Anticipate failure modes

Reward hacking produces responses that look polished to the scorer without being correct. Sycophancy mirrors a user’s false premise; mode collapse makes every answer sound alike; over-refusal blocks benign requests; hidden evaluator leakage inflates results. Alignment can also be brittle under new languages or jailbreak framing. These are not all “hallucinations.” Give each failure a stage, trigger, observable symptom, consequence, and response. Precise names produce precise tests.

Use the chain trigger → earliest evidence → user impact → containment → prevention. The earliest evidence is especially valuable. If a user complaint is the first signal, detection arrived late. For a general-purpose chat model, inspect intermediate artifacts so a bad input, retrieval, model judgment, validation, or action can be distinguished.

| Failure class | Early signal | Immediate containment | Longer-term repair | |---|---|---|---| | Input or data shift | Segment distribution changes | Narrow scope | Improve parser/data contract | | Model or scoring error | Offline slice regresses | Fallback or review | Prompt/model/data change | | Resource exhaustion | Queue, memory, or p95 spike | Shed load | Capacity/control redesign | | Policy or privacy breach | Forbidden field/action appears | Stop and revoke | Minimize access and retest | | Coordination defect | Duplicate/stale artifacts | Freeze action | Version state and ownership |

Populate the rows with topic-specific signals, not generic red/yellow labels. A threshold should include a time window, minimum sample, segment, and owner.

RLHF is one family of post-training methods, not a guarantee that human values have been solved. Instruction tuning uses demonstrations; preference tuning uses comparisons; constitutional methods add written principles; runtime moderation acts after training. Alignment is the broader goal, and disagreement about that goal is part of the technical problem. Confusing neighboring concepts leads teams to repair the wrong layer. A polished answer can conceal missing evidence; a valid schema can contain false values; a successful tool call can perform the wrong authorized action. Validate content, structure, and consequence separately.

Correlated failures deserve special attention. Model-based judges may favor the same style as the model they score. Several agents may share one false assumption. Overlapping chunks may look like independent evidence. Repetition is not corroboration unless sources and failure paths are independent.

For each severe failure, define a stop condition and safe state. Rollback works only if old prompts, indexes, weights, and schemas remain available and compatible. A fallback must be tested under load. Human review needs queue capacity and enough context to decide; “send to a human” is not a complete control.

Practice one tabletop scenario: inject a realistic defect, verify detection, identify the owner, execute containment, and measure recovery time. Preserve the trace for a blameless review. The goal is not to claim failures are impossible but to reduce their frequency, blast radius, and time to recovery.