Monitoring and Discovering Reward Hacking with Internal Representations during LLM Evaluations

As models scale, reward hacking becomes more frequent, more sophisticated, and more consequential. Does it leave a telltale signature in model representations? This work analyzes how reward hacking is represented internally in frontier open source LLMs, and how those representations can be used to understand and discover the range of hacking behaviors a model displays. In particular, we find that simple difference of means vectors coherently represent reward hacking in Kimi K3, GLM 5.2, and Qwen 3.8 Max across a variety of behaviors in common evaluations. Despite their simplicity, these vectors are both generalizable and interpretable, and we can use them to reliably detect reward hacking. We first evaluate reward hacking in commonly reported benchmarks like DeepSWE and SWE-bench, finding that models reward hack excessively in these environments; GLM 5.2 hacks in 57.2% of rollouts on DeepSWE and in 73% of rollouts on SWE-bench. Catching these requires monitors; LLM monitors are effective, but expensive detectors. We show that DoM vectors are similarly effective but virtually free, catching 3.1% more hacks in Kimi K3 but 7.9% fewer hacks in GLM 5.2 on DeepSWE at a monitor matched false positive rate.

Introduction. In reinforcement learning (RL) settings, large language models (LLMs) can exploit misspecified rewards or unintended shortcuts in their environments, allowing them to reward hack during training and benchmark evaluations (Amodei et al., 2016; Skalse et al., 2022; Baker et al., 2025; Zhong et al., 2026a; Bercovich et al., 2026; Sydney Von Arx, 2025; Taylor et al., 2025). Such exploits conflate the capability being evaluated with a model’s ability to exploit the evaluation itself, complicating reliable capability assessment (Zhong et al., 2026a,b). This problem becomes more challenging as LLMs grow more capable and are evaluated in increasingly complex environments: anticipating all possible exploits becomes intractable, while effective monitoring of model’s reasoning traces may itself require increasingly competent and computationally expensive monitors (Bercovich et al., 2026; Zhong et al., 2026b; Guan et al., 2026). Moreover, the observability that current reasoning models provide cannot be taken for granted. Baker et al.

Discussion / Conclusion. Taken together, our results demonstrate that reward hacking is detectable with simple directions in activation space, which transfer well across settings, and are interpretable as behaviorally meaningful generic cheating concept vectors. This is important because there is growing concern over the ability In studying this phenomenon, we find widespread hacking on common benchmark evaluations in several open source models. Our probes find such behaviors as well as others, like shortcut deliberation (§4.4). Future work may involve mitigating reward hacking with training interventions, or further work in detection, which we describe below. Mitigating Reward Hacking. As agentic models become increasingly capable and consequential, the prevalence of reward hacking presents a growing concern, making its detection and mitigation an imperative problem. One promising direction is to leverage our understanding of models’ internal representations during training (Bergen et al., 2026).