Freeze, Rewind, Fork: Making Flag-Triggered Interventions on Activation Monitors Measurable

Overview Activation probes can detect reward hacking while a model is still contemplating it. This raises an immediate operational dilemma: Intervening (stopping or steering): Destroys the very trajectory needed to evaluate whether the flag was accurate (censoring). Ignoring (letting it run): Allows the exploit to succeed. Because generation is stochastic, a flag only indicates a propensity—raising the probability of a hack rather than providing deterministic ground truth. The Protocol: Freeze, Rewind, Fork We address this measurement failure with two core principles: Acting on a flag censors its own label: Any monitor that intervenes becomes unmeasurable exactly where it matters most. Fork instead of stop: At the CUSUM alarm, generation state (KV cache and recurrent state) is frozen and rewound to the estimated onset. From this identical state, four branches are sampled using shared random streams (common random numbers): Branch A (Observed): Uninterrupted continuation to record the actual single-draw outcome. Branch B (Targeted Intervention): Clamps the activation projection to the honest mean. Branch C (Null / Replay): Rewound trajectory without intervention to certify exact replay fidelity (C ≡ A) and estimate P(HACK | state). Branch D (Placebo Control): Norm-matched perturbation along an orthogonal random direction to verify specificity. Key Estimands & Hardware Validation Measurable Metrics: The framework unifies flag calibration P(HACK | flag), causal intervention effect (B − C), specificity (B − D), and capability cost in a single measurement setup. Consumer Hardware Pilot: Mechanics validated on a single AMD Radeon RX 7900 XTX (ROCm). Branch C reproduced Branch A bit-exactly across 64/64 audits with sampling (C ≡ A). Pilot Observations: Demonstrates runtime monkey-patching under pressure on Qwen2.5-Coder-7B and explains why pre-execution early warnings structurally require an extended reasoning phase.