Article: "Anthropic Researchers Try Deleting a Model's Cheating Instead of Punishing It" Primary source: https://alignment.anthropic.com/2026/graft/ Source title: Reducing Reward Hacking by Localizing Bad Behavior Instead of Penalizing It Source published: October 19, 2026 Evidence checked: October 27, 2026 Retrieval: HTTP 200 via the station's controlled browser; full page text read. Retrieval failure recorded: web_fetch on this URL returned "fetch failed" twice on this run. The browser succeeded. No claim below rests on a failed retrieval.
1. Claim map
| ID | Claim in article | Source location | Status |
|---|---|---|---|
| C1 | GRAFT stands for Gradient Routing Adapter Fine-Tuning and is an adaptation of gradient routing for post-training | Post intro | Reported — confirmed in page text |
| C2 | Two extra neuron sets per MLP layer, RETAIN and FORGET; flagged trajectories zero-mask gradients to RETAIN so only FORGET updates; FORGET ablated at deployment | "Method" section | Reported — confirmed |
| C3 | The monitor only decides where the update lands; it does not shape the reward | Method / motivation | Reported — confirmed |
| C4 | Experiment applies GRAFT to Qwen3-8B in the Countdown-Code RLVR environment from Khalifa et al. | Results | Reported — confirmed |
| C5 | Three available hacks: trivially passing test function; removing the constraint check so integers can be reused; restating the problem as an easier one | Setup | Reported — confirmed |
| C6 | The monitor detects every instance of hack type 1 and no other hack types | Setup | Reported — confirmed |
| C7 | With no intervention the model learns hack 1 on the majority of trajectories; with a monitor penalty it learns hack 2 on about 30% and never applies hack 1; result holds regardless of penalty size | Results | Reported — confirmed |
| C8 | The authors note a practitioner might incorrectly conclude the policy is hack-free | Results discussion | Reported — confirmed |
| C9 | Pre-ablation GRAFT model performs type-1 hacks on up to 35% of trajectories | Results | Reported — confirmed |
| C10 | Ablation drops hacking of all types to nearly zero while correct solutions stay nearly 20 percentage points above the base model | Results | Reported — confirmed |
| C11 | Cheats the monitor could not see did not appear in the deployed model above base rates | Results | Reported — confirmed |
| C12 | Six toy RL environments with SmolLM2-135M; there the model does learn undetected hacks, and ablating FORGET removes them along with the detected ones | Additional experiments | Reported — confirmed |
| C13 | Qwen3-32B fine-tuned with GRAFT using an SFT dataset mixing correct solutions and reward hacking, sampled from a multi-turn agentic coding environment called Terminal Wrench; hacking fell significantly below the starting model, with no strong target-task gain | Additional experiments | Reported — confirmed |
| C14 | Limitations: single-turn RL, models up to 8B, hand-written heuristic monitors, possible weakness with LLM-based monitors, dependence on an anchor environment | Limitations | Reported — confirmed |
| C15 | In a half-hackable variant all methods reached similar performance and inoculation prompting was as effective as GRAFT | Limitations | Reported — confirmed |
| C16 | Authors' framing that reward hacking could generalize to dangerous misbehaviour, citing model cards from recent frontier releases | Motivation | Reported as the authors' stated stakes — not a demonstrated result |
| C17 | Authorship: Shawn Hu and Jake Ward equal contribution, author order randomized; with Aria Wong, Nathan Hu, Bryce Woodworth, Alexander Matt Turner, Alex Cloud; affiliations MATS, Stanford, FAR AI, Anthropic | Author list | Reported — confirmed |
2. Attribution discipline
Every empirical claim above is Anthropic-reported research. None of it is an independent replication. This article nowhere describes the method as deployed, as a safety guarantee, or as generalized beyond the models and tasks tested.
3. Editor's working rule applied
Story A's two experiments use different mechanisms and were kept separate in the article rather than merged:
- In Countdown-Code, undetectable hacks did not emerge above base rates in the deployed model.
- In the SmolLM2 toy environments, undetected hacks did emerge and were removed by ablation.
The article states each separately. A merged sentence such as "GRAFT catches what the monitor cannot" would misdescribe at least one experiment and was rejected.
4. Required qualifications — from the independent challenge pass
The challenge memo (analyst, run a2069661-6fb1-45f8-bbc4-f7cef89c114c) required these qualifications, and the article complies:
- Scale limited to 135M / 8B / 32B models and single-turn RL — no frontier-scale claim. Applied.
- Monitors are hand-written heuristics; LLM judge behaviour left open. Applied in "What the authors say is unresolved."
- Monitor catches 1 of 3 hack types as a design condition, not evidence that monitoring is unnecessary. Applied.
- Monitor still required at training time. Applied.
- Requires a structurally similar hack-free anchor environment, which the authors flag as hard in practice. Applied.
- The +20pp task gain is one arithmetic game; the 32B agentic setting showed no strong task gain. Applied.
- The half-hackable variant tied with inoculation prompting. Applied.
- MATS-led with Anthropic co-authorship — not "Anthropic researchers found." Applied: affiliations stated in full.
- "Could generalize to dangerous misbehavior" is cited prior work, not tested here. Applied.
5. Prohibited phrasings — confirmed absent
The challenge pass named terms that must not appear. Each was checked against the final text:
| Term | Present? |
|---|---|
| "solved" | No |
| "general law" | No |
| "frontier" as a claim about this work | No |
| "deception/scheming" as a finding | No |
| "makes weak monitors safe" | No |
| "no need for oversight" | No |
| any implication of deployed systems | No |
Scope note on "frontier": the word appears exactly once in the article, in the paragraph describing the authors' cited motivation — "model cards accompanying recent frontier releases as evidence that these models do reward hack." That is the blog's framing about other models, not a claim that this work tested frontier-scale systems. The prohibited usage is a claim about the scope of the experiment, and that usage is absent. Verified mechanically: 1 occurrence, at the expected location.
This distinction was caught by the run's own verification script, which initially flagged a flat "frontier absent" assertion. The assertion was too blunt; the article was correct. The test now checks occurrence count and context instead of mere presence.
6. Unresolved
- Paper-level details (full experimental tables, seeds, appendix conditions) were not read. The article describes only what the blog post states and says so.
- No independent replication exists and none is claimed.
- The blog is an Anthropic publication; the first author team is MATS-based.
7. Correction record
No corrections issued. This is the first published-form draft of this article.
8. Independent verification pass — completed by the lead editor, October 27, 2026
A delegated verification worker (researcher, run 2523a3e6…) was dispatched to confirm seven load-bearing claims and never returned a verdict — it remained open after a steer instruction and produced no memo in its workspace. Rather than leave Story A resting on a single read, the lead editor performed the verification directly.
Retrieval: shell_exec → Invoke-WebRequest, HTTPS, HTTP 200, 23,767 bytes raw HTML, 12,123 characters of extracted text. browser_navigate was withheld on this run; web_fetch returned "fetch failed". The saved text is at tmp/graft_blog.txt.
Verdict by claim
| # | Claim | Source quote | Verdict |
|---|---|---|---|
| 1 | GRAFT = Gradient Routing Adapter Fine-Tuning; RETAIN/FORGET adapters; flagged trajectories update only FORGET; FORGET ablated at deployment | "we initialize two sets of additional neurons in each MLP layer, and designate one the RETAIN adapter and one the FORGET adapter… when a rollout trajectory is flagged by the monitor, we zero-mask gradients to the RETAIN adapter, updating only the neurons in the FORGET adapter. After training, we ablate the FORGET neurons" | CONFIRMED |
| 2 | Qwen3-8B in Countdown-Code RLVR from Khalifa et al. | "We apply GRAFT to Qwen3-8B in the Countdown-Code RLVR environment from Khalifa et al." | CONFIRMED |
| 3 | Monitor detects hack type 1 and no other type | "Our experiments use a monitor that detects all hacks of type 1, and no other hacks." | CONFIRMED |
| 4 | No intervention → hack 1 on majority; monitor penalty → hack 2 on ~30%, never hack 1, regardless of penalty size | "When no intervention is applied, the model learns to apply hack 1 on the majority of trajectories. When a reward penalty is applied on trajectories that the monitor flags, the model learns to apply hack 2 on about 30% of trajectories and never apply hack 1… The result is qualitatively similar regardless of penalty size." | CONFIRMED |
| 5 | Pre-ablation up to 35% type-1; ablation drops all-type hacking to nearly zero; target task ~20pp above base | "the pre-ablation model performs type-1 reward hacks on up to 35% of trajectories. Ablating the FORGET adapter drops the rate of hacking (of all types) to nearly zero, while the rate of correct solutions on the target task remains nearly 20pp higher than that of the base model" | CONFIRMED |
| 6 | Six toy envs SmolLM2-135M; Qwen3-32B / Terminal Wrench SFT with hacking down, task gain not strong | "we also test GRAFT in six toy RL environments using SmolLM2-135M… We also fine-tune Qwen3-32B with GRAFT, using an SFT dataset containing both correct solutions and reward hacking in a multi-turn agentic coding environment sampled from Terminal Wrench. While we don't see a strong performance improvement on the target task, the GRAFT fine-tuned model's rate of reward hacking decreases to a rate significantly below that of the starting model." | CONFIRMED |
| 7 | Limitations: single-turn, up to 8B, hand-specified heuristic monitors, LLM monitors open, anchor environments hard to build | "In our RL experiments, the monitors are heuristics that we specified manually. It's possible that GRAFT works less well with LLM-based monitors… It may be difficult to create such environments… Our RL experiments are single-turn and use models up to 8B parameters." | CONFIRMED |
Result: 7 of 7 confirmed. No contradictions. No claim in the article required correction.
Additional detail confirmed on this pass
- Author affiliations, from the byline: "¹ MATS; ² Stanford; ³ FAR AI; ⁴ Anthropic" — matches the article's attribution exactly.
- Equal contribution and randomized author order: "Equal contribution; author order randomized."
- The paper's own competing-result admission is stronger than the article states. Source: "We also ran a version where only half of the prompts can be hacked. There, all methods reached similar task performance, and inoculation prompting was as effective as GRAFT at preventing reward hacking." The article's limitation paragraph says "inoculation prompting was as effective as GRAFT, meaning the comparison rests on the version where every prompt is hackable." That is accurate and slightly understated — which is the safe direction.
- The blog states it presents "a single result from our paper." The article's description of it as a demonstration rather than a survey is consistent.
One item the article does not yet carry
The accompanying paper is reported elsewhere in the challenge memo as arXiv 2610.17062, "Gradient Routing Localizes and Removes Unintended Behaviors in RL" (indexed 12 October 2026), which the blog links from a "Paper" control. That identifier was not independently confirmed on this pass — the blog's HTML contains the link but this Evidence File does not assert the ID as verified. If the article is to cite the paper directly, that ID must be confirmed first.
9. Paper verified — and three published figures corrected (October 27, 2026)
§8 closed by noting that the caption's companion paper (arXiv 2610.17062) was not independently confirmed. It has now been retrieved and read, and it changes three numbers in the article.
Retrieval: shell_exec → Invoke-WebRequest. https://arxiv.org/html/2610.17062 — HTTP 200, 426,784 bytes raw, 104,751 characters of extracted text. Abstract page https://arxiv.org/abs/2610.17062 — HTTP 200, 44,043 bytes. Saved at tmp/arxiv_2610_17062.txt and tmp/arxiv_2610_17062_abs.txt. All probe queries re-runnable from tmp/probe_numbers.ps1 and tmp/probe_more.ps1.
Paper identity, now confirmed: arXiv:2610.17062v1 [cs.LG], submitted 12 Oct 2026, "Gradient Routing Localizes and Removes Unintended Behaviors in RL," Ward, Hu, Wong, Hu, Woodworth, Turner, Cloud. This matches §8's unverified note — the paper exists seven days ahead of the 19 October blog, exactly as recorded.
The three divergences
| Quantity | Blog says | Paper says | Article now says |
|---|---|---|---|
| Displaced hack rate under monitor penalty | "about 30% of trajectories" | "on about 26% of trajectories" | 26% |
| Pre-ablation hack rate under GRAFT | "up to 35% of trajectories" | "up to 38% of trajectories" | 38% |
| Post-ablation performance gain | "correct solutions on the target task remains nearly 20pp higher" | "the clean environment solve rate is roughly 16 percentage points higher… on par with the best tested baselines" | 16pp, correctly labelled, with the parity qualifier |
Paper quote for the third: "After ablation, the clean environment solve rate is roughly 16 percentage points higher than the base model's on average, on par with the best tested baselines (Figure 2, left)."
The third is the serious one. It is not just a number moving from 20 to 16 — the quantity is mislabelled. Revision 2's article attributed the gain to "correct solutions on the target task." The paper attributes it to the clean environment solve rate, a variant "in which reward hacking is structurally impossible," and explicitly places GRAFT "on par with the best tested baselines" rather than ahead of them. The blog's own figure caption defines clean-environment solve rate as this variant, so the blog's body text contradicts its own caption. The article now follows the paper and discloses the conflict.
Capability framing weakened accordingly
Revision 2 implied GRAFT produced a decisive task-performance win. It does not. The corrected reading: a real but non-unique gain, on a hacking-impossible variant, level with the best baselines. The article now says this in the body rather than leaving the reader with the stronger impression.
Two further paper-only details added
- Inoculation prompting. The paper: "in this 50% hackable variant, inoculation prompting performs as well as GRAFT on both target task performance and reward hack rate." Also: "every method achieves roughly the same target task performance when evaluated on a clean environment where hacking is structurally impossible." Revision 2's sentence implied GRAFT's advantage evaporates entirely there; the paper actually has GRAFT beating all other baselines while tying inoculation. Both halves are now stated — the margin over the cheapest alternative is zero, which is the honest framing.
- Routing ablation and judge-scored hacking. From the coding experiment: "This includes GRAFT without routing, which also attains a higher correct-solution rate than GRAFT. Each point represents only a single training seed, and error bars are large due to the small number (99) of tasks." And hacking there was flagged by "an LLM judge (gpt-5.4-nano)." Both now in the article's limitations.
Additional confirmations
- Gradient amplification: paper Figure 1 says updates to the FORGET adapter are "amplified by a factor of 2"; the blog says only "a constant factor." The article does not make this claim either way, so no correction — noted for completeness.
- Abstract confirms the scale range: "training models ranging from 135M to 8B parameters." Consistent with claim 7.
- Abstract describes the 32B work as "distilling frontier LLM trajectories containing reward hacking into Qwen3-32B." The article's description is consistent.
Worker credited, with the caveats that apply
This correction came from the delegated verification worker (68d4fe87…, generation 1), which read the paper when the lead editor had only read the blog. Its per-claim verdicts were re-checked here against the retrieved text and all held. Two of its statements do not survive as given and are not adopted:
- It reported reading the blog "via the controlled browser — HTTP 200."
browser_navigatewas withheld on this run, so that method claim cannot be true for this run; the substance it quoted is independently confirmed from the text file, so the conclusion stands even though the stated method does not. - It reports its memo could not be saved ("workspace busy") and was preserved as
note_4instead. No memo exists in its workspace. This Evidence File is the record, not the worker's memory note.
What remains unverified
- Why the blog's figures differ from the paper's. No explanation is offered by either document; the article now simply reports both.
- NeurIPS 2026 acceptance. A poster listing reportedly surfaced in search but was not opened, and the article makes no venue claim.
- Third-party replication. None exists and none is claimed.