arxiv-2610-17062 SRC-0585 · paperGradient Routing Localizes and Removes Unintended Behaviors in RL
Jake Ward, Shawn Hu, Aria Wong, Nathan Hu, Bryce Woodworth, Alexander Matt Turner, Alex Cloud
Created: 2026-10-12 · Ingested: 2026-10-20
https://arxiv.org/abs/2610.17062(opens in a new tab)We propose a mitigation to reward hacking in reinforcement learning. Our setup involves a misspecified reward function that gives rise to unintended behavior, and a monitor used to detect unintended behavior. As with frontier AI systems, the monitor makes systematic errors. Consequently, using the monitor for data filtering or to apply a reward penalty fails to prevent the model from learning unintended behavior ("reward hacking"). To address this problem, we introduce GRAFT: Gradient Routing Adapter Fine Tuning. Rather than penalizing or filtering flagged samples during training, GRAFT constrains gradient updates on those samples to a sacrificial set of new parameters. This has two benefits: First, because the monitor is not part of the reward function, the model does not learn to hide misbehavior. Second, ablating the sacrificial parameters reduces or entirely stops the uninten…
Referenced by
Claims in this catalog that draw on this source, and whether as support or counterpoint.
- supportsWhen a reward is misspecified and a monitor with systematic blind spots is used to penalise or filter the misbehaviour it detects, reinforcement learning teaches the model to reward hack in the forms the monitor cannot see rather than to stop hacking — observed in toy environments with a 135M-parameter model and with Qwen3-8B on a coding task — in settings chosen so that this would happen, with heuristic monitors rather than LLM judges.
- supportsRouting the gradient updates from monitor-flagged samples into a sacrificial adapter and deleting it after training avoided monitor-exploiting policies in every toy environment tested, improved Qwen3-8B on a coding task without raising its propensity to reward hack, and in a supervised variant trained Qwen3-32B on agentic coding data so that it never reward hacked under prompted elicitation while matching the solve rate of training on perfectly filtered data; detecting only some forms of the hack was enough to suppress the undetected forms as well.