Harness-Agnostic Detection and Immunization of Reward Hacking in Self-Evolving Language Models

Self-evolving language models improve by proposing candidate updates and keeping whatever raises a visible score. When that score is an imperfect proxy for the capability one actually wants, sustained selection widens the gap between the two. This is reward hacking. We introduce HackProbe, a monitor that attaches to an arbitrary self-evolving loop through two black-box hooks, with no access to weights or activations. It keeps a secret, distribution-fixed comparison core, whose frozen distribution makes its capability proxy comparable across generations, alongside a rotated fresh layer that hardens the bank against co-adaptation. Four tests built on that proxy cover the level gap, a scale-aligned divergence with online change-point detection, capability stagnation, and a conditional confidently-wrong rate; a Šidák correction turns them into a calibrated family-wise $p$-value. Diagnosis alone recovers nothing, so a risk-aware immunization layer reselects an honest candidate from the proposal pool using the core together with a purely structural gaming footprint, disclosing at most ${\log }_2\Pi$ bits per generation to the host. We prove a detectability bound that converts a target error rate into an explicit probe-size budget, and we delimit what probe rotation does and does not buy. On a controlled prompt-level host with four injected hacking channels and ground-truth labels, HackProbe reaches $0.763$ AUROC against $0.663$ for the strongest baseline and cuts the false-positive rate from $0.706$ to $0.434$. Its bandwidth-limited reselection is the only immunization level that returns more true capability under hacking, $5.2$ points on average, than it forfeits on clean runs, $4.7$; per-channel effects are mostly not individually significant.