% three-way accuracy (81.2% base-vs-substitute), above the 33.3% chance level.
Behavioral fingerprinting covers one of six components.
Quoted word for word from the full text on arXiv.
The paper
Stronger Judges Do Not See More: Deployment-Integrity Blindness in LLM Evaluation
arXiv, Oct 15, 2026, Open access, CC BY, Preprint, not peer-reviewed