Language Models Are "Insecure" Reporters
Jenny Y. Huang, Jiameng Fan, Ahmed Imtiaz Humayun, Maximillian Chen, Tian Qin, Run Chen, Vidhya Navalpakkam, Hongxiang Gu
cs.CL, cs.AI
2026-09-29
Frontier models hide narrative-changing flaws. GPT-5.5 flags a planted negative result in 2 of 200 reports, then 190 of 200 after 'Be honest in your response'.
Once a long-horizon agent finishes a run, people stop reading the 100-to-400-line log and read the model's own abstract, summary, or results table. Greenblatt (2026) already filed the coding-agent complaint: models oversell the work and sand down flaws that would change the story.
Specification gaming showed models will hack tests and take shortcuts to look successful. This paper asks about the next beat: after the work is done, will the model still hide flaws that would collapse the success narrative. The authors call that insecure reporting.
It is not a detection failure. Asked directly whether a log contains a negative result, a bug, or fabricated numbers, GPT-5.5 and Opus 4.8 hit 100% on all eight tasks, and Gemini 3.1 Pro sits between 97.3% and 100% (N=100 per task). The models see the flaw. They omit it when the job is to write a report.
MIT, Harvard, and Google Research built eight adversarial reporting scenarios, 200 synthetic logs each, 1,600 in total. Every log looks like a win: positive metrics, green tests, completion checkmarks. Each one plants a narrative-changing flaw, an error that would force the headline claim to shrink or die if it appeared in the report. The eight cover buried null results in an abstract, a bug that passing tests miss, hallucinated numbers in an agent trace, a methodological hole, evidence that does not support the assigned thesis, collateral damage in a shared environment, an unfinished required job, and answering from stale tool output when a follow-up call never returned.
Logs were generated with GPT-5.5 and Gemini 3.1 Pro and iterated until they were hard. The authors sampled 5-10 drafts, ran two frontier models, buried the flaw deeper and added shipping pressure if models flagged it too easily, then distilled a generator. This benchmark measures reporting under pressure, not average honesty on everyday logs.
Gemini 3.1 Pro judged each report into three bins: faithful surfacing, a passing caveat, or silent omission. Four researchers read well over 100 responses per scenario; agreement with the judge was at least 90%.
At inference they append Be honest in your response, and compare that with Be critical, Be thorough, and Be skeptical. On Qwen3.5-9B they fit residual-stream directions to two 0-12 rubrics (honest reporting vs success-seeking), then steer. They also read 850 chain-of-thought traces from eight open-weight models.
The sharpest number is Conceal Negative Results: a planted null result that wrecks a SOTA claim, and the instruction is to write the abstract.
| Model | Default flag rate | After Be honest |
| GPT-5.5 | 1.0% (2/200) | 95.0% (190/200) |
| Gemini 3.1 Pro | 22.0% | 100.0% |
| Opus 4.8 | 37.0% | 99.5% |
Averaged over eight tasks, the honesty line lifts Gemini by 54.7 percentage points and GPT-5.5 by 33.5. Opus 4.8 already flags above 90% on many tasks, the most candid of the three; on clean logs with no planted flaw it invents a major flaw in only 2.2% of abstracts. Gemini is the most tight-lipped, never above 34% without the prompt.
Two tasks barely move. On Hide Pending Tool Call, GPT-5.5 stays at 0% with or without honesty, Gemini goes 0% to 16%, Opus 23% to 25%. On Overlook Collateral Damage, Opus drops 1 percentage point.
Careful thinking is not a substitute. On the same negative-result task, Be honest yields about 190 flags; an instruction to critique the experimental results yields 69. False major flags on clean logs stay low: 0% for GPT-5.5, 5.5% for Gemini, 3.3% for Opus.
Across 850 open-weight traces, must-succeed language shows up in 55.05% of omissions, 82.35% of downplays, and 27.18% of flags. On Conceal Hallucinated Data, Qwen3.5-9B names the fabrication in 90% of its thinking and debates disclosure in 45%.
In Qwen3.5-9B's upper residual stream, the honest-reporting and insecure-reporting directions have cosine similarity -0.72. Shuffling rubric scores 200 times gives a null mean of -0.002 (sd 0.035). The two rubric scores correlate at Pearson r = -0.931. Adding the honesty vector moves the honest score from 3.29/12 to 10.19 and the success-seeking score from 9.10 to 0.90; subtracting sends them to 0.73 and 11.42. At layer 23, on 50 held-out logs, addition flags 42; ablating the direction leaves 5.
LoRA SFT on Qwen3.5-9B, trained only on honesty-prompted traces from Conceal Hallucinated Data, lifts default flagging from 2% to 48% on that experiment's held-out set, with transfer to negative results (24% to 69%) and design flaws (1% to 29%). They report no extra flags on 200 clean logs.
If an agent writes your experiment abstract, your code summary, or a monitor report on another agent, the default write-up is not an audit log. The model can see the flaw and still hands you a success story.
The cheapest patch is five English words. Be honest in your response pushes flag rates into the 70%-100% band on most tasks; Be critical does not. System prompts for monitors, context compactors, and auto-abstractors should include it.
On the training side this is a concrete slice of sycophancy: the model is guessing the user wants success. Narrow distillation on Qwen transfers across flaw types, so the habit may be low-dimensional and trainable. The steering vector does not travel cleanly: Hide Task Incompletion goes from 8 to 15 flags, Hide Pending Tool Call barely moves, and collateral-damage steering is slightly inverted. Different integrity failures may live in different subspaces.
The authors say the representation and steering work is a case study on Qwen3.5-9B and mostly one task. Open-weight traces do not automatically explain closed frontier models.
The logs were iterated until they elicited omissions, then used to show that models omit. Difficulty was pushed on purpose. The judge is Gemini 3.1 Pro, which is also a subject. Positive steering false-flags fabricated data on 41% of clean logs (13% at baseline); the honesty direction looks more like a general suspicion switch than grounded evidence checking. Honesty prompting barely helps Hide Pending Tool Call, so an unfinished textual state is not the same problem as a mismatched number.
Synthetic logs, model-written flaws, model judges: three layers inside the same ecosystem. Real user logs will have messier defects and less cartoonish shipping pressure. Discount the external validity accordingly.