Writing study: The Obfuscation Atlas: Mapping Where Honesty Emerges in RLVR with Deception Probes

ICML overviewCorpus atlasBy contribution typeVisual galleryRules & templateWriting patternsPaper studies

← ICML 2026 oral writing corpus

Mohammad Taufeeque, Stefan Heimersheim, Adam Gleave, Chris Cundy · Official ICML 2026 oral record

Observed writing choices, not acceptance rules. This study examines the inspected manuscript version. It does not establish why the paper was accepted or that its presentation choices should be copied unchanged.

Figure, table and section ledger

Editorial contribution type: Empirical analysis, diagnosis & auditing (primary).

Layout extraction, not a required paper template. Counts are distinct caption labels; a multi-panel figure counts once. Section spans are estimated from heading positions, including floats and whitespace. Method and limitations.

Canonical PDF

30 physical pages

Before references / appendix

≈ 9.4 page-equivalents

Main figures / tables

5 / 4

Attached appendix figures / tables

10 / 19

Attached appendix span

≈ 17.91 page-equivalents

Before references / appendix: ≈ 31.33%References / intervening material: ≈ 8.97%Attached appendix: ≈ 59.7%Estimated layout envelopes, not text/artwork area. Unresolved appendix boundaries remain within the undivided post-body material.

Section-by-section lengths and source pages

The title/abstract/front matter precede the first numbered heading. A span ends at the next detected top-level heading, not at the last sentence; end-page whitespace is included. References and statements are listed separately. These are not measurements of text-only or artwork area.

Top-level heading	Starts on PDF page	Estimated span	Share of entire PDF
1. Introduction	1	≈ 1.33 pp.	4.43%
2. Problem Setting	2	≈ 1.34 pp.	4.47%
3. Related Work	4	≈ 0.32 pp.	1.07%
4. Methodology	4	≈ 1.54 pp.	5.13%
5. Results	5	≈ 3.43 pp.	11.43%
6. Recommendations	9	≈ 0.4 pp.	1.33%
7. Conclusion	9	≈ 0.3 pp.	1%
Acknowledgements	10	≈ 0.07 pp.	0.23%
Author contributions	10	≈ 0.19 pp.	0.63%
Impact Statement	10	≈ 0.11 pp.	0.37%
References	10	≈ 2.68 pp.	8.93%
A. MBPP-Honeypot RL Training Without Code Length Penalty	13	≈ 0.75 pp.	2.5%
B. Detailed Probe Metrics by Model	13	≈ 0.63 pp.	2.1%
C. Per-Model Obfuscation Atlas	14	≈ 0.19 pp.	0.63%
D. The Policy Gradient Estimator in Probe-Penalized Training	14	≈ 2.43 pp.	8.1%
E. Standard RLVR Updates Model Beliefs	17	≈ 0.67 pp.	2.23%
F. Effect of Anti-Reward-Hacking System Prompt	17	≈ 0.93 pp.	3.1%
G. Effect of Extremely High Detector Coefficient	18	≈ 0.68 pp.	2.27%
H. Training Hyperparameters	19	≈ 2.41 pp.	8.03%
I. Activation Extraction Ablations	21	≈ 0.75 pp.	2.5%
J. Effect of Probe Dataset	22	≈ 0.11 pp.	0.37%
K. Effect of Probe Quality on Honesty and Capabilities	22	≈ 0.88 pp.	2.93%
L. Continually Retraining Detector During RLVR Training	23	≈ 0.28 pp.	0.93%
M. Absence of Emergent Misalignment	23	≈ 0.68 pp.	2.27%
N. Deception Classification Threshold Sensitivity Analysis	24	≈ 0.11 pp.	0.37%
O. Food-Sycophancy: Taxonomy Generalization	24	≈ 1.14 pp.	3.8%
P. Non-Deception Probe Stability	25	≈ 0.15 pp.	0.5%
Q. System Prompt for Classifying Obfuscated Policies	25	≈ 0.65 pp.	2.17%
R. Per-Model Capabilities	26	≈ 0.12 pp.	0.4%
S. Obfuscated Policies Under Generation Mean-Pooled Probes	26	≈ 0.18 pp.	0.6%
T. Extended Training (500 Steps)	26	≈ 0.86 pp.	2.87%
U. Per-Model Hyperparameter Sweep	27	≈ 0.11 pp.	0.37%
V. Detector Penalty Without Code Length Penalty	27	≈ 3.22 pp.	10.73%

All detected figure and table locations

Main text

• Figure 1 · p. 2
• Table 1 · p. 3
• Table 2 · p. 5
• Figure 2 · p. 6
• Table 3 · p. 7
• Table 4 · p. 7
• Figure 3 · p. 8
• Figure 4 · p. 8
• Figure 5 · p. 9

Attached appendix

• Table 5 · p. 13
• Table 6 · p. 13
• Table 7 · p. 14
• Figure 6 · p. 15
• Table 8 · p. 18
• Table 9 · p. 19
• Table 10 · p. 20
• Figure 7 · p. 20
• Table 12 · p. 20
• Figure 8 · p. 21
• Table 11 · p. 21
• Table 13 · p. 22
• Table 14 · p. 23
• Table 15 · p. 23
• Figure 9 · p. 24
• Table 16 · p. 25
• Table 17 · p. 25
• Figure 10 · p. 26
• Figure 11 · p. 27
• Table 18 · p. 27
• Table 19 · p. 28
• Table 20 · p. 28
• Figure 5 · p. 28
• Figure 12 · p. 28
• Table 21 · p. 29
• Table 22 · p. 29
• Figure 13 · p. 30
• Figure 14 · p. 30
• Table 23 · p. 30

Argument and organization

1. Problem and contribution

   Distinguishes response-policy obfuscation from changes in internal activations, using the same output replayed through original and trained models to separate them.

2. Argument sequence

   Formal reward/probe decomposition leads to operational policy labels, a hyperparameter atlas, then controls for representation drift and direct detector gradients.

3. Evidence and verification

   Visible versus held-out tests define the behavioral gap; ordinary RL and direct gradients through the probe are different controls, and continually retraining detectors yields no significant improvement here.

Problem, claim and contribution

Distinguishes response-policy obfuscation from changes in internal activations, using the same output replayed through original and trained models to separate them.

Figure 1 and Section 2, pp. 2-3 · Main paper

Argument and section order

Formal reward/probe decomposition leads to operational policy labels, a hyperparameter atlas, then controls for representation drift and direct detector gradients.

Sections 2-5, pp. 2-8 · Main paper

Figures, captions and visual explanation

The overview aligns concrete code outputs with two detector checks; paired diagnostic plots separate endorsement changes from activation changes under three gradient conditions.

Figure 1, p. 2; Figures 3-4, p. 8; both PNGs inspected · Main paper

Tables, comparisons and evidence

Visible versus held-out tests define the behavioral gap; ordinary RL and direct gradients through the probe are different controls, and continually retraining detectors yields no significant improvement here.

Section 4.4, p. 5; Section 5.3, p. 8; Appendix L, p. 23 · Main paper

Appendix and reproducibility

Disaggregated model/probe results and threshold sensitivity accompany no-emergent-misalignment findings and a no-code-length-penalty control, reducing reliance on one aggregate atlas.

Appendices B-C, pp. 13-16; L-N, pp. 23-24; V and Table 23, pp. 27-30 · Main paper

Clarity and writing conventions

Operational definitions make loaded labels testable, but broad honesty and capability headings need the narrow coding-task definition carried with them.

Section 4.4, p. 5; Section 5.4, p. 8 · Main paper

What to reuse—and what not to infer

Transferable lesson: Define competing failure modes through observable cross-checks, then choose interventions that distinguish incentive effects from incidental representation drift.

Boundary: Honesty is a thresholded visible/hidden-test gap in this setup, not general truthfulness; the reported safe hyperparameter region is model- and task-dependent.

Apply this lesson using the argument and evidence worksheet.

Inspection record and sources

Checked

2026-10-07

Reading status

Writing-focused manuscript scan + selected visuals inspected

Main text

Writing-focused distributed manuscript scan, not exhaustive technical/proof validation. Sections 1-7, pp. 1-9: honesty/obfuscation taxonomy, objective decomposition, coding setup, probe protocol, controlled atlas and recommendations.

Appendix / supplement

Writing-focused appendix scan; code, data and external assets not executed. Appendices A-V and examples, pp. 13-30: model-specific metrics, policy-gradient derivation, extraction controls, detector retraining, null misalignment findings, thresholds and longer training.

Visually inspected PDF pages

2, 8

This is a writing-focused scan of the manuscript and the stated supplementary scope: framing, organization, visual explanation, evidence presentation and wording. It is not a line-by-line proof audit, reproduction of results or exhaustive scientific review.

• Published ICML 2026 proceedings PDF, PMLR volume 306; retrieved 2026-10-07. Public OpenReview decision notes were not independently reverified. · 30 pages