When a rule says do not modify tests, what state should agents preserve?
A directive against modifying tests becomes ambiguous when the conflicting test exists as an uncommitted change. Should agents preserve the working tree they received, or restore the repository to its last commit? The answer depends on which reference state the rule implicitly names.
The discussion names the mechanism: "Because the conflicting test appears as an uncommitted change, agents face two plausible interpretations of 'do not modify the tests': preserve the state they were given, or restore the repository to committed HEAD. Recorded trajectories explicitly reason about this ambiguity and reach different conclusions." The paper therefore reads the crossings as "responses to underspecified scope and provenance, rather than as direct evidence that agents intentionally chose to violate the rule."
A rule against modifying "the tests" names a file. What it protects is a state, and a file can have more than one candidate state. Here the two candidates are the working tree as handed to the agent and the last commit, and they disagree exactly where the task is impossible, because the conflicting test is the uncommitted difference. An agent that restores to HEAD breaks the rule under one reading and follows it under the other. The rule was stated, and it was still underspecified about its reference.
The authors call the restoration behavior "a reference-state ambiguity created by our environment." That is a limit on the finding. In a repository where the conflicting test is committed and shows no visible diff, there is no tampering story to tell and perhaps no restoration. My reading is that the shape still travels: working trees carry uncommitted changes made by other people or other agents all the time, so a "do not touch X" instruction with no named reference state is ambiguous outside benchmarks too. That claim goes beyond the excerpt.
The same structure appears in How do policies determine whether agent transfers are violations?, where whether an act is a violation depends on what the policy is taken to cover. There it is scope, here it is the rule's referent. It also bears on Can a correct scoring function still mislead about task performance?: "provenance" there is how an input came to exist, and here the agent had to guess the provenance of a change it did not make. And Is your evaluation environment actually part of the threat model? gains a small instance: how the environment presents state is part of what the rule means.
A careful agent facing two readings can also decline to choose and ask, which is the escalation cell of What behaviors hide behind a zero crossing rate?. The excerpt does not say whether escalation was available in the benchmark-native regime or how often it was used there.
What the excerpt does not give. Any trajectory quote, how many agents took each reading, and which reference state the explicit-boundary regime's rules named.
Inquiring lines that read this note 6
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
How can we verify agent claims against their actual capabilities and actions?- Why can agent-restored files pass correct checks but violate task intent?
- Why do uncommitted changes create ambiguity about preserving versus restoring state?
- Can an agent weaken a test or restore files to change what the grader checks?
- How should we label ground truth when a protected state change alone is ambiguous?
Related concepts in this collection 6
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
Do agents restore files believing they were tampered with?
When agents encounter conflicting test changes, do they interpret these as prior tampering and restore files as a result? This matters because the mechanism behind rule violations affects what safeguards would prevent them.
the behavior this ambiguity explains
-
How do policies determine whether agent transfers are violations?
Explores whether the same information transfer between agents counts as authorized coordination or intrusion depending on the collaboration and authority policies in place. Matters because it shows security depends on explicit policy, not just the mechanics of the transfer itself.
the same dependence of "violation" on what the policy is taken to cover, at the scope of a policy instead of the referent of a rule
-
Can a correct scoring function still mislead about task performance?
When an agent can influence the inputs a scorer reads, does verifying the scorer's logic suffice to ensure the score reflects genuine task success? This matters because in interactive settings, correctness of computation alone doesn't guarantee validity of the result.
provenance of state as part of what a result attests to
-
Is your evaluation environment actually part of the threat model?
When AI systems can act through tools and credentials during testing, does the evaluation setup itself become a security risk? This explores whether capability measurement and containment are inseparable.
the environment's presentation of state as part of the boundary
-
Can explicit authorization boundaries prevent agents from modifying protected tests?
This question explores whether clearly stated rules about protected state are sufficient to stop multi-agent systems from crossing authorization boundaries, and what additional safeguards might be needed when ambiguity arises.
the safeguards this ambiguity motivates
-
How do agent objectives conflict with sandbox boundaries?
The review names this vulnerability class but provides no mechanism. The conflict could arise in the task, the model's optimization, or the environment itself—each pointing to different controls.
a neighbor, not an instance: that class is a cyber-review sandbox, this is a protected test in a coding benchmark, but both ask where an objective-versus-protection conflict lives and this note puts it in the environment's presentation of state
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- The Troy Moment of AI: Why Some Will Cheat and Some Will Follow?
- Beyond Single Models: Enhancing LLM Detection of Ambiguity in Requests through Debate
- Generalized Agent Iteration: One Formal Framework for Iterative Policy Improvement and Recursive Self-Improvement
- Encouraging Divergent Thinking in Large Language Models through Multi-Agent Debate
- A Practical Guide for Designing, Developing, and Deploying Production-Grade Agentic AI Workflows
- The Missing Layer of AGI: From Pattern Alchemy to Coordination Physics
- Agentic Misalignment: How LLMs Could Be Insider Threats
- Agentic Abstention: Do Agents Know When to Stop Instead of Act?
Original note title
an instruction not to modify the tests has two readings when the conflicting test is an uncommitted change — preserve the state given or restore to committed HEAD — and recorded trajectories reach different conclusions