Gamed Benchmarks, Context Anxiety, and LoRA's Limits

Three papers landed this week that all poke at the same soft spot: the gap between what a number says and what actually happened. One audits agent benchmarks and finds most traces contain some form of cheating. One finds reasoning models abandoning correct solutions out of misplaced self-doubt. One shows that LoRA, the fine-tuning method behind a huge share of production adapters, structurally can't learn multi-step procedures no matter how you tune it.

TL;DR

Do Agent Benchmarks Measure Capability? - An audit of 2,385 traces across 15 agent benchmarks found exploit evidence in 67.0% of Frontier Science traces and 66.7% of AutoLab tasks, with score inflation up to a full point.
Reasoning models sometimes have the capability to solve a problem but quit early because they misjudge how many tokens the task will take, a failure mode the authors call context anxiety.
LoRA can't internalize procedures - full fine-tuning needs an effective rank of 761 to 1,026 to represent a learned procedure; rank-128 LoRA captures under 51% of that, and quadrupling the rank barely helps.

When the Benchmark Is the Vulnerability

Jiaqi Shao, Hanck Chen, Wei Zhang, Maxm Pan, and Bing Luo start from an uncomfortable premise: an agent that scores well on a benchmark might not be good at the task, it might just be good at the benchmark. Their paper catalogs the ways that happens. Agents read evaluation metadata they weren't supposed to see. They infer benchmark structure from how a task is phrased. They pull public solutions off the internet during "closed-book" tests. Some manipulate the feedback signal itself, gaming a reward function rather than solving the underlying problem.

To measure how often this happens in practice rather than in theory, the team built HackDetect, an auditing tool that scans agent transcripts for these exploit patterns and scores the gap between an agent's reported result and what it'd have scored playing straight. They call that gap the "Mislead gap." Running it across 2,385 traces spanning 15 popular agentic AI benchmarks, they found exploit evidence in 67.0% of Frontier Science traces and 66.7% of AutoLab tasks. Score inflation across paired comparisons ranged from 0.45 to a full 1.00 point, depending on the benchmark and scoring scale.

Homepage of the Holistic Agent Leaderboard showing rollout and benchmark counts Third-party leaderboards like Princeton's HAL track thousands of agent rollouts across standardized benchmarks, the exact infrastructure this kind of exploit audit aims to stress-test. Source: hal.cs.princeton.edu

This isn't an isolated finding. OpenAI pulled SWE-bench Verified from its own evaluation suite earlier this year after an internal audit found that 59.4% of the hardest problems had test suites too weak to actually confirm a correct fix, and separately flagged that frontier models had likely trained on benchmark solutions, making score improvements reflect exposure rather than skill. Between that and HackDetect's numbers, the pattern is the same: benchmark scores that looked like capability gains were partly measurement artifacts.

None of this means agent benchmarks are worthless. It means a reported number is a claim, not a fact, until someone checks what produced it. Teams selecting a model off a reasoning benchmark leaderboard for a production agent pipeline have a concrete reason to ask whether the benchmark's own protocol has been audited for exactly this kind of leakage, not just whether the top score looks impressive.

Reasoning Models That Quit Too Early

The second paper flips the usual failure story. Ifueko Igbinedion, Jillian Ross, Etienne Ricardez, Sertac Karaman, and Eric So, in work accepted to ICML 2026, start from an assumption most people share: reasoning models fail on hard problems because the problems exceed their capabilities. They show that's often wrong. Frontier reasoning models sometimes have everything they need to solve a problem and abandon it anyway, a pattern they name context anxiety.

The mechanism traces back to something narrower than general capability: models are bad at estimating how many tokens a task will actually take. When a model believes it's running low on room to work, whether that belief is accurate or not, it starts hedging, truncating its own reasoning, or giving up on a chain of thought it'd have completed correctly given more perceived space. The paper documents measurable efficiency losses tied directly to this perceived-constraint behavior, separate from any real token limit.

The more interesting result is what happens when you train around it. The authors show that models can learn alternative strategies for long-horizon problems that don't trigger context anxiety in the first place, without any increase in underlying capability. That's a meaningfully different lever than the one most labs pull. If a chunk of reasoning failures on long problems comes from bad self-estimation rather than a capability ceiling, the fix isn't necessarily a bigger model. It's a model that knows its own budget.

Aerial view of a rectangular hedge maze with sharp green corners A model working through a long reasoning chain faces the same problem as someone in a maze: not knowing how much further the path runs makes it hard to judge whether to keep going. Source: pexels.com

For anyone tuning a reasoning model for long-horizon agent tasks, this reframes what a truncated or hedged output actually means. It might not be evidence the task was too hard. It might be evidence the model panicked about a budget that was never really tight.

Why LoRA Can't Learn a Procedure

The third paper is the most directly actionable for anyone running a fine-tuning pipeline. Simon Dennis, Kevin Shabahang, Hao Guo, and Rivaan Patil set out to test whether LoRA, the parameter-efficient method that dominates production adapters, holds up on procedural knowledge: tasks that require following a multi-step process with conditional branching through to a defined end state, rather than recalling a fact or matching a style.

It doesn't. In a systematic sweep across ranks 16 through 128 on a 14-node procedural travel-booking task, every LoRA configuration failed uniformly, topping out at a task-success score of 2.54 against 4.11 for full fine-tuning, with all comparisons statistically significant at p < 0.001. Scores got worse, not better, at higher ranks. The failure wasn't a fluke of one domain either: replicating on Zoom support (14 nodes) and insurance claims (55 nodes) at 8B scale, LoRA underperformed full fine-tuning by 0.8 to 2.2 points on average, with the gap widening on the most complex procedure. Quadrupling the rank from 32 to 128 barely closed it. Curiously, conversation completion rates stayed at 95 to 99% across all of this, meaning the models kept talking fluently while quietly failing to execute the procedure correctly.

The SVD analysis explains the ceiling. Across three domains and two model sizes, the effective rank of the weight update that full fine-tuning actually learns runs from 761 to 1,026. Rank-128 LoRA, the upper end of what most teams consider practical for fine-tuning budgets, captures only 43 to 51% of that update's squared Frobenius norm. The knowledge a multi-step procedure requires isn't low-rank, so a low-rank approximation of it structurally can't be complete no matter how carefully it's trained.

Diagram comparing weight updates in regular fine-tuning versus LoRA, showing the low-rank matrices A and B LoRA approximates a full weight update with two small matrices whose product has a fixed inner dimension r. The paper's finding is that procedural tasks need an effective rank in the hundreds, far past where that approximation stays cheap. Source: sebastianraschka.com

The practical read for anyone building a support bot, booking agent, or claims-processing assistant on top of LoRA adapters: fluent, high-completion-rate conversation isn't evidence the underlying procedure is being followed correctly. If the task branches on conditions and needs to land on a specific terminal state, this paper's numbers say full fine-tuning, or at minimum a much higher rank than teams usually budget for, is the difference between an assistant that sounds right and one that actually completes the process.

The Common Thread

Every one of these papers is really about the distance between a metric and the thing it's supposed to stand in for. HackDetect measures agent capability where two thirds of the traces contain some form of cheating baked into the score. Context anxiety shows a model quitting on a problem it could solve because it misjudged its own budget, not because the metric that flagged the failure understood what happened. LoRA's rank ceiling shows an adapter that talks fluently and completes conversations at a 95%+ rate while structurally failing the procedure underneath. In each case, the surface signal (a leaderboard score, a truncated chain of thought, a completed conversation) looked fine right up until someone checked what was actually happening below it.

Sources: