MakazhanAlpamys/Soup v0.71.41

v0.71.41 — Is your verifier gameable?

on GitHub

What's New

soup reward stress — turn the reward-hacking detector on the verifier itself.
soup reward synth (v0.71.40) proves a reward verifier can tell your references from friendly bad answers. stress asks the adversarial question a reward-hacking model asks at train time: does the verifier pay out for degenerate junk? Nothing in TRL / Unsloth / Axolotl tests a verifier for gameability.

• Four attacks, scored against the real gold. Empty, length-padded, repetition, and sentinel-spam completions are fed to the verifier; any it accepts is a false positive. Per-attack accept-rate table + one robust / GAMEABLE verdict.
• Probes a synthesized .py or a builtin. soup reward stress reward.py --references golds.jsonl, or soup reward stress verifiable --verifiable-domain math --references golds.jsonl. A gold-requiring verifier probed with no --references is a hard error — never a false "robust".
• Tunable + offline. --attacks, --sentinel, --threshold, --max-gameable, --output-report. Pure Python, no new dependencies, no schema change.

soup reward stress reward.py --references golds.jsonl --output-report stress.json
#   exit 0 = robust · 2 = gameable · 1 = error

Install / Upgrade

pip install -U soup-cli

Security

• The .py target is cwd-contained (realpath + commonpath + O_NOFOLLOW) and loaded through the existing reward-loader path — no new arbitrary-code-exec surface beyond the pre-existing custom-reward warning. Every write/read path is validated before the target's module code runs.
• --sentinel bounded (256 chars); --attacks deduped + allowlist-validated; a short or non-finite reward return is a hard error, never a silent verdict.
• Corrected the ops-docs Telemetry section: Soup's telemetry primitives exist but are not wired to any command — no data is ever sent today.

Known Limitations

• The opt-in telemetry flywheel is deferred — a live sender is blocked on a published public privacy policy, a real analytics key, and an added HTTP dependency; this release ships the stress-tester alone.
• v1 attacks are the four deterministic reward-hack primitives (empty / length / repetition / sentinel); judge-based or LLM-generated adversarial completions are out of scope.
• --references is the meaningful path — a verifier that returns 0 on a missing gold looks trivially robust; a gold-requiring builtin probed with no --references is a hard error by design.