Anti-Gaming Mechanism Design

You want cheating to cost more than real ability. Bad news first: building a scoring scheme that cannot be gamed at all is mathematically impossible, so do not waste effort there. Under that ceiling, four things actually work, and the one with the most leverage is hiding the scoring logic, backed by an experiment showing a 43x difference. How to assemble these into an eval that holds up is in C03.

You learned in G01 that a good criterion is one a bad system cannot fake and a good system produces without effort. B11 said a ruler that is too simple cannot govern a complex system. Push both to the limit: can one ruler be both meaningful and completely impossible to exploit?

The answer is no, and two theorems together prove it. Social choice theory proved long ago that once there are more than three options and the rule is not dictatorial, then in any such scoring or ranking scheme, someone can always gain by misreporting. In 2026 this was pushed specifically onto rank aggregation, with the same conclusion: any meaningful ranking can be manipulated. AI has a matching proof: as long as your proxy reward is not a rigid constant, there necessarily exists a strategy that pushes the proxy up without improving the true objective at all. In other words, reward hacking cannot be eliminated in principle, only locally suppressed. Together the two nail down one thing: the goal of anti-gaming cannot be to build an ungameable metric, because no such thing exists.

Since perfection is out, all remaining effort goes into trade-offs across four fallbacks, each with a price:

• Restrict the domain: confine the problem to a small, unusually well-structured region where you can be airtight. The price is generality.
• Accept approximation: instead of chasing zero cheating, measure how much a cheater can gain at most and push that number down, treating it as something to optimize.
• Change the structure: make it impossible for the party being assessed to influence its own score. For instance, partition the review so that what you assess is isolated from anything affecting your own result, so no scoring choice of yours moves your own rank. The price is that the people who know the most may not review the most relevant items, so domain match degrades.
• Raise the cost of manipulation: audits, hidden items, scoring rules, making cheating simply expensive and not worth it.

That is all four. There is no fifth. Every fancy anti-gaming measure downstream is some combination of these, and the only difference is which price you are willing to pay for which one.

Within the fourth, the highest-leverage single move is hiding the scoring logic from the agent under test. This is not a hunch, there are numbers behind it. METR found in 2025 that the same set of frontier models cheated at a rate of 30.4% in an environment where the full scoring function was visible, and only 0.7% in an environment where the scoring logic was hidden. A factor of 43. Same models, same capabilities, and simply whether the scoring was visible moved the cheating rate by nearly two orders of magnitude. This says directly that cheating is a function of visible opportunity. That is exactly why "hide the scoring" turns from an intuition into a lever with numbers on it. To be clear, the 43x is not models getting 43 times worse, it is how strong the temptation is when the opportunity to cheat is laid out in front of them. Hide the scoring and the same model's cheating rate falls back under one percent.

Three supporting practices. First, random spot checks. You do not need to audit every output. As long as it is credible that any output might at any moment be pulled out for close inspection, the deterrence far exceeds the actual cost of checking. Tax research calls this the scarecrow effect. Second, randomized scoring and multiple crossing judges: shuffle positions, equalize length, put humans on key samples. This treats the familiar problem of a single model judge favouring its own outputs and favouring long answers. Third, ways to force honesty even without a gold answer: when ground truth becomes available afterwards, use a proper scoring rule so that honestly reporting your true confidence is the only profitable choice and misreporting confidence necessarily loses; when ground truth is simply unavailable, you can score one reviewer's judgement against another's, making truth-telling everyone's equilibrium. A caveat: these mechanisms all assume rational participants. In reality, both people and models go off the rails. Sufficiently hard pure optimization can overfit any scoring rule. So they raise costs; they do not give you immunity.

To put anti-gaming mechanisms on your eval, follow this list:

• Keep the scoring function and the details of the criteria invisible to the agent under test, publishing only which dimensions you test and by what method. Put that 43x on your side.
• Run unpredictable random human review on the steps easiest to exploit, using scarecrow-style deterrence. You do not have to check everything.
• Randomize scoring, use multiple judges, shuffle positions, equalize length. Do not let a single model judge decide.
• Use the partitioning idea so the assessed party cannot influence its own score, and never let an assessor assess itself.
• Use a proper scoring rule or peer prediction wherever you can, so misreporting loses in expectation.

One open question: each of the four fallbacks has a provable price, so is there a unified "manipulability budget" framework that puts the cost of conflicts of interest, the degree of approximate gaming resistance, and the overhead of hidden items and audits into one calculation of how much cheating I will tolerate and how much I will pay (in domain match, transparency, appealability), and optimizes all of it together? There is not one today. It is the last piece in collapsing the whole defensive line from G01 to G05 into a single computable objective.

The one-line takeaway: full gaming resistance is a dead end; what you can do is make cheating expensive and uncertain, and above all never let the tested party see how you score.