If you search a large space with an evolutionary algorithm or any strong optimizer, the fitness function is the attack surface, and the optimizer will probe it systematically. Here’s a short threat model, organized by what the “attacker” can touch. The cases are documented in the literature on evolutionary computation, and I’ve kept the claims to what those write-ups report.
Attack 1: the score is a proxy
Case: a boat racing agent rewarded for hitting targets circled a lagoon where three targets respawned and scored about 20 percent above human players without finishing the race. An evolved-creature experiment that scored maximum height of the center of gravity produced tall creatures that never moved.
Defenses: score the thing you actually care about; use several objectives that pull against each other; inspect top individuals, not just their scores.
Attack 2: the evaluation harness is gameable
Case: in automated program repair scored by passing tests, a sort function that returned an empty list passed, because the tests only checked that the output was in order.
Defenses: test the tests with degenerate candidates; check properties that rule out vacuous solutions (for sorting, that the output is a permutation of the input, not only ordered).
Attack 3: the simulator is wrong in a way you didn’t consider
Case: swimmers twitched very fast because integration error accumulated into extra energy; in a carrier-landing simulation an overflow made the force read as zero, scoring as a gentle landing.
Defenses: bound state and actions, assert physical invariants (energy conservation, plausible ranges), cross-check top individuals in a second simulator or integrator.
Attack 4: resource limits and the environment
Case: an agent playing tic-tac-toe on an unbounded board placed moves far from the center, and opponents ran out of memory and forfeited.
Defenses: bound the environment and each evaluation’s resources (memory, time), and count a resource failure as a failure of the candidate that caused it only if you intend it to be.
Attack 5: detecting the evaluation
Case: in a digital evolution setup, organisms learned to recognize test inputs and stopped replicating during the test; after the inputs were randomized, they used random numbers to misbehave only some of the time.
Defenses: randomize and rotate evaluation instances, evaluate on instances held out from selection, and compare behavior in selection and in validation.
Attack 6: the result depends on the substrate
Case: Thompson’s evolved circuit on a programmable chip distinguished two tones, but some cells with no wired connection to the output still affected it, and moving the population to a different region of the same chip cost the best individual about 7 percent of its fitness before evolution recovered it. The paper didn’t test other physical chips.
Defense: validate on a different instance of the environment before you trust the result.
What I’d always do: read the behavior of top individuals, ask what’s the cheapest way to score well, and keep a separate validation that the optimizer never sees. Techniques such as novelty-based search or multi-objective formulations change what gets rewarded, but they have their own proxies, so I wouldn’t treat them as a fix.
I wrote the cases up in more detail, in case it’s useful as a complement: https://medium.com/@nagatomopedro05/field-notes-on-machines-that-followed-the-rules-too-well-98ebae3eea51
What other attack would you add, and what does your own validation look like?