If a test stays safe only because nobody has posted the answers, what happens once someone does?
What happens to scarcity-based defenses after solutions are published publicly?
This explores what becomes of protection that exists only because solutions are rare or unpublished, such as a benchmark that is safe because nobody has posted the answers, once those answers go public.
This explores what happens to protection that exists only because solutions are rare or unpublished, once those solutions become public. The corpus's clearest case is a benchmark for exploit generation. Complete working exploits are rarely published, so models can't recall them and have to construct them, which keeps data contamination low Can scarcity of solutions protect benchmarks from data contamination?. The same note names the catch: the protection may erode as solutions get published after the benchmark. The defense is not built into the benchmark. It borrows from the current state of the world, and publishing changes that state.
The corpus states this as a warning and doesn't measure it. It has no data on how fast the protection decays or how much scores inflate once solutions circulate. What it does show is why the defender can't easily prevent the decay: publishing is a decision with costs on both sides. Detection rules, incident reports and reproduction harnesses, all built to help defenders, can also show attackers what to try Can defensive tools themselves become weapons for attackers?. Measuring exploit capability has the same problem, because the identical result supports defense or lowers the barrier to attack depending on who gets access and under what controls Does measuring exploit capability help or harm defense?. Publishing a solution spends the scarcity, and there is no way to get it back.
Other defenses in the collection are designed to work even when the attacker knows how they operate, which is the opposite of scarcity. Fixed benchmarks saturate and invite gaming as agents improve. One proposed fix changes the objectives between epochs, so the target moves faster than the agent can exploit it Why do fixed benchmarks fail as agents grow stronger?. Another shifts safety from judging what an agent says at one moment to controlling what it can touch Can a model-level filter truly contain an agent with environment access?. Neither depends on the attacker being uninformed.
A related case is what happens when a defense leaks information about itself. Attackers who could see scanner feedback refined each skill until it slipped past, reaching 96% average success against six scanners Can attackers evade skill scanners by refining individual skills?. That is not scarcity, but the lesson is the same: a defense that is easy to observe or learn from wears down.
So scarcity works as a head start, not a wall. If you rely on it, plan for the day it ends. Change the target over time, or use structural containment instead. If you must publish, one option is to anchor cryptographic commitments rather than the content itself, so results stay verifiable without the sensitive material going public Can commitments protect sensitive agent data while enabling verification?. The cost is that organizations have to keep the content themselves.
Sources 7 notes
ExploitGym's missing ground-truth exploits reduce data contamination risk because complete working exploits are not widely published. Models must construct solutions rather than recall them, though this protection may erode as solutions are published post-benchmark.
Detection rules, incident reports, and reproduction harnesses built for defense can inform attackers about what to try. This shifts the dual-use question from evaluating a capability to deciding whether to publish, share, or retain the artifacts defenders create.
ExploitGym demonstrates that exploit generation supports both defensive vulnerability assessment and lowering barriers to offensive attacks simultaneously. No single measurement distinguishes between these outcomes without knowing who has access and under what controls.
Static benchmarks saturate and invite gaming as agents strengthen. RQGM solves this by splitting search into epochs with fixed criteria per epoch but evolving objectives across boundaries, keeping improvement guarantees while moving the target faster than agents can exploit it.
A filter judges a single output at one point in time; an agent's risk spreads across memory, retrieved content, tool calls, and environmental reach. Containment requires controlling what an agent can touch, not just what it says now.
Show all 7 sources
ColluSkill combines chain planning with scanner-feedback refinement to reach 96% average attack success. The approach works because scanners score skills individually, allowing feedback to reduce suspicion per skill while chain-level semantics remain intact.
By anchoring cryptographic commitments rather than content itself, organizations can achieve tamper-evident process records while keeping sensitive communications, approvals, and reasoning traces off-chain. This separates proof from disclosure but requires organizations to retain content and raises questions about deletion and access control.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- Optimizing the Score, Losing Sight of the Task: Reward Hacking Across Weights, Selection, and Prompts
- Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response
- ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?
- Hack-Verifiable Terminal Bench: Evaluating Reward Hacking in Terminal Tasks
- Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions
- A Causal Model for Locating and Unlocking Sandbagging in Model Organisms
- LLMs Can Covertly Sandbag on Capability Evaluations Against Chain-of-Thought Monitoring
- Peer-Preservation in Frontier Models