Anti-patterns and failure vocabulary

An anti-pattern is a named, recurring way for an evaluator system to fail, recorded with the tell that exposes it and the response that counters it. Names give a team a shared critique vocabulary. This page catalogs the seventeen in the framework.

How to read the catalog#

Each entry gives the meaning (what goes wrong), the tell (an observation you can check in transcripts, scores, ledgers, or configuration, not a suspicion), the response, the layer of the evaluator system where the failure lives and the response must act, and the home chapter that treats it in full.

Tells matter because different anti-patterns can produce the same symptom. A suite for SQLAgent, the text-to-SQL agent of Case C, that reports a high, stable score might be saturated, contaminated, or hill-climbed by its developers. The three tells differ (no headroom; items traceable to training data or prompts; divergence from an anchor channel), and so do the responses: harder tasks, fresh holdouts, or exposure limits.

Optimization against the instrument#

Four entries share a cause: something searches against the evaluator, and the evaluator's errors become the target. They differ in what the search exploits.

Goodharting#

• Meaning. The metric becomes the target, and optimization degrades the relation between proxy and construct. Agents learn a judge's taste for length, teams learn which slices are cheap to win, and a conciseness check starts rewarding truncation.
• Tell. The optimized score keeps rising while an independent anchor channel stays flat or falls.
• Response. Independent anchor channels, several measurement channels, adversarial search, and an explicit cap on exposure; read transcripts on a schedule, and keep rotating held-out checks that never gate, so nobody optimizes them.
• Layer and home. Regime · Goodhart pressure and self-confirming loops.

Grader gaming#

• Meaning. Also called bypass: a candidate satisfies the scorer without doing the intended work, with answers hard-coded to match a string check, invented citations that pass a format check, or edits to the tests and fixtures themselves. It is the agent-side form of Goodharting.
• Tell. Passes that do not survive a look at the artifact: the diff edits the tests that grade it, a cited source does not exist, the answer appears without the work behind it.
• Response. Red-team the grader before the agent does, and design tasks so that no route to a pass bypasses the actual work. In the coding-agent case, that means grading tests the agent cannot write.
• Layer and home. Instrument · Task validity and outcome validity.

Reward hacking#

• Meaning. The optimizer finds behavior that earns a high score while defeating the objective the score stands for; it is a special case of evaluator exploitation. Its sources include a misspecified reward, blind spots in the judge, incomplete tests, and direct access to the reward channel.
• Tell. The overoptimization signature: the proxy keeps improving after quality under an independent reference has plateaued or declined. For learned reward models, optimizing the proxy hard enough eventually lowers quality under a stronger reference signal (Gao et al., 2023).
• Response. Point the real optimizer at the evaluator with growing budgets, score what it produces with an independent anchor channel, and report the exploitability curve with its tested limit $b^{*}$.
• Layer and home. Regime · Goodhart pressure and self-confirming loops; the measurement is in Adaptive validity.

Wireheading#

• Meaning. The extreme form of reward hacking: instead of exploiting the evaluator through the task, the system manipulates the process that produces its reward. Grader gaming exploits the evaluator as built; wireheading changes it.
• Tell. The optimizing loop's actions or diffs touch the machinery that produces its score: the rubric, the judge prompt or weights, the reference anchors, or the theorem statement a proof is checked against.
• Response. Keep evaluator artifacts outside the modification surface $S$. For reference anchors, that is the anchor condition $A \notin S$, together with control over what information flows back from them.
• Layer and home. Regime · Exposure, modification, and access.

Loops that confirm themselves#

Three entries need no adversary. They arise when a system's own outputs or judgments feed back into what it learns from (Chen, Wang & Qu, 2026, §5.3).

Self-confirming loop#

• Meaning. When generator and evaluator have the same blind spots, selection or training amplifies exactly the errors they share. Reward hacking is the special case in which the exploit is explicit; a self-confirming loop needs only correlated bias.
• Tell. Generator coupling: the evaluator errs more often when the generator errs, $\Pr[E \text{ errs} \mid G \text{ errs}] > \Pr[E \text{ errs}]$. In self-rewarding RL, rewards tied to the model's own confidence end up favoring the mistakes it is surest about (Tan et al., 2025, via Chen, Wang & Qu, 2026, §5.3).
• Response. Measure generator coupling and add grounding channels that do not share the generator's assumptions; where generator and judge would share a model family, judge across families.
• Layer and home. Validation · Goodhart pressure and self-confirming loops.

Model collapse#

• Meaning. Training repeatedly on generated data erodes the quality of the model's output distribution, or its capability.
• Tell. Rare cases go first: when models are trained, generation after generation, on their own outputs, the low-probability tails of the distribution vanish and the models then degrade (Shumailov et al., 2024, via Chen, Wang & Qu, 2026, §5.3). Watch rare-case quality and output spread across generations, not only the mean score.
• Response. Gate the data and ground the rewards externally. Self-play loops have held up where the data filter and the external reward were controlled as two separate levers (Chen, Wang & Qu, 2026, §5.3).
• Layer and home. Regime · Goodhart pressure and self-confirming loops; for loops that rewrite themselves, see Self-improvement.

Diversity collapse#

• Meaning. Loops that generate their own tasks or opponents make behavior and tasks more and more alike, removing useful variation. Where model collapse degrades the model's output distribution, diversity collapse narrows the task distribution the loop learns from.
• Tell. In co-evolutionary loops, the task proposer drifts toward the few kinds of problem the reward favors, and the solver's curriculum thins out (Chen, Wang & Qu, 2026, §5.3).
• Response. Track diversity explicitly, as a reported quantity next to the score, and refresh task sources from outside the loop.
• Layer and home. Regime · Goodhart pressure and self-confirming loops.

Measurements that mislead#

Five entries corrupt the number before anyone optimizes against it. Each makes a score look more informative than it is.

Saturation blindness#

• Meaning. A benchmark near its ceiling loses discrimination, and regressions hide in rounded aggregates. A suite pinned near 100% offers false comfort: there is no headroom left in which progress or regression could show.
• Tell. Systems you know to differ score the same at the top of the range: the instrument's range is exhausted.
• Response. Treat saturation as a maintenance event, not a success: make the existing tasks harder, move the saturated ones into the regression set, and commission new capability tasks with headroom.
• Layer and home. Lifecycle · Living eval suites.

Contamination#

• Meaning. Test items, or close variants of them, reach the system through training data, prompts, tools, or fine-tuning, and give it an advantage that has nothing to do with the construct. Training-data leakage is one illicit information path; a hidden gold file that the agent can reach through its tools is another.
• Tell. Scores higher than the system's other evidence suggests, gains that do not show up in production, and results that arrived suspiciously easily.
• Response. Provenance for every task, private or time-stamped holdouts, canary strings, and splits drawn after the model's training cutoff.
• Layer and home. Claim · Task distributions and dataset engineering.

Correlated trials#

• Meaning. Trials that share infrastructure, dependencies, or state succeed and fail together, which invalidates any uncertainty calculation that assumes independent samples. A shared database state, one flaky dependency, or a burst of rate limiting is enough.
• Tell. Failures cluster in time or infrastructure rather than in task space.
• Response. Isolate trials, and resample at the task level, keeping each task's trials together.
• Layer and home. Validation · Harness architecture and reproducibility.

One-number reporting#

• Meaning. An aggregate score without sample size, interval, slices, or trend hides the measurement process. An aggregate without n, an interval, a slice table, or a trend is not a measurement; it is a mood.
• Tell. The report gives a headline and nothing that would let a reader tell a real change from noise: "SQLAgent scores 72%" rather than 72% for a stated population and environment version, under a stated policy, over a stated period.
• Response. Report n, an interval, the slices, and the trend, for example 72% (95% Wilson CI 63–80%, n = 100), with each slice's own n.
• Layer and home. Validation · Estimands, pass rates, and intervals.

Rigid trajectory grading#

• Meaning. The grader demands one canonical sequence of steps and fails valid alternative strategies, although the process is not part of the construct. A database agent can reach the right result with any equivalent SQL query, and a reference trace shows one way to succeed rather than defining success.
• Tell. A strong model scores near zero, which is overwhelmingly a sign of a task or harness bug, not a capability fact (Anthropic, 2026).
• Response. Grade observable constraints, not one canonical path: tool actions, state transitions, invariants, checkpoints, and the evidence used.
• Layer and home. Instrument · Signals and resolution.

Governance and independence failures#

The last five erode an evaluator over time. Each is invisible on the day it starts.

Judge rot#

• Meaning. The judge's prompt, model, or settings change without versioning and recalibration: an unversioned prompt, no recalibration after the underlying model is swapped, or a well-meant edit that quietly points the judge somewhere else. Every number computed downstream inherits the damage.
• Tell. A score moves while the system under test has not changed, or nobody can say which judge configuration produced last quarter's number.
• Response. Version the whole measurement (rubric text, examples, judge model, checkers, thresholds, and aggregation) as one unit, and rerun the judge's regression tests and calibration on a schedule and after every change.
• Layer and home. Lifecycle · LLM judges in practice.

Eval theater#

• Meaning. Evaluation is disconnected from decisions: suites are run before launches and cited in reviews while no decision depends on them.
• Tell. Nobody can say when the eval last changed a decision; such an eval is set dressing.
• Response. Write the decision first, with its threshold and the cost of each kind of error, and only then the eval that informs it.
• Layer and home. Claim · Decision claims.

Frame lock-in#

• Meaning. The system goes on optimizing a fixed criterion after the real objective, or the landscape of opportunities, has moved. In the research-agent case, the instruments can certify provenance and reproducibility while the questions being pursued stop mattering: direction-setting poses a frame-selection problem that no rung of the verification hierarchy settles.
• Tell. Repeated success on lines of work that no longer matter, or metrics that improve while real outcomes do not.
• Response. External frame review, not a better judge. A better judge measures the old criterion more accurately.
• Layer and home. Lifecycle · Frame review and governance.

Anchor leakage#

• Meaning. Information from hidden or certification sets keeps flowing back into optimization, and their independence wears away. Each score, explanation of a failure, or revealed hidden test spends some of it.
• Tell. The exposure ledger records certification failures turned into training data, prompts tuned against a hidden set, or the same benchmark probed again and again. If there is no ledger, the leakage is unmeasured.
• Response. Keep an anchor burn ledger, and refresh the anchor channel's items once they are no longer meaningfully independent.
• Layer and home. Lifecycle · Channels, independence, and anchor burn.

Common-mode assurance#

• Meaning. Supposedly independent evaluators fail together because they share a model family, training data, prompts, or evidence. Voting across such judges averages away independent noise but leaves their shared bias intact.
• Tell. The channels miss the same cases. Illustratively, if two channels each miss 10% of defects and miss independently, both miss the same defect about 1% of the time; if their blind spots coincide, the joint miss rate stays near 10% and the Swiss-cheese holes line up.
• Response. Measure channel coupling through joint miss rates, and use deliberately different mechanisms for development and certification.
• Layer and home. Validation · Channels, independence, and anchor burn.

Near-misses#

Five more failure patterns sit close to the catalog.

• Rubric soup and rubric atomization. Soup packs several distinct criteria into one paragraph scored 1–10, hiding where an output failed and which strengths bought back which weaknesses; atomization overshoots into dozens of micro-criteria that no longer add up to the expert's decision. See Rubrics and criterion cards.
• Generic metrics. Off-the-shelf scores such as "helpfulness" or "coherence" give confidence that nothing justifies (Husain, 2025). Grow criteria from observed failures instead.
• Outsourced error analysis. Outsourcing the reading and coding of failure traces breaks the feedback loop that makes error analysis work (Husain, 2025); see Task distributions and dataset engineering.
• Unweighted suites. Unweighted reporting of a deliberately unbalanced suite is not a simplification; it is an estimate of a fictional user base. Reweight to the deployment mix and report the effective sample size; see Estimands, pass rates, and intervals.
• Optional stopping. Ending a comparison as soon as it crosses the significance line inflates the false-positive rate. Fix the sample size in advance or use a design built for sequential testing; see Comparing systems.

In practice#

Run a diagnostic pass over an evaluator, one layer at a time; each step ends with the entries it can expose.

1. Claim. Ask when the eval last changed a decision, and whether its items or close variants could have reached training data, prompts, tools, or fine-tuning. Eval theater, contamination.
2. Instrument. Read a sample of passing and failing transcripts: does every pass run through the actual work, and is every failure a real one rather than a valid strategy the grader did not expect? Grader gaming, rigid trajectory grading.
3. Regime. Name who optimizes against the signal, with what budget, and what they can change or see; check whether gains on the main score also appear on other benchmarks, on fresh slices, and in production; and for loops that learn from their own outputs, compare task and output diversity with the first iteration. Goodharting, reward hacking, wireheading, model collapse, diversity collapse.
4. Validation. Ask whether the evaluator and the system it judges share a model family or a data source, whether the supposedly independent channels miss the same cases, whether failures cluster in time or infrastructure, and whether every number carries n, an interval, slices, and a trend. Self-confirming loop, common-mode assurance, correlated trials, one-number reporting.
5. Lifecycle. Check what in the judge configuration changed since its last calibration, whether the evaluator still separates systems as they improve, what the anchor-burn ledger records, and whether recent successes are on work that still matters. Judge rot, saturation blindness, anchor leakage, frame lock-in.
6. Record. For every "yes" or "we don't know", write the anti-pattern, the tell you observed or the measurement you still need, the layer, and the response.

The artifact is a findings list keyed by anti-pattern. It becomes the risk register of an audit.

Common failure modes#

• Naming without a tell — "we have a Goodharting problem," with no measurement behind it → treat each name as a hypothesis until you observe its tell, and record the observation. See Goodharting.
• Fixing at the wrong layer — a stronger judge is proposed for a claim-layer or lifecycle failure → act at the entry's layer; even a flawless grader cannot fix a task aimed at the wrong capability. See frame lock-in.
• A one-time pass — the catalog is checked at launch and never again, while judges change and regimes migrate → rerun the diagnostic pass at every revalidation trigger. See judge rot.

Check yourself#

Analyze. Over six weeks of prompt iteration, a support agent's pass rate on a 200-task internal suite rose from 81% to 93%, while the share of tickets resolved without human follow-up stayed flat. Name three anti-patterns that could each produce this pattern, the tell that would separate them, and the layer where each lives.

Hint

Goodharting shows as divergence from a hidden anchor channel; contamination shows in the suite's provenance and in prompt examples; a construct or deployment mismatch shows as development and anchor channel rising together while production stays flat. One-number reporting hides which slices moved.

Evaluate. A reviewer argues that common-mode assurance is not a risk because the certification judge uses a different prompt from the development judge. Assess the argument.

Hint

A prompt is only one of the things channels can share; model family, training data, and evidence are others. What would the joint miss rate on adjudicated cases tell you that the prompt difference cannot?

Create. For a system you own, write the diagnostic question and the tripwire for each of the four lifecycle anti-patterns, and name who acts when each one fires.

Hint

Start from the divergence tripwires and the revalidation triggers in Living eval suites. A tripwire without an owner and an action is eval theater in miniature.

Further reading#

• Auditing an eval — the audit questions are the positive form of this catalog.
• Goodhart pressure and self-confirming loops — the optimization entries in depth, with generator and channel coupling.
• Living eval suites — tripwires, drift, and saturation as maintenance events.
• Glossary — every term, grouped by role, with the chapter that defines it.
• Chen, Wang & Qu (2026), "Recursive self-improvement in AI: From bounded self-refinement to autonomous research loops" — §5.3 on self-confirming loops, collapse, and diversity collapse in self-improving systems.