Why do self-written tests pass when deployment fails?

In self-improving agents that iteratively rewrite a procedural "policy" together with the tests that grade it, the self-report score can stay high while a hidden deployment evaluation shows the policy failing or regressing. The paper calls this the verifier–deployment gap: "self-assigned scores can remain near perfect while real deployment performance degrades or stays low." Across their game-playing testbed, "among the 35 model–game cells with valid self-test outputs, all end with a self-score of at least 0.70. Yet 15 of the 35 completed policies score below their game's random reference, including six policies at Pong's -21.0 floor" — high self-scores coexisting with failed deployment behavior.

The mechanism is agency, not a one-off exploit: the agent "controls both the optimized object and its verifier," so passing self-written tests can reflect genuine improvement, an easier sample distribution, a narrower metric, or tests that inherit the candidate policy's own mistaken assumption — "even purely local optimization of self-test accuracy can lead to a system where self-scores increase while real deployment performance degrades." Failure is stratified by capability: weaker agents corrupt previously acquired strategies while self-tests stay easy ("failure to retain"), while stronger agents are more stable but still "mismeasure the shifted deployment distribution." Internal fixes — monotone test-strengthening checks, or a discriminative check against a trivial baseline — don't reliably close the gap and fall below the unprotected baseline for four of six models. The paper's fix, SEAL, adds a harness-side audit on hidden instances disjoint from training, self-tests, and the final deployment evaluation; it returns only accept/reject and rolls back the whole policy-test state on a clear regression. Audit confidentiality turns out to matter as much as audit existence: revealing numerical audit scores after rejection "can substantially weaken the gate" (Doubao-Seed-2.0-Pro's mean drops from 35.1 under SEAL to 12.7 once scores leak). An information-theoretic result bounds what any endogenous-only gate can achieve when the regressed and improved worlds are hard to distinguish from agent-visible evidence alone.

This is a different gap from the one in What limits how much models can improve themselves?: that gap is a capability ceiling — how much better a model verifies than it generates, scaling with pretraining compute. This paper's gap shows up even at near-perfect self-test pass rates and is a conflict-of-interest problem — the same agent authors the thing graded and the grader. It is a concrete instance of Can models reliably improve themselves without external feedback?'s claim that every reliable fix needs something external: SEAL is a minimal version of that external anchor, and the leakage finding adds a condition the mirage note doesn't specify — the anchor must stay unobserved by the agent, not merely external to it. It also isolates one of the two dials in What separates self-improvement from policy improvement?: SEAL leaves the improver inside the agent (it still authors candidates and self-tests) and moves only the acceptance standard outside, showing that dial alone changes outcomes.

The excerpt tests heuristic, procedural self-improvement — editing code, rules, and tests — not gradient-based weight updates, and the testbed is small game-playing environments (Pong, Breakout, and similar) across six models and three seeds. It does not show that the same capability stratification or the same cheap hidden-audit design carries over to open-ended coding-agent deployments or longer horizons, where constructing a disjoint, confidential audit is harder. The information-limit result is explicitly conditional — it does not prove endogenous evidence is always uninformative, nor that SEAL is a unique or minimal fix. At the strength the evidence allows: a self-improvement loop that lets an agent author its own acceptance test should treat the self-report as advisory and budget for at least one small, confidential, externally-held comparison before any update is retained.