A verdict can remain correct while the specification fails its purpose. Verifying a result, validating the criterion and revising it are three different costs — and making the first cheap does not make the others cheap.
A machine can become better at passing a test without becoming better at what the test was meant to establish. The familiar explanation is that the test is an imperfect proxy. The less intuitive point is that nothing need go wrong with the test's execution: every verdict can remain correct on its own terms, and the failure lies entirely in what those terms were supposed to stand for.
The argument this one qualifies holds that the constraint on artificial self-improvement is not the generation of variants but their selection: variation can be made abundant and cheap almost anywhere, while selection compresses only where a verification criterion exists that is fast, reliable and cheap enough to sit inside the loop. From this a bifurcation follows. Where the criterion is constitutive — passing the test is succeeding, as when a flag is captured or a program runs — progress is deposited. Where the criterion is correlational — the test records properties statistically associated with success — optimizing against it can destroy the very relation that made it useful, and progress must be defended.
That argument closed on an observation worth returning to. Considering cryptographic attestation as the predictable response of correlational domains under pressure, it noted that the move works at a price: one manufactures a constitutive arbiter where no natural one existed, and to obtain it one changes the question. "Was this written by a human being?" becomes "was this produced by this identity through this attested chain?" The second predicate is not the first. That substitution was deliberate, and its virtue is that it is visible. What remains open is the case in which nobody changes the question — in which the question the arbiter answers was never quite the one that mattered, or has stopped being it, and nobody noticed because the arbiter always answered.
This is not new ground, and it is better to say so before entering it. Goodhart's law describes the general case. Manheim and Garrabrant distinguished four variants of it in 2018, and the one they call extremal — worlds in which the proxy takes an extreme value may be very different from the ordinary worlds in which the relationship between the proxy and the goal was observed — already covers the mechanism by which optimization leads out of the region where a simplified representation was adequate. Such a move is possible, not inevitable: the maxima of the proxy and of the objective may coincide. Krakovna ordered the layers of specification in 2019 — ideal, model, design, implementation, revealed — and placed specification gaming in the gap between the model specification, the best approximation a chosen formalism allows, and the design specification actually stated; with colleagues at DeepMind, in 2020, she defined it as satisfying the literal specification of an objective without achieving the intended outcome.
No additional failure mechanism is proposed here. What follows qualifies the bifurcation on one point, and then shifts attention to a cost that the Goodhart picture leaves implicit.
The bifurcation distinguished constitutive arbiters from correlational ones. The distinction holds, but it needs saying what it is a distinction of. Not of two kinds of device. Of two relations that the same device bears to two different objects.
A suite of unit tests is constitutive with respect to passing the benchmark: the test passes or it does not, and there is nothing to infer. The same suite is a proxy with respect to the ability to write software, which is what the benchmark was built to measure. A proof checker establishes that a derivation meets the rules of a formal system, assuming a sound implementation; it does not thereby establish that the theorem is worth proving. A publication count counts papers exactly while becoming a poor indicator of research quality, and the count need not falter when the relationship fails.
The consequence for the bifurcation is sharp. To say that progress is deposited in the constitutive regime is to say something true about the relation between the arbiter and its own specification — and nothing about the relation between the specification and the purpose. This does not mean the verdict carries no information about the purpose: a validated test can be strong evidence. It means the verdict does not, on its own, validate the relationship that makes it evidence. And this holds identically for a formal criterion and for a statistical proxy: a proxy that decays does not announce its own decay any more than a test that passes does. In both cases the missing information lies outside the verdict — not necessarily outside the system, which may contain further verifiers, outcome observations or cross-checks, but outside that one answer.
A constitutive arbiter, then, is not the purpose: it is a formalization of the purpose — a model specification in Krakovna's sense, or an implementation of one. What makes it consultable at near-zero cost, and therefore fit to sustain millions of iterations, is the reduction of a broad purpose to a decidable condition. The compression ratio is the source of the usefulness and cannot be removed without removing the device. Whether optimization then carries the system to where the formalization discarded information depends on how the formalization was built and on where the maxima lie. But it is a possibility the arbiter's own verdict is in no position to signal.
In 2026 OpenAI stopped reporting scores on SWE-bench Verified, a constitutively verified software engineering benchmark — the unit tests pass or they do not — and recommended alternatives. That was a decision about its own use of the benchmark, not a universal retirement. It rests on an audit whose numbers must be read together with the selection that produced them: of the benchmark's 500 tasks, 138 were examined, chosen because o3 had failed to solve them consistently across 64 independent runs. A sample selected on failures is enriched for defective tests by construction; the figures describe that sample, not the benchmark.
Of those 138 tasks, 59.4% carried material defects. 35.5% had tests that enforced implementation details and could reject functionally correct solutions; 18.8% had tests that checked functionality absent from the task description; 5.1% had other issues. All three percentages take the audited sample as denominator. And OpenAI is explicit on a point that matters here: the defects had been present since creation, residues the "Verified" curation had not removed. This is not a drift produced by optimization. It is a specification wrong from the outset, left in service for years.
That is exactly why the case is instructive. The arbiter issued binary, immediate, reproducible verdicts throughout. Its relation to its own specification was impeccable; its relation to the purpose was defective from the first day; and no verdict could say so. Suspicion arose from a flattening of scores — an ambiguous signal, since a flattening curve admits many explanations — and the diagnosis came from expert review conducted outside the criterion. The case does not show a purpose detaching under pressure. It shows how long a correct verdict can coexist with a wrong specification before someone pays the cost of looking.
The case of drift proper comes from training. In April 2026 Helff and colleagues examined models trained with verifiable rewards on inductive reasoning tasks — train classification on SLR-Bench, across four tiers of complexity, with models from the GPT-5, OLMo-3, Ministral and GPT-4 families — and showed that models trained under that regime can produce instance-specific labels that satisfy an extensional verifier without expressing the general rule the task asked for. They detect this with isomorphic perturbation: the same output is evaluated on a logically isomorphic task obtained by a bijective renaming of the object constants, with attribute constants left fixed. The test exposes reliance on particular identifiers; it does not inspect the model's internal knowledge directly. The authors distinguish explicitly between satisfying the verifier and acquiring the rule, and call a verifier that checks extensional consistency alone imperfect because it admits false positives with respect to the rule. It is the same distinction between two relations, seen from inside an experiment.
The paper contains a second result that limits what the first allows one to conclude, and it must be reported with equal prominence. In a controlled experiment, two versions of the same base model were trained under conditions identical except for the reward verifier. With the extensional verifier alone, the gap between extensional and isomorphic reward grows monotonically, reaching about 3.5 points after 500 steps on a scale whose maximum is 10: the drift exists, it is gradual, and the extensional verifier reports success throughout. With the isomorphic verifier inside the training loop, the gap stays near zero from beginning to end.
So drift under optimization is real and measured, and so is its prevention — in the studied setting, against the studied shortcut — by placing inside the loop a second check that varies the instance while preserving the intended task. The additional check need not be human, late or discontinuous. It can be automatic and continuous. On one condition, which is the point of everything that follows.
Three costs should be kept apart. Applying a verifier to a result. Establishing whether the verifier's criterion adequately serves the purpose. Revising the criterion, or its implementation, when it does not. In practice the three are often bundled; they remain different operations, and lowering one does not show that the others have fallen at the same rate. Software engineering has names for the first two — verification and validation, building the thing right and building the right thing — and the distinction is old precisely because the two costs come apart so easily.
Helff's second check is cheap because isomorphic variants of a train classification problem cost almost nothing to produce: constants are renamed, structure is preserved. Where validation can be obtained by transforming inputs and checking what should survive the transformation, it enters the loop as easily as verification does. Software is not outside this possibility. Metamorphic testing does the same for programs — MorphQ, for instance, generates quantum programs and applies transformations that should leave their behaviour unchanged, exposing defects in the Qiskit platform without anyone having specified the correct output in advance. Such methods provide real automated validation for the properties they cover, without establishing that every relevant property, or every user need, has been covered.
The boundary therefore does not run between code and everything else. It runs through domains, and through properties within a domain. Some properties admit cheap independent checks; others depend on observations that take time, on requirements not yet articulated, or on disagreement about what should count as success — and identifying a factual defect is a different problem from settling a contested purpose, even though both can hide behind a succession of passing verdicts. Nor does formalization guarantee cheap verification: decidable problems can still be expensive. The claim is narrower. It concerns settings where verification has already become cheap enough to sustain rapid iteration, while the adequacy of what is verified remains a separate question with a separate price.
The bifurcation observed that where selection cannot be automated it remains human and is paid for. Arbiter fidelity adds a qualification: what the constitutive regime automates cheaply is the verification of each result against the specification. The validation of the specification against the purpose is a separate line. Both can accelerate — better tools, automated cross-checks — and nothing in principle forbids them from accelerating together. But they need not, and where they do not the consequence is definite: results that pass accumulate faster than their pertinence can be assessed. The mismatch may have been present from the start, as with the benchmark, or become consequential only as search reaches new cases, as in training; in either case the number of formally successful results that pile up before it is identified grows with the gap between the two rates.
This is where the question meets evolutionary compression, and not before. What counts as correct software, as an interesting proof, as quality research, as acceptable behaviour — the specifications governing the domains in which capability grows fastest — is validated, where it is validated at all, by observation, by disagreement, by revised standards, by case law: processes that run at institutional speeds. In such domains the compression does not act on the optimization loop, which already runs at its own pace. It acts on the distance between the rate at which verified results accumulate and the rate at which anyone can check that the verification still means what it was taken to mean.
One consequence follows as a hypothesis rather than a law. The likely fate of arbiters is not scarcity but reuse beyond their established scope. Arbiters are abundant, well written and available; reusing one costs nothing, while validating it against a new purpose costs something and constructing a new one costs more. Reuse is individually rational, especially when the cost of a mismatch is uncertain or borne elsewhere, and so it spreads without anyone deciding on it. Here the distinction meets a point already fixed elsewhere: the arbiter does not choose the game. One may add that it does not remember why the game was chosen — and that, being faithful to its own specification, it outlives it.
The economic claim is conditional: among otherwise comparable systems — comparable optimization pressure, monitoring resources, incentives and access to feedback — raising the cost of obtaining and acting on independent evidence of a specification mismatch will tend to lengthen the time for which the mismatch persists. It can be tested. Introduce known mismatches into controlled tasks, vary the cost of an independent validation route, and record time to detection and time to correction separately, with both the onset of the mismatch and the available checks fixed in advance. If higher validation costs did not lengthen persistence across comparable conditions, or reliably shortened it, the hypothesis would fail. The two cases discussed here illustrate different routes to detecting a gap; they do not perform that test, and they do not show that differences in validation cost caused differences in detection time.
The conceptual point is narrower than the hypothesis and does not depend on it. Formal success and adequacy to purpose are different achievements. Cheap verification delivers the first without settling the second. The arbiter may remain faithful throughout; what still has to be defended is the reason for trusting its answer.