The Reference Is Part of the Signal: Structural Limits of Black-Box Sandbagging Detection

Black-box audits for sandbagging often compare a model's performance under evaluation cues with its performance under an ordinary-use reference. We establish that this reference is part of the signal: reference changes and suppression triggered whenever evaluation is present occupy the same cue direction. Any measurement invariant to arbitrary reference changes therefore discards this suppression component. We trace the practical consequences with a frozen, pre-registered structural statistic that achieves held-out AUROC 0.984 and detects an external sandbagger blind with an unflagged unlocked control. Changing only a harmless deployment preamble flips verdicts in 9 of 30 model configurations, including eight honest ones, while evaluation responses remain fixed. Reference variation exceeds question-sampling noise and extends to scalar performance-gap detectors. Reference removal discards a substantial component of the observed contrast; averaging retains honest false positives. Four models fine-tuned without a suppression objective reproduce the detected signature, two under every tested reference. Together, the theory and controlled experiments explain how strong ranking coexists with ambiguous attribution. They establish deployment framing as an explicit design choice in sandbagging audits and motivate a protocol combining reference sweeps, honest-control calibration and matched comparisons.